aes: Remove unused code (NDEBUG, u16)

The current code includes assert.h very early (from qemu-common.h),
so the definition of NDEBUG was without any effect.

In the initial version from 2004, NDEBUG was used to disable the assertions.
Those assertions are not in time critical code, so it is no longer
reasonable to disable them and the definition of NDEBUG can be removed.

Type u16 is also unused and therefore does not need a type definition.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
timer: make timers_state static

Signed-off-by: Liu Ping Fan <pingfank@linux.vnet.ibm.com>
Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
hw/9pfs: Fix potential memory leak and avoid reuse of freed memory

The leak was reported by cppcheck.

Function proxy_init also calls g_free for ctx->fs_root.
Avoid reuse of this memory by setting ctx->fs_root to NULL.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: M. Mohan Kumar <mohan@in.ibm.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
exec: Remove env from list of poisoned names

The global variable env was removed some time ago, so this name may be
used without any restriction now.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
watchdog: Remove break after exit

This was dead code.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
PPC: dbdma: macio: Fix format specifiers (build regression)

Fix a number of warnings for 32 bit builds (tested on MingW and Linux):

  CC    hw/ide/macio.o
qemu/hw/ide/macio.c: In function 'pmac_ide_atapi_transfer_cb':
qemu/hw/ide/macio.c:134:9: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'hwaddr' [-Werror=format]
qemu/hw/ide/macio.c: In function 'pmac_ide_transfer_cb':
qemu/hw/ide/macio.c:215:5: error: format '%ld' expects argument of type 'long int', but argument 5 has type 'int64_t' [-Werror=format]
qemu/hw/ide/macio.c:222:9: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'hwaddr' [-Werror=format]
qemu/hw/ide/macio.c:264:9: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'hwaddr' [-Werror=format]
cc1: all warnings being treated as errors
make: *** [hw/ide/macio.o] Error 1

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Acked-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
linux-user: correct argument number for sys_mremap and sys_splice

sys_mremap missed 5th argument (new_address), which caused examples that
remap to a specific address to fail.
sys_splice missed 5th and 6th argument which caused different examples to
fail.
This change has an effect on MIPS target only.

Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
misc: Fix new typos in comments and strings

All these typos were found by codespell.

sould -> should
emperical -> empirical
intialization -> initialization
successfuly -> successfully
gaurantee -> guarantee

Fix also another error (before before) in the same context.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
qemu-options: mention C-a h in the -nographic doc

Otherwise, a new user will be wondering how to switch between the
console and monitor.

Cc: Anthony Liguori <aliguori@us.ibm.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Ramkumar Ramachandra <artagnon@gmail.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
misc: Use g_assert_not_reached for code which is expected to be unreachable

The macro g_assert_not_reached is a better self documenting replacement
for assert(0) or assert(false).

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
target-mips: Remove assignment to a variable which is never used

This assignment causes a compiler warning for compilations with the compiler
option -Wunused-but-set-variable (which is included with -Wextra).

Removing it allows using -Wextra for QEMU code without suppressing too many
extra warnings.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
target-mips: fix multiplication in mipsdsp_rndq15_mul_q15_q15

Multiplication of Q15 fractional halfword vectors was incorrect in the
previous implementation of mipsdsp_rndq15_mul_q15_q15. It failed to take
element signs into account. This change fixes it, and it adds a test case
for it.

The change also removes unnecessary cast in the function
mipsdsp_mul_q15_q15_overflowflag21().

Signed-off-by: Petar Jovanovic <petar.jovanovic@imgtec.com>
Reviewed-by: Richard Henderson  <rth@twiddle.net> 
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
target-mips: fix branch in likely delay slot tcg assert

When a branch delay slot contains another branch instruction, the code
generated raises an exception, however since is_branch==1,
handle_delay_slot() doesn't get called immediately. This means
ctx->bstate isn't set to BS_BRANCH, and the decoder continues decoding
until a non-branch instruction is found.

If the first branch was a branch likely instruction then each
instruction after it generates code for the unlikely case, to go to the
next tb starting after the delay slot. This results in multiple goto_tb
tcg ops being generated with the same exit number. When debug is enabled
this hits:

tcg-op.h:2589: tcg_gen_goto_tb: Assertion `(tcg_ctx.goto_tb_issue_mask & (1 << idx)) == 0' failed.

This is fixed by removing is_branch entirely, and calling
handle_delay_slot() if (ctx.hflags & MIPS_HFLAG_BMASK) was set prior to
the current instruction being decoded. This still prevents
handle_delay_slot() being called immediately after a branch but allows
it to still be called after a branch within a delay slot.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Yongbok Kim <yongbok.kim@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
mips_malta: QOM cast cleanup

Signed-off-by: Andreas Färber <afaerber@suse.de>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
mips_malta: fix BIOS endianness swapping

If the target is little endian (mipsel) then the BIOS image endianness
is swapped so that the big endian BIOS binaries commonly produced can be
loaded correctly.

When using the -bios argument the BIOS is loaded using
load_image_targphys, however this doesn't perform the load to target
memory immediately. Instead it loads the BIOS file into a struct Rom
which will later be written to target memory upon reset. However the
endianness conversion was being performed before this, on init, and
operating on the target memory which at this point is blank & will later
be overwritten by the (big endian) BIOS image. Correct this by operating
on the data referenced by struct Rom rather than the target memory when
the -bios argument is used.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
mips_malta: correct reading MIPS revision at 0x1fc00010

Rather than modifying the BIOS code at its original location, copy it
for the 0x1fc00000 region & modify the copy. This means the original
ROM code is correctly readable at 0x1e000010 whilst the MIPS revision
is readable at 0x1fc00010.

Additionally the code previously operated on target memory which would
later be overwritten by the BIOS image upon CPU reset if the -bios
argument was used to specify the BIOS image. This led to the written
MIPS revision being lost. Copying using rom_copy when -bios is used
fixes this issue.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
mips_malta: generate SPD EEPROM data at runtime

The SPD EEPROM specifies the amount of memory present in the system and
thus its correct contents can only be known at runtime. Calculating
parts of the data on init allows the data to accurately reflect the
amount of target memory present and allow YAMON to boot with an
arbitrary amount of SDRAM.

Where possible the SPD data will favor indicating 2 banks of SDRAM
rather than 1. For example the default 128MB of target memory will be
represented as 2x64MB banks rather than 1x128MB bank. This allows
versions of MIPS BIOS code (such as YAMON 2.22 and older) to boot
despite a bug preventing them from handling a single bank of SDRAM with
the Galileo GT64120 system controller emulated by QEMU.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
mips_malta: cap BIOS endian swap length at 0x3e0000 bytes

This preserves the final sector of the pflash which is used by YAMON to
hold environment variables. If the endianness of the environment data
is swapped then YAMON will fail to load environment variables from
pflash.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
mips_malta: generate SMBUS EEPROM data

The malta contains 2 EEPROMs, one containing SPD data for the SDRAM and
another containing board information such as serial number and MAC
address. These are both exposed via the PIIX4 SMBUS. Generating this
data and providing it to smbus_eeprom_init will allow YAMON to read a
serial number for the board and prevent it from warning that the EEPROM
data is invalid.

We already have the contents of the SPD EEPROM which are exposed via
FPGA I2C accesses, this is provided as part of the SMBUS EEPROM data
too for consistency.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
pflash_cfi01: duplicate status byte from bits 23:16 for 32bit reads

The firmware commonly used with MIPS Malta boards (YAMON) reads the
status of the pflash with a 32bit memory access. On real hardware
this results in the status byte being mirrored in the upper 16 bits
of the read value. For example if the status byte is represented by
SS then the hardware reads 0x00SS00SS. The YAMON firmware compares the
status against 32bit values expecting the mirrored value and fails
without it.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Leon Alrae <leon.alrae@imgtec.com>
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>