if the blocksize of an iSCSI LUN is bigger than the BDRV_SECTOR_SIZE
it is possible that sector_num or nb_sectors are not correctly
aligned.

to avoid corruption we fail requests which are misaligned.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

this hask is not working (anymore). support for misaligned offsets should
be handled at the block layer.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

the -ENOPSC case did not work due to the missing goto.
Reported-by: NKevin Wolf <kwolf@redhat.com>
Signed-off-by: NPeter Lieven <pl@kamp.de>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

Don't assume that SG_IO is always invoked with a simple buffer,
check the iovec_count and if it is >= 1 then we need to pass an array
of iovectors to libiscsi instead of just a plain buffer.
Signed-off-by: NRonnie Sahlberg <ronniesahlberg@gmail.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: NPaolo Bonzini <pbonzini@redhat.com>

# By Chegu Vinod
# Via Juan Quintela
* quintela/migration.next:
  Force auto-convegence of live migration
  Add 'auto-converge' migration capability
  Introduce async_run_on_cpu()

Message-id: 1373664508-5404-1-git-send-email-quintela@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Dominik Dingel
# Via Cornelia Huck
* cohuck/virtio-ccw-upstr:
  virtio-ccw: Enable x-data-plane for virtio-ccw-blk

Message-id: 1373903207-27085-1-git-send-email-cornelia.huck@de.ibm.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

target-arm queue

# gpg: Signature made Mon 15 Jul 2013 11:15:13 AM CDT using RSA key ID 14360CDE
# gpg: Can't check signature: public key not found

# By Mans Rullgard (3) and others
# Via Peter Maydell
* pmaydell/tags/pull-target-arm-20130715-1:
  target-arm: Avoid g_hash_table_get_keys()
  target-arm: avoid undefined behaviour when writing TTBCR
  target-arm/helper.c: Allow const opaques in arm CP
  target-arm/helper.c: Implement MIDR aliases
  target-arm/helper.c: OMAP/StrongARM cp15 crn=0 cleanup
  target-arm: explicitly decode SEVL instruction
  target-arm: implement LDA/STL instructions
  target-arm: add feature flag for ARMv8

Message-id: 1373905022-27735-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

arm-devs queue

# gpg: Signature made Mon 15 Jul 2013 10:53:44 AM CDT using RSA key ID 14360CDE
# gpg: Can't check signature: public key not found

# By Peter Maydell (4) and others
# Via Peter Maydell
* pmaydell/tags/pull-arm-devs-20130715:
  ARM/highbank: add support for Calxeda ECX-2000 / Midway
  ARM/highbank: prepare for adding similar machines
  hw/arm/vexpress: Add alias for flash at address 0 on A15 board
  hw/dma/omap_dma: Fix bugs with DMA requests above 32
  sd/pl181.c: Avoid undefined shift behaviour in RWORD macro
  hw/cpu/a15mpcore: Correct default value for num-irq
  char/cadence_uart: Fix reset for unattached instances

Message-id: 1373904095-27592-1-git-send-email-peter.maydell@linaro.org
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Richard Henderson
# Via Richard Henderson
* rth/axp-next:
  hw/alpha: Use SRM epoch
  hw/alpha: Drop latch_tmp hack
  exec: Support 64-bit operations in address_space_rw
  hw/alpha: Don't machine check on missing pci i/o
  hw/alpha: Don't use get_system_io

Message-id: 1373840171-25556-1-git-send-email-rth@twiddle.net
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

# By Kevin Wolf (6) and Stefan Hajnoczi (2)
# Via Kevin Wolf
* kwolf/for-anthony:
  ahci: Fix FLUSH command
  migration: Fail migration on bdrv_flush_all() error
  cpus: Add return value for vm_stop()
  block: Add return value for bdrv_flush_all()
  qemu-iotests: Update 051 reference output
  block: Don't parse protocol from file.filename
  block: add drive_backup HMP command
  blockdev: add sync mode to drive-backup QMP command

Message-id: 1373887000-4488-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

g_hash_table_get_keys() was only introduced in glib 2.14, and we're
still targeting a minimum version of 2.12.  Rewrite the offending
code (introduced in commit 721fae12) to use g_hash_table_foreach()
to build the list of keys.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Tested-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 1372678819-8633-1-git-send-email-peter.maydell@linaro.org

LPAE CPUs have more potentially valid bits in the TTBCR, and so the
simple masking out of invalid bits is no longer sufficient to obtain
the base address width field of the register, which is what we use to
precalculate c2_mask and c2_base_mask.  Explicitly extract the
relevant register field rather than simply shifting by the register
value.

This bug would have had no ill effects in practice, since if the
EAE bit (TTBCR bit 31) is set then we don't use the precalculated
masks, and if EAE is zero then bits 30..3 are all UNK/SBZP, so
well-behaved guests won't set them. However the shift is undefined
behaviour, so we should avoid it.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1372347527-4428-1-git-send-email-peter.maydell@linaro.org

Allow for defining const opaque data in ARM CP register definitions by
setting .opaque = foo. If non null opaque is passed into
define_one_arm_cp_reg_with_opaque then that opaque will take
precedence, otherwise if null opaque is passed, the original opaque
data will be used.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: cf0a3ac3438d97464240db9f5f4ef1585cbc1d77.1373429432.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Unimplemented registers in the cp15, CRn=0, opc1=0, CRm=0 space default
to aliasing the MIDR register. Set all registers in the space to access
MIDR by default.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 6127846712b7ad2727354a4f5e1d809451f1e859.1373429432.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The if block detecting OMAP/StrongARM modifies the id_cp_reginfo
.access fields in place. So there is no need to replicate the call
to define_arm_cp_reg(). Dropped, and let the OMAP case fall through
to the normal behaviour after the in-place modification.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 72aae9b8ebbc9a76d2b06faf8666ef8a4b34b92a.1373429432.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The ARMv8 SEVL instruction is in the architectural hint space already
emulated as nop.  This makes the decoding of SEVL explicit for clarity.
Signed-off-by: NMans Rullgard <mans@mansr.com>
Message-id: 1370606786-5650-3-git-send-email-mans@mansr.com
[PMM: added 'SEVL' to the TODO comment]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This adds support for the ARMv8 load acquire/store release instructions.
Since qemu does nothing special for memory barriers, these can be
emulated like their non-acquire/release counterparts.
Signed-off-by: NMans Rullgard <mans@mansr.com>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Add property x-data-plane to virtio-ccw-blk devices.
Signed-off-by: NDominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: NCornelia Huck <cornelia.huck@de.ibm.com>

The Calxeda ECX-2000 chip (aka. Midway) is model-wise quite similar
to the Highbank. The most prominent difference is the Cortex-A15 CPU
core in it, together with the associated core peripherals.

Add a new ARM machine type called "midway".
Move the L2 cache controller device into the Highbank specific part,
since Midway does not have (and need) it.
Signed-off-by: NAndre Przywara <andre.przywara@calxeda.com>
Message-id: 1373026897-12085-3-git-send-email-andre.przywara@calxeda.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

To allow the modelling of machines similar to Calxeda Highbank,
introduce a parameter to the init function and call it from a
wrapper. This allows to tweak the definition for individual machines
later on.
Signed-off-by: NAndre Przywara <andre.przywara@calxeda.com>
Message-id: 1373026897-12085-2-git-send-email-andre.przywara@calxeda.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The A15 Versatile Express board can remap a variety of things at address
0. We don't currently emulate the Serial Configuration Controller which
is how the guest can control this remapping, but we can provide the
initial default mapping of the first flash device into this space.
In particular this allows QEMU to boot flash images such as UEFI which
expect to include an exception vector table.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Tested-by: NGrant Likely <grant.likely@linaro.org>
Message-id: 1373374180-19884-1-git-send-email-peter.maydell@linaro.org

The drqbmp field of struct soc_dma_s is a uint64_t; however several
places in the code attempt to set bits in it using "(1 << drq)",
which will fail if drq is large enough that the 1 bit gets shifted
off the top of a 32 bit integer.  Change these to "(1ULL << drq)" so
that the promotion to 64 bit happens before the shift rather than
afterwards.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1372423919-5669-1-git-send-email-peter.maydell@linaro.org

Add a cast to avoid potentially shifting into the sign bit of
a signed value, which is undefined behaviour in C.

(Detected with clang's -fsanitize=undefined.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1372341831-4264-1-git-send-email-peter.maydell@linaro.org

The a15mpcore device claims that its default value for num-irq
is the number of interrupts used by the A15MP in the vexpress-a15
board. However that chip has 128 external interrupts, not 64.
Since there is only one A15 based model in QEMU currently, we
can fix this by simply changing the default value.

This error was causing recent (3.10) Linux kernels to print
warnings/backtraces when the number of interrupts reported
by the GIC was smaller than an interrupt number they wanted
to use.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1373032481-15280-1-git-send-email-peter.maydell@linaro.org

Signed-off-by: NMans Rullgard <mans@mansr.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

commit 1db8b5ef introduced an issue
where QEMU would segfault if you have an unattached Cadence UART.

Fix by guarding the flush-on-reset logic on there being a qemu_chr
attachment.
Reported-by: NSoren Brinkmann <soren.brinkmann@xilinx.com>
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Tested-by: NSoren Brinkmann <soren.brinkmann@xilinx.com>
Message-id: 9009578ee10a50d994b2e10aa2840d73765f5968.1370577272.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

AHCI couldn't cope with asynchronous commands that aren't doing DMA, it
simply wouldn't complete them. Due to the bug fixed in commit f68ec837,
FLUSH commands would seem to have completed immediately even if they
were still running on the host. After the commit, they would simply hang
and never unset the BSY bit, rendering AHCI unusable on any OS sending
flushes.

This patch adds another callback for the completion of asynchronous
commands. This is what AHCI really wants to use for its command
completion logic rather than an DMA completion callback.

Cc: qemu-stable@nongnu.org
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

If bdrv_flush_all() returns an error, there is an inconsistency in the
view of an image file between the source and the destination host.
Completing the migration would lead to corruption. Better abort
migration in this case.

To reproduce this case, try the following (ensures that there is
something to flush, and then fails that flush):

$ qemu-img create -f qcow2 test.qcow2 1G
$ cat blkdebug.cfg
[inject-error]
event = "flush_to_os"
errno = "5"
$ qemu-system-x86_64 -hda blkdebug:blkdebug.cfg:test.qcow2 -monitor stdio
(qemu) qemu-io ide0-hd0 "write 0 4k"
(qemu) migrate ...
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

If flushing the block devices fails, return an error. The VM is stopped
anyway.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

bdrv_flush() can fail, and bdrv_flush_all() should return an error as
well if this happens for a block device. It returns the first error
return now, but still at least tries to flush the remaining devices even
in error cases.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>

This has been broken by commit bd5c51ee.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

One of the major reasons for doing something new for -blockdev and
blockdev-add was that the old block layer code parses filenames instead
of just taking them literally. So we should really leave it untouched
when it's passing using the new interfaces (like -drive
file.filename=...).

This allows opening relative file names that contain a colon.
Signed-off-by: NKevin Wolf <kwolf@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>

Make "drive_backup" available on the HMP monitor:

  drive_backup [-n] [-f] device target [format]

The -n flag requests QEMU to reuse the image found in new-image-file,
instead of recreating it from scratch.

The -f flag requests QEMU to copy the whole disk, so that the result
does not need a backing file.  Note that this flag *must* currently be
passed since the other sync modes ('none' and 'top') have not been
implemented yet.  Requiring it ensures that "drive_backup" behaves like
"drive_mirror".
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The drive-backup command is similar to the drive-mirror command, except
no guest data written after the command executes gets copied.  Add a
sync mode argument which determines whether the entire disk is copied,
just allocated clusters, or only clusters being written to by the guest.

Currently only sync mode 'full' is supported - it copies the entire disk.
For read-only point-in-time snapshots we may only need sync mode 'none'
since the target can be a qcow2 file using the guest's disk as its
backing file (no need to copy the entire disk).  Finally, sync mode
'top' is useful if we wish to preserve the backing chain.

Note that this patch just adds the sync mode argument to drive-backup.
It does not implement sync modes 'top' or 'none'.  This patch is
necessary so we can add a drive-backup HMP command that behaves like the
existing drive-mirror HMP command and takes a sync mode.
Signed-off-by: NStefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The 1980 epoch is used by the ARC PALcode for NT.  But we're emulating
a system using the SRM PALcode.  Using the proper epoch results in less
confusion in the guest userland.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

The memory and i/o core now support passing 64-bit accesses along
from the guest, so we no longer need to emulate them.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Honor the implementation maximum access size, and at least check
the minimum access size.
Reviewed-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Not really correct, but we don't implement all of the random devices
that the kernel looks for.  This is good enough to keep us booting.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Advancements in the ioport subsystem mean that we need no longer
thunk memory-mapped i/o through the system-io address space.
Signed-off-by: NRichard Henderson <rth@twiddle.net>

Setting it to LE forces a byte swap when host != guest endian but
this makes no sense at all.

Herve made the suggestion upon observing that word writes/reads
were broken into byte writes/reads in such a way as to assume
devices are interpret registers as LE.

However, even if this were a problem, marking the region as LE is
not useful because what's essentially happening here is that LE is
open coded.  So by marking it LE in MemoryRegionOps, we're doing a
superflous swap.

Now, the portio code is suspicious to begin with.  The dispatch
layer really has no purpose in splitting I/O requests in the first
place...

Cc: Hervé Poussineau <hpoussin@reactos.org>
Cc: Alex Graf <agraf@suse.de>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>