Commit c8a35f1c "fdc: use IsaDma interface instead of global DMA_*
functions" accidentally introduced a segfault in fdctrl_stop_transfer() for
non-DMA transfers.

If fdctrl->dma_chann has not been configured then the fdctrl->dma interface
reference isn't initialised during isabus_fdc_realize(). Unfortunately
fdctrl_stop_transfer() unconditionally references the DMA interface when
finishing the transfer causing a NULL pointer dereference.

Fix the issue by adding a check in fdctrl_stop_transfer() so that the DMA
interface reference and release method is only invoked if fdctrl->dma_chann
has been set.

(This issue was discovered by Martin testing a recent change in the NetBSD
installer under qemu-system-sparc)

Cc: qemu-stable@nongnu.org
Reported-by: NMartin Husemann <martin@duskware.de>
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NHervé Poussineau <hpoussin@reactos.org>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Currently, the nvme_cmb_ops mr doesn't check the addr and size.
This can lead an oob access issue. This is triggerable in the guest.
Add check to avoid this issue.

Fixes CVE-2018-16847.
Reported-by: NLi Qiang <liq3ea@gmail.com>
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NLi Qiang <liq3ea@gmail.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The MAINTAINERS file is a bit sparse on information about what
the different designators are. Let's add some more information
to give contributors a better idea about what the different
roles are.
Signed-off-by: NCornelia Huck <cohuck@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Message-id: 20181026105711.29605-1-cohuck@redhat.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

MIPS queue for QEMU 3.1-rc2 - v2

# gpg: Signature made Sat 17 Nov 2018 18:30:46 GMT
# gpg:                using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01  DD75 D497 2A89 67F7 5A65

* remotes/amarkovic/tags/mips-queue-november-2018-v2:
  MAINTAINERS: Add Stefan Markovic as a MIPS reviewer
  target/mips: Disable R5900 support
  target/mips: Rename MMI-related functions
  target/mips: Rename MMI-related opcodes
  target/mips: Rename MMI-related masks
  target/mips: Guard check_insn with INSN_R5900 check
  target/mips: Guard check_insn_opc_user_only with INSN_R5900 check
  target/mips: Fix decoding mechanism of special R5900 opcodes
  target/mips: Fix decoding mechanism of R5900 DIV1 and DIVU1
  target/mips: Fix decoding mechanism of R5900 MFLO1, MFHI1, MTLO1 and MTHI1
  linux-user: Update MIPS specific prctl() implementation
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

RISC-V Patches for 3.1-rc2

This pull request contains four patches that aren't really related to
each other aside from all being bug fixes that I think should go in for
3.1.0:

* The second half of Alistair's memory leak patch set that I missed last
  week.
* A fix to make fclass.d availiable only on RV64IFD systems (without
  this it's availiable on RV32IFD systems, truncating the result).
* A fix to make sfence.vm availiable only in priv-1.9.1, and sfence.vma
  only availiable in priv-1.10.
* A change to respect fences in user-mode emulators, which were
  previously treated as NOPs.

As usual, this builds and boot Linux for me.  I don't think I have
anything else planned for 3.1.0, but I may be wrong as things are a bit
hectic this week.

# gpg: Signature made Tue 13 Nov 2018 23:48:38 GMT
# gpg:                using RSA key EF4CA1502CCBAB41
# gpg: Good signature from "Palmer Dabbelt <palmer@dabbelt.com>"
# gpg:                 aka "Palmer Dabbelt <palmer@sifive.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 00CE 76D1 8349 60DF CE88  6DF8 EF4C A150 2CCB AB41

* remotes/riscv/tags/riscv-for-master-3.1-rc2:
  RISC-V: Respect fences for user-only emulators
  target/riscv: Fix sfence.vm/a both available in any priv version
  target/riscv: Fix FCLASS_D being treated as RV64 only
  hw/riscv/virt: Free the test device tree node name
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add Stefan Markovic as a MIPS reviewer. He had several key
contributions to QEMU for MIPS this year. He is a meticulous
person with the ability to think and act on many levels.
Reviewed-by: NStefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Disable R5900 support. There are some outstanding issues related
to ABI support and emulation accuracy, that were not understood
well during review process. Disable to avoid backward compatibility
issues.

Reverts commit ed4f49ba.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Rename MMI-related functions.
Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: NStefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Rename MMI-related opcodes.
Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: NStefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Rename MMI-related masks.
Reviewed-by: NPhilippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: NStefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Explicitely mark handling of PREF instruction for R5900 as
treating the same as NOP.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NFredrik Noring <noring@nocrew.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Avoid using check_opc_user_only() as a decision making code wrt
various architectures. Use ctx->insn_flags checks instead.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NFredrik Noring <noring@nocrew.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

MOVN, MOVZ, MFHI, MFLO, MTHI, MTLO, MULT, MULTU, DIV, DIVU, DMULT,
DMULTU, DDIV, DDIVU and JR are decoded in decode_opc_special_tx79
instead of the generic decode_opc_special_legacy.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NFredrik Noring <noring@nocrew.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

DIV1 and DIVU1 are generated in gen_div1_tx79 instead of the generic
gen_muldiv.
Signed-off-by: NFredrik Noring <noring@nocrew.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

MFLO1, MFHI1, MTLO1 and MTHI1 are generated in gen_HILO1_tx79 instead of
the generic gen_HILO.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NFredrik Noring <noring@nocrew.org>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

Perform needed checks before actual prctl() PR_SET_FP_MODE and
PR_GET_FP_MODE work based on kernel implementation. Also, update
necessary hflags.
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>
Signed-off-by: NAleksandar Markovic <amarkovic@wavecomp.com>

ui: add rendernode arg for egl-headless (fixes permission issues with libvirt)

# gpg: Signature made Fri 16 Nov 2018 13:29:15 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-31-20181116-pull-request:
  help: Provide help for egl-headless
  ui: Allow specifying 'rendernode' display option for egl-headless
  qapi: Add "rendernode" display option for egl-headless
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

EGL headless has been missing from QEMU's help or man page, we should
mention that such a thing exists, especially since projects like libvirt
might rely on that. This patch also adds the newly introduced option for
egl-headless 'rendernode'.
Signed-off-by: NErik Skultety <eskultet@redhat.com>
Message-id: 87ef678b0934d3abba66c46c9e65b57119d29295.1542362949.git.eskultet@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

As libvirt can't predict which rendernode QEMU would pick, it
won't adjust the permissions on the device, hence QEMU getting
"Permission denied" when opening the DRI device. Therefore, enable
'rendernode' option for egl-headless display type.

Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1648236Signed-off-by: NErik Skultety <eskultet@redhat.com>
Message-id: 27f4617f19aa1072114f10f1aa9dd199735ef982.1542362949.git.eskultet@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Unlike SPICE, egl-headless doesn't offer a way of specifying the DRM
node used for OpenGL, hence QEMU always selecting the first one that is
available. Thus, add the 'rendernode' option for egl-headless to QAPI.
Signed-off-by: NErik Skultety <eskultet@redhat.com>
Message-id: 7658e15eca72d520e7a5fb1c2e724702d83d4f7f.1542362949.git.eskultet@redhat.com
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

# gpg: Signature made Fri 16 Nov 2018 03:38:58 GMT
# gpg:                using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) <jasowang@redhat.com>"
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  net/filter-rewriter.c: Fix coverity static analysis issue
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The original code just follow the TCP state diagram,
but in this case, we can skip the TCPS_TIME_WAIT state to simplify
the implementation.
Signed-off-by: NZhang Chen <zhangckid@gmail.com>
Signed-off-by: NJason Wang <jasowang@redhat.com>

Merge tpm 2018/11/15 v1

# gpg: Signature made Thu 15 Nov 2018 14:03:45 GMT
# gpg:                using RSA key 75AD65802A0B4211
# gpg: Good signature from "Stefan Berger <stefanb@linux.vnet.ibm.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: B818 B9CA DF90 89C2 D5CE  C66B 75AD 6580 2A0B 4211

* remotes/stefanberger/tags/pull-tpm-2018-11-15-1:
  tests: tpm: Use g_test_message rather than fprintf
  tpm: use loop iterator to set sts data field
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Coverity complains (CID 1390847) about some dead code in
do_sigreturn(). This is an if (err) clause that can never be
true, copied from the kernel (where __get_user returns an error).
The one code path that could report an error is in the
currently commented-out pseudocode for handling FPU register
restoring, so move the if into that comment (and fix the
broken indent in the comment in the process).

(The new position for the error check is also the semantically
correct one -- we should not restore the signal mask from
the signal frame if we get an error here, so the check must
be done before set_sigmask(), not after.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-id: 20181115114616.26265-1-peter.maydell@linaro.org

This is needed to build skiboot from tarball-distributed sources
since the git data the make_release.sh script relies on to generate
it is not available.

Cc: qemu-stable@nongnu.org
Reported-by: NMichael Tokarev <mjt@tls.msk.ru>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109161352.29873-1-mdroth@linux.vnet.ibm.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118-1' into staging

Testing tweaks:

  - split MacOSX build
  - fix for readdir() failures in check-tcg

# gpg: Signature made Wed 14 Nov 2018 13:08:24 GMT
# gpg:                using RSA key FBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>"
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-testing-fixes-for-3.1-141118-1:
  tests/tcg/multiarch: fix 32bit linux-test on 64bit host
  .travis.yml: split MacOSX builds and reduce target list
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fix error handling during zpci device creation.

# gpg: Signature made Wed 14 Nov 2018 10:08:43 GMT
# gpg:                using RSA key DECF6B93C6F02FAF
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>"
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>"
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>"
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>"
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>"
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20181114:
  s390x/pci: properly fail if the zPCI device cannot be created
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Display a message during the test using g_test_message rather
than fprintf.
Signed-off-by: NStefan Berger <stefanb@linux.ibm.com>
Reviewed-by: NThomas Huth <thuth@redhat.com>

When TIS request is done, set 'sts' data field across all localities.
Signed-off-by: NPrasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: NStefan Berger <stefanb@linux.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.ibm.com>

Fix:

  TEST    linux-test on i386
  .../tests/tcg/multiarch/linux-test.c:201: readdir

readdir() calls getdents64() to have the list of the entries in a
directory, and getdents64() can return 64bit d_off values (with ext4,
for instance) that will not fit in the 32bit d_off field of the
readdir() dirent structure.

To avoid that, use readdir64() to use a 64bit d_off field too.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>

We have reached the point where the MacOSX build was regularly timing
out. So as before I've reduced the target list to "major"
architectures to try and bring the build time down. I've added an
additional MacOSX build with the latest XCode with a minimal list of
"most likely" targets on MacOS.
Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>

Our current fence implementation ignores fences for the user-only
configurations.  This is incorrect but unlikely to manifest: it requires
multi-threaded user-only code that takes advantage of the weakness in
the host's memory model and can be inlined by TCG.

This patch simply treats fences the same way for all our emulators.
I've given it to testing as I don't want to construct a test that would
actually trigger the failure.

Our fence implementation has an additional deficiency where we map all
RISC-V fences to full fences.  Now that we have a formal memory model
for RISC-V we can start to take advantage of the strength bits on our
fence instructions.  This requires a bit more though, so I'm going to
split it out because the implementation is still correct without taking
advantage of these weaker fences.

Thanks to Richard Henderson for pointing out both of the issues.
Signed-off-by: NPalmer Dabbelt <palmer@sifive.com>
Reviewed-by: NAlistair Francis <alistair.francis@wdc.com>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>

sfence.vm has been replaced in priv v1.10 spec by sfence.vma.
Reported-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NPalmer Dabbelt <palmer@sifive.com>

Signed-off-by: NBastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NPalmer Dabbelt <palmer@sifive.com>

Signed-off-by: NAlistair Francis <alistair.francis@wdc.com>
Signed-off-by: NPalmer Dabbelt <palmer@sifive.com>

Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Right now, errors during realize()/pre_plug/plug of the zPCI device
would result in QEMU crashing instead of failing nicely when creating
a zPCI device for a PCI device.
Reviewed-by: NThomas Huth <thuth@redhat.com>
Reviewed-by: NCollin Walling <walling@linux.ibm.com>
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20181113121710.18490-1-david@redhat.com>
Signed-off-by: NCornelia Huck <cohuck@redhat.com>

qemu-ga patch queue for 3.1.0

* add missing #include guards for guest-agent-core.h
* fix leaks introduced with recent win32 enablement of disk info in
  guest-get-fsinfo

# gpg: Signature made Tue 13 Nov 2018 02:52:12 GMT
# gpg:                using RSA key 3353C9CEF108B584
# gpg: Good signature from "Michael Roth <flukshun@gmail.com>"
# gpg:                 aka "Michael Roth <mdroth@utexas.edu>"
# gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>"
# Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

* remotes/mdroth/tags/qga-pull-2018-11-12-tag:
  qga: Add multiple include guard to guest-agent-core.h
  qga-win: fix leaks of build_guest_disk_info()
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

- gdb signal handling fix
- add SO_REUSEPORT
- remove dead-code

# gpg: Signature made Mon 12 Nov 2018 20:48:23 GMT
# gpg:                using RSA key F30C38BD3F2FBE3C
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>"
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>"
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-3.1-pull-request:
  linux-user: Add support for SO_REUSEPORT
  linux-user: Clean up nios2 main loop signal handling
  linux-user: Don't call gdb_handlesig() before queue_signal()
  linux-user: Remove dead error-checking code
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

target/arm queue:
 * Remove no-longer-needed workaround for small SAU regions for v8M
 * Remove antique TODO comment
 * MAINTAINERS: Add an entry for the 'collie' machine
 * hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
 * Fix infinite recursion in tlbi_aa64_vmalle1_write()
 * ARM KVM: fix various bugs in handling of guest debugging
 * Correctly implement handling of HCR_EL2.{VI, VF}
 * Hyp mode R14 is shared with User and System
 * Give Cortex-A15 and -A7 the EL2 feature

# gpg: Signature made Tue 13 Nov 2018 10:51:53 GMT
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20181113:
  target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
  target/arm: Hyp mode R14 is shared with User and System
  target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
  target/arm: Track the state of our irq lines from the GIC explicitly
  Revert "target/arm: Implement HCR.VI and VF"
  arm: fix aa64_generate_debug_exceptions to work with EL2
  arm: use symbolic MDCR_TDE in arm_debug_target_el
  tests/guest-debug: fix scoping of failcount
  target/arm64: kvm debug set target_el when passing exception to guest
  target/arm64: hold BQL when calling do_interrupt()
  target/arm64: properly handle DBGVR RESS bits
  target/arm: Fix typo in tlbi_aa64_vmalle1_write
  hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
  MAINTAINERS: Add an entry for the 'collie' machine
  target/arm: Remove antique TODO comment
  target/arm: Remove workaround for small SAU regions
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>