qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 937de9: vga: use common endian swap macros


From: Peter Maydell
Subject: [Qemu-commits] [qemu/qemu] 937de9: vga: use common endian swap macros
Date: Fri, 19 Jan 2024 03:40:10 -0800

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: 937de9a981a86be1e002cff58f02272610708fbb
      
https://github.com/qemu/qemu/commit/937de9a981a86be1e002cff58f02272610708fbb
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/vga.c

  Log Message:
  -----------
  vga: use common endian swap macros

The constant-expression bswap is provided by const_le32(), and GET_PLANE()
can also be implemented using cpu_to_le32().  Remove the custom macros in
vga.c.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: f9b925fd41337027e959baeb23d714b5214cd5ff
      
https://github.com/qemu/qemu/commit/f9b925fd41337027e959baeb23d714b5214cd5ff
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/cirrus_vga.c
    M hw/display/vga.c
    M hw/display/vga_int.h

  Log Message:
  -----------
  vga: introduce VGADisplayParams

The next patches will introduce more parameters that cause a full
refresh.  Instead of adding arguments to get_offsets and lines to
update_basic_params, do everything through a struct.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 9b53b95a1c3b46e5a54734a46f37790460c9265e
      
https://github.com/qemu/qemu/commit/9b53b95a1c3b46e5a54734a46f37790460c9265e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/vga-helpers.h
    M hw/display/vga.c

  Log Message:
  -----------
  vga: mask addresses in non-VESA modes to 256k

This allows setting the start address to a high value, and reading the
bottom of the screen from the beginning of VRAM.  Commander Keen 4
("Goodbye, Galaxy!") relies on this behavior.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 973a724eb006f674301a0c45f34b3c08dee0fe49
      
https://github.com/qemu/qemu/commit/973a724eb006f674301a0c45f34b3c08dee0fe49
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/cirrus_vga.c
    M hw/display/vga-helpers.h
    M hw/display/vga.c
    M hw/display/vga_int.h

  Log Message:
  -----------
  vga: implement horizontal pel panning in graphics modes

This implements smooth scrolling, as used for example by Commander Keen
and Second Reality.

Unfortunately, this is not enough to avoid tearing in Commander Keen,
because sometimes the wrong start address is used for a frame.
On real EGA, the panning register is sampled on every line, while
the display start is latched for the next frame at the start of the
vertical retrace.  On real VGA, the panning register is also latched,
but at the end of the vertical retrace.  It looks like Keen exploits
this by only waiting for horizontal retrace when setting the display
start, but implementing it breaks the 256-color Keen games...

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 4d6c310502a4d825ae27a3bf8905e70447d74671
      
https://github.com/qemu/qemu/commit/4d6c310502a4d825ae27a3bf8905e70447d74671
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/vga-helpers.h

  Log Message:
  -----------
  vga: optimize horizontal pel panning in 256-color modes

Do not go through the panning buffer unless the address wraps in the middle
of the line.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: ae9d71a003c8cfd2f035c8f768341a40bcef8ed4
      
https://github.com/qemu/qemu/commit/ae9d71a003c8cfd2f035c8f768341a40bcef8ed4
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/vga.c

  Log Message:
  -----------
  vga: reindent memory access code

The next patch will reuse latched memory access in text modes.  Start with
a patch that moves the latched access code out of the "if".

Best reviewed with "git diff -b".

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 3f83435042af241ea8773d04ef3726ce4146bfca
      
https://github.com/qemu/qemu/commit/3f83435042af241ea8773d04ef3726ce4146bfca
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/vga.c

  Log Message:
  -----------
  vga: use latches in odd/even mode too

Jazz Jackrabbit uses odd/even mode with 256-color graphics.  This is
probably so that it can do very fast blitting with a decent resolution
(two pixels, compared to four pixels for "regular" mode X).

Accesses still use all planes (reads go to the latches and the game uses
read mode 1 so that the CPU always gets 0xFF; writes use the plane mask
register because the game sets bit 2 of the sequencer's memory mode
register).  For this to work, QEMU needs to use the code for latched
memory accesses in odd/even mode.  The only difference between odd/even
mode and "regular" planar mode is how the plane is computed in read mode
0, and how the planes are masked if the aforementioned bit 2 is reset.

It is almost enough to fix the game.  You also need to honor byte/word
mode selection, which is done in the next patch.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 435262605fa2737af73b7057f525f8fe221c1006
      
https://github.com/qemu/qemu/commit/435262605fa2737af73b7057f525f8fe221c1006
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M hw/display/vga.c
    M hw/display/vga_regs.h

  Log Message:
  -----------
  vga: sort-of implement word and double-word access modes

Jazz Jackrabbit has a very unusual VGA setup, where it uses odd/even mode
with 256-color graphics.  Probably, it wants to use fast VRAM-to-VRAM
copies without having to store 4 copies of the sprites as needed in mode
X, one for each mod-4 alignment; odd/even mode simplifies the code a
lot if it's okay to place on a 160-pixels horizontal grid.

At the same time, because it wants to use double buffering (a la "mode X")
it uses byte mode, not word mode as is the case in text modes.  In order
to implement the combination of odd/even mode (plane number comes from
bit 0 of the address) and byte mode (use all bytes of VRAM, whereas word
mode only uses bytes 0, 2, 4,... on each of the four planes), we need
to separate the effect on the plane number from the effect on the address.

Implementing the modes properly is a mess in QEMU, because it would
change the layout of VRAM and break migration.  As an approximation,
shift right when the CPU accesses memory instead of shifting left when
the CRT controller reads it.  A hack is needed in order to write font data
properly (see comment in the code), but it works well enough for the game.

Because doubleword and chain4 modes are now independent, chain4 does not
assert anymore that the address is in range.  Instead it just returns
all ones and discards writes, like other modes.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: aef158b093b9d67381f88468d39ac8dd62ae9e8b
      
https://github.com/qemu/qemu/commit/aef158b093b9d67381f88468d39ac8dd62ae9e8b
  Author: Daan De Meyer <daan.j.demeyer@gmail.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M accel/kvm/kvm-all.c
    M include/sysemu/kvm_int.h
    M qemu-options.hx

  Log Message:
  -----------
  Add class property to configure KVM device node to use

This allows passing the KVM device node to use as a file
descriptor via /dev/fdset/XX. Passing the device node to
use as a file descriptor allows running qemu unprivileged
even when the user running qemu is not in the kvm group
on distributions where access to /dev/kvm is gated behind
membership of the kvm group (as long as the process invoking
qemu is able to open /dev/kvm and passes the file descriptor
to qemu).

Signed-off-by: Daan De Meyer <daan.j.demeyer@gmail.com>
Message-ID: <20231021134015.1119597-1-daan.j.demeyer@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 3cbc17ee92479ff56d0d6afecc0def6f7ec01153
      
https://github.com/qemu/qemu/commit/3cbc17ee92479ff56d0d6afecc0def6f7ec01153
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M block/io_uring.c
    M include/block/aio.h
    M include/block/raw-aio.h

  Log Message:
  -----------
  io_uring: move LuringState typedef to block/aio.h

The LuringState typedef is defined twice, in include/block/raw-aio.h and
block/io_uring.c.  Move it in include/block/aio.h, which is included
everywhere the typedef is needed, since include/block/aio.h already has
to define the forward reference to the struct.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: a58506b748b8988a95f4fa1a2420ac5c17038b30
      
https://github.com/qemu/qemu/commit/a58506b748b8988a95f4fa1a2420ac5c17038b30
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M target/i386/tcg/translate.c

  Log Message:
  -----------
  target/i386: Do not re-compute new pc with CF_PCREL

With PCREL, we have a page-relative view of EIP, and an
approximation of PC = EIP+CSBASE that is good enough to
detect page crossings.  If we try to recompute PC after
masking EIP, we will mess up that approximation and write
a corrupt value to EIP.

We already handled masking properly for PCREL, so the
fix in b5e0d5d2 was only needed for the !PCREL path.

Cc: qemu-stable@nongnu.org
Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation")
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240101230617.129349-1-richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 2926eab8969908bc068629e973062a0fb6ff3759
      
https://github.com/qemu/qemu/commit/2926eab8969908bc068629e973062a0fb6ff3759
  Author: guoguangyao <guoguangyao18@mails.ucas.ac.cn>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M target/i386/tcg/translate.c

  Log Message:
  -----------
  target/i386: fix incorrect EIP in PC-relative translation blocks

The PCREL patches introduced a bug when updating EIP in the !CF_PCREL case.
Using s->pc in func gen_update_eip_next() solves the problem.

Cc: qemu-stable@nongnu.org
Fixes: b5e0d5d22fbf ("target/i386: Fix 32-bit wrapping of pc/eip computation")
Signed-off-by: guoguangyao <guoguangyao18@mails.ucas.ac.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240115020804.30272-1-guoguangyao18@mails.ucas.ac.cn>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 729ba8e933f8af5800c3a92b37e630e9bdaa9f1e
      
https://github.com/qemu/qemu/commit/729ba8e933f8af5800c3a92b37e630e9bdaa9f1e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M target/i386/tcg/tcg-cpu.c
    M target/i386/tcg/translate.c

  Log Message:
  -----------
  target/i386: pcrel: store low bits of physical address in data[0]

For PC-relative translation blocks, env->eip changes during the
execution of a translation block, Therefore, QEMU must be able to
recover an instruction's PC just from the TranslationBlock struct and
the instruction data with.  Because a TB will not span two pages, QEMU
stores all the low bits of EIP in the instruction data and replaces them
in x86_restore_state_to_opc.  Bits 12 and higher (which may vary between
executions of a PCREL TB, since these only use the physical address in
the hash key) are kept unmodified from env->eip.  The assumption is that
these bits of EIP, unlike bits 0-11, will not change as the translation
block executes.

Unfortunately, this is incorrect when the CS base is not aligned to a page.
Then the linear address of the instructions (i.e. the one with the
CS base addred) indeed will never span two pages, but bits 12+ of EIP
can actually change.  For example, if CS base is 0x80262200 and EIP =
0x6FF4, the first instruction in the translation block will be at linear
address 0x802691F4.  Even a very small TB will cross to EIP = 0x7xxx,
while the linear addresses will remain comfortably within a single page.

The fix is simply to use the low bits of the linear address for data[0],
since those don't change.  Then x86_restore_state_to_opc uses tb->cs_base
to compute a temporary linear address (referring to some unknown
instruction in the TB, but with the correct values of bits 12 and higher);
the low bits are replaced with data[0], and EIP is obtained by subtracting
again the CS base.

Huge thanks to Mark Cave-Ayland for the image and initial debugging,
and to Gitlab user @kjliew for help with bisecting another occurrence
of (hopefully!) the same bug.

It should be relatively easy to write a testcase that performs MMIO on
an EIP with different bits 12+ than the first instruction of the translation
block; any help is welcome.

Fixes: e3a79e0e878 ("target/i386: Enable TARGET_TB_PCREL", 2022-10-11)
Cc: qemu-stable@nongnu.org
Cc: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Cc: Richard Henderson <richard.henderson@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1759
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1964
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2012
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 592d0bc0302ff5b5209ecd7f8733f285bc008cff
      
https://github.com/qemu/qemu/commit/592d0bc0302ff5b5209ecd7f8733f285bc008cff
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M block/io_uring.c
    M hw/vfio/common.c
    M target/i386/sev.c
    M util/fdmon-io_uring.c

  Log Message:
  -----------
  remove unnecessary casts from uintptr_t

uintptr_t, or unsigned long which is equivalent on Linux I32LP64 systems,
is an unsigned type and there is no need to further cast to __u64 which is
another unsigned integer type; widening casts from unsigned integers
zero-extend the value.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 5fd1674d21d3e3489f077c67dcd841b72ed351b8
      
https://github.com/qemu/qemu/commit/5fd1674d21d3e3489f077c67dcd841b72ed351b8
  Author: Bibo Mao <maobibo@loongson.cn>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M include/qemu/osdep.h

  Log Message:
  -----------
  qemu/osdep: Add huge page aligned support on LoongArch platform

On LoongArch kvm mode if transparent huge page wants to be enabled, base
address and size of memslot from both HVA and GPA view. And LoongArch
supports both 4K and 16K page size with Linux kernel, so transparent huge
page size is calculated from real page size rather than hardcoded size.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20240115073244.174155-1-maobibo@loongson.cn>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 379652e967b32ac905056bf723b54298b2f79a51
      
https://github.com/qemu/qemu/commit/379652e967b32ac905056bf723b54298b2f79a51
  Author: Ilya Leoshkevich <iii@linux.ibm.com>
  Date:   2024-01-18 (Thu, 18 Jan 2024)

  Changed paths:
    M tests/tcg/aarch64/system/vtimer.c

  Log Message:
  -----------
  tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c

make check-tcg fails on Fedora with:

    vtimer.c:9:10: fatal error: inttypes.h: No such file or directory

Fedora has a minimal aarch64 cross-compiler, which satisfies the
configure checks, so it's chosen instead of the dockerized one.
There is no cross-version of inttypes.h, however.

Fix by using stdint.h instead. The test does not require anything
from inttypes.h anyway.

Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20240108125030.58569-1-iii@linux.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: c0d0b716ba3e52236088eb9f75ef5cbd7e15a4f3
      
https://github.com/qemu/qemu/commit/c0d0b716ba3e52236088eb9f75ef5cbd7e15a4f3
  Author: Daniel Hoffman <dhoff749@gmail.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/timer/hpet.c
    M hw/timer/trace-events

  Log Message:
  -----------
  hw/timer/hpet: Convert DPRINTF to trace events

This conversion is pretty straight-forward. Standardized some formatting
so the +0 and +4 offset cases can recycle the same message.

Signed-off-by: Daniel Hoffman <dhoff749@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231118231129.2840388-1-dhoff749@gmail.com>
[PMD: Fixed few string formats]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 484aecf2d3a75251b63481be2a0c3aef635002af
      
https://github.com/qemu/qemu/commit/484aecf2d3a75251b63481be2a0c3aef635002af
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M backends/cryptodev.c

  Log Message:
  -----------
  backends/cryptodev: Do not ignore throttle/backends Errors

Both cryptodev_backend_set_throttle() and CryptoDevBackendClass::init()
can set their Error** argument. Do not ignore them, return early
on failure. Without that, running into another failure trips
error_setv()'s assertion. Use the ERRP_GUARD() macro as suggested
in commit ae7c80a7bd ("error: New macro ERRP_GUARD()").

Cc: qemu-stable@nongnu.org
Fixes: e7a775fd9f ("cryptodev: Account statistics")
Fixes: 2580b452ff ("cryptodev: support QoS")
Reviewed-by: zhenwei pi <pizhenwei@bytedance.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20231120150418.93443-1-philmd@linaro.org>


  Commit: b94b8c604b6d4e6071569c4c00a1f4c841028934
      
https://github.com/qemu/qemu/commit/b94b8c604b6d4e6071569c4c00a1f4c841028934
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M target/arm/cpu.c
    M target/i386/cpu.c

  Log Message:
  -----------
  accel: Do not set CPUState::tcg_cflags in non-TCG accels

'tcg_cflags' is specific to TCG.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20231130075958.21285-1-philmd@linaro.org>


  Commit: 396f66f99dfb405bd2a29582d043d2a6b7b37d6d
      
https://github.com/qemu/qemu/commit/396f66f99dfb405bd2a29582d043d2a6b7b37d6d
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/dummy-cpus.c
    M accel/hvf/hvf-accel-ops.c
    M accel/kvm/kvm-accel-ops.c

  Log Message:
  -----------
  accel: Do not set CPUState::can_do_io in non-TCG accels

'can_do_io' is specific to TCG. It was added to other
accelerators in 626cf8f4c6 ("icount: set can_do_io outside
TB execution"), then likely copy/pasted in commit c97d6d2cdf
("i386: hvf: add code base from Google's QEMU repository").
Having it set in non-TCG code is confusing, so remove it from
QTest / HVF / KVM.

Fixes: 626cf8f4c6 ("icount: set can_do_io outside TB execution")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20231129205037.16849-1-philmd@linaro.org>


  Commit: 5f3ebbc86da5508535c7d8e4655b1dc7ad3047fe
      
https://github.com/qemu/qemu/commit/5f3ebbc86da5508535c7d8e4655b1dc7ad3047fe
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M target/xtensa/cpu.c
    M target/xtensa/cpu.h
    M target/xtensa/dbg_helper.c
    M target/xtensa/helper.c
    M target/xtensa/translate.c

  Log Message:
  -----------
  target/xtensa: use generic instruction breakpoint infrastructure

Don't embed ibreak exception generation into TB and don't invalidate TB
on ibreak address change. Add CPUBreakpoint pointers to xtensa
CPUArchState, use cpu_breakpoint_insert/cpu_breakpoint_remove_by_ref to
manage ibreak breakpoints and provide TCGCPUOps::debug_check_breakpoint
callback that recognizes valid instruction breakpoints.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231130171920.3798954-2-jcmvbkbc@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 6b1f10093d471e5ea0695a3905622bdf3d3c9edc
      
https://github.com/qemu/qemu/commit/6b1f10093d471e5ea0695a3905622bdf3d3c9edc
  Author: Max Filippov <jcmvbkbc@gmail.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M tests/tcg/xtensa/test_break.S

  Log Message:
  -----------
  tests/tcg/xtensa: add icount/ibreak priority test

When icount and ibreak exceptions are due to happen on the same address
icount has higher precedence.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231130171920.3798954-3-jcmvbkbc@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: c076f37a77564995b7bc3f4ee0003146ec6a704e
      
https://github.com/qemu/qemu/commit/c076f37a77564995b7bc3f4ee0003146ec6a704e
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M cpu-target.c
    M include/exec/exec-all.h

  Log Message:
  -----------
  accel/tcg: Remove unused tb_invalidate_phys_addr()

Commit e3f7c801f1 introduced the TCGCPUOps::debug_check_breakpoint()
handler, and commit 10c37828b2 "moved breakpoint recognition outside
of translation", so "we no longer need to flush any TBs when changing
BPs".

The last target using tb_invalidate_phys_addr() was converted to the
debug_check_breakpoint(), so this function is now unused. Remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20231130203241.31099-1-philmd@linaro.org>


  Commit: fe5c4adca9ddb916afc74e18a5bf195372eb1b2f
      
https://github.com/qemu/qemu/commit/fe5c4adca9ddb916afc74e18a5bf195372eb1b2f
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/tcg/tb-maint.c
    M include/exec/translate-all.h

  Log Message:
  -----------
  accel/tcg: Remove tb_invalidate_phys_page() from system emulation

Since previous commit, tb_invalidate_phys_page() is not used
anymore in system emulation. Make it static for user emulation
and remove its public declaration in "exec/translate-all.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20231130205600.35727-1-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 0180444806f5809b3bacd3284c47c8b7c29fd3a5
      
https://github.com/qemu/qemu/commit/0180444806f5809b3bacd3284c47c8b7c29fd3a5
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    A target/alpha/clk_helper.c
    M target/alpha/meson.build
    M target/alpha/sys_helper.c

  Log Message:
  -----------
  target/alpha: Extract clk_helper.c from sys_helper.c

Except helper_load_pcc(), all helpers from sys_helper.c
are system-emulation specific. In preparation of restricting
sys_helper.c to system emulation, extract helper_load_pcc()
to clk_helper.c.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20231207105426.49339-2-philmd@linaro.org>


  Commit: 6adcba7c0a58fe9d1b74c4af3dd881253b3a94dd
      
https://github.com/qemu/qemu/commit/6adcba7c0a58fe9d1b74c4af3dd881253b3a94dd
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M target/alpha/meson.build
    M target/alpha/sys_helper.c

  Log Message:
  -----------
  target/alpha: Only build sys_helper.c on system emulation

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20231207105426.49339-3-philmd@linaro.org>


  Commit: f07f246734e271b368bfc9afc4cbc437999d58ea
      
https://github.com/qemu/qemu/commit/f07f246734e271b368bfc9afc4cbc437999d58ea
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/tcg/icount-common.c
    M include/sysemu/cpu-timers.h
    M stubs/icount.c
    M system/vl.c

  Log Message:
  -----------
  system/cpu-timers: Have icount_configure() return a boolean

Following the example documented since commit e3fe3988d7 ("error:
Document Error API usage rules"), have icount_configure()
return a boolean indicating whether an error is set or not.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231208113529.74067-2-philmd@linaro.org>


  Commit: 8e98c27daacba2fac0cb868f905489b9a744a152
      
https://github.com/qemu/qemu/commit/8e98c27daacba2fac0cb868f905489b9a744a152
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/tcg/icount-common.c
    M include/sysemu/cpu-timers.h
    M stubs/icount.c
    M system/cpu-timers.c
    M target/arm/helper.c

  Log Message:
  -----------
  system/cpu-timers: Introduce ICountMode enumerator

Rather than having to lookup for what the 0, 1, 2, ...
icount values are, use a enum definition.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20231208113529.74067-4-philmd@linaro.org>


  Commit: 24128132866d8486e8f0b4bdf647ced03b5ef522
      
https://github.com/qemu/qemu/commit/24128132866d8486e8f0b4bdf647ced03b5ef522
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Ensure icount is enabled when emulating INST_RETIRED

pmu_init() register its event checking the pm_event::supported()
handler. For INST_RETIRED, the event is only registered and the
bit enabled in the PMU Common Event Identification register when
icount is enabled as ICOUNT_PRECISE.

PMU events are TCG-only, hardware accelerators handle them
directly. Unfortunately we register the events in non-TCG builds,
leading to linking error such:

  ld: Undefined symbols:
    _icount_to_ns, referenced from:
      _instructions_ns_per in target_arm_helper.c.o
  clang: error: linker command failed with exit code 1 (use -v to see 
invocation)

As a kludge, give a hint to the compiler by asserting the
pm_event::get_count() and pm_event::ns_per_count() handler will
only be called under this icount mode.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231208113529.74067-5-philmd@linaro.org>


  Commit: 72c603f82f2267c93fadf37aac2412d1b19645d2
      
https://github.com/qemu/qemu/commit/72c603f82f2267c93fadf37aac2412d1b19645d2
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/tcg/icount-common.c
    M stubs/icount.c
    M util/async.c

  Log Message:
  -----------
  util/async: Only call icount_notify_exit() if icount is enabled

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231208113529.74067-6-philmd@linaro.org>


  Commit: 322b038c9411bae0c9f518fe1cb55934ac4e1a67
      
https://github.com/qemu/qemu/commit/322b038c9411bae0c9f518fe1cb55934ac4e1a67
  Author: Samuel Tardieu <sam@rfc1149.net>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M docs/about/deprecated.rst
    M hw/sh4/shix.c

  Log Message:
  -----------
  target/sh4: Deprecate the shix machine

The shix machine has been designed and used at Télécom Paris from 2003
to 2010. It had been added to QEMU in 2005 and has not been maintained
since. Since nobody is using the physical board anymore nor interested
in maintaining the QEMU port, it is time to deprecate it.

Signed-off-by: Samuel Tardieu <sam@rfc1149.net>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240109083053.2581588-2-sam@rfc1149.net>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: c8cdec74e6214d52f1924f9db09cab8c2c4ad150
      
https://github.com/qemu/qemu/commit/c8cdec74e6214d52f1924f9db09cab8c2c4ad150
  Author: Samuel Tardieu <sam@rfc1149.net>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M docs/about/deprecated.rst
    M hw/block/tc58128.c

  Log Message:
  -----------
  hw/block: Deprecate the TC58128 block device

The 16MiB flash device is only used by the deprecated shix machine.
Its code it old and unmaintained, and has never been adapted to the
QOM architecture. It still contains debug statements and uses global
variables. It is time to deprecate it.

Signed-off-by: Samuel Tardieu <sam@rfc1149.net>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240109083053.2581588-3-sam@rfc1149.net>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: ebd92d6de37eacd109cf320ca8ece7a0f5a243ae
      
https://github.com/qemu/qemu/commit/ebd92d6de37eacd109cf320ca8ece7a0f5a243ae
  Author: Bernhard Beschow <shentey@gmail.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/i386/pc_piix.c

  Log Message:
  -----------
  hw/i386/pc_piix: Make piix_intx_routing_notifier_xen() more device independent

This is a follow-up on commit 89965db43cce "hw/isa/piix3: Avoid Xen-specific
variant of piix3_write_config()" which introduced
piix_intx_routing_notifier_xen(). This function is implemented in board code but
accesses the PCI configuration space of the PIIX ISA function to determine the
PCI interrupt routes. Avoid this by reusing pci_device_route_intx_to_irq() which
makes piix_intx_routing_notifier_xen() more device-agnostic.

One remaining improvement would be making piix_intx_routing_notifier_xen()
agnostic towards the number of PCI interrupt routes and move it to xen-hvm.
This might be useful for possible Q35 Xen efforts but remains a future exercise
for now.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240107231623.5282-1-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 3b14a555fdb627ac091559ef5931c887d06590d8
      
https://github.com/qemu/qemu/commit/3b14a555fdb627ac091559ef5931c887d06590d8
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/block/pflash_cfi01.c

  Log Message:
  -----------
  hw/pflash: refactor pflash_data_write()

Move the offset calculation, do it once at the start of the function and
let the 'p' variable point directly to the memory location which should
be updated.  This makes it simpler to update other buffers than
pfl->storage in an upcoming patch.  No functional change.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240108160900.104835-2-kraxel@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 5dd58358a57048e5ceabf5c91c0544f4f56afdcd
      
https://github.com/qemu/qemu/commit/5dd58358a57048e5ceabf5c91c0544f4f56afdcd
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/block/pflash_cfi01.c

  Log Message:
  -----------
  hw/pflash: use ldn_{be,le}_p and stn_{be,le}_p

Use the helper functions we have to read/write multi-byte values
in correct byte order.

Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240108160900.104835-3-kraxel@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 284a7ee2e290e0c9b8cd3ea6164d92386933054f
      
https://github.com/qemu/qemu/commit/284a7ee2e290e0c9b8cd3ea6164d92386933054f
  Author: Gerd Hoffmann <kraxel@redhat.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/block/pflash_cfi01.c
    M hw/block/pflash_cfi02.c
    M hw/block/trace-events

  Log Message:
  -----------
  hw/pflash: implement update buffer for block writes

Add an update buffer where all block updates are staged.
Flush or discard updates properly, so we should never see
half-completed block writes in pflash storage.

Drop a bunch of FIXME comments ;)

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240108160900.104835-4-kraxel@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 16ad9788b5368fb4aded10d1f050316ea6df9989
      
https://github.com/qemu/qemu/commit/16ad9788b5368fb4aded10d1f050316ea6df9989
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M include/sysemu/cpu-timers.h
    M include/sysemu/replay.h
    M stubs/icount.c

  Log Message:
  -----------
  system/replay: Restrict icount to system emulation

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20231208113529.74067-7-philmd@linaro.org>


  Commit: 1c3d42c4c9477600720aa1b6825a5d9f5aa43cbe
      
https://github.com/qemu/qemu/commit/1c3d42c4c9477600720aa1b6825a5d9f5aa43cbe
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/tcg/meson.build
    A accel/tcg/watchpoint.c
    M system/watchpoint.c

  Log Message:
  -----------
  system/watchpoint: Move TCG specific code to accel/tcg/

Keep system/watchpoint.c accelerator-agnostic by moving
TCG specific code to accel/tcg/watchpoint.c. Update meson.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20240111162032.43378-1-philmd@linaro.org>


  Commit: 0f9237f4e23e6fce6ccad4df23f6263c2f160e65
      
https://github.com/qemu/qemu/commit/0f9237f4e23e6fce6ccad4df23f6263c2f160e65
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M cpu-target.c

  Log Message:
  -----------
  cpus: Restrict 'start-powered-off' property to system emulation

Since the CPUState::start-powered-off property is irrelevant
to user emulation, restrict it to system emulation.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20240111161817.43150-1-philmd@linaro.org>


  Commit: 463b00682d8651e1c4140dc439703e9d258ffdee
      
https://github.com/qemu/qemu/commit/463b00682d8651e1c4140dc439703e9d258ffdee
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/accel-system.c
    M accel/accel-system.h
    M accel/accel-target.c

  Log Message:
  -----------
  accel: Rename accel_init_ops_interfaces() to include 'system'

accel_init_ops_interfaces() is system specific, so
rename it as accel_system_init_ops_interfaces() to
ease navigating the code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240111120221.35072-2-philmd@linaro.org>


  Commit: 3c756f489af07dc913d0ce247de3ca6d2b563027
      
https://github.com/qemu/qemu/commit/3c756f489af07dc913d0ce247de3ca6d2b563027
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/core/cpu-common.c

  Log Message:
  -----------
  hw/core/cpu: Rename cpu_class_init() to include 'common'

cpu_class_init() is common, so rename it as cpu_common_class_init()
to ease navigating the code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20240111120221.35072-3-philmd@linaro.org>


  Commit: 83f1ab12b13dfd284084ce8daa6c548caad6ef67
      
https://github.com/qemu/qemu/commit/83f1ab12b13dfd284084ce8daa6c548caad6ef67
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/s390x/sclpcpu.c

  Log Message:
  -----------
  hw/s390x: Rename cpu_class_init() to include 'sclp'

cpu_class_init() is specific to s390x SCLP, so rename
it as sclp_cpu_class_init() (as other names in this file)
to ease navigating the code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20240111120221.35072-4-philmd@linaro.org>


  Commit: e129593f6fc98d4fa14d0241061b5f556c9a4347
      
https://github.com/qemu/qemu/commit/e129593f6fc98d4fa14d0241061b5f556c9a4347
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M target/i386/tcg/tcg-cpu.c

  Log Message:
  -----------
  target/i386: Rename tcg_cpu_FOO() to include 'x86'

The tcg_cpu_FOO() names are x86 specific, so rename
them as x86_tcg_cpu_FOO() (as other names in this file)
to ease navigating the code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20240111120221.35072-5-philmd@linaro.org>


  Commit: 7ebbd9d0b6a6b692371a3f31b9cc937824bed92b
      
https://github.com/qemu/qemu/commit/7ebbd9d0b6a6b692371a3f31b9cc937824bed92b
  Author: Philippe Mathieu-Daudé <philmd@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M target/riscv/tcg/tcg-cpu.c

  Log Message:
  -----------
  target/riscv: Rename tcg_cpu_FOO() to include 'riscv'

The tcg_cpu_FOO() names are riscv specific, so rename
them as riscv_tcg_cpu_FOO() (as other names in this file)
to ease navigating the code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20240111120221.35072-6-philmd@linaro.org>


  Commit: 84a6835e004c257037492167d4f266dbb54dc33e
      
https://github.com/qemu/qemu/commit/84a6835e004c257037492167d4f266dbb54dc33e
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/scsi/esp-pci.c

  Log Message:
  -----------
  hw/scsi/esp-pci: use correct address register for PCI DMA transfers

The current code in esp_pci_dma_memory_rw() sets the DMA address to the value
of the DMA_SPA (Starting Physical Address) register which is incorrect: this
means that for each callback from the SCSI layer the DMA address is set back
to the starting address.

In the case where only a single SCSI callback occurs (currently for transfer
lengths < 128kB) this works fine, however for larger transfers the DMA address
wraps back to the initial starting address, corrupting the buffer holding the
data transferred to the guest.

Fix esp_pci_dma_memory_rw() to use the DMA_WAC (Working Address Counter) for
the DMA address which is correctly incremented across multiple SCSI layer
transfers.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-ID: <20240112131529.515642-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 6b41417d934b2640b7ccf893544d656eea92a2e7
      
https://github.com/qemu/qemu/commit/6b41417d934b2640b7ccf893544d656eea92a2e7
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/scsi/esp-pci.c

  Log Message:
  -----------
  hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sources

The am53c974/dc390 PCI interrupt has two separate sources: the first is from the
internal ESP device, and the second is from the PCI DMA transfer logic.

Update the ESP interrupt handler so that it sets DMA_STAT_SCSIINT rather than
driving the PCI IRQ directly, and introduce a new esp_pci_update_irq() function
to generate the correct PCI IRQ level. In particular this fixes spurious 
interrupts
being generated by setting DMA_STAT_DONE at the end of a transfer if 
DMA_CMD_INTE_D
isn't set in the DMA_CMD register.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-ID: <20240112131529.515642-3-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 1e8e6644e063b20ad391140fae13d00ad7750b33
      
https://github.com/qemu/qemu/commit/1e8e6644e063b20ad391140fae13d00ad7750b33
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/scsi/esp-pci.c

  Log Message:
  -----------
  hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion 
interrupt

The setting of DMA_STAT_DONE at the end of a DMA transfer can be configured to
generate an interrupt, however the Linux driver manually checks for 
DMA_STAT_DONE
being set and if it is, considers that a DMA transfer has completed.

If DMA_STAT_DONE is set but the ESP device isn't indicating an interrupt then
the Linux driver considers this to be a spurious interrupt. However this can
occur in QEMU as there is a delay between the end of DMA transfer where
DMA_STAT_DONE is set, and the ESP device raising its completion interrupt.

This appears to be an incorrect assumption in the Linux driver as the ESP and
PCI DMA interrupt sources are separate (and may not be raised exactly
together), however we can work around this by synchronising the setting of
DMA_STAT_DONE at the end of a DMA transfer with the ESP completion interrupt.

In conjunction with the previous commit Linux is now able to correctly boot
from an am53c974 PCI SCSI device on the hppa C3700 machine without emitting
"iget: checksum invalid" and "Spurious irq, sreg=10" errors.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-ID: <20240112131529.515642-4-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: c2d7de557d19ec76eb83b87b6bf77c8114e2f183
      
https://github.com/qemu/qemu/commit/c2d7de557d19ec76eb83b87b6bf77c8114e2f183
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M hw/scsi/esp-pci.c

  Log Message:
  -----------
  hw/scsi/esp-pci: set DMA_STAT_BCMBLT when BLAST command issued

Even though the BLAST command isn't fully implemented in QEMU, the 
DMA_STAT_BCMBLT
bit should be set after the command has been issued to indicate that the command
has completed.

This fixes an issue with the DC390 DOS driver which issues the BLAST command as
part of its normal error recovery routine at startup, and otherwise sits in a
tight loop waiting for DMA_STAT_BCMBLT to be set before continuing.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-ID: <20240112131529.515642-5-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 62570f1434160d356311e1c217537e24a4ac85cd
      
https://github.com/qemu/qemu/commit/62570f1434160d356311e1c217537e24a4ac85cd
  Author: Bin Meng <bmeng@tinylab.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M include/hw/elf_ops.h

  Log Message:
  -----------
  hw/elf_ops: Ignore loadable segments with zero size

Some ELF files really do have segments of zero size, e.g.:

Program Headers:
  Type           Offset             VirtAddr           PhysAddr
                 FileSiz            MemSiz              Flags  Align
  RISCV_ATTRIBUT 0x00000000000025b8 0x0000000000000000 0x0000000000000000
                 0x000000000000003e 0x0000000000000000  R      0x1
  LOAD           0x0000000000001000 0x0000000080200000 0x0000000080200000
                 0x00000000000001d1 0x00000000000001d1  R E    0x1000
  LOAD           0x00000000000011d1 0x00000000802001d1 0x00000000802001d1
                 0x0000000000000e37 0x0000000000000e37  RW     0x1000
  LOAD           0x0000000000000120 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000         0x1000

The current logic does not check for this condition, resulting in
the incorrect assignment of 'lowaddr' as zero.

There is already a piece of codes inside the segment traversal loop
that checks for zero-sized loadable segments for not creating empty
ROM blobs. Let's move this check to the beginning of the loop to
cover both scenarios.

Signed-off-by: Bin Meng <bmeng@tinylab.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20240116155049.390301-1-bmeng@tinylab.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 1c50d026d518eb4549084f14825648afe8fc2a7c
      
https://github.com/qemu/qemu/commit/1c50d026d518eb4549084f14825648afe8fc2a7c
  Author: Raphael Norwitz <raphael.norwitz@nutanix.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  MAINTAINERS: Update Raphael Norwitz email

I will be leaving Nutanix so updating my email in MAINTAINERS to my
personal email for now.

Signed-off-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240111192846.111699-1-raphael.norwitz@nutanix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 85178698f64571c47013f9f7c6f1b134429ed7de
      
https://github.com/qemu/qemu/commit/85178698f64571c47013f9f7c6f1b134429ed7de
  Author: Zhao Liu <zhao1.liu@intel.com>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  MAINTAINERS: Update hw/core/cpu.c entry

The hw/core/cpu.c was split as hw/core/cpu-common.c and
hw/core/cpu-sysemu.c in the commit df4fd7d5c8a3 ("cpu: Split as
cpu-common / cpu-sysemu").

Update the related entry.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240115094852.3597165-2-zhao1.liu@linux.intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: 7ec5d7d91215815e885d2b38e62256e8fd8e2bce
      
https://github.com/qemu/qemu/commit/7ec5d7d91215815e885d2b38e62256e8fd8e2bce
  Author: Bibo Mao <maobibo@loongson.cn>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: Add linux header compile support for LoongArch

When compiling qemu with system KVM mode for LoongArch, header files
in directory linux-headers/asm-loongarch should be used firstly.
Otherwise it fails to find kvm.h on system with old glibc, since
latest kernel header files are not installed.

This patch adds linux_arch definition for LoongArch system so that
header files in directory linux-headers/asm-loongarch can be included.

Fixes: 714b03c125 ("target/loongarch: Add loongarch kvm into meson build")
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20240116013952.264474-1-maobibo@loongson.cn>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>


  Commit: e566fb85939bec58a75f22ff9d80d0bac8717806
      
https://github.com/qemu/qemu/commit/e566fb85939bec58a75f22ff9d80d0bac8717806
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M accel/kvm/kvm-all.c
    M block/io_uring.c
    M hw/display/cirrus_vga.c
    M hw/display/vga-helpers.h
    M hw/display/vga.c
    M hw/display/vga_int.h
    M hw/display/vga_regs.h
    M hw/vfio/common.c
    M include/block/aio.h
    M include/block/raw-aio.h
    M include/qemu/osdep.h
    M include/sysemu/kvm_int.h
    M qemu-options.hx
    M target/i386/sev.c
    M target/i386/tcg/tcg-cpu.c
    M target/i386/tcg/translate.c
    M tests/tcg/aarch64/system/vtimer.c
    M util/fdmon-io_uring.c

  Log Message:
  -----------
  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging

* vga: implement odd/even and byte/word/doubleword modes more accurately
* vga: implement horizontal pel panning
* KVM: add class property to configure KVM device node to use
* fix various bugs in x86 TCG PC-relative translation
* properly align huge pages on LoongArch
* cleanup patches

# -----BEGIN PGP SIGNATURE-----
#
# iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmWo8wkUHHBib256aW5p
# QHJlZGhhdC5jb20ACgkQv/vSX3jHroMhHAf+KiYvN/gxrYnpSS7IfbFqx6MtQrwW
# Hj9QsfgRF2sThRu6BveLMG7REwEtwFh7lMhUbiyR/mzuYN9cMmHDw4OE62WRrL86
# 3PAtzAaJ/Lzd8Qp4K4un+ZrFZvq8a83HvGRRTaF9wO6/9EwpqmqMTbrNlSSA08Gy
# mnfXGEt0oYitJ3JUH0MI8y6EOh1mkIhEfGPeyJaGDZVW/m4ob+QIauNOOozYN7r6
# QK+2OU0HeJC5CIzi2o5kq5U0AydVO1iAp7OBxtclYaaSvRyhlpEmbdTIKCzzPlUx
# vZthxbU2PgzUbME8fraUcd7GzT64++QOLDxNyZNEL8PCCcd0lRQ0EEukgA==
# =Uz0X
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu 18 Jan 2024 09:44:41 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* tag 'for-upstream' of https://gitlab.com/bonzini/qemu:
  tests/tcg: Don't #include <inttypes.h> in aarch64/system/vtimer.c
  qemu/osdep: Add huge page aligned support on LoongArch platform
  remove unnecessary casts from uintptr_t
  target/i386: pcrel: store low bits of physical address in data[0]
  target/i386: fix incorrect EIP in PC-relative translation blocks
  target/i386: Do not re-compute new pc with CF_PCREL
  io_uring: move LuringState typedef to block/aio.h
  Add class property to configure KVM device node to use
  vga: sort-of implement word and double-word access modes
  vga: use latches in odd/even mode too
  vga: reindent memory access code
  vga: optimize horizontal pel panning in 256-color modes
  vga: implement horizontal pel panning in graphics modes
  vga: mask addresses in non-VESA modes to 256k
  vga: introduce VGADisplayParams
  vga: use common endian swap macros

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 3f2a357b95845ea0bf7463eff6661e43b97d1afc
      
https://github.com/qemu/qemu/commit/3f2a357b95845ea0bf7463eff6661e43b97d1afc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2024-01-19 (Fri, 19 Jan 2024)

  Changed paths:
    M MAINTAINERS
    M accel/accel-system.c
    M accel/accel-system.h
    M accel/accel-target.c
    M accel/dummy-cpus.c
    M accel/hvf/hvf-accel-ops.c
    M accel/kvm/kvm-accel-ops.c
    M accel/tcg/icount-common.c
    M accel/tcg/meson.build
    M accel/tcg/tb-maint.c
    A accel/tcg/watchpoint.c
    M backends/cryptodev.c
    M configure
    M cpu-target.c
    M docs/about/deprecated.rst
    M hw/block/pflash_cfi01.c
    M hw/block/pflash_cfi02.c
    M hw/block/tc58128.c
    M hw/block/trace-events
    M hw/core/cpu-common.c
    M hw/i386/pc_piix.c
    M hw/s390x/sclpcpu.c
    M hw/scsi/esp-pci.c
    M hw/sh4/shix.c
    M hw/timer/hpet.c
    M hw/timer/trace-events
    M include/exec/exec-all.h
    M include/exec/translate-all.h
    M include/hw/elf_ops.h
    M include/sysemu/cpu-timers.h
    M include/sysemu/replay.h
    M stubs/icount.c
    M system/cpu-timers.c
    M system/vl.c
    M system/watchpoint.c
    A target/alpha/clk_helper.c
    M target/alpha/meson.build
    M target/alpha/sys_helper.c
    M target/arm/cpu.c
    M target/arm/helper.c
    M target/i386/cpu.c
    M target/i386/tcg/tcg-cpu.c
    M target/riscv/tcg/tcg-cpu.c
    M target/xtensa/cpu.c
    M target/xtensa/cpu.h
    M target/xtensa/dbg_helper.c
    M target/xtensa/helper.c
    M target/xtensa/translate.c
    M tests/tcg/xtensa/test_break.S
    M util/async.c

  Log Message:
  -----------
  Merge tag 'hw-cpus-20240119' of https://github.com/philmd/qemu into staging

HW core patch queue

. Deprecate unmaintained SH-4 models (Samuel)
. HPET: Convert DPRINTF calls to trace events (Daniel)
. Implement buffered block writes in Intel PFlash (Gerd)
. Ignore ELF loadable segments with zero size (Bin)
. ESP/NCR53C9x: PCI DMA fixes (Mark)
. PIIX: Simplify Xen PCI IRQ routing (Bernhard)
. Restrict CPU 'start-powered-off' property to sysemu (Phil)

. target/alpha: Only build sys_helper.c on system emulation (Phil)
. target/xtensa: Use generic instruction breakpoint API & add test (Max)
. Restrict icount to system emulation (Phil)
. Do not set CPUState TCG-specific flags in non-TCG accels (Phil)
. Cleanup TCG tb_invalidate API (Phil)
. Correct LoongArch/KVM include path (Bibo)
. Do not ignore throttle errors in crypto backends (Phil)

. MAINTAINERS updates (Raphael, Zhao)

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEE+qvnXhKRciHc/Wuy4+MsLN6twN4FAmWqXbkACgkQ4+MsLN6t
# wN6VVBAAkP/Bs2JfQYobPZVV868wceM97KeUJMXP2YWf6dSLpHRCQN5KtuJcACM9
# y3k3R7nMeVJSGmzl/1gF1G9JhjoCLoVLX/ejeBppv4Wq//9sEdggaQfdCwkhWw2o
# IK/gPjTZpimE7Er4hPlxmuhSRuM1MX4duKFRRfuZpE7XY14Y7/Hk12VIG7LooO0x
# 2Sl8CaU0DN7CWmRVDoUkwVx7JBy28UVarRDsgpBim7oKmjjBFnCJkH6B6NJXEiYr
# z1BmIcHa87S09kG1ek+y8aZpG9iPC7nUWjPIQyJGhnfrnBuO7hQHwCLIjHHp5QBR
# BoMr8YQNTI34/M/D8pBfg96LrGDjkQOfwRyRddkMP/jJcNPMAPMNGbfVaIrfij1e
# T+jFF4gQenOvy1XKCY3Uk/a11P3tIRFBEeOlzzQg4Aje9W2MhUNwK2HTlRfBbrRr
# V30R764FDmHlsyOu6/E3jqp4GVCgryF1bglPOBjVEU5uytbQTP8jshIpGVnxBbF+
# OpFwtsoDbsousNKVcO5+B0mlHcB9Ru9h11M5/YD/jfLMk95Ga90JGdgYpqQ5tO5Y
# aqQhKfCKbfgKuKhysxpsdWAwHZzVrlSf+UrObF0rl2lMXXfcppjCqNaw4QJ0oedc
# DNBxTPcCE2vWhUzP3A60VH7jLh4nLaqSTrxxQKkbx+Je1ERGrxs=
# =KmQh
# -----END PGP SIGNATURE-----
# gpg: Signature made Fri 19 Jan 2024 11:32:09 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" 
[full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* tag 'hw-cpus-20240119' of https://github.com/philmd/qemu: (36 commits)
  configure: Add linux header compile support for LoongArch
  MAINTAINERS: Update hw/core/cpu.c entry
  MAINTAINERS: Update Raphael Norwitz email
  hw/elf_ops: Ignore loadable segments with zero size
  hw/scsi/esp-pci: set DMA_STAT_BCMBLT when BLAST command issued
  hw/scsi/esp-pci: synchronise setting of DMA_STAT_DONE with ESP completion 
interrupt
  hw/scsi/esp-pci: generate PCI interrupt from separate ESP and PCI sources
  hw/scsi/esp-pci: use correct address register for PCI DMA transfers
  target/riscv: Rename tcg_cpu_FOO() to include 'riscv'
  target/i386: Rename tcg_cpu_FOO() to include 'x86'
  hw/s390x: Rename cpu_class_init() to include 'sclp'
  hw/core/cpu: Rename cpu_class_init() to include 'common'
  accel: Rename accel_init_ops_interfaces() to include 'system'
  cpus: Restrict 'start-powered-off' property to system emulation
  system/watchpoint: Move TCG specific code to accel/tcg/
  system/replay: Restrict icount to system emulation
  hw/pflash: implement update buffer for block writes
  hw/pflash: use ldn_{be,le}_p and stn_{be,le}_p
  hw/pflash: refactor pflash_data_write()
  hw/i386/pc_piix: Make piix_intx_routing_notifier_xen() more device independent
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/88cf5fec91e5...3f2a357b9584



reply via email to

[Prev in Thread] Current Thread [Next in Thread]