qemu-commits
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 544203: pc: comment style fixup


From: Peter Maydell
Subject: [Qemu-commits] [qemu/qemu] 544203: pc: comment style fixup
Date: Fri, 13 Nov 2020 04:00:22 -0800

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 54420332b595d4563d9c0e417d796baecd2debfa
      
https://github.com/qemu/qemu/commit/54420332b595d4563d9c0e417d796baecd2debfa
  Author: Michael S. Tsirkin <mst@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/i386/pc.c

  Log Message:
  -----------
  pc: comment style fixup

Fix up checkpatch comment style warnings.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Chen Qun <kuhn.chenqun@huawei.com>


  Commit: d31992ae131527b63284d406d5dac21b02d4f3ef
      
https://github.com/qemu/qemu/commit/d31992ae131527b63284d406d5dac21b02d4f3ef
  Author: David Hildenbrand <david@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-mem.c

  Log Message:
  -----------
  virtio-mem: Make sure "addr" is always multiples of the block size

The spec states:
  "The device MUST set addr, region_size, usable_region_size, plugged_size,
   requested_size to multiples of block_size."

In some cases, we currently don't guarantee that for "addr": For example,
when starting a VM with 4 GiB boot memory and a virtio-mem device with a
block size of 2 GiB, "memaddr"/"addr" will be auto-assigned to
0x140000000 (5 GiB).

We'll try to improve auto-assignment for memory devices next, to avoid
bailing out in case memory device code selects a bad address.

Note: The Linux driver doesn't support such big block sizes yet.

Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Fixes: 910b25766b33 ("virtio-mem: Paravirtualized memory hot(un)plug")
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20201008083029.9504-2-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 0aed28006114b17d64a8491071d382f4c8a83e41
      
https://github.com/qemu/qemu/commit/0aed28006114b17d64a8491071d382f4c8a83e41
  Author: David Hildenbrand <david@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-mem.c

  Log Message:
  -----------
  virtio-mem: Make sure "usable_region_size" is always multiples of the block 
size

The spec states:
  "The device MUST set addr, region_size, usable_region_size, plugged_size,
   requested_size to multiples of block_size."

With block sizes > 256MB, we currently wouldn't guarantee that for the
usable_region_size.

Note that we cannot exceed the region_size, as we already enforce the
alignment there properly.

Fixes: 910b25766b33 ("virtio-mem: Paravirtualized memory hot(un)plug")
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20201008083029.9504-3-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 228957fea3a998735524abf6354634f1fb710e61
      
https://github.com/qemu/qemu/commit/228957fea3a998735524abf6354634f1fb710e61
  Author: David Hildenbrand <david@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-mem.c

  Log Message:
  -----------
  virtio-mem: Probe THP size to determine default block size

Let's allow a minimum block size of 1 MiB in all configurations. Select
the default block size based on
- The page size of the memory backend.
- The THP size if the memory backend size corresponds to the real host
  page size.
- The global minimum of 1 MiB.
and warn if something smaller is configured by the user.

VIRTIO_MEM only supports Linux (depends on LINUX), so we can probe the
THP size unconditionally.

For now we only support virtio-mem on x86-64 - there isn't a user-visible
change (x86-64 only supports 2 MiB THP on the PMD level) - the default
was, and will be 2 MiB.

If we ever have THP on the PUD level (e.g., 1 GiB THP on x86-64), we
expect it to be more transparent - e.g., to only optimize fully populated
ranges unless explicitly told /configured otherwise (in contrast to PMD
THP).

Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20201008083029.9504-4-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 780a4d24e73dd0a7c7fc3f6f8b104aab70b7bfff
      
https://github.com/qemu/qemu/commit/780a4d24e73dd0a7c7fc3f6f8b104aab70b7bfff
  Author: David Hildenbrand <david@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/mem/memory-device.c

  Log Message:
  -----------
  memory-device: Support big alignment requirements

Let's warn instead of bailing out - the worst thing that can happen is
that we'll fail hot/coldplug later. The user got warned, and this should
be rare.

This will be necessary for memory devices with rather big (user-defined)
alignment requirements - say a virtio-mem device with a 2G block size -
which will become important, for example, when supporting vfio in the
future.

Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20201008083029.9504-5-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: c726aa69419ba2ecd38ae14dc62aaa189c3510e5
      
https://github.com/qemu/qemu/commit/c726aa69419ba2ecd38ae14dc62aaa189c3510e5
  Author: David Hildenbrand <david@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/mem/memory-device.c
    M include/hw/mem/memory-device.h

  Log Message:
  -----------
  memory-device: Add get_min_alignment() callback

Add a callback that can be used to express additional alignment
requirements (exceeding the ones from the memory region).

Will be used by virtio-mem to express special alignment requirements due
to manually configured, big block sizes (e.g., 1GB with an ordinary
memory-backend-ram). This avoids failing later when realizing, because
auto-detection wasn't able to assign a properly aligned address.

Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20201008083029.9504-6-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 296e88fd9f407c1ca5d749b921e12407e7f9da1d
      
https://github.com/qemu/qemu/commit/296e88fd9f407c1ca5d749b921e12407e7f9da1d
  Author: David Hildenbrand <david@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-mem-pci.c

  Log Message:
  -----------
  virito-mem: Implement get_min_alignment()

The block size determines the alignment requirements. Implement
get_min_alignment() of the TYPE_MEMORY_DEVICE interface.

This allows auto-assignment of a properly aligned address in guest
physical address space. For example, when specifying a 2GB block size
for a virtio-mem device with 10GB with a memory setup "-m 4G, 20G",
we'll no longer fail when realizing.

Reviewed-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Wei Yang <richardw.yang@linux.intel.com>
Cc: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: Igor Mammedov <imammedo@redhat.com>
Cc: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Message-Id: <20201008083029.9504-7-david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 88eed1989619b4059d225c593f6c59860e0271c8
      
https://github.com/qemu/qemu/commit/88eed1989619b4059d225c593f6c59860e0271c8
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/acpi/nvdimm.c

  Log Message:
  -----------
  hw/acpi : Don't use '#' flag of printf format

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-Id: <20201103102634.273021-1-zhangxinhao1@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 4cbf31a8fef91648995f3f576f7ede661b3e0c18
      
https://github.com/qemu/qemu/commit/4cbf31a8fef91648995f3f576f7ede661b3e0c18
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/acpi/core.c

  Log Message:
  -----------
  hw/acpi : add space before the open parenthesis '('

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-Id: <20201103102634.273021-2-zhangxinhao1@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 510feed79a364521df41508ced6498ebf30728cd
      
https://github.com/qemu/qemu/commit/510feed79a364521df41508ced6498ebf30728cd
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/acpi/pcihp.c

  Log Message:
  -----------
  hw/acpi : add spaces around operator

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-Id: <20201103102634.273021-3-zhangxinhao1@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 8faf2f1de40e2fb919d8f584478d407a2fa7c80a
      
https://github.com/qemu/qemu/commit/8faf2f1de40e2fb919d8f584478d407a2fa7c80a
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/vhost-backend.c

  Log Message:
  -----------
  hw/virtio/vhost-backend: Fix Coverity CID 1432871

Fix uninitialized value issues reported by Coverity:

  Field 'msg.reserved' is uninitialized when calling write().

While the 'struct vhost_msg' does not have a 'reserved' field,
we still initialize it to have the two parts of the function
consistent.

Reported-by: Coverity (CID 1432864: UNINIT)
Fixes: c471ad0e9bd ("vhost_net: device IOTLB support")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201103063541.2463363-1-philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 8055d2fb7f4717c6aa7c4ca801a487153945a15d
      
https://github.com/qemu/qemu/commit/8055d2fb7f4717c6aa7c4ca801a487153945a15d
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/smbios/smbios.c

  Log Message:
  -----------
  hw/smbios: Fix leaked fd in save_opt_one() error path

Fix the following Coverity issue (RESOURCE_LEAK):

  CID 1432879: Resource leak

    Handle variable fd going out of scope leaks the handle.

Replace a close() call by qemu_close() since the handle is
opened with qemu_open().

Fixes: bb99f4772f5 ("hw/smbios: support loading OEM strings values from a file")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201030152742.1553968-1-philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: bfe7a961737452ae8e616df758406e86ac289972
      
https://github.com/qemu/qemu/commit/bfe7a961737452ae8e616df758406e86ac289972
  Author: Jean-Philippe Brucker <jean-philippe@linaro.org>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Fix virtio_iommu_mr()

Due to an invalid mask, virtio_iommu_mr() may return the wrong memory
region. It hasn't been too problematic so far because the function was
only used to test existence of an endpoint, but that is about to change.

Fixes: cfb42188b24d ("virtio-iommu: Implement attach/detach command")
Cc: QEMU Stable <qemu-stable@nongnu.org>
Acked-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-2-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 31aa323fb97bae3786f5bce5a88668f76fdb0cec
      
https://github.com/qemu/qemu/commit/31aa323fb97bae3786f5bce5a88668f76fdb0cec
  Author: Jean-Philippe Brucker <jean-philippe@linaro.org>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Store memory region in endpoint struct

Store the memory region associated to each endpoint into the endpoint
structure, to allow efficient memory notification on map/unmap.

Acked-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-3-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 15e4c8f01b7f06b9dde13bc13949c834b25160f3
      
https://github.com/qemu/qemu/commit/15e4c8f01b7f06b9dde13bc13949c834b25160f3
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/trace-events
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Add memory notifiers for map/unmap

Extend VIRTIO_IOMMU_T_MAP/UNMAP request to notify memory listeners. It
will call VFIO notifier to map/unmap regions in the physical IOMMU.

Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-4-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 2f6eeb5f0bb1efea09510b9481e2ff82fe69b440
      
https://github.com/qemu/qemu/commit/2f6eeb5f0bb1efea09510b9481e2ff82fe69b440
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Call memory notifiers in attach/detach

Call the memory notifiers when attaching an endpoint to a domain, to
replay existing mappings, and when detaching the endpoint, to remove all
mappings.

Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-5-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 308e5e1b5f811aa28063006088ff276a63a034d3
      
https://github.com/qemu/qemu/commit/308e5e1b5f811aa28063006088ff276a63a034d3
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/trace-events
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Add replay() memory region callback

Implement the replay callback to setup all mappings for a new memory
region.

Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-6-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 6978bfaa688df55dc9ea581fe32b226f81aebc3a
      
https://github.com/qemu/qemu/commit/6978bfaa688df55dc9ea581fe32b226f81aebc3a
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/trace-events
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Add notify_flag_changed() memory region callback

Add notify_flag_changed() to notice when memory listeners are added and
removed.

Acked-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-7-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 457f8cbbd80f631cee02057c3c844a43ca65b5c4
      
https://github.com/qemu/qemu/commit/457f8cbbd80f631cee02057c3c844a43ca65b5c4
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M include/exec/memory.h
    M softmmu/memory.c

  Log Message:
  -----------
  memory: Add interface to set iommu page size mask

Allow to set the page size mask supported by an iommu memory region.
This enables a vIOMMU to communicate the page size granule supported by
an assigned device, on hosts that use page sizes greater than 4kB.

Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-8-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: b917749842493abdfa49f5265ea236c922c05cb2
      
https://github.com/qemu/qemu/commit/b917749842493abdfa49f5265ea236c922c05cb2
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/vfio/common.c

  Log Message:
  -----------
  vfio: Set IOMMU page size as per host supported page size

Set IOMMU supported page size mask same as host Linux supported page
size mask.

Acked-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-9-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 5c3cfe33f4185841feaedd07bea1d6d7e02011a0
      
https://github.com/qemu/qemu/commit/5c3cfe33f4185841feaedd07bea1d6d7e02011a0
  Author: Bharat Bhushan <bbhushan2@marvell.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/virtio/trace-events
    M hw/virtio/virtio-iommu.c

  Log Message:
  -----------
  virtio-iommu: Set supported page size mask

The virtio-iommu device can deal with arbitrary page sizes for virtual
endpoints, but for endpoints assigned with VFIO it must follow the page
granule used by the host IOMMU driver.

Implement the interface to set the vIOMMU page size mask, called by VFIO
for each endpoint. We assume that all host IOMMU drivers use the same
page granule (the host page granule). Override the page_size_mask field
in the virtio config space.

Signed-off-by: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-10-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 090afdc5e61e80de4ac158fa4cb2a578ee69be54
      
https://github.com/qemu/qemu/commit/090afdc5e61e80de4ac158fa4cb2a578ee69be54
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M include/qemu/cutils.h
    M util/cutils.c

  Log Message:
  -----------
  cutils: replace strdup with g_strdup

Memory returned by get_relocated_path must be freed with
free or g_free depending on the path that the function
took; Coverity takes exception to this practice.  The
fix lets caller use g_free as is standard in QEMU.

While at it, mention the requirements on the caller in
the doc comment.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 2eba427eb1e9057ee6bd2b4e6c4c78cda3534bfe
      
https://github.com/qemu/qemu/commit/2eba427eb1e9057ee6bd2b4e6c4c78cda3534bfe
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M docs/devel/build-system.rst
    M docs/devel/kconfig.rst

  Log Message:
  -----------
  docs: expand sourceset documentation

Expand on the usage of sourcesets and describe the CONFIG_ALL
symbol.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 379218511219feddb85fde6362c0eefd94dd4828
      
https://github.com/qemu/qemu/commit/379218511219feddb85fde6362c0eefd94dd4828
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M softmmu/physmem.c

  Log Message:
  -----------
  exec: Remove dead code (CID 1432876)

We removed the global_locking field in commit 4174495408a,
leaving dead code around the 'unlocked' variable. Remove it
to fix the DEADCODE issue reported by Coverity (CID 1432876).

Fixes: 4174495408a ("exec: Remove MemoryRegion::global_locking field")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201030153752.1557776-1-philmd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: f8b8f3746327d577cdd25d6f86bd993178aece58
      
https://github.com/qemu/qemu/commit/f8b8f3746327d577cdd25d6f86bd993178aece58
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M scripts/oss-fuzz/build.sh

  Log Message:
  -----------
  scripts/oss-fuzz: rename bin/qemu-fuzz-i386

OSS-Fuzz changed the way it scans for fuzzers in $DEST_DIR. The new code
also scans subdirectories for fuzzers. This means that OSS-Fuzz is
considering bin/qemu-fuzz-i386 as an independent fuzzer (it is not - it
requires a --fuzz-target argument). This has led to coverage-build
failures and false crash reports. To work around this, we take advantage
of OSS-Fuzz' filename extension check - OSS-Fuzz will not run anything
that has an extension that is not ".exe":
https://github.com/google/oss-fuzz/blob/master/infra/utils.py#L115

Reported-by: OSS-Fuzz (Issue 26725)
Reported-by: OSS-Fuzz (Issue 26679)
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201101212245.185819-1-alxndr@bu.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 4177b062fc58dd250667415e487618ac59393d04
      
https://github.com/qemu/qemu/commit/4177b062fc58dd250667415e487618ac59393d04
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/isa/lpc_ich9.c
    M include/hw/i386/ich9.h

  Log Message:
  -----------
  hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ

libFuzzer triggered the following assertion:

  cat << EOF | qemu-system-i386 -M pc-q35-5.0 \
    -nographic -monitor none -serial none \
    -qtest stdio -d guest_errors -trace pci\*
  outl 0xcf8 0x8400f841
  outl 0xcfc 0xebed205d
  outl 0x5d02 0xedf82049
  EOF
  pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d
  hw/pci/pci.c:268: int pci_bus_get_irq_level(PCIBus *, int): Assertion 
`irq_num < bus->nirq' failed.

This is because ich9_lpc_sci_irq() returns -1 for reserved
(illegal) values, but ich9_lpc_pmbase_sci_update() considers
it valid and store it in a 8-bit unsigned type. Then the 255
value is used as GSI IRQ, resulting in a PIRQ value of 247,
more than ICH9_LPC_NB_PIRQS (8).

Fix by simply ignoring the invalid access (and reporting it):

  pci_cfg_write ICH9-LPC 31:0 @0x41 <- 0xebed205d
  ICH9 LPC: SCI IRQ SEL #3 is reserved
  pci_cfg_read mch 00:0 @0x0 -> 0x8086
  pci_cfg_read mch 00:0 @0x0 -> 0x29c08086
  ...

Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: 8f242cb724 ("ich9: implement SCI_IRQ_SEL register")
BugLink: https://bugs.launchpad.net/qemu/+bug/1878642
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20200717151705.18611-1-f4bug@amsat.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: fd250172842b3bbd4213242eb83bd5fa989f7381
      
https://github.com/qemu/qemu/commit/fd250172842b3bbd4213242eb83bd5fa989f7381
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz-test.c

  Log Message:
  -----------
  qtest: add a reproducer for LP#1878642

https://bugs.launchpad.net/qemu/+bug/1878642

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201102163336.115444-1-alxndr@bu.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: a5cb7c5afe717d42ae8845cd4b8805ea17b3f64d
      
https://github.com/qemu/qemu/commit/a5cb7c5afe717d42ae8845cd4b8805ea17b3f64d
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M configure
    M meson.build

  Log Message:
  -----------
  meson: use b_staticpic=false for meson >=0.56.0

Meson 0.56.0 correctly builds non-PIC static libraries with -fPIE if
b_pie=true.  We do not have to pass b_staticpic=true if PIE is requested
if Meson is new-enough, which improves performance.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: cd57deabad8f60a6b0d135318810909bc0b7a93f
      
https://github.com/qemu/qemu/commit/cd57deabad8f60a6b0d135318810909bc0b7a93f
  Author: Marc Hartmayer <mhartmay@linux.ibm.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M contrib/vhost-user-gpu/meson.build
    M tools/virtiofsd/meson.build

  Log Message:
  -----------
  meson: vhost-user-gpu/virtiofsd: use absolute path

The option `libexecdir` is relative to `prefix` (see
https://mesonbuild.com/Builtin-options.html), so we have to be aware
of this when creating 50-qemu-gpu.json and
50-qemu-virtiofsd.json. Otherwise, tools like libvirt will not be able
to find the executable.

Fixes: 16bf7a3326d8 ("configure: move directory options from config-host.mak to 
meson")
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Message-Id: <20201103112333.24734-1-mhartmay@linux.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 1d72d9c4874f61c38df9a473e2fd4de869ba0b11
      
https://github.com/qemu/qemu/commit/1d72d9c4874f61c38df9a473e2fd4de869ba0b11
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/libqtest.c

  Log Message:
  -----------
  tests/qtest/libqtest.c: Check for setsockopt() failure

In socket_accept() we use setsockopt() to set SO_RCVTIMEO,
but we don't check the return value for failure. Do so.

Fixes: Coverity CID 1432321
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20201103115112.19211-1-peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 0250edf1eb4ff0b164c0cdabcbf4313507f3082e
      
https://github.com/qemu/qemu/commit/0250edf1eb4ff0b164c0cdabcbf4313507f3082e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/libqos/ahci.c

  Log Message:
  -----------
  tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_exec()

In ahci_exec() we attempt to permit the caller to pass a NULL pointer
for opts_in (in which case we use a default set of options).  However
although we check for NULL when setting up the opts variable at the
top of the function, we unconditionally dereference opts_in at the
end of the function as part of freeing the opts->buffer.

Switch to checking whether the final buffer is the same as the
buffer we started with, instead of assuming the value we started
with is always opts_in->buffer.

At the moment all the callers pass a non-NULL opts argument, so
we never saw any crashes in practice.

Fixes: Coverity CID 1432302
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20201103115257.23623-1-peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: af2c0e854bd2b93a61f2d7111822154ccccd86c9
      
https://github.com/qemu/qemu/commit/af2c0e854bd2b93a61f2d7111822154ccccd86c9
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M docs/meson.build

  Log Message:
  -----------
  meson: fix warning for bad sphinx-build

The warning was printing an empty string if the bad sphinx-build
was not passed on the command line.  Instead, always use the
path that was returned by find_program.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 3569a5dfc11f2c4880b7cddd9e0091b29aa0e015
      
https://github.com/qemu/qemu/commit/3569a5dfc11f2c4880b7cddd9e0091b29aa0e015
  Author: Bruce Rogers <brogers@suse.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: fix gio_libs reference

The gio library detection code no longer works, due to a missing $ in
front of the gio_libs reference. Make the string be $gio_libs.

Fixes: 76346b6264a ("configure: Test that gio libs from pkg-config
work")

Signed-off-by: Bruce Rogers <brogers@suse.com>
Message-Id: <20201103145121.668865-1-brogers@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: c59c582d56ee3bbde15e6788c0d28329792b2573
      
https://github.com/qemu/qemu/commit/c59c582d56ee3bbde15e6788c0d28329792b2573
  Author: AlexChen <alex.chen@huawei.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz/qos_fuzz.c

  Log Message:
  -----------
  tests/qtest: Fix potential NULL pointer dereference in qos_build_main_args()

In qos_build_main_args(), the pointer 'path' is dereferenced before
checking it is valid, which may lead to NULL pointer dereference.
So move the assignment to 'cmd_line' after checking 'path' is valid.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-Id: <5FA16ED5.4000203@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: a9f67c1d51dda405bc6a406d13c8802b98df904e
      
https://github.com/qemu/qemu/commit/a9f67c1d51dda405bc6a406d13c8802b98df904e
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz/generic_fuzz.c

  Log Message:
  -----------
  fuzz: fix writing DMA patterns

This code had all sorts of issues. We used a loop similar to
address_space_write_rom, but I did not remove a "break" that only made
sense in the context of the switch statement in the original code. Then,
after the loop, we did a separate qtest_memwrite over the entire DMA
access range, defeating the purpose of the loop. Additionally, we
increment the buf pointer, and then try to g_free() it. Fix these
problems.

Reported-by: OSS-Fuzz (Issue 26725)
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: OSS-Fuzz (Issue 26691)
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20201029172901.534442-2-alxndr@bu.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: cc3d99c7418925b9f252482d67055e7c3f2c4814
      
https://github.com/qemu/qemu/commit/cc3d99c7418925b9f252482d67055e7c3f2c4814
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz/generic_fuzz.c

  Log Message:
  -----------
  fuzz: check the MR in the DMA callback

We should be checking that the device is trying to read from RAM, before
filling the region with data. Otherwise, we will try to populate
nonsensical addresses in RAM for callbacks on PIO/MMIO reads. We did
this originally, however the final version I sent had the line commented
out..

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20201029172901.534442-3-alxndr@bu.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 953e6d7c0e94126dbfdb63ba1546e6b74ed9ccee
      
https://github.com/qemu/qemu/commit/953e6d7c0e94126dbfdb63ba1546e6b74ed9ccee
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz/generic_fuzz.c

  Log Message:
  -----------
  fuzz: fuzz offsets within pio/mmio regions

The code did not add offsets to FlatRange bases, so we did not fuzz
offsets within device MemoryRegions.

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20201029172901.534442-4-alxndr@bu.edu>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: e19c520fe6545230bf37c2458c6d97ed18cd0c4f
      
https://github.com/qemu/qemu/commit/e19c520fe6545230bf37c2458c6d97ed18cd0c4f
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M softmmu/vl.c

  Log Message:
  -----------
  semihosting: fix order of initialization functions

qemu_semihosting_console_init uses semihosting.chardev which is set
by qemu_semihosting_connect_chardevs.  Thus qemu_semihosting_connect_chardevs
has to be called first.

Both have to be called after processing -serial and friends though, so
that the semihosting console can connect to a multiplexer as in
"-serial mon:stdio -semihosting-config chardev=serial0"

Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Fixes: 619985e937 ("semihosting: defer connect_chardevs a little more to use 
serialx", 2020-07-27)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 1b296c3def4b9b63d2fdbce6646edd108a3e616c
      
https://github.com/qemu/qemu/commit/1b296c3def4b9b63d2fdbce6646edd108a3e616c
  Author: Jean-Philippe Brucker <jean-philippe@linaro.org>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/vfio/common.c

  Log Message:
  -----------
  vfio: Don't issue full 2^64 unmap

IOMMUs may declare memory regions spanning from 0 to UINT64_MAX. When
attempting to deal with such region, vfio_listener_region_del() passes a
size of 2^64 to int128_get64() which throws an assertion failure.  Even
ignoring this, the VFIO_IOMMU_DMA_MAP ioctl cannot handle this size
since the size field is 64-bit. Split the request in two.

Acked-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-Id: <20201030180510.747225-11-jean-philippe@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 57b3a7d81bd7b5fb846ab5c05597a853259a1853
      
https://github.com/qemu/qemu/commit/57b3a7d81bd7b5fb846ab5c05597a853259a1853
  Author: Cindy Lu <lulu@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M net/vhost-vdpa.c

  Log Message:
  -----------
  vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup

fix the bug that fd will still open after the cleanup

Signed-off-by: Cindy Lu <lulu@redhat.com>
Message-Id: <20201016030909.9522-1-lulu@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 1bc211a166be2c98f98852124b6fdb61e0b0be32
      
https://github.com/qemu/qemu/commit/1bc211a166be2c98f98852124b6fdb61e0b0be32
  Author: Cindy Lu <lulu@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M net/net.c

  Log Message:
  -----------
  net: Add vhost-vdpa in show_netdevs()

Fix the bug that while Check qemu supported netdev,
there is no vhost-vdpa

Signed-off-by: Cindy Lu <lulu@redhat.com>
Message-Id: <20201016030909.9522-2-lulu@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: b7c1bd9d78480481455678602c9a8505cc8adadd
      
https://github.com/qemu/qemu/commit/b7c1bd9d78480481455678602c9a8505cc8adadd
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/block/vhost-user-blk.c
    M hw/virtio/vhost.c
    M include/hw/virtio/vhost.h

  Log Message:
  -----------
  Revert "vhost-blk: set features before setting inflight feature"

This reverts commit adb29c027341ba095a3ef4beef6aaef86d3a520e.

The commit broke -device vhost-user-blk-pci because the
vhost_dev_prepare_inflight() function it introduced segfaults in
vhost_dev_set_features() when attempting to access struct vhost_dev's
vdev pointer before it has been assigned.

To reproduce the segfault simply launch a vhost-user-blk device with the
contrib vhost-user-blk device backend:

  $ build/contrib/vhost-user-blk/vhost-user-blk -s /tmp/vhost-user-blk.sock -r 
-b /var/tmp/foo.img
  $ build/qemu-system-x86_64 \
        -device vhost-user-blk-pci,id=drv0,chardev=char1,addr=4.0 \
        -object memory-backend-memfd,id=mem,size=1G,share=on \
        -M memory-backend=mem,accel=kvm \
        -chardev socket,id=char1,path=/tmp/vhost-user-blk.sock
  Segmentation fault (core dumped)

Cc: Jin Yu <jin.yu@intel.com>
Cc: Raphael Norwitz <raphael.norwitz@nutanix.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201102165709.232180-1-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 1b0063b3048af65dfaae6422a572c87db8575a92
      
https://github.com/qemu/qemu/commit/1b0063b3048af65dfaae6422a572c87db8575a92
  Author: Jin Yu <jin.yu@intel.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M hw/block/vhost-user-blk.c
    M hw/virtio/vhost.c
    M include/hw/virtio/vhost.h

  Log Message:
  -----------
  vhost-blk: set features before setting inflight feature

Virtqueue has split and packed, so before setting inflight,
you need to inform the back-end virtqueue format.

Signed-off-by: Jin Yu <jin.yu@intel.com>
Acked-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Message-Id: <20201103123617.28256-1-jin.yu@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: de65d4978571769eae98e4d757b23dcd03313ba2
      
https://github.com/qemu/qemu/commit/de65d4978571769eae98e4d757b23dcd03313ba2
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M contrib/libvhost-user/libvhost-user.h

  Log Message:
  -----------
  libvhost-user: follow QEMU comment style

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-2-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: bc15e44cb2191bbb2318878acdf5038134e56394
      
https://github.com/qemu/qemu/commit/bc15e44cb2191bbb2318878acdf5038134e56394
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M block/export/export.c
    M block/export/meson.build
    M configure
    M util/meson.build

  Log Message:
  -----------
  configure: introduce --enable-vhost-user-blk-server

Make it possible to compile out the vhost-user-blk server. It is enabled
by default on Linux.

Note that vhost-user-server.c depends on libvhost-user, which requires
CONFIG_LINUX. The CONFIG_VHOST_USER dependency was erroneous since that
option controls vhost-user frontends (previously known as "master") and
not device backends (previously known as "slave").

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-3-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 11f60f7eaee2630dd6fa0c3a8c49f792e46c4cf1
      
https://github.com/qemu/qemu/commit/11f60f7eaee2630dd6fa0c3a8c49f792e46c4cf1
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M block/export/vhost-user-blk-server.c

  Log Message:
  -----------
  block/export: make vhost-user-blk config space little-endian

VIRTIO 1.0 devices have little-endian configuration space. The
vhost-user-blk-server.c code already uses little-endian for virtqueue
processing but not for the configuration space fields. Fix this so the
vhost-user-blk export works on big-endian hosts.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-4-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: f8ffcb2bda22bad8e91da70c28ec52724a054f92
      
https://github.com/qemu/qemu/commit/f8ffcb2bda22bad8e91da70c28ec52724a054f92
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M block/export/vhost-user-blk-server.c

  Log Message:
  -----------
  block/export: fix vhost-user-blk get_config() information leak

Refuse get_config() requests in excess of sizeof(struct virtio_blk_config).

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-5-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 9f6df01d0e128c2df179789b37140d6aeddfcb92
      
https://github.com/qemu/qemu/commit/9f6df01d0e128c2df179789b37140d6aeddfcb92
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-03 (Tue, 03 Nov 2020)

  Changed paths:
    M contrib/vhost-user-blk/vhost-user-blk.c

  Log Message:
  -----------
  contrib/vhost-user-blk: fix get_config() information leak

Refuse get_config() in excess of sizeof(struct virtio_blk_config).

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201027173528.213464-6-stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>


  Commit: 2ddafce7f797082ad216657c830afd4546f16e37
      
https://github.com/qemu/qemu/commit/2ddafce7f797082ad216657c830afd4546f16e37
  Author: Ding Hui <dinghui@sangfor.com.cn>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M ui/vnc-auth-sasl.c
    M ui/vnc-auth-vencrypt.c
    M ui/vnc-jobs.c
    M ui/vnc-ws.c
    M ui/vnc.c

  Log Message:
  -----------
  vnc: fix resource leak when websocket channel error

When we connect to vnc by websocket channel, and disconnect
(maybe by some network exception) before handshake,
qemu will left CLOSE_WAIT socket and never close it

After 04d2529da2 ("ui: convert VNC server to use QIOChannelSocket")
and dd154c4d9f ("io: fix handling of EOF / error conditions in websock 
GSource"),
the vnc call qio_channel_add_watch only care about G_IO_IN,
but mising G_IO_HUP and G_IO_ERR.
When the websocket channel get EOF or error, it cannot callback,
because the caller ignore the event, that leads to resource leak

We need handle G_IO_HUP and G_IO_ERR event, then cleanup the channel

Fixes: 04d2529da2 ("ui: convert VNC server to use QIOChannelSocket")
Fixes: dd154c4d9f ("io: fix handling of EOF / error conditions in websock 
GSource")
Cc: qemu-stable@nongnu.org
Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
Message-id: 20201029032241.11040-1-dinghui@sangfor.com.cn
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>


  Commit: ca1f9cbfdce4d63b10d57de80fef89a89d92a540
      
https://github.com/qemu/qemu/commit/ca1f9cbfdce4d63b10d57de80fef89a89d92a540
  Author: Prasad J Pandit <pjp@fedoraproject.org>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M hw/display/ati_2d.c

  Log Message:
  -----------
  ati: check x y display parameter values

The source and destination x,y display parameters in ati_2d_blt()
may run off the vga limits if either of s->regs.[src|dst]_[xy] is
zero. Check the parameter values to avoid potential crash.

Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20201021103818.1704030-1-ppandit@redhat.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>


  Commit: 577b808b0974fa4af53131cdfece6e9de3c6e4fd
      
https://github.com/qemu/qemu/commit/577b808b0974fa4af53131cdfece6e9de3c6e4fd
  Author: Bruce Rogers <brogers@suse.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M roms/Makefile

  Log Message:
  -----------
  roms/Makefile: Add qboot to .PHONY list

Adding qboot to the .PHONY directive will allow a
make -C roms qboot invocation to work as expected

Signed-off-by: Bruce Rogers <brogers@suse.com>
Message-id: 20201020152512.837769-1-brogers@suse.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>


  Commit: 872882e771cf0873f5e8e78ea7333367a3f87d8b
      
https://github.com/qemu/qemu/commit/872882e771cf0873f5e8e78ea7333367a3f87d8b
  Author: Jason J. Herne <jjherne@linux.ibm.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M pc-bios/s390-ccw/main.c

  Log Message:
  -----------
  s390-bios: Skip writing iplb location to low core for ccw ipl

The architecture states that the iplb location is only written to low
core for list directed ipl and not for traditional ccw ipl. If we don't
skip this then operating systems that load by reading into low core
memory may fail to start.

We should also not write the iplb pointer for network boot as it might
overwrite content that we got via network.

Fixes: 9bfc04f9ef68 ("pc-bios: s390x: Save iplb location in lowcore")
Signed-off-by: Jason J. Herne <jjherne@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20201030122823.347140-1-borntraeger@de.ibm.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>


  Commit: 5e592947de2d12f6696ccea0472b833ecaffc204
      
https://github.com/qemu/qemu/commit/5e592947de2d12f6696ccea0472b833ecaffc204
  Author: Cornelia Huck <cohuck@redhat.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M pc-bios/s390-ccw.img
    M pc-bios/s390-netboot.img

  Log Message:
  -----------
  pc-bios/s390: update s390-ccw bios binaries

Contains "s390-bios: Skip writing iplb location to low core for ccw ipl".

Signed-off-by: Cornelia Huck <cohuck@redhat.com>


  Commit: 794b95608f8d92189baba697a7d6072e94ed2e0e
      
https://github.com/qemu/qemu/commit/794b95608f8d92189baba697a7d6072e94ed2e0e
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M tests/qtest/ivshmem-test.c

  Log Message:
  -----------
  ivshmem-test: do not use short-form boolean option

This QemuOpts idiom will be deprecated, so get rid of it in the tests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: e27bd4987699df5f49a03e93cf57941abeb82938
      
https://github.com/qemu/qemu/commit/e27bd4987699df5f49a03e93cf57941abeb82938
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M tests/qtest/device-introspect-test.c

  Log Message:
  -----------
  qtest: escape device name in device-introspect-test

device-introspect-test uses HMP, so it should escape the device name
properly.  Because of this, a few devices that had commas in their
names were escaping testing.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 372bcb2585cd2f06a01f13b1a208370ccf7479cf
      
https://github.com/qemu/qemu/commit/372bcb2585cd2f06a01f13b1a208370ccf7479cf
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M include/qapi/util.h
    M qapi/opts-visitor.c
    M qapi/qapi-util.c
    M qapi/qobject-input-visitor.c
    M qapi/string-input-visitor.c
    M util/qemu-option.c

  Log Message:
  -----------
  qapi, qemu-options: make all parsing visitors parse boolean options the same

OptsVisitor, StringInputVisitor and the keyval visitor have
three different ideas of how a human could write the value of
a boolean option.  Pay homage to the backwards-compatibility
gods and make the new common helper accept all four sets (on/off,
true/false, y/n and yes/no), but remove case-insensitivity.

Since OptsVisitor is supposed to match qemu-options, adjust
it as well.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201103161339.447118-1-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: f14bed3fd4a17e1255e2ed6db1dfe50e654e601d
      
https://github.com/qemu/qemu/commit/f14bed3fd4a17e1255e2ed6db1dfe50e654e601d
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M tcg/tcg.c

  Log Message:
  -----------
  tcg: Remove assert from set_jmp_reset_offset

Since 6e6c4efed99, there has been a more appropriate range check
done later at the end of tcg_gen_code.  There, a failing range
check results in a returned error code, which causes the TB to
be restarted at half the size.

Reported-by: Sai Pavan Boddu <saipava@xilinx.com>
Tested-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: c56caea3b2a4ef5d760266f554df0d92c5a45f87
      
https://github.com/qemu/qemu/commit/c56caea3b2a4ef5d760266f554df0d92c5a45f87
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M tcg/optimize.c

  Log Message:
  -----------
  tcg: Revert "tcg/optimize: Flush data at labels not TCG_OPF_BB_END"

This reverts commit cd0372c515c4732d8bd3777cdd995c139c7ed7ea.

The patch is incorrect in that it retains copies between globals and
non-local temps, and non-local temps still die at the end of the BB.

Failing test case for hppa:

        .globl  _start
_start:
        cmpiclr,=       0x24,%r19,%r0
        cmpiclr,<>      0x2f,%r19,%r19

 ---- 00010057 0001005b
 movi_i32 tmp0,$0x24
 sub_i32 tmp1,tmp0,r19
 mov_i32 tmp2,tmp0
 mov_i32 tmp3,r19
 movi_i32 tmp1,$0x0

 ---- 0001005b 0001005f
 brcond_i32 tmp2,tmp3,eq,$L1
 movi_i32 tmp0,$0x2f
 sub_i32 tmp1,tmp0,r19
 mov_i32 tmp2,tmp0
 mov_i32 tmp3,r19
 movi_i32 tmp1,$0x0
 mov_i32 r19,tmp1
 setcond_i32 psw_n,tmp2,tmp3,ne
 set_label $L1

In this case, both copies of "mov_i32 tmp3,r19" are removed.  The
second because opt thought it was redundant.  The first is removed
later by liveness because tmp3 is known to be dead.  This leaves
the setcond_i32 with an uninitialized input.

Revert the entire patch for 5.2, and a proper optimization across
the branch may be considered for the next development cycle.

Reported-by: qemu@igor2.repo.hu
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>


  Commit: 81966c1801b8fb04bca451819f16ca92120ba970
      
https://github.com/qemu/qemu/commit/81966c1801b8fb04bca451819f16ca92120ba970
  Author: Chen Qun <kuhn.chenqun@huawei.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M linux-user/mips/cpu_loop.c

  Log Message:
  -----------
  linux-user/mips/cpu_loop: silence the compiler warnings

When using -Wimplicit-fallthrough in our CFLAGS, the compiler showed warning:
linux-user/mips/cpu_loop.c: In function ‘cpu_loop’:
linux-user/mips/cpu_loop.c:104:24: warning: this statement may fall through 
[-Wimplicit-fallthrough=]
  104 |                     if ((ret = get_user_ual(arg8, sp_reg + 28)) != 0) {
      |                        ^
linux-user/mips/cpu_loop.c:107:17: note: here
  107 |                 case 7:
      |                 ^~~~
linux-user/mips/cpu_loop.c:108:24: warning: this statement may fall through 
[-Wimplicit-fallthrough=]
  108 |                     if ((ret = get_user_ual(arg7, sp_reg + 24)) != 0) {
      |                        ^
linux-user/mips/cpu_loop.c:111:17: note: here
  111 |                 case 6:
      |                 ^~~~
linux-user/mips/cpu_loop.c:112:24: warning: this statement may fall through 
[-Wimplicit-fallthrough=]
  112 |                     if ((ret = get_user_ual(arg6, sp_reg + 20)) != 0) {
      |                        ^
linux-user/mips/cpu_loop.c:115:17: note: here
  115 |                 case 5:
      |                 ^~~~

Add the corresponding "fall through" comment to fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20201030004046.2191790-5-kuhn.chenqun@huawei.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: 36d2dbc72df682df49c94a7a55f1e483f4f029a2
      
https://github.com/qemu/qemu/commit/36d2dbc72df682df49c94a7a55f1e483f4f029a2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M linux-user/elfload.c

  Log Message:
  -----------
  linux-user: Use "!= 0" when checking if MAP_FIXED_NOREPLACE is non-zero

In pgd_find_hole_fallback(), Coverity doesn't like the use
of "if (MAP_FIXED_NOREPLACE || ...)" because it's using a
logical operator on a constant other than 0 or 1 and its
heuristic thinks we might have intended a bitwise operator
instead.

The logic is correct (we are checking whether the host really
has a MAP_FIXED_NOREPLACE or whether we fell back to the
"#define as 0 to ignore" from osdep.h); make Coverity
happier by explicitly writing out the comparison with zero.

Fixes: Coverity CID 1431059
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20201103142636.21125-1-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: e4ce178b6153205c2e17a9b719287c83e1e67a72
      
https://github.com/qemu/qemu/commit/e4ce178b6153205c2e17a9b719287c83e1e67a72
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M linux-user/syscall.c

  Log Message:
  -----------
  linux-user/syscall: Fix missing target_to_host_timespec64() check

Coverity pointed out (CID 1432339) that target_to_host_timespec64() can
fail with -TARGET_EFAULT but we never check the return value. This patch
checks the return value and handles the error.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: 
<cad74fae734d2562746b94acd9c34b00081c89bf.1604432881.git.alistair.francis@wdc.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: 022625a8ade3005addb42700a145bae6a1653240
      
https://github.com/qemu/qemu/commit/022625a8ade3005addb42700a145bae6a1653240
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M linux-user/elfload.c

  Log Message:
  -----------
  linux-user: Check copy_from_user() return value in vma_dump_size()

Coverity points out that we don't check the return value from
copy_from_user() in vma_dump_size(). This is to some extent
a "can't happen" error since we've already checked the page
with an access_ok() call earlier, but it's simple enough to
handle the error anyway.

Fixes: Coverity CID 1432362
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20201103141532.19912-1-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: e2766868d45d8c8f8991cfd133e6a0c14abfe577
      
https://github.com/qemu/qemu/commit/e2766868d45d8c8f8991cfd133e6a0c14abfe577
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-04 (Wed, 04 Nov 2020)

  Changed paths:
    M hw/display/ati_2d.c
    M roms/Makefile
    M ui/vnc-auth-sasl.c
    M ui/vnc-auth-vencrypt.c
    M ui/vnc-jobs.c
    M ui/vnc-ws.c
    M ui/vnc.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/kraxel/tags/fixes-20201104-pull-request' into staging

misc bugfixes for 5.2

# gpg: Signature made Wed 04 Nov 2020 15:46:33 GMT
# gpg:                using RSA key 4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* remotes/kraxel/tags/fixes-20201104-pull-request:
  roms/Makefile: Add qboot to .PHONY list
  ati: check x y display parameter values
  vnc: fix resource leak when websocket channel error

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 295397f53cc1e337e5c1ada62a9ac9feea4d4e97
      
https://github.com/qemu/qemu/commit/295397f53cc1e337e5c1ada62a9ac9feea4d4e97
  Author: Chen Qun <kuhn.chenqun@huawei.com>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M target/ppc/excp_helper.c

  Log Message:
  -----------
  target/ppc/excp_helper: Add a fallthrough for fix compiler warning

When using -Wimplicit-fallthrough in our CFLAGS, the compiler showed warning:
../target/ppc/excp_helper.c: In function ‘powerpc_excp’:
../target/ppc/excp_helper.c:529:13: warning: this statement may fall through 
[-Wimplicit-fallthrough=]
  529 |         msr |= env->error_code;
      |         ~~~~^~~~~~~~~~~~~~~~~~
../target/ppc/excp_helper.c:530:5: note: here
  530 |     case POWERPC_EXCP_HDECR:     /* Hypervisor decrementer exception    
     */
      |     ^~~~

Add the corresponding "fall through" comment to fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Message-Id: <20201028055107.2170401-1-kuhn.chenqun@huawei.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>


  Commit: 184b813e7b1fe2dc27e7657befc907b5aac3b619
      
https://github.com/qemu/qemu/commit/184b813e7b1fe2dc27e7657befc907b5aac3b619
  Author: Greg Kurz <groug@kaod.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/ppc/spapr.c

  Log Message:
  -----------
  spapr: Drop dead code in spapr_reallocate_hpt()

Sometimes QEMU needs to allocate the HPT in userspace, namely with TCG
or PR KVM. This is performed with qemu_memalign() because of alignment
requirements. Like glib's allocators, its behaviour is to abort on OOM
instead of returning NULL.

This could be changed to qemu_try_memalign(), but in the specific case
of spapr_reallocate_hpt(), the outcome would be to terminate QEMU anyway
since no HPT means no MMU for the guest. Drop the dead code instead.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <160398562892.32380.15006707861753544263.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>


  Commit: f29b959dc6871c9d8df781d1bedcfaebc76d5565
      
https://github.com/qemu/qemu/commit/f29b959dc6871c9d8df781d1bedcfaebc76d5565
  Author: Greg Kurz <groug@kaod.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/ppc/spapr_hcall.c

  Log Message:
  -----------
  spapr: Convert hpt_prepare_thread() to use qemu_try_memalign()

HPT resizing is asynchronous: the guest first kicks off the creation of a
new HPT, then it waits for that new HPT to be actually created and finally
it asks the current HPT to be replaced by the new one.

In the case of a userland allocated HPT, this currently relies on calling
qemu_memalign() which aborts on OOM and never returns NULL. Since we seem
to have path to report the failure to the guest with an H_NO_MEM return
value, use qemu_try_memalign() instead of qemu_memalign().

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <160398563636.32380.1747166034877173994.stgit@bahia.lan>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>


  Commit: 5e49e89cb6e71c8bc06fe9dd1afd4037917b10bb
      
https://github.com/qemu/qemu/commit/5e49e89cb6e71c8bc06fe9dd1afd4037917b10bb
  Author: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M target/s390x/insn-data.def
    M target/s390x/translate.c

  Log Message:
  -----------
  target/s390x: fix execution with icount

This patch adds some gen_io_start() calls to allow execution
of s390x targets in icount mode with -smp 1.
It enables deterministic timers and record/replay features.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: David Hildenbrand <david@redhat.com>
Message-Id: <160455551747.32240.17074484658979970129.stgit@pasha-ThinkPad-X280>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>


  Commit: 77280d33bc9cfdbfb5b5d462259d644f5aefe9b3
      
https://github.com/qemu/qemu/commit/77280d33bc9cfdbfb5b5d462259d644f5aefe9b3
  Author: Cornelia Huck <cohuck@redhat.com>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/s390x/meson.build
    M include/hw/s390x/s390-pci-vfio.h

  Log Message:
  -----------
  s390x: fix build for --without-default-devices

s390-pci-vfio.c calls into the vfio code, so we need it to be
built conditionally on vfio (which implies CONFIG_LINUX).

Fixes: cd7498d07fbb ("s390x/pci: Add routine to get the vfio dma available 
count")
Reported-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-Id: <20201103123237.718242-1-cohuck@redhat.com>
Acked-by: Greg Kurz <groug@kaod.org>
Tested-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>


  Commit: 747c6b3811ef5f06278ab364261e3723bcbb4031
      
https://github.com/qemu/qemu/commit/747c6b3811ef5f06278ab364261e3723bcbb4031
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M configure
    M contrib/vhost-user-gpu/meson.build
    M docs/devel/build-system.rst
    M docs/devel/kconfig.rst
    M docs/meson.build
    M hw/isa/lpc_ich9.c
    M include/hw/i386/ich9.h
    M include/qapi/util.h
    M include/qemu/cutils.h
    M meson.build
    M qapi/opts-visitor.c
    M qapi/qapi-util.c
    M qapi/qobject-input-visitor.c
    M qapi/string-input-visitor.c
    M scripts/oss-fuzz/build.sh
    M softmmu/physmem.c
    M softmmu/vl.c
    M tests/qtest/device-introspect-test.c
    M tests/qtest/fuzz-test.c
    M tests/qtest/fuzz/generic_fuzz.c
    M tests/qtest/fuzz/qos_fuzz.c
    M tests/qtest/ivshmem-test.c
    M tests/qtest/libqos/ahci.c
    M tests/qtest/libqtest.c
    M tools/virtiofsd/meson.build
    M util/cutils.c
    M util/qemu-option.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into 
staging

Doc and bug fixes

# gpg: Signature made Wed 04 Nov 2020 17:01:29 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini-gitlab/tags/for-upstream:
  qapi, qemu-options: make all parsing visitors parse boolean options the same
  qtest: escape device name in device-introspect-test
  ivshmem-test: do not use short-form boolean option
  semihosting: fix order of initialization functions
  fuzz: fuzz offsets within pio/mmio regions
  fuzz: check the MR in the DMA callback
  fuzz: fix writing DMA patterns
  tests/qtest: Fix potential NULL pointer dereference in qos_build_main_args()
  configure: fix gio_libs reference
  meson: fix warning for bad sphinx-build
  tests/qtest/libqos/ahci.c: Avoid NULL dereference in ahci_exec()
  tests/qtest/libqtest.c: Check for setsockopt() failure
  meson: vhost-user-gpu/virtiofsd: use absolute path
  meson: use b_staticpic=false for meson >=0.56.0
  qtest: add a reproducer for LP#1878642
  hw/isa/lpc_ich9: Ignore reserved/invalid SCI IRQ
  scripts/oss-fuzz: rename bin/qemu-fuzz-i386
  exec: Remove dead code (CID 1432876)
  docs: expand sourceset documentation
  cutils: replace strdup with g_strdup

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 01011733ea3177e437d8999b77c73caa93266896
      
https://github.com/qemu/qemu/commit/01011733ea3177e437d8999b77c73caa93266896
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/9pfs/9p-local.c
    M hw/9pfs/9p.c

  Log Message:
  -----------
  hw/9pfs : add spaces around operator

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Reported-by: Euler Robot <euler.robot@huawei.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20201030043515.1030223-1-zhangxinhao1@huawei.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>


  Commit: 487729e9f667644ee0d6762b24269e7758ad2e5e
      
https://github.com/qemu/qemu/commit/487729e9f667644ee0d6762b24269e7758ad2e5e
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/9pfs/9p.h

  Log Message:
  -----------
  hw/9pfs : open brace '{' following struct go on the same line

Fix code style. Open braces for struct should go on the same line.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Reported-by: Euler Robot <euler.robot@huawei.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20201030043515.1030223-2-zhangxinhao1@huawei.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>


  Commit: 22e13675874dabcb314de98134fe6142cd9864a7
      
https://github.com/qemu/qemu/commit/22e13675874dabcb314de98134fe6142cd9864a7
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/9pfs/cofs.c

  Log Message:
  -----------
  hw/9pfs : add space before the open parenthesis '('

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Reported-by: Euler Robot <euler.robot@huawei.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <20201030043515.1030223-3-zhangxinhao1@huawei.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>


  Commit: e6b99460b14469e0b83febc8d5a501947d1d5c7c
      
https://github.com/qemu/qemu/commit/e6b99460b14469e0b83febc8d5a501947d1d5c7c
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/9pfs/Kconfig
    M hw/9pfs/meson.build

  Log Message:
  -----------
  hw/9pfs: Fix Kconfig dependency problem between 9pfs and Xen

Commit b2c00bce54c ("meson: convert hw/9pfs, cleanup") introduced
CONFIG_9PFS (probably a wrong conflict resolution). This config is
not used anywhere. Backends depend on CONFIG_FSDEV_9P which itself
depends on CONFIG_VIRTFS.

Remove the invalid CONFIG_9PFS and use CONFIG_FSDEV_9P instead, to
fix the './configure --without-default-devices --enable-xen' build:

  /usr/bin/ld: libcommon.fa.p/hw_xen_xen-legacy-backend.c.o: in function 
`xen_be_register_common':
  hw/xen/xen-legacy-backend.c:754: undefined reference to `xen_9pfs_ops'
  /usr/bin/ld: libcommon.fa.p/fsdev_qemu-fsdev.c.o:(.data.rel+0x8): undefined 
reference to `local_ops'
  /usr/bin/ld: libcommon.fa.p/fsdev_qemu-fsdev.c.o:(.data.rel+0x20): undefined 
reference to `synth_ops'
  /usr/bin/ld: libcommon.fa.p/fsdev_qemu-fsdev.c.o:(.data.rel+0x38): undefined 
reference to `proxy_ops'
  collect2: error: ld returned 1 exit status

Fixes: b2c00bce54c ("meson: convert hw/9pfs, cleanup")
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Greg Kurz <groug@kaod.org>
Tested-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Message-Id: <20201104115706.3101190-3-philmd@redhat.com>
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>


  Commit: 85c3ed44171d757e399bcbb3db3608c1848c0984
      
https://github.com/qemu/qemu/commit/85c3ed44171d757e399bcbb3db3608c1848c0984
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M block/export/export.c
    M block/export/meson.build
    M block/export/vhost-user-blk-server.c
    M configure
    M contrib/libvhost-user/libvhost-user.h
    M contrib/vhost-user-blk/vhost-user-blk.c
    M hw/acpi/core.c
    M hw/acpi/nvdimm.c
    M hw/acpi/pcihp.c
    M hw/block/vhost-user-blk.c
    M hw/i386/pc.c
    M hw/mem/memory-device.c
    M hw/smbios/smbios.c
    M hw/vfio/common.c
    M hw/virtio/trace-events
    M hw/virtio/vhost-backend.c
    M hw/virtio/vhost.c
    M hw/virtio/virtio-iommu.c
    M hw/virtio/virtio-mem-pci.c
    M hw/virtio/virtio-mem.c
    M include/exec/memory.h
    M include/hw/mem/memory-device.h
    M include/hw/virtio/vhost.h
    M net/net.c
    M net/vhost-vdpa.c
    M softmmu/memory.c
    M util/meson.build

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging

pc,pci,vhost,virtio: fixes

Lots of fixes all over the place.
virtio-mem and virtio-iommu patches are kind of fixes but
it seems better to just make them behave sanely than
try to educate users about the limitations ...

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Wed 04 Nov 2020 18:40:03 GMT
# gpg:                using RSA key 5D09FD0871C8F85B94CA8A0D281F0DB8D28D5469
# gpg:                issuer "mst@redhat.com"
# gpg: Good signature from "Michael S. Tsirkin <mst@kernel.org>" [full]
# gpg:                 aka "Michael S. Tsirkin <mst@redhat.com>" [full]
# Primary key fingerprint: 0270 606B 6F3C DF3D 0B17  0970 C350 3912 AFBE 8E67
#      Subkey fingerprint: 5D09 FD08 71C8 F85B 94CA  8A0D 281F 0DB8 D28D 5469

* remotes/mst/tags/for_upstream: (31 commits)
  contrib/vhost-user-blk: fix get_config() information leak
  block/export: fix vhost-user-blk get_config() information leak
  block/export: make vhost-user-blk config space little-endian
  configure: introduce --enable-vhost-user-blk-server
  libvhost-user: follow QEMU comment style
  vhost-blk: set features before setting inflight feature
  Revert "vhost-blk: set features before setting inflight feature"
  net: Add vhost-vdpa in show_netdevs()
  vhost-vdpa: Add qemu_close in vhost_vdpa_cleanup
  vfio: Don't issue full 2^64 unmap
  virtio-iommu: Set supported page size mask
  vfio: Set IOMMU page size as per host supported page size
  memory: Add interface to set iommu page size mask
  virtio-iommu: Add notify_flag_changed() memory region callback
  virtio-iommu: Add replay() memory region callback
  virtio-iommu: Call memory notifiers in attach/detach
  virtio-iommu: Add memory notifiers for map/unmap
  virtio-iommu: Store memory region in endpoint struct
  virtio-iommu: Fix virtio_iommu_mr()
  hw/smbios: Fix leaked fd in save_opt_one() error path
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: fbd9cc20ad26708a6e854460f8a173ea9f958165
      
https://github.com/qemu/qemu/commit/fbd9cc20ad26708a6e854460f8a173ea9f958165
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M tcg/optimize.c
    M tcg/tcg.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20201104' into staging

Fix assert in set_jmp_reset_offset
Revert cross-branch optimization in tcg/optimize.c.

# gpg: Signature made Thu 05 Nov 2020 00:28:07 GMT
# gpg:                using RSA key 7A481E78868B4DB6A85A05C064DF38E8AF7E215F
# gpg:                issuer "richard.henderson@linaro.org"
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>" 
[full]
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20201104:
  tcg: Revert "tcg/optimize: Flush data at labels not TCG_OPF_BB_END"
  tcg: Remove assert from set_jmp_reset_offset

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 326c9a0eb67672f3d7515fe41e9deaa58fb15227
      
https://github.com/qemu/qemu/commit/326c9a0eb67672f3d7515fe41e9deaa58fb15227
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M hw/ppc/spapr.c
    M hw/ppc/spapr_hcall.c
    M target/ppc/excp_helper.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-5.2-20201105' 
into staging

ppc patch queue for 2020-11-05

A small PR this time, one bugfix, one removal of minor dead code, one
warning suppression.

# gpg: Signature made Thu 05 Nov 2020 03:44:51 GMT
# gpg:                using RSA key 75F46586AE61A66CC44E87DC6C38CACA20D9B392
# gpg: Good signature from "David Gibson <david@gibson.dropbear.id.au>" [full]
# gpg:                 aka "David Gibson (Red Hat) <dgibson@redhat.com>" [full]
# gpg:                 aka "David Gibson (ozlabs.org) <dgibson@ozlabs.org>" 
[full]
# gpg:                 aka "David Gibson (kernel.org) <dwg@kernel.org>" 
[unknown]
# Primary key fingerprint: 75F4 6586 AE61 A66C C44E  87DC 6C38 CACA 20D9 B392

* remotes/dg-gitlab/tags/ppc-for-5.2-20201105:
  spapr: Convert hpt_prepare_thread() to use qemu_try_memalign()
  spapr: Drop dead code in spapr_reallocate_hpt()
  target/ppc/excp_helper: Add a fallthrough for fix compiler warning

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 42705e269186fb309dd9120f540e2cab05422cb9
      
https://github.com/qemu/qemu/commit/42705e269186fb309dd9120f540e2cab05422cb9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-05 (Thu, 05 Nov 2020)

  Changed paths:
    M linux-user/elfload.c
    M linux-user/mips/cpu_loop.c
    M linux-user/syscall.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/vivier2/tags/linux-user-for-5.2-pull-request' into staging

Coverity and compiler warning fixes

# gpg: Signature made Thu 05 Nov 2020 07:07:56 GMT
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "laurent@vivier.eu"
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full]
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" 
[full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-5.2-pull-request:
  linux-user: Check copy_from_user() return value in vma_dump_size()
  linux-user/syscall: Fix missing target_to_host_timespec64() check
  linux-user: Use "!= 0" when checking if MAP_FIXED_NOREPLACE is non-zero
  linux-user/mips/cpu_loop: silence the compiler warnings

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: a47c284a7cf8f6e98df974b1009bf412653ce01e
      
https://github.com/qemu/qemu/commit/a47c284a7cf8f6e98df974b1009bf412653ce01e
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-06 (Fri, 06 Nov 2020)

  Changed paths:
    M hw/9pfs/9p-local.c
    M hw/9pfs/9p.c
    M hw/9pfs/9p.h
    M hw/9pfs/Kconfig
    M hw/9pfs/cofs.c
    M hw/9pfs/meson.build

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/cschoenebeck/tags/pull-9p-20201106' 
into staging

9pfs: some fixes

* Fix meson build config for Xen.

* Code style fixes.

# gpg: Signature made Fri 06 Nov 2020 09:12:51 GMT
# gpg:                using RSA key 96D8D110CF7AF8084F88590134C2B58765A47395
# gpg:                issuer "qemu_oss@crudebyte.com"
# gpg: Good signature from "Christian Schoenebeck <qemu_oss@crudebyte.com>" 
[unknown]
# gpg: WARNING: This key is not certified with a trusted signature!
# gpg:          There is no indication that the signature belongs to the owner.
# Primary key fingerprint: ECAB 1A45 4014 1413 BA38  4926 30DB 47C3 A012 D5F4
#      Subkey fingerprint: 96D8 D110 CF7A F808 4F88  5901 34C2 B587 65A4 7395

* remotes/cschoenebeck/tags/pull-9p-20201106:
  hw/9pfs: Fix Kconfig dependency problem between 9pfs and Xen
  hw/9pfs : add space before the open parenthesis '('
  hw/9pfs : open brace '{' following struct go on the same line
  hw/9pfs : add spaces around operator

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 3493c36f0371777c62d1d72b205b0eb6117e2156
      
https://github.com/qemu/qemu/commit/3493c36f0371777c62d1d72b205b0eb6117e2156
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-06 (Fri, 06 Nov 2020)

  Changed paths:
    M hw/s390x/meson.build
    M include/hw/s390x/s390-pci-vfio.h
    M pc-bios/s390-ccw.img
    M pc-bios/s390-ccw/main.c
    M pc-bios/s390-netboot.img
    M target/s390x/insn-data.def
    M target/s390x/translate.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20201106' into staging

some s390x fixes, including a bios update

# gpg: Signature made Fri 06 Nov 2020 13:08:42 GMT
# gpg:                using RSA key C3D0D66DC3624FF6A8C018CEDECF6B93C6F02FAF
# gpg:                issuer "cohuck@redhat.com"
# gpg: Good signature from "Cornelia Huck <conny@cornelia-huck.de>" [unknown]
# gpg:                 aka "Cornelia Huck <huckc@linux.vnet.ibm.com>" [full]
# gpg:                 aka "Cornelia Huck <cornelia.huck@de.ibm.com>" [full]
# gpg:                 aka "Cornelia Huck <cohuck@kernel.org>" [unknown]
# gpg:                 aka "Cornelia Huck <cohuck@redhat.com>" [unknown]
# Primary key fingerprint: C3D0 D66D C362 4FF6 A8C0  18CE DECF 6B93 C6F0 2FAF

* remotes/cohuck/tags/s390x-20201106:
  s390x: fix build for --without-default-devices
  target/s390x: fix execution with icount
  pc-bios/s390: update s390-ccw bios binaries
  s390-bios: Skip writing iplb location to low core for ccw ipl

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: a60442eb8d97d37d3ae031739503dec4912a1127
      
https://github.com/qemu/qemu/commit/a60442eb8d97d37d3ae031739503dec4912a1127
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M MAINTAINERS
    M docs/system/deprecated.rst

  Log Message:
  -----------
  target/mips: Deprecate nanoMIPS ISA

The nanoMIPS ISA has been announced in 2018 for various projects:

GCC:   https://gcc.gnu.org/legacy-ml/gcc/2018-05/msg00012.html
Linux: https://lwn.net/Articles/753605/
QEMU:  https://www.mail-archive.com/qemu-devel@nongnu.org/msg530721.html

Unfortunately the links referenced doesn't work anymore (www.mips.com).

>From this Wayback machine link [1] we can get to a working place to
download a toolchain (a more recent release than the one referenced
in the announcement mails):
http://codescape.mips.com/components/toolchain/nanomips/2018.04-02/downloads.html

The toolchain page mention LLVM but simply links http://llvm.org/
where there is no reference on nanoMIPS.

The only reference in the GCC mailing list, is the nanoMIPS
announcement: https://gcc.gnu.org/pipermail/gcc/2018-May.txt

The developer who authored the announcements have been emailed [2]
to ask for more information but all their emails are now bouncing:

- Your message to Stefan.Markovic@mips.com couldn't be delivered.

- Your message to smarkovic@wavecomp.com couldn't be delivered.

- Couldn't deliver the message to the following recipients:
    Robert.Suchanek@mips.com, matthew.fortune@mips.com,
    marcin.nowakowski@mips.com

Our deprecation policy do not allow feature removal before 2 release,
therefore declare the nanoMIPS ISA code deprecated as of QEMU 5.2.
This gives time to developers to update the QEMU community, or
interested parties to step in to maintain this code.

[1] 
https://web.archive.org/web/20180904044530/https://www.mips.com/develop/tools/compilers/
[2] https://www.mail-archive.com/qemu-devel@nongnu.org/msg756392.html

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20201102202710.2224691-1-f4bug@amsat.org>


  Commit: d40b55bc1b8630a0028f54d9df376930e133cc4a
      
https://github.com/qemu/qemu/commit/d40b55bc1b8630a0028f54d9df376930e133cc4a
  Author: Jiaxun Yang <jiaxun.yang@flygoat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M target/mips/cp0_helper.c
    M target/mips/cpu.h

  Log Message:
  -----------
  target/mips: Fix PageMask with variable page size

Our current code assumed the target page size is always 4k
when handling PageMask and VPN2, however, variable page size
was just added to mips target and that's no longer true.

Fixes: ee3863b9d414 ("target/mips: Support variable page size")
Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Message-Id: <1604636510-8347-2-git-send-email-chenhc@lemote.com>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
[PMD: Replaced find_first_zero_bit() by cto32()]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: bf4ee88ab63fcf2dcb75f0d68cc6c8d2edb68212
      
https://github.com/qemu/qemu/commit/bf4ee88ab63fcf2dcb75f0d68cc6c8d2edb68212
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M hw/mips/boston.c

  Log Message:
  -----------
  hw/mips/boston: Fix memory leak in boston_fdt_filter() error-handling paths

Coverity points out that the error-handling paths in the
boston_fdt_filter() function don't free the fdt that was allocated.
Fix the leak by using g_autofree.

Fixes: Coverity CID 1432275

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20201106175823.1650-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>


  Commit: f166061c73f070ce98a9003bdaeedd39ab034eed
      
https://github.com/qemu/qemu/commit/f166061c73f070ce98a9003bdaeedd39ab034eed
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  MAINTAINERS: Demote Renesas target & hardware to 'Odd Fixes'

To be fair with other subsystems listed as 'Odd Fixes' but having
maintainers more present, demote the Renesas sections from being
'Maintained' to 'Odd Fixes' (has a maintainer but they don't have
time to do much other than throw the odd patch in.)

This matches Magnus's possibilities so far:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg710319.html

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20201102104001.2062572-1-f4bug@amsat.org>


  Commit: 60f6de8fbafa5dc57af63792e3ba1a910239d195
      
https://github.com/qemu/qemu/commit/60f6de8fbafa5dc57af63792e3ba1a910239d195
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M hw/rx/rx-gdbsim.c

  Log Message:
  -----------
  hw/rx/rx-gdbsim: Fix memory leak (CID 1432307)

As load_device_tree() returns allocated memory,
we need to free it.

Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Fixes: bda19d7bb56 ("hw/rx: Add RX GDB simulator")
Reported-by: Coverity (CID 1432307: RESOURCE_LEAK)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20201102104542.2064745-1-f4bug@amsat.org>


  Commit: c4cdf54cff933d7176083581523748d4171db6e6
      
https://github.com/qemu/qemu/commit/c4cdf54cff933d7176083581523748d4171db6e6
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M docs/devel/qapi-code-gen.txt

  Log Message:
  -----------
  docs/devel/qapi-code-gen: Fix up examples

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201027121026.3025930-1-armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>


  Commit: 92a3c6aac8da5f97f7ec86d12c2d0417cc3bf325
      
https://github.com/qemu/qemu/commit/92a3c6aac8da5f97f7ec86d12c2d0417cc3bf325
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  MAINTAINERS: Add QAPI schema modules to their subsystems

Add the relevant QAPI schema modules to section Audio, QMP, Tracing,
Cryptography.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201102081550.171061-2-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Daniel P. Berrangé <berrange@redhat.com>


  Commit: a1d12a2148e75dc67743de9c45bf925ca6f26739
      
https://github.com/qemu/qemu/commit/a1d12a2148e75dc67743de9c45bf925ca6f26739
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M qapi/audio.json
    M qapi/authz.json

  Log Message:
  -----------
  qapi: Fix missing headers in QMP Reference Manual

Audio stuff is under "Miscellanea", and authorization stuff is under
"Input".  Add suitable header doc comments to correct that.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Daniel P. Berrange <berrange@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201102081550.171061-3-armbru@redhat.com>
Acked-by: Daniel P. Berrangé <berrange@redhat.com>


  Commit: ffb515fa50c286ec572a0dcc3923652085dd63f8
      
https://github.com/qemu/qemu/commit/ffb515fa50c286ec572a0dcc3923652085dd63f8
  Author: Max Reitz <mreitz@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M qapi/block-core.json

  Log Message:
  -----------
  qapi/block-core: Improve MapEntry documentation

MapEntry and BlockDeviceMapEntry are kind of the same thing, and the
latter is not used, so we want to remove it.  However, the documentation
it provides for some fields is better than that of MapEntry, so steal
some of it for the latter.

(And adjust them a bit in the process, because I feel like we can make
them even clearer.)

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20201104165513.72720-2-mreitz@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>


  Commit: 143d51e1792ecf2c8e5b0fc3a8c6022676c723d4
      
https://github.com/qemu/qemu/commit/143d51e1792ecf2c8e5b0fc3a8c6022676c723d4
  Author: Markus Armbruster <armbru@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M qapi/block-core.json

  Log Message:
  -----------
  block: Remove unused BlockDeviceMapEntry

BlockDeviceMapEntry has never been used.  It was added in commit
facd6e2 "so that it is published through the introspection mechanism."
What exactly introspecting types that aren't used for anything could
accomplish isn't clear.  What "introspection mechanism" to use is also
nebulous.  To the best of my knowledge, there has never been one that
covered this type.  Certainly not query-qmp-schema, which includes
only types that are actually used in QMP.

Not being able to introspect BlockDeviceMapEntry hasn't bothered
anyone enough to complain in almost four years.  Get rid of it.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Eric Blake <eblake@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201104165513.72720-3-mreitz@redhat.com>


  Commit: b54b82df250685b8ee7f947909d10dc30a0ac2b1
      
https://github.com/qemu/qemu/commit/b54b82df250685b8ee7f947909d10dc30a0ac2b1
  Author: Thomas Huth <thuth@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M meson.build

  Log Message:
  -----------
  meson: Clarify the confusing vhost-user vs. vhost-kernel output

The configuration summary prints a line with "vhost-user: YES/NO",
but the value is currently the vhost-kernel setting instead which
looks wrong. Print the kernel setting in a separate line and switch
the "vhost-user:" line to CONFIG_VHOST_USER instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20201109085906.87921-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 1023e0033db712b0742de226f133a494f7c474c8
      
https://github.com/qemu/qemu/commit/1023e0033db712b0742de226f133a494f7c474c8
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M Makefile

  Log Message:
  -----------
  fix make clean/distclean

A misplaced $(quiet-@) meant that "make clean" and "make distclean" did
not work properly.

Reported-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: dc24926baf9d577bb00b385f12ade9cad6bb4cba
      
https://github.com/qemu/qemu/commit/dc24926baf9d577bb00b385f12ade9cad6bb4cba
  Author: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M replay/replay-debugging.c

  Log Message:
  -----------
  replay: remove some dead code

This patch removes dead code in replay_continue_stop() function.

Signed-off-by: Pavel Dovgalyuk <pavel.dovgalyuk@ispras.ru>
Reported-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <160455661411.3455.4177953912304752892.stgit@pasha-ThinkPad-X280>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 784106ec98b68cd4c1470a3f92cc46ac3e8926c1
      
https://github.com/qemu/qemu/commit/784106ec98b68cd4c1470a3f92cc46ac3e8926c1
  Author: Greg Kurz <groug@kaod.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M Makefile

  Log Message:
  -----------
  Makefile: No echoing for 'make help V=1'

It doesn't bring much to have echoing with "make help". Suppress it
unconditionally.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <160459122012.462591.8467906402712875729.stgit@bahia.lan>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 193f51ddcf1d87d725f1dfd51b8a95351c910e8f
      
https://github.com/qemu/qemu/commit/193f51ddcf1d87d725f1dfd51b8a95351c910e8f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M MAINTAINERS
    M docs/system/deprecated.rst
    M hw/mips/boston.c
    M target/mips/cp0_helper.c
    M target/mips/cpu.h

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/philmd-gitlab/tags/mips-fixes-20201109' 
into staging

MIPS patches queue

- Deprecate nanoMIPS ISA
- Fix PageMask with variable page size (Huacai Chen)
- Fix memory leak in boston_fdt_filter (Coverity CID 1432275, Peter Maydell)

CI jobs results:
. https://cirrus-ci.com/build/5439131968864256
. https://gitlab.com/philmd/qemu/-/pipelines/213403385
. https://travis-ci.org/github/philmd/qemu/builds/742312387

# gpg: Signature made Sun 08 Nov 2020 23:41:19 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" 
[full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd-gitlab/tags/mips-fixes-20201109:
  hw/mips/boston: Fix memory leak in boston_fdt_filter() error-handling paths
  target/mips: Fix PageMask with variable page size
  target/mips: Deprecate nanoMIPS ISA

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 2a190a7256a3e0563b29ffd67e0164097b4a6dac
      
https://github.com/qemu/qemu/commit/2a190a7256a3e0563b29ffd67e0164097b4a6dac
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M MAINTAINERS
    M hw/rx/rx-gdbsim.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/philmd-gitlab/tags/renesas-fixes-20201109' into staging

Renesas patches queue

- Demote target & hardware sections to 'Odd Fixes'
- Fix memory leak (CID 1432307)

CI jobs results:
. https://cirrus-ci.com/build/5340929353580544
. https://gitlab.com/philmd/qemu/-/pipelines/213407241
. https://travis-ci.org/github/philmd/qemu/builds/742315021

# gpg: Signature made Sun 08 Nov 2020 23:58:37 GMT
# gpg:                using RSA key FAABE75E12917221DCFD6BB2E3E32C2CDEADC0DE
# gpg: Good signature from "Philippe Mathieu-Daudé (F4BUG) <f4bug@amsat.org>" 
[full]
# Primary key fingerprint: FAAB E75E 1291 7221 DCFD  6BB2 E3E3 2C2C DEAD C0DE

* remotes/philmd-gitlab/tags/renesas-fixes-20201109:
  hw/rx/rx-gdbsim: Fix memory leak (CID 1432307)
  MAINTAINERS: Demote Renesas target & hardware to 'Odd Fixes'

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: a2547c1ba911a0c53a10fe02d94a0f539dc064cc
      
https://github.com/qemu/qemu/commit/a2547c1ba911a0c53a10fe02d94a0f539dc064cc
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M MAINTAINERS
    M docs/devel/qapi-code-gen.txt
    M qapi/audio.json
    M qapi/authz.json
    M qapi/block-core.json

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2020-11-09' into 
staging

QAPI patches patches for 2020-11-09

# gpg: Signature made Mon 09 Nov 2020 08:16:33 GMT
# gpg:                using RSA key 354BC8B3D7EB2A6B68674E5F3870B400EB918653
# gpg:                issuer "armbru@redhat.com"
# gpg: Good signature from "Markus Armbruster <armbru@redhat.com>" [full]
# gpg:                 aka "Markus Armbruster <armbru@pond.sub.org>" [full]
# Primary key fingerprint: 354B C8B3 D7EB 2A6B 6867  4E5F 3870 B400 EB91 8653

* remotes/armbru/tags/pull-qapi-2020-11-09:
  block: Remove unused BlockDeviceMapEntry
  qapi/block-core: Improve MapEntry documentation
  qapi: Fix missing headers in QMP Reference Manual
  MAINTAINERS: Add QAPI schema modules to their subsystems
  docs/devel/qapi-code-gen: Fix up examples

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 3d86af858ec081b2b385b6fd5af09e42ca825a96
      
https://github.com/qemu/qemu/commit/3d86af858ec081b2b385b6fd5af09e42ca825a96
  Author: AlexChen <alex.chen@huawei.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block/dmg-lzfse.c

  Log Message:
  -----------
  block: Remove unused include

The "qemu-common.h" include is not used, remove it.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: AlexChen <alex.chen@huawei.com>
Message-Id: <5F8FFB94.3030209@huawei.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 009cde17a527993b8bc45da831fe0643229a04ee
      
https://github.com/qemu/qemu/commit/009cde17a527993b8bc45da831fe0643229a04ee
  Author: Greg Kurz <groug@kaod.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M include/block/block.h
    M include/block/block_int.h

  Log Message:
  -----------
  block: Move bdrv_drain_all_end_quiesce() to block_int.h

This function is really an internal helper for bdrv_close(). Update its
doc comment to make this clear and make the function private.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <160387245480.131299.13430357162209598411.stgit@bahia>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 3441ad4bc42ce9d9c6004cd013b91da0a454f143
      
https://github.com/qemu/qemu/commit/3441ad4bc42ce9d9c6004cd013b91da0a454f143
  Author: Alberto Garcia <berto@igalia.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block/qcow2-cluster.c
    M block/qcow2.c
    M block/qcow2.h

  Log Message:
  -----------
  qcow2: Document and enforce the QCowL2Meta invariants

The QCowL2Meta structure is used to store information about a part of
a write request that touches clusters that need changes in their L2
entries. This happens with newly-allocated clusters or subclusters.

This structure has changed a bit since it was first created and its
current documentation is not quite up-to-date.

A write request can span a region consisting of a combination of
clusters of different types, and qcow2_alloc_host_offset() can
repeatedly call handle_copied() and handle_alloc() to add more
clusters to the mix as long as they all are contiguous on the image
file.

Because of this a write request has a list of QCowL2Meta structures,
one for each part of the request that needs changes in the L2
metadata.

Each one of them spans nb_clusters and has two copy-on-write regions
located immediately before and after the middle region touched by that
part of the write request. Even when those regions themselves are
empty their offsets must be correct because they are used to know the
location of the middle region.

This was not always the case but it is not a problem anymore
because the only two places where QCowL2Meta structures are created
(calculate_l2_meta() and qcow2_co_truncate()) ensure that the
copy-on-write regions are correctly defined, and so do assertions like
the ones in perform_cow().

The conditional initialization of the 'written_to' variable is
therefore unnecessary and is removed by this patch.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201007161323.4667-1-berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 8ce648056fe2e1b071579b66401c8a58ecbebe05
      
https://github.com/qemu/qemu/commit/8ce648056fe2e1b071579b66401c8a58ecbebe05
  Author: Klaus Jensen <k.jensen@samsung.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M hw/block/nvme.c

  Log Message:
  -----------
  hw/block/nvme: fix null ns in register namespace

Fix dereference after NULL check.

Reported-by: Coverity (CID 1436128)
Fixes: b20804946bce ("hw/block/nvme: update nsid when registered")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Message-Id: <20201104102248.32168-2-its@irrelevant.dk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: bf288953f13b4a3c57e6e59656ac5367491c65eb
      
https://github.com/qemu/qemu/commit/bf288953f13b4a3c57e6e59656ac5367491c65eb
  Author: Klaus Jensen <k.jensen@samsung.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M hw/block/nvme.c

  Log Message:
  -----------
  hw/block/nvme: fix uint16_t use of uint32_t sgls member

nvme_map_sgl_data erroneously uses the sgls member of NvmeIdNs as a
uint16_t.

Reported-by: Coverity (CID 1436129)
Fixes: cba0a8a344fe ("hw/block/nvme: add support for scatter gather lists")
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Message-Id: <20201104102248.32168-3-its@irrelevant.dk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 73ad0ff216d2e1cf08909a0597e7b072babfe9c4
      
https://github.com/qemu/qemu/commit/73ad0ff216d2e1cf08909a0597e7b072babfe9c4
  Author: Klaus Jensen <k.jensen@samsung.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M hw/block/nvme.c

  Log Message:
  -----------
  hw/block/nvme: fix free of array-typed value

Since 7f0f1acedf15 ("hw/block/nvme: support multiple namespaces"), the
namespaces member of NvmeCtrl is no longer a dynamically allocated
array. Remove the free.

Fixes: 7f0f1acedf15 ("hw/block/nvme: support multiple namespaces")
Reported-by: Coverity (CID 1436131)
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
Message-Id: <20201104102248.32168-4-its@irrelevant.dk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 2daba442059a838f8f3c80d8fa52a85768ba7c4c
      
https://github.com/qemu/qemu/commit/2daba442059a838f8f3c80d8fa52a85768ba7c4c
  Author: Maxim Levitsky <mlevitsk@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M tests/qemu-iotests/iotests.py

  Log Message:
  -----------
  iotests: add filter_qmp_virtio_scsi function

filter_qmp_virtio_scsi can be used to filter virtio-scsi-pci/ccw differences.
Note that this patch was only tested on x86.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20201104185025.434703-2-mlevitsk@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: c6ac463631a124eaa47cae8a9a4aaac4d0761d28
      
https://github.com/qemu/qemu/commit/c6ac463631a124eaa47cae8a9a4aaac4d0761d28
  Author: Maxim Levitsky <mlevitsk@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M tests/qemu-iotests/240
    M tests/qemu-iotests/240.out

  Log Message:
  -----------
  iotests: rewrite iotest 240 in python

The recent changes that brought RCU delayed device deletion,
broke few tests and this test breakage went unnoticed.

Fix this test by rewriting it in python
(which allows to wait for DEVICE_DELETED events before continuing).

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20201104185025.434703-3-mlevitsk@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: c63b0201ae3a1bb6a17136f641d84fe9bd28d285
      
https://github.com/qemu/qemu/commit/c63b0201ae3a1bb6a17136f641d84fe9bd28d285
  Author: Yonggang Luo <luoyonggang@gmail.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block/nfs.c

  Log Message:
  -----------
  block: Fixes nfs compiling error on msys2/mingw

These compiling errors are fixed:
../block/nfs.c:27:10: fatal error: poll.h: No such file or directory
   27 | #include <poll.h>
      |          ^~~~~~~~
compilation terminated.

../block/nfs.c:63:5: error: unknown type name 'blkcnt_t'
   63 |     blkcnt_t st_blocks;
      |     ^~~~~~~~
../block/nfs.c: In function 'nfs_client_open':
../block/nfs.c:550:27: error: 'struct _stat64' has no member named 'st_blocks'
  550 |     client->st_blocks = st.st_blocks;
      |                           ^
../block/nfs.c: In function 'nfs_get_allocated_file_size':
../block/nfs.c:751:41: error: 'struct _stat64' has no member named 'st_blocks'
  751 |     return (task.ret < 0 ? task.ret : st.st_blocks * 512);
      |                                         ^
../block/nfs.c: In function 'nfs_reopen_prepare':
../block/nfs.c:805:31: error: 'struct _stat64' has no member named 'st_blocks'
  805 |         client->st_blocks = st.st_blocks;
      |                               ^
../block/nfs.c: In function 'nfs_get_allocated_file_size':
../block/nfs.c:752:1: error: control reaches end of non-void function 
[-Werror=return-type]
  752 | }
      | ^

On msys2/mingw, there is no st_blocks in struct _stat64 yet, we disable the 
usage of it
on msys2/mingw, and create a typedef long long blkcnt_t; for further 
implementation

Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
Message-Id: <20201105123116.674-2-luoyonggang@gmail.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 7c5c53830636a9da263a9be5b510ac528bbd75d5
      
https://github.com/qemu/qemu/commit/7c5c53830636a9da263a9be5b510ac528bbd75d5
  Author: Yonggang Luo <luoyonggang@gmail.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M .cirrus.yml

  Log Message:
  -----------
  block: enable libnfs on msys2/mingw in cirrus.yml

Initially, libnfs has not been enabled, and now it's fixed, so enable it
on cirrus.

Signed-off-by: Yonggang Luo <luoyonggang@gmail.com>
Message-Id: <20201105123116.674-3-luoyonggang@gmail.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 122860bae7c3a3cf45f9f2dedddb0e2492f09888
      
https://github.com/qemu/qemu/commit/122860bae7c3a3cf45f9f2dedddb0e2492f09888
  Author: Eric Blake <eblake@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: Fix integer promotion error in bdrv_getlength()

Back in 2015, we attempted to fix error reporting for images that
claimed to have more than INT64_MAX/512 sectors, but due to the type
promotions caused by BDRV_SECTOR_SIZE being unsigned, this
inadvertently forces all negative ret values to be slammed into -EFBIG
rather than the original error.  While we're at it, we can avoid the
confusing ?: by spelling the logic more directly.

Fixes: 4a9c9ea0d3
Reported-by: Guoyi Tu <tu.guoyi@h3c.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20201105155122.60943-1-eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: a3f6be81aa95f4f80504face9bc6de6d2dc1743f
      
https://github.com/qemu/qemu/commit/a3f6be81aa95f4f80504face9bc6de6d2dc1743f
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M meson.build

  Log Message:
  -----------
  meson: always include contrib/libvhost-user

libvhost-user is needed when CONFIG_LINUX is set. The CONFIG_VHOST_USER
check in meson.build is incorrect.

In fact, no explicit check is needed since this dependency is not built
by default. If something declares a dependency on libvhost-user then it
will be built, otherwise it won't be built (i.e. on non-Linux hosts).

This fixes ./configure --disable-vhost-user && make.

Fixes: bc15e44cb2191bbb2318878acdf5038134e56394 ("configure: introduce 
--enable-vhost-user-blk-server")
Reported-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reported-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201106210340.698771-1-stefanha@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 45716765b1d0bb1741688e5347aea967b9492d28
      
https://github.com/qemu/qemu/commit/45716765b1d0bb1741688e5347aea967b9492d28
  Author: Brad Smith <brad@comstyle.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M tests/vm/openbsd

  Log Message:
  -----------
  tests/vm: update openbsd to release 6.8

A double dash at the end of a package name removes ambiguity
when the intent is to install a non-FLAVORed package.

Signed-off-by: Brad Smith <brad@comstyle.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201027053048.GB64546@humpty.home.comstyle.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 8a47836548851ac00863a4f520ad761253ea4a86
      
https://github.com/qemu/qemu/commit/8a47836548851ac00863a4f520ad761253ea4a86
  Author: Eduardo Habkost <ehabkost@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M scripts/device-crash-test

  Log Message:
  -----------
  device-crash-test: Check if path is actually an executable file

After the transition to Meson, the build directory now have
subdirectories named "qemu-system-*.p", and device-crash-test
will try to execute them as if they were binaries.  This results
in errors like:

  PermissionError: [Errno 13] Permission denied: './qemu-system-or1k.p'

When generating the default list of binaries to test, check if
the path is actually a file and if it's executable.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
Message-Id: <20201026125238.2752882-1-ehabkost@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 3dc057923d3f3cd92ddc1685ff44022eec175c9c
      
https://github.com/qemu/qemu/commit/3dc057923d3f3cd92ddc1685ff44022eec175c9c
  Author: AlexChen <alex.chen@huawei.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M tests/qtest/arm-cpu-features.c

  Log Message:
  -----------
  qtest: Fix bad printf format specifiers

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-Id: <5FA28117.3020802@huawei.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: dccaea2514007dd526a54038ffcaef5fb9c95c0c
      
https://github.com/qemu/qemu/commit/dccaea2514007dd526a54038ffcaef5fb9c95c0c
  Author: AlexChen <alex.chen@huawei.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M tests/qtest/tpm-tests.c

  Log Message:
  -----------
  tests/qtest/tpm: Remove redundant check in the tpm_test_swtpm_test()

The 'addr' would not be NULL after checking 'succ' is valid,
and it has been dereferenced in the previous code(args = g_strdup_printf()).
So the check on 'addr' in the tpm_test_swtpm_test() is redundant. Remove it.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-Id: <5FA41448.4040404@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 7433a6860bee36d570c69720760238252a92090b
      
https://github.com/qemu/qemu/commit/7433a6860bee36d570c69720760238252a92090b
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M .gitlab-ci.yml

  Log Message:
  -----------
  gitlab-ci: Drop generic cache rule

This cache rule is meant for Avocado artifacts, but affects
all jobs. Moreover the 'acceptance_template' template already
include a more detailled rule to cache artifacts.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201108221925.2344515-2-philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 5f14f31d2bbb2c00b59c7e9cbbd584d0cee80273
      
https://github.com/qemu/qemu/commit/5f14f31d2bbb2c00b59c7e9cbbd584d0cee80273
  Author: shiliyang <shiliyang@huawei.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block/blkdebug.c
    M block/dmg.c
    M block/qcow2.c
    M block/qcow2.h
    M block/vpc.c

  Log Message:
  -----------
  block: Fix some code style problems, "foo* bar" should be "foo *bar"

There have some code style problems be found when read the block driver code.
So I fixes some problems of this error, ERROR: "foo* bar" should be "foo *bar".

Signed-off-by: Liyang Shi <shiliyang@huawei.com>
Reported-by: Euler Robot <euler.robot@huawei.com>
Message-Id: <3211f389-6d22-46c1-4a16-e6a2ba66f070@huawei.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 6c5f7b3a1002ebe552782de4f3664a486d444323
      
https://github.com/qemu/qemu/commit/6c5f7b3a1002ebe552782de4f3664a486d444323
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: add forgotten bdrv_abort_perm_update() to bdrv_co_invalidate_cache()

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201106124241.16950-2-vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 313274bbd4677f44631921ef4366f4ffc81cc5d5
      
https://github.com/qemu/qemu/commit/313274bbd4677f44631921ef4366f4ffc81cc5d5
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: add bdrv_replace_node_common()

Add new parameter to bdrv_replace_node(): auto_skip. With
auto_skip=false we'll have stricter behavior: update _all_ from
parents or fail. New behaviour will be used in the following commit in
block.c, so keep original function name as public interface.

Note: new error message is a bit funny in contrast with further
"Cannot" in case of frozen child, but we'd better keep some difference
to make it possible to distinguish one from another on failure. Still,
actually we'd better refactor should_update_child() call to distinguish
also different kinds of "should not". Let's do it later.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201106124241.16950-3-vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: d669ed6ab028497d634e1f236c74a98725f9e45f
      
https://github.com/qemu/qemu/commit/d669ed6ab028497d634e1f236c74a98725f9e45f
  Author: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M block.c

  Log Message:
  -----------
  block: make bdrv_drop_intermediate() less wrong

First, permission update loop tries to do iterations transactionally,
but the whole update is not transactional: nobody roll-back successful
loop iterations when some iteration fails.

Second, in the iteration we have nested permission update:
c->klass->update_filename may point to bdrv_child_cb_update_filename()
which calls bdrv_backing_update_filename(), which may do node reopen to
RW.

Permission update system is not prepared to nested updates, at least it
has intermediate permission-update state stored in BdrvChild
structures: has_backup_perm, backup_perm and backup_shared_perm.

So, let's first do bdrv_replace_node_common() (which is more
transactional than open-coded update in bdrv_drop_intermediate()) and
then call update_filename() in separate. We still do not rollback
changes in case of update_filename() failure but it's not much worse
than pre-patch behavior.

Note that bdrv_replace_node_common() does check for frozen children,
so corresponding check is dropped in bdrv_drop_intermediate().

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201106124241.16950-4-vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>


  Commit: 2b030ce1ed75e075d35b0d1008a0cacd73624b28
      
https://github.com/qemu/qemu/commit/2b030ce1ed75e075d35b0d1008a0cacd73624b28
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M .cirrus.yml
    M block.c
    M block/blkdebug.c
    M block/dmg-lzfse.c
    M block/dmg.c
    M block/nfs.c
    M block/qcow2-cluster.c
    M block/qcow2.c
    M block/qcow2.h
    M block/vpc.c
    M hw/block/nvme.c
    M include/block/block.h
    M include/block/block_int.h
    M tests/qemu-iotests/240
    M tests/qemu-iotests/240.out
    M tests/qemu-iotests/iotests.py

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/maxreitz/tags/pull-block-2020-11-09-v2' 
into staging

Block patches for 5.2.0-rc1:
- Some nvme fixes (addressing problems spotted by Coverity)
- Fix nfs compiling on mingw (and enable it in Cirrus)
- Fix an error path in bdrv_co_invalidate_cache() (permission update
  was initiated, but not aborted)
- Fix (on-error) roll back in bdrv_drop_intermediate(): Instead of
  inlining bdrv_replace_node() (wrongly), call that function
- Fix for iotest 240
- Fix error handling in bdrv_getlength()
- Be more explicit about how QCowL2Meta objects are handled
- Cleanups

# gpg: Signature made Mon 09 Nov 2020 17:45:06 GMT
# gpg:                using RSA key 91BEB60A30DB3E8857D11829F407DB0061D5CF40
# gpg:                issuer "mreitz@redhat.com"
# gpg: Good signature from "Max Reitz <mreitz@redhat.com>" [full]
# Primary key fingerprint: 91BE B60A 30DB 3E88 57D1  1829 F407 DB00 61D5 CF40

* remotes/maxreitz/tags/pull-block-2020-11-09-v2:
  block: make bdrv_drop_intermediate() less wrong
  block: add bdrv_replace_node_common()
  block: add forgotten bdrv_abort_perm_update() to bdrv_co_invalidate_cache()
  block: Fix some code style problems, "foo* bar" should be "foo *bar"
  block: Fix integer promotion error in bdrv_getlength()
  block: enable libnfs on msys2/mingw in cirrus.yml
  block: Fixes nfs compiling error on msys2/mingw
  iotests: rewrite iotest 240 in python
  iotests: add filter_qmp_virtio_scsi function
  hw/block/nvme: fix free of array-typed value
  hw/block/nvme: fix uint16_t use of uint32_t sgls member
  hw/block/nvme: fix null ns in register namespace
  qcow2: Document and enforce the QCowL2Meta invariants
  block: Move bdrv_drain_all_end_quiesce() to block_int.h
  block: Remove unused include

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: b1b9ab1c04d560f86d8da3dfca4d8b21de75fee6
      
https://github.com/qemu/qemu/commit/b1b9ab1c04d560f86d8da3dfca4d8b21de75fee6
  Author: Michael Roth <michael.roth@amd.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M qga/commands-posix.c

  Log Message:
  -----------
  qga: fix missing closedir() in qmp_guest_get_disks()

We opendir("/sys/block") at the beginning of the function, but we never
close it prior to returning.

Fixes: Coverity CID 1436130
Fixes: fed3956429d5 ("qga: add implementation of guest-get-disks for Linux")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Tomáš Golembiovský <tgolembi@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Michael Roth <michael.roth@amd.com>


  Commit: 43afbbd9fea1b255cc81f5f4bfd0b6a88826c735
      
https://github.com/qemu/qemu/commit/43afbbd9fea1b255cc81f5f4bfd0b6a88826c735
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M qga/commands-posix.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/mdroth/tags/qga-pull-2020-11-09-tag' 
into staging

qemu-ga patch queue for hard-freeze

* fix leaked DIR* descriptor in guest-get-disks spotted by coverity

# gpg: Signature made Mon 09 Nov 2020 20:11:08 GMT
# gpg:                using RSA key CEACC9E15534EBABB82D3FA03353C9CEF108B584
# gpg:                issuer "michael.roth@amd.com"
# gpg: Good signature from "Michael Roth <flukshun@gmail.com>" [full]
# gpg:                 aka "Michael Roth <mdroth@utexas.edu>" [full]
# gpg:                 aka "Michael Roth <mdroth@linux.vnet.ibm.com>" [full]
# Primary key fingerprint: CEAC C9E1 5534 EBAB B82D  3FA0 3353 C9CE F108 B584

* remotes/mdroth/tags/qga-pull-2020-11-09-tag:
  qga: fix missing closedir() in qmp_guest_get_disks()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: c445593d30037d0c82241e8ec23eb845bca476e9
      
https://github.com/qemu/qemu/commit/c445593d30037d0c82241e8ec23eb845bca476e9
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M target/riscv/cpu-param.h
    M target/riscv/cpu.h
    M target/riscv/cpu_helper.c

  Log Message:
  -----------
  target/riscv: Add a virtualised MMU Mode

Add a new MMU mode that includes the current virt mode.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 
4b301bc0ea36da962fc1605371b65019ac3073df.1604464950.git.alistair.francis@wdc.com


  Commit: 3e5979046f3f5f65828d3950d0c3ec9846d63715
      
https://github.com/qemu/qemu/commit/3e5979046f3f5f65828d3950d0c3ec9846d63715
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M target/riscv/op_helper.c

  Log Message:
  -----------
  target/riscv: Set the virtualised MMU mode when doing hyp accesses

When performing the hypervisor load/store operations set the MMU mode to
indicate that we are virtualised.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 
e411c61a1452cad16853f13cac2fb86dc91ebee8.1604464950.git.alistair.francis@wdc.com


  Commit: 1c1c060aa866986ef8b7eb334abbb8c104a46e5c
      
https://github.com/qemu/qemu/commit/1c1c060aa866986ef8b7eb334abbb8c104a46e5c
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M target/riscv/cpu.h
    M target/riscv/cpu_bits.h
    M target/riscv/cpu_helper.c
    M target/riscv/op_helper.c

  Log Message:
  -----------
  target/riscv: Remove the HS_TWO_STAGE flag

The HS_TWO_STAGE flag is no longer required as the MMU index contains
the information if we are performing a two stage access.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 
f514b128b1ff0fb41c85f914cee18f905007a922.1604464950.git.alistair.francis@wdc.com


  Commit: 743077b35b1ed88ed243daefafe9403d88a958f6
      
https://github.com/qemu/qemu/commit/743077b35b1ed88ed243daefafe9403d88a958f6
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M target/riscv/cpu.h
    M target/riscv/helper.h
    M target/riscv/insn_trans/trans_rvh.c.inc
    M target/riscv/op_helper.c
    M target/riscv/translate.c

  Log Message:
  -----------
  target/riscv: Remove the hyp load and store functions

Remove the special Virtulisation load and store functions and just use
the standard tcg tcg_gen_qemu_ld_tl() and tcg_gen_qemu_st_tl() functions
instead.

As part of this change we ensure we still run an access check to make
sure we can perform the operations.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 
189ac3e53ef2854824d18aad7074c6649f17de2c.1604464950.git.alistair.francis@wdc.com


  Commit: 7687537ab0c16e0b1e69e7707456573a64b8e13b
      
https://github.com/qemu/qemu/commit/7687537ab0c16e0b1e69e7707456573a64b8e13b
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M target/riscv/helper.h
    M target/riscv/insn_trans/trans_rvh.c.inc
    M target/riscv/op_helper.c

  Log Message:
  -----------
  target/riscv: Split the Hypervisor execute load helpers

Split the hypervisor execute load functions into two seperate functions.
This avoids us having to pass the memop to the C helper functions.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 
5b1550f0faa3c435cc77f3c1ae811dea98ab9e36.1604464950.git.alistair.francis@wdc.com


  Commit: 96338fefc19a143abdc91f6c44f37683274b08d4
      
https://github.com/qemu/qemu/commit/96338fefc19a143abdc91f6c44f37683274b08d4
  Author: Alistair Francis <alistair.francis@wdc.com>
  Date:   2020-11-09 (Mon, 09 Nov 2020)

  Changed paths:
    M hw/intc/ibex_plic.c

  Log Message:
  -----------
  hw/intc/ibex_plic: Clear the claim register when read

After claiming the interrupt by reading the claim register we want to
clear the register to make sure the interrupt doesn't appear at the next
read.

This matches the documentation for the claim register as when an interrupt
is claimed by a target the relevant bit of IP is cleared (which we already
do): https://docs.opentitan.org/hw/ip/rv_plic/doc/index.html

This also matches the current hardware.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 
68d4575deef2559b7a747f3bda193fcf43af4558.1604629928.git.alistair.francis@wdc.com


  Commit: b8ae597f0e6df9d1d80e07083fabf763fcb46013
      
https://github.com/qemu/qemu/commit/b8ae597f0e6df9d1d80e07083fabf763fcb46013
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M linux-user/sparc/signal.c

  Log Message:
  -----------
  linux-user/sparc: Fix errors in target_ucontext structures

The various structs that make up the SPARC target_ucontext had some
errors:
 * target structures must not include fields which are host pointers,
   which might be the wrong size.  These should be abi_ulong instead
 * because we don't have the 'long double' part of the mcfpu_fregs
   union in our version of the target_mc_fpu struct, we need to
   manually force it to be 16-aligned

In particular, the lack of 16-alignment caused sparc64_get_context()
and sparc64_set_context() to read and write all the registers at the
wrong offset, which triggered a guest glibc stack check in
siglongjmp:
  *** longjmp causes uninitialized stack frame ***: terminated
when trying to run bash.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20201105212314.9628-2-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: 266b41582e0de8c30707614d6733ecf6485c7677
      
https://github.com/qemu/qemu/commit/266b41582e0de8c30707614d6733ecf6485c7677
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M linux-user/sparc/signal.c

  Log Message:
  -----------
  linux-user/sparc: Correct set/get_context handling of fp and i7

Because QEMU's user-mode emulation just directly accesses guest CPU
state, for SPARC the guest register window state is not the same in
the sparc64_get_context() and sparc64_set_context() functions as it
is for the real kernel's versions of those functions.  Specifically,
for the kernel it has saved the user space state such that the O*
registers go into a pt_regs struct as UREG_I*, and the I* registers
have been spilled onto the userspace stack.  For QEMU, we haven't
done that, so the guest's O* registers are still in WREG_O* and the
I* registers in WREG_I*.

The code was already accessing the O* registers correctly for QEMU,
but had copied the kernel code for accessing the I* registers off the
userspace stack.  Replace this with direct accesses to fp and i7 in
the CPU state, and add a comment explaining why we differ from the
kernel code here.

This fix is sufficient to get bash to a shell prompt.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20201105212314.9628-3-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: c3ab5df2f5c466d998917f2c707e206322063dcd
      
https://github.com/qemu/qemu/commit/c3ab5df2f5c466d998917f2c707e206322063dcd
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M linux-user/sparc/signal.c

  Log Message:
  -----------
  linux-user/sparc: Don't zero high half of PC, NPC, PSR in sigreturn

The function do_sigreturn() tries to store the PC, NPC and PSR in
uint32_t local variables, which implicitly drops the high half of
these fields for 64-bit guests.

The usual effect was that a guest which used signals would crash on
return from a signal unless it was lucky enough to take it while the
PC was in the low 4GB of the address space.  In particular, Debian
/bin/dash and /bin/bash would segfault after executing external
commands.

Use abi_ulong, which is the type these fields all have in the
__siginfo_t struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20201105212314.9628-4-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: 3758e88bb8b38d54134a90f5afd6b21c7495ed5a
      
https://github.com/qemu/qemu/commit/3758e88bb8b38d54134a90f5afd6b21c7495ed5a
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M MAINTAINERS

  Log Message:
  -----------
  MAINTAINERS: Add gitlab-pipeline-status script to GitLab CI section

Do not let the gitlab-pipeline-status script unmaintained,
add it to the 'GitLab Continuous Integration' section.

Fixes: c02b2eac55e ("GitLab Gating CI: introduce pipeline-status contrib 
script")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201108204535.2319870-5-philmd@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: f3a0208f24775c23c3db867a5e6df889d5132ed6
      
https://github.com/qemu/qemu/commit/f3a0208f24775c23c3db867a5e6df889d5132ed6
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M MAINTAINERS
    A docs/devel/fuzzing.rst
    R docs/devel/fuzzing.txt
    M docs/devel/index.rst

  Log Message:
  -----------
  docs/fuzz: rST-ify the fuzzing documentation

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201106180600.360110-2-alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: e6a3e1322ba9e05a7919d9cd10d05c8c23fa8698
      
https://github.com/qemu/qemu/commit/e6a3e1322ba9e05a7919d9cd10d05c8c23fa8698
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M docs/devel/fuzzing.rst

  Log Message:
  -----------
  docs/fuzz: update fuzzing documentation post-meson

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201106180600.360110-3-alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: bb451d248719aaa6c32524e418444a1b8159b7dd
      
https://github.com/qemu/qemu/commit/bb451d248719aaa6c32524e418444a1b8159b7dd
  Author: Alexander Bulekov <alxndr@bu.edu>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M scripts/oss-fuzz/build.sh

  Log Message:
  -----------
  scripts/oss-fuzz: give all fuzzers -target names

We switched to hardlinks in
a942f64cc4 ("scripts/oss-fuzz: use hardlinks instead of copying")

The motivation was to conserve space (50 fuzzers built with ASAN, can
weigh close to 9 GB).

Unfortunately, OSS-Fuzz (partially) treated the underlying copy of the
fuzzer as a standalone fuzzer. To attempt to fix, we tried:

f8b8f37463 ("scripts/oss-fuzz: rename bin/qemu-fuzz-i386")

This was also not a complete fix, because though OSS-Fuzz
ignores the renamed fuzzer, the underlying ClusterFuzz, doesn't:
https://storage.googleapis.com/clusterfuzz-builds/qemu/targets.list.address
https://oss-fuzz-build-logs.storage.googleapis.com/log-9bfb55f9-1c20-4aa6-a49c-ede12864eeb2.txt
(clusterfuzz still lists qemu-fuzz-i386.base as a fuzzer)

This change keeps the hard-links, but makes them all point to a file
with a qemu-fuzz-i386-target-.. name. If we have targets, A, B, C, the
result will be:

qemu-fuzz-i386-target-A (base file)
qemu-fuzz-i386-target-B -> qemu-fuzz-i386-target-A
qemu-fuzz-i386-target-C -> qemu-fuzz-i386-target-A

The result should be that every file that looks like a fuzzer to
OSS-Fuzz/ClusterFuzz, can run as a fuzzer (we don't have a separate base
copy). Unfortunately, there is not simple way to test this locally.

In the future, it might be worth it to link the majority of QEMU in as a
shared-object (see https://github.com/google/oss-fuzz/issues/4575 )

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20201108171136.160607-1-alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: aba378dee666fe2aa07f3d318fdf904f454389af
      
https://github.com/qemu/qemu/commit/aba378dee666fe2aa07f3d318fdf904f454389af
  Author: Daniele Buono <dbuono@linux.vnet.ibm.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz/fork_fuzz.ld

  Log Message:
  -----------
  fuzz: Make fork_fuzz.ld compatible with LLVM's LLD

LLVM's linker, LLD, supports the keyword "INSERT AFTER", starting with
version 11.
However, when multiple sections are defined in the same "INSERT AFTER",
they are added in a reversed order, compared to BFD's LD.

This patch makes fork_fuzz.ld generic enough to work with both linkers.
Each section now has its own "INSERT AFTER" keyword, so proper ordering is
defined between the sections added.

Signed-off-by: Daniele Buono <dbuono@linux.vnet.ibm.com>
Message-Id: <20201105221905.1350-2-dbuono@linux.vnet.ibm.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 2deca810d8c2b8d0c56782ef8d9f4bfbfcacd261
      
https://github.com/qemu/qemu/commit/2deca810d8c2b8d0c56782ef8d9f4bfbfcacd261
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M configure

  Log Message:
  -----------
  configure: surface deprecated targets in the help output

Show the targets but keep them separate from the main list.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20201029201449.6926-1-alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 4daa9055beffa17ed47a71d52e7af219acc38e29
      
https://github.com/qemu/qemu/commit/4daa9055beffa17ed47a71d52e7af219acc38e29
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M .gitlab-ci.yml

  Log Message:
  -----------
  gitlab: publish the docs built during CI

Most of the build jobs will create the sphinx documentation. If we
expose this as an artifact of a "pages" job in a "public" directory, it
will get published using GitLab Pages. This means a user can push a
branch with docs changes to GitLab and view the results at

  https://yourusername.gitlab.io/qemu/

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20201102130926.161183-2-berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: d0f26e68a0545db5010e8fac7386739a2c7213b3
      
https://github.com/qemu/qemu/commit/d0f26e68a0545db5010e8fac7386739a2c7213b3
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M .gitlab-ci.yml

  Log Message:
  -----------
  gitlab: force enable docs build in Fedora, Ubuntu, Debian

Meson runs a test to see if Sphinx works, and automatically disables it
on error. This can lead to the CI jobs skipping docs build without
maintainers noticing the problem. Use --enable-docs to force a fatal
error if Sphinx doesn't work on the jobs where we expect it to be OK.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20201102130926.161183-3-berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 704a256da83d6535fce879ba4137299bbe626e5e
      
https://github.com/qemu/qemu/commit/704a256da83d6535fce879ba4137299bbe626e5e
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    A docs/_templates/editpage.html
    M docs/conf.py
    A docs/devel/_templates/editpage.html
    A docs/interop/_templates/editpage.html
    A docs/specs/_templates/editpage.html
    A docs/system/_templates/editpage.html
    A docs/tools/_templates/editpage.html
    A docs/user/_templates/editpage.html

  Log Message:
  -----------
  docs: add "page source" link to sphinx documentation

Add a link to the top of the sidebar in every docs page that takes the
user back to the source code in gitlab.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20201102130926.161183-5-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: d4e279141bf59e702beae3a1002b482f733a2ac2
      
https://github.com/qemu/qemu/commit/d4e279141bf59e702beae3a1002b482f733a2ac2
  Author: Dima Stepanov <dimastep@yandex-team.ru>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M tests/qtest/fuzz/meson.build
    A tests/qtest/fuzz/virtio_blk_fuzz.c

  Log Message:
  -----------
  fuzz: add virtio-blk fuzz target

The virtio-blk fuzz target sets up and fuzzes the available virtio-blk
queues. The implementation is based on two files:
  - tests/qtest/fuzz/virtio_scsi_fuzz.c
  - tests/qtest/virtio_blk_test.c

Signed-off-by: Dima Stepanov <dimastep@yandex-team.ru>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: 
<e2405c459302ecaee2555405604975353bfa3837.1604920905.git.dimastep@yandex-team.ru>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: ad57e2b1f53f507392807e6e2b36c34454b270fa
      
https://github.com/qemu/qemu/commit/ad57e2b1f53f507392807e6e2b36c34454b270fa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M tests/qtest/libqos/libqtest.h
    M tests/qtest/libqtest-single.h

  Log Message:
  -----------
  qtest: Update references to parse_escape() in comments

In commit 61030280ca2d67bd in 2018 we renamed the parse_escape()
function to parse_interpolation(), but we didn't catch the references
to this function in doc comments in libqtest.h. Update them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20201109162621.18885-1-peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: 074df27f744f0a72f8b33b2fd5a6cdc557f48f7b
      
https://github.com/qemu/qemu/commit/074df27f744f0a72f8b33b2fd5a6cdc557f48f7b
  Author: Daniele Buono <dbuono@linux.vnet.ibm.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M target/s390x/cpu_models.c

  Log Message:
  -----------
  s390x: fix clang 11 warnings in cpu_models.c

There are void * pointers that get casted to enums, in cpu_models.c
Such casts can result in a small integer type and are caught as
warnings with clang, starting with version 11:

Clang 11 finds a bunch of spots in the code that trigger this new warnings:

../qemu-base/target/s390x/cpu_models.c:985:21: error: cast to smaller integer 
type 'S390Feat' from 'void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    S390Feat feat = (S390Feat) opaque;
                    ^~~~~~~~~~~~~~~~~
../qemu-base/target/s390x/cpu_models.c:1002:21: error: cast to smaller integer 
type 'S390Feat' from 'void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    S390Feat feat = (S390Feat) opaque;
                    ^~~~~~~~~~~~~~~~~
../qemu-base/target/s390x/cpu_models.c:1036:27: error: cast to smaller integer 
type 'S390FeatGroup' from 'void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    S390FeatGroup group = (S390FeatGroup) opaque;
                          ^~~~~~~~~~~~~~~~~~~~~~
../qemu-base/target/s390x/cpu_models.c:1057:27: error: cast to smaller integer 
type 'S390FeatGroup' from 'void *' [-Werror,-Wvoid-pointer-to-enum-cast]
    S390FeatGroup group = (S390FeatGroup) opaque;
                          ^~~~~~~~~~~~~~~~~~~~~~
4 errors generated.

Avoid this warning by casting the pointer to uintptr_t first.

Signed-off-by: Daniele Buono <dbuono@linux.vnet.ibm.com>
Message-Id: <20201105221905.1350-3-dbuono@linux.vnet.ibm.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: a58cabd0e355fc51f18db359ba260da268df26ef
      
https://github.com/qemu/qemu/commit/a58cabd0e355fc51f18db359ba260da268df26ef
  Author: Daniele Buono <dbuono@linux.vnet.ibm.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/s390x/ipl.h

  Log Message:
  -----------
  s390x: Avoid variable size warning in ipl.h

S390IPLState contains two IplParameterBlock, which may in turn have
either a IPLBlockPV or a IplBlockFcp, both ending with a variable
sized field (an array).

This causes a warning with clang 11 or greater, which checks that
variable sized type are only allocated at the end of the struct:

In file included from ../qemu-cfi-v3/target/s390x/diag.c:21:
../qemu-cfi-v3/hw/s390x/ipl.h:161:23: error: field 'iplb' with variable sized 
type 'IplParameterBlock' (aka 'union IplParameterBlock') not at the end of a 
struct or class is a GNU extension 
[-Werror,-Wgnu-variable-sized-type-not-at-end]
    IplParameterBlock iplb;
                      ^
../qemu-cfi-v3/hw/s390x/ipl.h:162:23: error: field 'iplb_pv' with variable 
sized type 'IplParameterBlock' (aka 'union IplParameterBlock') not at the end 
of a struct or class is a GNU extension 
[-Werror,-Wgnu-variable-sized-type-not-at-end]
    IplParameterBlock iplb_pv;

In this case, however, the warning is a false positive, because
IPLBlockPV and IplBlockFcp are allocated in a union wrapped at 4K,
making the union non-variable sized.

Fix the warning by turning the two variable sized arrays into arrays
of size 0. This avoids the compiler error and should produce the
same code.

Signed-off-by: Daniele Buono <dbuono@linux.vnet.ibm.com>
Message-Id: <20201105221905.1350-5-dbuono@linux.vnet.ibm.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>


  Commit: f7e1914adad8885a5d4c70239ab90d901ed97e9f
      
https://github.com/qemu/qemu/commit/f7e1914adad8885a5d4c70239ab90d901ed97e9f
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/intc/ibex_plic.c
    M target/riscv/cpu-param.h
    M target/riscv/cpu.h
    M target/riscv/cpu_bits.h
    M target/riscv/cpu_helper.c
    M target/riscv/helper.h
    M target/riscv/insn_trans/trans_rvh.c.inc
    M target/riscv/op_helper.c
    M target/riscv/translate.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging

This fixes two bugs in the RISC-V port. One is a bug in the
Ibex PLIC, the other fixes the Hypvervisor access functions.

# gpg: Signature made Tue 10 Nov 2020 03:53:49 GMT
# gpg:                using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full]
# Primary key fingerprint: F6C4 AC46 D493 4868 D3B8  CE8F 21E1 0D29 DF97 7054

* remotes/alistair/tags/pull-riscv-to-apply-20201109:
  hw/intc/ibex_plic: Clear the claim register when read
  target/riscv: Split the Hypervisor execute load helpers
  target/riscv: Remove the hyp load and store functions
  target/riscv: Remove the HS_TWO_STAGE flag
  target/riscv: Set the virtualised MMU mode when doing hyp accesses
  target/riscv: Add a virtualised MMU Mode

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 6c8e801f076109a31d864fdbeec57badd159fb06
      
https://github.com/qemu/qemu/commit/6c8e801f076109a31d864fdbeec57badd159fb06
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M linux-user/sparc/signal.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/vivier2/tags/linux-user-for-5.2-pull-request' into staging

Some linux-user/sparc fixes

# gpg: Signature made Tue 10 Nov 2020 08:30:17 GMT
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "laurent@vivier.eu"
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full]
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" 
[full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-5.2-pull-request:
  linux-user/sparc: Don't zero high half of PC, NPC, PSR in sigreturn
  linux-user/sparc: Correct set/get_context handling of fp and i7
  linux-user/sparc: Fix errors in target_ucontext structures

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 9ad5f6b05f181b36bc368e2bf60b1548d2937667
      
https://github.com/qemu/qemu/commit/9ad5f6b05f181b36bc368e2bf60b1548d2937667
  Author: Andrew Jones <drjones@redhat.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/Kconfig

  Log Message:
  -----------
  hw/arm/Kconfig: ARM_V7M depends on PTIMER

commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
changed armv7m_systick to build on ptimers. Make sure we have ptimers
in the build when building armv7m_systick.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20201104103343.30392-1-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 9df0a97298292f1638d4de9258ff1fc9092b7813
      
https://github.com/qemu/qemu/commit/9df0a97298292f1638d4de9258ff1fc9092b7813
  Author: AlexChen <alex.chen@huawei.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/ssi/imx_spi.c
    M hw/ssi/xilinx_spi.c

  Log Message:
  -----------
  ssi: Fix bad printf format specifiers

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: bdc3b6f570e8bd219aa6a24a149b35a691e6986c
      
https://github.com/qemu/qemu/commit/bdc3b6f570e8bd219aa6a24a149b35a691e6986c
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M target/arm/arch_dump.c
    M target/arm/arm-semi.c
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: add spaces around operator

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 6eb55edbabb9eed1e4c7dfb233e7d738e8b5fa89
      
https://github.com/qemu/qemu/commit/6eb55edbabb9eed1e4c7dfb233e7d738e8b5fa89
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M target/arm/translate-a64.c

  Log Message:
  -----------
  target/arm: Don't use '#' flag of printf format

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 7f350a87e3a85e8a260ce4b133d549a7b2789213
      
https://github.com/qemu/qemu/commit/7f350a87e3a85e8a260ce4b133d549a7b2789213
  Author: Xinhao Zhang <zhangxinhao1@huawei.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M target/arm/translate.c

  Log Message:
  -----------
  target/arm: add space before the open parenthesis '('

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 0339c2a86fe645413b884ac96f7a7d5d9ce9e39e
      
https://github.com/qemu/qemu/commit/0339c2a86fe645413b884ac96f7a7d5d9ce9e39e
  Author: Alex Bennée <alex.bennee@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    A docs/system/arm/sbsa.rst
    M docs/system/target-arm.rst

  Log Message:
  -----------
  docs: add some notes on the sbsa-ref machine

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: bec3c97e0cf9a80f555dc056cc60b53fcd43c424
      
https://github.com/qemu/qemu/commit/bec3c97e0cf9a80f555dc056cc60b53fcd43c424
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/Kconfig

  Log Message:
  -----------
  hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals

When using a Cortex-A15, the Virt machine does not use any
MPCore peripherals. Remove the dependency.

Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with 
Kconfig")
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20201107114852.271922-1-philmd@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 604cef3e57eaeeef77074d78f6cf2eca1be11c62
      
https://github.com/qemu/qemu/commit/604cef3e57eaeeef77074d78f6cf2eca1be11c62
  Author: Richard Henderson <richard.henderson@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M target/arm/helper.h
    M target/arm/op_helper.c
    M target/arm/translate-neon.c.inc

  Log Message:
  -----------
  target/arm: Fix neon VTBL/VTBX for len > 1

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 509602eed4d5d51cb71911ffc9c5ecc1cd04db06
      
https://github.com/qemu/qemu/commit/509602eed4d5d51cb71911ffc9c5ecc1cd04db06
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/armsse.c

  Log Message:
  -----------
  hw/arm/armsse: Correct expansion MPC interrupt lines

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 2108e5092a67aaaa710845159cab9df514e28716
      
https://github.com/qemu/qemu/commit/2108e5092a67aaaa710845159cab9df514e28716
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/stm32f205_soc.c
    M hw/misc/stm32f2xx_syscfg.c
    M include/hw/misc/stm32f2xx_syscfg.h

  Log Message:
  -----------
  hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: bdad3654d3c55f478e538037d9eccd204e5fc8ee
      
https://github.com/qemu/qemu/commit/bdad3654d3c55f478e538037d9eccd204e5fc8ee
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/nseries.c

  Log Message:
  -----------
  hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 498661dd22a1b60461e41d256a7197fea3c4ff0e
      
https://github.com/qemu/qemu/commit/498661dd22a1b60461e41d256a7197fea3c4ff0e
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/Kconfig
    M hw/arm/musicpal.c

  Log Message:
  -----------
  hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 44cbf34975b81ac40e715cd3ee488a114d7b7d29
      
https://github.com/qemu/qemu/commit/44cbf34975b81ac40e715cd3ee488a114d7b7d29
  Author: Philippe Mathieu-Daudé <f4bug@amsat.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/musicpal.c

  Log Message:
  -----------
  hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 0e5dc775736fda574e0df9c4c9a29c92201833fe
      
https://github.com/qemu/qemu/commit/0e5dc775736fda574e0df9c4c9a29c92201833fe
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M hw/arm/nseries.c

  Log Message:
  -----------
  hw/arm/nseries: Check return value from load_image_targphys()

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org


  Commit: 8006c9842bf6f52fdcfb1c8f64c9bd714e661301
      
https://github.com/qemu/qemu/commit/8006c9842bf6f52fdcfb1c8f64c9bd714e661301
  Author: Havard Skinnemoen <hskinnemoen@google.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M tests/qtest/npcm7xx_rng-test.c

  Log Message:
  -----------
  tests/qtest/npcm7xx_rng-test: count runs properly

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: b6c56c8a9a4064ea783f352f43c5df6231a110fa
      
https://github.com/qemu/qemu/commit/b6c56c8a9a4064ea783f352f43c5df6231a110fa
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M target/arm/translate-neon.c.inc

  Log Message:
  -----------
  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org


  Commit: a3a929083b03c839b3c87c461769e605ec79b0a7
      
https://github.com/qemu/qemu/commit/a3a929083b03c839b3c87c461769e605ec79b0a7
  Author: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M softmmu/physmem.c

  Log Message:
  -----------
  physmem: improve ram size error messages

 Ram size mismatch condition logs below message.

   "Length mismatch: pc.ram: 0x80000000 in != 0x180000000: Invalid argument"

 This patch improves the readability of error messages.
 Removed the superflous "in" and changed "Length" to "Size".

Signed-off-by: Pankaj Gupta <pankaj.gupta.linux@gmail.com>
Reported-by: Li Zhang <li.zhang@cloud.ionos.com>
Message-Id: <20201022111302.8105-1-pankaj.gupta.linux@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: 879860ca706fa1ef47ba511c49a6e2b1b49be9b7
      
https://github.com/qemu/qemu/commit/879860ca706fa1ef47ba511c49a6e2b1b49be9b7
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M .gitlab-ci.yml
    M MAINTAINERS
    M configure
    A docs/_templates/editpage.html
    M docs/conf.py
    A docs/devel/_templates/editpage.html
    A docs/devel/fuzzing.rst
    R docs/devel/fuzzing.txt
    M docs/devel/index.rst
    A docs/interop/_templates/editpage.html
    A docs/specs/_templates/editpage.html
    A docs/system/_templates/editpage.html
    A docs/tools/_templates/editpage.html
    A docs/user/_templates/editpage.html
    M hw/s390x/ipl.h
    M meson.build
    M scripts/device-crash-test
    M scripts/oss-fuzz/build.sh
    M target/s390x/cpu_models.c
    M tests/qtest/arm-cpu-features.c
    M tests/qtest/fuzz/fork_fuzz.ld
    M tests/qtest/fuzz/meson.build
    A tests/qtest/fuzz/virtio_blk_fuzz.c
    M tests/qtest/libqos/libqtest.h
    M tests/qtest/libqtest-single.h
    M tests/qtest/tpm-tests.c
    M tests/vm/openbsd

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/huth-gitlab/tags/pull-request-2020-11-10' into staging

* Some small qtest fixes
* Oss-fuzz updates
* Publish the docs built during gitlab CI to the user's gitlab.io page
* Update the OpenBSD VM test to v6.8
* Fix the device-crash-test script to run with the meson build system
* Some small s390x fixes

# gpg: Signature made Tue 10 Nov 2020 11:05:06 GMT
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* remotes/huth-gitlab/tags/pull-request-2020-11-10:
  s390x: Avoid variable size warning in ipl.h
  s390x: fix clang 11 warnings in cpu_models.c
  qtest: Update references to parse_escape() in comments
  fuzz: add virtio-blk fuzz target
  docs: add "page source" link to sphinx documentation
  gitlab: force enable docs build in Fedora, Ubuntu, Debian
  gitlab: publish the docs built during CI
  configure: surface deprecated targets in the help output
  fuzz: Make fork_fuzz.ld compatible with LLVM's LLD
  scripts/oss-fuzz: give all fuzzers -target names
  docs/fuzz: update fuzzing documentation post-meson
  docs/fuzz: rST-ify the fuzzing documentation
  MAINTAINERS: Add gitlab-pipeline-status script to GitLab CI section
  gitlab-ci: Drop generic cache rule
  tests/qtest/tpm: Remove redundant check in the tpm_test_swtpm_test()
  qtest: Fix bad printf format specifiers
  device-crash-test: Check if path is actually an executable file
  tests/vm: update openbsd to release 6.8
  meson: always include contrib/libvhost-user

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 3e7d06d05a3689972171ad6a289315d54ea2e915
      
https://github.com/qemu/qemu/commit/3e7d06d05a3689972171ad6a289315d54ea2e915
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    A docs/system/arm/sbsa.rst
    M docs/system/target-arm.rst
    M hw/arm/Kconfig
    M hw/arm/armsse.c
    M hw/arm/musicpal.c
    M hw/arm/nseries.c
    M hw/arm/stm32f205_soc.c
    M hw/misc/stm32f2xx_syscfg.c
    M hw/ssi/imx_spi.c
    M hw/ssi/xilinx_spi.c
    M include/hw/misc/stm32f2xx_syscfg.h
    M target/arm/arch_dump.c
    M target/arm/arm-semi.c
    M target/arm/helper.c
    M target/arm/helper.h
    M target/arm/op_helper.c
    M target/arm/translate-a64.c
    M target/arm/translate-neon.c.inc
    M target/arm/translate.c
    M tests/qtest/npcm7xx_rng-test.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20201110' 
into staging

target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

# gpg: Signature made Tue 10 Nov 2020 11:17:45 GMT
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" 
[ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20201110:
  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
  tests/qtest/npcm7xx_rng-test: count runs properly
  hw/arm/nseries: Check return value from load_image_targphys()
  hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  hw/arm/armsse: Correct expansion MPC interrupt lines
  target/arm: Fix neon VTBL/VTBX for len > 1
  hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
  docs: add some notes on the sbsa-ref machine
  target/arm: add space before the open parenthesis '('
  target/arm: Don't use '#' flag of printf format
  target/arm: add spaces around operator
  ssi: Fix bad printf format specifiers
  hw/arm/Kconfig: ARM_V7M depends on PTIMER

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: c6f28ed5075df79fef39c500362a3f4089256c9c
      
https://github.com/qemu/qemu/commit/c6f28ed5075df79fef39c500362a3f4089256c9c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-10 (Tue, 10 Nov 2020)

  Changed paths:
    M VERSION

  Log Message:
  -----------
  Update version for v5.2.0-rc1 release

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: e87936ea299d8204e496b5ff19ffdca46c21610e
      
https://github.com/qemu/qemu/commit/e87936ea299d8204e496b5ff19ffdca46c21610e
  Author: Cindy Lu <lulu@redhat.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/net/virtio-net.c

  Log Message:
  -----------
  virtio-net: Set mac address to hardware if the peer is vdpa

If the peer's type is vdpa, we need to set the mac address to hardware
in virtio_net_device_realize,

Signed-off-by: Cindy Lu <lulu@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: b492a4b8cad9977334fa4c80983e686184d6bb30
      
https://github.com/qemu/qemu/commit/b492a4b8cad9977334fa4c80983e686184d6bb30
  Author: Pan Nengyuan <pannengyuan@huawei.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/filter-rewriter.c

  Log Message:
  -----------
  net/filter-rewriter: destroy g_hash_table in colo_rewriter_cleanup

s->connection_track_table forgot to destroy in colo_rewriter_cleanup. Fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 33609e95b206788681263b76d6649a556d064e4d
      
https://github.com/qemu/qemu/commit/33609e95b206788681263b76d6649a556d064e4d
  Author: Rao, Lei <lei.rao@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo-compare.c

  Log Message:
  -----------
  Optimize seq_sorter function for colo-compare

The seq of tcp has been filled in fill_pkt_tcp_info, it
can be used directly here.

Signed-off-by: Lei Rao <lei.rao@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: b70cb3b4854dc4d65c89a8f6704c0f1e9d900ac3
      
https://github.com/qemu/qemu/commit/b70cb3b4854dc4d65c89a8f6704c0f1e9d900ac3
  Author: Rao, Lei <lei.rao@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M migration/ram.c

  Log Message:
  -----------
  Reduce the time of checkpoint for COLO

we should set ram_bulk_stage to false after ram_state_init,
otherwise the bitmap will be unused in migration_bitmap_find_dirty.
all pages in ram cache will be flushed to the ram of secondary guest
for each checkpoint.

Signed-off-by: Lei Rao <lei.rao@intel.com>
Signed-off-by: Derek Su <dereksu@qnap.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 5647051f432b7c9b57525470b0a79a31339062d2
      
https://github.com/qemu/qemu/commit/5647051f432b7c9b57525470b0a79a31339062d2
  Author: Rao, Lei <lei.rao@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M softmmu/vl.c

  Log Message:
  -----------
  Fix the qemu crash when guest shutdown in COLO mode

In COLO mode, if the startup parameters of QEMU include "no-shutdown",
QEMU will crash when the guest shutdown. The root cause is when the
guest shutdown, the state of VM will switch COLO to SHUTDOWN. When do
checkpoint again, the state will be changed to COLO. But the state
switch is undefined in runstate_transitions_def, we should add it.
This patch fixes the following:
qemu-system-x86_64: invalid runstate transition: 'shutdown' -> 'colo'
Aborted

Signed-off-by: Lei Rao <lei.rao@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 862ee1e07e9d4dc97263fc919cb76364a2b6d193
      
https://github.com/qemu/qemu/commit/862ee1e07e9d4dc97263fc919cb76364a2b6d193
  Author: Li Zhijian <lizhijian@cn.fujitsu.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo.c

  Log Message:
  -----------
  colo-compare: fix missing compare_seq initialization

Fixes: f449c9e549c ("colo: compare the packet based on the tcp sequence
number")

Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 45b9e8c33a844c80d6067a3271652af5654ba7bd
      
https://github.com/qemu/qemu/commit/45b9e8c33a844c80d6067a3271652af5654ba7bd
  Author: Li Zhijian <lizhijian@cn.fujitsu.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo-compare.c

  Log Message:
  -----------
  colo-compare: check mark in mutual exclusion

Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 0c4266ef2690312512512ad6f4e44b5ac1d44c0c
      
https://github.com/qemu/qemu/commit/0c4266ef2690312512512ad6f4e44b5ac1d44c0c
  Author: Zhang Chen <chen.zhang@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo-compare.c

  Log Message:
  -----------
  net/colo-compare.c: Fix compare_timeout format issue

This parameter need compare with the return of qemu_clock_get_ms(),
it is uint64_t. So we need fix this issue here.

Fixes: 9cc43c94b31 ("net/colo-compare.c: Expose "compare_timeout" to users")

Reported-by: Derek Su <dereksu@qnap.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: ec081984f4ae7017e30f58599be54271e1b66d29
      
https://github.com/qemu/qemu/commit/ec081984f4ae7017e30f58599be54271e1b66d29
  Author: Zhang Chen <chen.zhang@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo-compare.c

  Log Message:
  -----------
  net/colo-compare.c: Change the timer clock type

The virtual clock only runs during the emulation. It stops
when the virtual machine is stopped.
The host clock should be used for device models that emulate accurate
real time sources. It will continue to run when the virtual machine
is suspended. COLO need to know the host time here.

Fixes: dd321ecfc2e ("colo-compare: Use IOThread to Check old packet
regularly and Process packets of the primary")

Reported-by: Derek Su <dereksu@qnap.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 17475df2c1f5dc5b9a4fecd5997765897782832e
      
https://github.com/qemu/qemu/commit/17475df2c1f5dc5b9a4fecd5997765897782832e
  Author: Zhang Chen <chen.zhang@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo-compare.c

  Log Message:
  -----------
  net/colo-compare.c: Add secondary old packet detection

Detect queued secondary packet to sync VM state in time.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 2f2fcff323349b6d4ffe00e897f8efb507f071b9
      
https://github.com/qemu/qemu/commit/2f2fcff323349b6d4ffe00e897f8efb507f071b9
  Author: Zhang Chen <chen.zhang@intel.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/colo-compare.c

  Log Message:
  -----------
  net/colo-compare.c: Increase default queued packet scan frequency

In my test, use this default parameter looks better.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 7564bf7701f00214cdc8a678a9f7df765244def1
      
https://github.com/qemu/qemu/commit/7564bf7701f00214cdc8a678a9f7df765244def1
  Author: Prasad J Pandit <pjp@fedoraproject.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/eth.c

  Log Message:
  -----------
  net: remove an assert call in eth_get_gso_type

eth_get_gso_type() routine returns segmentation offload type based on
L3 protocol type. It calls g_assert_not_reached if L3 protocol is
unknown, making the following return statement unreachable. Remove the
g_assert call, it maybe triggered by a guest user.

Reported-by: Gaoning Pan <pgn@zju.edu.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: d949fe64b074af7adca1076556aaebbcfdf6932e
      
https://github.com/qemu/qemu/commit/d949fe64b074af7adca1076556aaebbcfdf6932e
  Author: AlexChen <alex.chen@huawei.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M net/l2tpv3.c

  Log Message:
  -----------
  net/l2tpv3: Remove redundant check in net_init_l2tpv3()

The result has been checked to be NULL before, it cannot be NULL here,
so the check is redundant. Remove it.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: AlexChen <alex.chen@huawei.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: b1b0393c3c58c0e96c7c44e2e98baa252d6c6813
      
https://github.com/qemu/qemu/commit/b1b0393c3c58c0e96c7c44e2e98baa252d6c6813
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/core/machine.c
    M hw/misc/pvpanic.c
    M tests/qtest/pvpanic-test.c

  Log Message:
  -----------
  pvpanic: Advertise the PVPANIC_CRASHLOADED event support

Advertise both types of events as supported when the guest OS
queries the pvpanic device.  Currently only PVPANIC_PANICKED is
exposed; PVPANIC_CRASHLOADED must also be advertised, but only on
new machine types.

Fixes: 7dc58deea79a ("pvpanic: implement crashloaded event handling")
Reported-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>


  Commit: ce437484fced8292d90497d7b740335428fffed6
      
https://github.com/qemu/qemu/commit/ce437484fced8292d90497d7b740335428fffed6
  Author: LemonBoy <thatlemon@gmail.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M linux-user/alpha/target_signal.h
    M linux-user/arm/target_signal.h
    M linux-user/cris/target_signal.h
    M linux-user/hppa/target_signal.h
    M linux-user/i386/target_signal.h
    M linux-user/m68k/target_signal.h
    M linux-user/microblaze/target_signal.h
    M linux-user/mips/target_signal.h
    M linux-user/mips64/target_signal.h
    M linux-user/nios2/target_signal.h
    M linux-user/ppc/target_signal.h
    M linux-user/s390x/target_signal.h
    M linux-user/sh4/target_signal.h
    M linux-user/sparc/target_signal.h
    M linux-user/x86_64/target_signal.h

  Log Message:
  -----------
  linux-user: Correct definition of stack_t

Some platforms used the wrong definition of stack_t where the flags and
size fields were swapped or where the flags field had type ulong instead
of int.

Due to the presence of padding space in the structure and the prevalence
of little-endian machines this problem went unnoticed for a long time.

The type definitions have been cross-checked with the ones defined in
the Linux kernel v5.9, plus some older versions for a few architecture
that have been removed and Xilinx's kernel fork for NiosII [1].

The bsd-user headers remain unchanged as I don't know if they are wrong
or not.

[1] 
https://github.com/Xilinx/linux-xlnx/blob/master/arch/nios2/include/uapi/asm/signal.h

Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <e9d47692-ee92-009f-6007-0abc3f502b97@gmail.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: c7811022ebfcaae64e06383ff734f3b3651bf892
      
https://github.com/qemu/qemu/commit/c7811022ebfcaae64e06383ff734f3b3651bf892
  Author: LemonBoy <thatlemon@gmail.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M linux-user/syscall.c

  Log Message:
  -----------
  linux-user: Prevent crash in epoll_ctl

>From 894bb5172705e46a3a04c93b4962c0f0cafee814 Mon Sep 17 00:00:00 2001
From: Giuseppe Musacchio <thatlemon@gmail.com>
Date: Fri, 17 Apr 2020 17:25:07 +0200
Subject: [PATCH] linux-user: Prevent crash in epoll_ctl

The `event` parameter is ignored by the kernel if `op` is EPOLL_CTL_DEL,
do the same and avoid returning EFAULT if garbage is passed instead of a
valid pointer.

Signed-off-by: Giuseppe Musacchio <thatlemon@gmail.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <a244fa67-dace-abdb-995a-3198bd80fee8@gmail.com>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>


  Commit: 5e73953a276106f8e2be475cca3299748bfd1201
      
https://github.com/qemu/qemu/commit/5e73953a276106f8e2be475cca3299748bfd1201
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/net/can/ctucan_core.c

  Log Message:
  -----------
  hw/net/can/ctucan: Don't allow guest to write off end of tx_buffer

The ctucan device has 4 CAN bus cores, each of which has a set of 20
32-bit registers for writing the transmitted data. The registers are
however not contiguous; each core's buffers is 0x100 bytes after
the last.

We got the checks on the address wrong in the ctucan_mem_write()
function:
 * the first "is addr in range at all" check allowed
   addr == CTUCAN_CORE_MEM_SIZE, which is actually the first
   byte off the end of the range
 * the decode of addresses into core-number plus offset in the
   tx buffer for that core failed to check that the offset was
   in range, so the guest could write off the end of the
   tx_buffer[] array

NB: currently the values of CTUCAN_CORE_MEM_SIZE, CTUCAN_CORE_TXBUF_NUM,
etc, make "buff_num >= CTUCAN_CORE_TXBUF_NUM" impossible, but we
retain this as a runtime check rather than an assertion to permit
those values to be changed in future (in hardware they are
configurable synthesis parameters).

Fix the top level check, and check the offset is within the buffer.

Fixes: Coverity CID 1432874
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: e0784d8375962da584fa92be8457845f433e2ae2
      
https://github.com/qemu/qemu/commit/e0784d8375962da584fa92be8457845f433e2ae2
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/net/can/ctucan_core.c

  Log Message:
  -----------
  hw/net/can/ctucan: Avoid unused value in ctucan_send_ready_buffers()

Coverity points out that in ctucan_send_ready_buffers() we
set buff_st_mask = 0xf << (i * 4) inside the loop, but then
we never use it before overwriting it later.

The only thing we use the mask for is as part of the code that is
inserting the new buff_st field into tx_status.  That is more
comprehensibly written using deposit32(), so do that and drop the
mask variable entirely.

We also update the buff_st local variable at multiple points
during this function, but nothing can ever see these
intermediate values, so just drop those, write the final
TXT_TOK as a fixed constant value, and collapse the only
remaining set/use of buff_st down into an extract32().

Fixes: Coverity CID 1432869
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 676ea985c0d13c9d39b9ead4c60005abb9ea4218
      
https://github.com/qemu/qemu/commit/676ea985c0d13c9d39b9ead4c60005abb9ea4218
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/net/can/ctucan_core.h

  Log Message:
  -----------
  hw/net/can/ctucan_core: Handle big-endian hosts

The ctucan driver defines types for its registers which are a union
of a uint32_t with a struct with bitfields for the individual
fields within that register. This is a bad idea, because bitfields
aren't portable. The ctu_can_fd_regs.h header works around the
most glaring of the portability issues by defining the
fields in two different orders depending on the setting of the
__LITTLE_ENDIAN_BITFIELD define. However, in ctucan_core.h this
is unconditionally set to 1, which is wrong for big-endian hosts.

Set it only if HOST_WORDS_BIGENDIAN is not set. There is no need
for a "have we defined it already" guard, because the only place
that should set it is ctucan_core.h, which has the usual
double-inclusion guard.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 71182187ddae5d5b17bd48464f719798321484ed
      
https://github.com/qemu/qemu/commit/71182187ddae5d5b17bd48464f719798321484ed
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/net/can/ctucan_core.c

  Log Message:
  -----------
  hw/net/can/ctucan_core: Use stl_le_p to write to tx_buffers

Instead of casting an address within a uint8_t array to a
uint32_t*, use stl_le_p(). This handles possibly misaligned
addresses which would otherwise crash on some hosts.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Tested-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Signed-off-by: Jason Wang <jasowang@redhat.com>


  Commit: 92eecfff32763ee138f4cebc1a12c5b051ad5bb5
      
https://github.com/qemu/qemu/commit/92eecfff32763ee138f4cebc1a12c5b051ad5bb5
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M bsd-user/main.c
    M linux-user/main.c
    M qemu-img.c
    M qemu-io.c
    M qemu-nbd.c
    M scsi/qemu-pr-helper.c
    M softmmu/vl.c
    M storage-daemon/qemu-storage-daemon.c
    M trace/control.c
    M trace/control.h

  Log Message:
  -----------
  trace: remove argument from trace_init_file

It is not needed, all the callers are just saving what was
retrieved from -trace and trace_init_file can retrieve it
on its own.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201102115841.4017692-1-pbonzini@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>


  Commit: 35e28cb0f210cae3d9c98113d519fe5a4bef5866
      
https://github.com/qemu/qemu/commit/35e28cb0f210cae3d9c98113d519fe5a4bef5866
  Author: Stefan Hajnoczi <stefanha@redhat.com>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M scripts/tracetool/format/d.py

  Log Message:
  -----------
  scripts/tracetool: silence SystemTap dtrace(1) long long warnings

SystemTap's dtrace(1) prints the following warning when it encounters
long long arguments:

  Warning: /usr/bin/dtrace:trace/trace-dtrace-hw_virtio.dtrace:76: syntax error 
near:
  probe vhost_vdpa_dev_start

  Warning: Proceeding as if --no-pyparsing was given.

Use the uint64_t and int64_t types, respectively. This works with all
host CPU 32- and 64-bit data models (ILP32, LP64, and LLP64) that QEMU
supports.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20201020094043.159935-1-stefanha@redhat.com
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>


  Commit: 54cd1213ce1faac196c1b57110a9ee4f18969e6c
      
https://github.com/qemu/qemu/commit/54cd1213ce1faac196c1b57110a9ee4f18969e6c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M hw/net/can/ctucan_core.c
    M hw/net/can/ctucan_core.h
    M hw/net/virtio-net.c
    M migration/ram.c
    M net/colo-compare.c
    M net/colo.c
    M net/eth.c
    M net/filter-rewriter.c
    M net/l2tpv3.c
    M softmmu/vl.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/jasowang/tags/net-pull-request' into 
staging

# gpg: Signature made Wed 11 Nov 2020 13:04:02 GMT
# gpg:                using RSA key EF04965B398D6211
# gpg: Good signature from "Jason Wang (Jason Wang on RedHat) 
<jasowang@redhat.com>" [marginal]
# gpg: WARNING: This key is not certified with sufficiently trusted signatures!
# gpg:          It is not certain that the signature belongs to the owner.
# Primary key fingerprint: 215D 46F4 8246 689E C77F  3562 EF04 965B 398D 6211

* remotes/jasowang/tags/net-pull-request:
  hw/net/can/ctucan_core: Use stl_le_p to write to tx_buffers
  hw/net/can/ctucan_core: Handle big-endian hosts
  hw/net/can/ctucan: Avoid unused value in ctucan_send_ready_buffers()
  hw/net/can/ctucan: Don't allow guest to write off end of tx_buffer
  net/l2tpv3: Remove redundant check in net_init_l2tpv3()
  net: remove an assert call in eth_get_gso_type
  net/colo-compare.c: Increase default queued packet scan frequency
  net/colo-compare.c: Add secondary old packet detection
  net/colo-compare.c: Change the timer clock type
  net/colo-compare.c: Fix compare_timeout format issue
  colo-compare: check mark in mutual exclusion
  colo-compare: fix missing compare_seq initialization
  Fix the qemu crash when guest shutdown in COLO mode
  Reduce the time of checkpoint for COLO
  Optimize seq_sorter function for colo-compare
  net/filter-rewriter: destroy g_hash_table in colo_rewriter_cleanup
  virtio-net: Set mac address to hardware if the peer is vdpa

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 46d407f84a437f2cbd4afb2f3d23d685448ba272
      
https://github.com/qemu/qemu/commit/46d407f84a437f2cbd4afb2f3d23d685448ba272
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M Makefile
    M hw/core/machine.c
    M hw/misc/pvpanic.c
    M meson.build
    M replay/replay-debugging.c
    M softmmu/physmem.c
    M tests/qtest/pvpanic-test.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into 
staging

Bug fixes

# gpg: Signature made Wed 11 Nov 2020 08:59:24 GMT
# gpg:                using RSA key F13338574B662389866C7682BFFBD25F78C7AE83
# gpg:                issuer "pbonzini@redhat.com"
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full]
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>" [full]
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini-gitlab/tags/for-upstream:
  pvpanic: Advertise the PVPANIC_CRASHLOADED event support
  physmem: improve ram size error messages
  Makefile: No echoing for 'make help V=1'
  replay: remove some dead code
  fix make clean/distclean
  meson: Clarify the confusing vhost-user vs. vhost-kernel output

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: a4c141dca466ed3e9451f147efe6304b1b659ff5
      
https://github.com/qemu/qemu/commit/a4c141dca466ed3e9451f147efe6304b1b659ff5
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M bsd-user/main.c
    M linux-user/main.c
    M qemu-img.c
    M qemu-io.c
    M qemu-nbd.c
    M scripts/tracetool/format/d.py
    M scsi/qemu-pr-helper.c
    M softmmu/vl.c
    M storage-daemon/qemu-storage-daemon.c
    M trace/control.c
    M trace/control.h

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/stefanha-gitlab/tags/tracing-pull-request' into staging

Tracing pull request

# gpg: Signature made Wed 11 Nov 2020 15:56:18 GMT
# gpg:                using RSA key 8695A8BFD3F97CDAAC35775A9CA4ABB381AB73C8
# gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" [full]
# gpg:                 aka "Stefan Hajnoczi <stefanha@gmail.com>" [full]
# Primary key fingerprint: 8695 A8BF D3F9 7CDA AC35  775A 9CA4 ABB3 81AB 73C8

* remotes/stefanha-gitlab/tags/tracing-pull-request:
  scripts/tracetool: silence SystemTap dtrace(1) long long warnings
  trace: remove argument from trace_init_file

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 674ee1245b4f14d998299d83410ac147e6e54eca
      
https://github.com/qemu/qemu/commit/674ee1245b4f14d998299d83410ac147e6e54eca
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-11 (Wed, 11 Nov 2020)

  Changed paths:
    M linux-user/alpha/target_signal.h
    M linux-user/arm/target_signal.h
    M linux-user/cris/target_signal.h
    M linux-user/hppa/target_signal.h
    M linux-user/i386/target_signal.h
    M linux-user/m68k/target_signal.h
    M linux-user/microblaze/target_signal.h
    M linux-user/mips/target_signal.h
    M linux-user/mips64/target_signal.h
    M linux-user/nios2/target_signal.h
    M linux-user/ppc/target_signal.h
    M linux-user/s390x/target_signal.h
    M linux-user/sh4/target_signal.h
    M linux-user/sparc/target_signal.h
    M linux-user/syscall.c
    M linux-user/x86_64/target_signal.h

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/vivier2/tags/linux-user-for-5.2-pull-request' into staging

Fixes for epoll_ctl and stack_t

# gpg: Signature made Wed 11 Nov 2020 21:40:16 GMT
# gpg:                using RSA key CD2F75DDC8E3A4DC2E4F5173F30C38BD3F2FBE3C
# gpg:                issuer "laurent@vivier.eu"
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>" [full]
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>" [full]
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>" 
[full]
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-5.2-pull-request:
  linux-user: Prevent crash in epoll_ctl
  linux-user: Correct definition of stack_t

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: 6bfa035ec31f4f5a14499f17e08f62e8f14760cc
      
https://github.com/qemu/qemu/commit/6bfa035ec31f4f5a14499f17e08f62e8f14760cc
  Author: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M hw/misc/macio/macio.c

  Log Message:
  -----------
  macio: set user_creatable to false in macio_class_init()

Commit 348b8d1a76 "macio: don't reference serial_hd() directly within the 
device"
removed the setting of user_creatable to false on the basis that the restriction
was due to the use of serial_hd() in macio_instance_init().

Unfortunately this isn't the full story since the PIC object property links
must still be set before the device is realized. Whilst it is possible to update
the macio device and Mac machines to resolve this, the fix is too invasive at
this point in the release cycle.

For now simply set user_creatable back to false in macio_class_init() to
prevent QEMU from segfaulting in anticipation of the proper fix arriving in
QEMU 6.0.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20201110103111.18395-1-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>


  Commit: cb5d19e8294486551c422759260883ed290226d9
      
https://github.com/qemu/qemu/commit/cb5d19e8294486551c422759260883ed290226d9
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M hw/misc/macio/macio.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/mcayland/tags/qemu-macppc-20201112' 
into staging

qemu-macppc fix for 5.2

# gpg: Signature made Thu 12 Nov 2020 09:50:45 GMT
# gpg:                using RSA key CC621AB98E82200D915CC9C45BC2C56FAE0F321F
# gpg:                issuer "mark.cave-ayland@ilande.co.uk"
# gpg: Good signature from "Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>" 
[full]
# Primary key fingerprint: CC62 1AB9 8E82 200D 915C  C9C4 5BC2 C56F AE0F 321F

* remotes/mcayland/tags/qemu-macppc-20201112:
  macio: set user_creatable to false in macio_class_init()

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: af3bbbe98405fe2d274696abe5def679a3b0c673
      
https://github.com/qemu/qemu/commit/af3bbbe98405fe2d274696abe5def679a3b0c673
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M migration/ram.c

  Log Message:
  -----------
  migration/ram: Fix hexadecimal format string specifier

The '%u' conversion specifier is for decimal notation.
When prefixing a format with '0x', we want the hexadecimal
specifier ('%x').

Inspired-by: Dov Murik <dovmurik@linux.vnet.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20201103112558.2554390-5-philmd@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 136fc6aa2cf38205fa3b47e155ebac11baccc789
      
https://github.com/qemu/qemu/commit/136fc6aa2cf38205fa3b47e155ebac11baccc789
  Author: Peng Liang <liangpeng10@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M hw/acpi/generic_event_device.c

  Log Message:
  -----------
  ACPI: Avoid infinite recursion when dump-vmstate

There is a field with vmstate_ghes_state as vmsd in vmstate_ghes_state,
which will lead to infinite recursion in dump_vmstate_vmsd.

Fixes: a08a64627b ("ACPI: Record the Generic Error Status Block address")
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Peng Liang <liangpeng10@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-Id: <20201112020638.874515-1-liangpeng10@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: a1af605bd5ade1a6dd571f553a6746b97f3d6869
      
https://github.com/qemu/qemu/commit/a1af605bd5ade1a6dd571f553a6746b97f3d6869
  Author: Chuan Zheng <zhengchuan@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M migration/multifd.c

  Log Message:
  -----------
  migration/multifd: fix hangup with TLS-Multifd due to blocking handshake

The qemu main loop could hang up forever when we enable TLS+Multifd.
The Src multifd_send_0 invokes tls handshake, it sends hello to sever
and wait response.
However, the Dst main qemu loop has been waiting recvmsg() for multifd_recv_1.
Both of Src and Dst main qemu loop are blocking and waiting for reponse which
results in hanging up forever.

Src: (multifd_send_0)                                              Dst: 
(multifd_recv_1)
multifd_channel_connect                                            
migration_channel_process_incoming
  multifd_tls_channel_connect                                        
migration_tls_channel_process_incoming
    multifd_tls_channel_connect                                        
qio_channel_tls_handshake_task
       qio_channel_tls_handshake                                         
gnutls_handshake
          qio_channel_tls_handshake_task                                       
...
            qcrypto_tls_session_handshake                                      
...
              gnutls_handshake                                                 
...
                   ...                                                         
...
                recvmsg (Blocking I/O waiting for response)                
recvmsg (Blocking I/O waiting for response)

Fix this by offloadinig handshake work to a background thread.

Reported-by: Yan Jin <jinyan12@huawei.com>
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Chuan Zheng <zhengchuan@huawei.com>
Message-Id: <1604643893-8223-1-git-send-email-zhengchuan@huawei.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: a24292830b7a356f528760e065c0012ff56e18ab
      
https://github.com/qemu/qemu/commit/a24292830b7a356f528760e065c0012ff56e18ab
  Author: Chen Qun <kuhn.chenqun@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: fix uninitialized variable warning in migrate_send_rp_req_pages()

After the WITH_QEMU_LOCK_GUARD macro is added, the compiler cannot identify
 that the statements in the macro must be executed. As a result, some variables
 assignment statements in the macro may be considered as unexecuted by the 
compiler.

When the -Wmaybe-uninitialized capability is enabled on GCC9,the compiler 
showed warning:
migration/migration.c: In function ‘migrate_send_rp_req_pages’:
migration/migration.c:384:8: warning: ‘received’ may be used uninitialized in 
this function [-Wmaybe-uninitialized]
 384 |     if (received) {
     |        ^

Add a default value for 'received' to prevented the warning.

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201111142203.2359370-6-kuhn.chenqun@huawei.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: a18ed79b19ec63368bf825eaf708e31f49888d40
      
https://github.com/qemu/qemu/commit/a18ed79b19ec63368bf825eaf708e31f49888d40
  Author: Chuan Zheng <zhengchuan@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M migration/dirtyrate.c

  Log Message:
  -----------
  migration/dirtyrate: simplify includes in dirtyrate.c

Remove redundant blank line which is left by Commit 662770af7c6e8c,
also take this opportunity to remove redundant includes in dirtyrate.c.

Signed-off-by: Chuan Zheng <zhengchuan@huawei.com>
Message-Id: <1604030281-112946-1-git-send-email-zhengchuan@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 9e8424088c5648959e4c5d715290e6cfa96df087
      
https://github.com/qemu/qemu/commit/9e8424088c5648959e4c5d715290e6cfa96df087
  Author: Chuan Zheng <zhengchuan@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M migration/multifd.c

  Log Message:
  -----------
  multifd/tls: fix memoryleak of the QIOChannelSocket object when cancelling 
migration

When creating new tls client, the tioc->master will be referenced which results 
in socket
leaking after multifd_save_cleanup if we cancel migration.
Fix it by do object_unref() after tls client creation.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Chuan Zheng <zhengchuan@huawei.com>
Message-Id: <1605104763-118687-1-git-send-email-zhengchuan@huawei.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 6ba11211bd616237d028fb5d27f8576fc8cf7b1c
      
https://github.com/qemu/qemu/commit/6ba11211bd616237d028fb5d27f8576fc8cf7b1c
  Author: Longpeng(Mike) <longpeng2@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M migration/migration.c

  Log Message:
  -----------
  migration: handle CANCELLING state in migration_completion()

The following sequence may cause the VM abort during migration:

1. RUN_STATE_RUNNING,MIGRATION_STATUS_ACTIVE

2. before call migration_completion(), we send migrate_cancel
   QMP command, the state machine is changed to:
     RUN_STATE_RUNNING,MIGRATION_STATUS_CANCELLING

3. call migration_completion(), and the state machine is
   switch to: RUN_STATE_RUNNING,MIGRATION_STATUS_COMPLETED

4. call migration_iteration_finish(), because the migration
   status is COMPLETED, so it will try to set the runstate
   to POSTMIGRATE, but RUNNING-->POSTMIGRATE is an invalid
   transition, so abort().

The migration_completion() should not change the migration state
to COMPLETED if it is already changed to CANCELLING.

Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
Message-Id: <20201105091726.148-1-longpeng2@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: f26688a911ed4bc122f597333c9d5b45175e683c
      
https://github.com/qemu/qemu/commit/f26688a911ed4bc122f597333c9d5b45175e683c
  Author: Max Reitz <mreitz@redhat.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: Announce submounts even without statx()

Contrary to what the check (and warning) in lo_init() claims, we can
announce submounts just fine even without statx() -- the check is based
on comparing both the mount ID and st_dev of parent and child.  Without
statx(), we will not have the mount ID; but we always have st_dev.

The only problems we have (without statx() and its mount ID) are:

(1) Mounting the same device twice may lead to both trees being treated
    as exactly the same tree by virtiofsd.  But that is a problem that
    is completely independent of mirroring host submounts in the guest.
    Both submount roots will still show the FUSE_SUBMOUNT flag, because
    their st_dev still differs from their respective parent.

(2) There is only one exception to (1), and that is if you mount a
    device inside a mount of itself: Then, its st_dev will be the same
    as that of its parent, and so without a mount ID, virtiofsd will not
    be able to recognize the nested mount's root as a submount.
    However, thanks to virtiofsd then treating both trees as exactly the
    same tree, it will be caught up in a loop when the guest tries to
    examine the nested submount, so the guest will always see nothing
    but an ELOOP there.  Therefore, this case is just fully broken
    without statx(), whether we check for submounts (based on st_dev) or
    not.

All in all, checking for submounts works well even without comparing the
mount ID (i.e., without statx()).  The only concern is an edge case
that, without statx() mount IDs, is utterly broken anyway.

Thus, drop said check in lo_init().

Reported-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20201103164135.169325-1-mreitz@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 7fa87944f82d75d21b7166570ac87d7874c151d5
      
https://github.com/qemu/qemu/commit/7fa87944f82d75d21b7166570ac87d7874c151d5
  Author: Haotian Li <lihaotian9@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M tools/virtiofsd/buffer.c

  Log Message:
  -----------
  tools/virtiofsd/buffer.c: check whether buf is NULL in fuse_bufvec_advance 
func

In fuse_bufvec_advance func, calling fuse_bufvec_current func
may return NULL, so we should check whether buf is NULL before
using it.

Signed-off-by: Haotian Li <lihaotian9@huawei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Message-Id: <29fc87c2-b87c-4c34-40d4-75381f228849@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: db2e026a39d9871217289e5ed5cb97a2b7f476e5
      
https://github.com/qemu/qemu/commit/db2e026a39d9871217289e5ed5cb97a2b7f476e5
  Author: Haotian Li <lihaotian9@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: check whether lo_map_reserve returns NULL in, main func

In main func, func lo_map_reserve is called without NULL check.
If reallocing new_elems fails in func lo_map_grow, the func
lo_map_reserve may return NULL. We should check whether
lo_map_reserve returns NULL before using it.

Signed-off-by: Haotian Li <lihaotian9@huawei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Message-Id: <48887813-1c95-048c-6d10-48e3dd2bac71@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 7632b56c8f880a8f86cf049a3785069e1ffd2997
      
https://github.com/qemu/qemu/commit/7632b56c8f880a8f86cf049a3785069e1ffd2997
  Author: Haotian Li <lihaotian9@huawei.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: check whether strdup lo.source return NULL in main func

In main func, strdup lo.source may fail. So check whether strdup
lo.source return NULL before using it.

Signed-off-by: Haotian Li <lihaotian9@huawei.com>
Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
Message-Id: <f1e48ca8-d6de-d901-63c8-4f4024bda518@huawei.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 4cfac0152e798f9c60472706c0441501da13183c
      
https://github.com/qemu/qemu/commit/4cfac0152e798f9c60472706c0441501da13183c
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M hw/acpi/generic_event_device.c
    M migration/dirtyrate.c
    M migration/migration.c
    M migration/multifd.c
    M migration/ram.c
    M tools/virtiofsd/buffer.c
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20201112a' 
into staging

Migration & virtiofs fixes for 5.2

A bunch of small fixes.

# gpg: Signature made Thu 12 Nov 2020 18:34:41 GMT
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" 
[full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert/tags/pull-migration-20201112a:
  virtiofsd: check whether strdup lo.source return NULL in main func
  virtiofsd: check whether lo_map_reserve returns NULL in, main func
  tools/virtiofsd/buffer.c: check whether buf is NULL in fuse_bufvec_advance 
func
  virtiofsd: Announce submounts even without statx()
  migration: handle CANCELLING state in migration_completion()
  multifd/tls: fix memoryleak of the QIOChannelSocket object when cancelling 
migration
  migration/dirtyrate: simplify includes in dirtyrate.c
  migration: fix uninitialized variable warning in migrate_send_rp_req_pages()
  migration/multifd: fix hangup with TLS-Multifd due to blocking handshake
  ACPI: Avoid infinite recursion when dump-vmstate
  migration/ram: Fix hexadecimal format string specifier

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


  Commit: e408aeef8663fd6e3075aef252404c55d710a75e
      
https://github.com/qemu/qemu/commit/e408aeef8663fd6e3075aef252404c55d710a75e
  Author: Kirti Wankhede <kwankhede@nvidia.com>
  Date:   2020-11-12 (Thu, 12 Nov 2020)

  Changed paths:
    M hw/vfio/migration.c

  Log Message:
  -----------
  Fix use after free in vfio_migration_probe

Fixes Coverity issue:
CID 1436126:  Memory - illegal accesses  (USE_AFTER_FREE)

Fixes: a9e271ec9b36 ("vfio: Add migration region initialization and finalize 
function")
Signed-off-by: Kirti Wankhede <kwankhede@nvidia.com>
Reviewed-by: David Edmondson <dme@dme.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>


  Commit: b0f8c22d6d4d07f3bd2307bcc62e1660ef965472
      
https://github.com/qemu/qemu/commit/b0f8c22d6d4d07f3bd2307bcc62e1660ef965472
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-11-13 (Fri, 13 Nov 2020)

  Changed paths:
    M hw/vfio/migration.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201112.0' 
into staging

VFIO update 2020-11-12

 * Fix coverity reported use-after-free (Kirti Wankhede)

# gpg: Signature made Thu 12 Nov 2020 23:00:13 GMT
# gpg:                using RSA key 239B9B6E3BB08B22
# gpg: Good signature from "Alex Williamson <alex.williamson@redhat.com>" [full]
# gpg:                 aka "Alex Williamson <alex@shazbot.org>" [full]
# gpg:                 aka "Alex Williamson <alwillia@redhat.com>" [full]
# gpg:                 aka "Alex Williamson <alex.l.williamson@gmail.com>" 
[full]
# Primary key fingerprint: 42F6 C04E 540B D1A9 9E7B  8A90 239B 9B6E 3BB0 8B22

* remotes/awilliam/tags/vfio-update-20201112.0:
  Fix use after free in vfio_migration_probe

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/3c8c36c9087d...b0f8c22d6d4d



reply via email to

[Prev in Thread] Current Thread [Next in Thread]