[Qemu-commits] [qemu/qemu] ae52e5: s390/ioinst: fix IO_INT_WORD_ISC macro

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: ae52e585bf5e9678a77be033fd4b430a2e78dfed
      
https://github.com/qemu/qemu/commit/ae52e585bf5e9678a77be033fd4b430a2e78dfed
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/ioinst.h

  Log Message:
  -----------
  s390/ioinst: fix IO_INT_WORD_ISC macro

The I/O-Interruption Subclass field corresponds to bits 2 to 5 (BE
notation) of the Interruption-Identification Word. The value should
be shift by 27 instead of 24.

Signed-off-by: Aurelien Jarno <address@hidden>
Reviewed-by: Christian Borntraeger <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: d49f4ab48ec76e590ad72a2d6c3fba8459d3ded7
      
https://github.com/qemu/qemu/commit/d49f4ab48ec76e590ad72a2d6c3fba8459d3ded7
  Author: Alexander Graf <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/ioinst.c

  Log Message:
  -----------
  s390/ioinst: fix endianness in ioinst_schib_valid

The ioinst_schib_valid gets a SCHIB in guest endianness, we should
byteswap the fields we access.

Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: a499973ff32bc58f2db7b88ad5597ffdbc2becd7
      
https://github.com/qemu/qemu/commit/a499973ff32bc58f2db7b88ad5597ffdbc2becd7
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M hw/s390x/virtio-ccw.c
    M target-s390x/cpu.h

  Log Message:
  -----------
  virtio-ccw: disable ioevent bit when ioeventfds are not enabled

This remove the corresponding error messages in TCG mode, and allow to
simplify the s390_assign_subch_ioeventfd() function.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 06e3c077daa08c0a616e9507eb737401883ab645
      
https://github.com/qemu/qemu/commit/06e3c077daa08c0a616e9507eb737401883ab645
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.h

  Log Message:
  -----------
  target-s390x: fix setcc in TCG mode

In TCG mode we should store the CC value in env->cc_op. However do it
inconditionnaly because:
- the tcg_enabled function is not inlined
- it's probably faster to always store the value, especially given it
  is likely in the same cache line than env->psw.mask.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 7107e5a756317151666d47d1bc1e170293babaff
      
https://github.com/qemu/qemu/commit/7107e5a756317151666d47d1bc1e170293babaff
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.c

  Log Message:
  -----------
  target-s390x: correctly initialize ext interrupt queue

env->ext_index should be initialized to -1 to mark the external
interrupt queue as emtpy. This should not be done in s390_cpu_initfn
as all the interrupt fields are later reset to 0 by the memset in
s390_cpu_initial_reset or s390_cpu_full_reset. Move the initialization
there.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: cc0d079d4582ee0ed97b5e3e3da4f6cb2b5bd67f
      
https://github.com/qemu/qemu/commit/cc0d079d4582ee0ed97b5e3e3da4f6cb2b5bd67f
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.c

  Log Message:
  -----------
  target-s390x: initialize I/O interrupt queue

env->io_index[] should be set to -1 during CPU reset to mark the
I/O interrupt queue as empty.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: cbed0ba78f04ce9e2e718431f64eb4b621288aca
      
https://github.com/qemu/qemu/commit/cbed0ba78f04ce9e2e718431f64eb4b621288aca
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.c

  Log Message:
  -----------
  target-s390x: fix s390_cpu_initial_reset

The s390_cpu_initial_reset function zeroes a big part of the CPU state
structure, including CPU_COMMON, and thus the QEMU TLB structure. As
they should not be initialized with zeroes only, we need to call the
tlb_flush to initialize it correctly.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 8df7eef3059394bd53cdf7609aac9a50a78aa030
      
https://github.com/qemu/qemu/commit/8df7eef3059394bd53cdf7609aac9a50a78aa030
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/helper.h
    M target-s390x/insn-data.def
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: wire up DIAG IPL in TCG mode

DIAG IPL is already implemented for KVM, but not wired from TCG. For
that change the format of the instruction so that we can get R1 and R3
numbers in addition to the function code.

The diag function can change plenty of things, including CC, so we
should enter with a static CC. Also it doesn't set the value of general
register 2 to 0 as in the current code. We also need to exit the CPU
loop after a reset, which means a new PSW.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 2ecacb0b4b6c73af424b7b4389fa55809368a98b
      
https://github.com/qemu/qemu/commit/2ecacb0b4b6c73af424b7b4389fa55809368a98b
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/misc_helper.c

  Log Message:
  -----------
  target-s390x: wire up DIAG REIPL in TCG mode

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: ad8a4570add09a7635cb8cd1c9327640521ee7a7
      
https://github.com/qemu/qemu/commit/ad8a4570add09a7635cb8cd1c9327640521ee7a7
  Author: Alexander Graf <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/helper.h
    M target-s390x/insn-data.def
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: wire up I/O instructions in TCG mode

The code handling the I/O instructions for KVM decodes the instruction
itself. In TCG mode also pass the full instruction word to the helpers.

Signed-off-by: Alexander Graf <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 2e83c496261c799b0fe6b8e18ac80cdc0a5c97ce
      
https://github.com/qemu/qemu/commit/2e83c496261c799b0fe6b8e18ac80cdc0a5c97ce
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M include/exec/cpu_ldst.h

  Log Message:
  -----------
  softmmu: provide tlb_vaddr_to_host function for user mode

To avoid to many #ifdef in target code, provide a tlb_vaddr_to_host for
both user and softmmu modes. In the first case the function always
succeed and just call the g2h function.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: d7ce6b7a0ba4328a286d09d96395a8fc2fd6943c
      
https://github.com/qemu/qemu/commit/d7ce6b7a0ba4328a286d09d96395a8fc2fd6943c
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/mem_helper.c

  Log Message:
  -----------
  target-s390x: function to adjust the length wrt page boundary

This patch adds a function to adjust the length of a transfer so that
it doesn't cross a page boundary in softmmu mode. It does nothing in
user mode.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: fc89efe693278c79273f3bbf6b581e8a749c85b0
      
https://github.com/qemu/qemu/commit/fc89efe693278c79273f3bbf6b581e8a749c85b0
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/mem_helper.c

  Log Message:
  -----------
  target-s390x: mvc_fast_memset: access memory through softmmu

mvc_fast_memset is bypassing the softmmu functions, getting the
physical address using the mmu_translate function and accessing the
corresponding physical memory. This prevents watchpoints to work
correctly.

Instead use the tlb_vaddr_to_host function to get the host address
corresponding to the guest address through the softmmu code and fallback
to the byte level code in case the corresponding address is not in the
QEMU TLB or being examined through a watchpoint. As a bonus it works
even for area crossing pages by splitting the are into chunks contained
in a single page, bringing some performances improvements.

At the same time change the name of the function to fast_memset as it's
not specific to mvc and use the same argument order as the C memset
function.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 6da528d14de29138ca5ac43d6d059889dd24f464
      
https://github.com/qemu/qemu/commit/6da528d14de29138ca5ac43d6d059889dd24f464
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/mem_helper.c

  Log Message:
  -----------
  target-s390x: mvc_fast_memmove: access memory through softmmu

mvc_fast_memmove is bypassing the softmmu functions, getting the
physical source and destination addresses using the mmu_translate
function and accessing the corresponding physical memory. This
prevents watchpoints to work correctly.

Instead use the tlb_vaddr_to_host function to get the host addresses
corresponding to the guest source and destination addresses through the
softmmu code and fallback to the byte level code in case the
corresponding address are not in the QEMU TLB or being examined through
a watchpoint. As a bonus it works even for area crossing pages by
splitting the are into chunks contained in a single page, bringing some
performances improvements. We can therefore remove the 8-byte
loads/stores method, as it is now quite unlikely to be used.

At the same time change the name of the function to fast_memmove as it's
not specific to mvc and use the same argument order as the C memmove
function.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: fb01bf4c6b86d9ac00ea87d60f97871ee1488188
      
https://github.com/qemu/qemu/commit/fb01bf4c6b86d9ac00ea87d60f97871ee1488188
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.h

  Log Message:
  -----------
  target-s390x: add PER related constants

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: a8f931a931f8866abdb2f836d0fb6fb7d2606645
      
https://github.com/qemu/qemu/commit/a8f931a931f8866abdb2f836d0fb6fb7d2606645
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.h

  Log Message:
  -----------
  target-s390x: add get_per_atmid function

This function returns the ATMID field that is stored in the
per_perc_atmid lowcore entry.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: d453d103831c966e7920f146eb3416e43b588f89
      
https://github.com/qemu/qemu/commit/d453d103831c966e7920f146eb3416e43b588f89
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.h

  Log Message:
  -----------
  target-s390x: add get_per_in_range function

This function checks if an address is in between the PER starting
address and the PER ending address, taking care of a possible
address range loop.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 777c98c32ce577a9671b9267ff6e2802f69ebafd
      
https://github.com/qemu/qemu/commit/777c98c32ce577a9671b9267ff6e2802f69ebafd
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.h
    M target-s390x/helper.c
    M target-s390x/helper.h
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: basic PER event handling

This patch add basic support to generate PER exceptions. It adds two
fields to the cpu structure to record for the PER address and PER
code & ATMID values. When an exception is triggered and a PER event is
pending, the two PER values are copied to the lowcore area.

At the end of an instruction, an helper is checking for a possible
pending PER event and triggers an exception in that case. For that to
work with branches, we need to disable TB chaining when PER is
activated. Fortunately it's already in the TB flags.

Finally in case of a SERVICE CALL exception, we need to trigger the PER
exception immediately after.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 2c2275eb41c612df4bd115cf71d6e651d105f69c
      
https://github.com/qemu/qemu/commit/2c2275eb41c612df4bd115cf71d6e651d105f69c
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/helper.h
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: PER successful-branching event support

For the PER successful-branching event support, we can't rely on any
QEMU infrastucture. We therefore call an helper in all places where
a branch can be taken. We have to pay attention to the branch to next
case, as it's still a taken branch.

We don't need to care about the cases using goto_tb, as we have disabled
them in the previous patch.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: f0e0d817c22539cd2ce1bcb5487e076f117b04c0
      
https://github.com/qemu/qemu/commit/f0e0d817c22539cd2ce1bcb5487e076f117b04c0
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/helper.h
    M target-s390x/misc_helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: PER instruction-fetch event support

For the PER instruction-fetch, we can't use the QEMU breakpoint
infrastructure as it triggers for a single address and not a full
address range, and as it actually stop before the instruction and
not before.

We therefore call an helper with the just fetched instruction address,
which check if the address is within the PER address range. If it is
the case, an event is recorded and will be signaled through an
exception.

Note that we implement here the PER-3 behaviour, that is an invalid
opcode is not considered as an instruction fetch. Without PER-3 this
behavious is undefined.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 8d302e76755b8157373073d7107e31b0b13f80c1
      
https://github.com/qemu/qemu/commit/8d302e76755b8157373073d7107e31b0b13f80c1
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M translate-all.c

  Log Message:
  -----------
  translate-all: fix watchpoints if retranslation not possible

The tb_check_watchpoint function currently assumes that all memory
access is done either directly through the TCG code or through an
helper which knows its return address. This is obviously wrong as the
helpers use cpu_ldxx/stxx_data functions to access the memory.

Instead of aborting in that case, don't try to retranslate the code, but
assume that the CPU state (and especially the program counter) has been
saved before calling the helper. Then invalidate the TB based on this
address.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 311918b979c5364c30392c1054ed77d047a83953
      
https://github.com/qemu/qemu/commit/311918b979c5364c30392c1054ed77d047a83953
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu-qom.h
    M target-s390x/cpu.c
    M target-s390x/cpu.h
    M target-s390x/helper.c
    M target-s390x/mem_helper.c

  Log Message:
  -----------
  target-s390x: PER storage-alteration event support

For the PER storage-alteration event we can use the QEMU watchpoint
infrastructure. When PER is enabled or PER control register changed we
enable the corresponding watchpoints. When a watchpoint arises we can
save the event. Unfortunately the current code does not provide the
address space used to trigger the watchpoint. For now we assume it comes
from the default ASC.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 2f54394997bfc808bbfbebb2d8294edd17d63808
      
https://github.com/qemu/qemu/commit/2f54394997bfc808bbfbebb2d8294edd17d63808
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/mem_helper.c

  Log Message:
  -----------
  target-s390x: PER store-using-real-address event support

This PER event happens each time the STURA or STURG instructions are
used. As they use helpers, we can just save the event in the PER code
there, if enabled.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 83bb161299c019e25a3add59504f0b69e6257dcd
      
https://github.com/qemu/qemu/commit/83bb161299c019e25a3add59504f0b69e6257dcd
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/misc_helper.c

  Log Message:
  -----------
  target-s390x: PER instruction-fetch nullification event support

For the instruction-fetch nullification event, we just reuse the
existing instruction-fetch code and trigger the exception immediately
in that case.

There is no need to save the CPU state in the TCG code as it has been
saved by the previous instruction before calling the per_check_exception
helper.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 3da0ab35292fe93640cfdd95aa8bedec8f145d2c
      
https://github.com/qemu/qemu/commit/3da0ab35292fe93640cfdd95aa8bedec8f145d2c
  Author: Aurelien Jarno <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M target-s390x/cpu.c
    M target-s390x/cpu.h
    M target-s390x/helper.c
    M target-s390x/translate.c

  Log Message:
  -----------
  target-s390x: PER: add Breaking-Event-Address register

This patch adds support for PER Breaking-Event-Address register. Like
real hardware, it save the current PSW address when the PSW address is
changed by an instruction. We have to take care of optimizations QEMU
does, a branch to the next instruction is still a branch.

This register is copied to low core memory when a program exception
happens.

Signed-off-by: Aurelien Jarno <address@hidden>
Signed-off-by: Alexander Graf <address@hidden>


  Commit: 1f68f1d36c3af09ed31a529ad69c3d09880d10fd
      
https://github.com/qemu/qemu/commit/1f68f1d36c3af09ed31a529ad69c3d09880d10fd
  Author: Alexander Graf <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M blockdev.c
    M hw/s390x/s390-virtio-ccw.c
    M hw/s390x/s390-virtio.c
    M qdev-monitor.c

  Log Message:
  -----------
  s390x: Switch to s390-ccw machine as default

We now finally have TCG support for the basic set of instructions necessary
to run the s390-ccw machine. That means in any aspect possible that machine
type is now superior to the legacy s390-virtio machine.

Switch over to the ccw machine as default. That way people don't get a halfway
broken machine with the s390x target.

Signed-off-by: Alexander Graf <address@hidden>
Reviewed-by: Aurelien Jarno <address@hidden>
Acked-by: Christian Borntraeger <address@hidden>


  Commit: f754c3c9cce3c4789733d9068394be4256dfe6a8
      
https://github.com/qemu/qemu/commit/f754c3c9cce3c4789733d9068394be4256dfe6a8
  Author: Peter Maydell <address@hidden>
  Date:   2015-06-17 (Wed, 17 Jun 2015)

  Changed paths:
    M blockdev.c
    M hw/s390x/s390-virtio-ccw.c
    M hw/s390x/s390-virtio.c
    M hw/s390x/virtio-ccw.c
    M include/exec/cpu_ldst.h
    M qdev-monitor.c
    M target-s390x/cpu-qom.h
    M target-s390x/cpu.c
    M target-s390x/cpu.h
    M target-s390x/helper.c
    M target-s390x/helper.h
    M target-s390x/insn-data.def
    M target-s390x/ioinst.c
    M target-s390x/ioinst.h
    M target-s390x/mem_helper.c
    M target-s390x/misc_helper.c
    M target-s390x/translate.c
    M translate-all.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/agraf/tags/signed-s390-for-upstream' 
into staging

Patch queue for s390 - 2015-06-17

This is a special one. Two awesome features in one pull request:

  - CCW support for TCG
  - Watchpoint support for TCG

To celebrate this, we also switch the default machine model from s390-virtio
to s390-ccw and give users a fully working s390x model again!

# gpg: Signature made Wed Jun 17 11:42:26 2015 BST using RSA key ID 03FEDC60
# gpg: Good signature from "Alexander Graf <address@hidden>"
# gpg:                 aka "Alexander Graf <address@hidden>"

* remotes/agraf/tags/signed-s390-for-upstream: (26 commits)
  s390x: Switch to s390-ccw machine as default
  target-s390x: PER: add Breaking-Event-Address register
  target-s390x: PER instruction-fetch nullification event support
  target-s390x: PER store-using-real-address event support
  target-s390x: PER storage-alteration event support
  translate-all: fix watchpoints if retranslation not possible
  target-s390x: PER instruction-fetch event support
  target-s390x: PER successful-branching event support
  target-s390x: basic PER event handling
  target-s390x: add get_per_in_range function
  target-s390x: add get_per_atmid function
  target-s390x: add PER related constants
  target-s390x: mvc_fast_memmove: access memory through softmmu
  target-s390x: mvc_fast_memset: access memory through softmmu
  target-s390x: function to adjust the length wrt page boundary
  softmmu: provide tlb_vaddr_to_host function for user mode
  target-s390x: wire up I/O instructions in TCG mode
  target-s390x: wire up DIAG REIPL in TCG mode
  target-s390x: wire up DIAG IPL in TCG mode
  target-s390x: fix s390_cpu_initial_reset
  ...

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/a09f4a9d19c5...f754c3c9cce3