This look like temporary hacking code. It shouldn't be necessary in
release code, or there should be a runtime option for it.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>

This argument is always false, simplify the code.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>

Linux-user updates for Qemu 2.11

# gpg: Signature made Wed 18 Oct 2017 13:20:14 BST
# gpg:                using RSA key 0xB44890DEDE3C9BC0
# gpg: Good signature from "Riku Voipio <riku.voipio@iki.fi>"
# gpg:                 aka "Riku Voipio <riku.voipio@linaro.org>"
# Primary key fingerprint: FF82 03C8 C391 98AE 0581  41EF B448 90DE DE3C 9BC0

* remotes/riku/tags/pull-linux-user-20171018:
  linux-user: Fix TARGET_MTIOCTOP/MTIOCGET/MTIOCPOS values
  linux-user/main: support dfilter
  linux-user: Fix target FS_IOC_GETFLAGS and FS_IOC_SETFLAGS numbers
  linux-user/sh4: Reduce TARGET_VIRT_ADDR_SPACE_BITS to 31
  linux-user: Tidy and enforce reserved_va initialization
  tcg: Fix off-by-one in assert in page_set_flags
  linux-user: Allow -R values up to 0xffff0000 for 32-bit ARM guests
  linux-user: remove duplicate break in syscall
  target/m68k,linux-user: manage FP registers in ucontext
  linux-user: fix O_TMPFILE handling
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ui: opengl updates for dma-buf support.

# gpg: Signature made Tue 17 Oct 2017 12:13:36 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/opengl-20171017-pull-request:
  egl-headless: add dmabuf support
  egl-helpers: add egl_texture_blit and egl_texture_blend
  egl-helpers: add dmabuf import support
  opengl: add flipping vertex shader
  opengl: move shader init from console-gl.c to shader.c
  console: add support for dmabufs
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

cirrus: bugfixes, with some vga cleanups.

# gpg: Signature made Tue 17 Oct 2017 09:24:37 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/vga-20171017-pull-request:
  cirrus: fix oob access in mode4and5 write functions
  vga: add ram_addr_t cast
  vga: handle cirrus vbe mode wraparounds.
  vga: drop line_offset variable
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The TARGET_MTIOCTOP/TARGET_MTIOCGET/TARGET_MTIOCPOS values
were being defined in terms of host struct types, but
these structures are such that their size might differ
on different hosts. Switch to using a target struct
definition instead.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

This adds the -dfilter support to linux-user. There is a minor
checkpatch complaint about formatting which I've ignored for aesthetic
reasons.
Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@linaro.org>

ppc patch queue 2017-10-17

Here's the currently accumulated set of ppc patches for qemu.

  * The biggest set here is the ppc parts of Igor Mammedov's cleanups
    to cpu model handling
  * The above also includes a generic patches which are required as
    prerequisites for the ppc parts.  They don't seem to have been
    merged by Eduardo yet, so I hope they're ok to include here.
  * Apart from that it's basically just assorted bug fixes and cleanups

# gpg: Signature made Tue 17 Oct 2017 05:20:03 BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>"
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>"
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>"
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dgibson/tags/ppc-for-2.11-20171017: (34 commits)
  spapr_cpu_core: rewrite machine type sanity check
  spapr_pci: fail gracefully with non-pseries machine types
  spapr: Correct RAM size calculation for HPT resizing
  ppc: pnv: consolidate type definitions and batch register them
  ppc: pnv: drop PnvChipClass::cpu_model field
  ppc: pnv: define core types statically
  ppc: pnv: drop PnvCoreClass::cpu_oc field
  ppc: pnv: normalize core/chip type names
  ppc: pnv: use generic cpu_model parsing
  ppc: spapr: use generic cpu_model parsing
  ppc: move ppc_cpu_lookup_alias() before its first user
  ppc: spapr: use cpu model names as tcg defaults instead of aliases
  ppc: spapr: register 'host' core type along with the rest of core types
  ppc: spapr: use cpu type name directly
  ppc: spapr: define core types statically
  ppc: move '-cpu foo,compat=xxx' parsing into ppc_cpu_parse_featurestr()
  ppc: spapr: replace ppc_cpu_parse_features() with cpu_parse_cpu_model()
  ppc: 40p/prep: replace cpu_model with cpu_type
  ppc: virtex-ml507: replace cpu_model with cpu_type
  ppc: replace cpu_model with cpu_type on ref405ep,taihu boards
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

trivial patches for 2017-10-16

# gpg: Signature made Mon 16 Oct 2017 21:32:05 BST
# gpg:                using RSA key 0x701B4F6B1A693E59
# gpg: Good signature from "Michael Tokarev <mjt@tls.msk.ru>"
# gpg:                 aka "Michael Tokarev <mjt@corpit.ru>"
# gpg:                 aka "Michael Tokarev <mjt@debian.org>"
# Primary key fingerprint: 6EE1 95D1 886E 8FFB 810D  4324 457C E0A0 8044 65C5
#      Subkey fingerprint: 7B73 BAD6 8BE7 A2C2 8931  4B22 701B 4F6B 1A69 3E59

* remotes/mjt/tags/trivial-patches-fetch:
  Add myself as maintainer for TPM code
  filter-mirror: segfault when specifying non existent device
  MAINTAINERS: Track default-configs/pci.mak
  MAINTAINERS: Fix Sun4v file
  MAINTAINERS: Clean up SCSI device section
  include/hw/or-irq.h: Drop unused in_irqs field
  io: Add missing GCC_FMT_ATTR (fix -Werror=suggest-attribute=format)
  os-posix: Drop misleading comment
  linux-user: Add some random ioctls
  futex: add missing header guards
  ui/gtk: Fix deprecation of vte_terminal_copy_clipboard
  gitignore: ignore check-qlit test
  linux-user: remove duplicate break in syscall
  qemu-doc.texi: remove trailing whitespace
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Merge QIO 2017/10/16 v1

# gpg: Signature made Mon 16 Oct 2017 17:10:54 BST
# gpg:                using RSA key 0xBE86EBB415104FDF
# gpg: Good signature from "Daniel P. Berrange <dan@berrange.com>"
# gpg:                 aka "Daniel P. Berrange <berrange@redhat.com>"
# Primary key fingerprint: DAF3 A6FD B26B 6291 2D0E  8E3F BE86 EBB4 1510 4FDF

* remotes/berrange/tags/pull-qio-2017-10-16-1:
  io: fix mem leak in websock error path
  io: add trace points for websocket HTTP protocol headers
  io: cope with websock 'Connection' header having multiple values
  io: get rid of bounce buffering in websock write path
  io: pass a struct iovec into qio_channel_websock_encode
  io: get rid of qio_channel_websock_encode helper method
  io: simplify websocket ping reply handling
  io: monitor encoutput buffer size from websocket GSource
  sockets: Handle race condition between binds to the same port
  sockets: factor out create_fast_reuse_socket
  sockets: factor out a new try_bind() function
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This fixes a potential data leak to the guest.

# gpg: Signature made Mon 16 Oct 2017 16:08:25 BST
# gpg:                using DSA key 0x02FC3AEB0101DBC2
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Greg Kurz <groug@free.fr>"
# gpg:                 aka "Greg Kurz <gkurz@linux.vnet.ibm.com>"
# gpg:                 aka "Gregory Kurz (Groug) <groug@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2BD4 3B44 535E C0A7 9894  DBA2 02FC 3AEB 0101 DBC2

* remotes/gkurz/tags/for-upstream:
  9pfs: use g_malloc0 to allocate space for xattr
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

ui: use keycodemapdb for key code mappings, part one (v2)
ui: add qemu-keymap, update reverse keymaps (for qemu -k $map)
ui: fix for vte 0.50
ui: gtk texture fix

# gpg: Signature made Mon 16 Oct 2017 14:12:49 BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>"
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>"
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/ui-20171016-pull-request:
  gtk: fix wrong id between texture and framebuffer
  ui/gtk: Fix deprecation of vte_terminal_copy_clipboard
  pc-bios/keymaps: keymaps update
  Add pc-bios/keymaps/Makefile
  tools: add qemu-keymap
  ui: don't export qemu_input_event_new_key
  ui: convert key events to QKeyCodes immediately
  ui: convert common input code to keycodemapdb
  ui: add keycodemapdb repository as a GIT submodule
  docker: don't rely on submodules existing in the main checkout
  build: automatically handle GIT submodule checkout for dtc
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add support for the new dmabuf interface.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-7-kraxel@redhat.com

egl_texture_blit() blits a texture, simliar to egl_fb_blit() but by
rendering the texture to the screen instead of using a framebuffer blit.

egl_texture_blend() renders a texture with alpha blending, will be used
to render the cursor to the screen.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-6-kraxel@redhat.com

Add helper function to import a dma-buf as opengl texture.
Also add a helper to release the texture again.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-5-kraxel@redhat.com

Add vertex shader which flips the texture upside down while blitting it.
Add argument to qemu_gl_run_texture_blit() to enable flipping.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-4-kraxel@redhat.com

With the upcoming dmabuf support in qemu there will be more users of the
shaders than just console-gl.c.  So rename ConsoleGLState to
QemuGLShader, rename some functions too, move code from console-gl.c to
shaders.c.

No functional change.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-3-kraxel@redhat.com

This patch adds support for dma-bufs to the qemu console interfaces.
It adds a new "struct QemuDmaBuf" to represent a dmabuf with accociated
metatdata (size, format).  It adds three functions (and
DisplayChangeListenerOps operations) to set a dma-buf as display
scanout, as cursor and to release a dmabuf.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010135453.6704-2-kraxel@redhat.com

Move dst calculation into the loop, so we apply the mask on each
interation and will not overflow vga memory.

Cc: Prasad J Pandit <pjp@fedoraproject.org>
Reported-by: NNiu Guoxiang <niuguoxiang@huawei.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171011084314.21752-1-kraxel@redhat.com

Reported by Coverity.

Fixes: CID 1381409
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010141323.14049-4-kraxel@redhat.com

Commit "3d90c625 vga: stop passing pointers to vga_draw_line*
functions" is incomplete.  It doesn't handle the case that the vga
rendering code tries to create a shared surface, i.e. a pixman image
backed by vga video memory.  That can not work in case the guest display
wraps from end of video memory to the start.  So force shadowing in that
case.  Also adjust the snapshot region calculation.

Can trigger with cirrus only, when programming vbe modes using the bochs
api (stdvga, also qxl and virtio-vga in vga compat mode) wrap arounds
can't happen.

Fixes: CVE-2017-13672
Fixes: 3d90c625
Cc: P J P <ppandit@redhat.com>
Reported-by: NDavid Buchanan <d@vidbuchanan.co.uk>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Message-id: 20171010141323.14049-3-kraxel@redhat.com

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

This makes the code easier to understand and it is consistent with what
we already do for PHBs.
Signed-off-by: NGreg Kurz <groug@kaod.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

QEMU currently crashes when the user tries to add an spapr-pci-host-bridge
on a non-pseries machine:

$ qemu-system-ppc64 -M ppce500 -device spapr-pci-host-bridge,index=1
hw/ppc/spapr_pci.c:1535:spapr_phb_realize:
Object 0x1003dacae60 is not an instance of type spapr-machine
Aborted (core dumped)

The same thing happens with the deprecated but still available child type
spapr-pci-vfio-host-bridge.

Fix both by checking the machine type with object_dynamic_cast().
Reviewed-by: NDaniel Henrique Barboza <danielhb@linux.vnet.ibm.com>
Signed-off-by: NGreg Kurz <groug@kaod.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

In order to prevent the guest from forcing the allocation of large amounts
of qemu memory (or host kernel memory, in the case of KVM HV), we limit
the size of Hashed Page Table (HPT) it is allowed to allocated, based on
its RAM size.

However, the current calculation is not correct: it only adds up the size
of plugged memory, ignoring the base memory size.  This patch corrects it.

While we're there, use get_plugged_memory_size() instead of directly
calling pc_existing_dimms_capacity().  The only difference is that it
will abort on failure, which is right: a failure here indicates something
wrong within qemu.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Reviewed-by: NLaurent Vivier <lvivier@redhat.com>

Use a new DEFINE_TYPES() helper to simplify type registration
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NCédric Le Goater <clg@kaod.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

deduce core type directly from chip type instead of
maintaining type mapping in PnvChipClass::cpu_model.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

pnv core type definition doesn't have any fields that
require it to be defined at runtime. So replace code
that fills in TypeInfo at runtime with static TypeInfo
array that does the same at complie time.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NCédric Le Goater <clg@kaod.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

deduce cpu type directly from core type instead of
maintaining type mapping in PnvCoreClass::cpu_oc and doing
extra cpu_model parsing in pnv_core_class_init()
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

typically for cpus/core type names following convention is used

   new_type_prefix-superclass_typename

make PNV core/chip to follow common convention.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NCédric Le Goater <clg@kaod.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

use common cpu_model prasing in vl.c and set default cpu_model
using generic MachineClass::default_cpu_type.

Beside of switching to generic infrastructure it solves several
issues.

 * ppc_cpu_class_by_name() is used to deal with lower/upper case
   and alias translations into actual cpu type, which fixes
    '-M powernv -cpu power8' and '-M powernv -cpu power9_v1.0'
   usecases which error out with:
    'invalid CPU model 'FOO' for powernv machine'
 * allows to switch to lower-case typenames in pnv chip/core name
   (by convention typnames should be lower-case)
 * replace aliased names /power8, power9, .../ with exact cpu model
   names (i.e. typenames should be stable but aliases might decide to
   point to other cpu model withi family or changed by kvm). It will
   also help to simplify pnv_chip/core code and get rid of dependency
   on cpu_model parsing.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NCédric Le Goater <clg@kaod.org>
[dwg: Updated to make DD2.0 as default POWER9 chip]
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

use generic cpu_model parsing introduced by
 (6063d4c0 vl.c: convert cpu_model to cpu type and set of global properties before machine_init())

it allows to:
  * replace sPAPRMachineClass::tcg_default_cpu with
    MachineClass::default_cpu_type
  * drop cpu_parse_cpu_model() from hw/ppc/spapr.c and reuse
    one in vl.c
  * simplify spapr_get_cpu_core_type() by removing
    not needed anymore recurrsion since alias look up
    happens earlier at vl.c and spapr_get_cpu_core_type()
    works only with resulted from that cpu type.
  * spapr no more needs to parse/depend on being phased out
    MachineState::cpu_model, all tha parsing done by generic
    code and target specific callback.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
[dwg: Correct minor compile error]
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

next commit will drop ppc_cpu_lookup_alias() declaration from header
and make it static which will break its last user ppc_cpu_class_by_name()
since ppc_cpu_class_by_name() defined before ppc_cpu_lookup_alias().

To avoid this move ppc_cpu_lookup_alias() right before
ppc_cpu_class_by_name().
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

consolidate 'host' core type registration by moving it from
KVM specific code into spapr_cpu_core.c, similar like it's
done in x86 target.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

replace sPAPRCPUCoreClass::cpu_class with cpu type name
since it were needed just to get that at points it were
accessed.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

spapr core type definition doesn't have any fields that
require it to be defined at runtime. So replace code
that fills in TypeInfo at runtime with static TypeInfo
array that does the same at complie time.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

there is a dedicated callback CPUClass::parse_features
which purpose is to convert -cpu features into a set of
global properties AND deal with compat/legacy features
that couldn't be directly translated into CPU's properties.

Create ppc variant of it (ppc_cpu_parse_featurestr) and
move 'compat=val' handling from spapr_cpu_core.c into it.
That removes a dependency of board/core code on cpu_model
parsing and would let to reuse common -cpu parsing
introduced by 6063d4c0

Set "max-cpu-compat" property only if it exists, in practice
it should limit 'compat' hack to spapr machine and allow
to avoid including machine/spapr headers in target/ppc/cpu.c
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

ppc_cpu_parse_features() is doing practically the same thing as
generic cpu_parse_cpu_model(). So remove duplicated impl. and
reuse generic one.
Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Reviewed-by: NGreg Kurz <groug@kaod.org>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>

Signed-off-by: NIgor Mammedov <imammedo@redhat.com>
Acked-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>