readline_hist_add() moves the history entry to the end of history.  It
uses memmove() to move rs->history[idx + 1..] to rs->history[idx..].
However, its size argument is off by two array elements, so it writes
one element beyond rs->history[], and reads two.

On my system, this clobbers rs->hist_entry and the hole right after
it.  Since the function assigns to rs->hist_entry in time, the bug has
no ill effects for me.

Spotted by Coverity.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NPavel Borzenkov <pavel.borzenkov@gmail.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Signed-off-by: NPavel Borzenkov <pavel.borzenkov@gmail.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

Before the next patches, fix coding style of the affected functions.
Signed-off-by: NPavel Borzenkov <pavel.borzenkov@gmail.com>
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>

* 'xtensa' of git://jcmvbkbc.spb.ru/dumb/qemu-xtensa:
  xtensa_lx60: fix build date code and change memory region names
  xtensa_lx60: pass kernel arguments from -append
  xtensa_lx60: add FLASH support
  target-xtensa: raise an exception for invalid and reserved opcodes
  target-xtensa: handle cache options in the overlay tool
  target-xtensa: mask out undefined bits of WINDOWSTART SR

* 'tci' of git://qemu.weilnetz.de/qemu:
  tcg: Add tcg interpreter to configure / make
  tcg: Add tci disassembler
  tcg: Add interpreter for bytecode
  tcg: Add bytecode generator for tcg interpreter
  tcg: Make ARRAY_SIZE(tcg_op_defs) globally available
  tcg: TCG targets may define tcg_qemu_tb_exec

apic id returned to guest kernel in ebx for cpuid(function=1) depends on
CPUX86State->cpuid_apic_id which gets populated after the cpuid information
is cached in the host kernel. This results in broken CPU topology in guest.

Fix this by setting cpuid_apic_id before cpuid information is passed to
the host kernel. This is done by moving the setting of cpuid_apic_id
to cpu_x86_init() where it will work for both KVM as well as TCG modes.
Acked-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NBharata B Rao <bharata.rao@gmail.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

commit ba43d289 introduces a bug:
The stream-not-found case doesn't error out any more, instead the
code silently uses the first stream.  Fix it.
Signed-off-by: NGerd Hoffmann <kraxel@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

When SCSI passthrough is being used by the guest with virtio-blk, the
guest is not able to detect disk failures.  This is because the status
field is expected by the guest driver to include also the msg_status,
host_status and driver_status fields, but the device is only passing
down the SCSI status.

The patch fixes this, and also makes sure that the guest always sees a
CHECK_CONDITION status when there is valid sense data.
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Markus Armbruster <armbru@redhat.com> sent fixes for va_list vararg
issues in v9fs_string_alloc_printf().  It turns out the function
duplicates g_vasprintf() and can therefore be eliminated entirely.
Signed-off-by: NStefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: NAneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

Fix date code to uses MMDDYYYY notation.
Change memory region names to reflect specification that defines them.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Create boot parameters in the end of SRAM region, insert kernel
arguments specified in -append there.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

LX60 carry 4 Mbyte FLASH and 128 Kbyte SRAM, LX200 carry 16 Mbyte FLASH
and 32 Mbyte SRAM. Either of these memories may be mapped to the system
ROM region.

Select boot from FLASH if -kernel option is not specified, otherwise
boot from SRAM.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

This includes opcodes from disabled features and those marked reserved in the ISA.
Also end TB on opcodes that definitely generate an exception: illegal
instructions, syscall and privileged instructions.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Cache options must be enabled for the cores that have cache to avoid
illegal instruction exceptions.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

According to ISA, table 5-156, bits 32:NAREG/4 of the WINDOWSTART SR
must be zero.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>

Look out 1.0, here we come!
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This reverts commit 46d95bfe.

Removing the only tabs in the file.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: Nmalc <av1474@comtv.ru>

The error being caused by the failure to copy the other half of
the input to the output after having narrowed the deposit operation.
Signed-off-by: NRichard Henderson <rth@twiddle.net>
Signed-off-by: Nmalc <av1474@comtv.ru>

Update lnkst on link state changes so that guests can obtain this
information via reading back the LED output pin. Works for Linux but
not for guests that depend on the missing PHY.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Implement the various IO access widths according to the spec. This
specifically unbreaks word and dword access to the PROM area that is
mapped into IO space. It also drops redundant upper limit checks and
spurious "return void".
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This moves BCR defines to the common header and immediately makes use of
them to add BCR_APROMWE, replacing the open-coded write check in
pcnet_aprom_writeb.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This patch would try sort the command list in monitor at runtime. As a result,
command help and help info would show a more friendly sorted command list.
For eg:
(qemu)help
acl_add
acl_policy
acl_remove
acl_reset
acl_show
balloon
block_passwd
...
the command list is sorted.

v3: using qsort function to sort the command list.
Tested-by: NWenyi Gao <wenyi@linux.vnet.ibm.com>
Signed-off-by: NWayne Xia <xiawenc@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Has no business in hw/.
Signed-off-by: NAvi Kivity <avi@redhat.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Move the parsing of a filedescriptor into a common function
qemu_parse_fd() so others can use it as well. Have net.c call this
function.

v2:
 - moving qemu_parse_fd into cutils.c
Signed-off-by: NStefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Suppress confusing messages from pkg_config when probing for
'check' by sending them to /dev/null as we do with other
similar probes.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

Currently, virtio devices are usually presented to the guest as an
emulated PCI device, virtio_pci.  Although the actual IO operations
are done through system memory, the configuration of the virtio device
is done through the one PCI IO space BAR that virtio_pci presents.

But PCI IO space (aka PIO) is deprecated for modern PCI devices, and
on some systems with many PCI domains accessing PIO space can be
problematic.  For example on the existing PowerVM implementation of
the PAPR spec, PCI PIO access is not supported at all.  We're hoping
that our KVM implementation will support PCI PIO (once we support PCI
at all), but it will probably have some irritating limitations.

This patch, therefore, extends the virtio_pci device to have a PCI
memory space (MMIO) BAR as well as the IO BAR.  The MMIO BAR contains
exactly the same registers, in exactly the same layout as the existing
PIO BAR.

Because the PIO BAR is still present, existing guest drivers should
still work fine.  With this change in place, future guest drivers can
check for an MMIO BAR and use that if present (falling back to PIO
when possible to support older qemu versions).
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the usb-uhci device emulation to use the explicit PCI DMA
wrapper to initialize its scatter/gathjer structure.  This means this
driver should not need further changes when the sglist interface is
extended to support IOMMUs.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the usb-ehci device emulation to use the explicit PCI DMA
wrapper to initialize its scatter/gathjer structure.  This means this
driver should not need further changes when the sglist interface is
extended to support IOMMUs.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the PCI IDE device emulation to use the explicit PCI DMA
wrapper to initialize its scatter/gathjer structure.  This means this
driver should not need further changes when the sglist interface is
extended to support IOMMUs.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the intel-hda device emulation to use the explicit PCI DMA
functions, instead of directly calling physical memory access functions.
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAlexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the pcnet-pci device emulation to use the explicit PCI DMA
functions, instead of directly calling physical memory access functions.
Signed-off-by: NEduard - Gabriel Munteanu <eduard.munteanu@linux360.ro>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the lsi53c895a device emulation to use the explicit PCI DMA
functions, instead of directly calling physical memory access functions.
Signed-off-by: NEduard - Gabriel Munteanu <eduard.munteanu@linux360.ro>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>

This updates the e1000 device emulation to use the explicit PCI DMA
functions, instead of directly calling physical memory access functions.
Signed-off-by: NEduard - Gabriel Munteanu <eduard.munteanu@linux360.ro>
Signed-off-by: NDavid Gibson <david@gibson.dropbear.id.au>
Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>