Series comparison

-[PULL 00/12] target-arm queue
+[PULL 00/16] target-arm queue
-Almost nothing in here is arm-related, but the target-arm
+Patches for rc1: nothing major, just some minor bugfixes and
-queue was convenient for these last minute bits and pieces
+code cleanups.
 for 5.0...
-thanks
 -- PMM
-The following changes since commit 14e5526b51910efd62cd31cd95b49baca975c83f:
+The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2020-04-13 15:42:51 +0100)
+  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200414
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
-for you to fetch changes up to 84f82ddcbb4ac4ed04c8675e85155329f23184f0:
+for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
-  Deprecate KVM support for AArch32 (2020-04-14 17:20:22 +0100)
+  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
 ----------------------------------------------------------------
-patch queue:
+target-arm queue:
- * Fix some problems that trip up Coverity's scanner
+ * hw/arm/Kconfig: ARM_V7M depends on PTIMER
- * run-coverity-scan: New script automating the scan-and-upload process
+ * Minor coding style fixes
- * docs: Improve our gdbstub documentation
+ * docs: add some notes on the sbsa-ref machine
- * configure: Honour --disable-werror for Sphinx
+ * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
- * docs: Fix errors produced when building with Sphinx 3.0
+ * target/arm: Fix neon VTBL/VTBX for len > 1
- * docs: Require Sphinx 1.6 or better
+ * hw/arm/armsse: Correct expansion MPC interrupt lines
- * Add deprecation notice for KVM support on AArch32 hosts
+ * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Peter Maydell (12):
+Alex Bennée (1):
-      osdep.h: Drop no-longer-needed Coverity workarounds
+      docs: add some notes on the sbsa-ref machine
       thread.h: Fix Coverity version of qemu_cond_timedwait()
       thread.h: Remove trailing semicolons from Coverity qemu_mutex_lock() etc
       linux-user/flatload.c: Use "" for include of QEMU header target_flat.h
       scripts/run-coverity-scan: Script to run Coverity Scan build
       scripts/coverity-scan: Add Docker support
       docs: Improve our gdbstub documentation
       configure: Honour --disable-werror for Sphinx
       scripts/kernel-doc: Add missing close-paren in c:function directives
       kernel-doc: Use c:struct for Sphinx 3.0 and later
       docs: Require Sphinx 1.6 or better
       Deprecate KVM support for AArch32
- configure                                  |   9 +-
+AlexChen (1):
- Makefile                                   |   2 +-
+      ssi: Fix bad printf format specifiers
  include/qemu/osdep.h                       |  14 -
  include/qemu/thread.h                      |  12 +-
  linux-user/flatload.c                      |   2 +-
  MAINTAINERS                                |   5 +
  docs/conf.py                               |   6 +-
  docs/sphinx/kerneldoc.py                   |   1 +
  docs/system/deprecated.rst                 |   8 +
  docs/system/gdb.rst                        |  22 +-
  qemu-options.hx                            |  24 +-
  scripts/coverity-scan/coverity-scan.docker | 131 ++++++++++
  scripts/coverity-scan/run-coverity-scan    | 401 +++++++++++++++++++++++++++++
  scripts/kernel-doc                         |  18 +-
 files changed, 615 insertions(+), 40 deletions(-)
  create mode 100644 scripts/coverity-scan/coverity-scan.docker
  create mode 100755 scripts/coverity-scan/run-coverity-scan
+Andrew Jones (1):
+      hw/arm/Kconfig: ARM_V7M depends on PTIMER
+Havard Skinnemoen (1):
+      tests/qtest/npcm7xx_rng-test: count runs properly
+Peter Maydell (2):
+      hw/arm/nseries: Check return value from load_image_targphys()
+      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+Philippe Mathieu-Daudé (6):
+      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+      hw/arm/armsse: Correct expansion MPC interrupt lines
+      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+Richard Henderson (1):
+      target/arm: Fix neon VTBL/VTBX for len > 1
+Xinhao Zhang (3):
+      target/arm: add spaces around operator
+      target/arm: Don't use '#' flag of printf format
+      target/arm: add space before the open parenthesis '('
+ docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+ docs/system/target-arm.rst         |  1 +
+ include/hw/misc/stm32f2xx_syscfg.h |  2 --
+ target/arm/helper.h                |  2 +-
+ hw/arm/armsse.c                    |  3 +-
+ hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
+ hw/arm/nseries.c                   | 26 ++++++++----------
+ hw/arm/stm32f205_soc.c             |  1 -
+ hw/misc/stm32f2xx_syscfg.c         |  2 --
+ hw/ssi/imx_spi.c                   |  2 +-
+ hw/ssi/xilinx_spi.c                |  2 +-
+ target/arm/arch_dump.c             |  8 +++---
+ target/arm/arm-semi.c              |  8 +++---
+ target/arm/helper.c                |  2 +-
+ target/arm/op_helper.c             | 23 +++++++++-------
+ target/arm/translate-a64.c         |  4 +--
+ target/arm/translate.c             |  2 +-
+ tests/qtest/npcm7xx_rng-test.c     |  2 +-
+ hw/arm/Kconfig                     |  3 +-
+ target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
+files changed, 123 insertions(+), 98 deletions(-)
+ create mode 100644 docs/system/arm/sbsa.rst

-[PULL 09/12] scripts/kernel-doc: Add missing close-paren in c:function directives
+[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
-When kernel-doc generates a 'c:function' directive for a function
+From: Andrew Jones <drjones@redhat.com>
 one of whose arguments is a function pointer, it fails to print
 the close-paren after the argument list of the function pointer
 argument, for instance in the memory API documentation:
   .. c:function:: void memory_region_init_resizeable_ram (MemoryRegion * mr, struct Object * owner, const char * name, uint64_t size, uint64_t max_size, void (*resized) (const char*, uint64_t length, void *host, Error ** errp)
-which should have a ')' after the 'void *host' which is the
+commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
-last argument to 'resized'.
+changed armv7m_systick to build on ptimers. Make sure we have ptimers
 in the build when building armv7m_systick.
-Older versions of Sphinx don't try to parse the argumnet
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-to c:function, but Sphinx 3.0 does do this and will complain:
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201104103343.30392-1-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/Kconfig | 1 +
 file changed, 1 insertion(+)
-  /home/petmay01/linaro/qemu-from-laptop/qemu/docs/../include/exec/memory.h:834: WARNING: Error in declarator or parameters
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-  Invalid C declaration: Expecting "," or ")" in parameters, got "EOF". [error at 208]
+index XXXXXXX..XXXXXXX 100644
-    void memory_region_init_resizeable_ram (MemoryRegion * mr, struct Object * owner, const char * name, uint64_t size, uint64_t max_size, void (*resized) (const char*, uint64_t length, void *host, Error ** errp)
+--- a/hw/arm/Kconfig
-    ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------^
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
-Add the missing close-paren.
+ config ARM_V7M
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+     bool
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
++    select PTIMER
-Message-id: 20200411182934.28678-3-peter.maydell@linaro.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+ config ALLWINNER_A10
----
+     bool
  scripts/kernel-doc | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/scripts/kernel-doc b/scripts/kernel-doc
 index XXXXXXX..XXXXXXX 100755
 --- a/scripts/kernel-doc
 +++ b/scripts/kernel-doc
@@ -XXX,XX +XXX,XX @@ sub output_function_rst(%) {
      if ($type =~ m/([^\(]*\(\*)\s*\)\s*\(([^\)]*)\)/) {
          # pointer-to-function
 -        print $1 . $parameter . ") (" . $2;
 +        print $1 . $parameter . ") (" . $2 . ")";
      } else {
          print $type . " " . $parameter;
      }
 --
 .20.1

-New patch
+[PULL 02/16] ssi: Fix bad printf format specifiers
+From: AlexChen <alex.chen@huawei.com>
+We should use printf format specifier "%u" instead of "%d" for
+argument of type "unsigned int".
+Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 5FA280F5.8060902@huawei.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/ssi/imx_spi.c    | 2 +-
+ hw/ssi/xilinx_spi.c | 2 +-
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/imx_spi.c
++++ b/hw/ssi/imx_spi.c
+@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
+     case ECSPI_MSGDATA:
+         return  "ECSPI_MSGDATA";
+     default:
+-        sprintf(unknown, "%d ?", reg);
++        sprintf(unknown, "%u ?", reg);
+         return unknown;
+     }
+ }
+diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ssi/xilinx_spi.c
++++ b/hw/ssi/xilinx_spi.c
+@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
+        irq chain unless things really changed.  */
+     if (pending != s->irqline) {
+         s->irqline = pending;
+-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
++        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
+                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
+         qemu_set_irq(s->irq, pending);
+     }
+--
+.20.1

-New patch
+[PULL 03/16] target/arm: add spaces around operator
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
+Fix code style. Operator needs spaces both sides.
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/arch_dump.c | 8 ++++----
+ target/arm/arm-semi.c  | 8 ++++----
+ target/arm/helper.c    | 2 +-
+files changed, 9 insertions(+), 9 deletions(-)
+diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arch_dump.c
++++ b/target/arm/arch_dump.c
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     for (i = 0; i < 32; ++i) {
+         uint64_t *q = aa64_vfp_qreg(env, i);
+-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
+     }
+     if (s->dump_info.d_endian == ELFDATA2MSB) {
+@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+          */
+         for (i = 0; i < 32; ++i) {
+             uint64_t tmp = note.vfp.vregs[2*i];
+-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
+-            note.vfp.vregs[2*i+1] = tmp;
++            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++            note.vfp.vregs[2 * i + 1] = tmp;
+         }
+     }
+diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/arm-semi.c
++++ b/target/arm/arm-semi.c
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         if (use_gdb_syscalls()) {
+             arm_semi_open_guestfd = guestfd;
+             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
+-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
++                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
+         } else {
+             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
+             if (ret == (uint32_t)-1) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
+-                                  arg0, (int)arg1+1);
++                                  arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(3);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
+-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
++                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
+         } else {
+             char *s2;
+             s = lock_user_string(arg0);
+@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+         GET_ARG(1);
+         if (use_gdb_syscalls()) {
+             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
+-                                   arg0, (int)arg1+1);
++                                   arg0, (int)arg1 + 1);
+         } else {
+             s = lock_user_string(arg0);
+             if (!s) {
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
+     uint32_t sum;
+     sum = do_usad(a, b);
+     sum += do_usad(a >> 8, b >> 8);
+-    sum += do_usad(a >> 16, b >>16);
++    sum += do_usad(a >> 16, b >> 16);
+     sum += do_usad(a >> 24, b >> 24);
+     return sum;
+ }
+--
+.20.1

-[PULL 12/12] Deprecate KVM support for AArch32
+[PULL 04/16] target/arm: Don't use '#' flag of printf format
-The Linux kernel has dropped support for allowing 32-bit Arm systems
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
 to host KVM guests (kernel commit 541ad0150ca4aa663a2, which just
 landed upstream in the 5.7 merge window).  Mark QEMU's support for
 this configuration as deprecated, so that we can delete that support
 code in 5.2.
+Fix code style. Don't use '#' flag of printf format ('%#') in
+format strings, use '0x' prefix instead
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
 ---
- docs/system/deprecated.rst | 8 ++++++++
+ target/arm/translate-a64.c | 4 ++--
-file changed, 8 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/deprecated.rst
+--- a/target/arm/translate-a64.c
-+++ b/docs/system/deprecated.rst
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ The ``compat`` property used to set backwards compatibility modes for
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
- the processor has been deprecated. The ``max-cpu-compat`` property of
+                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
- the ``pseries`` machine type should be used instead.
+                 break;
+             default:
-+KVM guest support on 32-bit Arm hosts (since 5.0)
+-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
-+'''''''''''''''''''''''''''''''''''''''''''''''''
++                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
-+
+                         __func__, insn, fpopcode, s->pc_curr);
-+The Linux kernel has dropped support for allowing 32-bit Arm systems
+                 g_assert_not_reached();
-+to host KVM guests as of the 5.7 kernel. Accordingly, QEMU is deprecating
+             }
-+its support for this configuration and will remove it in a future version.
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
-+Running 32-bit guests on a 64-bit Arm host remains supported.
+     case 0x7f: /* FSQRT (vector) */
-+
+         break;
- System emulator devices
+     default:
- -----------------------
+-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
 +        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
          g_assert_not_reached();
      }
 --
 .20.1

-[PULL 02/12] thread.h: Fix Coverity version of qemu_cond_timedwait()
+[PULL 05/16] target/arm: add space before the open parenthesis '('
-For Coverity's benefit, we provide simpler versions of functions like
+From: Xinhao Zhang <zhangxinhao1@huawei.com>
 qemu_mutex_lock(), qemu_cond_wait() and qemu_cond_timedwait().  When
 we added qemu_cond_timedwait() in commit 3dcc9c6ec4ea, a cut and
 paste error meant that the Coverity version of qemu_cond_timedwait()
 was using the wrong _impl function, which makes the Coverity parser
 complain:
-"/qemu/include/qemu/thread.h", line 159: warning #140: too many arguments in
+Fix code style. Space required before the open parenthesis '('.
           function call
       return qemu_cond_timedwait(cond, mutex, ms);
              ^
-"/qemu/include/qemu/thread.h", line 159: warning #120: return value type does
+Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-          not match the function type
+Signed-off-by: Kai Deng <dengkai1@huawei.com>
-      return qemu_cond_timedwait(cond, mutex, ms);
+Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
-             ^
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 "/qemu/include/qemu/thread.h", line 156: warning #1563: function
           "qemu_cond_timedwait" not emitted, consider modeling it or review
           parse diagnostics to improve fidelity
   static inline bool (qemu_cond_timedwait)(QemuCond *cond, QemuMutex *mutex,
                       ^
 These aren't fatal, but reduce the scope of the analysis. Fix the error.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20200319193323.2038-3-peter.maydell@linaro.org
 ---
- include/qemu/thread.h | 2 +-
+ target/arm/translate.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/include/qemu/thread.h b/include/qemu/thread.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/thread.h
+--- a/target/arm/translate.c
-+++ b/include/qemu/thread.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ extern QemuCondTimedWaitFunc qemu_cond_timedwait_func;
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
- #define qemu_cond_wait(c, m)                                            \
+             - Hardware watchpoints.
-             qemu_cond_wait_impl(c, m, __FILE__, __LINE__);
+            Hardware breakpoints have already been handled and skip this code.
- #define qemu_cond_timedwait(c, m, ms)                                   \
+          */
--            qemu_cond_wait_impl(c, m, ms, __FILE__, __LINE__);
+-        switch(dc->base.is_jmp) {
-+            qemu_cond_timedwait_impl(c, m, ms, __FILE__, __LINE__);
++        switch (dc->base.is_jmp) {
- #else
+         case DISAS_NEXT:
- #define qemu_mutex_lock(m) ({                                           \
+         case DISAS_TOO_MANY:
-             QemuMutexLockFunc _f = atomic_read(&qemu_mutex_lock_func);  \
+             gen_goto_tb(dc, 1, dc->base.pc_next);
 --
 .20.1

-[PULL 06/12] scripts/coverity-scan: Add Docker support
+[PULL 06/16] docs: add some notes on the sbsa-ref machine
-Add support for running the Coverity Scan tools inside a Docker
+From: Alex Bennée <alex.bennee@linaro.org>
 container rather than directly on the host system.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+We should at least document what this machine is about.
 Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
 Cc: Leif Lindholm <leif@nuviainc.com>
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200319193323.2038-7-peter.maydell@linaro.org
 ---
- scripts/coverity-scan/coverity-scan.docker | 131 +++++++++++++++++++++
+ docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
- scripts/coverity-scan/run-coverity-scan    |  90 ++++++++++++++
+ docs/system/target-arm.rst |  1 +
-files changed, 221 insertions(+)
+files changed, 33 insertions(+)
- create mode 100644 scripts/coverity-scan/coverity-scan.docker
+ create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/scripts/coverity-scan/coverity-scan.docker b/scripts/coverity-scan/coverity-scan.docker
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/scripts/coverity-scan/coverity-scan.docker
++++ b/docs/system/arm/sbsa.rst
 @@ -XXX,XX +XXX,XX @@
-+# syntax=docker/dockerfile:1.0.0-experimental
++Arm Server Base System Architecture Reference board (``sbsa-ref``)
-+#
++==================================================================
 +# Docker setup for running the "Coverity Scan" tools over the source
 +# tree and uploading them to the website, as per
 +# https://scan.coverity.com/projects/qemu/builds/new
 +# We do this on a fixed config (currently Fedora 30 with a known
 +# set of dependencies and a configure command that enables a specific
 +# set of options) so that random changes don't result in our accidentally
 +# dropping some files from the scan.
 +#
 +# We don't build on top of the fedora.docker file because we don't
 +# want to accidentally change or break the scan config when that
 +# is updated.
 +
-+# The work of actually doing the build is handled by the
++While the `virt` board is a generic board platform that doesn't match
-+# run-coverity-scan script.
++any real hardware the `sbsa-ref` board intends to look like real
 +hardware. The `Server Base System Architecture
 +<https://developer.arm.com/documentation/den0029/latest>` defines a
 +minimum base line of hardware support and importantly how the firmware
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
-+FROM fedora:30
++It is intended to be a machine for developing firmware and testing
-+ENV PACKAGES \
++standards compliance with operating systems.
 +    alsa-lib-devel \
 +    bc \
 +    bison \
 +    brlapi-devel \
 +    bzip2 \
 +    bzip2-devel \
 +    ccache \
 +    clang \
 +    curl \
 +    cyrus-sasl-devel \
 +    dbus-daemon \
 +    device-mapper-multipath-devel \
 +    findutils \
 +    flex \
 +    gcc \
 +    gcc-c++ \
 +    gettext \
 +    git \
 +    glib2-devel \
 +    glusterfs-api-devel \
 +    gnutls-devel \
 +    gtk3-devel \
 +    hostname \
 +    libaio-devel \
 +    libasan \
 +    libattr-devel \
 +    libblockdev-mpath-devel \
 +    libcap-devel \
 +    libcap-ng-devel \
 +    libcurl-devel \
 +    libepoxy-devel \
 +    libfdt-devel \
 +    libgbm-devel \
 +    libiscsi-devel \
 +    libjpeg-devel \
 +    libpmem-devel \
 +    libnfs-devel \
 +    libpng-devel \
 +    librbd-devel \
 +    libseccomp-devel \
 +    libssh-devel \
 +    libubsan \
 +    libudev-devel \
 +    libusbx-devel \
 +    libxml2-devel \
 +    libzstd-devel \
 +    llvm \
 +    lzo-devel \
 +    make \
 +    mingw32-bzip2 \
 +    mingw32-curl \
 +    mingw32-glib2 \
 +    mingw32-gmp \
 +    mingw32-gnutls \
 +    mingw32-gtk3 \
 +    mingw32-libjpeg-turbo \
 +    mingw32-libpng \
 +    mingw32-libtasn1 \
 +    mingw32-nettle \
 +    mingw32-nsis \
 +    mingw32-pixman \
 +    mingw32-pkg-config \
 +    mingw32-SDL2 \
 +    mingw64-bzip2 \
 +    mingw64-curl \
 +    mingw64-glib2 \
 +    mingw64-gmp \
 +    mingw64-gnutls \
 +    mingw64-gtk3 \
 +    mingw64-libjpeg-turbo \
 +    mingw64-libpng \
 +    mingw64-libtasn1 \
 +    mingw64-nettle \
 +    mingw64-pixman \
 +    mingw64-pkg-config \
 +    mingw64-SDL2 \
 +    ncurses-devel \
 +    nettle-devel \
 +    nss-devel \
 +    numactl-devel \
 +    perl \
 +    perl-Test-Harness \
 +    pixman-devel \
 +    pulseaudio-libs-devel \
 +    python3 \
 +    python3-sphinx \
 +    PyYAML \
 +    rdma-core-devel \
 +    SDL2-devel \
 +    snappy-devel \
 +    sparse \
 +    spice-server-devel \
 +    systemd-devel \
 +    systemtap-sdt-devel \
 +    tar \
 +    texinfo \
 +    usbredir-devel \
 +    virglrenderer-devel \
 +    vte291-devel \
 +    wget \
 +    which \
 +    xen-devel \
 +    xfsprogs-devel \
 +    zlib-devel
 +ENV QEMU_CONFIGURE_OPTS --python=/usr/bin/python3
 +
-+RUN dnf install -y $PACKAGES
++Supported devices
-+RUN rpm -q $PACKAGES | sort > /packages.txt
++"""""""""""""""""
 +ENV PATH $PATH:/usr/libexec/python3-sphinx/
 +ENV COVERITY_TOOL_BASE=/coverity-tools
 +COPY run-coverity-scan run-coverity-scan
 +RUN --mount=type=secret,id=coverity.token,required ./run-coverity-scan --update-tools-only --tokenfile /run/secrets/coverity.token
 diff --git a/scripts/coverity-scan/run-coverity-scan b/scripts/coverity-scan/run-coverity-scan
 index XXXXXXX..XXXXXXX 100755
 --- a/scripts/coverity-scan/run-coverity-scan
 +++ b/scripts/coverity-scan/run-coverity-scan
@@ -XXX,XX +XXX,XX @@
  # Command line options:
  #   --dry-run : run the tools, but don't actually do the upload
 +#   --docker : create and work inside a docker container
  #   --update-tools-only : update the cached copy of the tools, but don't run them
  #   --tokenfile : file to read Coverity token from
  #   --version ver : specify version being analyzed (default: ask git)
@@ -XXX,XX +XXX,XX @@
  #   --srcdir : QEMU source tree to analyze (default: current working dir)
  #   --results-tarball : path to copy the results tarball to (default: don't
  #                       copy it anywhere, just upload it)
 +#   --src-tarball : tarball to untar into src dir (default: none); this
 +#                   is intended mainly for internal use by the Docker support
  #
  # User-specifiable environment variables:
  #  COVERITY_TOKEN -- Coverity token
@@ -XXX,XX +XXX,XX @@ update_coverity_tools () {
  # Check user-provided environment variables and arguments
  DRYRUN=no
  UPDATE_ONLY=no
 +DOCKER=no
  while [ "$#" -ge 1 ]; do
      case "$1" in
@@ -XXX,XX +XXX,XX @@ while [ "$#" -ge 1 ]; do
              RESULTSTARBALL="$1"
              shift
              ;;
 +        --src-tarball)
 +            shift
 +            if [ $# -eq 0 ]; then
 +                echo "--src-tarball needs an argument"
 +                exit 1
 +            fi
 +            SRCTARBALL="$1"
 +            shift
 +            ;;
 +        --docker)
 +            DOCKER=yes
 +            shift
 +            ;;
          *)
              echo "Unexpected argument '$1'"
              exit 1
@@ -XXX,XX +XXX,XX @@ PROJTOKEN="$COVERITY_TOKEN"
  PROJNAME=QEMU
  TARBALL=cov-int.tar.xz
 +if [ "$UPDATE_ONLY" = yes ] && [ "$DOCKER" = yes ]; then
 +    echo "Combining --docker and --update-only is not supported"
 +    exit 1
 +fi
  if [ "$UPDATE_ONLY" = yes ]; then
      # Just do the tools update; we don't need to check whether
@@ -XXX,XX +XXX,XX @@ if [ "$UPDATE_ONLY" = yes ]; then
      exit 0
  fi
 +if [ ! -e "$SRCDIR" ]; then
 +    mkdir "$SRCDIR"
 +fi
 +
- cd "$SRCDIR"
++The sbsa-ref board supports:
 +if [ ! -z "$SRCTARBALL" ]; then
 +    echo "Untarring source tarball into $SRCDIR..."
 +    tar xvf "$SRCTARBALL"
 +fi
 +
- echo "Checking this is a QEMU source tree..."
++  - A configurable number of AArch64 CPUs
- if ! [ -e "$SRCDIR/VERSION" ]; then
++  - GIC version 3
-     echo "Not in a QEMU source tree?"
++  - System bus AHCI controller
-@@ -XXX,XX +XXX,XX @@ if [ -z "$COVERITY_EMAIL" ]; then
++  - System bus EHCI controller
-     COVERITY_EMAIL="$(git config user.email)"
++  - CDROM and hard disc on AHCI bus
- fi
++  - E1000E ethernet card on PCIe bus
++  - VGA display adaptor on PCIe bus
-+# Run ourselves inside docker if that's what the user wants
++  - A generic SBSA watchdog device
 +if [ "$DOCKER" = yes ]; then
 +    # build docker container including the coverity-scan tools
 +    # Put the Coverity token into a temporary file that only
 +    # we have read access to, and then pass it to docker build
 +    # using --secret. This requires at least Docker 18.09.
 +    # Mostly what we are trying to do here is ensure we don't leak
 +    # the token into the Docker image.
 +    umask 077
 +    SECRETDIR=$(mktemp -d)
 +    if [ -z "$SECRETDIR" ]; then
 +        echo "Failed to create temporary directory"
 +        exit 1
 +    fi
 +    trap 'rm -rf "$SECRETDIR"' INT TERM EXIT
 +    echo "Created temporary directory $SECRETDIR"
 +    SECRET="$SECRETDIR/token"
 +    echo "$COVERITY_TOKEN" > "$SECRET"
 +    echo "Building docker container..."
 +    # TODO: This re-downloads the tools every time, rather than
 +    # caching and reusing the image produced with the downloaded tools.
 +    # Not sure why.
 +    # TODO: how do you get 'docker build' to print the output of the
 +    # commands it is running to its stdout? This would be useful for debug.
 +    DOCKER_BUILDKIT=1 docker build -t coverity-scanner \
 +                   --secret id=coverity.token,src="$SECRET" \
 +                   -f scripts/coverity-scan/coverity-scan.docker \
 +                   scripts/coverity-scan
 +    echo "Archiving sources to be analyzed..."
 +    ./scripts/archive-source.sh "$SECRETDIR/qemu-sources.tgz"
 +    if [ "$DRYRUN" = yes ]; then
 +        DRYRUNARG=--dry-run
 +    fi
 +    echo "Running scanner..."
 +    # If we need to capture the output tarball, get the inner run to
 +    # save it to the secrets directory so we can copy it out before the
 +    # directory is cleaned up.
 +    if [ ! -z "$RESULTSTARBALL" ]; then
 +        RTARGS="--results-tarball /work/cov-int.tar.xz"
 +    else
 +        RTARGS=""
 +    fi
 +    # Arrange for this docker run to get access to the sources with -v.
 +    # We pass through all the configuration from the outer script to the inner.
 +    export COVERITY_EMAIL COVERITY_BUILD_CMD
 +    docker run -it --env COVERITY_EMAIL --env COVERITY_BUILD_CMD \
 +           -v "$SECRETDIR:/work" coverity-scanner \
 +           ./run-coverity-scan --version "$VERSION" \
 +           --description "$DESCRIPTION" $DRYRUNARG --tokenfile /work/token \
 +           --srcdir /qemu --src-tarball /work/qemu-sources.tgz $RTARGS
 +    if [ ! -z "$RESULTSTARBALL" ]; then
 +        echo "Copying results tarball to $RESULTSTARBALL..."
 +        cp "$SECRETDIR/cov-int.tar.xz" "$RESULTSTARBALL"
 +    fi
 +    echo "Docker work complete."
 +    exit 0
 +fi
 +
-+# Otherwise, continue with the full build and upload process.
+diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
-+
+index XXXXXXX..XXXXXXX 100644
- check_upload_permissions
+--- a/docs/system/target-arm.rst
++++ b/docs/system/target-arm.rst
- update_coverity_tools
+@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
     arm/mps2
     arm/musca
     arm/realview
 +   arm/sbsa
     arm/versatile
     arm/vexpress
     arm/aspeed
 --
 .20.1

-New patch
+[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+When using a Cortex-A15, the Virt machine does not use any
+MPCore peripherals. Remove the dependency.
+Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201107114852.271922-1-philmd@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/Kconfig | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+     imply VFIO_PLATFORM
+     imply VFIO_XGMAC
+     imply TPM_TIS_SYSBUS
+-    select A15MPCORE
+     select ACPI
+     select ARM_SMMUV3
+     select GPIO_KEY
+--
+.20.1

-[PULL 07/12] docs: Improve our gdbstub documentation
+[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
-The documentation of our -s and -gdb options is quite old; in
+From: Richard Henderson <richard.henderson@linaro.org>
 particular it still claims that it will cause QEMU to stop and wait
 for the gdb connection, when this has not been true for some time:
 you also need to pass -S if you want to make QEMU not launch the
 guest on startup.
-Improve the documentation to mention this requirement in the
+The helper function did not get updated when we reorganized
-executable's --help output, the documentation of the -gdb option in
+the vector register file for SVE.  Since then, the neon dregs
-the manual, and in the "GDB usage" chapter.
+are non-sequential and cannot be simply indexed.
-Includes some minor tweaks to these paragraphs of documentation
+At the same time, make the helper function operate on 64-bit
-since I was editing them anyway (such as dropping the description
+quantities so that we do not have to call it twice.
 of our gdb support as "primitive").
+Fixes: c39c2b9043e
+Reported-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+[PMM: use aa32_vfp_dreg() rather than opencoding]
+Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20200403094014.9589-1-peter.maydell@linaro.org
 ---
- docs/system/gdb.rst | 22 +++++++++++++++-------
+ target/arm/helper.h             |  2 +-
- qemu-options.hx     | 24 ++++++++++++++++++------
+ target/arm/op_helper.c          | 23 +++++++++--------
-files changed, 33 insertions(+), 13 deletions(-)
+ target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/docs/system/gdb.rst b/docs/system/gdb.rst
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/gdb.rst
+--- a/target/arm/helper.h
-+++ b/docs/system/gdb.rst
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
- GDB usage
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
- ---------
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+ DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
--QEMU has a primitive support to work with gdb, so that you can do
+-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
--'Ctrl-C' while the virtual machine is running and inspect its state.
++DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
-+QEMU supports working with gdb via gdb's remote-connection facility
-+(the "gdbstub"). This allows you to debug guest code in the same
+ DEF_HELPER_3(shl_cc, i32, env, i32, i32)
-+way that you might with a low-level debug facility like JTAG
+ DEF_HELPER_3(shr_cc, i32, env, i32, i32)
-+on real hardware. You can stop and start the virtual machine,
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-+examine state like registers and memory, and set breakpoints and
+index XXXXXXX..XXXXXXX 100644
-+watchpoints.
+--- a/target/arm/op_helper.c
++++ b/target/arm/op_helper.c
--In order to use gdb, launch QEMU with the '-s' option. It will wait for
+@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
--a gdb connection:
+     cpu_loop_exit_restore(cs, ra);
-+In order to use gdb, launch QEMU with the ``-s`` and ``-S`` options.
+ }
-+The ``-s`` option will make QEMU listen for an incoming connection
-+from gdb on TCP port 1234, and ``-S`` will make QEMU not start the
+-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-+guest until you tell it to from gdb. (If you want to specify which
+-                          uint32_t maxindex)
-+TCP port to use or to use something other than TCP for the gdbstub
++uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
-+connection, use the ``-gdb dev`` option instead of ``-s``.)
++                          uint64_t ireg, uint64_t def)
+ {
- .. parsed-literal::
+-    uint32_t val, shift;
+-    uint64_t *table = vn;
--   |qemu_system| -s -kernel bzImage -hda rootdisk.img -append "root=/dev/hda"
++    uint64_t tmp, val = 0;
--   Connected to host network interface: tun0
++    uint32_t maxindex = ((desc & 3) + 1) * 8;
--   Waiting gdb connection on port 1234
++    uint32_t base_reg = desc >> 2;
-+   |qemu_system| -s -S -kernel bzImage -hda rootdisk.img -append "root=/dev/hda"
++    uint32_t shift, index, reg;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
      return val;
  }
 diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
 -    n <<= 3;
 -    tmp = tcg_temp_new_i32();
 -    if (a->op) {
 -        read_neon_element32(tmp, a->vd, 0, MO_32);
 -    } else {
 -        tcg_gen_movi_i32(tmp, 0);
 -    }
 -    tmp2 = tcg_temp_new_i32();
 -    read_neon_element32(tmp2, a->vm, 0, MO_32);
 -    ptr1 = vfp_reg_ptr(true, a->vn);
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
-+QEMU will launch but will silently wait for gdb to connect.
++    tcg_temp_free_i64(def);
++    tcg_temp_free_i64(val);
- Then launch gdb on the 'vmlinux' executable::
++    tcg_temp_free_i32(desc);
+     return true;
-diff --git a/qemu-options.hx b/qemu-options.hx
+ }
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
  ERST
  DEF("gdb", HAS_ARG, QEMU_OPTION_gdb, \
 -    "-gdb dev        wait for gdb connection on 'dev'\n", QEMU_ARCH_ALL)
 +    "-gdb dev        accept gdb connection on 'dev'. (QEMU defaults to starting\n"
 +    "                the guest without waiting for gdb to connect; use -S too\n"
 +    "                if you want it to not start execution.)\n",
 +    QEMU_ARCH_ALL)
  SRST
  ``-gdb dev``
 -    Wait for gdb connection on device dev (see
 -    :ref:`gdb_005fusage`). Typical connections will likely be
 -    TCP-based, but also UDP, pseudo TTY, or even stdio are reasonable
 -    use case. The latter is allowing to start QEMU from within gdb and
 -    establish the connection via a pipe:
 +    Accept a gdb connection on device dev (see
 +    :ref:`gdb_005fusage`). Note that this option does not pause QEMU
 +    execution -- if you want QEMU to not start the guest until you
 +    connect with gdb and issue a ``continue`` command, you will need to
 +    also pass the ``-S`` option to QEMU.
 +
 +    The most usual configuration is to listen on a local TCP socket::
 +
 +        -gdb tcp::3117
 +
 +    but you can specify other backends; UDP, pseudo TTY, or even stdio
 +    are all reasonable use cases. For example, a stdio connection
 +    allows you to start QEMU from within gdb and establish the
 +    connection via a pipe:
      .. parsed-literal::
 --
 .20.1

-New patch
+[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+We can use one MPC per SRAM bank, but we currently only wire the
+IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-2-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/armsse.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                                         qdev_get_gpio_in(dev_splitter, 0));
+             qdev_connect_gpio_out(dev_splitter, 0,
+                                   qdev_get_gpio_in_named(dev_secctl,
+-                                                         "mpc_status", 0));
++                                                         "mpc_status",
++                                                         i - IOTS_NUM_EXP_MPC));
+         }
+         qdev_connect_gpio_out(dev_splitter, 1,
+--
+.20.1

-[PULL 11/12] docs: Require Sphinx 1.6 or better
+[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
-Versions of Sphinx older than 1.6 can't build all of our documentation,
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 because they are too picky about the syntax of the argument to the
 option:: directive; see Sphinx bugs #646, #3366:
-  https://github.com/sphinx-doc/sphinx/issues/646
+The system configuration controller (SYSCFG) doesn't have
-  https://github.com/sphinx-doc/sphinx/issues/3366
+any output IRQ (and the INTC input #71 belongs to the UART6).
 Remove the invalid code.
-Trying to build with a 1.4.x Sphinx fails with
+Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
- docs/system/images.rst:4: SEVERE: Duplicate ID: "cmdoption-qcow2-arg-encrypt"
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-and a 1.5.x Sphinx fails with
+Message-id: 20201107193403.436146-3-f4bug@amsat.org
- docs/system/invocation.rst:544: WARNING: Malformed option description '[enable=]PATTERN', should look like "opt", "-opt
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-args", "--opt args", "/opt args" or "+opt args"
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/misc/stm32f2xx_syscfg.h | 2 --
  hw/arm/stm32f205_soc.c             | 1 -
  hw/misc/stm32f2xx_syscfg.c         | 2 --
 files changed, 5 deletions(-)
-Update our needs_sphinx setting to indicate that we require at least
+diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
 .6.  This will allow configure to fall back to "don't build the
 docs" rather than causing the build to fail entirely, which is
 probably what most users building on a host old enough to have such
 an old Sphinx would want; if they do want the docs then they'll have
 a useful indication of what they need to do (upgrade Sphinx!) rather
 than a confusing error message.
 In theory our distro support policy would suggest that we should
 support building on the Sphinx shipped in those distros, but:
  * EPEL7 has Sphinx 1.2.3 (which we've never supported!)
  * Debian Stretch has Sphinx 1.4.8
 Trying to get our docs to work with Sphinx 1.4 is not tractable
 for the 5.0 release and I'm not sure it's worthwhile effort anyway;
 at least with this change the build as a whole now succeeds.
 Thanks to John Snow for doing the investigation and testing to
 confirm what Sphinx versions fail in what ways and what distros
 shipped what.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  docs/conf.py | 6 ++++--
 file changed, 4 insertions(+), 2 deletions(-)
 diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/docs/conf.py
+--- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/docs/conf.py
++++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@ sys.path.insert(0, os.path.join(qemu_docdir, "sphinx"))
+@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
+     uint32_t syscfg_exticr3;
- # If your documentation needs a minimal Sphinx version, state it here.
+     uint32_t syscfg_exticr4;
- #
+     uint32_t syscfg_cmpcr;
--# 1.3 is where the 'alabaster' theme was shipped with Sphinx.
+-
--needs_sphinx = '1.3'
+-    qemu_irq irq;
-+# Sphinx 1.5 and earlier can't build our docs because they are too
+ };
-+# picky about the syntax of the argument to the option:: directive
-+# (see Sphinx bugs #646, #3366).
+ #endif /* HW_STM32F2XX_SYSCFG_H */
-+needs_sphinx = '1.6'
+diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
+index XXXXXXX..XXXXXXX 100644
- # Add any Sphinx extension module names here, as strings. They can be
+--- a/hw/arm/stm32f205_soc.c
- # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
++++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
      }
      busdev = SYS_BUS_DEVICE(dev);
      sysbus_mmio_map(busdev, 0, 0x40013800);
 -    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
      /* Attach UART (uses USART registers) and USART controllers */
      for (i = 0; i < STM_NUM_USARTS; i++) {
 diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32f2xx_syscfg.c
 +++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
  {
      STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 -    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 -
      memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                            TYPE_STM32F2XX_SYSCFG, 0x400);
      sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 --
 .20.1

-[PULL 08/12] configure: Honour --disable-werror for Sphinx
+[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
-If we are not making warnings fatal for compilation, make them
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 non-fatal when building the Sphinx documentation also.  (For instance
 Sphinx 3.0 warns about some constructs that older versions were happy
 with, which is a build failure if we use the warnings-as-errors
 flag.)
-This provides a workaround at least for LP:1872113.
+omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
 OMAP2 chip support") takes care of creating the 3 UARTs.
+Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
+extensions and attach to n8x0's UART") added n8x0_uart_setup()
+which create the UART and connects it to an IRQ output,
+overwritting the existing peripheral and its IRQ connection.
+This is incorrect.
+Fortunately we don't need to fix this, because commit 6da68df7f9b
+("hw/arm/nseries: Replace the bluetooth chardev with a "null"
+chardev") removed the use of this peripheral. We can simply
+remove the code.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201107193403.436146-4-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200411182934.28678-2-peter.maydell@linaro.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 ---
- configure | 9 ++++++++-
+ hw/arm/nseries.c | 11 -----------
- Makefile  | 2 +-
+file changed, 11 deletions(-)
 files changed, 9 insertions(+), 2 deletions(-)
-diff --git a/configure b/configure
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/hw/arm/nseries.c
-+++ b/configure
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ if check_include sys/kcov.h ; then
+@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
-     kcov=yes
+     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
  fi
 +# If we're making warnings fatal, apply this to Sphinx runs as well
 +sphinx_werror=""
 +if test "$werror" = "yes"; then
 +    sphinx_werror="-W"
 +fi
 +
  # Check we have a new enough version of sphinx-build
  has_sphinx_build() {
      # This is a bit awkward but works: create a trivial document and
@@ -XXX,XX +XXX,XX @@ has_sphinx_build() {
      # sphinx-build doesn't exist at all or if it is too old.
      mkdir -p "$TMPDIR1/sphinx"
      touch "$TMPDIR1/sphinx/index.rst"
 -    "$sphinx_build" -c "$source_path/docs" -b html "$TMPDIR1/sphinx" "$TMPDIR1/sphinx/out" >/dev/null 2>&1
 +    "$sphinx_build" $sphinx_werror -c "$source_path/docs" -b html "$TMPDIR1/sphinx" "$TMPDIR1/sphinx/out" >/dev/null 2>&1
  }
- # Check if tools are available to build documentation.
+-static void n8x0_uart_setup(struct n800_s *s)
-@@ -XXX,XX +XXX,XX @@ echo "INSTALL_PROG=$install -c -m 0755" >> $config_host_mak
+-{
- echo "INSTALL_LIB=$install -c -m 0644" >> $config_host_mak
+-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
- echo "PYTHON=$python" >> $config_host_mak
+-    /*
- echo "SPHINX_BUILD=$sphinx_build" >> $config_host_mak
+-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-+echo "SPHINX_WERROR=$sphinx_werror" >> $config_host_mak
+-     * here, but this code has been removed with the bluetooth backend.
- echo "GENISOIMAGE=$genisoimage" >> $config_host_mak
+-     */
- echo "CC=$cc" >> $config_host_mak
+-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
- if $iasl -h > /dev/null 2>&1; then
+-}
-diff --git a/Makefile b/Makefile
+-
-index XXXXXXX..XXXXXXX 100644
+ static void n8x0_usb_setup(struct n800_s *s)
---- a/Makefile
+ {
-+++ b/Makefile
+     SysBusDevice *dev;
-@@ -XXX,XX +XXX,XX @@ sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html \
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
- # Note the use of different doctree for each (manual, builder) tuple;
+     n8x0_spi_setup(s);
- # this works around Sphinx not handling parallel invocation on
+     n8x0_dss_setup(s);
- # a single doctree: https://github.com/sphinx-doc/sphinx/issues/2946
+     n8x0_cbus_setup(s);
--build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" $(SPHINX_BUILD) $(if $(V),,-q) -W -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
+-    n8x0_uart_setup(s);
-+build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" $(SPHINX_BUILD) $(if $(V),,-q) $(SPHINX_WERROR) -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
+     if (machine_usb(machine)) {
- # We assume all RST files in the manual's directory are used in it
+         n8x0_usb_setup(s);
- manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst $(SRC_PATH)/docs/$1/*/*.rst) \
+     }
                $(SRC_PATH)/docs/defs.rst.inc \
 --
 .20.1

-[PULL 10/12] kernel-doc: Use c:struct for Sphinx 3.0 and later
+[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
-The kernel-doc Sphinx plugin and associated script currently emit
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 'c:type' directives for "struct foo" documentation.
-Sphinx 3.0 warns about this:
+The MusicPal board code connects both of the IRQ outputs of the UART
-  /home/petmay01/linaro/qemu-from-laptop/qemu/docs/../include/exec/memory.h:3: WARNING: Type must be either just a name or a typedef-like declaration.
+to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-  If just a name:
+to the same input is not valid as it produces subtly wrong behaviour
-    Error in declarator or parameters
+(for instance if both the IRQ lines are high, and then one goes
-    Invalid C declaration: Expected identifier in nested name, got keyword: struct [error at 6]
+low, the INTC input will see this as a high-to-low transition
-      struct MemoryListener
+even though the second IRQ line should still be holding it high).
       ------^
   If typedef-like declaration:
     Error in declarator or parameters
     Invalid C declaration: Expected identifier in nested name. [error at 21]
       struct MemoryListener
       ---------------------^
-because it wants us to use the new-in-3.0 'c:struct' instead.
+This kind of wiring needs an explicitly created OR gate; add one.
-Plumb the Sphinx version through to the kernel-doc script
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
-and use it to select 'c:struct' for newer versions than 3.0.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20201107193403.436146-5-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/musicpal.c | 17 +++++++++++++----
  hw/arm/Kconfig    |  1 +
 files changed, 14 insertions(+), 4 deletions(-)
-Fixes: LP:1872113
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 ---
  docs/sphinx/kerneldoc.py |  1 +
  scripts/kernel-doc       | 16 +++++++++++++++-
 files changed, 16 insertions(+), 1 deletion(-)
 diff --git a/docs/sphinx/kerneldoc.py b/docs/sphinx/kerneldoc.py
 index XXXXXXX..XXXXXXX 100644
---- a/docs/sphinx/kerneldoc.py
+--- a/hw/arm/musicpal.c
-+++ b/docs/sphinx/kerneldoc.py
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ class KernelDocDirective(Directive):
+@@ -XXX,XX +XXX,XX @@
-                 env.note_dependency(os.path.abspath(f))
+ #include "ui/console.h"
-                 cmd += ['-export-file', f]
+ #include "hw/i2c/i2c.h"
+ #include "hw/irq.h"
-+        cmd += ['-sphinx-version', sphinx.__version__]
++#include "hw/or-irq.h"
-         cmd += [filename]
+ #include "hw/audio/wm8750.h"
+ #include "sysemu/block-backend.h"
-         try:
+ #include "sysemu/runstate.h"
-diff --git a/scripts/kernel-doc b/scripts/kernel-doc
+@@ -XXX,XX +XXX,XX @@
-index XXXXXXX..XXXXXXX 100755
+ #define MP_TIMER4_IRQ           7
---- a/scripts/kernel-doc
+ #define MP_EHCI_IRQ             8
-+++ b/scripts/kernel-doc
+ #define MP_ETH_IRQ              9
-@@ -XXX,XX +XXX,XX @@ Output selection (mutually exclusive):
+-#define MP_UART1_IRQ            11
-             DOC: sections. May be specified multiple times.
+-#define MP_UART2_IRQ            11
++#define MP_UART_SHARED_IRQ      11
- Output selection modifiers:
+ #define MP_GPIO_IRQ             12
-+  -sphinx-version VER   Generate rST syntax for the specified Sphinx version.
+ #define MP_RTC_IRQ              28
-+                        Only works with reStructuredTextFormat.
+ #define MP_AUDIO_IRQ            30
-   -no-doc-sections    Do not output DOC: sections.
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-   -enable-lineno        Enable output of #define LINENO lines. Only works with
+     ARMCPU *cpu;
-                         reStructuredText format.
+     qemu_irq pic[32];
-@@ -XXX,XX +XXX,XX @@ use constant {
+     DeviceState *dev;
- };
++    DeviceState *uart_orgate;
- my $output_selection = OUTPUT_ALL;
+     DeviceState *i2c_dev;
- my $show_not_found = 0;    # No longer used
+     DeviceState *lcd_dev;
-+my $sphinx_version = "0.0"; # if not specified, assume old
+     DeviceState *key_dev;
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
- my @export_file_list;
+                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
+                           pic[MP_TIMER4_IRQ], NULL);
-@@ -XXX,XX +XXX,XX @@ while ($ARGV[0] =~ m/^--?(.*)/) {
-         $enable_lineno = 1;
+-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
-     } elsif ($cmd eq 'show-not-found') {
++    /* Logically OR both UART IRQs together */
-     $show_not_found = 1;  # A no-op but don't fail
++    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+    } elsif ($cmd eq 'sphinx-version') {
++    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+        $sphinx_version = shift @ARGV;
++    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-     } else {
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-     # Unknown argument
++
-         usage();
++    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-@@ -XXX,XX +XXX,XX @@ sub output_struct_rst(%) {
++                   qdev_get_gpio_in(uart_orgate, 0),
-     my $oldprefix = $lineprefix;
+                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-     my $name = $args{'type'} . " " . $args{'struct'};
+-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
++    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
--    print "\n\n.. c:type:: " . $name . "\n\n";
++                   qdev_get_gpio_in(uart_orgate, 1),
-+    # Sphinx 3.0 and up will emit warnings for "c:type:: struct Foo".
+                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
-+    # It wants to see "c:struct:: Foo" (and will add the word 'struct' in
-+    # the rendered output).
+     /* Register flash */
-+    if ((split(/\./, $sphinx_version))[0] >= 3) {
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-+        my $sname = $name;
+index XXXXXXX..XXXXXXX 100644
-+        $sname =~ s/^struct //;
+--- a/hw/arm/Kconfig
-+        print "\n\n.. c:struct:: " . $sname . "\n\n";
++++ b/hw/arm/Kconfig
-+    } else {
+@@ -XXX,XX +XXX,XX @@ config MUSCA
-+        print "\n\n.. c:type:: " . $name . "\n\n";
-+    }
+ config MUSICPAL
-     print_lineno($declaration_start_line);
+     bool
-     $lineprefix = "   ";
++    select OR_IRQ
-     output_highlight_rst($args{'purpose'});
+     select BITBANG_I2C
      select MARVELL_88W8618
      select PTIMER
 --
 .20.1

-[PULL 05/12] scripts/run-coverity-scan: Script to run Coverity Scan build
+[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
-Add a new script to automate the process of running the Coverity
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Scan build tools and uploading the resulting tarball to the
 website.
-This is intended eventually to be driven from Travis,
+We don't need to fill the full pic[] array if we only use
-but it can be run locally, if you are a maintainer of the
+few of the interrupt lines. Directly call qdev_get_gpio_in()
-QEMU project on the Coverity Scan website and have the secret
+when necessary.
 upload token.
-The script must be run on a Fedora 30 system.  Support for using a
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Docker container is added in a following commit.
+Message-id: 20201107193403.436146-6-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/musicpal.c | 25 +++++++++++++------------
 file changed, 13 insertions(+), 12 deletions(-)
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200319193323.2038-6-peter.maydell@linaro.org
 ---
  MAINTAINERS                             |   5 +
  scripts/coverity-scan/run-coverity-scan | 311 ++++++++++++++++++++++++
 files changed, 316 insertions(+)
  create mode 100755 scripts/coverity-scan/run-coverity-scan
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/arm/musicpal.c
-+++ b/MAINTAINERS
++++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ M: Markus Armbruster <armbru@redhat.com>
+@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
- S: Supported
+ static void musicpal_init(MachineState *machine)
- F: scripts/coverity-model.c
+ {
+     ARMCPU *cpu;
-+Coverity Scan integration
+-    qemu_irq pic[32];
-+M: Peter Maydell <peter.maydell@linaro.org>
+     DeviceState *dev;
-+S: Maintained
++    DeviceState *pic;
-+F: scripts/coverity-scan/
+     DeviceState *uart_orgate;
-+
+     DeviceState *i2c_dev;
- Device Tree
+     DeviceState *lcd_dev;
- M: Alistair Francis <alistair.francis@wdc.com>
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
- R: David Gibson <david@gibson.dropbear.id.au>
+                            &error_fatal);
-diff --git a/scripts/coverity-scan/run-coverity-scan b/scripts/coverity-scan/run-coverity-scan
+     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
-new file mode 100755
-index XXXXXXX..XXXXXXX
+-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
---- /dev/null
++    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-+++ b/scripts/coverity-scan/run-coverity-scan
+                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-@@ -XXX,XX +XXX,XX @@
+-    for (i = 0; i < 32; i++) {
-+#!/bin/sh -e
+-        pic[i] = qdev_get_gpio_in(dev, i);
-+
+-    }
-+# Upload a created tarball to Coverity Scan, as per
+-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-+# https://scan.coverity.com/projects/qemu/builds/new
+-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-+
+-                          pic[MP_TIMER4_IRQ], NULL);
-+# This work is licensed under the terms of the GNU GPL version 2,
++    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
-+# or (at your option) any later version.
++                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
-+# See the COPYING file in the top-level directory.
++                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
-+#
++                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
-+# Copyright (c) 2017-2020 Linaro Limited
++                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
-+# Written by Peter Maydell
-+
+     /* Logically OR both UART IRQs together */
-+# Note that this script will automatically download and
+     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+# run the (closed-source) coverity build tools, so don't
+     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+# use it if you don't trust them!
+     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+
+-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+# This script assumes that you're running it from a QEMU source
++    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
-+# tree, and that tree is a fresh clean one, because we do an in-tree
++                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
-+# build. (This is necessary so that the filenames that the Coverity
-+# Scan server sees are relative paths that match up with the component
+     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+# regular expressions it uses; an out-of-tree build won't work for this.)
+                    qdev_get_gpio_in(uart_orgate, 0),
-+# The host machine should have as many of QEMU's dependencies
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+# installed as possible, for maximum coverity coverage.
+                              OBJECT(get_system_memory()), &error_fatal);
-+
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+# To do an upload you need to be a maintainer in the Coverity online
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-+# service, and you will need to know the "Coverity token", which is a
+-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
-+# secret 8 digit hex string. You can find that from the web UI in the
++    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
-+# project settings, if you have maintainer access there.
++                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
-+
-+# Command line options:
+     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
-+#   --dry-run : run the tools, but don't actually do the upload
-+#   --update-tools-only : update the cached copy of the tools, but don't run them
+     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
-+#   --tokenfile : file to read Coverity token from
-+#   --version ver : specify version being analyzed (default: ask git)
+     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-+#   --description desc : specify description of this version (default: ask git)
+-                               pic[MP_GPIO_IRQ]);
-+#   --srcdir : QEMU source tree to analyze (default: current working dir)
++                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
-+#   --results-tarball : path to copy the results tarball to (default: don't
+     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
-+#                       copy it anywhere, just upload it)
+     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
-+#
-+# User-specifiable environment variables:
+@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-+#  COVERITY_TOKEN -- Coverity token
+                              NULL);
-+#  COVERITY_EMAIL -- the email address to use for uploads (default:
+     sysbus_realize_and_unref(s, &error_fatal);
-+#                    looks at your git user.email config)
+     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-+#  COVERITY_BUILD_CMD -- make command (default: 'make -jN' where N is
+-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
-+#                    number of CPUs as determined by 'nproc')
++    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
-+#  COVERITY_TOOL_BASE -- set to directory to put coverity tools
-+#                        (default: /tmp/coverity-tools)
+     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
-+#
+     arm_load_kernel(cpu, machine, &musicpal_binfo);
 +# You must specify the token, either by environment variable or by
 +# putting it in a file and using --tokenfile. Everything else has
 +# a reasonable default if this is run from a git tree.
 +
 +check_upload_permissions() {
 +    # Check whether we can do an upload to the server; will exit the script
 +    # with status 1 if the check failed (usually a bad token);
 +    # will exit the script with status 0 if the check indicated that we
 +    # can't upload yet (ie we are at quota)
 +    # Assumes that PROJTOKEN, PROJNAME and DRYRUN have been initialized.
 +
 +    echo "Checking upload permissions..."
 +
 +    if ! up_perm="$(wget https://scan.coverity.com/api/upload_permitted --post-data "token=$PROJTOKEN&project=$PROJNAME" -q -O -)"; then
 +        echo "Coverity Scan API access denied: bad token?"
 +        exit 1
 +    fi
 +
 +    # Really up_perm is a JSON response with either
 +    # {upload_permitted:true} or {next_upload_permitted_at:<date>}
 +    # We do some hacky string parsing instead of properly parsing it.
 +    case "$up_perm" in
 +        *upload_permitted*true*)
 +            echo "Coverity Scan: upload permitted"
 +            ;;
 +        *next_upload_permitted_at*)
 +            if [ "$DRYRUN" = yes ]; then
 +                echo "Coverity Scan: upload quota reached, continuing dry run"
 +            else
 +                echo "Coverity Scan: upload quota reached; stopping here"
 +                # Exit success as this isn't a build error.
 +                exit 0
 +            fi
 +            ;;
 +        *)
 +            echo "Coverity Scan upload check: unexpected result $up_perm"
 +            exit 1
 +            ;;
 +    esac
 +}
 +
 +
 +update_coverity_tools () {
 +    # Check for whether we need to download the Coverity tools
 +    # (either because we don't have a copy, or because it's out of date)
 +    # Assumes that COVERITY_TOOL_BASE, PROJTOKEN and PROJNAME are set.
 +
 +    mkdir -p "$COVERITY_TOOL_BASE"
 +    cd "$COVERITY_TOOL_BASE"
 +
 +    echo "Checking for new version of coverity build tools..."
 +    wget https://scan.coverity.com/download/linux64 --post-data "token=$PROJTOKEN&project=$PROJNAME&md5=1" -O coverity_tool.md5.new
 +
 +    if ! cmp -s coverity_tool.md5 coverity_tool.md5.new; then
 +        # out of date md5 or no md5: download new build tool
 +        # blow away the old build tool
 +        echo "Downloading coverity build tools..."
 +        rm -rf coverity_tool coverity_tool.tgz
 +        wget https://scan.coverity.com/download/linux64 --post-data "token=$PROJTOKEN&project=$PROJNAME" -O coverity_tool.tgz
 +        if ! (cat coverity_tool.md5.new; echo "  coverity_tool.tgz") | md5sum -c --status; then
 +            echo "Downloaded tarball didn't match md5sum!"
 +            exit 1
 +        fi
 +        # extract the new one, keeping it corralled in a 'coverity_tool' directory
 +        echo "Unpacking coverity build tools..."
 +        mkdir -p coverity_tool
 +        cd coverity_tool
 +        tar xf ../coverity_tool.tgz
 +        cd ..
 +        mv coverity_tool.md5.new coverity_tool.md5
 +    fi
 +
 +    rm -f coverity_tool.md5.new
 +}
 +
 +
 +# Check user-provided environment variables and arguments
 +DRYRUN=no
 +UPDATE_ONLY=no
 +
 +while [ "$#" -ge 1 ]; do
 +    case "$1" in
 +        --dry-run)
 +            shift
 +            DRYRUN=yes
 +            ;;
 +        --update-tools-only)
 +            shift
 +            UPDATE_ONLY=yes
 +            ;;
 +        --version)
 +            shift
 +            if [ $# -eq 0 ]; then
 +                echo "--version needs an argument"
 +                exit 1
 +            fi
 +            VERSION="$1"
 +            shift
 +            ;;
 +        --description)
 +            shift
 +            if [ $# -eq 0 ]; then
 +                echo "--description needs an argument"
 +                exit 1
 +            fi
 +            DESCRIPTION="$1"
 +            shift
 +            ;;
 +        --tokenfile)
 +            shift
 +            if [ $# -eq 0 ]; then
 +                echo "--tokenfile needs an argument"
 +                exit 1
 +            fi
 +            COVERITY_TOKEN="$(cat "$1")"
 +            shift
 +            ;;
 +        --srcdir)
 +            shift
 +            if [ $# -eq 0 ]; then
 +                echo "--srcdir needs an argument"
 +                exit 1
 +            fi
 +            SRCDIR="$1"
 +            shift
 +            ;;
 +        --results-tarball)
 +            shift
 +            if [ $# -eq 0 ]; then
 +                echo "--results-tarball needs an argument"
 +                exit 1
 +            fi
 +            RESULTSTARBALL="$1"
 +            shift
 +            ;;
 +        *)
 +            echo "Unexpected argument '$1'"
 +            exit 1
 +            ;;
 +    esac
 +done
 +
 +if [ -z "$COVERITY_TOKEN" ]; then
 +    echo "COVERITY_TOKEN environment variable not set"
 +    exit 1
 +fi
 +
 +if [ -z "$COVERITY_BUILD_CMD" ]; then
 +    NPROC=$(nproc)
 +    COVERITY_BUILD_CMD="make -j$NPROC"
 +    echo "COVERITY_BUILD_CMD: using default '$COVERITY_BUILD_CMD'"
 +fi
 +
 +if [ -z "$COVERITY_TOOL_BASE" ]; then
 +    echo "COVERITY_TOOL_BASE: using default /tmp/coverity-tools"
 +    COVERITY_TOOL_BASE=/tmp/coverity-tools
 +fi
 +
 +if [ -z "$SRCDIR" ]; then
 +    SRCDIR="$PWD"
 +fi
 +
 +PROJTOKEN="$COVERITY_TOKEN"
 +PROJNAME=QEMU
 +TARBALL=cov-int.tar.xz
 +
 +
 +if [ "$UPDATE_ONLY" = yes ]; then
 +    # Just do the tools update; we don't need to check whether
 +    # we are in a source tree or have upload rights for this,
 +    # so do it before some of the command line and source tree checks.
 +    update_coverity_tools
 +    exit 0
 +fi
 +
 +cd "$SRCDIR"
 +
 +echo "Checking this is a QEMU source tree..."
 +if ! [ -e "$SRCDIR/VERSION" ]; then
 +    echo "Not in a QEMU source tree?"
 +    exit 1
 +fi
 +
 +# Fill in defaults used by the non-update-only process
 +if [ -z "$VERSION" ]; then
 +    VERSION="$(git describe --always HEAD)"
 +fi
 +
 +if [ -z "$DESCRIPTION" ]; then
 +    DESCRIPTION="$(git rev-parse HEAD)"
 +fi
 +
 +if [ -z "$COVERITY_EMAIL" ]; then
 +    COVERITY_EMAIL="$(git config user.email)"
 +fi
 +
 +check_upload_permissions
 +
 +update_coverity_tools
 +
 +TOOLBIN="$(cd "$COVERITY_TOOL_BASE" && echo $PWD/coverity_tool/cov-analysis-*/bin)"
 +
 +if ! test -x "$TOOLBIN/cov-build"; then
 +    echo "Couldn't find cov-build in the coverity build-tool directory??"
 +    exit 1
 +fi
 +
 +export PATH="$TOOLBIN:$PATH"
 +
 +cd "$SRCDIR"
 +
 +echo "Doing make distclean..."
 +make distclean
 +
 +echo "Configuring..."
 +# We configure with a fixed set of enables here to ensure that we don't
 +# accidentally reduce the scope of the analysis by doing the build on
 +# the system that's missing a dependency that we need to build part of
 +# the codebase.
 +./configure --disable-modules --enable-sdl --enable-gtk \
 +    --enable-opengl --enable-vte --enable-gnutls \
 +    --enable-nettle --enable-curses --enable-curl \
 +    --audio-drv-list=oss,alsa,sdl,pa --enable-virtfs \
 +    --enable-vnc --enable-vnc-sasl --enable-vnc-jpeg --enable-vnc-png \
 +    --enable-xen --enable-brlapi \
 +    --enable-linux-aio --enable-attr \
 +    --enable-cap-ng --enable-trace-backends=log --enable-spice --enable-rbd \
 +    --enable-xfsctl --enable-libusb --enable-usb-redir \
 +    --enable-libiscsi --enable-libnfs --enable-seccomp \
 +    --enable-tpm --enable-libssh --enable-lzo --enable-snappy --enable-bzip2 \
 +    --enable-numa --enable-rdma --enable-smartcard --enable-virglrenderer \
 +    --enable-mpath --enable-libxml2 --enable-glusterfs \
 +    --enable-virtfs --enable-zstd
 +
 +echo "Making libqemustub.a..."
 +make libqemustub.a
 +
 +echo "Running cov-build..."
 +rm -rf cov-int
 +mkdir cov-int
 +cov-build --dir cov-int $COVERITY_BUILD_CMD
 +
 +echo "Creating results tarball..."
 +tar cvf - cov-int | xz > "$TARBALL"
 +
 +if [ ! -z "$RESULTSTARBALL" ]; then
 +    echo "Copying results tarball to $RESULTSTARBALL..."
 +    cp "$TARBALL" "$RESULTSTARBALL"
 +fi
 +
 +echo "Uploading results tarball..."
 +
 +if [ "$DRYRUN" = yes ]; then
 +    echo "Dry run only, not uploading $TARBALL"
 +    exit 0
 +fi
 +
 +curl --form token="$PROJTOKEN" --form email="$COVERITY_EMAIL" \
 +     --form file=@"$TARBALL" --form version="$VERSION" \
 +     --form description="$DESCRIPTION" \
 +     https://scan.coverity.com/builds?project="$PROJNAME"
 +
 +echo "Done."
 --
 .20.1

-[PULL 01/12] osdep.h: Drop no-longer-needed Coverity workarounds
+[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
-In commit a1a98357e3fd in 2018 we added some workarounds for Coverity
+The nseries machines have a codepath that allows them to load a
-not being able to handle the _Float* types introduced by recent
+secondary bootloader.  This code wasn't checking that the
-glibc.  Newer versions of the Coverity scan tools have support for
+load_image_targphys() succeeded.  Check the return value and report
-these types, and will fail with errors about duplicate typedefs if we
+the error to the user.
 have our workaround.  Remove our copy of the typedefs.
+While we're in the vicinity, fix the comment style of the
+comment documenting what this image load is doing.
+Fixes: Coverity CID 1192904
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200319193323.2038-2-peter.maydell@linaro.org
+Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
 ---
- include/qemu/osdep.h | 14 --------------
+ hw/arm/nseries.c | 15 +++++++++++----
-file changed, 14 deletions(-)
+file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/osdep.h
+--- a/hw/arm/nseries.c
-+++ b/include/qemu/osdep.h
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
- #else
+         /* No, wait, better start at the ROM.  */
- #include "exec/poison.h"
+         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
- #endif
--#ifdef __COVERITY__
+-        /* This is intended for loading the `secondary.bin' program from
--/* Coverity does not like the new _Float* types that are used by
++        /*
-- * recent glibc, and croaks on every single file that includes
++         * This is intended for loading the `secondary.bin' program from
-- * stdlib.h.  These typedefs are enough to please it.
+          * Nokia images (the NOLO bootloader).  The entry point seems
-- *
+          * to be at OMAP2_Q2_BASE + 0x400000.
-- * Note that these fix parse errors so they cannot be placed in
+          *
-- * scripts/coverity-model.c.
+@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-- */
+          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
--typedef float _Float32;
+          *
--typedef double _Float32x;
+          * The code above is for loading the `zImage' file from Nokia
--typedef double _Float64;
+-         * images.  */
--typedef __float80 _Float64x;
+-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
--typedef __float128 _Float128;
+-                            machine->ram_size - 0x400000);
--#endif
++         * images.
++         */
- #include "qemu/compiler.h"
++        if (load_image_targphys(option_rom[0].name,
++                                OMAP2_Q2_BASE + 0x400000,
 +                                machine->ram_size - 0x400000) < 0) {
 +            error_report("Failed to load secondary bootloader %s",
 +                         option_rom[0].name);
 +            exit(EXIT_FAILURE);
 +        }
          n800_setup_nolo_tags(nolo_tags);
          cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
 --
 .20.1

-[PULL 04/12] linux-user/flatload.c: Use "" for include of QEMU header target_flat.h
+[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
-The target_flat.h file is a QEMU header, so we should include it using
+From: Havard Skinnemoen <hskinnemoen@google.com>
 quotes, not angle brackets.
-Coverity otherwise is unable to find the header:
+The number of runs is equal to the number of 0-1 and 1-0 transitions,
 plus one. Currently, it's counting the number of times these transitions
 do _not_ happen, plus one.
-"../linux-user/flatload.c", line 40: error #1712: cannot open source file
+Source:
-          "target_flat.h"
+https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
-  #include <target_flat.h>
+section 2.3.4 point (3).
                           ^
-because the relevant directory is only on the -iquote path, not the -I path.
+Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
+Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20200319193323.2038-5-peter.maydell@linaro.org
 ---
- linux-user/flatload.c | 2 +-
+ tests/qtest/npcm7xx_rng-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/linux-user/flatload.c b/linux-user/flatload.c
+diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/flatload.c
+--- a/tests/qtest/npcm7xx_rng-test.c
-+++ b/linux-user/flatload.c
++++ b/tests/qtest/npcm7xx_rng-test.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+     pi = (double)nr_ones / nr_bits;
- #include "qemu.h"
- #include "flat.h"
+     for (k = 0; k < nr_bits - 1; k++) {
--#include <target_flat.h>
+-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
-+#include "target_flat.h"
++        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
+     }
- //#define DEBUG
+     vn_obs += 1;
 --
 .20.1

-[PULL 03/12] thread.h: Remove trailing semicolons from Coverity qemu_mutex_lock() etc
+[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
-All the Coverity-specific definitions of qemu_mutex_lock() and friends
+Checks for UNDEF cases should go before the "is VFP enabled?" access
-have a trailing semicolon. This works fine almost everywhere because
+check, except in special cases. Move a stray UNDEF check in the VTBL
-of QEMU's mandatory-braces coding style and because most callsites are
+trans function up above the access check.
 simple, but target/s390x/sigp.c has a use of qemu_mutex_trylock() as
 an if() statement, which makes the ';' a syntax error:
 "../target/s390x/sigp.c", line 461: warning #18: expected a ")"
       if (qemu_mutex_trylock(&qemu_sigp_mutex)) {
           ^
 Remove the bogus semicolons from the macro definitions.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 Message-id: 20200319193323.2038-4-peter.maydell@linaro.org
 ---
- include/qemu/thread.h | 12 ++++++------
+ target/arm/translate-neon.c.inc | 8 ++++----
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/include/qemu/thread.h b/include/qemu/thread.h
+diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/thread.h
+--- a/target/arm/translate-neon.c.inc
-+++ b/include/qemu/thread.h
++++ b/target/arm/translate-neon.c.inc
-@@ -XXX,XX +XXX,XX @@ extern QemuCondTimedWaitFunc qemu_cond_timedwait_func;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-  * hide them.
+         return false;
-  */
+     }
- #define qemu_mutex_lock(m)                                              \
--            qemu_mutex_lock_impl(m, __FILE__, __LINE__);
+-    if (!vfp_access_check(s)) {
-+            qemu_mutex_lock_impl(m, __FILE__, __LINE__)
+-        return true;
- #define qemu_mutex_trylock(m)                                           \
+-    }
--            qemu_mutex_trylock_impl(m, __FILE__, __LINE__);
+-
-+            qemu_mutex_trylock_impl(m, __FILE__, __LINE__)
+     if ((a->vn + a->len + 1) > 32) {
- #define qemu_rec_mutex_lock(m)                                          \
+         /*
--            qemu_rec_mutex_lock_impl(m, __FILE__, __LINE__);
+          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
-+            qemu_rec_mutex_lock_impl(m, __FILE__, __LINE__)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
- #define qemu_rec_mutex_trylock(m)                                       \
+         return false;
--            qemu_rec_mutex_trylock_impl(m, __FILE__, __LINE__);
+     }
-+            qemu_rec_mutex_trylock_impl(m, __FILE__, __LINE__)
- #define qemu_cond_wait(c, m)                                            \
++    if (!vfp_access_check(s)) {
--            qemu_cond_wait_impl(c, m, __FILE__, __LINE__);
++        return true;
-+            qemu_cond_wait_impl(c, m, __FILE__, __LINE__)
++    }
- #define qemu_cond_timedwait(c, m, ms)                                   \
++
--            qemu_cond_timedwait_impl(c, m, ms, __FILE__, __LINE__);
+     desc = tcg_const_i32((a->vn << 2) | a->len);
-+            qemu_cond_timedwait_impl(c, m, ms, __FILE__, __LINE__)
+     def = tcg_temp_new_i64();
- #else
+     if (a->op) {
  #define qemu_mutex_lock(m) ({                                           \
              QemuMutexLockFunc _f = atomic_read(&qemu_mutex_lock_func);  \
 --
 .20.1

Almost nothing in here is arm-related, but the target-arm
queue was convenient for these last minute bits and pieces
for 5.0...

thanks
-- PMM

The following changes since commit 14e5526b51910efd62cd31cd95b49baca975c83f:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2020-04-13 15:42:51 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200414

for you to fetch changes up to 84f82ddcbb4ac4ed04c8675e85155329f23184f0:

Deprecate KVM support for AArch32 (2020-04-14 17:20:22 +0100)

----------------------------------------------------------------
patch queue:
 * Fix some problems that trip up Coverity's scanner
 * run-coverity-scan: New script automating the scan-and-upload process
 * docs: Improve our gdbstub documentation
 * configure: Honour --disable-werror for Sphinx
 * docs: Fix errors produced when building with Sphinx 3.0
 * docs: Require Sphinx 1.6 or better
 * Add deprecation notice for KVM support on AArch32 hosts

----------------------------------------------------------------
Peter Maydell (12):
      osdep.h: Drop no-longer-needed Coverity workarounds
      thread.h: Fix Coverity version of qemu_cond_timedwait()
      thread.h: Remove trailing semicolons from Coverity qemu_mutex_lock() etc
      linux-user/flatload.c: Use "" for include of QEMU header target_flat.h
      scripts/run-coverity-scan: Script to run Coverity Scan build
      scripts/coverity-scan: Add Docker support
      docs: Improve our gdbstub documentation
      configure: Honour --disable-werror for Sphinx
      scripts/kernel-doc: Add missing close-paren in c:function directives
      kernel-doc: Use c:struct for Sphinx 3.0 and later
      docs: Require Sphinx 1.6 or better
      Deprecate KVM support for AArch32

In commit a1a98357e3fd in 2018 we added some workarounds for Coverity
not being able to handle the _Float* types introduced by recent
glibc.  Newer versions of the Coverity scan tools have support for
these types, and will fail with errors about duplicate typedefs if we
have our workaround.  Remove our copy of the typedefs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200319193323.2038-2-peter.maydell@linaro.org
---
 include/qemu/osdep.h | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@
 #else
 #include "exec/poison.h"
 #endif
-#ifdef __COVERITY__
-/* Coverity does not like the new _Float* types that are used by
- * recent glibc, and croaks on every single file that includes
- * stdlib.h.  These typedefs are enough to please it.
- *
- * Note that these fix parse errors so they cannot be placed in
- * scripts/coverity-model.c.
- */
-typedef float _Float32;
-typedef double _Float32x;
-typedef double _Float64;
-typedef __float80 _Float64x;
-typedef __float128 _Float128;
-#endif
 
 #include "qemu/compiler.h"
 
-- 
2.20.1

For Coverity's benefit, we provide simpler versions of functions like
qemu_mutex_lock(), qemu_cond_wait() and qemu_cond_timedwait().  When
we added qemu_cond_timedwait() in commit 3dcc9c6ec4ea, a cut and
paste error meant that the Coverity version of qemu_cond_timedwait()
was using the wrong _impl function, which makes the Coverity parser
complain:

"/qemu/include/qemu/thread.h", line 159: warning #140: too many arguments in
          function call
      return qemu_cond_timedwait(cond, mutex, ms);
             ^

"/qemu/include/qemu/thread.h", line 159: warning #120: return value type does
          not match the function type
      return qemu_cond_timedwait(cond, mutex, ms);
             ^

"/qemu/include/qemu/thread.h", line 156: warning #1563: function
          "qemu_cond_timedwait" not emitted, consider modeling it or review
          parse diagnostics to improve fidelity
  static inline bool (qemu_cond_timedwait)(QemuCond *cond, QemuMutex *mutex,
                      ^

These aren't fatal, but reduce the scope of the analysis. Fix the error.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200319193323.2038-3-peter.maydell@linaro.org
---
 include/qemu/thread.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

All the Coverity-specific definitions of qemu_mutex_lock() and friends
have a trailing semicolon. This works fine almost everywhere because
of QEMU's mandatory-braces coding style and because most callsites are
simple, but target/s390x/sigp.c has a use of qemu_mutex_trylock() as
an if() statement, which makes the ';' a syntax error:
"../target/s390x/sigp.c", line 461: warning #18: expected a ")"
      if (qemu_mutex_trylock(&qemu_sigp_mutex)) {
          ^

Remove the bogus semicolons from the macro definitions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200319193323.2038-4-peter.maydell@linaro.org
---
 include/qemu/thread.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/qemu/thread.h b/include/qemu/thread.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/thread.h
+++ b/include/qemu/thread.h
@@ -XXX,XX +XXX,XX @@ extern QemuCondTimedWaitFunc qemu_cond_timedwait_func;
  * hide them.
  */
 #define qemu_mutex_lock(m)                                              \
-            qemu_mutex_lock_impl(m, __FILE__, __LINE__);
+            qemu_mutex_lock_impl(m, __FILE__, __LINE__)
 #define qemu_mutex_trylock(m)                                           \
-            qemu_mutex_trylock_impl(m, __FILE__, __LINE__);
+            qemu_mutex_trylock_impl(m, __FILE__, __LINE__)
 #define qemu_rec_mutex_lock(m)                                          \
-            qemu_rec_mutex_lock_impl(m, __FILE__, __LINE__);
+            qemu_rec_mutex_lock_impl(m, __FILE__, __LINE__)
 #define qemu_rec_mutex_trylock(m)                                       \
-            qemu_rec_mutex_trylock_impl(m, __FILE__, __LINE__);
+            qemu_rec_mutex_trylock_impl(m, __FILE__, __LINE__)
 #define qemu_cond_wait(c, m)                                            \
-            qemu_cond_wait_impl(c, m, __FILE__, __LINE__);
+            qemu_cond_wait_impl(c, m, __FILE__, __LINE__)
 #define qemu_cond_timedwait(c, m, ms)                                   \
-            qemu_cond_timedwait_impl(c, m, ms, __FILE__, __LINE__);
+            qemu_cond_timedwait_impl(c, m, ms, __FILE__, __LINE__)
 #else
 #define qemu_mutex_lock(m) ({                                           \
             QemuMutexLockFunc _f = atomic_read(&qemu_mutex_lock_func);  \
-- 
2.20.1

Add a new script to automate the process of running the Coverity
Scan build tools and uploading the resulting tarball to the
website.

This is intended eventually to be driven from Travis,
but it can be run locally, if you are a maintainer of the
QEMU project on the Coverity Scan website and have the secret
upload token.

The script must be run on a Fedora 30 system.  Support for using a
Docker container is added in a following commit.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200319193323.2038-6-peter.maydell@linaro.org
---
 MAINTAINERS                             |   5 +
 scripts/coverity-scan/run-coverity-scan | 311 ++++++++++++++++++++++++
 2 files changed, 316 insertions(+)
 create mode 100755 scripts/coverity-scan/run-coverity-scan

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Markus Armbruster <armbru@redhat.com>
 S: Supported
 F: scripts/coverity-model.c
 
+Coverity Scan integration
+M: Peter Maydell <peter.maydell@linaro.org>
+S: Maintained
+F: scripts/coverity-scan/
+
 Device Tree
 M: Alistair Francis <alistair.francis@wdc.com>
 R: David Gibson <david@gibson.dropbear.id.au>
diff --git a/scripts/coverity-scan/run-coverity-scan b/scripts/coverity-scan/run-coverity-scan
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/scripts/coverity-scan/run-coverity-scan
@@ -XXX,XX +XXX,XX @@
+#!/bin/sh -e
+
+# Upload a created tarball to Coverity Scan, as per
+# https://scan.coverity.com/projects/qemu/builds/new
+
+# This work is licensed under the terms of the GNU GPL version 2,
+# or (at your option) any later version.
+# See the COPYING file in the top-level directory.
+#
+# Copyright (c) 2017-2020 Linaro Limited
+# Written by Peter Maydell
+
+# Note that this script will automatically download and
+# run the (closed-source) coverity build tools, so don't
+# use it if you don't trust them!
+
+# This script assumes that you're running it from a QEMU source
+# tree, and that tree is a fresh clean one, because we do an in-tree
+# build. (This is necessary so that the filenames that the Coverity
+# Scan server sees are relative paths that match up with the component
+# regular expressions it uses; an out-of-tree build won't work for this.)
+# The host machine should have as many of QEMU's dependencies
+# installed as possible, for maximum coverity coverage.
+
+# To do an upload you need to be a maintainer in the Coverity online
+# service, and you will need to know the "Coverity token", which is a
+# secret 8 digit hex string. You can find that from the web UI in the
+# project settings, if you have maintainer access there.
+
+# Command line options:
+#   --dry-run : run the tools, but don't actually do the upload
+#   --update-tools-only : update the cached copy of the tools, but don't run them
+#   --tokenfile : file to read Coverity token from
+#   --version ver : specify version being analyzed (default: ask git)
+#   --description desc : specify description of this version (default: ask git)
+#   --srcdir : QEMU source tree to analyze (default: current working dir)
+#   --results-tarball : path to copy the results tarball to (default: don't
+#                       copy it anywhere, just upload it)
+#
+# User-specifiable environment variables:
+#  COVERITY_TOKEN -- Coverity token
+#  COVERITY_EMAIL -- the email address to use for uploads (default:
+#                    looks at your git user.email config)
+#  COVERITY_BUILD_CMD -- make command (default: 'make -jN' where N is
+#                    number of CPUs as determined by 'nproc')
+#  COVERITY_TOOL_BASE -- set to directory to put coverity tools
+#                        (default: /tmp/coverity-tools)
+#
+# You must specify the token, either by environment variable or by
+# putting it in a file and using --tokenfile. Everything else has
+# a reasonable default if this is run from a git tree.
+
+check_upload_permissions() {
+    # Check whether we can do an upload to the server; will exit the script
+    # with status 1 if the check failed (usually a bad token);
+    # will exit the script with status 0 if the check indicated that we
+    # can't upload yet (ie we are at quota)
+    # Assumes that PROJTOKEN, PROJNAME and DRYRUN have been initialized.
+
+    echo "Checking upload permissions..."
+
+    if ! up_perm="$(wget https://scan.coverity.com/api/upload_permitted --post-data "token=$PROJTOKEN&project=$PROJNAME" -q -O -)"; then
+        echo "Coverity Scan API access denied: bad token?"
+        exit 1
+    fi
+
+    # Really up_perm is a JSON response with either
+    # {upload_permitted:true} or {next_upload_permitted_at:<date>}
+    # We do some hacky string parsing instead of properly parsing it.
+    case "$up_perm" in
+        *upload_permitted*true*)
+            echo "Coverity Scan: upload permitted"
+            ;;
+        *next_upload_permitted_at*)
+            if [ "$DRYRUN" = yes ]; then
+                echo "Coverity Scan: upload quota reached, continuing dry run"
+            else
+                echo "Coverity Scan: upload quota reached; stopping here"
+                # Exit success as this isn't a build error.
+                exit 0
+            fi
+            ;;
+        *)
+            echo "Coverity Scan upload check: unexpected result $up_perm"
+            exit 1
+            ;;
+    esac
+}
+
+
+update_coverity_tools () {
+    # Check for whether we need to download the Coverity tools
+    # (either because we don't have a copy, or because it's out of date)
+    # Assumes that COVERITY_TOOL_BASE, PROJTOKEN and PROJNAME are set.
+
+    mkdir -p "$COVERITY_TOOL_BASE"
+    cd "$COVERITY_TOOL_BASE"
+
+    echo "Checking for new version of coverity build tools..."
+    wget https://scan.coverity.com/download/linux64 --post-data "token=$PROJTOKEN&project=$PROJNAME&md5=1" -O coverity_tool.md5.new
+
+    if ! cmp -s coverity_tool.md5 coverity_tool.md5.new; then
+        # out of date md5 or no md5: download new build tool
+        # blow away the old build tool
+        echo "Downloading coverity build tools..."
+        rm -rf coverity_tool coverity_tool.tgz
+        wget https://scan.coverity.com/download/linux64 --post-data "token=$PROJTOKEN&project=$PROJNAME" -O coverity_tool.tgz
+        if ! (cat coverity_tool.md5.new; echo "  coverity_tool.tgz") | md5sum -c --status; then
+            echo "Downloaded tarball didn't match md5sum!"
+            exit 1
+        fi
+        # extract the new one, keeping it corralled in a 'coverity_tool' directory
+        echo "Unpacking coverity build tools..."
+        mkdir -p coverity_tool
+        cd coverity_tool
+        tar xf ../coverity_tool.tgz
+        cd ..
+        mv coverity_tool.md5.new coverity_tool.md5
+    fi
+
+    rm -f coverity_tool.md5.new
+}
+
+
+# Check user-provided environment variables and arguments
+DRYRUN=no
+UPDATE_ONLY=no
+
+while [ "$#" -ge 1 ]; do
+    case "$1" in
+        --dry-run)
+            shift
+            DRYRUN=yes
+            ;;
+        --update-tools-only)
+            shift
+            UPDATE_ONLY=yes
+            ;;
+        --version)
+            shift
+            if [ $# -eq 0 ]; then
+                echo "--version needs an argument"
+                exit 1
+            fi
+            VERSION="$1"
+            shift
+            ;;
+        --description)
+            shift
+            if [ $# -eq 0 ]; then
+                echo "--description needs an argument"
+                exit 1
+            fi
+            DESCRIPTION="$1"
+            shift
+            ;;
+        --tokenfile)
+            shift
+            if [ $# -eq 0 ]; then
+                echo "--tokenfile needs an argument"
+                exit 1
+            fi
+            COVERITY_TOKEN="$(cat "$1")"
+            shift
+            ;;
+        --srcdir)
+            shift
+            if [ $# -eq 0 ]; then
+                echo "--srcdir needs an argument"
+                exit 1
+            fi
+            SRCDIR="$1"
+            shift
+            ;;
+        --results-tarball)
+            shift
+            if [ $# -eq 0 ]; then
+                echo "--results-tarball needs an argument"
+                exit 1
+            fi
+            RESULTSTARBALL="$1"
+            shift
+            ;;
+        *)
+            echo "Unexpected argument '$1'"
+            exit 1
+            ;;
+    esac
+done
+
+if [ -z "$COVERITY_TOKEN" ]; then
+    echo "COVERITY_TOKEN environment variable not set"
+    exit 1
+fi
+
+if [ -z "$COVERITY_BUILD_CMD" ]; then
+    NPROC=$(nproc)
+    COVERITY_BUILD_CMD="make -j$NPROC"
+    echo "COVERITY_BUILD_CMD: using default '$COVERITY_BUILD_CMD'"
+fi
+
+if [ -z "$COVERITY_TOOL_BASE" ]; then
+    echo "COVERITY_TOOL_BASE: using default /tmp/coverity-tools"
+    COVERITY_TOOL_BASE=/tmp/coverity-tools
+fi
+
+if [ -z "$SRCDIR" ]; then
+    SRCDIR="$PWD"
+fi
+
+PROJTOKEN="$COVERITY_TOKEN"
+PROJNAME=QEMU
+TARBALL=cov-int.tar.xz
+
+
+if [ "$UPDATE_ONLY" = yes ]; then
+    # Just do the tools update; we don't need to check whether
+    # we are in a source tree or have upload rights for this,
+    # so do it before some of the command line and source tree checks.
+    update_coverity_tools
+    exit 0
+fi
+
+cd "$SRCDIR"
+
+echo "Checking this is a QEMU source tree..."
+if ! [ -e "$SRCDIR/VERSION" ]; then
+    echo "Not in a QEMU source tree?"
+    exit 1
+fi
+
+# Fill in defaults used by the non-update-only process
+if [ -z "$VERSION" ]; then
+    VERSION="$(git describe --always HEAD)"
+fi
+
+if [ -z "$DESCRIPTION" ]; then
+    DESCRIPTION="$(git rev-parse HEAD)"
+fi
+
+if [ -z "$COVERITY_EMAIL" ]; then
+    COVERITY_EMAIL="$(git config user.email)"
+fi
+
+check_upload_permissions
+
+update_coverity_tools
+
+TOOLBIN="$(cd "$COVERITY_TOOL_BASE" && echo $PWD/coverity_tool/cov-analysis-*/bin)"
+
+if ! test -x "$TOOLBIN/cov-build"; then
+    echo "Couldn't find cov-build in the coverity build-tool directory??"
+    exit 1
+fi
+
+export PATH="$TOOLBIN:$PATH"
+
+cd "$SRCDIR"
+
+echo "Doing make distclean..."
+make distclean
+
+echo "Configuring..."
+# We configure with a fixed set of enables here to ensure that we don't
+# accidentally reduce the scope of the analysis by doing the build on
+# the system that's missing a dependency that we need to build part of
+# the codebase.
+./configure --disable-modules --enable-sdl --enable-gtk \
+    --enable-opengl --enable-vte --enable-gnutls \
+    --enable-nettle --enable-curses --enable-curl \
+    --audio-drv-list=oss,alsa,sdl,pa --enable-virtfs \
+    --enable-vnc --enable-vnc-sasl --enable-vnc-jpeg --enable-vnc-png \
+    --enable-xen --enable-brlapi \
+    --enable-linux-aio --enable-attr \
+    --enable-cap-ng --enable-trace-backends=log --enable-spice --enable-rbd \
+    --enable-xfsctl --enable-libusb --enable-usb-redir \
+    --enable-libiscsi --enable-libnfs --enable-seccomp \
+    --enable-tpm --enable-libssh --enable-lzo --enable-snappy --enable-bzip2 \
+    --enable-numa --enable-rdma --enable-smartcard --enable-virglrenderer \
+    --enable-mpath --enable-libxml2 --enable-glusterfs \
+    --enable-virtfs --enable-zstd
+
+echo "Making libqemustub.a..."
+make libqemustub.a
+
+echo "Running cov-build..."
+rm -rf cov-int
+mkdir cov-int
+cov-build --dir cov-int $COVERITY_BUILD_CMD
+
+echo "Creating results tarball..."
+tar cvf - cov-int | xz > "$TARBALL"
+
+if [ ! -z "$RESULTSTARBALL" ]; then
+    echo "Copying results tarball to $RESULTSTARBALL..."
+    cp "$TARBALL" "$RESULTSTARBALL"
+fi
+
+echo "Uploading results tarball..."
+
+if [ "$DRYRUN" = yes ]; then
+    echo "Dry run only, not uploading $TARBALL"
+    exit 0
+fi
+
+curl --form token="$PROJTOKEN" --form email="$COVERITY_EMAIL" \
+     --form file=@"$TARBALL" --form version="$VERSION" \
+     --form description="$DESCRIPTION" \
+     https://scan.coverity.com/builds?project="$PROJNAME"
+
+echo "Done."
-- 
2.20.1

Add support for running the Coverity Scan tools inside a Docker
container rather than directly on the host system.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200319193323.2038-7-peter.maydell@linaro.org
---
 scripts/coverity-scan/coverity-scan.docker | 131 +++++++++++++++++++++
 scripts/coverity-scan/run-coverity-scan    |  90 ++++++++++++++
 2 files changed, 221 insertions(+)
 create mode 100644 scripts/coverity-scan/coverity-scan.docker

diff --git a/scripts/coverity-scan/coverity-scan.docker b/scripts/coverity-scan/coverity-scan.docker
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/scripts/coverity-scan/coverity-scan.docker
@@ -XXX,XX +XXX,XX @@
+# syntax=docker/dockerfile:1.0.0-experimental
+#
+# Docker setup for running the "Coverity Scan" tools over the source
+# tree and uploading them to the website, as per
+# https://scan.coverity.com/projects/qemu/builds/new
+# We do this on a fixed config (currently Fedora 30 with a known
+# set of dependencies and a configure command that enables a specific
+# set of options) so that random changes don't result in our accidentally
+# dropping some files from the scan.
+#
+# We don't build on top of the fedora.docker file because we don't
+# want to accidentally change or break the scan config when that
+# is updated.
+
+# The work of actually doing the build is handled by the
+# run-coverity-scan script.
+
+FROM fedora:30
+ENV PACKAGES \
+    alsa-lib-devel \
+    bc \
+    bison \
+    brlapi-devel \
+    bzip2 \
+    bzip2-devel \
+    ccache \
+    clang \
+    curl \
+    cyrus-sasl-devel \
+    dbus-daemon \
+    device-mapper-multipath-devel \
+    findutils \
+    flex \
+    gcc \
+    gcc-c++ \
+    gettext \
+    git \
+    glib2-devel \
+    glusterfs-api-devel \
+    gnutls-devel \
+    gtk3-devel \
+    hostname \
+    libaio-devel \
+    libasan \
+    libattr-devel \
+    libblockdev-mpath-devel \
+    libcap-devel \
+    libcap-ng-devel \
+    libcurl-devel \
+    libepoxy-devel \
+    libfdt-devel \
+    libgbm-devel \
+    libiscsi-devel \
+    libjpeg-devel \
+    libpmem-devel \
+    libnfs-devel \
+    libpng-devel \
+    librbd-devel \
+    libseccomp-devel \
+    libssh-devel \
+    libubsan \
+    libudev-devel \
+    libusbx-devel \
+    libxml2-devel \
+    libzstd-devel \
+    llvm \
+    lzo-devel \
+    make \
+    mingw32-bzip2 \
+    mingw32-curl \
+    mingw32-glib2 \
+    mingw32-gmp \
+    mingw32-gnutls \
+    mingw32-gtk3 \
+    mingw32-libjpeg-turbo \
+    mingw32-libpng \
+    mingw32-libtasn1 \
+    mingw32-nettle \
+    mingw32-nsis \
+    mingw32-pixman \
+    mingw32-pkg-config \
+    mingw32-SDL2 \
+    mingw64-bzip2 \
+    mingw64-curl \
+    mingw64-glib2 \
+    mingw64-gmp \
+    mingw64-gnutls \
+    mingw64-gtk3 \
+    mingw64-libjpeg-turbo \
+    mingw64-libpng \
+    mingw64-libtasn1 \
+    mingw64-nettle \
+    mingw64-pixman \
+    mingw64-pkg-config \
+    mingw64-SDL2 \
+    ncurses-devel \
+    nettle-devel \
+    nss-devel \
+    numactl-devel \
+    perl \
+    perl-Test-Harness \
+    pixman-devel \
+    pulseaudio-libs-devel \
+    python3 \
+    python3-sphinx \
+    PyYAML \
+    rdma-core-devel \
+    SDL2-devel \
+    snappy-devel \
+    sparse \
+    spice-server-devel \
+    systemd-devel \
+    systemtap-sdt-devel \
+    tar \
+    texinfo \
+    usbredir-devel \
+    virglrenderer-devel \
+    vte291-devel \
+    wget \
+    which \
+    xen-devel \
+    xfsprogs-devel \
+    zlib-devel
+ENV QEMU_CONFIGURE_OPTS --python=/usr/bin/python3
+
+RUN dnf install -y $PACKAGES
+RUN rpm -q $PACKAGES | sort > /packages.txt
+ENV PATH $PATH:/usr/libexec/python3-sphinx/
+ENV COVERITY_TOOL_BASE=/coverity-tools
+COPY run-coverity-scan run-coverity-scan
+RUN --mount=type=secret,id=coverity.token,required ./run-coverity-scan --update-tools-only --tokenfile /run/secrets/coverity.token
diff --git a/scripts/coverity-scan/run-coverity-scan b/scripts/coverity-scan/run-coverity-scan
index XXXXXXX..XXXXXXX 100755
--- a/scripts/coverity-scan/run-coverity-scan
+++ b/scripts/coverity-scan/run-coverity-scan
@@ -XXX,XX +XXX,XX @@
 
 # Command line options:
 #   --dry-run : run the tools, but don't actually do the upload
+#   --docker : create and work inside a docker container
 #   --update-tools-only : update the cached copy of the tools, but don't run them
 #   --tokenfile : file to read Coverity token from
 #   --version ver : specify version being analyzed (default: ask git)
@@ -XXX,XX +XXX,XX @@
 #   --srcdir : QEMU source tree to analyze (default: current working dir)
 #   --results-tarball : path to copy the results tarball to (default: don't
 #                       copy it anywhere, just upload it)
+#   --src-tarball : tarball to untar into src dir (default: none); this
+#                   is intended mainly for internal use by the Docker support
 #
 # User-specifiable environment variables:
 #  COVERITY_TOKEN -- Coverity token
@@ -XXX,XX +XXX,XX @@ update_coverity_tools () {
 # Check user-provided environment variables and arguments
 DRYRUN=no
 UPDATE_ONLY=no
+DOCKER=no
 
 while [ "$#" -ge 1 ]; do
     case "$1" in
@@ -XXX,XX +XXX,XX @@ while [ "$#" -ge 1 ]; do
             RESULTSTARBALL="$1"
             shift
             ;;
+        --src-tarball)
+            shift
+            if [ $# -eq 0 ]; then
+                echo "--src-tarball needs an argument"
+                exit 1
+            fi
+            SRCTARBALL="$1"
+            shift
+            ;;
+        --docker)
+            DOCKER=yes
+            shift
+            ;;
         *)
             echo "Unexpected argument '$1'"
             exit 1
@@ -XXX,XX +XXX,XX @@ PROJTOKEN="$COVERITY_TOKEN"
 PROJNAME=QEMU
 TARBALL=cov-int.tar.xz
 
+if [ "$UPDATE_ONLY" = yes ] && [ "$DOCKER" = yes ]; then
+    echo "Combining --docker and --update-only is not supported"
+    exit 1
+fi
 
 if [ "$UPDATE_ONLY" = yes ]; then
     # Just do the tools update; we don't need to check whether
@@ -XXX,XX +XXX,XX @@ if [ "$UPDATE_ONLY" = yes ]; then
     exit 0
 fi
 
+if [ ! -e "$SRCDIR" ]; then
+    mkdir "$SRCDIR"
+fi
+
 cd "$SRCDIR"
 
+if [ ! -z "$SRCTARBALL" ]; then
+    echo "Untarring source tarball into $SRCDIR..."
+    tar xvf "$SRCTARBALL"
+fi
+
 echo "Checking this is a QEMU source tree..."
 if ! [ -e "$SRCDIR/VERSION" ]; then
     echo "Not in a QEMU source tree?"
@@ -XXX,XX +XXX,XX @@ if [ -z "$COVERITY_EMAIL" ]; then
     COVERITY_EMAIL="$(git config user.email)"
 fi
 
+# Run ourselves inside docker if that's what the user wants
+if [ "$DOCKER" = yes ]; then
+    # build docker container including the coverity-scan tools
+    # Put the Coverity token into a temporary file that only
+    # we have read access to, and then pass it to docker build
+    # using --secret. This requires at least Docker 18.09.
+    # Mostly what we are trying to do here is ensure we don't leak
+    # the token into the Docker image.
+    umask 077
+    SECRETDIR=$(mktemp -d)
+    if [ -z "$SECRETDIR" ]; then
+        echo "Failed to create temporary directory"
+        exit 1
+    fi
+    trap 'rm -rf "$SECRETDIR"' INT TERM EXIT
+    echo "Created temporary directory $SECRETDIR"
+    SECRET="$SECRETDIR/token"
+    echo "$COVERITY_TOKEN" > "$SECRET"
+    echo "Building docker container..."
+    # TODO: This re-downloads the tools every time, rather than
+    # caching and reusing the image produced with the downloaded tools.
+    # Not sure why.
+    # TODO: how do you get 'docker build' to print the output of the
+    # commands it is running to its stdout? This would be useful for debug.
+    DOCKER_BUILDKIT=1 docker build -t coverity-scanner \
+                   --secret id=coverity.token,src="$SECRET" \
+                   -f scripts/coverity-scan/coverity-scan.docker \
+                   scripts/coverity-scan
+    echo "Archiving sources to be analyzed..."
+    ./scripts/archive-source.sh "$SECRETDIR/qemu-sources.tgz"
+    if [ "$DRYRUN" = yes ]; then
+        DRYRUNARG=--dry-run
+    fi
+    echo "Running scanner..."
+    # If we need to capture the output tarball, get the inner run to
+    # save it to the secrets directory so we can copy it out before the
+    # directory is cleaned up.
+    if [ ! -z "$RESULTSTARBALL" ]; then
+        RTARGS="--results-tarball /work/cov-int.tar.xz"
+    else
+        RTARGS=""
+    fi
+    # Arrange for this docker run to get access to the sources with -v.
+    # We pass through all the configuration from the outer script to the inner.
+    export COVERITY_EMAIL COVERITY_BUILD_CMD
+    docker run -it --env COVERITY_EMAIL --env COVERITY_BUILD_CMD \
+           -v "$SECRETDIR:/work" coverity-scanner \
+           ./run-coverity-scan --version "$VERSION" \
+           --description "$DESCRIPTION" $DRYRUNARG --tokenfile /work/token \
+           --srcdir /qemu --src-tarball /work/qemu-sources.tgz $RTARGS
+    if [ ! -z "$RESULTSTARBALL" ]; then
+        echo "Copying results tarball to $RESULTSTARBALL..."
+        cp "$SECRETDIR/cov-int.tar.xz" "$RESULTSTARBALL"
+    fi
+    echo "Docker work complete."
+    exit 0
+fi
+
+# Otherwise, continue with the full build and upload process.
+
 check_upload_permissions
 
 update_coverity_tools
-- 
2.20.1

The documentation of our -s and -gdb options is quite old; in
particular it still claims that it will cause QEMU to stop and wait
for the gdb connection, when this has not been true for some time:
you also need to pass -S if you want to make QEMU not launch the
guest on startup.

Improve the documentation to mention this requirement in the
executable's --help output, the documentation of the -gdb option in
the manual, and in the "GDB usage" chapter.

Includes some minor tweaks to these paragraphs of documentation
since I was editing them anyway (such as dropping the description
of our gdb support as "primitive").

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20200403094014.9589-1-peter.maydell@linaro.org
---
 docs/system/gdb.rst | 22 +++++++++++++++-------
 qemu-options.hx     | 24 ++++++++++++++++++------
 2 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/docs/system/gdb.rst b/docs/system/gdb.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/gdb.rst
+++ b/docs/system/gdb.rst
@@ -XXX,XX +XXX,XX @@
 GDB usage
 ---------
 
-QEMU has a primitive support to work with gdb, so that you can do
-'Ctrl-C' while the virtual machine is running and inspect its state.
+QEMU supports working with gdb via gdb's remote-connection facility
+(the "gdbstub"). This allows you to debug guest code in the same
+way that you might with a low-level debug facility like JTAG
+on real hardware. You can stop and start the virtual machine,
+examine state like registers and memory, and set breakpoints and
+watchpoints.
 
-In order to use gdb, launch QEMU with the '-s' option. It will wait for
-a gdb connection:
+In order to use gdb, launch QEMU with the ``-s`` and ``-S`` options.
+The ``-s`` option will make QEMU listen for an incoming connection
+from gdb on TCP port 1234, and ``-S`` will make QEMU not start the
+guest until you tell it to from gdb. (If you want to specify which
+TCP port to use or to use something other than TCP for the gdbstub
+connection, use the ``-gdb dev`` option instead of ``-s``.)
 
 .. parsed-literal::
 
-   |qemu_system| -s -kernel bzImage -hda rootdisk.img -append "root=/dev/hda"
-   Connected to host network interface: tun0
-   Waiting gdb connection on port 1234
+   |qemu_system| -s -S -kernel bzImage -hda rootdisk.img -append "root=/dev/hda"
+
+QEMU will launch but will silently wait for gdb to connect.
 
 Then launch gdb on the 'vmlinux' executable::
 
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
 ERST
 
 DEF("gdb", HAS_ARG, QEMU_OPTION_gdb, \
-    "-gdb dev        wait for gdb connection on 'dev'\n", QEMU_ARCH_ALL)
+    "-gdb dev        accept gdb connection on 'dev'. (QEMU defaults to starting\n"
+    "                the guest without waiting for gdb to connect; use -S too\n"
+    "                if you want it to not start execution.)\n",
+    QEMU_ARCH_ALL)
 SRST
 ``-gdb dev``
-    Wait for gdb connection on device dev (see
-    :ref:`gdb_005fusage`). Typical connections will likely be
-    TCP-based, but also UDP, pseudo TTY, or even stdio are reasonable
-    use case. The latter is allowing to start QEMU from within gdb and
-    establish the connection via a pipe:
+    Accept a gdb connection on device dev (see
+    :ref:`gdb_005fusage`). Note that this option does not pause QEMU
+    execution -- if you want QEMU to not start the guest until you
+    connect with gdb and issue a ``continue`` command, you will need to
+    also pass the ``-S`` option to QEMU.
+
+    The most usual configuration is to listen on a local TCP socket::
+
+        -gdb tcp::3117
+
+    but you can specify other backends; UDP, pseudo TTY, or even stdio
+    are all reasonable use cases. For example, a stdio connection
+    allows you to start QEMU from within gdb and establish the
+    connection via a pipe:
 
     .. parsed-literal::
 
-- 
2.20.1

If we are not making warnings fatal for compilation, make them
non-fatal when building the Sphinx documentation also.  (For instance
Sphinx 3.0 warns about some constructs that older versions were happy
with, which is a build failure if we use the warnings-as-errors
flag.)

This provides a workaround at least for LP:1872113.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200411182934.28678-2-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 configure | 9 ++++++++-
 Makefile  | 2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if check_include sys/kcov.h ; then
     kcov=yes
 fi
 
+# If we're making warnings fatal, apply this to Sphinx runs as well
+sphinx_werror=""
+if test "$werror" = "yes"; then
+    sphinx_werror="-W"
+fi
+
 # Check we have a new enough version of sphinx-build
 has_sphinx_build() {
     # This is a bit awkward but works: create a trivial document and
@@ -XXX,XX +XXX,XX @@ has_sphinx_build() {
     # sphinx-build doesn't exist at all or if it is too old.
     mkdir -p "$TMPDIR1/sphinx"
     touch "$TMPDIR1/sphinx/index.rst"
-    "$sphinx_build" -c "$source_path/docs" -b html "$TMPDIR1/sphinx" "$TMPDIR1/sphinx/out" >/dev/null 2>&1
+    "$sphinx_build" $sphinx_werror -c "$source_path/docs" -b html "$TMPDIR1/sphinx" "$TMPDIR1/sphinx/out" >/dev/null 2>&1
 }
 
 # Check if tools are available to build documentation.
@@ -XXX,XX +XXX,XX @@ echo "INSTALL_PROG=$install -c -m 0755" >> $config_host_mak
 echo "INSTALL_LIB=$install -c -m 0644" >> $config_host_mak
 echo "PYTHON=$python" >> $config_host_mak
 echo "SPHINX_BUILD=$sphinx_build" >> $config_host_mak
+echo "SPHINX_WERROR=$sphinx_werror" >> $config_host_mak
 echo "GENISOIMAGE=$genisoimage" >> $config_host_mak
 echo "CC=$cc" >> $config_host_mak
 if $iasl -h > /dev/null 2>&1; then
diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html \
 # Note the use of different doctree for each (manual, builder) tuple;
 # this works around Sphinx not handling parallel invocation on
 # a single doctree: https://github.com/sphinx-doc/sphinx/issues/2946
-build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" $(SPHINX_BUILD) $(if $(V),,-q) -W -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
+build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" $(SPHINX_BUILD) $(if $(V),,-q) $(SPHINX_WERROR) -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1-$2 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
 # We assume all RST files in the manual's directory are used in it
 manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst $(SRC_PATH)/docs/$1/*/*.rst) \
               $(SRC_PATH)/docs/defs.rst.inc \
-- 
2.20.1

When kernel-doc generates a 'c:function' directive for a function
one of whose arguments is a function pointer, it fails to print
the close-paren after the argument list of the function pointer
argument, for instance in the memory API documentation:
  .. c:function:: void memory_region_init_resizeable_ram (MemoryRegion * mr, struct Object * owner, const char * name, uint64_t size, uint64_t max_size, void (*resized) (const char*, uint64_t length, void *host, Error ** errp)

which should have a ')' after the 'void *host' which is the
last argument to 'resized'.

Older versions of Sphinx don't try to parse the argumnet
to c:function, but Sphinx 3.0 does do this and will complain:

/home/petmay01/linaro/qemu-from-laptop/qemu/docs/../include/exec/memory.h:834: WARNING: Error in declarator or parameters
  Invalid C declaration: Expecting "," or ")" in parameters, got "EOF". [error at 208]
    void memory_region_init_resizeable_ram (MemoryRegion * mr, struct Object * owner, const char * name, uint64_t size, uint64_t max_size, void (*resized) (const char*, uint64_t length, void *host, Error ** errp)
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------^

Add the missing close-paren.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200411182934.28678-3-peter.maydell@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 scripts/kernel-doc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index XXXXXXX..XXXXXXX 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -XXX,XX +XXX,XX @@ sub output_function_rst(%) {
 
 	if ($type =~ m/([^$]*\(\*)\s*$\s*$([^$]*)\)/) {
 	    # pointer-to-function
-	    print $1 . $parameter . ") (" . $2;
+	    print $1 . $parameter . ") (" . $2 . ")";
 	} else {
 	    print $type . " " . $parameter;
 	}
-- 
2.20.1

The kernel-doc Sphinx plugin and associated script currently emit
'c:type' directives for "struct foo" documentation.

Sphinx 3.0 warns about this:
  /home/petmay01/linaro/qemu-from-laptop/qemu/docs/../include/exec/memory.h:3: WARNING: Type must be either just a name or a typedef-like declaration.
  If just a name:
    Error in declarator or parameters
    Invalid C declaration: Expected identifier in nested name, got keyword: struct [error at 6]
      struct MemoryListener
      ------^
  If typedef-like declaration:
    Error in declarator or parameters
    Invalid C declaration: Expected identifier in nested name. [error at 21]
      struct MemoryListener
      ---------------------^

because it wants us to use the new-in-3.0 'c:struct' instead.

Plumb the Sphinx version through to the kernel-doc script
and use it to select 'c:struct' for newer versions than 3.0.

Fixes: LP:1872113
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/sphinx/kerneldoc.py |  1 +
 scripts/kernel-doc       | 16 +++++++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/docs/sphinx/kerneldoc.py b/docs/sphinx/kerneldoc.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/sphinx/kerneldoc.py
+++ b/docs/sphinx/kerneldoc.py
@@ -XXX,XX +XXX,XX @@ class KernelDocDirective(Directive):
                 env.note_dependency(os.path.abspath(f))
                 cmd += ['-export-file', f]
 
+        cmd += ['-sphinx-version', sphinx.__version__]
         cmd += [filename]
 
         try:
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index XXXXXXX..XXXXXXX 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -XXX,XX +XXX,XX @@ Output selection (mutually exclusive):
 			DOC: sections. May be specified multiple times.
 
 Output selection modifiers:
+  -sphinx-version VER   Generate rST syntax for the specified Sphinx version.
+                        Only works with reStructuredTextFormat.
   -no-doc-sections	Do not output DOC: sections.
   -enable-lineno        Enable output of #define LINENO lines. Only works with
                         reStructuredText format.
@@ -XXX,XX +XXX,XX @@ use constant {
 };
 my $output_selection = OUTPUT_ALL;
 my $show_not_found = 0;	# No longer used
+my $sphinx_version = "0.0"; # if not specified, assume old
 
 my @export_file_list;
 
@@ -XXX,XX +XXX,XX @@ while ($ARGV[0] =~ m/^--?(.*)/) {
 	    $enable_lineno = 1;
     } elsif ($cmd eq 'show-not-found') {
 	$show_not_found = 1;  # A no-op but don't fail
+    } elsif ($cmd eq 'sphinx-version') {
+        $sphinx_version = shift @ARGV;
     } else {
 	# Unknown argument
         usage();
@@ -XXX,XX +XXX,XX @@ sub output_struct_rst(%) {
     my $oldprefix = $lineprefix;
     my $name = $args{'type'} . " " . $args{'struct'};
 
-    print "\n\n.. c:type:: " . $name . "\n\n";
+    # Sphinx 3.0 and up will emit warnings for "c:type:: struct Foo".
+    # It wants to see "c:struct:: Foo" (and will add the word 'struct' in
+    # the rendered output).
+    if ((split(/\./, $sphinx_version))[0] >= 3) {
+        my $sname = $name;
+        $sname =~ s/^struct //;
+        print "\n\n.. c:struct:: " . $sname . "\n\n";
+    } else {
+        print "\n\n.. c:type:: " . $name . "\n\n";
+    }
     print_lineno($declaration_start_line);
     $lineprefix = "   ";
     output_highlight_rst($args{'purpose'});
-- 
2.20.1

Versions of Sphinx older than 1.6 can't build all of our documentation,
because they are too picky about the syntax of the argument to the
option:: directive; see Sphinx bugs #646, #3366:

https://github.com/sphinx-doc/sphinx/issues/646
  https://github.com/sphinx-doc/sphinx/issues/3366

Trying to build with a 1.4.x Sphinx fails with
 docs/system/images.rst:4: SEVERE: Duplicate ID: "cmdoption-qcow2-arg-encrypt"
and a 1.5.x Sphinx fails with
 docs/system/invocation.rst:544: WARNING: Malformed option description '[enable=]PATTERN', should look like "opt", "-opt
args", "--opt args", "/opt args" or "+opt args"

Update our needs_sphinx setting to indicate that we require at least
1.6.  This will allow configure to fall back to "don't build the
docs" rather than causing the build to fail entirely, which is
probably what most users building on a host old enough to have such
an old Sphinx would want; if they do want the docs then they'll have
a useful indication of what they need to do (upgrade Sphinx!) rather
than a confusing error message.

In theory our distro support policy would suggest that we should
support building on the Sphinx shipped in those distros, but:
 * EPEL7 has Sphinx 1.2.3 (which we've never supported!)
 * Debian Stretch has Sphinx 1.4.8

Trying to get our docs to work with Sphinx 1.4 is not tractable
for the 5.0 release and I'm not sure it's worthwhile effort anyway;
at least with this change the build as a whole now succeeds.

Thanks to John Snow for doing the investigation and testing to
confirm what Sphinx versions fail in what ways and what distros
shipped what.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/conf.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@ sys.path.insert(0, os.path.join(qemu_docdir, "sphinx"))
 
 # If your documentation needs a minimal Sphinx version, state it here.
 #
-# 1.3 is where the 'alabaster' theme was shipped with Sphinx.
-needs_sphinx = '1.3'
+# Sphinx 1.5 and earlier can't build our docs because they are too
+# picky about the syntax of the argument to the option:: directive
+# (see Sphinx bugs #646, #3366).
+needs_sphinx = '1.6'
 
 # Add any Sphinx extension module names here, as strings. They can be
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
-- 
2.20.1

The Linux kernel has dropped support for allowing 32-bit Arm systems
to host KVM guests (kernel commit 541ad0150ca4aa663a2, which just
landed upstream in the 5.7 merge window).  Mark QEMU's support for
this configuration as deprecated, so that we can delete that support
code in 5.2.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
---
 docs/system/deprecated.rst | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ The ``compat`` property used to set backwards compatibility modes for
 the processor has been deprecated. The ``max-cpu-compat`` property of
 the ``pseries`` machine type should be used instead.
 
+KVM guest support on 32-bit Arm hosts (since 5.0)
+'''''''''''''''''''''''''''''''''''''''''''''''''
+
+The Linux kernel has dropped support for allowing 32-bit Arm systems
+to host KVM guests as of the 5.7 kernel. Accordingly, QEMU is deprecating
+its support for this configuration and will remove it in a future version.
+Running 32-bit guests on a 64-bit Arm host remains supported.
+
 System emulator devices
 -----------------------
 
-- 
2.20.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1