Coldfire defines an "Unsupported instruction" exception if execution
of a valid instruction is attempted but the required hardware is not
present in the processor.

We use it with instructions that are in fact undefined or illegal,
and the exception expected in this case by the kernel is the
illegal exception, so this patch fixes that.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20181030165554.5761-1-laurent@vivier.eu>

target/xtensa: support for bFLT binaries

- add support for bFLT binaries for target/xtensa
- fix per-architecture target_flat.h customization
- fix initial stack pointer for bFLT

# gpg: Signature made Tue 30 Oct 2018 18:27:42 GMT
# gpg:                using RSA key 51F9CC91F83FA044
# gpg: Good signature from "Max Filippov <filippov@cadence.com>"
# gpg:                 aka "Max Filippov <max.filippov@cogentembedded.com>"
# gpg:                 aka "Max Filippov <jcmvbkbc@gmail.com>"
# Primary key fingerprint: 2B67 854B 98E5 327D CDEB  17D8 51F9 CC91 F83F A044

* remotes/xtensa/tags/20181030-xtensa:
  linux-user/flatload: fix initial stack pointer alignment
  linux-user: xtensa: enable bFLT support
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Stack pointer alignment code incorrectly adds stack_size to sp instead
of subtracting it. It also does not take flat_argvp_envp_on_stack() into
account when calculating stack_size. This results in initial stack
pointer misalignment with certain set of command line arguments and
environment variables and correct alignment for the same binary with a
different set of arguments. This misalignment causes failures in the
following tests in the testsuite of gcc built for xtensa uclinux:

  gcc.dg/torture/vshuf-v64qi.c
  gcc.dg/torture/vshuf-v8sf.c
  gcc.dg/torture/vshuf-v8si.c
Reviewed-by: NLaurent Vivier <lvivier@redhat.com>
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

QEMU trivial patches collected between June and October 2018
(Thank you to Thomas Huth)

v2: fix 32bit build with updated patch (v3) from Philippe Mathieu-Daudé
    built in a 32bit debian sid chroot

# gpg: Signature made Tue 30 Oct 2018 11:23:01 GMT
# gpg:                using RSA key F30C38BD3F2FBE3C
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>"
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>"
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/qemu-trivial-for-3.1-pull-request:
  milkymist-minimac2: Use qemu_log_mask(GUEST_ERROR) instead of error_report
  ppc: move at24c to its own CONFIG_ symbol
  hw/intc/gicv3: Remove useless parenthesis around DIV_ROUND_UP macro
  hw/pci-host: Remove useless parenthesis around DIV_ROUND_UP macro
  tests/bios-tables-test: Remove an useless cast
  xen: Use the PCI_DEVICE macro
  qobject: Catch another straggler for use of qdict_put_str()
  configure: Support pkg-config for zlib
  tests: Fix typos in comments and help message (found by codespell)
  cpu.h: fix a typo in comment
  linux-user: fix comment s/atomic_write/atomic_set/
  qemu-iotests: make 218 executable
  scripts/qemu.py: remove trailing quotes on docstring
  scripts/decodetree.py: remove unused imports
  docs/devel/testing.rst: add missing newlines after code block
  qemu-iotests: fix filename containing checks
  tests/tcg/README: fix location for lm32 tests
  memory.h: fix typos in comments
  vga_int: remove unused function protype
  configs/alpha: Remove unused CONFIG_PARALLEL_ISA switch
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Pull request

# gpg: Signature made Mon 29 Oct 2018 21:24:08 GMT
# gpg:                using RSA key 7DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/bitmaps-pull-request:
  iotests: 169: add cases for source vm resuming
  iotests: improve 169
  dirty-bitmaps: clean-up bitmaps loading and migration logic
  bitmap: Update count after a merge
  nbd: forbid use of frozen bitmaps
  block/backup: prohibit backup from using in use bitmaps
  block/dirty-bitmaps: prohibit enable/disable on locked/frozen bitmaps
  block/dirty-bitmaps: allow clear on disabled bitmaps
  block/dirty-bitmaps: fix merge permissions
  block/dirty-bitmaps: add user_locked status checker
  bloc/qcow2: drop dirty_bitmaps_loaded state variable
  block/qcow2: improve error message in qcow2_inactivate
  iotests: 169: drop deprecated 'autoload' parameter
  qapi: add transaction support for x-block-dirty-bitmap-merge
  blockdev: rename block-dirty-bitmap-clear transaction handlers
  dirty-bitmap: make it possible to restore bitmap after merge
  dirty-bitmap: rename bdrv_undo_clear_dirty_bitmap
  dirty-bitmap: switch assert-fails to errors in bdrv_merge_dirty_bitmap
  blockdev-backup: add bitmap argument
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

usb: fixes for ohci and smart card emulation.

# gpg: Signature made Mon 29 Oct 2018 20:02:34 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/usb-20181029-pull-request:
  hw: ccid-card-emulated: cleanup resource when realize in error path
  hw: ccid-card-emulated: introduce clean_event_notifier
  usb: ohci: make num_ports to an unsinged integer
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

MIPS queue for October 2018, part 4

# gpg: Signature made Mon 29 Oct 2018 15:11:32 GMT
# gpg:                using RSA key D4972A8967F75A65
# gpg: Good signature from "Aleksandar Markovic <amarkovic@wavecomp.com>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 8526 FBF1 5DA3 811F 4A01  DD75 D497 2A89 67F7 5A65

* remotes/amarkovic/tags/mips-queue-october-2018-part-4: (27 commits)
  linux-user: Add prctl() PR_SET_FP_MODE and PR_GET_FP_MODE implementations
  linux-user: Determine the desired FPU mode from MIPS.abiflags
  linux-user: Read and set FP ABI value from MIPS abiflags
  linux-user: Extract MIPS abiflags from ELF file
  linux-user: Extend image_info struct with MIPS fp_abi and interp_fp_abi fields
  elf: Define MIPS_ABI_FP_UNKNOWN macro
  target/mips: Amend MXU ASE overview note
  target/mips: Move MXU_EN check one level higher
  target/mips: Add emulation of MXU instructions S32LDD and S32LDDR
  target/mips: Add emulation of MXU instructions Q8MUL and Q8MULSU
  target/mips: Add emulation of MXU instruction D16MAC
  target/mips: Add emulation of MXU instruction D16MUL
  target/mips: Add emulation of MXU instruction S8LDD
  target/mips: Move MUL, S32M2I, S32I2M handling out of main MXU switch
  target/mips: Add emulation of MXU instructions S32I2M and S32M2I
  target/mips: Add emulation of non-MXU MULL within MXU decoding engine
  target/mips: Add bit encoding for MXU operand getting pattern 'optn3'
  target/mips: Add bit encoding for MXU operand getting pattern 'optn2'
  target/mips: Add bit encoding for MXU execute add/sub pattern 'eptn2'
  target/mips: Add bit encoding for MXU accumulate add/sub 2-bit pattern 'aptn2'
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

qemu_log_mask(GUEST_ERROR) is more appropriate:

  $ qemu -d help
  Log items (comma separated):
  guest_errors    log when the guest OS does something invalid (eg accessing a non-existent register)
Signed-off-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: NMichael Walle <michael@walle.cc>
Message-Id: <20181029130034.26750-1-f4bug@amsat.org>
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>

AT24c EEPROM is currently gated by CONFIG_I2C, and as such it is
being included in all emulators that use I2C, even if they do not
really need it.  Separate it and, since it was added for the e500
machines, add it to qemu-system-ppc and qemu-system-ppc64.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NThomas Huth <thuth@redhat.com>
Message-Id: <20180522191743.12872-1-pbonzini@redhat.com>
[lv: rebase]
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>

Test that we can resume source vm after [failed] migration, and bitmaps
are ok.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Before previous patch, iotest 169 was actually broken for the case
test_persistent__not_migbitmap__offline_shared, while formally
passing.

After migration log of vm_b had message:

    qemu-system-x86_64: Could not reopen qcow2 layer: Bitmap already
    exists: bitmap0

which means that invalidation failed and bs->drv = NULL.

It was because we've loaded bitmap twice: on open and on invalidation.

Add code to 169, to catch such fails.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

This patch aims to bring the following behavior:

1. We don't load bitmaps, when started in inactive mode. It's the case
of incoming migration. In this case we wait for bitmaps migration
through migration channel (if 'dirty-bitmaps' capability is enabled) or
for invalidation (to load bitmaps from the image).

2. We don't remove persistent bitmaps on inactivation. Instead, we only
remove bitmaps after storing. This is the only way to restore bitmaps,
if we decided to resume source after [failed] migration with
'dirty-bitmaps' capability enabled (which means, that bitmaps were not
stored).

3. We load bitmaps on open and any invalidation, it's ok for all cases:
  - normal open
  - migration target invalidation with dirty-bitmaps capability
    (bitmaps are migrating through migration channel, the are not
     stored, so they should have IN_USE flag set and will be skipped
     when loading. However, it would fail if bitmaps are read-only[1])
  - migration target invalidation without dirty-bitmaps capability
    (normal load of the bitmaps, if migrated with shared storage)
  - source invalidation with dirty-bitmaps capability
    (skip because IN_USE)
  - source invalidation without dirty-bitmaps capability
    (bitmaps were dropped, reload them)

[1]: to accurately handle this, migration of read-only bitmaps is
     explicitly forbidden in this patch.

New mechanism for not storing bitmaps when migrate with dirty-bitmaps
capability is introduced: migration filed in BdrvDirtyBitmap.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

We need an accurate count of the number of bits set in a bitmap
after a merge. In particular, since the merge operation short-circuits
a merge from an empty source, if you have bitmaps A, B, and C where
B started empty, then merge C into B, and B into A, an inaccurate
count meant that A did not get the contents of C.

In the worst case, we may falsely regard the bitmap as empty when
it has had new writes merged into it.

Fixes: be58721d
CC: qemu-stable@nongnu.org
Signed-off-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20181002233314.30159-1-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Whether it's "locked" or "frozen", it's in use and should
not be allowed for the purposes of this operation.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20181002230218.13949-7-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

If the bitmap is frozen, we shouldn't touch it.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20181002230218.13949-6-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

We're not being consistent about this. If it's in use by an operation,
the user should not be able to change the behavior of that bitmap.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20181002230218.13949-5-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Similarly to merge, it's OK to allow clear operations on disabled
bitmaps, as this condition only means that they are not recording
new writes. We are free to clear it if the user requests it.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20181002230218.13949-4-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

In prior commits that made merge transactionable, we removed the
assertion that merge cannot operate on disabled bitmaps. In addition,
we want to make sure that we are prohibiting merges to "locked" bitmaps.

Use the new user_locked function to check.
Reported-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-id: 20181002230218.13949-3-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Instead of both frozen and qmp_locked checks, wrap it into one check.
frozen implies the bitmap is split in two (for backup), and shouldn't
be modified. qmp_locked implies it's being used by another operation,
like being exported over NBD. In both cases it means we shouldn't allow
the user to modify it in any meaningful way.

Replace any usages where we check both frozen and qmp_locked with the
new check.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Message-id: 20181002230218.13949-2-jsnow@redhat.com
[w/edits Suggested-By: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>]
Signed-off-by: NJohn Snow <jsnow@redhat.com>

This variable doesn't work as it should, because it is actually cleared
in qcow2_co_invalidate_cache() by memset(). Drop it, as the following
patch will introduce new behavior.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
[Maintainer edit -- touched up error message. --js]
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>
Signed-off-by: NJohn Snow <jsnow@redhat.com>

New action is like clean action: do the whole thing in .prepare and
undo in .abort. This behavior for bitmap-changing actions is needed
because backup job actions use bitmap in .prepare.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>

Rename block-dirty-bitmap-clear transaction handlers to reuse them for
x-block-dirty-bitmap-merge transaction in the following patch.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>

Add backup parameter to bdrv_merge_dirty_bitmap() to be used then with
bdrv_restore_dirty_bitmap() if it needed to restore the bitmap after
merge operation.

This is needed to implement bitmap merge transaction action in further
commit.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>

Use more generic names to reuse the function for bitmap merge in the
following commit.
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>

Move checks from qmp_x_block_dirty_bitmap_merge() to
bdrv_merge_dirty_bitmap(), to share them with dirty bitmap merge
transaction action in future commit.

Note: for now, only qmp_x_block_dirty_bitmap_merge() calls
bdrv_merge_dirty_bitmap().
Signed-off-by: NVladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: NJohn Snow <jsnow@redhat.com>

It is only an oversight that we don't allow incremental backup with
blockdev-backup. Add the bitmap argument which enables this.
Signed-off-by: NJohn Snow <jsnow@redhat.com>
Message-id: 20180830211605.13683-2-jsnow@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

ui: sdl+spice tweaks.

# gpg: Signature made Mon 29 Oct 2018 14:18:21 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20181029-pull-request:
  spice: prepare for upcoming spice-server change
  SDL: set a hint to not bypass the window compositor
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Pull request

No changelog-worthy entries, just small tweaks.

# gpg: Signature made Mon 29 Oct 2018 13:55:54 GMT
# gpg:                using RSA key 9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>"
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>"
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha/tags/block-pull-request:
  nvdimm: Add docs hint for Linux driver name
  util: aio-posix: fix a typo
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

audio: qom cleanups.

# gpg: Signature made Mon 29 Oct 2018 13:37:09 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/audio-20181029-pull-request:
  audio: use TYPE_MV88W8618_AUDIO instead of hardcoded string
  audio: use object link instead of qdev property to pass wm8750 reference
  audio: use TYPE_WM8750 instead of a hardcoded string
  hw: AC97: make it more QOMconventional
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Implement MIPS specific prctl() PR_SET_FP_MODE and PR_GET_FP_MODE emulation.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Floating-point mode is calculated from MIPS.abiflags FP ABI value
(based on kernel implementation). Illegal combinations are rejected.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Set fp_abi and interp_fp_abi values to current fp_abi value read from
MIPS.abiflags.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Read MIPS.abiflags section from ELF file into Mips_elf_abiflags_v0 struct.
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Add MIPS specific image_info struct fields fp_abi and interp_fp_abi
to store executable and interpreter fp_abi values (based on kernel
struct arch_elf_state in mips/include/asm/elf.h).
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Add MIPS_ABI_FP_UNKNOWN as QEMU internal value to represent
unknown fp_abi (based on kernel mips/include/asm/elf.h definition)
Reviewed-by: NAleksandar Markovic <amarkovic@wavecomp.com>
Signed-off-by: NStefan Markovic <smarkovic@wavecomp.com>

Future spice-server versions will call the client_monitors_config
callback with the monitors list filtered to only include the monitors
of the given display channel (aka QXLInstance).  Luckily this is easily
detectable at runtime, so we can prepare for that in advance and also
make qemu compatible with both old and new spice-server versions.

While being at it also use the console index instead of head number as
array index.  The later doesn't work correctly in case multiple display
devices are present.

Cc: spice-devel@lists.freedesktop.org
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NLukáš Hrázký <lhrazky@redhat.com>
Message-id: 20181012114551.28809-1-kraxel@redhat.com

Without that, window effects in KWin get suspended as soon as any
qemu-sdl window becomes visible. While the SDL default makes sense
for games, it's not really suitable for QEMU.
Signed-off-by: NSebastian Krzyszkowiak <dos@dosowisko.net>
Message-id: 20181024143748.4425-1-dos@dosowisko.net
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

I spent way too much time trying to figure out why the emulated NVDIMM
was missing under Linux. In an effort to help others who might be looking
for these kinds of things in the future, include a hint.
Signed-off-by: NKees Cook <keescook@chromium.org>
Message-id: 20181018201351.GA25286@beast
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>