qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] a1a636: ppc/pnv: restrict BMC object to the B


From: GitHub
Subject: [Qemu-commits] [qemu/qemu] a1a636: ppc/pnv: restrict BMC object to the BMC simulator
Date: Tue, 16 May 2017 09:41:29 -0700

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: a1a636b8b444acacf8c4299923c907ed2475811f
      
https://github.com/qemu/qemu/commit/a1a636b8b444acacf8c4299923c907ed2475811f
  Author: Cédric Le Goater <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/pnv.c

  Log Message:
  -----------
  ppc/pnv: restrict BMC object to the BMC simulator

Today, when a PowerNV guest runs, it uses the sensor definitions of
the BMC simulator to populate the device tree. But an external IPMI
BMC could also be used and, in that case, it is not (yet) possible to
retrieve the sensor list. Generating the OEM SEL event for shutdown or
reboot also does not make sense as it should be generated on the BMC
side.

This change allows a guest to use an 'ipmi-bmc-extern' backend to the
'isa-ipmi-bt' device and a 'chardev' for transport such as :

        -chardev socket,id=ipmi0,host=localhost,port=9002,reconnect=10 \
        -device ipmi-bmc-extern,id=bmc0,chardev=ipmi0 \
        -device isa-ipmi-bt,bmc=bmc0,irq=10

and connect to a BMC simulator, the OpenIPMI ipmi_sim simulator for
instance.

Signed-off-by: Cédric Le Goater <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 253ce7b2cfc0bccc3470335b0d7282457926087d
      
https://github.com/qemu/qemu/commit/253ce7b2cfc0bccc3470335b0d7282457926087d
  Author: Nikunj A Dadhania <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/translate.c

  Log Message:
  -----------
  target/ppc: Emulate LL/SC using cmpxchg helpers

Emulating LL/SC with cmpxchg is not correct, since it can suffer from
the ABA problem. However, portable parallel code is written assuming
only cmpxchg which means that in practice this is a viable alternative.

Signed-off-by: Nikunj A Dadhania <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 7f9af1abdcc69fd1d3d8d2be68464329600616d6
      
https://github.com/qemu/qemu/commit/7f9af1abdcc69fd1d3d8d2be68464329600616d6
  Author: Nikunj A Dadhania <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M cputlb.c

  Log Message:
  -----------
  cputlb: handle first atomic write to the page

In case where the conditional write is the first write to the page,
TLB_NOTDIRTY will be set and stop_the_world is triggered. Handle this as
a special case and set the dirty bit. After that fall through to the
actual atomic instruction below.

Signed-off-by: Nikunj A Dadhania <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 4771df23ed6a2b13927030d5933147d85785f5d5
      
https://github.com/qemu/qemu/commit/4771df23ed6a2b13927030d5933147d85785f5d5
  Author: Nikunj A Dadhania <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/translate.c

  Log Message:
  -----------
  target/ppc: Generate fence operations

Signed-off-by: Nikunj A Dadhania <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: a3e53273ad52551b61c0cdb8f48a19eb22c05831
      
https://github.com/qemu/qemu/commit/a3e53273ad52551b61c0cdb8f48a19eb22c05831
  Author: Bharata B Rao <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M cpus.c

  Log Message:
  -----------
  cpus: Fix CPU unplug for MTTCG

Ensure that the unplugged CPU thread is destroyed and the waiting
thread is notified about it. This is needed for CPU unplug to work
correctly in MTTCG mode.

Signed-off-by: Bharata B Rao <address@hidden>
Signed-off-by: Nikunj A Dadhania <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: f0b0685d6694a28c66018f438e822596243b1250
      
https://github.com/qemu/qemu/commit/f0b0685d6694a28c66018f438e822596243b1250
  Author: Nikunj A Dadhania <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M configure
    M target/ppc/cpu.h

  Log Message:
  -----------
  tcg: enable MTTCG by default for PPC64 on x86

This enables the multi-threaded system emulation by default for PPC64
guests using the x86_64 TCG back-end.

Signed-off-by: Nikunj A Dadhania <address@hidden>
Reviewed-by: Alex Bennée <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 139d9023f1410591726bbe35908dcfd9d127aad2
      
https://github.com/qemu/qemu/commit/139d9023f1410591726bbe35908dcfd9d127aad2
  Author: Nikunj A Dadhania <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/excp_helper.c
    M target/ppc/translate_init.c

  Log Message:
  -----------
  target/ppc: do not reset reserve_addr in exec_enter

In case when atomic operation is not supported, exit_atomic is called
and we stop the world and execute the atomic operation. This results
in a following call chain:

tcg_gen_atomic_cmpxchg_tl()
  -> gen_helper_exit_atomic()
     -> HELPER(exit_atomic)
  -> cpu_loop_exit_atomic() -> EXCP_ATOMIC
     -> qemu_tcg_cpu_thread_fn() => case EXCP_ATOMIC
        -> cpu_exec_step_atomic()
           -> cpu_step_atomic()
              -> cc->cpu_exec_enter() = ppc_cpu_exec_enter()
                 Sets env->reserve_addr = -1;

But by the time it return back, the reservation is erased and the code
fails, this continues forever and the lock is never taken.

Instead set this in powerpc_excp()

Now that ppc_cpu_exec_enter() doesn't have anything meaningful to do,
let us get rid of the function.

Signed-off-by: Nikunj A Dadhania <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 063cb7cbc9f65ff4095df884cfcd7eaf3a160555
      
https://github.com/qemu/qemu/commit/063cb7cbc9f65ff4095df884cfcd7eaf3a160555
  Author: Sam Bobroff <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/intc/xics_kvm.c

  Log Message:
  -----------
  ppc/xics: Fix stale irq->status bits after get

ics_get_kvm_state() "or"s set bits into irq->status but does not mask
out clear bits.

Correct this by initializing the IRQ status to zero before adding bits
to it.

Signed-off-by: Sam Bobroff <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 229e16fd247c7d39822627916d18b52f733cbfa1
      
https://github.com/qemu/qemu/commit/229e16fd247c7d39822627916d18b52f733cbfa1
  Author: Sam Bobroff <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/intc/xics_kvm.c
    M include/hw/ppc/xics.h

  Log Message:
  -----------
  ppc/xics: preserve P and Q bits for KVM IRQs

Kernel commit 17d48610ae0f ("KVM: PPC: Book 3S: XICS: Implement ICS
P/Q states") added new bits to the state used by KVM IRQs. Currently,
QEMU does not preserve these bits, so migrating (or otherwise saving
and restoring) the guest state causes the P and Q bits to be cleared.

Clearing the P bit has no effect, because the kernel will set it based
on other data, but the loss of a set Q bit will cause a lost
interrupt.

This patch preserves the P and Q bits, correcting the problem.

Signed-off-by: Sam Bobroff <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 0806b30c8dff64e944456aa15bdc6957384e29a8
      
https://github.com/qemu/qemu/commit/0806b30c8dff64e944456aa15bdc6957384e29a8
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M .gitmodules
    M pc-bios/README
    A roms/QemuMacDrivers

  Log Message:
  -----------
  Add QemuMacDrivers as submodule

The QemuMacDrivers project provides virtualisation drivers for PPC MacOS
guests.

Signed-off-by: Mark Cave-Ayland <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: fbe9214318a41f8a201052f3ed63cca5a247408e
      
https://github.com/qemu/qemu/commit/fbe9214318a41f8a201052f3ed63cca5a247408e
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M Makefile
    A pc-bios/qemu_vga.ndrv

  Log Message:
  -----------
  Add QemuMacDrivers qemu_vga.ndrv revision d4e7d7a built as submodule

Signed-off-by: Mark Cave-Ayland <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: b50de5cd77e3ee8ce21fbd715307319aa388b703
      
https://github.com/qemu/qemu/commit/b50de5cd77e3ee8ce21fbd715307319aa388b703
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/mac_oldworld.c

  Log Message:
  -----------
  ppc: add qemu_vga.ndrv ROM to fw_cfg interface for OldWorld Macs

Signed-off-by: Mark Cave-Ayland <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 53ecf09df3179203950ca6af16d9420deedcc4f3
      
https://github.com/qemu/qemu/commit/53ecf09df3179203950ca6af16d9420deedcc4f3
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/mac_newworld.c

  Log Message:
  -----------
  ppc: add qemu_vga.ndrv ROM to fw_cfg interface for NewWorld Macs

Signed-off-by: Mark Cave-Ayland <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 6de833070ca25874541f633e5d3ecad3fa6db2e1
      
https://github.com/qemu/qemu/commit/6de833070ca25874541f633e5d3ecad3fa6db2e1
  Author: Suraj Jitindar Singh <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/spapr_hcall.c

  Log Message:
  -----------
  target/ppc: Set UPRT and GTSE on all cpus in H_REGISTER_PROCESS_TABLE

The UPRT and GTSE bits are set when a guest calls H_REGISTER_PROCESS_TABLE
to choose determine how address translation is performed. Currently these
bits in the LPCR are only set for the cpu which handles the H_CALL, however
they need to be set for all cpus for that guest as address translation
cannot be performed differently on a per cpu basis.

Update the H_CALL handler to set these bits in the LPCR correctly for all
cpus of the guest.

Note it is the reponsibility of the guest to ensure that any secondary cpus
are suspended when the H_CALL is made and thus we can safely update these
values here.

Signed-off-by: Suraj Jitindar Singh <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: c6fd28fd573d69938e4da6ab3348b0695cad4f42
      
https://github.com/qemu/qemu/commit/c6fd28fd573d69938e4da6ab3348b0695cad4f42
  Author: Suraj Jitindar Singh <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/translate.c

  Log Message:
  -----------
  target/ppc: Update tlbie to check privilege level based on GTSE

The Guest Translation Shootdown Enable (GTSE) bit in the Logical Partition
Control Register (LPCR) can be set to enable a guest to use the tlbie
instruction directly to invalidate translations.

When the GTSE bit is set then the tlbie instruction is supervisor
privileged, otherwise it is hypervisor privileged.

Add a guest translation shootdown enable (gtse) field to the diassembly
context and use this to check the correct privilege level at code
generation time.

Signed-off-by: Suraj Jitindar Singh <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: c88305027d5a8dbeaacf04ad2ceba79a5c5fb91e
      
https://github.com/qemu/qemu/commit/c88305027d5a8dbeaacf04ad2ceba79a5c5fb91e
  Author: Suraj Jitindar Singh <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/translate.c
    M target/ppc/translate_init.c

  Log Message:
  -----------
  target/ppc: Change tlbie invalid fields for POWER9 support

The tlbie[l] instructions are used to invalidate TLB entries used to cache
address translations.

In ISAv3.00 (POWER9) more fields were added to the tblie[l] instructions
which were previously invalid. We don't care about any of these new fields
since we just invalidate the whole world anyway but we need to not
cause an illegal instruction exception when the instructions are called.
We also don't want to allow an older processor to have these fields set
since that would be invalid.

Add a new GEN_HANDLER for the ISAv3 instructions with the correct invalid
mask. These will only be generated to a POWER9 processor for now based on
the instruction flag. Also remove the PPC_MEM_TLBIE instruction flag from
the POWER9 processor definition to ensure the old tlbie isn't generated.

Signed-off-by: Suraj Jitindar Singh <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: d5fee0bbe68d5e61e2d2beb5ff6de0b9c1cfd182
      
https://github.com/qemu/qemu/commit/d5fee0bbe68d5e61e2d2beb5ff6de0b9c1cfd182
  Author: Suraj Jitindar Singh <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/Makefile.objs
    M target/ppc/cpu.h
    M target/ppc/mmu-book3s-v3.c
    M target/ppc/mmu-book3s-v3.h
    A target/ppc/mmu-radix64.c
    A target/ppc/mmu-radix64.h

  Log Message:
  -----------
  target/ppc: Implement ISA V3.00 radix page fault handler

ISA V3.00 introduced a new radix mmu model. Implement the page fault
handler for this so we can run a tcg guest in radix mode and perform
address translation correctly.

In real mode (mmu turned off) addresses are masked to remove the top
4 bits and then are subject to partition scoped translation, since we only
support pseries at this stage it is only necessary to perform the masking
and then we're done.

In virtual mode (mmu turned on) address translation if performed as
follows:

1. Use the quadrant to determine the fully qualified address.

The fully qualified address is defined as the combination of the effective
address, the effective logical partition id (LPID) and the effective
process id (PID). Based on the quadrant (EA63:62) we set the pid and lpid
like so:

quadrant 0: lpid = LPIDR, pid = PIDR
quadrant 1: HV only (not allowed in pseries)
quadrant 2: HV only (not allowed in pseries)
quadrant 3: lpid = LPIDR, pid = 0

If we can't get the fully qualified address we raise a segment interrupt.

2. Find the guest radix tree

We ask the virtual hypervisor for the partition table which was registered
with H_REGISTER_PROC_TBL which points us to the process table in guest
memory. We then index this table by pid to get the process table entry
which points us to the appropriate radix tree to translate the address.

If the process table isn't big enough to contain an entry for the current
pid then we raise a storage interrupt.

3. Walk the radix tree

Next we walk the radix tree where each level is a table of page directory
entries indexed by some number of bits from the effective address, where
the number of bits is determined by the table size. We continue to walk
the tree (while entries are valid and the table is of minimum size) until
we reach a table of page table entries, indicated by having the leaf bit
set. The appropriate pte is then checked for sufficient access permissions,
the reference and change bits are updated and the real address is
calculated from the real page number bits of the pte and the low bits of
the effective address.

If we can't find an entry or can't access the entry bacause of permissions
then we raise a storage interrupt.

Signed-off-by: Suraj Jitindar Singh <address@hidden>
[dwg: Add missing parentheses to macro]
Signed-off-by: David Gibson <address@hidden>


  Commit: 545d6e2b5c1e5fd321792bce0ad136c3a192c37b
      
https://github.com/qemu/qemu/commit/545d6e2b5c1e5fd321792bce0ad136c3a192c37b
  Author: Suraj Jitindar Singh <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/spapr.c

  Log Message:
  -----------
  target/ppc: Enable RADIX mmu mode for pseries TCG guest

Now that we have added all the infrastructure we can enable a pseries TCG
guest to use radix.

In order to do this we have to add the appropriate bits to the
ibm,arch-vec-5-platform-support vector to represent that we support both
hash and radix mmu models.

A radix guest can now be booted in pseries tcg mode by specifying:
-cpu POWER9

Note that we assume hash, that is we allocate a hpt, until a guest tells
us otherwise via a H_REGISTER_PROCESS_TABLE call with radix specified - in
which case we free the hpt. If we were right and the guest is hash then
there's nothing for us to do.

Signed-off-by: Suraj Jitindar Singh <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 5c6b487d673f1f5e5a30f6168bad3bc5cef40180
      
https://github.com/qemu/qemu/commit/5c6b487d673f1f5e5a30f6168bad3bc5cef40180
  Author: Paolo Bonzini <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M include/hw/ppc/xics.h

  Log Message:
  -----------
  ppc: xics: fix compilation with CentOS 6

The PowerPCCPU typedef is included twice if a file includes
both hw/ppc/xics.h and target/ppc/cpu-qom.h.

Signed-off-by: Paolo Bonzini <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 9bf502fe127f04e393cacae9f2666e0c98c6df4f
      
https://github.com/qemu/qemu/commit/9bf502fe127f04e393cacae9f2666e0c98c6df4f
  Author: David Gibson <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/spapr.c

  Log Message:
  -----------
  spapr: Don't accidentally advertise HTM support on POWER9

Logic in spapr_populate_pa_features() enables the bit advertising
Hardware Transactional Memory (HTM) in the guest's device tree only when
KVM advertises its availability with the KVM_CAP_PPC_HTM feature.

However, this assumes that the HTM bit is off in the base template used for
the device tree value.  That is true for POWER8, but not for POWER9.

It looks like that was accidentally changed in 9fb4541 "spapr: Enable ISA
3.0 MMU mode selection via CAS".

Fixes: 9fb4541f5803f8d2ba116b12113386e26482ba30

Signed-off-by: David Gibson <address@hidden>
Reviewed-by: Thomas Huth <address@hidden>


  Commit: 5f3066d8b1063b364cd42d64bc011a56fae9c086
      
https://github.com/qemu/qemu/commit/5f3066d8b1063b364cd42d64bc011a56fae9c086
  Author: David Gibson <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/cpu-models.h
    M target/ppc/kvm.c

  Log Message:
  -----------
  target/ppc: Allow workarounds for POWER9 DD1

POWER9 DD1 silicon has some bugs which mean it a) isn't really compliant
with the ISA v3.00 and b) require a number of special workarounds in the
kernel.

At the moment, qemu isn't aware of DD1.  For TCG we don't really want it to
be (why bother emulating buggy silicon).  But with KVM, the guest does need
to be aware of DD1 so it can apply the necessary workarounds.

Meanwhile, the feature negotiation between qemu and the guest strongly
favours architected compatibility modes to "raw" CPU modes.  In combination
with the above, this means the guest sees architected POWER9 mode, and
doesn't apply the DD1 workarounds.  Well, unless it has yet another
workaround to partially ignore what qemu tells it.

This patch addresses this by disabling support for compatibility modes when
using KVM on a POWER9 DD1 host.

Signed-off-by: David Gibson <address@hidden>


  Commit: eaf87a3976fbdd96b2cf813d4e13cb5b2b839d88
      
https://github.com/qemu/qemu/commit/eaf87a3976fbdd96b2cf813d4e13cb5b2b839d88
  Author: David Gibson <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M include/hw/ppc/pnv.h
    M include/hw/ppc/pnv_lpc.h
    M include/hw/ppc/pnv_occ.h

  Log Message:
  -----------
  pnv: Fix build failures on some host platforms

This makes some changes to fix build failures on the 'min-glib' docker
image, and maybe other platforms with a buildchain that's less tolerant
about duplicated typedefs.

Signed-off-by: David Gibson <address@hidden>


  Commit: e9edd931eb1b7e4be2274a8d9b3e5d5c4b7d1aad
      
https://github.com/qemu/qemu/commit/e9edd931eb1b7e4be2274a8d9b3e5d5c4b7d1aad
  Author: Thomas Huth <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/ppc/cpu.h
    M target/ppc/kvm.c
    M target/ppc/translate_init.c

  Log Message:
  -----------
  target/ppc: Avoid printing wrong aliases in CPU help text

When running with KVM, we update the "family" CPU alias to point
to the right host CPU type, so that it for example possible to
use "-cpu POWER8" on a POWER8NVL host. However, the function for
printing the list of available CPU models is called earlier than
the KVM setup code, so the output of "-cpu help" is wrong in that
case. Since it would be somewhat ugly anyway to have different
help texts depending on whether "-enable-kvm" has been specified
or not, we should better always print the same text, so fix this
issue by printing "alias for preferred XXX CPU" instead.

Reviewed-by: Eduardo Habkost <address@hidden>
Signed-off-by: Thomas Huth <address@hidden>
Signed-off-by: David Gibson <address@hidden>


  Commit: 9cfa7ab939f27ffca845ffb9a28c3fa1856c92e7
      
https://github.com/qemu/qemu/commit/9cfa7ab939f27ffca845ffb9a28c3fa1856c92e7
  Author: Philippe Voinov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/input/virtio-input-hid.c
    M include/ui/input.h
    M ui/cocoa.m
    M ui/gtk.c
    M ui/input.c
    M ui/sdl.c
    M ui/sdl2.c
    M ui/spice-input.c
    M ui/vnc.c

  Log Message:
  -----------
  ui: Support non-zero minimum values for absolute input axes

This patch refactors ui/input.c to support absolute axis
minimum values other than 0. All dependent calls to qemu_input_queue_abs
have been updated to explicitly supply 0 as the axis minimum value.

Signed-off-by: Philippe Voinov <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: d755defd5d779d96a9a204cdd559458798c4a36a
      
https://github.com/qemu/qemu/commit/d755defd5d779d96a9a204cdd559458798c4a36a
  Author: Philippe Voinov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M ui/input-linux.c

  Log Message:
  -----------
  ui: input-linux: Add absolute event support

This patch adds support for absolute pointer events to the input-linux
subsystem. This support was omitted from the original input-linux patch,
however most of the code required for it is already in place.

Support for absolute events is especially useful for guests with vga
passthrough. Since they have a physical monitor, none of normal channels
for sending video output (vnc, etc) are used, meaning they also can't be
used to send absolute input events. This leaves QMP as the only option
to send absolute input into vga passthrough guests, which is not its
intended use and is not efficient.

This patch allows, for example, uinput to be used to create virtual
absolute input devices. This lets you build external systems which share
physical input devices between guests. Without absolute input
capability, such external systems can't seamlessly share pointer devices
between guests.

Signed-off-by: Philippe Voinov <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 344a68bf9d6cc40e3e40d4ae267d8a02bcdbbba6
      
https://github.com/qemu/qemu/commit/344a68bf9d6cc40e3e40d4ae267d8a02bcdbbba6
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/display/cg3.c

  Log Message:
  -----------
  cg3: make display updates thread safe

Signed-off-by: Mark Cave-Ayland <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 2dd285b5f30cefbe56d0e02ceca2d14e33e42f27
      
https://github.com/qemu/qemu/commit/2dd285b5f30cefbe56d0e02ceca2d14e33e42f27
  Author: Mark Cave-Ayland <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/display/tcx.c

  Log Message:
  -----------
  tcx: make display updates thread safe

Signed-off-by: Mark Cave-Ayland <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: ca7f544123a8cf80524cdb7a4ffc369a660b0c17
      
https://github.com/qemu/qemu/commit/ca7f544123a8cf80524cdb7a4ffc369a660b0c17
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/display/sm501.c

  Log Message:
  -----------
  sm501: make display updates thread safe

Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: bfc56535f793c557aa754c50213fc5f882e6482d
      
https://github.com/qemu/qemu/commit/bfc56535f793c557aa754c50213fc5f882e6482d
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/display/vga.c

  Log Message:
  -----------
  vga: fix display update region calculation

vga display update mis-calculated the region for the dirty bitmap
snapshot in case the scanlines are padded.  This can triggere an
assert in cpu_physical_memory_snapshot_get_dirty().

Fixes: fec5e8c92becad223df9d972770522f64aafdb72
Reported-by: Kevin Wolf <address@hidden>
Reported-by: 李强 <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: 4ed3d478c63dc65a02eba774c35116618ea5ff10
      
https://github.com/qemu/qemu/commit/4ed3d478c63dc65a02eba774c35116618ea5ff10
  Author: Daniel P. Berrange <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/i386/cpu.c

  Log Message:
  -----------
  i386: rewrite way CPUID index is validated

Change the nested if statements into a flat format, to make
it clearer what validation / capping is being performed on
different CPUID index values.

NB this changes behaviour when "index > env->cpuid_xlevel2".
This won't have any guest-visible effect because no there is
no CPUID[0xC0000001] feature supported by TCG, and KVM code
will never call cpu_x86_cpuid() with such an index value.

Reviewed-by: Eduardo Habkost <address@hidden>
Signed-off-by: Daniel P. Berrange <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 0f203430dd88cc6270310956ace58aca639edb59
      
https://github.com/qemu/qemu/commit/0f203430dd88cc6270310956ace58aca639edb59
  Author: He Chen <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/acpi/aml-build.c
    M hw/i386/acpi-build.c
    M include/hw/acpi/aml-build.h
    M include/sysemu/numa.h
    M include/sysemu/sysemu.h
    M numa.c
    M qapi-schema.json
    M qemu-options.hx

  Log Message:
  -----------
  numa: Allow setting NUMA distance for different NUMA nodes

This patch is going to add SLIT table support in QEMU, and provides
additional option `dist` for command `-numa` to allow user set vNUMA
distance by QEMU command.

With this patch, when a user wants to create a guest that contains
several vNUMA nodes and also wants to set distance among those nodes,
the QEMU command would like:

```
-numa node,nodeid=0,cpus=0 \
-numa node,nodeid=1,cpus=1 \
-numa node,nodeid=2,cpus=2 \
-numa node,nodeid=3,cpus=3 \
-numa dist,src=0,dst=1,val=21 \
-numa dist,src=0,dst=2,val=31 \
-numa dist,src=0,dst=3,val=41 \
-numa dist,src=1,dst=2,val=21 \
-numa dist,src=1,dst=3,val=31 \
-numa dist,src=2,dst=3,val=21 \
```

Signed-off-by: He Chen <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 3bfe57165b4bf86a431099078df422f54598f5c6
      
https://github.com/qemu/qemu/commit/3bfe57165b4bf86a431099078df422f54598f5c6
  Author: Laurent Vivier <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/core/machine.c
    M hw/i386/pc_piix.c
    M hw/i386/pc_q35.c
    M hw/ppc/spapr.c
    M include/hw/boards.h
    M include/qemu/typedefs.h
    M include/sysemu/numa.h
    M numa.c

  Log Message:
  -----------
  numa: equally distribute memory on nodes

When there are more nodes than available memory to put the minimum
allowed memory by node, all the memory is put on the last node.

This is because we put (ram_size / nb_numa_nodes) &
~((1 << mc->numa_mem_align_shift) - 1); on each node, and in this
case the value is 0. This is particularly true with pseries,
as the memory must be aligned to 256MB.

To avoid this problem, this patch uses an error diffusion algorithm [1]
to distribute equally the memory on nodes.

We introduce numa_auto_assign_ram() function in MachineClass
to keep compatibility between machine type versions.
The legacy function is used with pseries-2.9, pc-q35-2.9 and
pc-i440fx-2.9 (and previous), the new one with all others.

Example:

qemu-system-ppc64 -S -nographic  -nodefaults -monitor stdio -m 1G -smp 8 \
            -numa node -numa node -numa node \
            -numa node -numa node -numa node

Before:

(qemu) info numa
6 nodes
node 0 cpus: 0 6
node 0 size: 0 MB
node 1 cpus: 1 7
node 1 size: 0 MB
node 2 cpus: 2
node 2 size: 0 MB
node 3 cpus: 3
node 3 size: 0 MB
node 4 cpus: 4
node 4 size: 0 MB
node 5 cpus: 5
node 5 size: 1024 MB

After:
(qemu) info numa
6 nodes
node 0 cpus: 0 6
node 0 size: 0 MB
node 1 cpus: 1 7
node 1 size: 256 MB
node 2 cpus: 2
node 2 size: 0 MB
node 3 cpus: 3
node 3 size: 256 MB
node 4 cpus: 4
node 4 size: 256 MB
node 5 cpus: 5
node 5 size: 256 MB

[1] https://en.wikipedia.org/wiki/Error_diffusion

Signed-off-by: Laurent Vivier <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Eduardo Habkost <address@hidden>
[ehabkost: s/ram_size/size/ at numa_default_auto_assign_ram()]
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: fda4096fca83dcdc72e0fc0e4a1ae6e7724fb5e0
      
https://github.com/qemu/qemu/commit/fda4096fca83dcdc72e0fc0e4a1ae6e7724fb5e0
  Author: He Chen <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    A tests/acpi-test-data/pc/SLIT.cphp
    A tests/acpi-test-data/pc/SLIT.memhp
    M tests/acpi-test-data/pc/SRAT.memhp
    A tests/acpi-test-data/q35/SLIT.cphp
    A tests/acpi-test-data/q35/SLIT.memhp
    M tests/acpi-test-data/q35/SRAT.memhp
    M tests/bios-tables-test.c

  Log Message:
  -----------
  tests: acpi: extend cphp and memhp testcase with numa distance check

Signed-off-by: He Chen <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Igor Mammedov <address@hidden>
[ehabkost: regenerated tests/acpi-tst-data, included SLIT table]
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 63baf8bf014fa00f0a22ce7e47f9b3ddbe891cd9
      
https://github.com/qemu/qemu/commit/63baf8bf014fa00f0a22ce7e47f9b3ddbe891cd9
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M tests/Makefile.include
    A tests/numa-test.c

  Log Message:
  -----------
  tests: add CPUs to numa node mapping test

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Eduardo Habkost <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 46de5913b6779b5cf656f62f945409be00f45b94
      
https://github.com/qemu/qemu/commit/46de5913b6779b5cf656f62f945409be00f45b94
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/arm/virt.c
    M target/arm/cpu.c
    M target/arm/cpu.h

  Log Message:
  -----------
  hw/arm/virt: extract mp-affinity calculation in separate function

Signed-off-by: Igor Mammedov <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 17d3d0e2d9fc70631de3116eba33e3b2a63887eb
      
https://github.com/qemu/qemu/commit/17d3d0e2d9fc70631de3116eba33e3b2a63887eb
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/arm/virt.c

  Log Message:
  -----------
  hw/arm/virt: use machine->possible_cpus for storing possible topology info

for now precalculate and store mp_afinity in possible_cpus
as ARM cpus don't have socket/core/thread-id properties yet.
In follow patches possible_cpus will be used for storing
and setting NUMA node mapping and replace legacy bitmap
based numa_info[node_id].node_cpu/numa_get_node_for_cpu()

For the lack of better idea, this patch cannibalizes
possible_cpus.cpus[x].props.thread_id so that
*_cpu_index_to_props() callback could return addressable
by props CPU which will be used by machine_set_cpu_numa_node()
in follow up patches to assign a CPU to node. But
cannibalizing is fine for now as that thread_id isn't exposed
to users (no hotpluggable_cpus callback support for ARM yet)
and it will be used only internally until 'device_add cpu'
is supported where we can decide on which properties to use.

Signed-off-by: Igor Mammedov <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: d9c34f9c6c745f6a8123a872b33990ab564c614a
      
https://github.com/qemu/qemu/commit/d9c34f9c6c745f6a8123a872b33990ab564c614a
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/arm/virt.c

  Log Message:
  -----------
  hw/arm/virt: explicitly allocate cpu_index for cpus

Currently cpu_index is implicitly auto assigned during
cpu.realize() time cpu_exec_realizefn()->cpu_list_add().

It happens to match index in possible_cpus so take
control over it and make board initialize cpu_index
to possible_cpus index explicitly. It will at least
document that board is in control of it and when
'-device cpu' support comes it will keep cpu_index
stable regardless of order cpus are created so it won't
break migration.
Within this series it will be used for internal
conversion from storing cpu_index based NUMA node
bitmaps to property based mapping with possible_cpus,
And will allow map cpu_index to a CPU entry in
possible_cpus array.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: ea089eebbd80e61d3c3cd03741dd5d9535c551fc
      
https://github.com/qemu/qemu/commit/ea089eebbd80e61d3c3cd03741dd5d9535c551fc
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/arm/virt.c
    M hw/i386/pc.c
    M hw/ppc/spapr.c
    M include/hw/boards.h
    M include/sysemu/numa.h
    M numa.c
    M vl.c

  Log Message:
  -----------
  numa: move source of default CPUs to NUMA node mapping into boards

Originally CPU threads were by default assigned in
round-robin fashion. However it was causing issues in
guest since CPU threads from the same socket/core could
be placed on different NUMA nodes.
Commit fb43b73b (pc: fix default VCPU to NUMA node mapping)
fixed it by grouping threads within a socket on the same node
introducing cpu_index_to_socket_id() callback and commit
20bb648d (spapr: Fix default NUMA node allocation for threads)
reused callback to fix similar issues for SPAPR machine
even though socket doesn't make much sense there.

As result QEMU ended up having 3 default distribution rules
used by 3 targets /virt-arm, spapr, pc/.

In effort of moving NUMA mapping for CPUs into possible_cpus,
generalize default mapping in numa.c by making boards decide
on default mapping and let them explicitly tell generic
numa code to which node a CPU thread belongs to by replacing
cpu_index_to_socket_id() with @cpu_index_to_instance_props()
which provides default node_id assigned by board to specified
cpu_index.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Eduardo Habkost <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 0b8497f08cb6a933b31c1639ead2da2b536062ec
      
https://github.com/qemu/qemu/commit/0b8497f08cb6a933b31c1639ead2da2b536062ec
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/spapr.c
    M hw/ppc/spapr_cpu_core.c
    M include/hw/ppc/spapr_cpu_core.h
    M include/qom/cpu.h

  Log Message:
  -----------
  spapr: add node-id property to sPAPR core

it will allow switching from cpu_index to core based numa
mapping in follow up patches.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 93b2a8cb0bb6195ab6001fe05d4896a7aaaed639
      
https://github.com/qemu/qemu/commit/93b2a8cb0bb6195ab6001fe05d4896a7aaaed639
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/i386/pc.c
    M target/i386/cpu.c

  Log Message:
  -----------
  pc: add node-id property to CPU

it will allow switching from cpu_index to property based
numa mapping in follow up patches.

PS:
patch changes default value of CPUState::numa_node from 0
to CPU_UNSET_NUMA_NODE_ID. The only place for x86 that
would affected is monitor's 'infor numa' command which
uses that field. However legacy 0 value is still preserved
by pc_cpu_pre_plug() in this patch if user/numa.c hasn't
set it explicitly, so there is no change in behavior.

Signed-off-by: Igor Mammedov <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Eduardo Habkost <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: bd4c1bfe3e2736e5bb3e5238ede718843b175cc6
      
https://github.com/qemu/qemu/commit/bd4c1bfe3e2736e5bb3e5238ede718843b175cc6
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/arm/virt.c
    M target/arm/cpu.c

  Log Message:
  -----------
  virt-arm: add node-id property to CPU

it will allow switching from cpu_index to property based
numa mapping in follow up patches.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 64c2a8f6d3facc2f758907c3b95686fe9e999590
      
https://github.com/qemu/qemu/commit/64c2a8f6d3facc2f758907c3b95686fe9e999590
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M numa.c

  Log Message:
  -----------
  numa: add check that board supports cpu_index to node mapping

Default node mapping initialization already checks that board
supports cpu_index to node mapping and refuses to start if
it's not supported. Do the same for explicitly provided
mapping "-numa node,cpus=..."

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 7c88e65d9e9ff7df7fa9cff1869d64a0eaac63a1
      
https://github.com/qemu/qemu/commit/7c88e65d9e9ff7df7fa9cff1869d64a0eaac63a1
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/core/machine.c
    M include/hw/boards.h
    M numa.c

  Log Message:
  -----------
  numa: mirror cpu to node mapping in MachineState::possible_cpus

Introduce machine_set_cpu_numa_node() helper that stores
node mapping for CPU in MachineState::possible_cpus.
CPU and node it belongs to is specified by 'props' argument.

Patch doesn't remove old way of storing mapping in
numa_info[X].node_cpu as removing it at the same time
makes patch rather big. Instead it just mirrors mapping
in possible_cpus and follow up per target patches will
switch to possible_cpus and numa_info[X].node_cpu will
be removed once there isn't any users left.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: af9b20e8d21cb692e9411963a532b2486f2a1e65
      
https://github.com/qemu/qemu/commit/af9b20e8d21cb692e9411963a532b2486f2a1e65
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M numa.c

  Log Message:
  -----------
  numa: do default mapping based on possible_cpus instead of node_cpu bitmaps

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: ea2650724ceb15903eb25473252047784fae5672
      
https://github.com/qemu/qemu/commit/ea2650724ceb15903eb25473252047784fae5672
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/acpi/cpu.c
    M hw/i386/acpi-build.c
    M hw/i386/pc.c

  Log Message:
  -----------
  pc: get numa node mapping from possible_cpus instead of 
numa_get_node_for_cpu()

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 722387e78daf6a330220082934cfaaf68fa4d492
      
https://github.com/qemu/qemu/commit/722387e78daf6a330220082934cfaaf68fa4d492
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/ppc/spapr.c
    M hw/ppc/spapr_cpu_core.c

  Log Message:
  -----------
  spapr: get numa node mapping from possible_cpus instead of 
numa_get_node_for_cpu()

it's safe to remove thread node_id != core node_id error
branch as machine_set_cpu_numa_node() also does mismatch
check and is called even before any CPU is created.

Signed-off-by: Igor Mammedov <address@hidden>
Acked-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 4ccf5826f96e766e32385e9f6ee0350403054ce1
      
https://github.com/qemu/qemu/commit/4ccf5826f96e766e32385e9f6ee0350403054ce1
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/arm/virt-acpi-build.c
    M hw/arm/virt.c

  Log Message:
  -----------
  virt-arm: get numa node mapping from possible_cpus instead of 
numa_get_node_for_cpu()

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: afed5a5a7030a074a181d2a0ce8202de71a6ada4
      
https://github.com/qemu/qemu/commit/afed5a5a7030a074a181d2a0ce8202de71a6ada4
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M cpus.c
    M qapi-schema.json

  Log Message:
  -----------
  QMP: include CpuInstanceProperties into query_cpus output output

if board supports CpuInstanceProperties, report them for
each CPU thread listed. Main motivation for this is to
provide these properties introspection via QMP interface
for using in test cases to verify numa node to cpu mapping,
which includes not only boards that support cpu hotplug
and have this info in query-hotpluggable-cpus (pc/spapr)
but also for boards that don't not support hotpluggable-cpus
but support numa mapping (virt-arm).

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Eric Blake <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 6accfb782321de5a15e9c9ff5482a2d830055a8f
      
https://github.com/qemu/qemu/commit/6accfb782321de5a15e9c9ff5482a2d830055a8f
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M numa.c
    M tests/numa-test.c

  Log Message:
  -----------
  tests: numa: add case for QMP command query-cpus

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 3b8a8557f781c4216744d9ab69bee43b526b0c64
      
https://github.com/qemu/qemu/commit/3b8a8557f781c4216744d9ab69bee43b526b0c64
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M include/sysemu/numa.h
    M numa.c
    M vl.c

  Log Message:
  -----------
  numa: remove no longer need numa_post_machine_init()

CPUState::numa_node is still in use but now it's set by
board when it creates CPU objects. So there isn't any
need to set it again after all CPU's are created,
since it's been already set.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 482dfe9a9e8fe72d6a96c927e23078808f9cacd2
      
https://github.com/qemu/qemu/commit/482dfe9a9e8fe72d6a96c927e23078808f9cacd2
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/core/machine.c
    M include/hw/boards.h
    M vl.c

  Log Message:
  -----------
  machine: call machine init from wrapper

add machine_run_board_init() wrapper that calls machine
init for now but in follow up patches it will be used
to run generic machine code that should run before
machine init.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Reviewed-by: Eduardo Habkost <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: ec78f8114bc4c133fc56fefa7f2af99725e42857
      
https://github.com/qemu/qemu/commit/ec78f8114bc4c133fc56fefa7f2af99725e42857
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M hw/core/machine.c
    M numa.c

  Log Message:
  -----------
  numa: use possible_cpus for not mapped CPUs check

and remove corresponding part in numa.c that uses
node_cpu bitmaps.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 1171ae9a5b132dc631728ff17688d05ed4534181
      
https://github.com/qemu/qemu/commit/1171ae9a5b132dc631728ff17688d05ed4534181
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M include/sysemu/numa.h
    M numa.c

  Log Message:
  -----------
  numa: remove node_cpu bitmaps as they are no longer used

Postfactum "CPU(s) present in multiple NUMA nodes" check
was the last user of node_cpu bitmaps, but it's not need
as machine_set_cpu_numa_node() does the similar check at
the time mapping is set for cpus (i.e. when -numa cpus=
is parsed) and ensures that cpu can be mapped only to
one node.

Remove duplicate check based on node_cpu bitmaps and
since the last user is gone remove node_cpu as well,
which completes internal transition from legacy bitmap
based mapping storage to possible_cpus storage.

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Reviewed-by: Andrew Jones <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 419fcdec3c1ff545cd33d90ade99236c9bcc37cc
      
https://github.com/qemu/qemu/commit/419fcdec3c1ff545cd33d90ade99236c9bcc37cc
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M numa.c
    M qapi-schema.json
    M qemu-options.hx

  Log Message:
  -----------
  numa: add '-numa cpu,...' option for property based node mapping

legacy cpu to node mapping is using cpu index values to map
VCPU to node with help of '-numa node,nodeid=node,cpus=x[-y]'
option. However cpu index is internal concept and QEMU users
have to guess /reimplement qemu's logic/ to map it to
a concrete cpu socket/core/thread to make sane CPUs
placement across numa nodes.

This patch allows to map cpu objects to numa nodes using
the same properties as used for cpus with -device/device_add
(socket-id/core-id/thread-id/node-id).

At present valid properties/values to address CPUs could be
fetched using hotpluggable-cpus monitor/qmp command, it will
require user to start qemu twice when creating domain to fetch
possible CPUs for a machine type/-smp layout first and
then the second time with numa explicit mapping for actual
usage. The first step results could be saved and reused to
set/change mapping later as far as machine type/-smp stays
the same.

Proposed impl. supports exact and wildcard matching to
simplify CLI and allow to set mapping for a specific cpu
or group of cpu objects specified by matched properties.

For example:

   # exact mapping x86
   -numa cpu,node-id=x,socket-id=y,core-id=z,thread-id=n

   # exact mapping SPAPR
   -numa cpu,node-id=x,core-id=y

   # wildcard mapping, all cpu objects that match socket-id=y
   # are mapped to node-id=x
   -numa cpu,node-id=x,socket-id=y

Signed-off-by: Igor Mammedov <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 2941020a476f4875c9112500278e2ba2773cb124
      
https://github.com/qemu/qemu/commit/2941020a476f4875c9112500278e2ba2773cb124
  Author: Igor Mammedov <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M tests/numa-test.c

  Log Message:
  -----------
  tests: check -numa node,cpu=props_list usecase

Signed-off-by: Igor Mammedov <address@hidden>
Reviewed-by: David Gibson <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 46baa9007fb807f88feb2b1a975ae680dab1d5fd
      
https://github.com/qemu/qemu/commit/46baa9007fb807f88feb2b1a975ae680dab1d5fd
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/i386/machine.c

  Log Message:
  -----------
  migration/i386: Remove old non-softfloat 64bit FP support

Long long ago, we used to support storing the x86 FP registers in
a 64bit format.

Then c31da136a0bf8caad70c348f5ffc283206e9c7fc in v0.14-rc0 removed
the last support for writing that in the migration format.
Even before that, it was only used if you had softfloat disabled
 (i.e. !USE_X86LDOUBLE) so in practice use of it in even earlier
qemu is unlikely for most users.

Kill it off, it's complicated, and possibly broken.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: ab808276f8b1db1757e1421e99c98b11714bb9a8
      
https://github.com/qemu/qemu/commit/ab808276f8b1db1757e1421e99c98b11714bb9a8
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/i386/machine.c

  Log Message:
  -----------
  vmstatification: i386 FPReg

Convert the fpreg save/restore to use VMSTATE_ macros rather than
.get/.put.

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: 08b277ac46da8b02e50cec455eca7cb2d12ffcf0
      
https://github.com/qemu/qemu/commit/08b277ac46da8b02e50cec455eca7cb2d12ffcf0
  Author: Dr. David Alan Gilbert <address@hidden>
  Date:   2017-05-11 (Thu, 11 May 2017)

  Changed paths:
    M target/i386/machine.c

  Log Message:
  -----------
  migration/i386: Remove support for pre-0.12 formats

Remove support for versions of the CPU state prior to 11
which is the version used in qemu 0.12 - you'd be pretty
lucky if you got a migration stream to work from anything
that old anyway.  This doesn't affect the machine type
definition in any way.

My main reason for doing this is the hack for sysenter_esp/eip
that uses .get/.put's in state versions less than 7 (that's
prior to somewhere before 0.10).

Signed-off-by: Dr. David Alan Gilbert <address@hidden>
Message-Id: <address@hidden>
Reviewed-by: Juan Quintela <address@hidden>
Signed-off-by: Eduardo Habkost <address@hidden>


  Commit: c19f4fbce1c2293b7a9bddadddd7a1b69953f534
      
https://github.com/qemu/qemu/commit/c19f4fbce1c2293b7a9bddadddd7a1b69953f534
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M hw/display/virtio-gpu-3d.c
    M hw/display/virtio-gpu.c
    M include/hw/virtio/virtio-gpu.h

  Log Message:
  -----------
  virtio-gpu: move virtio_gpu_gl_block

Move to virtio-gpu-3d.c where all the other virgl code lives too.

Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: 9f728c7940dfade366fed01d8f43f1e5283f95d8
      
https://github.com/qemu/qemu/commit/9f728c7940dfade366fed01d8f43f1e5283f95d8
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M include/ui/egl-helpers.h
    M ui/egl-helpers.c
    M ui/gtk-egl.c

  Log Message:
  -----------
  egl-helpers: drop support for gles and debug logging

Leftover from the early opengl days.
Unused now, so delete the dead code.

Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Marc-André Lureau <address@hidden>
Message-id: address@hidden


  Commit: e1913dbb58e7a4ab0c2dd088cc3b397b8daed8c5
      
https://github.com/qemu/qemu/commit/e1913dbb58e7a4ab0c2dd088cc3b397b8daed8c5
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M include/ui/egl-helpers.h
    M ui/egl-helpers.c
    M ui/gtk-egl.c

  Log Message:
  -----------
  egl-helpers: fix display init for x11

When running on gtk we need X11 platform not mesa platform.
Create separate functions for mesa and x11 so we can keep
the egl #ifdef mess local to egl-helpers.c

Fixes: 0ea1523fb6703aa0dcd65e66b59e96fec028e60a
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: 151c8e608efc29e4dde4a0dbc2e79ebbc86c319c
      
https://github.com/qemu/qemu/commit/151c8e608efc29e4dde4a0dbc2e79ebbc86c319c
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M ui/egl-helpers.c

  Log Message:
  -----------
  egl-helpers: add missing error check

Code didn't check for qemu_egl_init_dpy_mesa() failures, add it.

Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: bc8c946f7274543ca3ed35482de4e554daccfac6
      
https://github.com/qemu/qemu/commit/bc8c946f7274543ca3ed35482de4e554daccfac6
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M ui/egl-context.c
    M ui/egl-helpers.c

  Log Message:
  -----------
  egl: explicitly ask for core context

Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: bb1599b64c8f94fb2bd745d20f128e11543d891d
      
https://github.com/qemu/qemu/commit/bb1599b64c8f94fb2bd745d20f128e11543d891d
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M include/ui/console.h
    M ui/Makefile.objs
    A ui/egl-headless.c
    M vl.c

  Log Message:
  -----------
  opengl: add egl-headless display

Add egl-headless user interface.  It doesn't provide a real user
interface, it only provides opengl support using drm render nodes.
It will copy back the bits rendered by the guest using virgl back
to a DisplaySurface and kick the usual display update code paths,
so spice and vnc and screendump can pick it up.

Use it this way:
  qemu -display egl-headless -vnc $display
  qemu -display egl-headless -spice gl=off,$args

Note that you should prefer native spice opengl support (-spice
gl=on) if possible because that delivers better performance.

Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: a92ff8c123f45b3eb01a54f61d7be088e345612a
      
https://github.com/qemu/qemu/commit/a92ff8c123f45b3eb01a54f61d7be088e345612a
  Author: Thomas Huth <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M docs/qdev-device-use.txt
    M qemu-doc.texi

  Log Message:
  -----------
  qemu-doc: Update to use the new way of attaching USB devices

The preferred way of adding USB devices is via "-device" and
"device_add" nowadays, so let's start to get rid of "-usbdevice"
and "usb_add" in the documentation. While we're at it, also
add the new USB devices there which have been added to QEMU
during the last years, and get rid of the old "vendorid" and
"productid" parameters of "-usbdevice serial" which have been
removed in QEMU version 0.14.0 already.

Reviewed-by: Markus Armbruster <address@hidden>
Signed-off-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: bd4a683505b27adc1ac809f71e918e58573d851d
      
https://github.com/qemu/qemu/commit/bd4a683505b27adc1ac809f71e918e58573d851d
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M hw/usb/redirect.c

  Log Message:
  -----------
  usb-redir: fix stack overflow in usbredir_log_data

Don't reinvent a broken wheel, just use the hexdump function we have.

Impact: low, broken code doesn't run unless you have debug logging
enabled.

Reported-by: 李强 <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>
Message-id: address@hidden


  Commit: ee56264af818dd6c0a97cb9c6e44e5b7d394c0fc
      
https://github.com/qemu/qemu/commit/ee56264af818dd6c0a97cb9c6e44e5b7d394c0fc
  Author: Ladi Prosek <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M hw/usb/hcd-xhci.c

  Log Message:
  -----------
  xhci: fix logging

slotid and epid were deleted from XHCITransfer in commit d6fcb29.
Also deleting one unused forward declaration.

Signed-off-by: Ladi Prosek <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 66849dcfbed4be2ba012fd55631558c623c43f89
      
https://github.com/qemu/qemu/commit/66849dcfbed4be2ba012fd55631558c623c43f89
  Author: Ladi Prosek <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M hw/usb/dev-hub.c

  Log Message:
  -----------
  usb-hub: clear PORT_STAT_SUSPEND on wakeup

The spec says:

  Suspend: (PORT_SUSPEND) This field indicates whether or not the device
  on this port is suspended. Setting this field causes the device to
  suspend by not propagating bus traffic downstream. This field may be
  reset by a request or by resume signaling from the device attached to
  the port.

I can't find any specific statement like "the PORT_SUSPEND field is reset
automatically on remote wakeup", but without this patch, the only way to
reset it is via the ClearPortFeature request so the ".. or by resume
signaling from the device" clause is clearly not implemented on the remote
wakeup path.

The default xhci Windows driver does not issue the ClearPortFeature request
and suspended devices attached to a hub don't properly get out of the
suspended state. Interestingly, the default uhci Windows driver *does*
issue the ClearPortFeature request and does not exhibit this problem.

Signed-off-by: Ladi Prosek <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 99f9aeba5d461f79c9ce73f968ba0feb77fc1f5a
      
https://github.com/qemu/qemu/commit/99f9aeba5d461f79c9ce73f968ba0feb77fc1f5a
  Author: Ladi Prosek <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M hw/usb/hcd-xhci.c

  Log Message:
  -----------
  xhci: relax link check

The strict td link limit added by commit "05f43d4 xhci: limit the
number of link trbs we are willing to process" causes problems with
Windows guests. Let's raise the limit.

This change is analogous to:

  commit ab6b1105a2259c7072905887f71caa850ce63190
  Author: Gerd Hoffmann <address@hidden>
  Date:   Tue Mar 7 09:40:18 2017 +0100

      ohci: relax link check

Signed-off-by: Ladi Prosek <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: aa612b364ecbe1dc034efcabb04526f24e56c145
      
https://github.com/qemu/qemu/commit/aa612b364ecbe1dc034efcabb04526f24e56c145
  Author: Thomas Huth <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M hw/usb/dev-serial.c

  Log Message:
  -----------
  hw/usb/dev-serial: Do not try to set vendorid or productid properties

When starting QEMU with the legacy USB serial device like this:

 qemu-system-x86_64 -usbdevice serial:vendorid=0x1234:stdio

it currently aborts since the vendorid property does not exist
anymore (it has been removed by commit f29783f72ea77dfbd7ea0c9):

 Unexpected error in object_property_find() at qemu/qom/object.c:1008:
 qemu-system-x86_64: -usbdevice serial:vendorid=0x1234:stdio: Property
               '.vendorid' not found
 Aborted (core dumped)

Fix this crash by issuing a more friendly error message instead
(and simplify the code also a little bit this way).

Signed-off-by: Thomas Huth <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 761d0f97a40a3a6b6a0f2fb75eea47a0cea42d14
      
https://github.com/qemu/qemu/commit/761d0f97a40a3a6b6a0f2fb75eea47a0cea42d14
  Author: Wei Qi <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M ui/vnc-enc-zrle.c

  Log Message:
  -----------
  vnc: simple clean up

It is unnecessary to assign 'packed_bytes' to 'estimated_bytes', because 
'estimated_bytes' unused after assignment.

Signed-off-by: Wei Qi <address@hidden>
Reviewed-by: Sahid Orentino Ferdjaoui <address@hidden>
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 7c9209e7bfb8c09ab5a4cadaa84928d146874a05
      
https://github.com/qemu/qemu/commit/7c9209e7bfb8c09ab5a4cadaa84928d146874a05
  Author: Cédric Le Goater <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M include/qemu/bitops.h
    M ui/vnc.c

  Log Message:
  -----------
  vnc: replace hweight_long() with ctpopl()

ctpopl() has a better implementation than hweight_long() and ui/vnc.c
being the last user of hweight_long(), we can simply remove it.

Signed-off-by: Cédric Le Goater <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Gerd Hoffmann <address@hidden>


  Commit: 5bf83628dc61b821c3834730836f1d7c2f5ff1be
      
https://github.com/qemu/qemu/commit/5bf83628dc61b821c3834730836f1d7c2f5ff1be
  Author: Richard Henderson <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/helper.h
    M target/s390x/insn-data.def
    M target/s390x/misc_helper.c
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: Implement STORE FACILITIES LIST EXTENDED

At the same time, improve STORE FACILITIES LIST
so that we don't hard-code the list for all cpus.

Signed-off-by: Richard Henderson <address@hidden>


  Commit: 190b2422e65fb8bb559f4337dfe461a50d0b7ec1
      
https://github.com/qemu/qemu/commit/190b2422e65fb8bb559f4337dfe461a50d0b7ec1
  Author: Miroslav Benes <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/insn-data.def
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: Implement LOAD PROGRAM PARAMETER

Linux arch/s390/kernel/head(64).S uses LPP instruction if it is
available in facilities list provided by stfl/stfle instruction.
This is the case of newer z/System generations and their qemu
definition.

The description of LPP is at
http://www-01.ibm.com/support/docview.wss?uid=isg26fcd1cc32246f4c8852574ce0044734a

Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Miroslav Benes <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: 44977a8fe7b5ed8fc3d135b74d5933dfa53b11ee
      
https://github.com/qemu/qemu/commit/44977a8fe7b5ed8fc3d135b74d5933dfa53b11ee
  Author: Richard Henderson <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/cpu.c
    M target/s390x/cpu.h
    M target/s390x/helper.c

  Log Message:
  -----------
  target/s390x: Diagnose specification exception for atomics

All of the interlocked access facility instructions raise a
specification exception for unaligned accesses.  Do this by
using the (previously unused) unaligned_access hook.

Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: 1807aaa565ca0b318b9b9da62e78fcd81793ebef
      
https://github.com/qemu/qemu/commit/1807aaa565ca0b318b9b9da62e78fcd81793ebef
  Author: Eric Bischoff <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/insn-data.def
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: Implement LOAD PAIR DISJOINT

Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Eric Bischoff <address@hidden>
Message-Id: <address@hidden>
[rth: Combine the two via insn->data; free the address temps.]
Signed-off-by: Richard Henderson <address@hidden>


  Commit: 303a9ab887f26046cf7c96fb6347f3d3659721e9
      
https://github.com/qemu/qemu/commit/303a9ab887f26046cf7c96fb6347f3d3659721e9
  Author: Richard Henderson <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/helper.h
    M target/s390x/insn-data.def
    M target/s390x/mem_helper.c
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: Use atomic operations for COMPARE SWAP

Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: 4dba4d6fef612d9bfab9554e7dee5960ebdf22d6
      
https://github.com/qemu/qemu/commit/4dba4d6fef612d9bfab9554e7dee5960ebdf22d6
  Author: Richard Henderson <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/insn-data.def
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: Use atomic operations for LOAD AND OP

Reviewed-by: Aurelien Jarno <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: a7c1fadf00027d8ff16326f4ea1548e3fdbc4a55
      
https://github.com/qemu/qemu/commit/a7c1fadf00027d8ff16326f4ea1548e3fdbc4a55
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/cpu.h
    M target/s390x/kvm.c
    M target/s390x/misc_helper.c

  Log Message:
  -----------
  target/s390x: mask the SIGP order_code using SIGP_ORDER_MASK

For that move the definition from kvm.c to cpu.h

Reviewed-by: Thomas Huth <address@hidden>
Reviewed-by: Cornelia Huck <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: 1e8e69f08b05065b9c1a85715773cf844bfa27dd
      
https://github.com/qemu/qemu/commit/1e8e69f08b05065b9c1a85715773cf844bfa27dd
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: fix SIGNAL PROCESSOR return value

The SIGNAL PROCESSOR helper returns its value through the CC register.
set_cc_static should be called just after the helper.

Signed-off-by: Aurelien Jarno <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: 538fad597d898f677f81cb4daacd37e7cdc18e6e
      
https://github.com/qemu/qemu/commit/538fad597d898f677f81cb4daacd37e7cdc18e6e
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-12 (Fri, 12 May 2017)

  Changed paths:
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: implement serialization in BRANCH CONDITION

Signed-off-by: Aurelien Jarno <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>


  Commit: a6215749dc299214642b3dfd690227243606331f
      
https://github.com/qemu/qemu/commit/a6215749dc299214642b3dfd690227243606331f
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: split ctx->flags into ctx->tbflags and ctx->envflags

There is a confusion (and not only in the SH4 target) between tb->flags,
env->flags and ctx->flags. To avoid it, split ctx->flags into
ctx->tbflags and ctx->envflags. ctx->tbflags stays unchanged during the
whole TB translation, while ctx->envflags evolves and is kept in sync
with env->flags using TCG instructions. ctx->envflags now only contains
the part that of env->flags that is contained in the TB state, i.e. the
DELAY_SLOT* flags.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 39682608111713404b53ade46edc87a7f85a0f12
      
https://github.com/qemu/qemu/commit/39682608111713404b53ade46edc87a7f85a0f12
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/cpu.h
    M target/sh4/helper.c
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: get rid of DELAY_SLOT_CLEARME

Now that ctx->flags has been split, it becomes clear that
DELAY_SLOT_CLEARME has not impact on the code generation: in both case
ctx->envflags is cleared, either by clearing all the flags, or by
setting it to 0. This is left-over from pre-TCG era.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 24b09d9d8ba589402f9c8e0d8d36bcf5c4a933da
      
https://github.com/qemu/qemu/commit/24b09d9d8ba589402f9c8e0d8d36bcf5c4a933da
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/cpu.h

  Log Message:
  -----------
  target/sh4: do not include DELAY_SLOT_TRUE in the TB state

DELAY_SLOT_TRUE is used as a dynamic condition for the branch after the
delay slot instruction. It is not used in code generation, so there is
no need to including in the TB state.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 47b9f4d5a4013938134ca678c338906e798a61d7
      
https://github.com/qemu/qemu/commit/47b9f4d5a4013938134ca678c338906e798a61d7
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/cpu.h
    M target/sh4/helper.c
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: move DELAY_SLOT_TRUE flag into a separate global

Instead of using one bit of the env flags to store the condition of the
next delay slot, use a separate global. It simplifies reading and
writing the flags variable and also removes some confusion between
ctx->envflags and env->flags.

Note that the global is first transfered to a temp in order to be
able to discard the global before the brcond.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 0fc37a8b0cd79f532ef6b743c7f43496f7d2ce1e
      
https://github.com/qemu/qemu/commit/0fc37a8b0cd79f532ef6b743c7f43496f7d2ce1e
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: fix BS_STOP exit

When stopping the translation because the state has changed, goto_tb
should not be used as it might link TB with different flags.

Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 632056651a038e85ea9b62f1ad63a98c929ee40f
      
https://github.com/qemu/qemu/commit/632056651a038e85ea9b62f1ad63a98c929ee40f
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: fix BS_EXCP exit

In case of exception, there is no need to call tcg_gen_exit_tb as the
exception helper won't return.

Also fix a few cases where BS_BRANCH is called instead of BS_EXCP.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: ac9707eaf6124cb0dd81202d88730f540e7c7d5b
      
https://github.com/qemu/qemu/commit/ac9707eaf6124cb0dd81202d88730f540e7c7d5b
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: only save flags state at the end of the TB

There is no need to save flags when entering and exiting the delay slot.
They can be saved only when reaching the end of the TB. If the TB is
interrupted before by an exception, they will be restored using
restore_state_to_opc.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: b3995c23edff05631f90143f68866aed776e80f9
      
https://github.com/qemu/qemu/commit/b3995c23edff05631f90143f68866aed776e80f9
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: fold ctx->bstate = BS_BRANCH into gen_conditional_jump

Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 58d2a9aef4cacb3056f5b12c1eb92105704183fe
      
https://github.com/qemu/qemu/commit/58d2a9aef4cacb3056f5b12c1eb92105704183fe
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: optimize gen_store_fpr64

Using extr and avoiding intermediate temps.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: a380f9db96dc94e5109611e4fd0fb4f671e30143
      
https://github.com/qemu/qemu/commit/a380f9db96dc94e5109611e4fd0fb4f671e30143
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: optimize gen_write_sr using extract op

This doesn't change the generated code on x86, but optimizes it on most
RISC architectures and makes the code simpler to read.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: aa3513176f8c6f3150a9499f3d22da6c86b6b097
      
https://github.com/qemu/qemu/commit/aa3513176f8c6f3150a9499f3d22da6c86b6b097
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: generate fences for SH4

synco is a SH4-A only instruction.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: cb32f179e00c51b32bf37a15191179b4fc472d29
      
https://github.com/qemu/qemu/commit/cb32f179e00c51b32bf37a15191179b4fc472d29
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: implement tas.b using atomic helper

We only emulate UP SH4, however as the tas.b instruction is used in the GNU
libc, this improve linux-user emulation.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 143021b26ffe1a468236c824003caaf4fd7d4831
      
https://github.com/qemu/qemu/commit/143021b26ffe1a468236c824003caaf4fd7d4831
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: movua.l is an SH4-A only instruction

At the same time change the comment describing the instruction the same
way than other instruction, so that the code is easier to read and search.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 34257c2117209573ddff290128d4192cf9bbdf23
      
https://github.com/qemu/qemu/commit/34257c2117209573ddff290128d4192cf9bbdf23
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/cpu.c
    M target/sh4/cpu.h
    M target/sh4/op_helper.c
    M target/sh4/translate.c

  Log Message:
  -----------
  target/sh4: trap unaligned accesses

SH4 requires that memory accesses are naturally aligned, except for the
SH4-A movua.l instructions which can do unaligned loads.

Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 57e2d417d3108a6e28e705f4a9d6ff22ab79af16
      
https://github.com/qemu/qemu/commit/57e2d417d3108a6e28e705f4a9d6ff22ab79af16
  Author: Aurelien Jarno <address@hidden>
  Date:   2017-05-13 (Sat, 13 May 2017)

  Changed paths:
    M target/sh4/op_helper.c

  Log Message:
  -----------
  target/sh4: use cpu_loop_exit_restore

Use cpu_loop_exit_restore when using cpu_restore_state and cpu_loop_exit
together.

Reviewed-by: Richard Henderson <address@hidden>
Signed-off-by: Aurelien Jarno <address@hidden>


  Commit: 2f77ec7390d307842286f64019475c4fdf5dad18
      
https://github.com/qemu/qemu/commit/2f77ec7390d307842286f64019475c4fdf5dad18
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-15 (Mon, 15 May 2017)

  Changed paths:
    M .gitmodules
    M Makefile
    M configure
    M cpus.c
    M cputlb.c
    M hw/intc/xics_kvm.c
    M hw/ppc/mac_newworld.c
    M hw/ppc/mac_oldworld.c
    M hw/ppc/pnv.c
    M hw/ppc/spapr.c
    M hw/ppc/spapr_hcall.c
    M include/hw/ppc/pnv.h
    M include/hw/ppc/pnv_lpc.h
    M include/hw/ppc/pnv_occ.h
    M include/hw/ppc/xics.h
    M pc-bios/README
    A pc-bios/qemu_vga.ndrv
    A roms/QemuMacDrivers
    M target/ppc/Makefile.objs
    M target/ppc/cpu-models.h
    M target/ppc/cpu.h
    M target/ppc/excp_helper.c
    M target/ppc/kvm.c
    M target/ppc/mmu-book3s-v3.c
    M target/ppc/mmu-book3s-v3.h
    A target/ppc/mmu-radix64.c
    A target/ppc/mmu-radix64.h
    M target/ppc/translate.c
    M target/ppc/translate_init.c

  Log Message:
  -----------
  Merge remote-tracking branch 'dgibson/tags/ppc-for-2.10-20170511' into staging

ppc patch queue for 2017-05-11

This pull request supersedes the one from yesterday (20170510), fixing
an important style bug in one patch, and adding an extra couple of
simple patches.

Highlights of this set:
  * Some fixes for POWER9
  * TCG support for POWER9 radix MMU
  * VGA rom for Mac machine types
  * Fixes for the XICS interrupt controller
  * MTTCG support for ppc targets

As suggested by Paolo, I've tried to add the Docker tests to my
standard pre-pull-request tests.  I haven't wholly suceeded; this has
been tested with some of the Docker images, but others I haven't
managed due to problems that as best I can tell are not due to
problems in this patch series.  I'll continue working on this for
future pull requests.  Specifically, 'travis', 'fedora', and 'centos6'
seem to work.  'min-glib' jammed while gtesting moxie, which seems
very unlikely to be caused by this series.  'ubuntu', 'debian' and
'debian-bootstrap' hit build errors almost immediately that look like
problems with the container configuration, and 'debian-*-cross' hit
build errors later on which also look like missing dependencies from
the container.

# gpg: Signature made Thu 11 May 2017 05:13:46 AM BST
# gpg:                using RSA key 0x6C38CACA20D9B392
# gpg: Good signature from "David Gibson <address@hidden>"
# gpg:                 aka "David Gibson (kernel.org) <address@hidden>"
# gpg:                 aka "David Gibson (Red Hat) <address@hidden>"
# gpg:                 aka "David Gibson (ozlabs.org) <address@hidden>"
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* dgibson/tags/ppc-for-2.10-20170511: (23 commits)
  target/ppc: Avoid printing wrong aliases in CPU help text
  pnv: Fix build failures on some host platforms
  target/ppc: Allow workarounds for POWER9 DD1
  spapr: Don't accidentally advertise HTM support on POWER9
  ppc: xics: fix compilation with CentOS 6
  target/ppc: Enable RADIX mmu mode for pseries TCG guest
  target/ppc: Implement ISA V3.00 radix page fault handler
  target/ppc: Change tlbie invalid fields for POWER9 support
  target/ppc: Update tlbie to check privilege level based on GTSE
  target/ppc: Set UPRT and GTSE on all cpus in H_REGISTER_PROCESS_TABLE
  ppc: add qemu_vga.ndrv ROM to fw_cfg interface for NewWorld Macs
  ppc: add qemu_vga.ndrv ROM to fw_cfg interface for OldWorld Macs
  Add QemuMacDrivers qemu_vga.ndrv revision d4e7d7a built as submodule
  Add QemuMacDrivers as submodule
  ppc/xics: preserve P and Q bits for KVM IRQs
  ppc/xics: Fix stale irq->status bits after get
  target/ppc: do not reset reserve_addr in exec_enter
  tcg: enable MTTCG by default for PPC64 on x86
  cpus: Fix CPU unplug for MTTCG
  target/ppc: Generate fence operations
  ...

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 43ad494c0439e0af9f77cd455ec1a217a05b8fc0
      
https://github.com/qemu/qemu/commit/43ad494c0439e0af9f77cd455ec1a217a05b8fc0
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-15 (Mon, 15 May 2017)

  Changed paths:
    M hw/display/cg3.c
    M hw/display/sm501.c
    M hw/display/tcx.c
    M hw/display/vga.c

  Log Message:
  -----------
  Merge remote-tracking branch 'kraxel/tags/pull-vga-20170511-1' into staging

make display updates thread safe, batch #2

# gpg: Signature made Thu 11 May 2017 03:41:51 PM BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* kraxel/tags/pull-vga-20170511-1:
  vga: fix display update region calculation
  sm501: make display updates thread safe
  tcx: make display updates thread safe
  cg3: make display updates thread safe

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: ba9915e1f87fec742775d64859e881e4ab611429
      
https://github.com/qemu/qemu/commit/ba9915e1f87fec742775d64859e881e4ab611429
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-15 (Mon, 15 May 2017)

  Changed paths:
    M cpus.c
    M hw/acpi/aml-build.c
    M hw/acpi/cpu.c
    M hw/arm/virt-acpi-build.c
    M hw/arm/virt.c
    M hw/core/machine.c
    M hw/i386/acpi-build.c
    M hw/i386/pc.c
    M hw/i386/pc_piix.c
    M hw/i386/pc_q35.c
    M hw/ppc/spapr.c
    M hw/ppc/spapr_cpu_core.c
    M include/hw/acpi/aml-build.h
    M include/hw/boards.h
    M include/hw/ppc/spapr_cpu_core.h
    M include/qemu/typedefs.h
    M include/qom/cpu.h
    M include/sysemu/numa.h
    M include/sysemu/sysemu.h
    M numa.c
    M qapi-schema.json
    M qemu-options.hx
    M target/arm/cpu.c
    M target/arm/cpu.h
    M target/i386/cpu.c
    M target/i386/machine.c
    M tests/Makefile.include
    A tests/acpi-test-data/pc/SLIT.cphp
    A tests/acpi-test-data/pc/SLIT.memhp
    M tests/acpi-test-data/pc/SRAT.memhp
    A tests/acpi-test-data/q35/SLIT.cphp
    A tests/acpi-test-data/q35/SLIT.memhp
    M tests/acpi-test-data/q35/SRAT.memhp
    M tests/bios-tables-test.c
    A tests/numa-test.c
    M vl.c

  Log Message:
  -----------
  Merge remote-tracking branch 'ehabkost/tags/x86-and-machine-pull-request' 
into staging

x86 and machine queue, 2017-05-11

Highlights:
* New "-numa cpu" option
* NUMA distance configuration
* migration/i386 vmstatification

# gpg: Signature made Thu 11 May 2017 08:16:07 PM BST
# gpg:                using RSA key 0x2807936F984DC5A6
# gpg: Good signature from "Eduardo Habkost <address@hidden>"
# gpg: Note: This key has expired!
# Primary key fingerprint: 5A32 2FD5 ABC4 D3DB ACCF  D1AA 2807 936F 984D C5A6

* ehabkost/tags/x86-and-machine-pull-request: (29 commits)
  migration/i386: Remove support for pre-0.12 formats
  vmstatification: i386 FPReg
  migration/i386: Remove old non-softfloat 64bit FP support
  tests: check -numa node,cpu=props_list usecase
  numa: add '-numa cpu,...' option for property based node mapping
  numa: remove node_cpu bitmaps as they are no longer used
  numa: use possible_cpus for not mapped CPUs check
  machine: call machine init from wrapper
  numa: remove no longer need numa_post_machine_init()
  tests: numa: add case for QMP command query-cpus
  QMP: include CpuInstanceProperties into query_cpus output output
  virt-arm: get numa node mapping from possible_cpus instead of 
numa_get_node_for_cpu()
  spapr: get numa node mapping from possible_cpus instead of 
numa_get_node_for_cpu()
  pc: get numa node mapping from possible_cpus instead of 
numa_get_node_for_cpu()
  numa: do default mapping based on possible_cpus instead of node_cpu bitmaps
  numa: mirror cpu to node mapping in MachineState::possible_cpus
  numa: add check that board supports cpu_index to node mapping
  virt-arm: add node-id property to CPU
  pc: add node-id property to CPU
  spapr: add node-id property to sPAPR core
  ...

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 7a95434e0ca8a037fd8aa1a2e2461f92585eb77b
      
https://github.com/qemu/qemu/commit/7a95434e0ca8a037fd8aa1a2e2461f92585eb77b
  Author: Greg Kurz <address@hidden>
  Date:   2017-05-15 (Mon, 15 May 2017)

  Changed paths:
    M hw/9pfs/9p-local.c

  Log Message:
  -----------
  9pfs: local: forbid client access to metadata (CVE-2017-7493)

When using the mapped-file security mode, we shouldn't let the client mess
with the metadata. The current code already tries to hide the metadata dir
from the client by skipping it in local_readdir(). But the client can still
access or modify it through several other operations. This can be used to
escalate privileges in the guest.

Affected backend operations are:
- local_mknod()
- local_mkdir()
- local_open2()
- local_symlink()
- local_link()
- local_unlinkat()
- local_renameat()
- local_rename()
- local_name_to_path()

Other operations are safe because they are only passed a fid path, which
is computed internally in local_name_to_path().

This patch converts all the functions listed above to fail and return
EINVAL when being passed the name of the metadata dir. This may look
like a poor choice for errno, but there's no such thing as an illegal
path name on Linux and I could not think of anything better.

This fixes CVE-2017-7493.

Reported-by: Leo Gaspard <address@hidden>
Signed-off-by: Greg Kurz <address@hidden>
Reviewed-by: Eric Blake <address@hidden>


  Commit: 384d9d554aa4de0aa81a5b0be074d8c02f0941d4
      
https://github.com/qemu/qemu/commit/384d9d554aa4de0aa81a5b0be074d8c02f0941d4
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-15 (Mon, 15 May 2017)

  Changed paths:
    M hw/display/virtio-gpu-3d.c
    M hw/display/virtio-gpu.c
    M hw/input/virtio-input-hid.c
    M include/hw/virtio/virtio-gpu.h
    M include/qemu/bitops.h
    M include/ui/console.h
    M include/ui/egl-helpers.h
    M include/ui/input.h
    M ui/Makefile.objs
    M ui/cocoa.m
    M ui/egl-context.c
    A ui/egl-headless.c
    M ui/egl-helpers.c
    M ui/gtk-egl.c
    M ui/gtk.c
    M ui/input-linux.c
    M ui/input.c
    M ui/sdl.c
    M ui/sdl2.c
    M ui/spice-input.c
    M ui/vnc-enc-zrle.c
    M ui/vnc.c
    M vl.c

  Log Message:
  -----------
  Merge remote-tracking branch 'kraxel/tags/pull-ui-20170512-1' into staging

ui: add egl-headless
ui: some vnc cleanups
ui: absolute events for input-linux

# gpg: Signature made Fri 12 May 2017 12:50:07 PM BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* kraxel/tags/pull-ui-20170512-1:
  vnc: replace hweight_long() with ctpopl()
  vnc: simple clean up
  opengl: add egl-headless display
  egl: explicitly ask for core context
  egl-helpers: add missing error check
  egl-helpers: fix display init for x11
  egl-helpers: drop support for gles and debug logging
  virtio-gpu: move virtio_gpu_gl_block
  ui: input-linux: Add absolute event support
  ui: Support non-zero minimum values for absolute input axes

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 8a813c9868218242f7d7b68f45ac4f484b1ccba9
      
https://github.com/qemu/qemu/commit/8a813c9868218242f7d7b68f45ac4f484b1ccba9
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-15 (Mon, 15 May 2017)

  Changed paths:
    M docs/qdev-device-use.txt
    M hw/usb/dev-hub.c
    M hw/usb/dev-serial.c
    M hw/usb/hcd-xhci.c
    M hw/usb/redirect.c
    M qemu-doc.texi

  Log Message:
  -----------
  Merge remote-tracking branch 'kraxel/tags/pull-usb-20170512-1' into staging

usb: bugfixes, doc update

# gpg: Signature made Fri 12 May 2017 01:20:29 PM BST
# gpg:                using RSA key 0x4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <address@hidden>"
# gpg:                 aka "Gerd Hoffmann <address@hidden>"
# gpg:                 aka "Gerd Hoffmann (private) <address@hidden>"
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* kraxel/tags/pull-usb-20170512-1:
  hw/usb/dev-serial: Do not try to set vendorid or productid properties
  xhci: relax link check
  usb-hub: clear PORT_STAT_SUSPEND on wakeup
  xhci: fix logging
  usb-redir: fix stack overflow in usbredir_log_data
  qemu-doc: Update to use the new way of attaching USB devices

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: eba0161990af8509608332450ee7e338273cf5df
      
https://github.com/qemu/qemu/commit/eba0161990af8509608332450ee7e338273cf5df
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-16 (Tue, 16 May 2017)

  Changed paths:
    M target/s390x/cpu.c
    M target/s390x/cpu.h
    M target/s390x/helper.c
    M target/s390x/helper.h
    M target/s390x/insn-data.def
    M target/s390x/kvm.c
    M target/s390x/mem_helper.c
    M target/s390x/misc_helper.c
    M target/s390x/translate.c

  Log Message:
  -----------
  Merge remote-tracking branch 'rth/tags/pull-s390-20170512' into staging

Queued target/s390 patches

# gpg: Signature made Sat 13 May 2017 12:33:08 AM BST
# gpg:                using RSA key 0xAD1270CC4DD0279B
# gpg: Good signature from "Richard Henderson <address@hidden>"
# gpg:                 aka "Richard Henderson <address@hidden>"
# gpg:                 aka "Richard Henderson <address@hidden>"
# Primary key fingerprint: 9CB1 8DDA F8E8 49AD 2AFC  16A4 AD12 70CC 4DD0 279B

* rth/tags/pull-s390-20170512:
  target/s390x: implement serialization in BRANCH CONDITION
  target/s390x: fix SIGNAL PROCESSOR return value
  target/s390x: mask the SIGP order_code using SIGP_ORDER_MASK
  target/s390x: Use atomic operations for LOAD AND OP
  target/s390x: Use atomic operations for COMPARE SWAP
  target/s390x: Implement LOAD PAIR DISJOINT
  target/s390x: Diagnose specification exception for atomics
  target/s390x: Implement LOAD PROGRAM PARAMETER
  target/s390x: Implement STORE FACILITIES LIST EXTENDED

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 6a8d8349864fb01fdd5a7d1c2e7ca0e5ad24f3d0
      
https://github.com/qemu/qemu/commit/6a8d8349864fb01fdd5a7d1c2e7ca0e5ad24f3d0
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-16 (Tue, 16 May 2017)

  Changed paths:
    M target/sh4/cpu.c
    M target/sh4/cpu.h
    M target/sh4/helper.c
    M target/sh4/op_helper.c
    M target/sh4/translate.c

  Log Message:
  -----------
  Merge remote-tracking branch 'aurel32/tags/pull-target-sh4-20170513' into 
staging

Queued target/sh4 patches

# gpg: Signature made Sat 13 May 2017 10:25:41 AM BST
# gpg:                using RSA key 0xBA9C78061DDD8C9B
# gpg: Good signature from "Aurelien Jarno <address@hidden>"
# gpg:                 aka "Aurelien Jarno <address@hidden>"
# gpg:                 aka "Aurelien Jarno <address@hidden>"
# Primary key fingerprint: 7746 2642 A9EF 94FD 0F77  196D BA9C 7806 1DDD 8C9B

* aurel32/tags/pull-target-sh4-20170513:
  target/sh4: use cpu_loop_exit_restore
  target/sh4: trap unaligned accesses
  target/sh4: movua.l is an SH4-A only instruction
  target/sh4: implement tas.b using atomic helper
  target/sh4: generate fences for SH4
  target/sh4: optimize gen_write_sr using extract op
  target/sh4: optimize gen_store_fpr64
  target/sh4: fold ctx->bstate = BS_BRANCH into gen_conditional_jump
  target/sh4: only save flags state at the end of the TB
  target/sh4: fix BS_EXCP exit
  target/sh4: fix BS_STOP exit
  target/sh4: move DELAY_SLOT_TRUE flag into a separate global
  target/sh4: do not include DELAY_SLOT_TRUE in the TB state
  target/sh4: get rid of DELAY_SLOT_CLEARME
  target/sh4: split ctx->flags into ctx->tbflags and ctx->envflags

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 96cd59981805b2d0addb86967d35f60d660ec9dc
      
https://github.com/qemu/qemu/commit/96cd59981805b2d0addb86967d35f60d660ec9dc
  Author: Stefan Hajnoczi <address@hidden>
  Date:   2017-05-16 (Tue, 16 May 2017)

  Changed paths:
    M hw/9pfs/9p-local.c

  Log Message:
  -----------
  Merge remote-tracking branch 'gkurz/tags/security-fix-for-2.10' into staging

Fix for CVE-2017-7493.

# gpg: Signature made Mon 15 May 2017 07:48:20 PM BST
# gpg:                using DSA key 0x02FC3AEB0101DBC2
# gpg: Good signature from "Greg Kurz <address@hidden>"
# gpg:                 aka "Greg Kurz <address@hidden>"
# gpg:                 aka "Greg Kurz <address@hidden>"
# gpg:                 aka "Greg Kurz <address@hidden>"
# gpg:                 aka "Gregory Kurz (Groug) <address@hidden>"
# gpg:                 aka "Gregory Kurz (Cimai Technology) <address@hidden>"
# gpg:                 aka "Gregory Kurz (Meiosys Technology) <address@hidden>"
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: 2BD4 3B44 535E C0A7 9894  DBA2 02FC 3AEB 0101 DBC2

* gkurz/tags/security-fix-for-2.10:
  9pfs: local: forbid client access to metadata (CVE-2017-7493)

Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 3c2bdbc1e402fa88b80fcbba7f45cd778443e5c2
      
https://github.com/qemu/qemu/commit/3c2bdbc1e402fa88b80fcbba7f45cd778443e5c2
  Author: Kamil Rytarowski <address@hidden>
  Date:   2017-05-16 (Tue, 16 May 2017)

  Changed paths:
    M MAINTAINERS
    M configure

  Log Message:
  -----------
  maintainers: Add myself as a NetBSD reviewer

I volunteer to review NetBSD patches.
Adding myself will help to not miss some of them.

Restore NetBSD as a maintained host.

All patches to make qemu/pkgsrc building have been emitted to review.

Signed-off-by: Kamil Rytarowski <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: 612fc05ad210abfba656f2da89120041039c0b57
      
https://github.com/qemu/qemu/commit/612fc05ad210abfba656f2da89120041039c0b57
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-16 (Tue, 16 May 2017)

  Changed paths:
    M crypto/random-platform.c

  Log Message:
  -----------
  fix mingw build failure

Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Stefan Weil <address@hidden>
Reviewed-by: Daniel P. Berrange <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>


  Commit: cdece0467c00007cf8e3f4b3c3f0b13bf2c4fea9
      
https://github.com/qemu/qemu/commit/cdece0467c00007cf8e3f4b3c3f0b13bf2c4fea9
  Author: Gerd Hoffmann <address@hidden>
  Date:   2017-05-16 (Tue, 16 May 2017)

  Changed paths:
    M block/file-win32.c

  Log Message:
  -----------
  block/win32: fix 'ret not initialized' warning

Signed-off-by: Gerd Hoffmann <address@hidden>
Reviewed-by: Stefan Weil <address@hidden>
Reviewed-by: Fam Zheng <address@hidden>
Message-id: address@hidden
Signed-off-by: Stefan Hajnoczi <address@hidden>


Compare: https://github.com/qemu/qemu/compare/3a8760664d5c...cdece0467c00

reply via email to

[Prev in Thread] Current Thread [Next in Thread]