Series comparison

 [PULL 0/9] target-arm queue
-Arm queue; bugfixes only.
+A last lot of bug fixes before rc0...
 thanks
 -- PMM
-The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
+The following changes since commit 0d0275c31f00b71b49eb80bbdca2cfe244cf80fb:
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
+  Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2022-07-26 10:31:02 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220726
-for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
+for you to fetch changes up to 5865d99fe88d8c8fa437c18c6b63fb2a8165634f:
-  tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
+  hw/display/bcm2835_fb: Fix framebuffer allocation address (2022-07-26 14:09:44 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/virt: ARM_VIRT must select ARM_GIC
+ * Update Coverity component definitions
- * exynos: Fix bad printf format specifiers
+ * target/arm: Add MO_128 entry to pred_esz_masks[]
- * hw/input/ps2.c: Remove remnants of printf debug
+ * configure: Fix portability issues
- * target/openrisc: Remove dead code attempting to check "is timer disabled"
+ * hw/display/bcm2835_fb: Fix framebuffer allocation address
  * register: Remove unnecessary NULL check
  * util/cutils: Fix Coverity array overrun in freq_to_str()
  * configure: Make "does libgio work" test pull in some actual functions
  * tmp105: reset the T_low and T_High registers
  * tmp105: Correct handling of temperature limit checks
 ----------------------------------------------------------------
-Alex Chen (1):
+Alan Jian (1):
-      exynos: Fix bad printf format specifiers
+      hw/display/bcm2835_fb: Fix framebuffer allocation address
-Alistair Francis (1):
+Peter Maydell (8):
-      register: Remove unnecessary NULL check
+      scripts/coverity-scan/COMPONENTS.md: Add loongarch component
       scripts/coverity-scan/COMPONENTS.md: Update slirp component info
       target/arm: Add MO_128 entry to pred_esz_masks[]
       configure: Add missing POSIX-required space
       configure: Add braces to clarify intent of $emu[[:space:]]
       configure: Don't use bash-specific string-replacement syntax
       configure: Drop dead code attempting to use -msmall-data on alpha hosts
       configure: Avoid '==' bashism
-Andrew Jones (1):
+ configure                           | 20 +++++++-------------
-      hw/arm/virt: ARM_VIRT must select ARM_GIC
+ target/arm/cpu.h                    |  2 +-
+ hw/display/bcm2835_fb.c             |  3 +--
-Peter Maydell (5):
+ target/arm/translate-sve.c          |  5 +++--
-      hw/input/ps2.c: Remove remnants of printf debug
+ scripts/coverity-scan/COMPONENTS.md |  7 +++++--
-      target/openrisc: Remove dead code attempting to check "is timer disabled"
+files changed, 17 insertions(+), 20 deletions(-)
       configure: Make "does libgio work" test pull in some actual functions
       hw/misc/tmp105: reset the T_low and T_High registers
       tmp105: Correct handling of temperature limit checks
 Philippe Mathieu-Daudé (1):
       util/cutils: Fix Coverity array overrun in freq_to_str()
  configure                    | 11 +++++--
  hw/misc/tmp105.h             |  7 +++++
  hw/core/register.c           |  4 ---
  hw/input/ps2.c               |  9 ------
  hw/misc/tmp105.c             | 73 ++++++++++++++++++++++++++++++++++++++------
  hw/timer/exynos4210_mct.c    |  4 +--
  hw/timer/exynos4210_pwm.c    |  8 ++---
  target/openrisc/sys_helper.c |  3 --
  util/cutils.c                |  3 +-
  hw/arm/Kconfig               |  1 +
 files changed, 89 insertions(+), 34 deletions(-)

-[PULL 8/9] hw/misc/tmp105: reset the T_low and T_High registers
+[PULL 1/9] scripts/coverity-scan/COMPONENTS.md: Add loongarch component
-The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
+Add the component regex for the new loongarch target.
 power-up reset values for the T_low and T_high registers are 80 degrees C
 and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
 values are then shifted right by four bits to give the register reset
 values, since both registers store the 12 bits of temperature data in bits
 [15..4] of a 16 bit register.
 We were resetting these registers to zero, which is problematic for Linux
 guests which enable the alert interrupt and then immediately take an
 unexpected overtemperature alert because the current temperature is above
 freezing...
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
+Message-id: 20220718142310.16013-2-peter.maydell@linaro.org
 ---
- hw/misc/tmp105.c | 3 +++
+ scripts/coverity-scan/COMPONENTS.md | 3 +++
 file changed, 3 insertions(+)
-diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
+diff --git a/scripts/coverity-scan/COMPONENTS.md b/scripts/coverity-scan/COMPONENTS.md
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.c
+--- a/scripts/coverity-scan/COMPONENTS.md
-+++ b/hw/misc/tmp105.c
++++ b/scripts/coverity-scan/COMPONENTS.md
-@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
+@@ -XXX,XX +XXX,XX @@ testlibs
-     s->faults = tmp105_faultq[(s->config >> 3) & 3];
-     s->alarm = 0;
+ tests
+   ~ (/qemu)?(/tests/.*)
 +    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
 +    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 +
-     tmp105_interrupt_update(s);
++loongarch
- }
++  ~ (/qemu)?((/include)?/hw/(loongarch/.*|.*/loongarch.*)|/target/loongarch/.*)
 --
-.20.1
+.25.1

-[PULL 9/9] tmp105: Correct handling of temperature limit checks
+[PULL 2/9] scripts/coverity-scan/COMPONENTS.md: Update slirp component info
-The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
+Update the regex for the slirp component now that it lives
-signals an alert when the temperature equals or exceeds the T_high value and
+solely inside /slirp/, and note that it should be ignored in
-then remains high until a device register is read or the device responds to
+Coverity analysis (because it's a separate upstream project
-the SMBUS Alert Response address, or the device is put into Shutdown Mode.
+now, and they run Coverity on it themselves).
 Thereafter the Alert pin will only be re-signalled when temperature falls
 below T_low; alert can then be cleared in the same set of ways, and the
 device returns to its initial "alert when temperature goes above T_high"
 mode. (If this textual description is confusing, see figure 3 in the
 TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
 We were misimplementing this as a simple "always alert if temperature is
 above T_high or below T_low" condition, which gives a spurious alert on
 startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
 limit values.
 Implement the correct (hysteresis) behaviour by tracking whether we
 are currently looking for the temperature to rise over T_high or
 for it to fall below T_low. Our implementation of the comparator
 mode (TM==0) wasn't wrong, but rephrase it to match the way that
 interrupt mode is now handled for clarity.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
+Message-id: 20220718142310.16013-3-peter.maydell@linaro.org
 ---
- hw/misc/tmp105.h |  7 +++++
+ scripts/coverity-scan/COMPONENTS.md | 4 ++--
- hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
+file changed, 2 insertions(+), 2 deletions(-)
 files changed, 68 insertions(+), 9 deletions(-)
-diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
+diff --git a/scripts/coverity-scan/COMPONENTS.md b/scripts/coverity-scan/COMPONENTS.md
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.h
+--- a/scripts/coverity-scan/COMPONENTS.md
-+++ b/hw/misc/tmp105.h
++++ b/scripts/coverity-scan/COMPONENTS.md
-@@ -XXX,XX +XXX,XX @@ struct TMP105State {
+@@ -XXX,XX +XXX,XX @@ qemu-ga
-     int16_t limit[2];
+ scsi
-     int faults;
+   ~ (/qemu)?(/scsi/.*|/hw/scsi/.*|/include/hw/scsi/.*)
-     uint8_t alarm;
-+    /*
+-slirp
-+     * The TMP105 initially looks for a temperature rising above T_high;
+-  ~ (/qemu)?(/.*slirp.*)
-+     * once this is detected, the condition it looks for next is the
++slirp (component should be ignored in analysis)
-+     * temperature falling below T_low. This flag is false when initially
++  ~ (/qemu)?(/slirp/.*)
-+     * looking for T_high, true when looking for T_low.
-+     */
+ tcg
-+    bool detect_falling;
+   ~ (/qemu)?(/accel/tcg/.*|/replay/.*|/(.*/)?softmmu.*)
  };
  #endif
 diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/tmp105.c
 +++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
              return;
      }
 -    if ((s->config >> 1) & 1) {                    /* TM */
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 1;
 +    if (s->config >> 1 & 1) {
 +        /*
 +         * TM == 1 : Interrupt mode. We signal Alert when the
 +         * temperature rises above T_high, and expect the guest to clear
 +         * it (eg by reading a device register).
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 1;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      } else {
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 0;
 +        /*
 +         * TM == 0 : Comparator mode. We signal Alert when the temperature
 +         * rises above T_high, and stop signalling it when the temperature
 +         * falls below T_low.
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 0;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      }
      tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
      return 0;
  }
 +static bool detect_falling_needed(void *opaque)
 +{
 +    TMP105State *s = opaque;
 +
 +    /*
 +     * We only need to migrate the detect_falling bool if it's set;
 +     * for migration from older machines we assume that it is false
 +     * (ie temperature is not out of range).
 +     */
 +    return s->detect_falling;
 +}
 +
 +static const VMStateDescription vmstate_tmp105_detect_falling = {
 +    .name = "TMP105/detect-falling",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = detect_falling_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_BOOL(detect_falling, TMP105State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_tmp105 = {
      .name = "TMP105",
      .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
          VMSTATE_UINT8(alarm, TMP105State),
          VMSTATE_I2C_SLAVE(i2c, TMP105State),
          VMSTATE_END_OF_LIST()
 +    },
 +    .subsections = (const VMStateDescription*[]) {
 +        &vmstate_tmp105_detect_falling,
 +        NULL
      }
  };
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
      s->config = 0;
      s->faults = tmp105_faultq[(s->config >> 3) & 3];
      s->alarm = 0;
 +    s->detect_falling = false;
      s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
      s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 --
-.20.1
+.25.1

-[PULL 4/9] target/openrisc: Remove dead code attempting to check "is timer disabled"
+[PULL 3/9] target/arm: Add MO_128 entry to pred_esz_masks[]
-In the mtspr helper we attempt to check for "is the timer disabled"
+In commit 7390e0e9ab8475, we added support for SME loads and stores.
-with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
+Unlike SVE loads and stores, these include handling of 128-bit
-is zero and the condition is always false (Coverity complains about
+elements.  The SME load/store functions call down into the existing
-the dead code.)
+sve_cont_ldst_elements() function, which uses the element size MO_*
 value as an index into the pred_esz_masks[] array.  Because this code
 path now has to handle MO_128, we need to add an extra element to the
 array.
-The correct check would be to test whether the TTMR_M field in the
+This bug was spotted by Coverity because it meant we were reading off
-register is equal to TIMER_NONE instead.  However, the
+the end of the array.
 cpu_openrisc_timer_update() function checks whether the timer is
 enabled (it looks at cpu->env.is_counting, which is set to 0 via
 cpu_openrisc_count_stop() when the TTMR_M field is set to
 TIMER_NONE), so there's no need to check for "timer disabled" in the
 target/openrisc code.  Instead, simply remove the dead code.
-Fixes: Coverity CID 1005812
+Resolves: Coverity CID 1490539, 1490541, 1490543, 1490544, 1490545,
  1490546, 1490548, 1490549, 1490550, 1490551, 1490555, 1490557,
  1490558, 1490560, 1490561, 1490563
 Fixes: 7390e0e9ab8475 ("target/arm: Implement SME LD1, ST1")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Stafford Horne <shorne@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
+Message-id: 20220718100144.3248052-1-peter.maydell@linaro.org
 ---
- target/openrisc/sys_helper.c | 3 ---
+ target/arm/cpu.h           | 2 +-
-file changed, 3 deletions(-)
+ target/arm/translate-sve.c | 5 +++--
 files changed, 4 insertions(+), 3 deletions(-)
-diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/sys_helper.c
+--- a/target/arm/cpu.h
-+++ b/target/openrisc/sys_helper.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
+@@ -XXX,XX +XXX,XX @@ static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)
+ }
-     case TO_SPR(10, 1): /* TTCR */
-         cpu_openrisc_count_set(cpu, rb);
+ /* Shared between translate-sve.c and sve_helper.c.  */
--        if (env->ttmr & TIMER_NONE) {
+-extern const uint64_t pred_esz_masks[4];
--            return;
++extern const uint64_t pred_esz_masks[5];
--        }
-         cpu_openrisc_timer_update(cpu);
+ /* Helper for the macros below, validating the argument type. */
-         break;
+ static inline MemTxAttrs *typecheck_memtxattrs(MemTxAttrs *x)
- #endif
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_predtest(DisasContext *s, int dofs, int gofs, int words)
  }
  /* For each element size, the bits within a predicate word that are active.  */
 -const uint64_t pred_esz_masks[4] = {
 +const uint64_t pred_esz_masks[5] = {
 xffffffffffffffffull, 0x5555555555555555ull,
 -    0x1111111111111111ull, 0x0101010101010101ull
 +    0x1111111111111111ull, 0x0101010101010101ull,
 +    0x0001000100010001ull,
  };
  static bool trans_INVALID(DisasContext *s, arg_INVALID *a)
 --
-.20.1
+.25.1

-[PULL 5/9] register: Remove unnecessary NULL check
+[PULL 4/9] configure: Add missing POSIX-required space
-From: Alistair Francis <alistair.francis@wdc.com>
+In commit 7d7dbf9dc15be6e1 we added a line to the configure script
 which is not valid POSIX shell syntax, because it is missing a space
 after a '!' character. shellcheck diagnoses this:
-This patch fixes CID 1432800 by removing an unnecessary check.
+if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then
     ^-- SC1035: You are missing a required space after the !.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+and the OpenBSD shell will not correctly handle this without the space.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Fixes: 7d7dbf9dc15be6e1 ("configure: replace --enable/disable-git-update with --with-git-submodules")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
+Message-id: 20220720152631.450903-2-peter.maydell@linaro.org
 ---
- hw/core/register.c | 4 ----
+ configure | 2 +-
-file changed, 4 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/core/register.c b/hw/core/register.c
+diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100644
+index XXXXXXX..XXXXXXX 100755
---- a/hw/core/register.c
+--- a/configure
-+++ b/hw/core/register.c
++++ b/configure
-@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
+@@ -XXX,XX +XXX,XX @@ else
-         int index = rae[i].addr / data_size;
+     cxx=
-         RegisterInfo *r = &ri[index];
+ fi
--        if (data + data_size * index == 0 || !&rae[i]) {
+-if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then
--            continue;
++if ! (GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then
--        }
+     exit 1
--
+ fi
          /* Init the register, this will zero it. */
          object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
 --
-.20.1
+.25.1

-[PULL 3/9] hw/input/ps2.c: Remove remnants of printf debug
+[PULL 5/9] configure: Add braces to clarify intent of $emu[[:space:]]
-In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
+In shell script syntax, $var[something] is not special for variable
-and mouse emulation. However we didn't remove all the debug-by-printf
+expansion: $var is expanded.  However, as it can look as if it were
-support. In fact there is only one printf() remaining, and it is
+intended to be an array element access (the correct syntax for which
-redundant with the trace_ps2_write_mouse() event next to it.
+is ${var[something]}), shellcheck recommends using explicit braces
-Remove the printf() and the now-unused DEBUG* macros.
+around ${var} to clarify the intended expansion.
 This fixes the warning:
 In ./configure line 2346:
         if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*$emu[[:space:]]*$"; then
                                                               ^-- SC1087: Use braces when expanding arrays, e.g. ${array[idx]} (or ${var}[.. to quiet).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Message-id: 20220720152631.450903-3-peter.maydell@linaro.org
 Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
 ---
- hw/input/ps2.c | 9 ---------
+ configure | 2 +-
-file changed, 9 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/input/ps2.c b/hw/input/ps2.c
+diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100644
+index XXXXXXX..XXXXXXX 100755
---- a/hw/input/ps2.c
+--- a/configure
-+++ b/hw/input/ps2.c
++++ b/configure
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ if test -n "$target_cc" &&
+     # emulation. Linux and OpenBSD/amd64 use 'elf_i386'; FreeBSD uses the _fbsd
- #include "trace.h"
+     # variant; OpenBSD/i386 uses the _obsd variant; and Windows uses i386pe.
+     for emu in elf_i386 elf_i386_fbsd elf_i386_obsd i386pe; do
--/* debug PC keyboard */
+-        if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*$emu[[:space:]]*$"; then
--//#define DEBUG_KBD
++        if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*${emu}[[:space:]]*$"; then
--
+             ld_i386_emulation="$emu"
--/* debug PC keyboard : only mouse */
+             break
--//#define DEBUG_MOUSE
+         fi
 -
  /* Keyboard Commands */
  #define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
  #define KBD_CMD_ECHO         0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
      PS2MouseState *s = (PS2MouseState *)opaque;
      trace_ps2_write_mouse(opaque, val);
 -#ifdef DEBUG_MOUSE
 -    printf("kbd: write mouse 0x%02x\n", val);
 -#endif
      switch(s->common.write_cmd) {
      default:
      case -1:
 --
-.20.1
+.25.1

-[PULL 6/9] util/cutils: Fix Coverity array overrun in freq_to_str()
+[PULL 6/9] configure: Don't use bash-specific string-replacement syntax
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The variable string-replacement syntax ${var/old/new} is a bashism
 (though it is also supported by some other shells), and for instance
 does not work with the NetBSD /bin/sh, which complains:
  ../src/configure: 687: Syntax error: Bad substitution
-Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):
+Replace it with a more portable sed-based approach, similar to
 what we already do in quote_sh().
->>> Overrunning array "suffixes" of 7 8-byte elements at element
+Note that shellcheck also diagnoses this:
     index 7 (byte offset 63) using index "idx" (which evaluates to 7).
-Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
+In ./configure line 687:
-which is ~18.446 EHz, less than 1000 EHz.
+    e=${e/'\'/'\\'}
       ^-----------^ SC2039: In POSIX sh, string replacement is undefined.
            ^-- SC1003: Want to escape a single quote? echo 'This is how it'\''s done'.
                 ^-- SC1003: Want to escape a single quote? echo 'This is how it'\''s done'.
-Reported-by: Eduardo Habkost <ehabkost@redhat.com>
+In ./configure line 688:
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+    e=${e/\"/'\"'}
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+      ^----------^ SC2039: In POSIX sh, string replacement is undefined.
-Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
+Fixes: 8154f5e64b0cf ("meson: Prefix each element of firmware path")
 Message-id: 20201101215755.2021421-1-f4bug@amsat.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20220720152631.450903-4-peter.maydell@linaro.org
 ---
- util/cutils.c | 3 ++-
+ configure | 7 ++++---
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/util/cutils.c b/util/cutils.c
+diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100644
+index XXXXXXX..XXXXXXX 100755
---- a/util/cutils.c
+--- a/configure
-+++ b/util/cutils.c
++++ b/configure
-@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
+@@ -XXX,XX +XXX,XX @@ meson_option_build_array() {
-     double freq = freq_hz;
+     IFS=:
-     size_t idx = 0;
+   fi
+   for e in $1; do
--    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+-    e=${e/'\'/'\\'}
-+    while (freq >= 1000.0) {
+-    e=${e/\"/'\"'}
-         freq /= 1000.0;
+-    printf '"""%s""",' "$e"
-         idx++;
++    printf '"""'
-     }
++    # backslash escape any '\' and '"' characters
-+    assert(idx < ARRAY_SIZE(suffixes));
++    printf "%s" "$e" | sed -e 's/\([\"]\)/\\\1/g'
++    printf '""",'
-     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
+   done)
    printf ']\n'
  }
 --
-.20.1
+.25.1

-[PULL 1/9] hw/arm/virt: ARM_VIRT must select ARM_GIC
+[PULL 7/9] configure: Drop dead code attempting to use -msmall-data on alpha hosts
-From: Andrew Jones <drjones@redhat.com>
+In commit 823eb013452e93d we moved the setting of ARCH from configure
 to meson.build, but we accidentally left behind one attempt to use
 $ARCH in configure, which was trying to add -msmall-data to the
 compiler flags on Alpha hosts.  Since ARCH is now never set, the test
 always fails and we never add the flag.
-The removal of the selection of A15MPCORE from ARM_VIRT also
+There isn't actually any need to use this compiler flag on Alpha:
-removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
+the original intent was that it would allow us to simplify our TCG
 codegen on that platform, but we never actually made the TCG changes
 that would rely on -msmall-data.
-Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
+Drop the effectively-dead code from configure, as we don't need it.
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+This was spotted by shellcheck:
-Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+In ./configure line 2254:
-Message-id: 20201111143440.112763-1-drjones@redhat.com
+case "$ARCH" in
       ^---^ SC2153: Possible misspelling: ARCH may not be assigned, but arch is.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20220720152631.450903-5-peter.maydell@linaro.org
 ---
- hw/arm/Kconfig | 1 +
+ configure | 7 -------
-file changed, 1 insertion(+)
+file changed, 7 deletions(-)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100644
+index XXXXXXX..XXXXXXX 100755
---- a/hw/arm/Kconfig
+--- a/configure
-+++ b/hw/arm/Kconfig
++++ b/configure
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+@@ -XXX,XX +XXX,XX @@ if test "$fortify_source" = "yes" ; then
-     imply VFIO_PLATFORM
+   QEMU_CFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $QEMU_CFLAGS"
-     imply VFIO_XGMAC
+ fi
-     imply TPM_TIS_SYSBUS
-+    select ARM_GIC
+-case "$ARCH" in
-     select ACPI
+-alpha)
-     select ARM_SMMUV3
+-  # Ensure there's only a single GP
-     select GPIO_KEY
+-  QEMU_CFLAGS="-msmall-data $QEMU_CFLAGS"
 -;;
 -esac
 -
  if test "$have_asan" = "yes"; then
    QEMU_CFLAGS="-fsanitize=address $QEMU_CFLAGS"
    QEMU_LDFLAGS="-fsanitize=address $QEMU_LDFLAGS"
 --
-.20.1
+.25.1

-[PULL 7/9] configure: Make "does libgio work" test pull in some actual functions
+[PULL 8/9] configure: Avoid '==' bashism
-In commit 76346b6264a9b01979 we tried to add a configure check that
+The '==' operator to test is a bashism; the standard way to copmare
-the libgio pkg-config data was correct, which builds an executable
+strings is '='. This causes dash to complain:
 linked against it.  Unfortunately this doesn't catch the problem
 (missing static library dependency info), because a "do nothing" test
 source file doesn't have any symbol references that cause the linker
 to pull in .o files from libgio.a, and so we don't see the "missing
 symbols from libmount" error that a full QEMU link triggers.
-(The ineffective test went unnoticed because of a typo that
+../../configure: 681: test: linux: unexpected operator
 effectively disabled libgio unconditionally, but after commit
 a5dfc11f2 fixed that, a static link of the system emulator on
 Ubuntu stopped working again.)
 Improve the gio test by having the test source fragment reference a
 g_dbus function (which is what is indirectly causing us to end up
 wanting functions from libmount).
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
+Message-id: 20220720152631.450903-6-peter.maydell@linaro.org
 ---
- configure | 11 +++++++++--
+ configure | 2 +-
-file changed, 9 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/configure b/configure
 index XXXXXXX..XXXXXXX 100755
 --- a/configure
 +++ b/configure
-@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
+@@ -XXX,XX +XXX,XX @@ werror=""
-     # Check that the libraries actually work -- Ubuntu 18.04 ships
-     # with pkg-config --static --libs data for gio-2.0 that is missing
+ meson_option_build_array() {
-     # -lblkid and will give a link error.
+   printf '['
--    write_c_skeleton
+-  (if test "$targetos" == windows; then
--    if compile_prog "" "$gio_libs" ; then
++  (if test "$targetos" = windows; then
-+    cat > $TMPC <<EOF
+     IFS=\;
-+#include <gio/gio.h>
+   else
-+int main(void)
+     IFS=:
 +{
 +    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
 +    return 0;
 +}
 +EOF
 +    if compile_prog "$gio_cflags" "$gio_libs" ; then
          gio=yes
      else
          gio=no
 --
-.20.1
+.25.1

-[PULL 2/9] exynos: Fix bad printf format specifiers
+[PULL 9/9] hw/display/bcm2835_fb: Fix framebuffer allocation address
-From: Alex Chen <alex.chen@huawei.com>
+From: Alan Jian <alanjian85@gmail.com>
-We should use printf format specifier "%u" instead of "%d" for
+This patch fixes the dedicated framebuffer mailbox interface by
-argument of type "unsigned int".
+removing an unneeded offset.  This means that we pick the framebuffer
 address in the same way that we do if the guest code uses the buffer
 allocate mechanism of the bcm2835_property interface (case
 x00040001: /* Allocate buffer */ in bcm2835_property.c).
-Reported-by: Euler Robot <euler.robot@huawei.com>
+The documentation of this mailbox interface doesn't say anything
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+about using parts of the request buffer address to affect the
-Message-id: 20201111073651.72804-1-alex.chen@huawei.com
+chosen framebuffer address:
 https://github.com/raspberrypi/firmware/wiki/Mailbox-framebuffer-interface
 Some baremetal applications like the Screen01/Screen02 examples from
 Baking Pi tutorial[1] didn't work before this patch.
 [1] https://www.cl.cam.ac.uk/projects/raspberrypi/tutorials/os/screen01.html
 Signed-off-by: Alan Jian <alanjian85@outlook.com>
 Message-id: 20220725145838.8412-1-alanjian85@outlook.com
 [PMM: tweaked commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/exynos4210_mct.c | 4 ++--
+ hw/display/bcm2835_fb.c | 3 +--
- hw/timer/exynos4210_pwm.c | 8 ++++----
+file changed, 1 insertion(+), 2 deletions(-)
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/hw/display/bcm2835_fb.c
-+++ b/hw/timer/exynos4210_mct.c
++++ b/hw/display/bcm2835_fb.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
+@@ -XXX,XX +XXX,XX @@ static void bcm2835_fb_mbox_push(BCM2835FBState *s, uint32_t value)
-     /* If CSTAT is pending and IRQ is enabled */
+     newconf.xoffset = ldl_le_phys(&s->dma_as, value + 24);
-     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
+     newconf.yoffset = ldl_le_phys(&s->dma_as, value + 28);
-             (s->reg.int_enb & G_INT_ENABLE(id))) {
--        DPRINTF("gcmp timer[%d] IRQ\n", id);
+-    newconf.base = s->vcram_base | (value & 0xc0000000);
-+        DPRINTF("gcmp timer[%u] IRQ\n", id);
+-    newconf.base += BCM2835_FB_OFFSET;
-         qemu_irq_raise(s->irq[id]);
++    newconf.base = s->vcram_base + BCM2835_FB_OFFSET;
-     }
- }
+     /* Copy fields which we don't want to change from the existing config */
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
+     newconf.pixo = s->config.pixo;
                      MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
      if (freq != s->freq) {
 -        DPRINTF("freq=%dHz\n", s->freq);
 +        DPRINTF("freq=%uHz\n", s->freq);
          /* global timer */
          tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
 diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/exynos4210_pwm.c
 +++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
      if (freq != s->timer[id].freq) {
          ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
 -        DPRINTF("freq=%dHz\n", s->timer[id].freq);
 +        DPRINTF("freq=%uHz\n", s->timer[id].freq);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
      uint32_t id = s->id;
      bool cmp;
 -    DPRINTF("timer %d tick\n", id);
 +    DPRINTF("timer %u tick\n", id);
      /* set irq status */
      p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
      /* raise IRQ */
      if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
 -        DPRINTF("timer %d IRQ\n", id);
 +        DPRINTF("timer %u IRQ\n", id);
          qemu_irq_raise(p->timer[id].irq);
      }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
      }
      if (cmp) {
 -        DPRINTF("auto reload timer %d count to %x\n", id,
 +        DPRINTF("auto reload timer %u count to %x\n", id,
                  p->timer[id].reg_tcntb);
          ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
          ptimer_run(p->timer[id].ptimer, 1);
 --
-.20.1
+.25.1

Arm queue; bugfixes only.

thanks
-- PMM

The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117

for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:

tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: ARM_VIRT must select ARM_GIC
 * exynos: Fix bad printf format specifiers
 * hw/input/ps2.c: Remove remnants of printf debug
 * target/openrisc: Remove dead code attempting to check "is timer disabled"
 * register: Remove unnecessary NULL check
 * util/cutils: Fix Coverity array overrun in freq_to_str()
 * configure: Make "does libgio work" test pull in some actual functions
 * tmp105: reset the T_low and T_High registers
 * tmp105: Correct handling of temperature limit checks

----------------------------------------------------------------
Alex Chen (1):
      exynos: Fix bad printf format specifiers

Alistair Francis (1):
      register: Remove unnecessary NULL check

Andrew Jones (1):
      hw/arm/virt: ARM_VIRT must select ARM_GIC

Peter Maydell (5):
      hw/input/ps2.c: Remove remnants of printf debug
      target/openrisc: Remove dead code attempting to check "is timer disabled"
      configure: Make "does libgio work" test pull in some actual functions
      hw/misc/tmp105: reset the T_low and T_High registers
      tmp105: Correct handling of temperature limit checks

Philippe Mathieu-Daudé (1):
      util/cutils: Fix Coverity array overrun in freq_to_str()

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201111073651.72804-1-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 hw/timer/exynos4210_pwm.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
     /* If CSTAT is pending and IRQ is enabled */
     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
             (s->reg.int_enb & G_INT_ENABLE(id))) {
-        DPRINTF("gcmp timer[%d] IRQ\n", id);
+        DPRINTF("gcmp timer[%u] IRQ\n", id);
         qemu_irq_raise(s->irq[id]);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
-        DPRINTF("freq=%dHz\n", s->freq);
+        DPRINTF("freq=%uHz\n", s->freq);
 
         /* global timer */
         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
 
     if (freq != s->timer[id].freq) {
         ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
-        DPRINTF("freq=%dHz\n", s->timer[id].freq);
+        DPRINTF("freq=%uHz\n", s->timer[id].freq);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     uint32_t id = s->id;
     bool cmp;
 
-    DPRINTF("timer %d tick\n", id);
+    DPRINTF("timer %u tick\n", id);
 
     /* set irq status */
     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
 
     /* raise IRQ */
     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
-        DPRINTF("timer %d IRQ\n", id);
+        DPRINTF("timer %u IRQ\n", id);
         qemu_irq_raise(p->timer[id].irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     }
 
     if (cmp) {
-        DPRINTF("auto reload timer %d count to %x\n", id,
+        DPRINTF("auto reload timer %u count to %x\n", id,
                 p->timer[id].reg_tcntb);
         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
         ptimer_run(p->timer[id].ptimer, 1);
-- 
2.20.1

In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
and mouse emulation. However we didn't remove all the debug-by-printf
support. In fact there is only one printf() remaining, and it is
redundant with the trace_ps2_write_mouse() event next to it.
Remove the printf() and the now-unused DEBUG* macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
---
 hw/input/ps2.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -XXX,XX +XXX,XX @@
 
 #include "trace.h"
 
-/* debug PC keyboard */
-//#define DEBUG_KBD
-
-/* debug PC keyboard : only mouse */
-//#define DEBUG_MOUSE
-
 /* Keyboard Commands */
 #define KBD_CMD_SET_LEDS	0xED	/* Set keyboard leds */
 #define KBD_CMD_ECHO     	0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
     PS2MouseState *s = (PS2MouseState *)opaque;
 
     trace_ps2_write_mouse(opaque, val);
-#ifdef DEBUG_MOUSE
-    printf("kbd: write mouse 0x%02x\n", val);
-#endif
     switch(s->common.write_cmd) {
     default:
     case -1:
-- 
2.20.1

In the mtspr helper we attempt to check for "is the timer disabled"
with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
is zero and the condition is always false (Coverity complains about
the dead code.)

The correct check would be to test whether the TTMR_M field in the
register is equal to TIMER_NONE instead.  However, the
cpu_openrisc_timer_update() function checks whether the timer is
enabled (it looks at cpu->env.is_counting, which is set to 0 via
cpu_openrisc_count_stop() when the TTMR_M field is set to
TIMER_NONE), so there's no need to check for "timer disabled" in the
target/openrisc code.  Instead, simply remove the dead code.

Fixes: Coverity CID 1005812
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
---
 target/openrisc/sys_helper.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
 
     case TO_SPR(10, 1): /* TTCR */
         cpu_openrisc_count_set(cpu, rb);
-        if (env->ttmr & TIMER_NONE) {
-            return;
-        }
         cpu_openrisc_timer_update(cpu);
         break;
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):

>>> Overrunning array "suffixes" of 7 8-byte elements at element
    index 7 (byte offset 63) using index "idx" (which evaluates to 7).

Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
which is ~18.446 EHz, less than 1000 EHz.

Reported-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20201101215755.2021421-1-f4bug@amsat.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/util/cutils.c b/util/cutils.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
     double freq = freq_hz;
     size_t idx = 0;
 
-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+    while (freq >= 1000.0) {
         freq /= 1000.0;
         idx++;
     }
+    assert(idx < ARRAY_SIZE(suffixes));
 
     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
 }
-- 
2.20.1

In commit 76346b6264a9b01979 we tried to add a configure check that
the libgio pkg-config data was correct, which builds an executable
linked against it.  Unfortunately this doesn't catch the problem
(missing static library dependency info), because a "do nothing" test
source file doesn't have any symbol references that cause the linker
to pull in .o files from libgio.a, and so we don't see the "missing
symbols from libmount" error that a full QEMU link triggers.

(The ineffective test went unnoticed because of a typo that
effectively disabled libgio unconditionally, but after commit
3569a5dfc11f2 fixed that, a static link of the system emulator on
Ubuntu stopped working again.)

Improve the gio test by having the test source fragment reference a
g_dbus function (which is what is indirectly causing us to end up
wanting functions from libmount).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
---
 configure | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
     # Check that the libraries actually work -- Ubuntu 18.04 ships
     # with pkg-config --static --libs data for gio-2.0 that is missing
     # -lblkid and will give a link error.
-    write_c_skeleton
-    if compile_prog "" "$gio_libs" ; then
+    cat > $TMPC <<EOF
+#include <gio/gio.h>
+int main(void)
+{
+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
+    return 0;
+}
+EOF
+    if compile_prog "$gio_cflags" "$gio_libs" ; then
         gio=yes
     else
         gio=no
-- 
2.20.1

The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
power-up reset values for the T_low and T_high registers are 80 degrees C
and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
values are then shifted right by four bits to give the register reset
values, since both registers store the 12 bits of temperature data in bits
[15..4] of a 16 bit register.

We were resetting these registers to zero, which is problematic for Linux
guests which enable the alert interrupt and then immediately take an
unexpected overtemperature alert because the current temperature is above
freezing...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
---
 hw/misc/tmp105.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
 
+    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
+    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
+
     tmp105_interrupt_update(s);
 }
 
-- 
2.20.1

The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
signals an alert when the temperature equals or exceeds the T_high value and
then remains high until a device register is read or the device responds to
the SMBUS Alert Response address, or the device is put into Shutdown Mode.
Thereafter the Alert pin will only be re-signalled when temperature falls
below T_low; alert can then be cleared in the same set of ways, and the
device returns to its initial "alert when temperature goes above T_high"
mode. (If this textual description is confusing, see figure 3 in the
TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)

We were misimplementing this as a simple "always alert if temperature is
above T_high or below T_low" condition, which gives a spurious alert on
startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
limit values.

Implement the correct (hysteresis) behaviour by tracking whether we
are currently looking for the temperature to rise over T_high or
for it to fall below T_low. Our implementation of the comparator
mode (TM==0) wasn't wrong, but rephrase it to match the way that
interrupt mode is now handled for clarity.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
---
 hw/misc/tmp105.h |  7 +++++
 hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.h
+++ b/hw/misc/tmp105.h
@@ -XXX,XX +XXX,XX @@ struct TMP105State {
     int16_t limit[2];
     int faults;
     uint8_t alarm;
+    /*
+     * The TMP105 initially looks for a temperature rising above T_high;
+     * once this is detected, the condition it looks for next is the
+     * temperature falling below T_low. This flag is false when initially
+     * looking for T_high, true when looking for T_low.
+     */
+    bool detect_falling;
 };
 
 #endif
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
             return;
     }
 
-    if ((s->config >> 1) & 1) {					/* TM */
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 1;
+    if (s->config >> 1 & 1) {
+        /*
+         * TM == 1 : Interrupt mode. We signal Alert when the
+         * temperature rises above T_high, and expect the guest to clear
+         * it (eg by reading a device register).
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 1;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     } else {
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 0;
+        /*
+         * TM == 0 : Comparator mode. We signal Alert when the temperature
+         * rises above T_high, and stop signalling it when the temperature
+         * falls below T_low.
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 0;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     }
 
     tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
     return 0;
 }
 
+static bool detect_falling_needed(void *opaque)
+{
+    TMP105State *s = opaque;
+
+    /*
+     * We only need to migrate the detect_falling bool if it's set;
+     * for migration from older machines we assume that it is false
+     * (ie temperature is not out of range).
+     */
+    return s->detect_falling;
+}
+
+static const VMStateDescription vmstate_tmp105_detect_falling = {
+    .name = "TMP105/detect-falling",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = detect_falling_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(detect_falling, TMP105State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_tmp105 = {
     .name = "TMP105",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
         VMSTATE_UINT8(alarm, TMP105State),
         VMSTATE_I2C_SLAVE(i2c, TMP105State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_tmp105_detect_falling,
+        NULL
     }
 };
 
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->config = 0;
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
+    s->detect_falling = false;
 
     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-- 
2.20.1

A last lot of bug fixes before rc0...

thanks
-- PMM

The following changes since commit 0d0275c31f00b71b49eb80bbdca2cfe244cf80fb:

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2022-07-26 10:31:02 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220726

for you to fetch changes up to 5865d99fe88d8c8fa437c18c6b63fb2a8165634f:

hw/display/bcm2835_fb: Fix framebuffer allocation address (2022-07-26 14:09:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Update Coverity component definitions
 * target/arm: Add MO_128 entry to pred_esz_masks[]
 * configure: Fix portability issues
 * hw/display/bcm2835_fb: Fix framebuffer allocation address

----------------------------------------------------------------
Alan Jian (1):
      hw/display/bcm2835_fb: Fix framebuffer allocation address

Peter Maydell (8):
      scripts/coverity-scan/COMPONENTS.md: Add loongarch component
      scripts/coverity-scan/COMPONENTS.md: Update slirp component info
      target/arm: Add MO_128 entry to pred_esz_masks[]
      configure: Add missing POSIX-required space
      configure: Add braces to clarify intent of $emu[[:space:]]
      configure: Don't use bash-specific string-replacement syntax
      configure: Drop dead code attempting to use -msmall-data on alpha hosts
      configure: Avoid '==' bashism

In commit 7390e0e9ab8475, we added support for SME loads and stores.
Unlike SVE loads and stores, these include handling of 128-bit
elements.  The SME load/store functions call down into the existing
sve_cont_ldst_elements() function, which uses the element size MO_*
value as an index into the pred_esz_masks[] array.  Because this code
path now has to handle MO_128, we need to add an extra element to the
array.

This bug was spotted by Coverity because it meant we were reading off
the end of the array.

Resolves: Coverity CID 1490539, 1490541, 1490543, 1490544, 1490545,
 1490546, 1490548, 1490549, 1490550, 1490551, 1490555, 1490557,
 1490558, 1490560, 1490561, 1490563
Fixes: 7390e0e9ab8475 ("target/arm: Implement SME LD1, ST1")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220718100144.3248052-1-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 +-
 target/arm/translate-sve.c | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)
 }
 
 /* Shared between translate-sve.c and sve_helper.c.  */
-extern const uint64_t pred_esz_masks[4];
+extern const uint64_t pred_esz_masks[5];
 
 /* Helper for the macros below, validating the argument type. */
 static inline MemTxAttrs *typecheck_memtxattrs(MemTxAttrs *x)
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static void do_predtest(DisasContext *s, int dofs, int gofs, int words)
 }
 
 /* For each element size, the bits within a predicate word that are active.  */
-const uint64_t pred_esz_masks[4] = {
+const uint64_t pred_esz_masks[5] = {
     0xffffffffffffffffull, 0x5555555555555555ull,
-    0x1111111111111111ull, 0x0101010101010101ull
+    0x1111111111111111ull, 0x0101010101010101ull,
+    0x0001000100010001ull,
 };
 
 static bool trans_INVALID(DisasContext *s, arg_INVALID *a)
-- 
2.25.1

In commit 7d7dbf9dc15be6e1 we added a line to the configure script
which is not valid POSIX shell syntax, because it is missing a space
after a '!' character. shellcheck diagnoses this:

if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then
    ^-- SC1035: You are missing a required space after the !.

and the OpenBSD shell will not correctly handle this without the space.

Fixes: 7d7dbf9dc15be6e1 ("configure: replace --enable/disable-git-update with --with-git-submodules")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 20220720152631.450903-2-peter.maydell@linaro.org
---
 configure | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ else
     cxx=
 fi
 
-if !(GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then
+if ! (GIT="$git" "$source_path/scripts/git-submodule.sh" "$git_submodules_action" "$git_submodules"); then
     exit 1
 fi
 
-- 
2.25.1

In shell script syntax, $var[something] is not special for variable
expansion: $var is expanded.  However, as it can look as if it were
intended to be an array element access (the correct syntax for which
is ${var[something]}), shellcheck recommends using explicit braces
around ${var} to clarify the intended expansion.

This fixes the warning:

In ./configure line 2346:
        if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*$emu[[:space:]]*$"; then
                                                              ^-- SC1087: Use braces when expanding arrays, e.g. ${array[idx]} (or ${var}[.. to quiet).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20220720152631.450903-3-peter.maydell@linaro.org
---
 configure | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if test -n "$target_cc" &&
     # emulation. Linux and OpenBSD/amd64 use 'elf_i386'; FreeBSD uses the _fbsd
     # variant; OpenBSD/i386 uses the _obsd variant; and Windows uses i386pe.
     for emu in elf_i386 elf_i386_fbsd elf_i386_obsd i386pe; do
-        if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*$emu[[:space:]]*$"; then
+        if "$target_ld" -verbose 2>&1 | grep -q "^[[:space:]]*${emu}[[:space:]]*$"; then
             ld_i386_emulation="$emu"
             break
         fi
-- 
2.25.1

The variable string-replacement syntax ${var/old/new} is a bashism
(though it is also supported by some other shells), and for instance
does not work with the NetBSD /bin/sh, which complains:
 ../src/configure: 687: Syntax error: Bad substitution

Replace it with a more portable sed-based approach, similar to
what we already do in quote_sh().

Note that shellcheck also diagnoses this:

In ./configure line 687:
    e=${e/'\'/'\\'}
      ^-----------^ SC2039: In POSIX sh, string replacement is undefined.
           ^-- SC1003: Want to escape a single quote? echo 'This is how it'\''s done'.
                ^-- SC1003: Want to escape a single quote? echo 'This is how it'\''s done'.

In ./configure line 688:
    e=${e/\"/'\"'}
      ^----------^ SC2039: In POSIX sh, string replacement is undefined.

Fixes: 8154f5e64b0cf ("meson: Prefix each element of firmware path")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Message-id: 20220720152631.450903-4-peter.maydell@linaro.org
---
 configure | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ meson_option_build_array() {
     IFS=:
   fi
   for e in $1; do
-    e=${e/'\'/'\\'}
-    e=${e/\"/'\"'}
-    printf '"""%s""",' "$e"
+    printf '"""'
+    # backslash escape any '\' and '"' characters
+    printf "%s" "$e" | sed -e 's/$[\"]$/\\\1/g'
+    printf '""",'
   done)
   printf ']\n'
 }
-- 
2.25.1

In commit 823eb013452e93d we moved the setting of ARCH from configure
to meson.build, but we accidentally left behind one attempt to use
$ARCH in configure, which was trying to add -msmall-data to the
compiler flags on Alpha hosts.  Since ARCH is now never set, the test
always fails and we never add the flag.

There isn't actually any need to use this compiler flag on Alpha:
the original intent was that it would allow us to simplify our TCG
codegen on that platform, but we never actually made the TCG changes
that would rely on -msmall-data.

Drop the effectively-dead code from configure, as we don't need it.

This was spotted by shellcheck:

In ./configure line 2254:
case "$ARCH" in
      ^---^ SC2153: Possible misspelling: ARCH may not be assigned, but arch is.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20220720152631.450903-5-peter.maydell@linaro.org
---
 configure | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if test "$fortify_source" = "yes" ; then
   QEMU_CFLAGS="-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 $QEMU_CFLAGS"
 fi
 
-case "$ARCH" in
-alpha)
-  # Ensure there's only a single GP
-  QEMU_CFLAGS="-msmall-data $QEMU_CFLAGS"
-;;
-esac
-
 if test "$have_asan" = "yes"; then
   QEMU_CFLAGS="-fsanitize=address $QEMU_CFLAGS"
   QEMU_LDFLAGS="-fsanitize=address $QEMU_LDFLAGS"
-- 
2.25.1

From: Alan Jian <alanjian85@gmail.com>

This patch fixes the dedicated framebuffer mailbox interface by
removing an unneeded offset.  This means that we pick the framebuffer
address in the same way that we do if the guest code uses the buffer
allocate mechanism of the bcm2835_property interface (case
0x00040001: /* Allocate buffer */ in bcm2835_property.c).

The documentation of this mailbox interface doesn't say anything
about using parts of the request buffer address to affect the
chosen framebuffer address:
https://github.com/raspberrypi/firmware/wiki/Mailbox-framebuffer-interface

Some baremetal applications like the Screen01/Screen02 examples from
Baking Pi tutorial[1] didn't work before this patch.

[1] https://www.cl.cam.ac.uk/projects/raspberrypi/tutorials/os/screen01.html

Signed-off-by: Alan Jian <alanjian85@outlook.com>
Message-id: 20220725145838.8412-1-alanjian85@outlook.com
[PMM: tweaked commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/bcm2835_fb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/bcm2835_fb.c
+++ b/hw/display/bcm2835_fb.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_fb_mbox_push(BCM2835FBState *s, uint32_t value)
     newconf.xoffset = ldl_le_phys(&s->dma_as, value + 24);
     newconf.yoffset = ldl_le_phys(&s->dma_as, value + 28);
 
-    newconf.base = s->vcram_base | (value & 0xc0000000);
-    newconf.base += BCM2835_FB_OFFSET;
+    newconf.base = s->vcram_base + BCM2835_FB_OFFSET;
 
     /* Copy fields which we don't want to change from the existing config */
     newconf.pixo = s->config.pixo;
-- 
2.25.1