* Remove legacy KVM PCI device assignment
* Fix qemu-pr-helper.c compilation on older compilers

# gpg: Signature made Sun 05 Nov 2017 13:52:36 GMT
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream:
  build: disable -Wmissing-braces on older compilers
  pci-assign: Remove
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

GCC 4.9 and newer stopped warning for missing braces around the
"universal" C zero initializer {0}.  One such initializer sneaked
into scsi/qemu-pr-helper.c and is breaking the build with such
older GCC versions.

Detect the lack of support for the idiom, and disable the warning
in that case.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Legacy PCI device assignment has been removed from Linux in 4.12,
and had been deprecated 2 years ago there.  We can remove it from
QEMU as well.

The ROM loading code was shared with Xen PCI passthrough, so move
it to hw/xen.
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Merge remote-tracking branch 'remotes/stsquad/tags/pull-ci-updates-for-softfreeze-021117-2' into staging

One fix for win32/64 cross compiles.

# gpg: Signature made Thu 02 Nov 2017 11:55:46 GMT
# gpg:                using RSA key 0xFBD0DB095A9E2A44
# gpg: Good signature from "Alex Bennée (Master Work Key) <alex.bennee@linaro.org>"
# Primary key fingerprint: 6685 AE99 E751 67BC AFC8  DF35 FBD0 DB09 5A9E 2A44

* remotes/stsquad/tags/pull-ci-updates-for-softfreeze-021117-2:
  docker: add python stdlib dependency (required by keycodemapdb)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Queued tcg patches

# gpg: Signature made Fri 03 Nov 2017 08:37:58 GMT
# gpg:                using RSA key 0x64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20171103:
  cpu-exec: Exit exclusive region on longjmp from step_atomic
  tcg/s390x: Use constant pool for prologue
  tcg: Allow constant pool entries in the prologue
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Commit ac03ee53 narrowed the scope of the exclusive
region so it only covers when we're executing the TB, not when
we're generating it. However it missed that there is more than
one execution path out of cpu_tb_exec -- if the atomic insn
causes an exception then the code will longjmp out, skipping
the code to end the exclusive region. This causes QEMU to hang
the next time the CPU calls start_exclusive(), waiting for
itself to exit the region.

Move the "end the region" code out to the end of the
function so that it is run for both normal exit and also
for exit-via-longjmp. We have to use a volatile bool flag
to decide whether we need to end the region, because we
can longjump out of the codegen as well as the execution.

(For some reason this only reproduces for me with a clang
optimized build, not a gcc debug build.)
Reviewed-by: NEmilio G. Cota <cota@braap.org>
Reviewed-by: NAlex Bennée <alex.bennee@linaro.org>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Fixes: ac03ee53Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-Id: <1509640536-32160-1-git-send-email-peter.maydell@linaro.org>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Rather than have separate code only used for guest_base,
rely on a recent change to handle constant pool entries.

Cc: qemu-s390x@nongnu.org
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Both ARMv6 and AArch64 currently may drop complex guest_base values
into the constant pool.  But generic code wasn't expecting that, and
the pool is not emitted.  Correct that.
Tested-by: NEmilio G. Cota <cota@braap.org>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Reported-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

NetBSD 8.0(beta) ships with KERN_PROC_PATHNAME in sysctl(2).
Older NetBSD versions can use argv[0] parsing fallback.

This code section is partly shared with FreeBSD.
Signed-off-by: NKamil Rytarowski <n54@gmx.com>
Message-id: 20171028194833.23858-1-n54@gmx.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fix console selection keys so that the right console is selected.
Signed-off-by: NJohn Arbuckle <programmingkidx@gmail.com>
Message-id: 20171005190449.15591-1-programmingkidx@gmail.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Since 92712822 QEMU depends of keycodemapdb, which uses the python 'csv'
module from stdlib to parse keymaps.csv.

Without this package the build fails:

    GEN     ui/input-keymap-linux-to-qcode.c
  Traceback (most recent call last):
    File "ui/keycodemapdb/tools/keymap-gen", line 15, in <module>
      import csv
  ImportError: No module named csv
    GEN     ui/input-keymap-qcode-to-qnum.c
  Traceback (most recent call last):
    File "ui/keycodemapdb/tools/keymap-gen", line 15, in <module>
      import csv
  ImportError: No module named csv
  [...]
    CC      ui/input-keymap.o
  ui/input-keymap.c:8:44: fatal error: ui/input-keymap-linux-to-qcode.c: No such file or directory
  make: *** [ui/input-keymap.o] Error 1
Signed-off-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: NAlex Bennée <alex.bennee@linaro.org>

# gpg: Signature made Tue 31 Oct 2017 23:01:18 GMT
# gpg:                using RSA key 0x7DEF8106AAFC390E
# gpg: Good signature from "John Snow (John Huston) <jsnow@redhat.com>"
# Primary key fingerprint: FAEB 9711 A12C F475 812F  18F2 88A9 064D 1835 61EB
#      Subkey fingerprint: F9B7 ABDB BCAC DF95 BE76  CBD0 7DEF 8106 AAFC 390E

* remotes/jnsnow/tags/ide-pull-request:
  ide: avoid referencing NULL dev in rotational rate setting
  hw/ide/ahci: Move allwinner code into a separate file
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The 'dev' variable can be NULL when the guest OS calls identify on an IDE
unit that does not have a drive attached to it.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Message-id: 20171020091403.1479-1-berrange@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

qemu-sparc update

# gpg: Signature made Tue 31 Oct 2017 17:43:11 GMT
# gpg:                using RSA key 0x5BC2C56FAE0F321F
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>"
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-sparc-signed:
  sun4m: change TYPE_SUN4M_IOMMU macro from "iommu" to "sun4m-iommu"
  sun4m_iommu: remove legacy sparc_iommu_memory_rw() function
  sparc32_dma: switch over to using IOMMU memory region and DMA API
  sun4m: implement IOMMU translation using IOMMU memory region
  sparc32_dma: add len to esp/le DMA memory tracing
  sparc32_dma: remove is_ledma hack and replace with memory region alias
  sparc32_dma: introduce new SPARC32_DMA type container object
  sparc32_dma: make lance device child of ledma device
  lance: move TYPE_LANCE and SysBusPCNetState from lance.c to lance.h
  sparc32_dma: make esp device child of espdma device
  esp: move TYPE_ESP and SysBusESPState from esp.c to esp.h
  sparc32_dma: use object link instead of qdev property to pass IOMMU reference
  sun4m_iommu: move TYPE_SUN4M_IOMMU declaration to sun4m.h
  sun4m: move DMA device wiring from sparc32_dma_init() to sun4m_hw_init()
  sparc32_dma: move type declarations from sparc32_dma.c to sparc32_dma.h
  sparc32_dma: split esp and le into separate DMA devices
  sparc32_dma: rename SPARC32_DMA type to SPARC32_DMA_DEVICE
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The allwinner code is only needed for the allwinner board (for which
we also have a separate CONFIG_ALLWINNER_A10 config switch), so it
does not make sense that we compile this for all the other boards
that need AHCI, too. Let's move it to a separate file that is only
compiled when CONFIG_ALLWINNER_A10 is set.
Signed-off-by: NThomas Huth <thuth@redhat.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1508784509-29377-1-git-send-email-thuth@redhat.com
Signed-off-by: NJohn Snow <jsnow@redhat.com>

This is a legacy artifact from when the sun4m IOMMU implementation was
the only IOMMU available within QEMU.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

With the switch to the IOMMU memory region and DMA API, this is no longer
required.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>

This is surprisingly useful when trying to debug DMA issues.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This hack originated from before the memory region API was introduced, and
increased the size of the ledma DMA device to capture incorrect accesses
beyond the end of the ledma device. A full analysis can be found on Artyom's
blog at http://tyom.blogspot.co.uk/2010/10/bug-in-all-solaris-versions-after-57.html.

With the memory API we can now simply alias the incorrect access onto its
intended destination allowing us to remove the hack.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Create a new SPARC32_DMA container object (including an appropriate container
memory region) and add instances of the SPARC32_ESPDMA_DEVICE and
SPARC32_LEDMA_DEVICE as child objects. The benefit is that most of the gpio
wiring complexity between esp/espdma and lance/ledma is now hidden within the
SPARC32_DMA realize function.

Since the sun4m IOMMU is already QOMified we can find a reference to
it using object_resolve_path_type() allowing us to completely remove all external
references to the iommu pointer.

Finally we rework sun4m's sparc32_dma_init() to invoke the new SPARC32_DMA object
and wire up the remaining board memory regions/IRQs.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Acked-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This makes it possible to reference the lance device from the ledma device as
required.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Acked-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This enables them to be used outside of lance.c. We also update the comment to
refer to the SPARC32 lance device rather than the AMD PCNet-II device (of which
lance is a register-compatible subset).
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Jason Wang <jasowang@redhat.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This makes it possible to reference the esp device from the espdma device as
required, and by wiring up the device ourselves in sun4m.c we can drop use
of the esp_init() function.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Acked-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This enables them to be used outside of esp.c.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
CC: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This enables us to remove the last remaining (opaque) qdev property. Whilst we
are here, also update iommu_init() to use TYPE_SUN4M_IOMMU instead of a
hardcoded string.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

This is in preparation to allow the type to be used elsewhere.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

By using the sysbus interface it is possible to wire up the esp/le devices
to the sun4m DMA controller directly during sun4m_hw_init() instead of
passing qemu_irqs into the sparc32_dma_init() function.

This is an intermediate step to allow further reorganisation as more logic
is moved into the relevant SPARC32 DMA devices; there will be a final
refactoring of sparc32_dma_init() once this work is complete.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Acked-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Due to slight differences in behaviour accessing the registers for the
esp and le devices, create two separate SPARC32_DMA_DEVICE types and
update the sun4m machine to use.

Note that by using different device types we already know the size of
the register block and the value of is_ledma at init time, allowing us to
drop the SPARC32_DMA_DEVICE realize function and the is_ledma device
property.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Acked-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

Also update the function names to match as appropriate. While we're
here rename the type from sparc32_dma to sparc32-dma in order to
match the current QOM convention.
Signed-off-by: NMark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: NArtyom Tarasenko <atar4qemu@gmail.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

target-arm queue:
 * fix instruction-length bit in syndrome for WFI/WFE traps
 * xlnx-zcu102: Specify the max number of CPUs
 * msf2: Remove dead code reported by Coverity
 * msf2: Wire up SYSRESETREQ in SoC for system reset
 * hw/pci-host/gpex: Improve INTX to gsi routing error checking

# gpg: Signature made Tue 31 Oct 2017 13:10:02 GMT
# gpg:                using RSA key 0x3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>"
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>"
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20171031:
  hw/pci-host/gpex: Improve INTX to gsi routing error checking
  msf2: Wire up SYSRESETREQ in SoC for system reset
  msf2: Remove dead code reported by Coverity
  xlnx-zcu102: Specify the max number of CPUs
  fix WFI/WFE length in syndrome register
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

nbd patches for 2017-10-30

Vladimir Sementsov-Ogievskiy (some patches co-authored by Eric Blake):
00/12 nbd minimal structured read

# gpg: Signature made Mon 30 Oct 2017 20:54:54 GMT
# gpg:                using RSA key 0xA7A16B4A2527436A
# gpg: Good signature from "Eric Blake <eblake@redhat.com>"
# gpg:                 aka "Eric Blake (Free Software Programmer) <ebb9@byu.net>"
# gpg:                 aka "[jpeg image of size 6874]"
# Primary key fingerprint: 71C2 CC22 B1C4 6029 27D2  F3AA A7A1 6B4A 2527 436A

* remotes/ericb/tags/pull-nbd-2017-10-30:
  nbd: Minimal structured read for client
  nbd: Move nbd_read() to common header
  nbd/client: prepare nbd_receive_reply for structured reply
  nbd/client: refactor nbd_receive_starttls
  nbd/server: Include human-readable message in structured errors
  nbd: Minimal structured read for server
  nbd/server: Refactor zero-length option check
  nbd/server: Simplify nbd_negotiate_options loop
  nbd/server: Report error for write to read-only export
  nbd: Expose constants and structs for structured read
  nbd: Move nbd_errno_to_system_errno() to public header
  nbd: Include error names in trace messages
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

We exposed gpex_set_irq_num() for machines to set the INTx to
GSI routing. However if the machine forgets to call that
function we currently do not check the association was properly
done. Let's initialize gsi values to -1 and if this value is
found in gpex_route_intx_pin_to_irq, set the routing mode as
disabled.
Signed-off-by: NEric Auger <eric.auger@redhat.com>
Message-id: 1508776211-22175-1-git-send-email-eric.auger@redhat.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Implemented system reset by creating SYSRESETREQ gpio
out from nvic.
Signed-off-by: NSubbaraya Sundeep <sundeep.lkml@gmail.com>
Message-id: 1509253165-7434-1-git-send-email-sundeep.lkml@gmail.com
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fixed incorrect frame size mask, validated maximum frame
size in spi_write and removed dead code.
Signed-off-by: NSubbaraya Sundeep <sundeep.lkml@gmail.com>
Reviewed-by: NDarren Kenny <darren.kenny@oracle.com>
Reviewed-by: NAlistair Francis <alistair.francis@xilinx.com>
Message-id: 1508898544-10307-1-git-send-email-sundeep.lkml@gmail.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Specify the number of CPUs that can run on ZynqMP.
Signed-off-by: NAlistair Francis <alistair.francis@xilinx.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

WFI/E are often, but not always, 4 bytes long. When they are, we need to
set ARM_EL_IL_SHIFT in the syndrome register.

Pass the instruction length to HELPER(wfi), use it to decrement pc
appropriately and to pass an is_16bit flag to syn_wfx, which sets
ARM_EL_IL_SHIFT if needed.

Set dc->insn in both arm_tr_translate_insn and thumb_tr_translate_insn.
Signed-off-by: NStefano Stabellini <sstabellini@kernel.org>
Message-id: alpine.DEB.2.10.1710241055160.574@sstabellini-ThinkPad-X260
[PMM: move setting of dc->insn for Thumb so it is correct for 32 bit insns]
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

hmp pull 2017-10-30

# gpg: Signature made Mon 30 Oct 2017 20:17:57 GMT
# gpg:                using RSA key 0x0516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>"
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-hmp-20171030:
  monitor: fix dangling CPU pointer
  hmp: Replace error_report_err
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>