Fix the CBAR initialisation by using the newly defined static property.
CBAR is now set before realization, so the intended value is now
actually used.

So I have kind of tested this. I booted an ARM kernel on Highbank with
the stock Highbank DTB. It doesn't boot (and I will be doing something
wrong), but before this patch I got this:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at /workspaces/pcrost/public/linux2.git/arch/arm/mm/ioremap.c:301 __arm_ioremap_pfn_caller+0x180/0x198()
CPU: 0 PID: 0 Comm: swapper/0 Tainted: G        W 3.13.0-rc1-next-20131126-dirty #2
[<c0015164>] (unwind_backtrace) from [<c00118c0>] (show_stack+0x10/0x14)
[<c00118c0>] (show_stack) from [<c02bd5fc>] (dump_stack+0x78/0x90)
[<c02bd5fc>] (dump_stack) from [<c001f110>] (warn_slowpath_common+0x68/0x84)
[<c001f110>] (warn_slowpath_common) from [<c001f1f4>] (warn_slowpath_null+0x1c/0x24)
[<c001f1f4>] (warn_slowpath_null) from [<c0017c6c>] (__arm_ioremap_pfn_caller+0x180/0x198)
[<c0017c6c>] (__arm_ioremap_pfn_caller) from [<c0017cd8>] (__arm_ioremap_caller+0x54/0x5c)
[<c0017cd8>] (__arm_ioremap_caller) from [<c0017d10>] (__arm_ioremap+0x18/0x1c)
[<c0017d10>] (__arm_ioremap) from [<c03913c0>] (highbank_init_irq+0x34/0x8c)
[<c03913c0>] (highbank_init_irq) from [<c038c228>] (init_IRQ+0x28/0x2c)
[<c038c228>] (init_IRQ) from [<c03899ec>] (start_kernel+0x234/0x398)
[<c03899ec>] (start_kernel) from [<00008074>] (0x8074)
---[ end trace 3406ff24bd97382f ]---

Which disappears with this patch.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: fedec366aaa512d75093635f523d1dbcb3358361.1387160489.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

To allow the machine model to set device properties before CPU
realization.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 8c671e500390c8be0cc363e887e32867d1d1b0d2.1387160489.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The reset value of the CP15 CBAR is a vendor (machine) configurable
property. If ARM_FEATURE_CBAR is set, add it as a property at
post_init time.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Message-id: 2f1eec3f912135deea6252360e03645003d12e0a.1387160489.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Some processors (notably A9 within Highbank) define and use the
CP15 configuration base address (CBAR). This is vendor specific
so its best implemented as a CPU property (otherwise we would need
vendor specific child classes for every ARM implementation).

This patch prepares support for converting CBAR reset value to
a CPU property by moving the CP registration out of the CPU
init fn, as registration will need to happen at realize time
to pick up any property updates. The easiest way to do this
is via definition of a new ARM_FEATURE to flag the existence
of the register.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 9f697ef1e2ee60a3b9ef971a7f3bc3fa6752a9b7.1387160489.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The cp15.c15 space is implementation defined. Currently there is a
dummy placeholder register RAZing it. Allow overriding of this RAZ
so implementations of specific registers can take precedence.
Signed-off-by: NPeter Crosthwaite <peter.crosthwaite@xilinx.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: ed1bacec56dae00cb398c798f8240e8e685f949c.1387160489.git.peter.crosthwaite@xilinx.com
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Fix NOR flash manufacturer and device ID reading.  This now
properly takes into account device widths and device max widths
as required.  The reading of these IDs uses the same max_width
dependent addressing as CFI queries.

The old code remains for chips that don't specify a device width,
as the new code relies on a device width being set in order to
properly operate.  The existing code seems very broken.

Only ident0 and ident1 are used in the new code, as other fields
relate to the lock state of blocks in flash.

The VExpress flash configuration has been updated to match
the new code, as the existing definition was 'wrong' in order
to return the expected results with the broken device ID code.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Message-id: 1386279359-32286-8-git-send-email-roy.franz@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This change fixes the CFI query responses to handle NOR device
widths that are different from the bank width.  Support is also
added for multi-width devices in a x8 configuration.  This is
typically x8/x16 devices, but the CFI specification mentions
x8/x32 devices so those should be supported as well if they
exist.
The query response data is now replicated per-device in the bank,
and is adjusted for x16 or x32 parts configured in x8 mode.

The existing code is left in place for boards that have not
been updated to specify an explicit device_width.  The VExpress
board has been updated in an earlier patch in this series so
this is the only board currently affected.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Message-id: 1386279359-32286-7-git-send-email-roy.franz@linaro.org
[PMM: fixed a few formatting nits]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

For handling CFI and device ID reads, we need to not only know the
width that a NOR flash device is configured for, but also its maximum
width.  The maximum width addressing mode is used for multi-width
parts no matter which width they are configured for.  The most common
case is x16 parts that also support x8 mode.  When configured for x8
operation these devices respond to CFI and device ID requests differently
than native x8 NOR parts.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Message-id: 1386279359-32286-6-git-send-email-roy.franz@linaro.org
[PMM: Added comment explaining the semantics of width vs device-width
 vs max-device-width]
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Create vexpress specific pflash registration
function which properly configures the device-width
of 16 bits (2 bytes) for the NOR flash on the
vexpress platform.  This change is required for
buffered flash writes to work properly.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Message-id: 1386279359-32286-5-git-send-email-roy.franz@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Now that we know how wide each flash device that makes up the bank is,
return status for each device in the bank.  Leave existing code
that treats 32 bit wide banks as composed of two 16 bit devices as otherwise
we may break configurations that do not set the device_width propery.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Message-id: 1386279359-32286-4-git-send-email-roy.franz@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

The width of the devices that make up the flash interface
is required to mask certain commands, in particular the
write length for buffered writes.  This length will be presented
to each device on the interface by the program writing the flash,
and the flash emulation code needs to be able to determine
the length of the write as recieved by each flash device.
The device-width defaults to the bank width which should
maintain existing behavior for platforms that don't need
this change.
This change is required to support buffered writes on the
vexpress platform that has a 32 bit flash interface with 2
16 bit devices on it.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Message-id: 1386279359-32286-3-git-send-email-roy.franz@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Rename the 'width' member of the pflash_t structure
in preparation for adding a bank_width member.
Signed-off-by: NRoy Franz <roy.franz@linaro.org>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-id: 1386279359-32286-2-git-send-email-roy.franz@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

This adds support for the AESE/AESD/AESMC/AESIMC instructions that
are available on some v8 implementations of Aarch32.
Signed-off-by: NArd Biesheuvel <ard.biesheuvel@linaro.org>
Message-id: 1386266078-6976-1-git-send-email-ard.biesheuvel@linaro.org
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

qemu_opts_parse() can always return NULL, even if the QemuOptsList.desc in
question would be trivial to satisfy (eg. because it's empty). For
example:

qemu_opts_parse()
  opts_parse()
    qemu_opts_create()
      id_wellformed()

In practice:

  $ .../qemu-system-x86_64 -acpitable id=3
  qemu-system-x86_64: -acpitable id=3: Parameter 'id' expects an identifier
  **
  ERROR:vl.c:3491:main: assertion failed: (opts != NULL)
  Aborted (core dumped)

  $ .../qemu-system-x86_64 -smbios id=3
  qemu-system-x86_64: -smbios id=3: Parameter 'id' expects an identifier
  Segmentation fault (core dumped)

I checked all qemu_opts_parse() invocations (and all drive_def()
invocations too, because it blindly forwards the former's retval). Only
the two above examples look problematic.
Signed-off-by: NLaszlo Ersek <lersek@redhat.com>
Reviewed-by: NMarkus Armbruster <armbru@redhat.com>
Message-id: 1385658779-7529-1-git-send-email-lersek@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Collection of little cleanups anf bugfixes.
nbd patches in preparation of spice-nbd.

# gpg: Signature made Mon 16 Dec 2013 01:27:45 AM PST using RSA key ID D3E87138
# gpg: Can't check signature: public key not found

# By Marc-André Lureau (12) and Gerd Hoffmann (4)
# Via Gerd Hoffmann
* spice/tags/pull-spice-1:
  spice: stop server for qxl hard reset
  spice: move spice_server_vm_{start,stop} calls into qemu_spice_display_*()
  spice: move qemu_spice_display_*() from spice-graphics to spice-core
  nbd: avoid uninitialized warnings
  nbd: finish any pending coroutine
  nbd: make nbd_client_session_close() idempotent
  nbd: pass export name as init argument
  nbd: don't change socket block during negotiate
  Split nbd block client code
  spice-char: implement chardev port event
  char: add qemu_chr_fe_event()
  include: add missing config-host.h include
  qmp_change_blockdev() remove unused has_format
  spice-char: remove unused field
  vscclient: do not add a socket watch if there is not data to send
  spice: flip streaming video mode to off by default

Block patches

# gpg: Signature made Fri 13 Dec 2013 09:47:03 AM PST using RSA key ID C88F2FD6
# gpg: Can't check signature: public key not found

# By Peter Lieven (2) and others
# Via Kevin Wolf
* kwolf/tags/for-anthony:
  blkdebug: Use QLIST_FOREACH_SAFE to resume IO
  qemu-img: make progress output more accurate during convert
  block: expect get_block_status errors in bdrv_make_zero
  block/vvfat: Fix compiler warnings for OpenBSD
  qapi-schema.json: Change 1.8 reference to 2.0
  sheepdog: check if '-o redundancy' is passed from user

Message-id: 1386956943-19474-1-git-send-email-kwolf@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Hard reset can happen at any time.  We should be able to put qxl into a
known-good state no matter what.  Stop spice server thread for reset so
it can't be confused by fetching stale commands lingering around in the
rings while we reset is ongoing.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

So calling spice server to start/stop the worker goes
hand in hand with the status variable update.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

==15815== Thread 1:
==15815== Syscall param socketcall.sendto(msg) points to uninitialised byte(s)
==15815==    at 0x65AD5CB: send (send.c:31)
==15815==    by 0x37F84B: nbd_wr_sync (nbd.c:145)
==15815==    by 0x37F94B: write_sync (nbd.c:186)
==15815==    by 0x380FA9: nbd_send_request (nbd.c:681)
==15815==    by 0x1C4A2D: nbd_teardown_connection (nbd-client.c:337)
==15815==    by 0x1C4AD8: nbd_client_session_close (nbd-client.c:354)
==15815==    by 0x1ED2D8: close_socketpair (spicebd.c:132)
==15815==    by 0x1EE265: spice_close (spicebd.c:457)
==15815==    by 0x1ACBF6: bdrv_close (block.c:1519)
==15815==    by 0x1AD804: bdrv_delete (block.c:1772)
==15815==    by 0x1B4136: bdrv_unref (block.c:4476)
==15815==    by 0x1ACCE0: bdrv_close (block.c:1541)
==15815==  Address 0x7feffef98 is on thread 1's stack
Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Make sure all pending coroutines are finished when closing the session.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

There is no need to keep the export name around, and it seems a better
fit as an argument in the init() call.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

The caller might handle non-blocking using coroutine. Leave the choice
to the caller to use a blocking or non-blocking negotiate.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: NPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Wire up chardev fe_event to Spice port.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Teach the chardev frontend to send event. This is used by the Spice port
chardev currently.
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Signed-off-by: NMarc-André Lureau <marcandre.lureau@gmail.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Fixes the following error:
** (process:780): CRITICAL **: do_socket_send: assertion
`socket_to_send->len != 0' failed
Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>

Video streaming detection heuristics in spice-server have problems
keeping modern desktop animations (as done by gnome shell) and real
video playback apart.  This leads to jpeg compression artefacts on
your desktop, due to spice using mjpeg to send what it thinks is
a video stream.

Turn off video detection by default to avoid these artifacts.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Reviewed-by: NAlon Levy <alevy@redhat.com>

# By Andreas Färber (18) and Paolo Bonzini (12)
# Via Paolo Bonzini
* bonzini/virtio: (30 commits)
  virtio: Convert exit to unrealize
  virtio: Complete converting VirtioDevice to QOM realize
  virtio-scsi: Convert to QOM realize
  virtio-rng: Convert to QOM realize
  virtio-balloon: Convert to QOM realize
  virtio-net: Convert to QOM realize
  virtio-serial: Convert to QOM realize
  virtio-blk: Convert to QOM realize
  virtio-9p: Convert to QOM realize
  virtio: Start converting VirtioDevice to QOM realize
  virtio-scsi: QOM realize preparations
  virtio-rng: QOM realize preparations
  virtio-balloon: QOM realize preparations
  virtio-net: QOM realize preparations
  virtio-serial: QOM realize preparations
  virtio-blk: QOM realize preparations
  virtio-9p: QOM realize preparations
  virtio-blk-dataplane: Improve error reporting
  virtio-pci: add device_unplugged callback
  virtio-rng: switch exit callback to VirtioDeviceClass
  ...

acpi.pci,pc,memory core fixes

Most notably this includes changes to exec to support
full 64 bit addresses.

This also flushes out patches that got queued during 1.7 freeze.
There are new tests, and a bunch of bug fixes all over the place.
There are also some changes mostly useful for downstreams.

I'm also listing myself as pc co-maintainer. I'm doing this reluctantly,
but this seems to be necessary to make sure patches are not lost or delayed too
much, and posting the MAINTAINERS patch did not seem to make anyone else
volunteer.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>

# gpg: Signature made Wed 11 Dec 2013 10:21:51 AM PST using RSA key ID D28D5469
# gpg: Can't check signature: public key not found

# By Michael S. Tsirkin (14) and others
# Via Michael S. Tsirkin
* mst/tags/for_anthony: (28 commits)
  pc: use macro for HPET type
  hpet: fix build with CONFIG_HPET off
  acpi unit-test: adjust the test data structure for better handling
  acpi unit-test: load and check facs table
  exec: separate sections and nodes per address space
  memory.c: bugfix - ref counting mismatch in memory_region_find
  hpet: enable to entitle more irq pins for hpet
  hpet: inverse polarity when pin above ISA_NUM_IRQS
  pci: fix pci bridge fw path
  ACPI DSDT: Make control method `IQCR` serialized
  acpi: strip compiler info in built-in DSDT
  acpi unit-test: verify signature and checksum
  smbios: Set system manufacturer, product & version by default
  exec: reduce L2_PAGE_SIZE
  exec: make address spaces 64-bit wide
  exec: memory radix tree page level compression
  exec: pass hw address to phys_page_find
  exec: extend skip field to 6 bit, page entry to 32 bit
  exec: replace leaf with skip
  split definitions for exec.c and translate-all.c radix trees
  ...

Message-id: cover.1386786228.git.mst@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

# By Paolo Bonzini (4) and Peter Lieven (1)
# Via Paolo Bonzini
* bonzini/scsi-next:
  help: add id suboption to -iscsi
  scsi-disk: fix WRITE SAME with large non-zero payload
  block/iscsi: introduce bdrv_co_{readv, writev, flush_to_disk}
  scsi-disk: fix VERIFY emulation
  scsi-bus: fix transfer length and direction for VERIFY command

Message-id: 1386594157-17535-1-git-send-email-pbonzini@redhat.com
Signed-off-by: NAnthony Liguori <aliguori@amazon.com>

Qemu-iotest 030 was broken.

When the coroutine runs and finishes, it will remove itself from the req
list, so let's use safe version of foreach to avoid use after free.
Signed-off-by: NFam Zheng <famz@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

the progress output is very bumpy if the input images contains
a significant portion of unallocated sectors. This patch
checks how much sectors are allocated a priori if progress
output is selected.
Signed-off-by: NPeter Lieven <pl@kamp.de>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

during testing around with 4k LUNs a bad target implementation
triggert an -EIO in iscsi_get_block_status, but it got never caught
resulting in an infinite loop.

CC: qemu-stable@nongnu.org
Signed-off-by: NPeter Lieven <pl@kamp.de>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

The buildbot shows these compiler warnings:

block/vvfat.c: In function 'create_short_and_long_name':
block/vvfat.c:620: warning: array size (8) smaller than bound length (11)
block/vvfat.c:620: warning: array size (8) smaller than bound length (11)
block/vvfat.c:635: warning: array size (8) smaller than bound length (11)
block/vvfat.c:635: warning: array size (8) smaller than bound length (11)

They are caused by tricky code where 8 characters for the name are followed
by 3 characters for the extension, and some operations touch both name and
extension.

Using an 11 character name which includes the extension fixes the compiler
warning, satisfies cppcheck, valgrind and maybe other static and dynamic
code checkers, and even simplifies some parts of the code.
Signed-off-by: NStefan Weil <sw@weilnetz.de>
Reviewed-by: NStefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>

Reviewed-by: NEric Blake <eblake@redhat.com>
Signed-off-by: NKevin Wolf <kwolf@redhat.com>