Merge remote-tracking branch 'remotes/kraxel/tags/seabios-1.12.1-20190318-pull-request' into staging

seabios update for 4.0

# gpg: Signature made Mon 18 Mar 2019 13:07:53 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/seabios-1.12.1-20190318-pull-request:
  seabios: update binaries to 1.12.1
  seabios: turn off CONFIG_ATA_DMA
  seabios: update submodule to 1.12.1
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

There have been regressions reported, when booting FreeDOS.
https://www.mail-archive.com/qemu-devel@nongnu.org/msg593254.htmlSigned-off-by: NGerd Hoffmann <kraxel@redhat.com>

git shortlog rel-1.12.0..rel-1.12.1
===================================

Kevin O'Connor (1):
      usb-ehci: Clear pipe token on pipe reallocate

Stephen Douthit (1):
      tpm: Check for TPM related ACPI tables before attempting hw probe
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

audio: pulseaudio fixes for 4.0

# gpg: Signature made Mon 18 Mar 2019 12:08:50 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/audio-20190318-pull-request:
  audio/paaudio: fix microphone input being unusable
  audio/paaudio: prolong and make latency configurable
  audio/paaudio: fix ignored buffer_length setting
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ui: fixes for 4.0 (vnc, curses, keymaps).

# gpg: Signature made Mon 18 Mar 2019 11:20:19 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20190318-pull-request:
  keymaps: regenerate keymaps
  keymaps: use nodeadkeys variant for de and fr
  curses ui: add missing iconv_close calls
  curses ui: always initialize all curses_line fields
  vnc: fix unalignment access in tight_pack24
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The current code does not specify the metrics of the buffers for the
input device. This makes PulseAudio choose very bad defaults, which
causes input to be unusable: Audio put in gets out 30 seconds later.
This patch fixes that and makes the latency configurable as well.
Signed-off-by: NMartin Schrodt <martin@schrodt.org>
Message-id: 20190315084653.120020-4-martin@schrodt.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The latency of a connection to the PulseAudio server is determined by
the tlength parameter. This was hardcoded to 10ms, which is a bit too
tight on my machine, causing audio on host and guest to malfunction.
A setting of 15ms works fine here. To allow tweaking, I also made the
setting configurable via the new -audiodev config. This allows to squeeze out better timings in scenarios where the emulation allows it.

I also removed setting of the minreq parameter to (seemingly arbitrary) half the latency, since it showed worse audio quality during my tests. Allowing PulseAudio to request smaller chunks helped.
Signed-off-by: NMartin Schrodt <martin@schrodt.org>
Message-id: 20190315084653.120020-3-martin@schrodt.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Audiodev configuration allows to set the length of the buffered data.
The setting was ignored and a constant value used instead.
This patch makes the code apply the setting properly, and uses the
previous default if nothing is supplied.
Signed-off-by: NMartin Schrodt <martin@schrodt.org>
Message-id: 20190315084653.120020-2-martin@schrodt.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Pick up the config updates.  Also add a few keys to the maps which
got a QKeyCode assigned since the last time we generated the maps
(Hiragana_Katakana, Muhenkan).  Sync with xkbcommon updates.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20190315110248.29208-3-kraxel@redhat.com

The reverse keymap code can't handle dead keys.  So use the nodeadkeys
variant of the keyboard layout for the german and french maps.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20190315110248.29208-2-kraxel@redhat.com

The iconv_t are opened but never closed.

Spotted by Coverity: CID 1399708
Spotted by Coverity: CID 1399709
Spotted by Coverity: CID 1399713
Signed-off-by: NSamuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20190314172524.9290-1-samuel.thibault@ens-lyon.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

cchar_t can contain not only attr and chars fields, but also ext_color.
Initialize the whole structure to zero instead of enumerating fields.

Spotted by Coverity: CID 1399711
Signed-off-by: NSamuel Thibault <samuel.thibault@ens-lyon.org>
Message-Id: <20190315130932.26094-1-samuel.thibault@ens-lyon.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

A Single RISC-V Patch for 4.0-rc0

There was a regression introduced by the decodetree conversion that has
a fairly straight-forward fix.  Since this fixes bugs that everyone has
hit I'd like to target it for rc0.

# gpg: Signature made Mon 18 Mar 2019 05:26:07 GMT
# gpg:                using RSA key 00CE76D1834960DFCE886DF8EF4CA1502CCBAB41
# gpg:                issuer "palmer@dabbelt.com"
# gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>" [unknown]
# gpg:                 aka "Palmer Dabbelt <palmer@sifive.com>" [unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 00CE 76D1 8349 60DF CE88  6DF8 EF4C A150 2CCB AB41

* remotes/palmer/tags/riscv-for-4.0-rc0:
  target/riscv: Fix manually parsed 16 bit insn
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

When adding '-fsanitize=undefined' in compiling configuration
and connect VM with vnc, it reports following error:

ui/vnc-enc-tight.c:910:13: runtime error: load of
misaligned address 0x621000466513 for type 'uint32_t',
which requires 4 byte alignment

This patch fix this issue.
Signed-off-by: NLi Qiang <liq3ea@163.com>
Message-id: 20190318010442.14897-1-liq3ea@163.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

during the refactor to decodetree we removed the manual decoding that is
necessary for c.jal/c.addiw and removed the translation of c.flw/c.ld
and c.fsw/c.sd. This reintroduces the manual parsing and the
omited implementation.
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Tested-by: NPalmer Dabbelt <palmer@sifive.com>
Reviewed-by: NAlistair Francis <alistair.francis@wdc.com>
Tested-by: NAlistair Francis <alistair.francis@wdc.com>
Signed-off-by: NPalmer Dabbelt <palmer@sifive.com>

Fix lost interrupts.
Update seabios-hppa.

# gpg: Signature made Sat 16 Mar 2019 16:13:42 GMT
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" [full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-hppa-20190316:
  Update seabios-hppa to latest upstream
  target/hppa: Avoid squishing DISAS_IAQ_N_STALE_EXIT
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

RDMA queue

 * Another Clang compilation fix
 * Collect pvrdma debugging statistics
 * Various fixes for the pvrdma device

# gpg: Signature made Sat 16 Mar 2019 14:09:02 GMT
# gpg:                using RSA key 36D4C0F0CF2FE46D
# gpg: Good signature from "Marcel Apfelbaum <marcel.apfelbaum@zoho.com>" [marginal]
# gpg:                 aka "Marcel Apfelbaum <marcel@redhat.com>" [marginal]
# gpg:                 aka "Marcel Apfelbaum <marcel.apfelbaum@gmail.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: B1C6 3A57 F92E 08F2 640F  31F5 36D4 C0F0 CF2F E46D

* remotes/marcel/tags/rdma-pull-request:
  hw/rdma: Fix the error prints in create_qp_rings()
  hw/pvrdma: Fix zero-initialization of resp in {query/modify}_qp
  hw/rdma: Use {} instead of {0}
  hw/rdma: Remove unused parameter from rdma_poll_cq()
  hw/rdma: Fix broken paths to docs/devel/tracing.txt
  hw/rdma: another clang compilation fix
  hw/pvrdma: Provide correct value to object_get_typename
  hw/pvrdma: Unregister from shutdown notifier when device goes down
  hw/pvrdma: Delete pvrdma_exit function
  hw/pvrdma: Delete unneeded function argument
  hw/rdma: Free all receive buffers when QP is destroyed
  hw/rdma: Free all MAD receive buffers when device is closed
  {hmp, hw/pvrdma}: Expose device internals via monitor interface
  hw/pvrdma: Collect debugging statistics
  hw/rdma: Protect against concurrent execution of poll_cq
  hw/rdma: Introduce protected qlist
  hw/rdma: Switch to generic error reporting way
  contrib/rdmacm-mux: Fix out-of-bounds risk
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The prints should indicate that we are talking about QP and not CQ.

Fixes: 98d176f8 ("hw/rdma: PVRDMA commands and data-path ops")
Reviewed-by: NYuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: NKamal Heib <kamalheib1@gmail.com>
Message-Id: <20190227085546.23690-1-kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Make sure to zero-initialize only the pvrdma_cmd_query_qp_resp and not
the whole pvrdma_cmd_resp for query_qp, in modify_qp the resp isn't used
so remove it.
Reviewed-by: NYuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: NKamal Heib <kamalheib1@gmail.com>
Message-Id: <20190314153031.7197-5-kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Initialize structs with {} instead of {0} to make sure that all code is
using the same convention.
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Signed-off-by: NKamal Heib <kamalheib1@gmail.com>
Reviewed-by: NYuval Shaia <yuval.shaia@oracle.com>
Message-Id: <20190314153031.7197-4-kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

The 'rdma_dev_res' parameter is not used in rdma_poll_cq(), so remove it.
Reviewed-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Signed-off-by: NKamal Heib <kamalheib1@gmail.com>
Message-Id: <20190314153031.7197-3-kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

The tracing.txt file is under "docs/devel" and not "docs".
Reviewed-by: NYuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: NKamal Heib <kamalheib1@gmail.com>
Message-Id: <20190314153031.7197-2-kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Configuring QEMU with:
   configure --target-list="x86_64-softmmu" --cc=clang --enable-pvrdma
Results in:
   qemu/hw/rdma/rdma_rm_defs.h:108:3: error: redefinition of typedef 'RdmaDeviceResources' is a C11 feature [-Werror,-Wtypedef-redefinition]
   } RdmaDeviceResources;
     ^
   qemu/hw/rdma/rdma_backend_defs.h:24:36: note: previous definition is here
   typedef struct RdmaDeviceResources RdmaDeviceResources;

Fix by removing one of the 'typedef' definitions.
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <20190214154053.15050-1-marcel.apfelbaum@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Use base object of PCIDevice in call to object_get_typename().
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Message-Id: <1552300155-25216-12-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

This hook was installed to close the device when VM is going down.
After the device is closed there is no need to be informed on VM
shutdown.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-11-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

This hook is not called and was implemented by mistake.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-10-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

The function's argument rdma_dev_res is not needed as it is stored in
the backend_dev object at init.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-9-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

When QP is destroyed the backend QP is destroyed as well. This ensures
we clean all received buffer we posted to it.
However, a contexts of these buffers are still remain in the device.
Fix it by maintaining a list of buffer's context and free them when QP
is destroyed.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-8-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

When device is going down free all saved MAD buffers.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-7-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Allow interrogating device internals through HMP interface.
The exposed indicators can be used for troubleshooting by developers or
sysadmin.
There is no need to expose these attributes to a management system (e.x.
libvirt) because (1) most of them are not "device-management' related
info and (2) there is no guarantee the interface is stable.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Acked-by: NDr. David Alan Gilbert <dgilbert@redhat.com>
Acked-by: NMarkus Armbruster <armbru@redhat.com>
Message-Id: <1552300155-25216-6-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Add counters to enable enhance debugging
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Message-Id: <1552300155-25216-5-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

The function rdma_poll_cq is called from two contexts - completion
handler thread which sense new completion on backend channel and
explicitly as result of guest issuing poll_cq command.

Add lock to protect against concurrent executions.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-4-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

To make code more readable move handling of protected list to a
rdma_utils
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-3-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

Utilize error_report for all pr_err calls and some pr_dbg that are
considered as errors.
For the remaining pr_dbg calls, the important ones were replaced by
trace points while other deleted.
Some of the functions got renamed to include prefix "rdma/pvrdma"
in the function name.
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Reviewed-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>
Message-Id: <1552300155-25216-2-git-send-email-yuval.shaia@oracle.com>
Reviewed-by: NKamal Heib <kamalheib1@gmail.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

The function get_fd extract context from the received MAD message and
uses it as a key to fetch the destination fd from the mapping table.
A context can be dgid in case of CM request message or comm_id in case
of CM SIDR response message.

When MAD message with a smaller size as expected for the message type
received we are hitting out-of-bounds where we are looking for the
context out of message boundaries.

Fix it by validating the message size.

Reported-by Sam Smith <sam.j.smith@oracle.com>
Signed-off-by: NYuval Shaia <yuval.shaia@oracle.com>
Message-Id: <20190212112347.1605-1-yuval.shaia@oracle.com>
Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: NMarcel Apfelbaum <marcel.apfelbaum@gmail.com>

This patch fixes two issues in the hppa/parisc emulation:

1. The CPU HPA was wrong in the sense that we had negative module
offsets in the firmware-internal module table (which we ignored up to
now). Get it correct by changing the CPU HPA to 0xfffb0000 which is
greater than the DINO_HPA of 0xfff80000.
This change requires the seabios-firmware update.

2. Sven noticed that the FPU register cr10 is only able to reference up
to 8 FPUs, so let's reduce the maximum amount of SMP CPUs too.
Signed-off-by: NHelge Deller <deller@gmx.de>
Message-Id: <20190315164130.GA7800@ls3530>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Within a delay slot, we were squishing both DISAS_IAQ_N_STALE and
DISAS_IAQ_N_STALE_EXIT to DISAS_IAQ_N_UPDATED.  This lost the
required exit to the main loop, and could result in interrupts
never being delivered.
Tested-by: NSven Schnelle <svens@stackframe.org>
Reported-by: NSven Schnelle <svens@stackframe.org>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

target-arm queue:
 * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
 * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
 * virt-acpi-build: Fix SMMUv3 GSIV values
 * Allow EL0 to write to arch timer registers, not just read them
 * bcm2836_control: Implement local timer

# gpg: Signature made Fri 15 Mar 2019 11:37:29 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20190315:
  target/arm: Check access permission to ADDVL/ADDPL/RDVL
  hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
  target/arm: change arch timer registers access permission
  hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
  hw/intc/bcm2836_control: Implement local timer
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

These instructions do not trap when SVE is disabled in EL0,
causing them to be executed with wrong size information.
Signed-off-by: NAmir Charif <amir.charif@cea.fr>
Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
[PMM: added 'target/arm' prefix to subject]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>