A last lot of bug fixes before rc0...

thanks

-- PMM

The following changes since commit 0d0275c31f00b71b49eb80bbdca2cfe244cf80fb:

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2022-07-26 10:31:02 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220726

for you to fetch changes up to 5865d99fe88d8c8fa437c18c6b63fb2a8165634f:

hw/display/bcm2835_fb: Fix framebuffer allocation address (2022-07-26 14:09:44 +0100)

* Update Coverity component definitions

* target/arm: Add MO_128 entry to pred_esz_masks[]

* configure: Fix portability issues

* hw/display/bcm2835_fb: Fix framebuffer allocation address

Alan Jian (1):

hw/display/bcm2835_fb: Fix framebuffer allocation address

Peter Maydell (8):

scripts/coverity-scan/COMPONENTS.md: Add loongarch component

scripts/coverity-scan/COMPONENTS.md: Update slirp component info

target/arm: Add MO_128 entry to pred_esz_masks[]

configure: Add missing POSIX-required space

configure: Add braces to clarify intent of $emu[[:space:]]

configure: Don't use bash-specific string-replacement syntax

configure: Drop dead code attempting to use -msmall-data on alpha hosts

configure: Avoid '==' bashism

configure | 20 +++++++-------------

target/arm/cpu.h | 2 +-

hw/display/bcm2835_fb.c | 3 +--

target/arm/translate-sve.c | 5 +++--

scripts/coverity-scan/COMPONENTS.md | 7 +++++--

5 files changed, 17 insertions(+), 20 deletions(-)

Add the component regex for the new loongarch target.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20220718142310.16013-2-peter.maydell@linaro.org

---

scripts/coverity-scan/COMPONENTS.md | 3 +++

1 file changed, 3 insertions(+)

diff --git a/scripts/coverity-scan/COMPONENTS.md b/scripts/coverity-scan/COMPONENTS.md

--- a/scripts/coverity-scan/COMPONENTS.md

+++ b/scripts/coverity-scan/COMPONENTS.md

@@ -XXX,XX +XXX,XX @@ testlibs

tests

~ (/qemu)?(/tests/.*)

+

+loongarch

+ ~ (/qemu)?((/include)?/hw/(loongarch/.*|.*/loongarch.*)|/target/loongarch/.*)

2.25.1

Update the regex for the slirp component now that it lives

solely inside /slirp/, and note that it should be ignored in

Coverity analysis (because it's a separate upstream project

now, and they run Coverity on it themselves).

Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Message-id: 20220718142310.16013-3-peter.maydell@linaro.org

scripts/coverity-scan/COMPONENTS.md | 4 ++--

diff --git a/scripts/coverity-scan/COMPONENTS.md b/scripts/coverity-scan/COMPONENTS.md

--- a/scripts/coverity-scan/COMPONENTS.md

+++ b/scripts/coverity-scan/COMPONENTS.md

@@ -XXX,XX +XXX,XX @@ qemu-ga

scsi

~ (/qemu)?(/scsi/.*|/hw/scsi/.*|/include/hw/scsi/.*)

-slirp

- ~ (/qemu)?(/.*slirp.*)

+slirp (component should be ignored in analysis)

+ ~ (/qemu)?(/slirp/.*)

tcg

~ (/qemu)?(/accel/tcg/.*|/replay/.*|/(.*/)?softmmu.*)

2.25.1

In commit 7390e0e9ab8475, we added support for SME loads and stores.

Unlike SVE loads and stores, these include handling of 128-bit

elements. The SME load/store functions call down into the existing

sve_cont_ldst_elements() function, which uses the element size MO_*

value as an index into the pred_esz_masks[] array. Because this code

path now has to handle MO_128, we need to add an extra element to the

array.

This bug was spotted by Coverity because it meant we were reading off

the end of the array.

Resolves: Coverity CID 1490539, 1490541, 1490543, 1490544, 1490545,

1490546, 1490548, 1490549, 1490550, 1490551, 1490555, 1490557,

1490558, 1490560, 1490561, 1490563

Fixes: 7390e0e9ab8475 ("target/arm: Implement SME LD1, ST1")

target/arm/cpu.h | 2 +-

target/arm/translate-sve.c | 5 +++--

2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)

}

/* Shared between translate-sve.c and sve_helper.c. */

-extern const uint64_t pred_esz_masks[4];

+extern const uint64_t pred_esz_masks[5];

/* Helper for the macros below, validating the argument type. */

static inline MemTxAttrs *typecheck_memtxattrs(MemTxAttrs *x)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c

--- a/target/arm/translate-sve.c

+++ b/target/arm/translate-sve.c

@@ -XXX,XX +XXX,XX @@ static void do_predtest(DisasContext *s, int dofs, int gofs, int words)

/* For each element size, the bits within a predicate word that are active. */

-const uint64_t pred_esz_masks[4] = {

+const uint64_t pred_esz_masks[5] = {

0xffffffffffffffffull, 0x5555555555555555ull,

- 0x1111111111111111ull, 0x0101010101010101ull

+ 0x1111111111111111ull, 0x0101010101010101ull,

+ 0x0001000100010001ull,

};

static bool trans_INVALID(DisasContext *s, arg_INVALID *a)

2.25.1

In commit 7d7dbf9dc15be6e1 we added a line to the configure script

which is not valid POSIX shell syntax, because it is missing a space

after a '!' character. shellcheck diagnoses this:

if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then

^-- SC1035: You are missing a required space after the !.

and the OpenBSD shell will not correctly handle this without the space.

Fixes: 7d7dbf9dc15be6e1 ("configure: replace --enable/disable-git-update with --with-git-submodules")

configure | 2 +-

diff --git a/configure b/configure

index XXXXXXX..XXXXXXX 100755

--- a/configure

+++ b/configure

@@ -XXX,XX +XXX,XX @@ else

cxx=

fi

-if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then

+if ! (GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then

exit 1

fi

2.25.1

In shell script syntax, $var[something] is not special for variable

expansion: $var is expanded. However, as it can look as if it were

intended to be an array element access (the correct syntax for which

is ${var[something]}), shellcheck recommends using explicit braces

around ${var} to clarify the intended expansion.

This fixes the warning:

In ./configure line 2346:

if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*$emu[[:space:]]*$"; then

^-- SC1087: Use braces when expanding arrays, e.g. ${array[idx]} (or ${var}[.. to quiet).

configure | 2 +-

diff --git a/configure b/configure

index XXXXXXX..XXXXXXX 100755

--- a/configure

+++ b/configure

@@ -XXX,XX +XXX,XX @@ if test -n "$target_cc" &&

# emulation. Linux and OpenBSD/amd64 use 'elf_i386'; FreeBSD uses the _fbsd

# variant; OpenBSD/i386 uses the _obsd variant; and Windows uses i386pe.

for emu in elf_i386 elf_i386_fbsd elf_i386_obsd i386pe; do

- if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*$emu[[:space:]]*$"; then

+ if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*${emu}[[:space:]]*$"; then

ld_i386_emulation="$emu"

break

fi

2.25.1

The variable string-replacement syntax ${var/old/new} is a bashism

(though it is also supported by some other shells), and for instance

does not work with the NetBSD /bin/sh, which complains:

../src/configure: 687: Syntax error: Bad substitution

Replace it with a more portable sed-based approach, similar to

what we already do in quote_sh().

Note that shellcheck also diagnoses this:

In ./configure line 687:

e=${e/'\'/'\\'}

^-----------^ SC2039: In POSIX sh, string replacement is undefined.

^-- SC1003: Want to escape a single quote? echo 'This is how it'\''s done'.

^-- SC1003: Want to escape a single quote? echo 'This is how it'\''s done'.

In ./configure line 688:

e=${e/\"/'\"'}

^----------^ SC2039: In POSIX sh, string replacement is undefined.

Fixes: 8154f5e64b0cf ("meson: Prefix each element of firmware path")

configure | 7 ++++---

1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/configure b/configure

index XXXXXXX..XXXXXXX 100755

--- a/configure

+++ b/configure

@@ -XXX,XX +XXX,XX @@ meson_option_build_array() {

IFS=:

fi

for e in $1; do

- e=${e/'\'/'\\'}

- e=${e/\"/'\"'}

- printf '"""%s""",' "$e"

+ printf '"""'

+ # backslash escape any '\' and '"' characters

+ printf "%s" "$e" | sed -e 's/\([\"]\)/\\\1/g'

+ printf '""",'

done)

printf ']\n'

}

2.25.1

In commit 823eb013452e93d we moved the setting of ARCH from configure

to meson.build, but we accidentally left behind one attempt to use

$ARCH in configure, which was trying to add -msmall-data to the

compiler flags on Alpha hosts. Since ARCH is now never set, the test

always fails and we never add the flag.

There isn't actually any need to use this compiler flag on Alpha:

the original intent was that it would allow us to simplify our TCG

codegen on that platform, but we never actually made the TCG changes

that would rely on -msmall-data.

Drop the effectively-dead code from configure, as we don't need it.

This was spotted by shellcheck:

In ./configure line 2254:

case "$ARCH" in

^---^ SC2153: Possible misspelling: ARCH may not be assigned, but arch is.

Reviewed-by: Thomas Huth <thuth@redhat.com>

Message-id: 20220720152631.450903-5-peter.maydell@linaro.org

configure | 7 -------

1 file changed, 7 deletions(-)

diff --git a/configure b/configure

index XXXXXXX..XXXXXXX 100755

--- a/configure

+++ b/configure

@@ -XXX,XX +XXX,XX @@ if test "$fortify_source" = "yes" ; then

QEMU_CFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $QEMU_CFLAGS"

fi

-case "$ARCH" in

-alpha)

- # Ensure there's only a single GP

- QEMU_CFLAGS="-msmall-data $QEMU_CFLAGS"

-;;

-esac

-

if test "$have_asan" = "yes"; then

QEMU_CFLAGS="-fsanitize=address $QEMU_CFLAGS"

QEMU_LDFLAGS="-fsanitize=address $QEMU_LDFLAGS"

2.25.1

The '==' operator to test is a bashism; the standard way to copmare

strings is '='. This causes dash to complain:

../../configure: 681: test: linux: unexpected operator

configure | 2 +-

diff --git a/configure b/configure

index XXXXXXX..XXXXXXX 100755

--- a/configure

+++ b/configure

@@ -XXX,XX +XXX,XX @@ werror=""

meson_option_build_array() {

printf '['

- (if test "$targetos" == windows; then

+ (if test "$targetos" = windows; then

IFS=\;

else

IFS=:

2.25.1

From: Alan Jian <alanjian85@gmail.com>

This patch fixes the dedicated framebuffer mailbox interface by

removing an unneeded offset. This means that we pick the framebuffer

address in the same way that we do if the guest code uses the buffer

allocate mechanism of the bcm2835_property interface (case

0x00040001: /* Allocate buffer */ in bcm2835_property.c).

The documentation of this mailbox interface doesn't say anything

about using parts of the request buffer address to affect the

chosen framebuffer address:

https://github.com/raspberrypi/firmware/wiki/Mailbox-framebuffer-interface

Some baremetal applications like the Screen01/Screen02 examples from

Baking Pi tutorial[1] didn't work before this patch.

[1] https://www.cl.cam.ac.uk/projects/raspberrypi/tutorials/os/screen01.html

Signed-off-by: Alan Jian <alanjian85@outlook.com>

Message-id: 20220725145838.8412-1-alanjian85@outlook.com

[PMM: tweaked commit message]

hw/display/bcm2835_fb.c | 3 +--

1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c

--- a/hw/display/bcm2835_fb.c

+++ b/hw/display/bcm2835_fb.c

@@ -XXX,XX +XXX,XX @@ static void bcm2835_fb_mbox_push(BCM2835FBState *s, uint32_t value)

newconf.xoffset = ldl_le_phys(&s->dma_as, value + 24);

newconf.yoffset = ldl_le_phys(&s->dma_as, value + 28);

- newconf.base = s->vcram_base | (value & 0xc0000000);

- newconf.base += BCM2835_FB_OFFSET;

+ newconf.base = s->vcram_base + BCM2835_FB_OFFSET;

/* Copy fields which we don't want to change from the existing config */

newconf.pixo = s->config.pixo;

2.25.1