Update to 2.8.0

Changelog:
== System emulation ==
=== Incompatible changes ===
* The number of allow PCI host bridges for pSeries machine was reduced from 256 to 31 (more can be configured by setting up MMIO windows manually).
* Removed support for tftp:// in the block layer, since this has been broken forever for files bigger than 256KB.
=== Future incompatible changes ===
* Three options are using different names on the command line and in configuration file.  In particular:
** The "acpi" configuration file section matches command-line option "acpitable";
** The "boot-opts" configuration file section matches command-line option "boot";
** The "smp-opts" configuration file section matches command-line option "smp".
:-readconfig will standardize on the name for the command line option.
* Behavior of automatic calculation of SMP topology when some SMP topology options for -smp are omitted (sockets, cores, threads) will change in the future. If guest ABI needs to be preserved on upgrades while using the SMP topology options, users should either set set all options explicitly (sockets, cores, threads), or omit all of them.
* Devices "allwinner-a10", "pc87312", "ssi-sd" will be configured with explicit properties instead of implicitly.  This is unlikely to affect users.
* QMP command blockdev-add is still a work in progress.  It doesn't support all block drivers, it lacks a matching blockdev-del, and more.  It might change incompatibly.
* For x86, specifying a CPUID feature with both "+feature/-feature" and "feature=on/off" will cause a warning.  The current behavior for this combination ("+feature/-feature" wins over "feature=on/off") will be changed so that "+feature" and "-feature" will be synonyms for "feature=on" and "feature=off" respectively).
=== ARM ===
* Improvements to the Aspeed board.
* Support for HLT semihosting traps in AArch32 mode (both ARM and Thumb).
* The ACPI tables for the "virt" machine type support ITS.
* The Cadence GEM device now supports multiple priority queues through the num-priority-queues property.
* The STM32F2xx board (Netduino 2) now includes ADC and SPI devices.
==== KVM ====
=== MIPS ===
* Support for 24KEc CPUs.
=== PowerPC ===
* Support for POWER9 CPUs.
* Improvements for the new "powernv" platform.
==== pSeries ====
* PCI host bridges can be associated to NUMA nodes.
* Support for more than 1 TiB of guest memory.
* Support for more than 64 GiB of MMIO window in a PCI host bridge.
* Support for the "-prom-env" parameter
=== s390 ===
* Support for CPU models.
* Support for virtio-ccw revision 2.

=== SH ===
=== SPARC ===
=== TileGX ===
=== Tricore ===
=== x86 ===
* Support for several new CPUID features related to AVX-512 instruction set extensions.
* The emulated IOAPIC (used by TCG and, with KVM, if the "-machine kernel_irqchip" option has the value "off" or "split") now defaults to version 0x20, which supports directed end-of-interrupt messages.
* Support for Extended Interrupt Mode (EIM) in the intel_iommu device.  EIM requires KVM (Linux v4.7 or newer, for x2APIC support) and "-machine kernel-irqchip=split"; it is enabled automatically if interrupt remapping is enabled ("-machine kernel-irqchip=split -device intel_iommu,intremap=on").
* Support for up to 288 CPUs with the Q35 machine types.  256 or more CPUs are only supported if IOMMU and EIM are enabled.
==== Xen ====
* Support for unplugging SCSI disk.
* Support for SUSE xenlinux-compatible device unplug.
=== Device emulation and assignment ===
* QEMU now includes a generic loader pseudo-device that lets you load multiple images or values into memory at startup.  This device is documented in {{src|path=docs/generic-loader.txt}}.
==== ACPI ====
* Support for hotplugging of NVDIMM devices (_FIT)
==== Block devices ====
==== Network devices ====
* Support for fault tolerance based on coarse-grained lock stepping (COLO).
==== SCSI ====
==== PCI/PCIe ====
* The sample EDU device now supports MSI.
* [http://git.qemu.org/?p=qemu.git;a=blob;f=docs/pcie.txt;h=9fb20aaed9f41c302419206e1201d151c35e5a1c;hb=HEAD PCI Express Guidelines documentation] has been added for advice on topology and PCI vs PCIe.
==== USB ====
==== VFIO ====
==== virtio ====
* New device vhost-vsock.
* Initial support for graceful handling of guest errors (i.e. QEMU should not exit on guest errors).
* Support for new virtio-crypto device.

==== Xen ====
* Support for grant copy.
=== Character devices ===
=== Crypto subsystem ===
* Support for more hash algorithms for PBKDF.
* Support for CTR mode.
=== GUI ===
* SPICE can use pure OpenGL rendering if "gl=on" is specified.
=== Monitor ===
=== Migration ===
* Support for fault tolerance based on coarse-grained lock stepping (COLO).
=== Network ===
=== Block devices and tools ===
* More QMP commands support node-name (block-stream, block-commit, blockdev-backup, blockdev-mirror, blockdev-snapshot-delete-internal-sync, blockdev-snapshot-internal-sync, change-backing-file, drive-backup, drive-mirror, nbd-server-add).
* The BLOCK_IO_ERROR event now includes the node name.
* More QMP commands accept device model names (block_set_io_throttle, blockdev-change-medium, eject, x-blockdev-remove-medium, x-blockdev-insert-medium, blockdev-open-tray, blockdev-close-tray)
* The DEVICE_TRAY_MOVED event now includes the device id.
* Throttling now applies to the guest device only, and not to block jobs or the NBD server.
* drive-backup and blockdev-backup support writing out backups in compressed format.
* The LUKS format now can configure the PBKDF iteration count.
* block-stream supports streaming from a backing file to another backing file.
* Support for replication, for coarse-grained lock stepping (COLO) fault tolerance.
* New "dd" subcomamand of qemu-img.
* The DMG driver can be compiled to a separate driver, so as to make QEMU's dependency on libbz2 optional.
* Support for iSER in QEMU's iSCSI initiator through a iser:// URI.
* The NBD client and server support the NBD_CMD_WRITE_ZEROES extension.
* Raw images support "offset" and "size" options to access only a part of the file or device.

=== Tracing ===
* New tracing backend "syslog".
* Support for multiple "-d trace:PATTERN" command-line arguments.
=== CLI options ===

== User-mode emulation ==
=== Removed target support ===
* The unicore32-linux-user target implemented a different system call ABI from mainline Linux for this architecture. Support for it has been dropped.
=== New functionality ===
* Added support for more syscalls including preadv, pwritev, syslog.
* Major scalability improvements for multi-threaded programs (ARM, SPARC, x86).
* QEMU can now understand and generate fence and cmpxchg operations.

== TCG ==
* New TCG primitives have been added for safely modelling architectural synchronisation instructions (e.g. atomics, LL/SC, LOCK prefixes). arm, aarch64, alpha and x86 targets now use these primitives for multi-threaded linux-user programs. TCG target maintainers are encouraged to port their front-ends to use the new facilities.
* The TCG backends now emit appropriate barrier instructions for frontend barriers when running multi-threaded programs. However, emulating a strongly-ordered architecture (e.g., x86) on a weakly-ordered one (e.g., ARM or POWER) will not work yet.
* tb_flush() is finally thread-safe meaning multi-threaded programs are less likely to crash when the translation buffer is reset
* lock contention in the main cpu run-loop has been reduced improving performance for multi-threaded code
* a number of races were identified and fixed

A lot of the TCG work merged in this cycle where prerequisites for supporting multi-threaded system emulation (MTTCG). While full MTTCG support is expected to be merged in the next development cycle, multi-threaded linux-user programs will already benefit from this work.

8 files changed, 35 insertions, 161 deletions

diff --git a/emulators/qemu/Makefile b/emulators/qemu/Makefile
index f28e3ef16e5..ba3a2e5b1c4 100644
--- a/emulators/qemu/Makefile
+++ b/emulators/qemu/Makefile
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.159 2016/12/29 22:59:39 wiz Exp $
+# $NetBSD: Makefile,v 1.160 2016/12/30 10:00:16 ryoon Exp $
 
-DISTNAME=	qemu-2.7.0
+DISTNAME=	qemu-2.8.0
 CATEGORIES=	emulators
 MASTER_SITES=	http://wiki.qemu.org/download/
 EXTRACT_SUFX=	.tar.bz2
-PKGREVISION=	1
 
 MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	http://www.qemu.org/
@@ -23,6 +22,12 @@ HAS_CONFIGURE=		yes
 
 BUILD_DEPENDS+=		texi2html-[0-9]*:../../textproc/texi2html
 
+SUBST_CLASSES+=			prefix
+SUBST_STAGE.prefix=		pre-configure
+SUBST_MESSAGE.prefix=		Setting PREFIX
+SUBST_FILES.prefix+=		configure
+SUBST_VARS.prefix+=		PREFIX
+
 .include "options.mk"
 
 .include "../../mk/bsd.prefs.mk"
@@ -130,7 +135,7 @@ post-install:
 .include "../../mk/oss.buildlink3.mk"
 .endif
 .include "../../devel/glib2/buildlink3.mk"
-.include "../../devel/ncurses/buildlink3.mk"
+.include "../../devel/ncursesw/buildlink3.mk"
 .include "../../devel/zlib/buildlink3.mk"
 .include "../../lang/python/extension.mk"
 .include "../../security/libgcrypt/buildlink3.mk"
diff --git a/emulators/qemu/PLIST b/emulators/qemu/PLIST
index f89cfedc0da..68128e32726 100644
--- a/emulators/qemu/PLIST
+++ b/emulators/qemu/PLIST
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.47 2016/09/04 09:21:04 ryoon Exp $
+@comment $NetBSD: PLIST,v 1.48 2016/12/30 10:00:16 ryoon Exp $
 ${PLIST.ivshmem}bin/ivshmem-client
 ${PLIST.ivshmem}bin/ivshmem-server
 ${PLIST.alpha}bin/qemu-alpha
@@ -61,7 +61,6 @@ man/man8/qemu-ga.8
 man/man8/qemu-nbd.8
 share/doc/qemu/Makefile.multinode-NetBSD
 share/doc/qemu/qemu-doc.html
-share/doc/qemu/qemu-tech.html
 share/doc/qemu/qmp-commands.txt
 share/qemu/QEMU,cgthree.bin
 share/qemu/QEMU,tcx.bin
@@ -135,6 +134,7 @@ share/qemu/qemu-icon.bmp
 share/qemu/qemu_logo_no_text.svg
 share/qemu/s390-ccw.img
 share/qemu/sgabios.bin
+share/qemu/skiboot.lid
 share/qemu/slof.bin
 share/qemu/spapr-rtas.bin
 share/qemu/trace-events-all
diff --git a/emulators/qemu/distinfo b/emulators/qemu/distinfo
index 4f089d64744..6494f49643f 100644
--- a/emulators/qemu/distinfo
+++ b/emulators/qemu/distinfo
@@ -1,15 +1,11 @@
-$NetBSD: distinfo,v 1.118 2016/10/30 14:48:00 spz Exp $
+$NetBSD: distinfo,v 1.119 2016/12/30 10:00:16 ryoon Exp $
 
-SHA1 (qemu-2.7.0.tar.bz2) = 96737d31a2fb74553dacbd0ddaa93014858dc986
-RMD160 (qemu-2.7.0.tar.bz2) = cc962261a4f7b05ace8c16027bda770a89322cd3
-SHA512 (qemu-2.7.0.tar.bz2) = 654acaa7b3724a288e5d7e2a26ab780d9c9ed9f647fba00a906cbaffbe9d58fd666f2d962514aa2c5b391b4c53811ac3170d2eb51727f090bd19dfe45ca9a9db
-Size (qemu-2.7.0.tar.bz2) = 26867760 bytes
-SHA1 (patch-CVE-2016-7423) = 1e126226adb90bfc335fa4dfbdb0365271ca1db3
-SHA1 (patch-CVE-2016-7907) = 3645de0cc1685966261be1847bad14a354c75326
-SHA1 (patch-CVE-2016-7908) = 09c1a30af90a1b9cb2b381401b760a861ce10765
-SHA1 (patch-CVE-2016-7909) = 26ed8d3bbcb8463d4d2c7e28c76aa75518a8c528
+SHA1 (qemu-2.8.0.tar.bz2) = a5602f2ddb51d61b4c0e618b779fdb0dbdc9cc1f
+RMD160 (qemu-2.8.0.tar.bz2) = da1e640443a15f36a242fe803c65a39f85b06fcc
+SHA512 (qemu-2.8.0.tar.bz2) = 50f2988d822388ba9fd1bf5dbe68359033ed7432d7f0f9790299f32f63faa6dc72979256b5632ba572d47ee3e74ed40e3e8e331dc6303ec1599f1b4367cb78c2
+Size (qemu-2.8.0.tar.bz2) = 28368517 bytes
 SHA1 (patch-Makefile.objs) = f40deeed5482a24369e898411bb611be418dc3ca
-SHA1 (patch-configure) = 9eb469dc5be1d7c6b4ee69e8ee61e6ab8d542112
+SHA1 (patch-configure) = dba5399fb674f0848111c3fecb65462a6829444a
 SHA1 (patch-default-configs_pci.mak) = 2162550a68de514c8fe9e255df88f8a0a07ee6c7
 SHA1 (patch-ef) = 98a1de2fd48638886b5d16f6a61dc72910e98b41
 SHA1 (patch-et) = e9b850ac5985cbe934b541acbfdb330cce421d50
diff --git a/emulators/qemu/patches/patch-CVE-2016-7423 b/emulators/qemu/patches/patch-CVE-2016-7423
deleted file mode 100644
index 00e66581ec7..00000000000
--- a/emulators/qemu/patches/patch-CVE-2016-7423
+++ /dev/null
@@ -1,25 +0,0 @@
-$NetBSD: patch-CVE-2016-7423,v 1.1 2016/10/30 14:48:00 spz Exp $
-
-from:
-http://git.qemu.org/?p=qemu.git;a=commitdiff;h=670e56d3ed2918b3861d9216f2c0540d9e9ae0d5
-
-scsi: mptsas: use g_new0 to allocate MPTSASRequest object
-
-When processing IO request in mptsas, it uses g_new to allocate
-a 'req' object. If an error occurs before 'req->sreq' is
-allocated, It could lead to an OOB write in mptsas_free_request
-function. Use g_new0 to avoid it.
-
-Reported-by: Li Qiang <liqiang6-s@360.cn>
-
---- hw/scsi/mptsas.c.orig	2016-09-02 15:34:20.000000000 +0000
-+++ hw/scsi/mptsas.c
-@@ -304,7 +304,7 @@ static int mptsas_process_scsi_io_reques
-         goto bad;
-     }
- 
--    req = g_new(MPTSASRequest, 1);
-+    req = g_new0(MPTSASRequest, 1);
-     QTAILQ_INSERT_TAIL(&s->pending, req, next);
-     req->scsi_io = *scsi_io;
-     req->dev = s;
diff --git a/emulators/qemu/patches/patch-CVE-2016-7907 b/emulators/qemu/patches/patch-CVE-2016-7907
deleted file mode 100644
index cdffc685634..00000000000
--- a/emulators/qemu/patches/patch-CVE-2016-7907
+++ /dev/null
@@ -1,41 +0,0 @@
-$NetBSD: patch-CVE-2016-7907,v 1.1 2016/10/30 14:48:00 spz Exp $
-
-from:
-https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg05556.html
-
-From: Prasad J Pandit <address@hidden>
-
-i.MX Fast Ethernet Controller uses buffer descriptors to manage
-data flow to/fro receive & transmit queues. While transmitting
-packets, it could continue to read buffer descriptors if a buffer
-descriptor has length of zero and has crafted values in bd.flags.
-Set an upper limit to number of buffer descriptors.
-
-Reported-by: Li Qiang <address@hidden>
-
---- hw/net/imx_fec.c.orig	2016-09-02 15:34:19.000000000 +0000
-+++ hw/net/imx_fec.c
-@@ -220,6 +220,8 @@ static const VMStateDescription vmstate_
- #define PHY_INT_PARFAULT            (1 << 2)
- #define PHY_INT_AUTONEG_PAGE        (1 << 1)
- 
-+#define IMX_MAX_DESC                1024
-+
- static void imx_eth_update(IMXFECState *s);
- 
- /*
-@@ -402,12 +404,12 @@ static void imx_eth_update(IMXFECState *
- 
- static void imx_fec_do_tx(IMXFECState *s)
- {
--    int frame_size = 0;
-+    int frame_size = 0, descnt = 0;
-     uint8_t frame[ENET_MAX_FRAME_SIZE];
-     uint8_t *ptr = frame;
-     uint32_t addr = s->tx_descriptor;
- 
--    while (1) {
-+    while (descnt++ < IMX_MAX_DESC) {
-         IMXFECBufDesc bd;
-         int len;
- 
diff --git a/emulators/qemu/patches/patch-CVE-2016-7908 b/emulators/qemu/patches/patch-CVE-2016-7908
deleted file mode 100644
index a0b0a47158b..00000000000
--- a/emulators/qemu/patches/patch-CVE-2016-7908
+++ /dev/null
@@ -1,43 +0,0 @@
-$NetBSD: patch-CVE-2016-7908,v 1.1 2016/10/30 14:48:00 spz Exp $
-
-from:
-http://git.qemu.org/?p=qemu.git;a=commitdiff;h=070c4b92b8cd5390889716677a0b92444d6e087a
-
-net: mcf: limit buffer descriptor count
-
-ColdFire Fast Ethernet Controller uses buffer descriptors to manage
-data flow to/fro receive & transmit queues. While transmitting
-packets, it could continue to read buffer descriptors if a buffer
-descriptor has length of zero and has crafted values in bd.flags.
-Set upper limit to number of buffer descriptors.
-
-Reported-by: Li Qiang <liqiang6-s@360.cn>
-
---- hw/net/mcf_fec.c.orig	2016-09-02 15:34:19.000000000 +0000
-+++ hw/net/mcf_fec.c
-@@ -23,6 +23,7 @@ do { printf("mcf_fec: " fmt , ## __VA_AR
- #define DPRINTF(fmt, ...) do {} while(0)
- #endif
- 
-+#define FEC_MAX_DESC 1024
- #define FEC_MAX_FRAME_SIZE 2032
- 
- typedef struct {
-@@ -149,7 +150,7 @@ static void mcf_fec_do_tx(mcf_fec_state 
-     uint32_t addr;
-     mcf_fec_bd bd;
-     int frame_size;
--    int len;
-+    int len, descnt = 0;
-     uint8_t frame[FEC_MAX_FRAME_SIZE];
-     uint8_t *ptr;
- 
-@@ -157,7 +158,7 @@ static void mcf_fec_do_tx(mcf_fec_state 
-     ptr = frame;
-     frame_size = 0;
-     addr = s->tx_descriptor;
--    while (1) {
-+    while (descnt++ < FEC_MAX_DESC) {
-         mcf_fec_read_bd(&bd, addr);
-         DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
-                 addr, bd.flags, bd.length, bd.data);
diff --git a/emulators/qemu/patches/patch-CVE-2016-7909 b/emulators/qemu/patches/patch-CVE-2016-7909
deleted file mode 100644
index 65042aa0d05..00000000000
--- a/emulators/qemu/patches/patch-CVE-2016-7909
+++ /dev/null
@@ -1,29 +0,0 @@
-$NetBSD: patch-CVE-2016-7909,v 1.1 2016/10/30 14:48:00 spz Exp $
-
-from:
-https://lists.gnu.org/archive/html/qemu-devel/2016-09/msg07942.html
-
-From: Prasad J Pandit <address@hidden>
-
-The AMD PC-Net II emulator has set of control and status(CSR)
-registers. Of these, CSR76 and CSR78 hold receive and transmit
-descriptor ring length respectively. This ring length could range
-from 1 to 65535. Setting ring length to zero leads to an infinite
-loop in pcnet_rdra_addr. Add check to avoid it.
-
-Reported-by: Li Qiang <address@hidden>
-
---- hw/net/pcnet.c.orig	2016-09-02 15:34:19.000000000 +0000
-+++ hw/net/pcnet.c
-@@ -1429,8 +1429,11 @@ static void pcnet_csr_writew(PCNetState 
-     case 47: /* POLLINT */
-     case 72:
-     case 74:
-+        break;
-     case 76: /* RCVRL */
-     case 78: /* XMTRL */
-+        val = (val > 0) ? val : 512;
-+        break;
-     case 112:
-        if (CSR_STOP(s) || CSR_SPND(s))
-            break;
diff --git a/emulators/qemu/patches/patch-configure b/emulators/qemu/patches/patch-configure
index 7d112b2cb66..1212f1ed4f0 100644
--- a/emulators/qemu/patches/patch-configure
+++ b/emulators/qemu/patches/patch-configure
@@ -1,12 +1,12 @@
-$NetBSD: patch-configure,v 1.14 2016/09/04 09:21:04 ryoon Exp $
+$NetBSD: patch-configure,v 1.15 2016/12/30 10:00:16 ryoon Exp $
 
 Don't use gld on SunOS
 add check for shm_open
 avoid bad substitution
 
---- configure.orig	2016-09-02 15:34:17.000000000 +0000
+--- configure.orig	2016-12-20 20:16:44.000000000 +0000
 +++ configure
-@@ -625,7 +625,6 @@ SunOS)
+@@ -631,7 +631,6 @@ SunOS)
    solaris="yes"
    make="${MAKE-gmake}"
    install="${INSTALL-ginstall}"
@@ -14,7 +14,18 @@ avoid bad substitution
    smbd="${SMBD-/usr/sfw/sbin/smbd}"
    needs_libsunmath="no"
    solarisrev=$(uname -r | cut -f2 -d.)
-@@ -3706,6 +3705,27 @@ if compile_prog "" "" ; then
+@@ -2928,8 +2927,8 @@ if test "$curses" != "no" ; then
+     curses_inc_list="$($pkg_config --cflags ncurses 2>/dev/null):"
+     curses_lib_list="$($pkg_config --libs ncurses 2>/dev/null):-lpdcurses"
+   else
+-    curses_inc_list="$($pkg_config --cflags ncursesw 2>/dev/null):-I/usr/include/ncursesw:"
+-    curses_lib_list="$($pkg_config --libs ncursesw 2>/dev/null):-lncursesw:-lcursesw"
++    curses_inc_list="$(@PREFIX@/bin/ncursesw6-config --cflags 2>/dev/null):-I/usr/include/ncursesw:"
++    curses_lib_list="$(@PREFIX@/bin/ncursesw6-config --libs 2>/dev/null):-lncursesw:-lcursesw"
+   fi
+   curses_found=no
+   cat > $TMPC << EOF
+@@ -3762,6 +3761,27 @@ if compile_prog "" "" ; then
    fallocate_zero_range=yes
  fi
  
@@ -42,7 +53,7 @@ avoid bad substitution
  # check for posix_fallocate
  posix_fallocate=no
  cat > $TMPC << EOF
-@@ -3955,8 +3975,13 @@ fi
+@@ -4041,8 +4061,13 @@ fi
  cat > $TMPC <<EOF
  #include <signal.h>
  #include <time.h>
@@ -56,7 +67,7 @@ avoid bad substitution
    return clock_gettime(CLOCK_REALTIME, NULL);
  }
  EOF
-@@ -4607,7 +4632,9 @@ if test "$want_tools" = "yes" ; then
+@@ -4797,7 +4822,9 @@ if test "$want_tools" = "yes" ; then
    tools="qemu-img\$(EXESUF) qemu-io\$(EXESUF) $tools"
    if [ "$linux" = "yes" -o "$bsd" = "yes" -o "$solaris" = "yes" ] ; then
      tools="qemu-nbd\$(EXESUF) $tools"
@@ -67,7 +78,7 @@ avoid bad substitution
    fi
  fi
  if test "$softmmu" = yes ; then
-@@ -5114,6 +5141,9 @@ fi
+@@ -5303,6 +5330,9 @@ fi
  if test "$fallocate_zero_range" = "yes" ; then
    echo "CONFIG_FALLOCATE_ZERO_RANGE=y" >> $config_host_mak
  fi