* 'ppc-next' of git://repo.or.cz/qemu/agraf: (24 commits)
  pseries: Add partial support for PCI
  ppc: Alter CPU state to mask out TCG unimplemented instructions as appropriate
  pseries: Allow writes to KVM accelerated TCE table
  KVM: PPC: Override host vmx/vsx/dfp only when information known
  ppc: Fix up usermode only builds
  pseries: Correct vmx/dfp handling in both KVM and TCG cases
  PPC: Fail configure when libfdt is not available
  ppc: Avoid decrementer related kvm exits
  PPC: Disable non-440 CPUs for ppcemb target
  PPC: Bump qemu-system-ppc to 64-bit physical address space
  pseries: Under kvm use guest cpu = host cpu by default
  ppc: Add cpu defs for POWER7 revisions 2.1 and 2.3
  ppc: First cut implementation of -cpu host
  ppc: Remove broken partial PVR matching
  pseries: Update SLOF firmware image
  pseries: Add device tree properties for VMX/VSX and DFP under kvm
  ppc: Generalize the kvmppc_get_clockfreq() function
  Set an invalid-bits mask for each SPE instructions
  pseries: Update SLOF firmware image
  pseries: Use Book3S-HV TCE acceleration capabilities
  ...

OpenCores 10/100 Mbps Ethernet MAC specification doesn't clearly state
whether FCS is counted in the RX frame length or not. Looks like it is.
Append zero FCS to the received frames.

Get rid of big static buffer for RX frame padding, optimize it for the
most common MINFL value range.

Set RXD_TL for the long frames only when HUGEN bit is set.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch increases robustness when migrating to a file with
two little changes:

 (1) Before closing the migration file handle checks if it happens to be
     a regular file and if so it issues a fsync.  This way the data is
     flushed to disk before qemu sends the migration completed event.
 (2) It adds error checking.  In case either fsync or close syscall
     fails pass up the error (and fail migration).

[ v2: return -errno instead of -1 ]

Cc: Juan Quintela <quintela@redhat.com>
Cc: Jiri Denemark <jdenemar@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

There is a "test-coroutine" which isn't in the list.
Add it so "make check" runs it too.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add some Makefile glue so we have a simple "make check"
to run the unit tests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Create a new CHECKS variable.  Put the checks there instead
of adding them to the TOOLS variable.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Probe for libcheck and build checks (if found) by default.
Can be explicitly disabled using --disable-check-utests.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Undefine ABS to avoid a clash with the macro that glib.h
helpfully defines for us (and a resulting build failure
on ia64 hosts).
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

A simple migration reproduces it:

1. Start the source VM with:

   # qemu [...] -S

2. Start the destination VM with:

   # qemu <source VM cmd-line> -incoming tcp:0:4444

3. In the source VM:

   (qemu) migrate -d tcp:0:4444

4. The source VM will segfault as soon as migration completes (might not
   happen in the first try)

What is happening here is that qemu_file_put_notify() can end up closing
's->file' (in which case it's also set to NULL). The call stack is rather
complex, but Eduardo helped tracking it to:

select loop -> migrate_fd_put_notify() -> qemu_file_put_notify() ->
buffered_put_buffer() -> migrate_fd_put_ready() ->
migrate_fd_completed() -> migrate_fd_cleanup().

To be honest, it's not completely clear to me in which cases 's->file'
is not closed (on error maybe)? But I doubt this fix will make anything
worse.
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Acked-by: NEduardo Habkost <ehabkost@redhat.com>
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

.gitignore already lists the qapi-generated subdirectory which includes a
number of files generated during build.  However, there are some additional
files generated by the qapi build which go in the top level directory.

This patch adds them to .gitignore, removing the irritating noise from
diffs and the like.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

qemu-barrier.h tests if macro __powerpc__ is defined, however, the
preprocessor on PowerPC Mac OS X defines only __POWERPC__, not
__powerpc__.  Resolve by testing instead for qemu-provided _ARCH_PPC.
Signed-off-by: NEric Sunshine <sunshine@sunshineco.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPavel Borzenkov <pavel.borzenkov@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

After the removal of the non-threaded mode cpu_exec_all is now only used
by TCG. Refactor it accordingly, also dropping its unused return value.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Make cpu_single_env thread-local. This fixes a regression
in handling of multi-threaded programs in linux-user mode
(bug 823902).
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
[Peter Maydell: rename tls_cpu_single_env to cpu_single_env]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NAndreas Färber <afaerber@suse.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Drop the cpu_single_env definition as it is unused.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Add an abstraction layer for defining and using thread-local
variables. For the moment this is implemented only for Linux,
which means they can only be used in restricted circumstances.
The abstraction layer allows us to add POSIX and Win32 support
later.
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Spotted via code review, we initialize offset to 0 to avoid a
compiler warning, but in the unlikely case that offset is
never set to something else, we should abort instead of return
a value that will almost certainly cause problems.
Signed-off-by: NAlex Williamson <alex.williamson@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

The whole usb_host_close() function is skipped in case the device is not
in attached state.  This is wrong though, only then usb_device_detach()
must be skipped, all other cleanup (especially device reset and closing
the file handle) still needs to be done.  There are code paths where
usb_host_close() is called with the device in detached state already.

This fixes usb-host devices not being released and returned to the host
after removing them with device_del.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Some USB drivers, for example USBASPI.SYS, will skip different type of
device which has same VID/PID. The following patch helps preventing
usb-msd being skipped by the driver.
Signed-off-by: NRoy Tam <roytam@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Valgrind is a tool which can automatically detect many kinds of bugs.

Running QEMU on Valgrind with x86_64 hosts was not possible because
Valgrind aborts when memalign is called with an alignment larger than
1 MiB. QEMU normally uses 2 MiB on Linux x86_64.

Now the alignment is reduced to the page size when QEMU is running on
Valgrind.

v2:
Instead of using the macro RUNNING_ON_VALGRIND from valgrind.h,
the patch now uses a hack from libvirt which tests for the pre-loaded
vgpreload_*.so shared libraries. This avoids the need for valgrind.h.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Officially take on maintainership for PReP and upgrade to Odd Fixes.
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Cc: Alexander Graf <agraf@suse.de>
Cc: Hervé Poussineau <hpoussin@reactos.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

A basic wildcard matching is supported in both the monitor command
"trace-event" and the events list file. That means you can enable/disable
the events having a common prefix in a batch. For example, virtio-blk trace
events could be enabled using:
    trace-event virtio_blk_* on
Signed-off-by: NMark Wu <wudxw@linux.vnet.ibm.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

When attaching a new device we must send a wakeup request to the root
hub, otherwise the guest will not notice the new device in case the
usb hub is suspended.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

RHBZ 740547

If we migrate when the device is in vga state the guest
still believes the slots are created, and will cause operations
that reference the slots, causing a "panic: virtual address out of range"
on the first of them. Easy to see by migrating in vga mode with
a driver loaded, for instance windows cmd window in full screen mode,
and then exiting vga mode back to native mode will cause said panic.

Fixed by doing the slot recreation in post_load for vga mode as well.
Note that compat does not require any changes because it creates it's
only slot by a side effect of QXL_IO_SET_MODE.
Signed-off-by: NAlon Levy <alevy@redhat.com>

The qxl renderer works only with a shared displaysurface.  So better
make sure we actually have one and restore it when needed.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

spice uses negative stride value to signal the bitmap is upside down.
The qxl renderer (used for scl, vnc and screenshots) wants a positive
value because it is easier to work with.  The positive value is then
stored in the very same variable, which has the drawback that the
upside-down test works only once.  Fix by using two variables.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Reproducer:

    $ MALLOC_PERTURB_=234 qemu-system-x86_64 -vnc :0,acl,sasl [...]
    QEMU 0.15.50 monitor - type 'help' for more information
    (qemu) acl_add vnc.username fred allow
    acl: added rule at position 1
    (qemu) acl_reset vnc.username
    Segmentation fault (core dumped)

Spotted by Coverity.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

C99 7.15.1: Each invocation of the va_start and va_copy macros shall
be matched by a corresponding invocation of the va_end macro in the
same function.

Spotted by Coverity.  Harmless on the (common) systems where va_end()
does nothing.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

I'm getting:

    could not configure /dev/net/tun (tap%d): Operation not permitted

When the ioctl() fails, ifr.ifr_name will most likely not be overwritten.
So we better only use it when ifname contains a string.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Conflicts:
	block/vmdk.c

Conflicts:
	ui/spice-core.c