Hi; here's a relatively small target-arm queue, pretty much all

bug fixes. (There are a few non-arm patches that I've thrown in

there too for my convenience :-))

The following changes since commit 278238505d28d292927bff7683f39fb4fbca7fd1:

Merge tag 'pull-tcg-20230511-2' of https://gitlab.com/rth7680/qemu into staging (2023-05-11 11:44:23 +0100)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230512

for you to fetch changes up to 478dccbb99db0bf8f00537dd0b4d0de88d5cb537:

target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check (2023-05-12 16:01:25 +0100)

* More refactoring of files into tcg/

* Don't allow stage 2 page table walks to downgrade to NS

* Fix handling of SW and NSW bits for stage 2 walks

* MAINTAINERS: Update Akihiko Odaki's email address

* ui: Fix pixel colour channel order for PNG screenshots

* docs: Remove unused weirdly-named cross-reference targets

* hw/mips/malta: Fix minor dead code issue

* Fixes for the "allow CONFIG_TCG=n" changes

* tests/qtest: Don't run cdrom boot tests if no accelerator is present

* target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check

Akihiko Odaki (1):

MAINTAINERS: Update Akihiko Odaki's email address

Fabiano Rosas (3):

target/arm: Select SEMIHOSTING when using TCG

target/arm: Select CONFIG_ARM_V7M when TCG is enabled

tests/qtest: Don't run cdrom boot tests if no accelerator is present

Peter Maydell (6):

target/arm: Don't allow stage 2 page table walks to downgrade to NS

target/arm: Fix handling of SW and NSW bits for stage 2 walks

ui: Fix pixel colour channel order for PNG screenshots

docs: Remove unused weirdly-named cross-reference targets

hw/mips/malta: Fix minor dead code issue

target/arm: Correct AArch64.S2MinTxSZ 32-bit EL1 input size check

From: Richard Henderson <richard.henderson@linaro.org>

While we cannot move the main "helper.h" out of target/arm/,

due to usage by generic code, we can move the sub-includes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Fabiano Rosas <farosas@suse.de>

Message-id: 20230504110412.1892411-3-richard.henderson@linaro.org

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.h | 8 ++++----

target/arm/{ => tcg}/helper-a64.h | 0

target/arm/{ => tcg}/helper-mve.h | 0

target/arm/{ => tcg}/helper-sme.h | 0

target/arm/{ => tcg}/helper-sve.h | 0

5 files changed, 4 insertions(+), 4 deletions(-)

rename target/arm/{ => tcg}/helper-a64.h (100%)

rename target/arm/{ => tcg}/helper-mve.h (100%)

rename target/arm/{ => tcg}/helper-sme.h (100%)

rename target/arm/{ => tcg}/helper-sve.h (100%)

diff --git a/target/arm/helper.h b/target/arm/helper.h

--- a/target/arm/helper.h

+++ b/target/arm/helper.h

@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_uclamp_d, TCG_CALL_NO_RWG,

void, ptr, ptr, ptr, ptr, i32)

#ifdef TARGET_AARCH64

-#include "helper-a64.h"

-#include "helper-sve.h"

-#include "helper-sme.h"

+#include "tcg/helper-a64.h"

+#include "tcg/helper-sve.h"

+#include "tcg/helper-sme.h"

#endif

-#include "helper-mve.h"

+#include "tcg/helper-mve.h"

diff --git a/target/arm/helper-a64.h b/target/arm/tcg/helper-a64.h

similarity index 100%

rename from target/arm/helper-a64.h

rename to target/arm/tcg/helper-a64.h

diff --git a/target/arm/helper-mve.h b/target/arm/tcg/helper-mve.h

similarity index 100%

rename from target/arm/helper-mve.h

rename to target/arm/tcg/helper-mve.h

diff --git a/target/arm/helper-sme.h b/target/arm/tcg/helper-sme.h

similarity index 100%

rename from target/arm/helper-sme.h

rename to target/arm/tcg/helper-sme.h

diff --git a/target/arm/helper-sve.h b/target/arm/tcg/helper-sve.h

similarity index 100%

rename from target/arm/helper-sve.h

rename to target/arm/tcg/helper-sve.h

2.34.1

Bit 63 in a Table descriptor is only the NSTable bit for stage 1

translations; in stage 2 it is RES0. We were incorrectly looking at

it all the time.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20230504135425.2748672-2-peter.maydell@linaro.org

target/arm/ptw.c | 5 +++--

1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c

--- a/target/arm/ptw.c

+++ b/target/arm/ptw.c

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,

descaddrmask &= ~indexmask_grainsize;

/*

- * Secure accesses start with the page table in secure memory and

+ * Secure stage 1 accesses start with the page table in secure memory and

* can be downgraded to non-secure at any step. Non-secure accesses

* remain non-secure. We implement this by just ORing in the NSTable/NS

* bits at each step.

+ * Stage 2 never gets this kind of downgrade.

*/

tableattrs = is_secure ? 0 : (1 << 4);

next_level:

descaddr |= (address >> (stride * (4 - level))) & indexmask;

descaddr &= ~7ULL;

- nstable = extract32(tableattrs, 4, 1);

+ nstable = !regime_is_stage2(mmu_idx) && extract32(tableattrs, 4, 1);

if (nstable) {

* Stage2_S -> Stage2 or Phys_S -> Phys_NS

2.34.1

From: Akihiko Odaki <akihiko.odaki@gmail.com>

I am now employed by Daynix. Although my role as a reviewer of

macOS-related change is not very relevant to the employment, I decided

to use the company email address to avoid confusions from different

addresses.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20230506072333.32510-1-akihiko.odaki@daynix.com

MAINTAINERS | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ Core Audio framework backend

M: Gerd Hoffmann <kraxel@redhat.com>

M: Philippe Mathieu-Daudé <philmd@linaro.org>

R: Christian Schoenebeck <qemu_oss@crudebyte.com>

-R: Akihiko Odaki <akihiko.odaki@gmail.com>

+R: Akihiko Odaki <akihiko.odaki@daynix.com>

S: Odd Fixes

F: audio/coreaudio.c

@@ -XXX,XX +XXX,XX @@ F: docs/devel/ui.rst

Cocoa graphics

M: Peter Maydell <peter.maydell@linaro.org>

M: Philippe Mathieu-Daudé <philmd@linaro.org>

-R: Akihiko Odaki <akihiko.odaki@gmail.com>

+R: Akihiko Odaki <akihiko.odaki@daynix.com>

S: Odd Fixes

F: ui/cocoa.m

2.34.1

When we take a PNG screenshot the ordering of the colour channels in

the data is not correct, resulting in the image having weird

colouring compared to the actual display. (Specifically, on a

little-endian host the blue and red channels are swapped; on

big-endian everything is wrong.)

This happens because the pixman idea of the pixel data and the libpng

idea differ. PIXMAN_a8r8g8b8 defines that pixels are 32-bit values,

with A in bits 24-31, R in bits 16-23, G in bits 8-15 and B in bits

0-7. This means that on little-endian systems the bytes in memory

are

B G R A

and on big-endian systems they are

A R G B

libpng, on the other hand, thinks of pixels as being a series of

values for each channel, so its format PNG_COLOR_TYPE_RGB_ALPHA

always wants bytes in the order

R G B A

This isn't the same as the pixman order for either big or little

endian hosts.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

Message-id: 20230502135548.2451309-1-peter.maydell@linaro.org

ui/console.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/console.c b/ui/console.c

--- a/ui/console.c

+++ b/ui/console.c

@@ -XXX,XX +XXX,XX @@ static bool png_save(int fd, pixman_image_t *image, Error **errp)

png_struct *png_ptr;

png_info *info_ptr;

g_autoptr(pixman_image_t) linebuf =

- qemu_pixman_linebuf_create(PIXMAN_a8r8g8b8, width);

+ qemu_pixman_linebuf_create(PIXMAN_BE_r8g8b8, width);

uint8_t *buf = (uint8_t *)pixman_image_get_data(linebuf);

FILE *f = fdopen(fd, "wb");

int y;

@@ -XXX,XX +XXX,XX @@ static bool png_save(int fd, pixman_image_t *image, Error **errp)

png_init_io(png_ptr, f);

png_set_IHDR(png_ptr, info_ptr, width, height, 8,

- PNG_COLOR_TYPE_RGB_ALPHA, PNG_INTERLACE_NONE,

+ PNG_COLOR_TYPE_RGB, PNG_INTERLACE_NONE,

PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);

png_write_info(png_ptr, info_ptr);

2.34.1

Coverity points out (in CID 1508390) that write_bootloader has

some dead code, where we assign to 'p' and then in the following

line assign to it again. This happened as a result of the

refactoring in commit cd5066f8618b.

Fix the dead code by removing the 'void *v' variable entirely and

instead adding a cast when calling bl_setup_gt64120_jump_kernel(), as

we do at its other callsite in write_bootloader_nanomips().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

hw/mips/malta.c | 5 +----

1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/mips/malta.c b/hw/mips/malta.c

--- a/hw/mips/malta.c

+++ b/hw/mips/malta.c

@@ -XXX,XX +XXX,XX @@ static void write_bootloader(uint8_t *base, uint64_t run_addr,

uint64_t kernel_entry)

{

uint32_t *p;

- void *v;

/* Small bootloader */

p = (uint32_t *)base;

@@ -XXX,XX +XXX,XX @@ static void write_bootloader(uint8_t *base, uint64_t run_addr,

*

*/

- v = p;

- bl_setup_gt64120_jump_kernel(&v, run_addr, kernel_entry);

- p = v;

+ bl_setup_gt64120_jump_kernel((void **)&p, run_addr, kernel_entry);

/* YAMON subroutines */

p = (uint32_t *) (base + 0x800);

2.34.1