Fix a buffer overflow, reported by cppcheck:
[/src/qemu/hw/ppc405_uc.c:72]: (error) Buffer access out-of-bounds: bd.bi_s_version

The use of field bi_s_version seems to be a typo, it should be
bi_r_version.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a buffer overflow, reported by cppcheck:
[/src/qemu/hw/lan9118.c:849]: (error) Buffer access out-of-bounds: s.eeprom

All eeprom handling code assumes that the size of eeprom is 128,
except lan9118_eeprom_cmd. Fix this by restricting the address passed.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a file descriptor leak, reported by cppcheck:
[/src/qemu/block/vpc.c:524]: (error) Resource leak: fd
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a memory leak, reported by cppcheck:
[/src/qemu/qemu-io.c:1135]: (error) Memory leak: ctx
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a file descriptor leak, reported by cppcheck:
[/src/qemu/block/vvfat.c:759]: (error) Resource leak: dir
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a file descriptor leak, reported by cppcheck:
[/src/qemu/hw/loader.c:311]: (error) Resource leak: fd
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a memory leak reported by cppcheck:
[/src/qemu/ui/vnc-auth-sasl.c:448]: (error) Memory leak: mechname
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Refactor the volume mixing, so it can be reused for capturing devices.
Additionally, it removes superfluous multiplications with the nominal
volume within the hardware voice code path.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: Nmalc <av1474@comtv.ru>

Following commit 5d48e917, it's possible
to remove the hack that used to display the opcodes on ARM hosts only.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Enhance the ARM disassembler used for debugging so that it includes
the hex dump of the opcode as well as the symbolic disassembly.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Add a comment about cache coherency and retranslation, so that people
developping new targets based on existing ones are warned of the issue.
Acked-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Add a configure check for the existence of linux/fiemap.h and the
IOC_FS_FIEMAP ioctl. This fixes a compilation failure on Linux
systems which don't have that header file.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Fix errors in the decoding of ARM VQSHL/VQSHLU immediate forms,
including using the new VQSHLU helper functions where appropriate.
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Add neon helper functions to implement VQSHLU, which is a
signed-to-unsigned version of VQSHL available only as an
immediate form.
Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Reviewed-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Illegal instructions in a slot delay should generate a slot illegal
instruction exception instead of an illegal instruction exception.

The current PC should be saved before generating such an exception,
but should not be corrected if in a delay slot, given it's already
done in the exception handler do_interrupt().
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Based on a patch by Blue Swirl <blauwirbel@gmail.com>.
Signed-off-by: NEdgar E. Iglesias <edgar@axis.com>

Signed-off-by: NEdgar E. Iglesias <edgar@axis.com>

Signed-off-by: NEdgar E. Iglesias <edgar@axis.com>

Slirp code tries to be smart an avoid data copy by using pointer to
the data. This solution leads to unaligned access, in this case
preq_addr, which is a 32-bit long structure. There is no real point
of avoiding data copy in a such case, as the value itself is smaller
or the same size as a pointer.

The patch replaces pointers to the preq_addr structure by the strcture
itself, and use the address 0.0.0.0 if no address has been requested
(this is not a valid address in such a request). It compares it with
htonl(0L) for correctness reasons, in case a code checker look for such
mistakes. It also uses memcpy() for copying the data, which takes care
of alignement issues.

This fixes an unaligned access on IA64 host while requesting a DHCP
address.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Improve constant loading in two ways:
- On all ARM versions, it's possible to load 0xffffff00 = -0x100 using
  the mvn rd, #0. Fix the conditions.
- On <= ARMv6 versions, where movw and movt are not available, load the
  constants using mov and orr with rotations depending on the constant
  to load. This is very useful for example to load constants where the
  low byte is 0. This reduce the generated code size by about 7%.

Also fix the coding style at the same time.

Cc: Andrzej Zaborowski <balrog@zabor.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Spotted by Richard Henderson.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

SH4 is using 16-bit instructions which means most of the constants are
loaded through a constant pool at the end of the subroutine. The same
memory page is therefore accessed in exec and read mode.

With the current implementation, a QEMU TLB entry is set to read or
read/write mode after an UTLB search and to exec mode after an ITLB
search, which causes a lot of TLB exceptions to switch from read or
read/write to exec and vice versa.

This patch optimizes that by already setting the QEMU TLB entry in read
or read/write mode when an UTLB entry is copied into ITLB (during an
ITLB miss). This improve the emulation speed by about 14%.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Some Linux kernels seems to implement ITLB/UTLB flushing through by
writing all TLB entries through the memory mapped interface instead
of writing one to MMUCR.TI.

Implement memory mapped ITLB write interface so that such kernels can
boot. This fixes https://bugs.launchpad.net/bugs/700774 .
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

neccessary -> necessary
Keberos -> Kerberos
emuilated -> emulated
transciever -> transceiver
emulaton -> emulation
inital -> initial
MingGW -> MinGW
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Each @section should have a menu entry and a @node entry.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Remove blanks at line endings.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Fix a file descriptor leak reported by cppcheck:
[/src/qemu/usb-bsd.c:392]: (error) Resource leak: bfd
[/src/qemu/usb-bsd.c:388]: (error) Resource leak: dfd

Rearrange the code to avoid descriptor leaks. Also add braces as
needed.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: Nmalc <av1474@comtv.ru>

Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: Nmalc <av1474@comtv.ru>

TCG on MIPS was trying to avoid changing the branch offset, but didn't
due to a stupid typo. Fix it.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Due to a typo, qemu_st64 doesn't properly byteswap the 32-bit low word of
a 64 bit word before saving it. This patch fixes that.
Acked-by: NAndrzej Zaborowski <balrogg@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

QEMU uses code retranslation to restore the CPU state when an exception
happens. For it to work the retranslation must not modify the generated
code. This is what is currently implemented in ARM TCG.

However on CPU that don't have icache/dcache/memory synchronised like
ARM, this requirement is stronger and code retranslation must not modify
the generated code "atomically", as the cache line might be flushed
at any moment (interrupt, exception, task switching), even if not
triggered by QEMU. The probability for this to happen is very low, and
depends on cache size and associativiy, machine load, interrupts, so the
symptoms are might happen randomly.

This requirement is currently not followed in tcg/arm, for the
load/store code, which basically has the following structure:
  1) tlb access code is written
  2) conditional fast path code is written
  3) branch is written with a temporary target
  4) slow path code is written
  5) branch target is updated
The cache lines corresponding to the retranslated code is not flushed
after code retranslation as the generated code is supposed to be the
same. However if the cache line corresponding to the branch instruction
is flushed between step 3 and 5, and is not flushed again before the
code is executed again, the branch target is wrong. In the guest, the
symptoms are MMU page fault at a random addresses, which leads to
kernel page fault or segmentation faults.

The patch fixes this issue by avoiding writing the branch target until
it is known, that is by writing only the branch instruction first, and
later only the offset.

This fixes booting linux guests on ARM hosts (tested: arm, i386, mips,
mipsel, sh4, sparc).
Acked-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

* 'linux-user-for-upstream' of git://gitorious.org/qemu-maemo/qemu:
  Remove dead code for ARM semihosting commandline handling
  Fix commandline handling for ARM semihosted executables
  linux-user: Fix incorrect NaN detection in ARM nwfpe emulation
  softfloat: Implement floatx80_is_any_nan() and float128_is_any_nan()
  linux-user: Implement FS_IOC_FIEMAP ioctl
  linux-user: Support ioctls whose parameter size is not constant
  linux-user: Implement sync_file_range{,2} syscalls

There are some bits in the code which were used to store the commandline for
the semihosting call. These bits are now write-only and can be removed.
Signed-off-by: NWolfgang Schildbach <wschi@dolby.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRiku Voipio <riku.voipio@iki.fi>