Update OpenBIOS images

# gpg: Signature made Thu 19 Oct 2017 20:08:44 BST
# gpg:                using RSA key 0x5BC2C56FAE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-openbios-signed:
  Update OpenBIOS images to 83818bd built from submodule.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

qemu-sparc update

# gpg: Signature made Thu 19 Oct 2017 07:50:16 BST
# gpg:                using RSA key 0x5BC2C56FAE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-sparc-signed:
  sun4u: fix assert when adding NICs which aren't the in-built model
  sun4u: update PCI topology to include simba PCI bridges
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Merge remote-tracking branch 'remotes/kraxel/tags/seabios-1.11-prerelease-20171019-pull-request' into staging

seabios: update to 1.11 prerelease

# gpg: Signature made Thu 19 Oct 2017 09:19:33 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/seabios-1.11-prerelease-20171019-pull-request:
  seabios: update to 1.11 prerelease
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This was introduced by:
    commit aef45d51
    Author: Daniel P. Berrange <berrange@redhat.com>
    Date:   Fri Sep 29 11:11:56 2017 +0100

	build: automatically handle GIT submodule checkout for dtc

On my system, I see the following with a fresh clone:

% ./configure --disable-gtk --target-list=aarch64-softmmu
% make -j8
  GEN     aarch64-softmmu/config-devices.mak.tmp
  GEN     config-host.h
mkdir -p dtc/libfdt
  GIT     ui/keycodemapdb dtc
mkdir -p dtc/tests
  GEN     qemu-options.def
[snip]
  GEN     migration/trace.h
make: *** [git-submodule-update] Error 1
make: *** Waiting for unfinished jobs....

Upon closer inspection, the root cause of the error is:

% git submodule update --init ui/keycodemapdb dtc
fatal: destination path 'dtc' already exists and is not an empty directory.
Clone of 'git://git.qemu-project.org/dtc.git' into submodule path 'dtc' failed

This patch fixes this race condition by forcing the 'dtc/%' rule which caused
'dtc' to be non-empty to wait on '.git-submodule-status'.
Signed-off-by: NAaron Lindsay <alindsay@codeaurora.org>
Reviewed-by: NDaniel P. Berrange <berrange@redhat.com>
Acked-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1508352023-28591-1-git-send-email-alindsay@codeaurora.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

* TCG 8-byte atomic accesses bugfix (Andrew)
* Report disk rotation rate (Daniel)
* Report invalid scsi-disk block size configuration (Mark)
* KVM and memory API MemoryListener fixes (David, Maxime, Peter Xu)
* x86 CPU hotplug crash fix (Igor)
* Load/store API documentation (Peter Maydell)
* Small fixes by myself and Thomas
* qdev DEVICE_DELETED deferral (Michael)

# gpg: Signature made Wed 18 Oct 2017 10:56:24 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (29 commits)
  scsi: reject configurations with logical block size > physical block size
  qdev: defer DEVICE_DEL event until instance_finalize()
  Revert "qdev: Free QemuOpts when the QOM path goes away"
  qdev: store DeviceState's canonical path to use when unparenting
  qemu-pr-helper: use new libmultipath API
  watch_mem_write: implement 8-byte accesses
  notdirty_mem_write: implement 8-byte accesses
  memory: reuse section_from_flat_range()
  kvm: simplify kvm_align_section()
  kvm: region_add and region_del is not called on updates
  kvm: fix error message when failing to unregister slot
  kvm: tolerate non-existing slot for log_start/log_stop/log_sync
  kvm: fix alignment of ram address
  memory: call log_start after region_add
  target/i386: trap on instructions longer than >15 bytes
  target/i386: introduce x86_ld*_code
  tco: add trace events
  docs/devel/loads-stores.rst: Document our various load and store APIs
  nios2: define tcg_env
  build: remove CONFIG_LIBDECNUMBER
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Linux-user updates for Qemu 2.11

# gpg: Signature made Wed 18 Oct 2017 13:20:14 BST
# gpg:                using RSA key 0xB44890DEDE3C9BC0
# gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
# gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"
# Primary key fingerprint: FF82 03C8 C391 98AE 0581  41EF B448 90DE DE3C 9BC0

* remotes/riku/tags/pull-linux-user-20171018:
  linux-user: Fix TARGET_MTIOCTOP/MTIOCGET/MTIOCPOS values
  linux-user/main: support dfilter
  linux-user: Fix target FS_IOC_GETFLAGS and FS_IOC_SETFLAGS numbers
  linux-user/sh4: Reduce TARGET_VIRT_ADDR_SPACE_BITS to 31
  linux-user: Tidy and enforce reserved_va initialization
  tcg: Fix off-by-one in assert in page_set_flags
  linux-user: Allow -R values up to 0xffff0000 for 32-bit ARM guests
  linux-user: remove duplicate break in syscall
  target/m68k,linux-user: manage FP registers in ucontext
  linux-user: fix O_TMPFILE handling
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ui: opengl updates for dma-buf support.

# gpg: Signature made Tue 17 Oct 2017 12:13:36 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/opengl-20171017-pull-request:
  egl-headless: add dmabuf support
  egl-helpers: add egl_texture_blit and egl_texture_blend
  egl-helpers: add dmabuf import support
  opengl: add flipping vertex shader
  opengl: move shader init from console-gl.c to shader.c
  console: add support for dmabufs
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

cirrus: bugfixes, with some vga cleanups.

# gpg: Signature made Tue 17 Oct 2017 09:24:37 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20171017-pull-request:
  cirrus: fix oob access in mode4and5 write functions
  vga: add ram_addr_t cast
  vga: handle cirrus vbe mode wraparounds.
  vga: drop line_offset variable
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This is the seabios update for qemu 2.11.  Well, almost, seabios is in
freeze for the upcoming 1.11 release.  This updates seabios to current
git master snapshot, and it will be updated again to 1.11 final before
the 2.11 release.

With this two-step seabios gets some more wide testing before the actual
release and the update to 1.11 final (which will most likely happen
after qemu freeze) should have bugfix patches only.

git shortlog
============

Aleksandr Bezzubikov (3):
      pci: refactor pci_find_capapibilty to get bdf as the first argument instead of the whole pci_device
      pci: add QEMU-specific PCI capability structure
      pci: enable RedHat PCI bridges to reserve additional resources on PCI init

Ben Warren (5):
      QEMU DMA: Add DMA write capability
      romfile-loader: Switch to using named structs
      QEMU fw_cfg: Add command to write back address of file
      QEMU fw_cfg: Add functions for accessing files by key
      QEMU fw_cfg: Write fw_cfg back on S3 resume

Daniel Verkamp (5):
      nvme: support NVMe 1.0 controllers
      nvme: extend command timeout to 5 seconds
      nvme: fix reversed loop condition in cmd_readwrite
      nvme: fix extraction of status code bits
      nvme: fix copy-paste mistake in comment

Filippo Sironi (1):
      nvme: Use the Maximum Queue Entries Supported (MQES) to initialize I/O queues

Gerd Hoffmann (7):
      usb: add hub portmap
      usb-xhci: use hub portmap
      std: add cp437 to unicode map
      kbd: make enqueue_key public, add ascii_to_keycode
      romfile: add support for constant files.
      paravirt: serial console configuration.
      add serial console support

Igor Mammedov (1):
      drop "etc/boot-cpus" fw_cfg file and reuse legacy QEMU_CFG_NB_CPUS

Jason Wang (1):
      virtio: IOMMU support

Julian Stecklina (2):
      block: add NVMe boot support
      nvme: fix out of memory behavior

Julius Werner (1):
      coreboot: Adapt to upstream CBMEM console changes

Kevin O'Connor (26):
      usb: Make usb_time_sigatt variable static
      tpm: Add comment banners to tcg.c separating major parts of spec
      tpm: Don't call tpm_set_failure() from tpm12_get_capability()
      tpm: Move code around in tcgbios.c to keep like code together
      acpi: Generalize find_fadt() and find_tcpa_by_rsdp() into find_acpi_table()
      tpm: Don't call tpm_build_and_send_cmd() from tpm20_stirrandom()
      tpm: Rework tpm_build_and_send_cmd() into tpm_simple_cmd()
      ps2port: Disable keyboard/mouse prior to resetting ps2 controller
      docs: Note release dates for 1.10.1 and 1.10.2
      resume: Don't attempt to use generic reboot mechanisms on QEMU
      boot: Increase description size in boot menu
      src: Minor - remove tab characters that slipped into SeaBIOS C code
      NVMe: Allow NVMe to be enabled on real hardware
      smm: Backup and restore A20 on an SMI based mode switch
      stacks: Make sure to initialize Call16Data
      stacks: Don't update the A20 settings if they haven't changed
      stacks: There is no need to disable NMI if it is already disabled
      vga: Fix bug in stdvga_get_linesize()
      docs: Fix typos in Memory_Model.md
      tcgbios: Fix use of unitialized variable
      boot: Rename drive_g to drive
      disk: Don't require the 'struct drive_s' to be in the f-segment
      block: Rename disk_op_s->drive_gf to drive_fl
      virtio: Allocate drive_s storage in low memory
      xhci: Build TRBs directly in xhci_trb_queue()
      xhci: Verify the device is still present in xhci_cmd_submit()

Ladi Prosek (1):
      ahci: Set upper 32-bit registers to zero

Patrick Rudolph (4):
      SeaVGABios/cbvga: Advertise correct pixel format
      SeaVGABIOS/vbe: Query driver for scanline pitch v2
      SeaVGABios/cbvga: Use active mode to clear screen
      SeaVGABios/cbvga: Advertise compatible VESA modes

Paul Menzel (1):
      vgasrc: Increase debug level

Petr Berky (1):
      config: Add function to check if fw_cfg exists

Ricardo Ribalda Delgado (1):
      serialio: Support for mmap serial ports

Roman Kagan (11):
      blockcmd: accept only disks and CD-ROMs
      blockcmd: generic SCSI luns enumeration
      virtio-scsi: enumerate luns with REPORT LUNS
      esp-scsi: enumerate luns with REPORT LUNS
      usb-uas: enumerate luns with REPORT LUNS
      pvscsi: fix the comment about lun enumeration
      mpt-scsi: try to enumerate luns with REPORT LUNS
      lsi-scsi: reset in case of a serious problem
      lsi-scsi: try to enumerate luns with REPORT LUNS
      blockcmd: start REPORT_LUNS with the smallest buffer
      Revert "lsi-scsi: reset in case of a serious problem"

Stefan Berger (1):
      tpm: Log TPM 2 digest structure in little endian format

Youness Alaoui (1):
      nvme: Enable NVMe support for non-qemu hardware

Zeh, Werner (1):
      ahci: Disable Native Command Queueing
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Commit 8d932971 introduced a bug whereby non-inbuilt NICs are realized before
setting the default MAC address causing an assert. Switch NIC creation
over from pci_create_simple() to pci_create() which works exactly the
same except omitting the realize as originally intended.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

This patch updates the sun4u model to being much closer to a real Ultra 5
by moving devices behind the 2 simba PCI bridges (A and B) as found on real
hardware.

The most noticeable change introduced by this patchset is that in-built devices
are no longer attached to the PCI root bus, but instead behind PCI bridge A.
Along with this the interrupt routing is updated accordingly to match the
official documentation.

Since the existing code currently bypasses the PCI bridge interrupt
swizzling, the interrupt mapping functions are reorganised so that
pci_pbm_map_irq() is used by the PCI bridges and pci_apb_map_irq() is
used by the PCI host bridge.

Behind the sabre PCI host bridge, the PCI IO space now needs to be
split into two separate halves at 0x8000000. Therefore we also setup a new
PCI IO space region of increased size on the PCI host bridge and enable
32-bit PCI IO accesses to allow IO accesses to reach devices behind PCI
bridge B correctly.

As part of this change we also combine the onboard sunhme NIC and the ebus
into a single multi-function device as done on a real Ultra 5. For other
NICs the existing behaviour is preserved, i.e. we initialise them and
place them into the next free slot on PCI bus B.

Finally we mark the physically unavailable slots (plus slot 0 in busA) as
reserved to ensure that users can't plug devices into non-existent slots
which will break interrupt routing.

Note: since this commit changes PCI topology and interrupt routing, an
updated openbios-sparc64 binary is included with this commit containing the
associated changes to maintain bisectability.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>

Logical block size of a SCSI disk should never be larger than
physical block size. From an ATA/SCSI perspective, it makes no sense
to have the logical block size greater than the physical block size,
and it cannot even be effectively expressed in the command set. The
whole point of adding the physical block size to the ATA/SCSI command
set was to communicate a desire for a larger block size (than logical),
while maintaining backwards compatibility with legacy 512 byte block
size.

When setting logical_block_size > physical_block_size, QEMU cannot express
it in READ CAPACITY(16) output, and all it can do is set the physical
block exponent to 0 (i.e. logical_block_size == physical_block_size).
Reporting the error properly, however, is better.
Signed-off-by: NMark Kanda <mark.kanda@oracle.com>
Reviewed-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: NMartin K. Petersen <martin.petersen@oracle.com>
Message-Id: <1508185024-5840-1-git-send-email-mark.kanda@oracle.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

DEVICE_DEL is currently emitted when a Device is unparented, as
opposed to when it is finalized. The main design motivation for this
seems to be that after unparent()/unrealize(), the Device is no
longer visible to the guest, and thus the operation is complete
from the perspective of management.

However, there are cases where remaining host-side cleanup is also
pertinent to management. The is generally handled by treating these
resources as aspects of the "backend", which can be managed via
separate interfaces/events, such as blockdev_add/del, netdev_add/del,
object_add/del, etc, but some devices do not have this level of
compartmentalization, namely vfio-pci, and possibly to lend themselves
well to it.

In the case of vfio-pci, the "backend" cleanup happens as part of
the finalization of the vfio-pci device itself, in particular the
cleanup of the VFIO group FD. Failing to wait for this cleanup can
result in tools like libvirt attempting to rebind the device to
the host while it's still being used by VFIO, which can result in
host crashes or other misbehavior depending on the host driver.

Deferring DEVICE_DEL still affords us the ability to manage backends
explicitly, while also addressing cases like vfio-pci's, so we
implement that approach here.

An alternative proposal involving having VFIO emit a separate event
to denote completion of host-side cleanup was discussed, but the
prevailing opinion seems to be that it is not worth the added
complexity, and leaves the issue open for other Device implementations
to solve in the future.
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Tested-by: NEric Auger <eric.auger@redhat.com>
Reviewed-by: NDavid Gibson <david@gibson.dropbear.id.au>
Message-Id: <20171016222315.407-4-mdroth@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

This reverts commit abed886e.

This patch originally addressed an issue where a DEVICE_DELETED
event could be emitted (in device_unparent()) before a Device's
QemuOpts were cleaned up (in device_finalize()), leading to a
"duplicate ID" error if management attempted to immediately add
a device with the same ID in response to the DEVICE_DELETED event.

An alternative will be implemented in a subsequent patch where we
defer the DEVICE_DELETED event until device_finalize(), which would
also prevent the race, so we revert the original fix in preparation.
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Tested-by: NEric Auger <eric.auger@redhat.com>
Reviewed-by: NDavid Gibson <david@gibson.dropbear.id.au>
Message-Id: <20171016222315.407-3-mdroth@linux.vnet.ibm.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

device_unparent(dev, ...) is called when a device is unparented,
either directly, or as a result of a parent device being
finalized, and handles some final cleanup for the device. Part
of this includes emiting a DEVICE_DELETED QMP event to notify
management, which includes the device's path in the composition
tree as provided by object_get_canonical_path().

object_get_canonical_path() assumes the device is still connected
to the machine/root container, and will assert otherwise, but
in some situations this isn't the case:

If the parent is finalized as a result of object_unparent(), it
will still be attached to the composition tree at the time any
children are unparented as a result of that same call to
object_unparent(). However, in some cases, object_unparent()
will complete without finalizing the parent device, due to
lingering references that won't be released till some time later.
One such example is if the parent has MemoryRegion children (which
take a ref on their parent), who in turn have AddressSpace's (which
take a ref on their regions), since those AddressSpaces get cleaned
up asynchronously by the RCU thread.

In this case qdev:device_unparent() may be called for a child Device
that no longer has a path to the root/machine container, causing
object_get_canonical_path() to assert.

Fix this by storing the canonical path during realize() so the
information will still be available for device_unparent() in such
cases.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Signed-off-by: NGreg Kurz <groug@kaod.org>
Signed-off-by: NMichael Roth <mdroth@linux.vnet.ibm.com>
Tested-by: NEric Auger <eric.auger@redhat.com>
Reviewed-by: NDavid Gibson <david@gibson.dropbear.id.au>
Message-Id: <20171016222315.407-2-mdroth@linux.vnet.ibm.com>
[Clear dev->canonical_path at the post_realize_fail label, which is
 cleaner.  Suggested by David Gibson. - Paolo]
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

libmultipath has recently changed its API.  The new API supports multi-threaded
clients better.  Unfortunately there is no backwards-compatibility, so we just
switch to the new one.  Running QEMU compiled with the new library on the old
library will likely crash, while doing the opposite will cause QEMU not to
start at all (because udev, get_multipath_config and put_multipath_config
are undefined).
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Aligned 8-byte memory writes by a 64-bit target on a 64-bit host should
always turn into atomic 8-byte writes on the host, however a write
write watchpoint would end up tearing the 8-byte write into two 4-byte
writes in access_with_adjusted_size().
Reported-by: NAndrew Baumann <Andrew.Baumann@microsoft.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Aligned 8-byte memory writes by a 64-bit target on a 64-bit host should
always turn into atomic 8-byte writes on the host, however if we missed
in the softmmu, and the TLB line was marked as not dirty, then we
would end up tearing the 8-byte write into two 4-byte writes in
access_with_adjusted_size().
Signed-off-by: NAndrew Baumann <Andrew.Baumann@microsoft.com>
Message-Id: <20171013181913.7556-1-Andrew.Baumann@microsoft.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

We can use section_from_flat_range() instead of manually initializing.
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-8-david@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Use ROUND_UP and simplify the code a bit.
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-7-david@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Attributes are not updated via region_add()/region_del(). Attribute changes
lead to a delete first, followed by a new add.

If this would ever not be the case, we would get an error when trying to
register the new slot.
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-6-david@redhat.com>
Tested-by: NJoe Clifford <joeclifford@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

"overlapping" is a leftover, let's drop it.
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-5-david@redhat.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

If we want to trap every access to a section, we might not have a
slot. So let's just tolerate if we don't have one.
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-4-david@redhat.com>
Tested-by: NJoe Clifford <joeclifford@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Fix the wrong calculation of the delta, used to align the ram address.

This only strikes if alignment has to be done.
Reported-by: NJoe Clifford <joeclifford@gmail.com>
Fixes: 5ea69c2e ("kvm: factor out alignment of memory section")
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-3-david@redhat.com>
Tested-by: NJoe Clifford <joeclifford@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

It might be confusing for some listener implementations that implement
both, region_add and log_start (e.g. KVM) if we call log_start before an
actual region was added using region_add.

This makes current KVM code trigger an assertion
("kvm_section_update_flags: error finding slot"). So let's just reverse
the order instead of tolerating log_start on yet unknown regions.
Reported-by: NThomas Huth <thuth@redhat.com>
Signed-off-by: NDavid Hildenbrand <david@redhat.com>
Message-Id: <20171016144302.24284-2-david@redhat.com>
Tested-by: NJoe Clifford <joeclifford@gmail.com>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

The TARGET_MTIOCTOP/TARGET_MTIOCGET/TARGET_MTIOCPOS values
were being defined in terms of host struct types, but
these structures are such that their size might differ
on different hosts. Switch to using a target struct
definition instead.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

This adds the -dfilter support to linux-user. There is a minor
checkpatch complaint about formatting which I've ignored for aesthetic
reasons.
Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

ppc patch queue 2017-10-17

Here's the currently accumulated set of ppc patches for qemu.

  * The biggest set here is the ppc parts of Igor Mammedov's cleanups
    to cpu model handling
  * The above also includes a generic patches which are required as
    prerequisites for the ppc parts.  They don't seem to have been
    merged by Eduardo yet, so I hope they're ok to include here.
  * Apart from that it's basically just assorted bug fixes and cleanups

# gpg: Signature made Tue 17 Oct 2017 05:20:03 BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.11-20171017: (34 commits)
  spapr_cpu_core: rewrite machine type sanity check
  spapr_pci: fail gracefully with non-pseries machine types
  spapr: Correct RAM size calculation for HPT resizing
  ppc: pnv: consolidate type definitions and batch register them
  ppc: pnv: drop PnvChipClass::cpu_model field
  ppc: pnv: define core types statically
  ppc: pnv: drop PnvCoreClass::cpu_oc field
  ppc: pnv: normalize core/chip type names
  ppc: pnv: use generic cpu_model parsing
  ppc: spapr: use generic cpu_model parsing
  ppc: move ppc_cpu_lookup_alias() before its first user
  ppc: spapr: use cpu model names as tcg defaults instead of aliases
  ppc: spapr: register 'host' core type along with the rest of core types
  ppc: spapr: use cpu type name directly
  ppc: spapr: define core types statically
  ppc: move '-cpu foo,compat=xxx' parsing into ppc_cpu_parse_featurestr()
  ppc: spapr: replace ppc_cpu_parse_features() with cpu_parse_cpu_model()
  ppc: 40p/prep: replace cpu_model with cpu_type
  ppc: virtex-ml507: replace cpu_model with cpu_type
  ppc: replace cpu_model with cpu_type on ref405ep,taihu boards
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

trivial patches for 2017-10-16

# gpg: Signature made Mon 16 Oct 2017 21:32:05 BST
# gpg:                using RSA key 0x701B4F6B1A693E59
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931  4B22 701B 4F6B 1A69 3E59

* remotes/mjt/tags/trivial-patches-fetch:
  Add myself as maintainer for TPM code
  filter-mirror: segfault when specifying non existent device
  MAINTAINERS: Track default-configs/pci.mak
  MAINTAINERS: Fix Sun4v file
  MAINTAINERS: Clean up SCSI device section
  include/hw/or-irq.h: Drop unused in_irqs field
  io: Add missing GCC_FMT_ATTR (fix -Werror=suggest-attribute=format)
  os-posix: Drop misleading comment
  linux-user: Add some random ioctls
  futex: add missing header guards
  ui/gtk: Fix deprecation of vte_terminal_copy_clipboard
  gitignore: ignore check-qlit test
  linux-user: remove duplicate break in syscall
  qemu-doc.texi: remove trailing whitespace
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Merge QIO 2017/10/16 v1

# gpg: Signature made Mon 16 Oct 2017 17:10:54 BST
# gpg:                using RSA key 0xBE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>"
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>"
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF

* remotes/berrange/tags/pull-qio-2017-10-16-1:
  io: fix mem leak in websock error path
  io: add trace points for websocket HTTP protocol headers
  io: cope with websock 'Connection' header having multiple values
  io: get rid of bounce buffering in websock write path
  io: pass a struct iovec into qio_channel_websock_encode
  io: get rid of qio_channel_websock_encode helper method
  io: simplify websocket ping reply handling
  io: monitor encoutput buffer size from websocket GSource
  sockets: Handle race condition between binds to the same port
  sockets: factor out create_fast_reuse_socket
  sockets: factor out a new try_bind() function
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This fixes a potential data leak to the guest.

# gpg: Signature made Mon 16 Oct 2017 16:08:25 BST
# gpg:                using DSA key 0x02FC3AEB0101DBC2
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Greg Kurz <groug@free.fr>"
# gpg:                 aka "Greg Kurz <gkurz@linux.vnet.ibm.com>"
# gpg:                 aka "Gregory Kurz (Groug) <groug@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2BD4 3B44 535E C0A7 9894  DBA2 02FC 3AEB 0101 DBC2

* remotes/gkurz/tags/for-upstream:
  9pfs: use g_malloc0 to allocate space for xattr
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ui: use keycodemapdb for key code mappings, part one (v2)
ui: add qemu-keymap, update reverse keymaps (for qemu -k $map)
ui: fix for vte 0.50
ui: gtk texture fix

# gpg: Signature made Mon 16 Oct 2017 14:12:49 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20171016-pull-request:
  gtk: fix wrong id between texture and framebuffer
  ui/gtk: Fix deprecation of vte_terminal_copy_clipboard
  pc-bios/keymaps: keymaps update
  Add pc-bios/keymaps/Makefile
  tools: add qemu-keymap
  ui: don't export qemu_input_event_new_key
  ui: convert key events to QKeyCodes immediately
  ui: convert common input code to keycodemapdb
  ui: add keycodemapdb repository as a GIT submodule
  docker: don't rely on submodules existing in the main checkout
  build: automatically handle GIT submodule checkout for dtc
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add support for the new dmabuf interface.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-7-kraxel@redhat.com

egl_texture_blit() blits a texture, simliar to egl_fb_blit() but by
rendering the texture to the screen instead of using a framebuffer blit.

egl_texture_blend() renders a texture with alpha blending, will be used
to render the cursor to the screen.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-6-kraxel@redhat.com

Add helper function to import a dma-buf as opengl texture.
Also add a helper to release the texture again.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-5-kraxel@redhat.com

Add vertex shader which flips the texture upside down while blitting it.
Add argument to qemu_gl_run_texture_blit() to enable flipping.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-4-kraxel@redhat.com

With the upcoming dmabuf support in qemu there will be more users of the
shaders than just console-gl.c.  So rename ConsoleGLState to
QemuGLShader, rename some functions too, move code from console-gl.c to
shaders.c.

No functional change.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-3-kraxel@redhat.com

This patch adds support for dma-bufs to the qemu console interfaces.
It adds a new "struct QemuDmaBuf" to represent a dmabuf with accociated
metatdata (size, format).  It adds three functions (and
DisplayChangeListenerOps operations) to set a dma-buf as display
scanout, as cursor and to release a dmabuf.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-2-kraxel@redhat.com

Move dst calculation into the loop, so we apply the mask on each
interation and will not overflow vga memory.

Cc: Prasad J Pandit <pjp@fedoraproject.org>
Reported-by: NNiu Guoxiang <niuguoxiang@huawei.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171011084314.21752-1-kraxel@redhat.com