Merge tag 'pull-misc-20250924' of https://gitlab.com/rth7680/qemu into staging

hw/pci-host/{dino,astro}: Don't call pci_register_root_bus() in init
target/sparc: Loosen various decode for v7
linux-user: Add syscall dispatch support
tcg/optimize: Fix folding of vector bitsel
include/hw/core/cpu: Introduce MMUIdxMap
include/hw/core/cpu: Introduce cpu_tlb_fast
include/hw/core/cpu: Invert the indexing into CPUTLBDescFast
accel/tcg: Remove dead mmap_unlock() call in invalidate_phys_page_range
accel/tcg: Remove cpu_loop_exit_restore() stub
accel/tcg: Properly unlink a TB linked to itself
accel/tcg: Introduce and use tb_flush__exclusive_or_serial

# -----BEGIN PGP SIGNATURE-----
#
# iQFRBAABCgA7FiEEekgeeIaLTbaoWgXAZN846K9+IV8FAmjUP5MdHHJpY2hhcmQu
# aGVuZGVyc29uQGxpbmFyby5vcmcACgkQZN846K9+IV/qEwgAt6uSXMVTXykr6uxW
# 321nMEMEB2Av5LHQwvgRW/BOAWCKDNtxHHn3tcfvOLKcFHR+agZqTHBvOKGgPGSo
# fPkoHRMlcb3pKxhttX66qZhDiaMNRALtajVNkelKUso4BtESkW1v4yQVNLr1Rk6+
# f/xg4noX2gSh56VDMGLgcTR5wvTNycTIq3909zPmO4YPVQjwUPSYkB227LyBRLYg
# R6EQOzn45oQuFfMYukjNQczibkZ7NV8mW7XmbfiMXwvK1yA/F75eN+B9sJKqS44d
# ww/rurQdIYZFwPPPqz3XZmztg0n9syE9VHkliYmAoJRtbgc0obQHt9M7UfLwW2TM
# NXYlNw==
# =HVcw
# -----END PGP SIGNATURE-----
# gpg: Signature made Wed 24 Sep 2025 11:59:31 AM PDT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [ultimate]

* tag 'pull-misc-20250924' of https://gitlab.com/rth7680/qemu: (32 commits)
  accel/tcg: Remove cpu_loop_exit_restore() stub
  accel/tcg: Remove dead mmap_unlock() call in invalidate_phys_page_range
  accel/tcg: Improve buffer overflow in tb_gen_code
  accel/tcg: Create queue_tb_flush from tb_flush
  linux-user: Split out begin_parallel_context
  plugins: Use tb_flush__exclusive_or_serial
  accel/tcg: Move post-load tb_flush to vm_change_state hook
  accel/tcg: Split out tb_flush__exclusive_or_serial
  hw/ppc/spapr: Use tb_invalidate_phys_range in h_page_init
  target/riscv: Record misa_ext in TCGTBCPUState.cs_base
  target/alpha: Simplify call_pal implementation
  gdbstub: Remove tb_flush uses
  tests/tcg/multiarch: Add tb-link test
  accel/tcg: Properly unlink a TB linked to itself
  target/hppa: Adjust mmu indexes to begin with 0
  include/hw/core/cpu: Invert the indexing into CPUTLBDescFast
  include/hw/core/cpu: Introduce cpu_tlb_fast
  include/hw/core/cpu: Introduce MMUIdxMap
  tcg/optimize: Fix folding of vector bitsel
  hw/pci-host/astro: Don't call pci_regsiter_root_bus() in init
  ...

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

2 files changed, 69 insertions, 0 deletions

diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index 8dc65d7a06..f5b4d2b813 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -46,6 +46,8 @@ vma-pthread: LDFLAGS+=-pthread
 sigreturn-sigmask: CFLAGS+=-pthread
 sigreturn-sigmask: LDFLAGS+=-pthread
 
+tb-link: LDFLAGS+=-lpthread
+
 # GCC versions 12/13/14/15 at least incorrectly complain about
 # "'SHA1Transform' reading 64 bytes from a region of size 0"; see the gcc bug
 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106709
diff --git a/tests/tcg/multiarch/tb-link.c b/tests/tcg/multiarch/tb-link.c
new file mode 100644
index 0000000000..4e40306fa1
--- /dev/null
+++ b/tests/tcg/multiarch/tb-link.c
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Verify that a single TB spin-loop is properly invalidated,
+ * releasing the thread from the spin-loop.
+ */
+
+#include <assert.h>
+#include <sys/mman.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <sched.h>
+
+
+#ifdef __x86_64__
+#define READY   0x000047c6      /* movb $0,0(%rdi) */
+#define LOOP    0xfceb9090      /* 1: nop*2; jmp 1b */
+#define RETURN  0x909090c3      /* ret; nop*3 */
+#define NOP     0x90909090      /* nop*4 */
+#elif defined(__aarch64__)
+#define READY   0x3900001f      /* strb wzr,[x0] */
+#define LOOP    0x14000000      /* b . */
+#define RETURN  0xd65f03c0      /* ret */
+#define NOP     0xd503201f      /* nop */
+#elif defined(__riscv)
+#define READY   0x00050023      /* sb zero, (a0) */
+#define LOOP    0x0000006f      /* jal zero, #0 */
+#define RETURN  0x00008067      /* jalr zero, ra, 0 */
+#define NOP     0x00000013      /* nop */
+#endif
+
+
+int main()
+{
+#ifdef READY
+    int tmp;
+    pthread_t thread_id;
+    bool hold = true;
+    uint32_t *buf;
+
+    buf = mmap(NULL, 3 * sizeof(uint32_t),
+               PROT_READ | PROT_WRITE | PROT_EXEC,
+               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    assert(buf != MAP_FAILED);
+
+    buf[0] = READY;
+    buf[1] = LOOP;
+    buf[2] = RETURN;
+
+    alarm(2);
+
+    tmp = pthread_create(&thread_id, NULL, (void *(*)(void *))buf, &hold);
+    assert(tmp == 0);
+
+    while (hold) {
+        sched_yield();
+    }
+
+    buf[1] = NOP;
+    __builtin___clear_cache(&buf[1], &buf[2]);
+
+    tmp = pthread_join(thread_id, NULL);
+    assert(tmp == 0);
+#endif
+    return 0;
+}