Commit d85d0d38 introduces a regression
with Windows ME that leads to a division by 0 and a crash.

It uses the color expansion rop with the source pitch set to 0. This is
something allowed, as the manual explicitely says "When the source of
color-expand data is display memory, the source pitch is ignored.".

This patch fixes this regression by computing sx, sy and others
variables only if they are going to be used later, that is for a plain
copy ROP. It basically consists in moving code.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

On big endian hosts, the curses interface is unusable: the emulated
graphic card only displays garbage, while the monitor interface displays
nothing (or rather only spaces).

The curses interface is waiting for data in native endianness, so
console_write_ch() should not do any conversion. The conversion should
be done when reading the video buffer in hw/vga.c. I supposed this
buffer is in little endian mode, though it's not impossible that the
data is actually in guest endianness. I currently have no big endian
guest to way (they all switch to graphic mode immediately).
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

This will fix the return value of the function which otherwise returns too
many samples because sw->total_hw_samples_acquired isn't correctly
accounted.
Signed-off-by: NMichael Walle <michael@walle.cc>
Signed-off-by: Nmalc <av1474@comtv.ru>

Implement the correct NaN propagation rules for ARM targets by
providing an appropriate pickNaN function.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

IEEE754 doesn't specify precisely what NaN should be returned as
the result of an operation on two input NaNs. This is therefore
target-specific. Abstract out the code in propagateFloat*NaN()
which was implementing the x87 propagation rules, so that it
can be easily replaced on a per-target basis.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The softfloat functions float*_is_nan() were badly misnamed,
because they return true only for quiet NaNs, not for all NaNs.
Rename them to float*_is_quiet_nan() to more accurately reflect
what they do.

This change was produced by:
 perl -p -i -e 's/_is_nan/_is_quiet_nan/g' $(git grep -l is_nan)
(with the results manually checked.)
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NNathan Froyd <froydnj@codesourcery.com>
Acked-by: NEdgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Most of emulated CPU have instructions aligned on 16 or 32 bits, while
on others GCC tries to align the target jump location. This means that
1/2 or 3/4 of tb_phys_hash entries are never used.

Update the hash function tb_phys_hash_func() to ignore the two lowest
bits of the address. This brings a 6% speed-up when booting a MIPS
image.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

UMAAL should use unsigned multiply instead of signed.

This patch fixes this issue by handling UMAAL separately from
UMULL/UMLAL/SMULL/SMLAL as these instructions are different
enough. It also explicitly list instructions in case and catch
nonexistent instruction as illegal. Also fixes a few style issues.

This fixes the issues reported in
https://bugs.launchpad.net/qemu/+bug/696015Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NMike Pall <mike-lp10@luajit.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Since commit 5a4bb580, Xorg crashes on
a Debian Etch image. The commit itself is fine, but it triggers a bug
due to wrong computation of flags for udiv(cc) and sdiv(cc).

This patch only compute cc_src2 for the cc version of udiv/sdiv. It
also moves the update of cc_dst and cc_op to the helper, as it is
faster doing it here when there is already an helper.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

* 'spice.v23.pull' of git://anongit.freedesktop.org/spice/qemu:
  vnc/spice: add set_passwd monitor command.
  vnc: support password expire
  vnc: auth reject cleanup
  spice: add qmp 'query-spice' and hmp 'info spice' commands.
  spice: connection events.
  spice: add qxl device
  spice: add qxl vgabios binary.

Only bits 8..23 of the segment flags contain valid data, so only dump
those when printing the CPU state.
Signed-off-by: NJan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

We used to ignore any fractional part in 0.13, but due to recent
changes (started with 9f9b17a4)
migrate_set_speed will reject the fractional part.

We don't expect existing clients to be relying on this, but we
need to update the documentation to reflect the change.
Signed-off-by: NLuiz Capitulino <lcapitulino@redhat.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Override access control checks (including execute) for mmu translation
table descriptors assigned to manager domains.
Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Where VQSHL of a signed 8/16/32 bit value saturated, the result
value was not being calculated correctly (it should be either
the minimum or maximum value for the size of the signed type).
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Remove a pointless else clause in the neon_qshl_u64 helper.
Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

VQSHL of a signed 64 bit non-zero value by a shift count >= 64 should
saturate; return the correct value in this case.
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Add a missing '-' which meant that we were misinterpreting the shift
argument for VQSHL of 64 bit signed values and treating almost every
shift value as if it were an extremely large right shift.
Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Correct the arguments passed when generating neon qshl_{u,s}64()
helpers so that we use the correct registers.
Signed-off-by: NJuha Riihimäki <juha.riihimaki@nokia.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The translation of REVSH shifted the low byte 8 steps left before performing
an 8-bit sign extend, causing this part of the expression to alwas be 0.
Reported-by: NJohan Bengtsson <teofrastius@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

When the CPU is in wait state, do not wake-up if an interrupt can't be
taken. This avoid host CPU running at 100% if a device (e.g. timer) has
an interrupt line left enabled.

Also factorize code to check if interrupts are enabled in
cpu_mips_hw_interrupts_pending().

Based on a patch from Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
Acked-by: Edgar E. Iglesias <edgar.iglesias@gmail.com> 

The s390 target doesn't compile out of the box anymore. This patch fixes all
the obvious glitches that got introduced in the last few weeks.
Signed-off-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

The translation of dmt/emt/dvpe/evpe was doing the moral equivalent of:

  int x;
  ...		/* no initialization of x */
  x = f (x);

which confused later bits of TCG rather badly, leading to crashes.

Fix the helpers to only return results (those instructions have no
inputs), and fix the translation code accordingly.
Signed-off-by: NNathan Froyd <froydnj@codesourcery.com>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Signed-off-by: NBrad Smith <brad@comstyle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NBrad Smith <brad@comstyle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Signed-off-by: NBrad Smith <brad@comstyle.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Use __builtin___clear_cache() instead of __clear_cache() to avoid having
to define the function as extern. Fix the following warning:

| In file included from qemu/cpus.c:34:
| qemu/exec-all.h: In function 'tb_set_jmp_target1':
| qemu/exec-all.h:208: error: nested extern declaration of '__clear_cache'
| make[1]: *** [cpus.o] Error 1
| make: *** [subdir-i386-softmmu] Error 2
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Every system should have some sort of main system bus,
so sysbus_get_default should always return a valid bus.

Without this patch, at least mipssim and malta no longer
start but raise a null pointer access exception (caused by
commit ec990eb6).

Cc: Anthony Liguori <anthony@codemonkey.ws>
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>

Also trace the extra registers, and update the comments with new
info from Artyom Tarasenko.
Signed-off-by: NBob Breuer <breuerr@mc.net>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

softfloat.h's uint64 type has least-width semantics.
Use uint64_t instead since that is used in helpers.

v4:
* Summary change.

v3:
* Split off.
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Acked-by: NHuang Ying <ying.huang@intel.com>
Acked-by: NJuan Quintela <quintela@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

softfloat.h's int64 type has least-width semantics.
Since we're assigning an int64_t, use plain int64_t.

v4:
* Summary change.

v3:
* Split off.
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Acked-by: NRichard W.M. Jones <rjones@redhat.com>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

softfloat.h's uint32 type has least-width semantics.
Surrounding code uses uint32_t, so use uint32_t here, too.

v4:
* Summary change.

v3:
* Split off.
Signed-off-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Avoid the warning below by using snprintf:
../libhw64/vl.o(.text+0x78d4): In function `get_boot_devices_list':
/src/qemu/vl.c:763: warning: sprintf() is often misused, please use snprintf()
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Use existing dump_mmu() to implement monitor command 'info tlb'.
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

Avoid these warnings with GCC 4.6.0:
/src/qemu/hw/ide/ahci.c: In function 'ahci_reset_port':
/src/qemu/hw/ide/ahci.c:810:14: error: variable 'tfd' set but not used [-Werror=unused-but-set-variable]
/src/qemu/hw/ide/ahci.c: In function 'handle_cmd':
/src/qemu/hw/ide/ahci.c:1103:19: error: variable 'pr' set but not used [-Werror=unused-but-set-variable]

In the tfd variable case, fix the logic also.

CC: Alexander Graf <agraf@suse.de>
CC: Kevin Wolf <kwolf@redhat.com>
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

This patch replaces explicit bswaps with endianness hints to the
mmio layer.

CC: Alexander Graf <agraf@suse.de>
Acked-by: NAlexander Graf <agraf@suse.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>

QEMU source code with CRLF line endings
which is quite common on windows hosts
fails with current make_device_config.sh.

The awk script gets the name of the included
file with \r, so instead of pci.mak it will
search for pci.mak\r which of course does
not work.

Fix this by removing any \r.

v2:
    Avoid using sub() and \r with awk because they are unsupported
    on some platforms. Use tr to remove \r. This new solution
    improves portability and was suggested by Paolo Bonzini.
Signed-off-by: NStefan Weil <weil@mail.berlios.de>
Acked-by: NAndreas Färber <andreas.faerber@web.de>
Signed-off-by: NBlue Swirl <blauwirbel@gmail.com>