The icebp instruction can be abused to terminate the emulation,
resulting in denial of service.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5921 c046a42c-6fe2-441c-8c8c-71466251a162

The emulated network cards in QEMU allows local users to execute arbitrary
code by writing Ethernet frames with a size larger than the slirp's default
MTU, which triggers a heap-based buffer overflow in the slirp library.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5920 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes a few things after Paul's improvements for TCG debugging:

  - change TCGv_i64 field name to something different from
    TCGv_i32
  - fix things in tcg that the above change made visible.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5919 c046a42c-6fe2-441c-8c8c-71466251a162

... which left was enabled by mistake.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5918 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5917 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5916 c046a42c-6fe2-441c-8c8c-71466251a162

Silences a warning about possible unitialized use of t0.
Signed-off-by: NAndreas Faerber <andreas.faerber@web.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5915 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5914 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes the destination and accumulator registers for the smmul
and smmla instructions.
Signed-off-by: NMans Rullgard <mans@mansr.com>
Acked-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5913 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes the destination and accumulator registers for the usad8
and usada8 instructions.
Signed-off-by: NMans Rullgard <mans@mansr.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5912 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5911 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5910 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5909 c046a42c-6fe2-441c-8c8c-71466251a162

 - gen_set_CF_bit31:  use the right value to set carry flag
 - shifter_out_im:  remove a spurious semi-colon
 - add a break for VSHRN, VRSHRN, VQSHRN, VQRSHRN
   size 2 case
 - sbfx, ubfx are v6t2 instructions

The correct cps user mode behaviour is unclear so it's left out from the
commit until ARM decides it.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5908 c046a42c-6fe2-441c-8c8c-71466251a162

  - remove macros that are not used
  - remove disass structure is_mem field which value is never used
  - correct a typo in a comment.
Signed-off-by: NLaurent Desnogues <laurent.desnogues@gmail.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5907 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5906 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5905 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5904 c046a42c-6fe2-441c-8c8c-71466251a162

Openserver 5.0.5 sends an Inquiry command to the emulated SCSI disk
expecting a response length of 40 bytes. Currently the response to an
Inquiry command is hardcoded to 36 bytes. When receiving a response of
length 36 instead of 40 Openserver panics.

Modifications to original patch based on feedback from Ryan Harper and Paul
Brook. Thanks guys.
Signed-off-by: NJustin Chevrier <address@hidden>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5903 c046a42c-6fe2-441c-8c8c-71466251a162

Basically after each DMA transfer the Openserver driver would issue an
empty (0) SCRIPTS opcode. As the opcode is essentially a NOP it has no
second DWORD and therefore the DSP should only be incremented by 4 bytes
instead of the 8 bytes we currently do.

Here's a snippet of the log:

lsi_scsi: Data ready tag=0x100d9 len=16384
...
lsi_scsi: SCRIPTS dsp=068c5e50 opcode 01000400 arg 07a09000
lsi_scsi: DMA addr=0x07a09000 len=1024
lsi_scsi: SCRIPTS dsp=068c5e58 opcode 00000000 arg 01000400
lsi_scsi: Wrong phase got 1 expected 0

Note the 2nd DWORD after the empty opcode; the next opcode in the DMA
transfer sequence. As can be expected the address after that has the next
DMA address to use.

After the attached patch the DMA transfer is able to complete successfully:

lsi_scsi: SCRIPTS dsp=068c5e50 opcode 01000400 arg 07a0d000
lsi_scsi: DMA addr=0x07a0d000 len=1024
lsi_scsi: SCRIPTS dsp=068c5e5c opcode 01000400 arg 07a0d400
lsi_scsi: DMA addr=0x07a0d400 len=1024
...

Tested againsted Openserver 5.0.5 and Debian ARM.
Signed-off-by: NJustin Chevrier <address@hidden>
Acked-by: NRyan Harper <ryanh@us.ibm.com>
Signed-off-by: NAndrzej Zaborowski <andrew.zaborowski@intel.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5902 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NJustin Chevrier <address@hidden>
Acked-by: NRyan Harper <ryanh@us.ibm.com>
Acked-by: NChris Wright <chrisw@sous-sol.org>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5901 c046a42c-6fe2-441c-8c8c-71466251a162

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5900 c046a42c-6fe2-441c-8c8c-71466251a162

This way the registers will only be visible at the given offset instead of
every 0x100 bytes.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5899 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5898 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>



git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5897 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5896 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5895 c046a42c-6fe2-441c-8c8c-71466251a162

This fixes compilation of hw/virtio.h on Mac OS X.
Signed-off-by: NAndreas Faerber <andreas.faerber@web.de>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5894 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5893 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5892 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5891 c046a42c-6fe2-441c-8c8c-71466251a162

This reverts commit 5876.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5890 c046a42c-6fe2-441c-8c8c-71466251a162

Vectored IO APIs will require some sort of vector argument.  It makes sense to
use struct iovec and just define it globally for Windows.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>



git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5889 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NChristoph Egger <Christoph.Egger@amd.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5888 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NChristoph Egger <Christoph.Egger@amd.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5887 c046a42c-6fe2-441c-8c8c-71466251a162

which compile.
Signed-off-by: NChristoph Egger <Christoph.Egger@amd.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5886 c046a42c-6fe2-441c-8c8c-71466251a162

the <sys/queue.h> system header. <sys/disk.h> uses SLIST_ENTRY
on NetBSD, which doesn't exist in sys-queue.h. Therefore,
include <sys/queue.h> before including sys-queue.h.
Signed-off-by: NChristoph Egger <Christoph.Egger@amd.com>


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5885 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5884 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5883 c046a42c-6fe2-441c-8c8c-71466251a162

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5882 c046a42c-6fe2-441c-8c8c-71466251a162