Series comparison

-[PULL 00/11] target-arm queue
+[PULL 0/9] target-arm queue
-A collection of bug fixes for rc2...
+This one's almost all docs fixes.
-The following changes since commit 146aa0f104bb3bf88e43c4082a0bfc4bbda4fbd8:
+thanks
 -- PMM
-  Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging (2020-04-03 15:30:11 +0100)
+The following changes since commit ba54a7e6b86884e43bed2d2f5a79c719059652a8:
   Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2024-11-26 14:06:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200406
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20241126
-for you to fetch changes up to 8893790966d9c964557ad01be4a68ef50696ace8:
+for you to fetch changes up to d8790ead55a2ef1e65332ebec63ae3c5db598942:
-  dma/xlnx-zdma: Reorg to fix CUR_DSCR (2020-04-06 10:59:56 +0100)
+  docs/system/arm/aspeed: add missing model supermicrox11spi-bmc (2024-11-26 16:22:38 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * don't expose "ieee_half" via gdbstub (prevents gdb crashes or errors
+ * target/arm/tcg/cpu32.c: swap ATCM and BTCM register names
-   with older GDB versions)
+ * docs/system/arm: Fix broken links and missing feature names
  * hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
  * PSTATE.PAN should not clear exec bits
  * hw/gpio/aspeed_gpio.c: Don't directly include assert.h
    (fixes compilation on some Windows build scenarios)
  * dump: Fix writing of ELF section
  * dma/xlnx-zdma: various bug fixes
  * target/arm/helperc. delete obsolete TODO comment
 ----------------------------------------------------------------
-Alex Bennée (1):
+Michael Tokarev (1):
-      target/arm: don't expose "ieee_half" via gdbstub
+      target/arm/tcg/cpu32.c: swap ATCM and BTCM register names
-Edgar E. Iglesias (5):
+Pierrick Bouvier (8):
-      dma/xlnx-zdma: Remove comment
+      docs/system/arm/emulation: mention armv9
-      dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE
+      docs/system/arm/emulation: fix typo in feature name
-      dma/xlnx-zdma: Clear DMA_DONE when halting
+      docs/system/arm/emulation: add FEAT_SSBS2
-      dma/xlnx-zdma: Advance the descriptor address when stopping
+      target/arm/tcg/: fix typo in FEAT name
-      dma/xlnx-zdma: Reorg to fix CUR_DSCR
+      docs/system/arm/: add FEAT_MTE_ASYNC
       docs/system/arm/: add FEAT_DoubleLock
       docs/system/arm/fby35: update link to product page
       docs/system/arm/aspeed: add missing model supermicrox11spi-bmc
-Peter Maydell (5):
+ docs/system/arm/aspeed.rst    |  7 ++++---
-      hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
+ docs/system/arm/emulation.rst | 11 +++++++----
-      target/arm: PSTATE.PAN should not clear exec bits
+ docs/system/arm/fby35.rst     |  2 +-
-      target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
+ target/arm/tcg/cpu32.c        |  6 +++---
-      hw/gpio/aspeed_gpio.c: Don't directly include assert.h
+files changed, 15 insertions(+), 11 deletions(-)
       dump: Fix writing of ELF section
  dump/dump.c           |  2 +-
  hw/arm/collie.c       | 33 +++++++++++++++++++++++++-----
  hw/dma/xlnx-zdma.c    | 56 ++++++++++++++++++++++++++-------------------------
  hw/gpio/aspeed_gpio.c |  2 --
  target/arm/gdbstub.c  |  7 ++++++-
  target/arm/helper.c   | 13 +++++-------
 files changed, 69 insertions(+), 44 deletions(-)

-[PULL 05/11] hw/gpio/aspeed_gpio.c: Don't directly include assert.h
+[PULL 1/9] target/arm/tcg/cpu32.c: swap ATCM and BTCM register names
-Remove a direct include of assert.h -- this is already
+From: Michael Tokarev <mjt@tls.msk.ru>
 provided by qemu/osdep.h, and it breaks our rule that the
 first include must always be osdep.h.
-In particular we must get the assert() macro via osdep.h
+According to Cortex-R5 r1p2 manual, register with opcode2=0 is
-to avoid compile failures on mingw (see the comment in
+BTCM and with opcode2=1 is ATCM, - exactly the opposite from how
-osdep.h where we redefine assert() for that platform).
+qemu labels them.  Just swap the labels to avoid confusion, -
 both registers are implemented as always-zero.
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241121171602.3273252-1-mjt@tls.msk.ru
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20200403124712.24826-1-peter.maydell@linaro.org
 ---
- hw/gpio/aspeed_gpio.c | 2 --
+ target/arm/tcg/cpu32.c | 4 ++--
-file changed, 2 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
+diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/aspeed_gpio.c
+--- a/target/arm/tcg/cpu32.c
-+++ b/hw/gpio/aspeed_gpio.c
++++ b/target/arm/tcg/cpu32.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
-  * SPDX-License-Identifier: GPL-2.0-or-later
-  */
+ static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
+     /* Dummy the TCM region regs for the moment */
--#include <assert.h>
+-    { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
--
++    { .name = "BTCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
- #include "qemu/osdep.h"
+       .access = PL1_RW, .type = ARM_CP_CONST },
- #include "qemu/host-utils.h"
+-    { .name = "BTCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
- #include "qemu/log.h"
++    { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
        .access = PL1_RW, .type = ARM_CP_CONST },
      { .name = "DCACHE_INVAL", .cp = 15, .opc1 = 0, .crn = 15, .crm = 5,
        .opc2 = 0, .access = PL1_W, .type = ARM_CP_NOP },
 --
-.20.1
+.34.1

-[PULL 04/11] target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
+[PULL 2/9] docs/system/arm/emulation: mention armv9
-An old comment in get_phys_addr_lpae() claims that the code does not
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 support the different format TCR for VTCR_EL2.  This used to be true
 but it is not true now (in particular the aa64_va_parameters() and
 aa32_va_parameters() functions correctly handle the different
 register format by checking whether the mmu_idx is Stage2).
 Remove the out of date parts of the comment.
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241122225049.1617774-2-pierrick.bouvier@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200331143407.3186-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 7 +------
+ docs/system/arm/emulation.rst | 6 +++---
-file changed, 1 insertion(+), 6 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/docs/system/arm/emulation.rst
-+++ b/target/arm/helper.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@
-     bool aarch64 = arm_el_is_aa64(env, el);
+ A-profile CPU architecture support
-     bool guarded = false;
+ ==================================
--    /* TODO:
+-QEMU's TCG emulation includes support for the Armv5, Armv6, Armv7 and
--     * This code does not handle the different format TCR for VTCR_EL2.
+-Armv8 versions of the A-profile architecture. It also has support for
--     * This code also does not support shareability levels.
++QEMU's TCG emulation includes support for the Armv5, Armv6, Armv7,
--     * Attribute and permission bit handling should also be checked when adding
++Armv8 and Armv9 versions of the A-profile architecture. It also has support for
--     * support for those page table walks.
+ the following architecture extensions:
--     */
-+    /* TODO: This code does not support shareability levels. */
+ - FEAT_AA32BF16 (AArch32 BFloat16 instructions)
-     if (aarch64) {
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-         param = aa64_va_parameters(env, address, mmu_idx,
+ - FEAT_XNX (Translation table stage 2 Unprivileged Execute-never)
-                                    access_type != MMU_INST_FETCH);
  For information on the specifics of these extensions, please refer
 -to the `Armv8-A Arm Architecture Reference Manual
 +to the `Arm Architecture Reference Manual for A-profile architecture
  <https://developer.arm.com/documentation/ddi0487/latest>`_.
  When a specific named CPU is being emulated, only those features which
 --
-.20.1
+.34.1

-[PULL 11/11] dma/xlnx-zdma: Reorg to fix CUR_DSCR
+[PULL 3/9] docs/system/arm/emulation: fix typo in feature name
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Reorganize the descriptor handling so that CUR_DSCR always
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-points to the next descriptor to be processed.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241122225049.1617774-3-pierrick.bouvier@linaro.org
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Message-id: 20200402134721.27863-6-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 47 ++++++++++++++++++++++------------------------
+ docs/system/arm/emulation.rst | 2 +-
-file changed, 22 insertions(+), 25 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/dma/xlnx-zdma.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void zdma_load_src_descriptor(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-     }
+ - FEAT_LSE2 (Large System Extensions v2)
- }
+ - FEAT_LVA (Large Virtual Address space)
+ - FEAT_MixedEnd (Mixed-endian support)
-+static void zdma_update_descr_addr(XlnxZDMA *s, bool type,
+-- FEAT_MixdEndEL0 (Mixed-endian support at EL0)
-+                                   unsigned int basereg)
++- FEAT_MixedEndEL0 (Mixed-endian support at EL0)
-+{
+ - FEAT_MOPS (Standardization of memory operations)
-+    uint64_t addr, next;
+ - FEAT_MTE (Memory Tagging Extension)
-+
+ - FEAT_MTE2 (Memory Tagging Extension)
 +    if (type == DTYPE_LINEAR) {
 +        addr = zdma_get_regaddr64(s, basereg);
 +        next = addr + sizeof(s->dsc_dst);
 +    } else {
 +        addr = zdma_get_regaddr64(s, basereg);
 +        addr += sizeof(s->dsc_dst);
 +        address_space_read(s->dma_as, addr, s->attr, (void *) &next, 8);
 +    }
 +
 +    zdma_put_regaddr64(s, basereg, next);
 +}
 +
  static void zdma_load_dst_descriptor(XlnxZDMA *s)
  {
      uint64_t dst_addr;
      unsigned int ptype = ARRAY_FIELD_EX32(s->regs, ZDMA_CH_CTRL0, POINT_TYPE);
 +    bool dst_type;
      if (ptype == PT_REG) {
          memcpy(&s->dsc_dst, &s->regs[R_ZDMA_CH_DST_DSCR_WORD0],
@@ -XXX,XX +XXX,XX @@ static void zdma_load_dst_descriptor(XlnxZDMA *s)
      if (!zdma_load_descriptor(s, dst_addr, &s->dsc_dst)) {
          ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, AXI_RD_DST_DSCR, true);
      }
 -}
 -static uint64_t zdma_update_descr_addr(XlnxZDMA *s, bool type,
 -                                       unsigned int basereg)
 -{
 -    uint64_t addr, next;
 -
 -    if (type == DTYPE_LINEAR) {
 -        next = zdma_get_regaddr64(s, basereg);
 -        next += sizeof(s->dsc_dst);
 -        zdma_put_regaddr64(s, basereg, next);
 -    } else {
 -        addr = zdma_get_regaddr64(s, basereg);
 -        addr += sizeof(s->dsc_dst);
 -        address_space_read(s->dma_as, addr, s->attr, &next, 8);
 -        zdma_put_regaddr64(s, basereg, next);
 -    }
 -    return next;
 +    /* Advance the descriptor pointer.  */
 +    dst_type = FIELD_EX32(s->dsc_dst.words[3], ZDMA_CH_DST_DSCR_WORD3, TYPE);
 +    zdma_update_descr_addr(s, dst_type, R_ZDMA_CH_DST_CUR_DSCR_LSB);
  }
  static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
@@ -XXX,XX +XXX,XX @@ static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
          dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                                SIZE);
          if (dst_size == 0 && ptype == PT_MEM) {
 -            uint64_t next;
 -            bool dst_type = FIELD_EX32(s->dsc_dst.words[3],
 -                                       ZDMA_CH_DST_DSCR_WORD3,
 -                                       TYPE);
 -
 -            next = zdma_update_descr_addr(s, dst_type,
 -                                          R_ZDMA_CH_DST_CUR_DSCR_LSB);
 -            zdma_load_descriptor(s, next, &s->dsc_dst);
 +            zdma_load_dst_descriptor(s);
              dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                                    SIZE);
          }
 --
-.20.1
+.34.1

-[PULL 10/11] dma/xlnx-zdma: Advance the descriptor address when stopping
+[PULL 4/9] docs/system/arm/emulation: add FEAT_SSBS2
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Advance the descriptor address when stopping the channel.
+We implemented this at the same times as FEAT_SSBS, but forgot
 to list it in the documentation.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20241122225049.1617774-4-pierrick.bouvier@linaro.org
-Message-id: 20200402134721.27863-5-edgar.iglesias@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: improve commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 1 -
+ docs/system/arm/emulation.rst | 1 +
-file changed, 1 deletion(-)
+file changed, 1 insertion(+)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/dma/xlnx-zdma.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void zdma_process_descr(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-     if (ptype == PT_REG || src_cmd == CMD_STOP) {
+ - FEAT_SVE2 (Scalable Vector Extension version 2)
-         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_CTRL2, EN, 0);
+ - FEAT_SPECRES (Speculation restriction instructions)
-         zdma_set_state(s, DISABLED);
+ - FEAT_SSBS (Speculative Store Bypass Safe)
--        return;
++- FEAT_SSBS2 (MRS and MSR instructions for SSBS version 2)
-     }
+ - FEAT_TGran16K (Support for 16KB memory translation granule size at stage 1)
+ - FEAT_TGran4K (Support for 4KB memory translation granule size at stage 1)
-     if (src_cmd == CMD_HALT) {
+ - FEAT_TGran64K (Support for 64KB memory translation granule size at stage 1)
 --
-.20.1
+.34.1

-[PULL 08/11] dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE
+[PULL 5/9] target/arm/tcg/: fix typo in FEAT name
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Populate DBG0.CMN_BUF_FREE so that SW can see some free space.
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20241122225049.1617774-5-pierrick.bouvier@linaro.org
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Message-id: 20200402134721.27863-3-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 6 ++++++
+ target/arm/tcg/cpu32.c | 2 +-
-file changed, 6 insertions(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/target/arm/tcg/cpu32.c
-+++ b/hw/dma/xlnx-zdma.c
++++ b/target/arm/tcg/cpu32.c
-@@ -XXX,XX +XXX,XX @@ static RegisterAccessInfo zdma_regs_info[] = {
+@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
-     },{ .name = "ZDMA_CH_DBG0",  .addr = A_ZDMA_CH_DBG0,
+     cpu->isar.id_mmfr5 = t;
-         .rsvd = 0xfffffe00,
-         .ro = 0x1ff,
+     t = cpu->isar.id_pfr0;
-+
+-    t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CVS2 */
-+        /*
++    t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CSV2 */
-+         * There's SW out there that will check the debug regs for free space.
+     t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
-+         * Claim that we always have 0x100 free.
+     t = FIELD_DP32(t, ID_PFR0, RAS, 1);           /* FEAT_RAS */
-+         */
+     cpu->isar.id_pfr0 = t;
 +        .reset = 0x100
      },{ .name = "ZDMA_CH_DBG1",  .addr = A_ZDMA_CH_DBG1,
          .rsvd = 0xfffffe00,
          .ro = 0x1ff,
 --
-.20.1
+.34.1

-[PULL 09/11] dma/xlnx-zdma: Clear DMA_DONE when halting
+[PULL 6/9] docs/system/arm/: add FEAT_MTE_ASYNC
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Clear DMA_DONE when halting the DMA channel.
+We already implement FEAT_MTE_ASYNC; we just forgot to list it
 in the documentation.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20241122225049.1617774-6-pierrick.bouvier@linaro.org
-Message-id: 20200402134721.27863-4-edgar.iglesias@gmail.com
+[PMM: expand commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 1 +
+ docs/system/arm/emulation.rst | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/dma/xlnx-zdma.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void zdma_process_descr(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-     if (src_cmd == CMD_HALT) {
+ - FEAT_MTE2 (Memory Tagging Extension)
-         zdma_set_state(s, PAUSED);
+ - FEAT_MTE3 (MTE Asymmetric Fault Handling)
-         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, DMA_PAUSE, 1);
+ - FEAT_MTE_ASYM_FAULT (Memory tagging asymmetric faults)
-+        ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, DMA_DONE, false);
++- FEAT_MTE_ASYNC (Asynchronous reporting of Tag Check Fault)
-         zdma_ch_imr_update_irq(s);
+ - FEAT_NMI (Non-maskable Interrupt)
-         return;
+ - FEAT_NV (Nested Virtualization)
-     }
+ - FEAT_NV2 (Enhanced nested virtualization support)
 --
-.20.1
+.34.1

-[PULL 07/11] dma/xlnx-zdma: Remove comment
+[PULL 7/9] docs/system/arm/: add FEAT_DoubleLock
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Remove comment.
+We already implement FEAT_DoubleLock (see commit f94a6df5dd6a7) when
 the ID registers call for it.  This feature is actually one that must
 *not* be implemented in v9.0, but since our documentation lists
 everything we can emulate, we should include FEAT_DoubleLock in the
 list.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20241122225049.1617774-7-pierrick.bouvier@linaro.org
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200402134721.27863-2-edgar.iglesias@gmail.com
+[PMM: expand commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 1 -
+ docs/system/arm/emulation.rst | 1 +
-file changed, 1 deletion(-)
+file changed, 1 insertion(+)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/dma/xlnx-zdma.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static void zdma_process_descr(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-         zdma_src_done(s);
+ - FEAT_CSV3 (Cache speculation variant 3)
-     }
+ - FEAT_DGH (Data gathering hint)
+ - FEAT_DIT (Data Independent Timing instructions)
--    /* Load next descriptor.  */
++- FEAT_DoubleLock (Double Lock)
-     if (ptype == PT_REG || src_cmd == CMD_STOP) {
+ - FEAT_DPB (DC CVAP instruction)
-         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_CTRL2, EN, 0);
+ - FEAT_DPB2 (DC CVADP instruction)
-         zdma_set_state(s, DISABLED);
+ - FEAT_Debugv8p1 (Debug with VHE)
 --
-.20.1
+.34.1

-[PULL 06/11] dump: Fix writing of ELF section
+[PULL 8/9] docs/system/arm/fby35: update link to product page
-In write_elf_section() we set the 'shdr' pointer to point to local
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 structures shdr32 or shdr64, which we fill in to be written out to
 the ELF dump.  Unfortunately the address we pass to fd_write_vmcore()
 has a spurious '&' operator, so instead of writing out the section
 header we write out the literal pointer value followed by whatever is
 on the stack after the 'shdr' local variable.
-Pass the correct address into fd_write_vmcore().
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Spotted by Coverity: CID 1421970.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Cc: qemu-stable@nongnu.org
+Message-id: 20241122225049.1617774-8-pierrick.bouvier@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20200324173630.12221-1-peter.maydell@linaro.org
 ---
- dump/dump.c | 2 +-
+ docs/system/arm/fby35.rst | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/dump/dump.c b/dump/dump.c
+diff --git a/docs/system/arm/fby35.rst b/docs/system/arm/fby35.rst
 index XXXXXXX..XXXXXXX 100644
---- a/dump/dump.c
+--- a/docs/system/arm/fby35.rst
-+++ b/dump/dump.c
++++ b/docs/system/arm/fby35.rst
-@@ -XXX,XX +XXX,XX @@ static void write_elf_section(DumpState *s, int type, Error **errp)
+@@ -XXX,XX +XXX,XX @@ include various compute accelerators (video, inferencing, etc). At the moment,
-         shdr = &shdr64;
+ only the first server slot's BIC is included.
-     }
+ Yosemite v3.5 is itself a sled which fits into a 40U chassis, and 3 sleds
--    ret = fd_write_vmcore(&shdr, shdr_size, s);
+-can be fit into a chassis. See `here <https://www.opencompute.org/products/423/wiwynn-yosemite-v3-server>`__
-+    ret = fd_write_vmcore(shdr, shdr_size, s);
++can be fit into a chassis. See `here <https://www.opencompute.org/products-chiplets/237/wiwynn-yosemite-v3-server>`__
-     if (ret < 0) {
+ for an example.
-         error_setg_errno(errp, -ret,
-                          "dump: failed to write section header table");
+ In this generation, the BMC is an AST2600 and each BIC is an AST1030. The BMC
 --
-.20.1
+.34.1

-[PULL 01/11] target/arm: don't expose "ieee_half" via gdbstub
+[PULL 9/9] docs/system/arm/aspeed: add missing model supermicrox11spi-bmc
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-While support for parsing ieee_half in the XML description was added
+Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-to gdb in 2019 (a6d0f249) there is no easy way for the gdbstub to know
+Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
-if the gdb end will understand it. Disable it for now and allow older
+Message-id: 20241122225049.1617774-13-pierrick.bouvier@linaro.org
 gdbs to successfully connect to the default -cpu max SVE enabled
 QEMUs.
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200402143913.24005-1-alex.bennee@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub.c | 7 ++++++-
+ docs/system/arm/aspeed.rst | 7 ++++---
-file changed, 6 insertions(+), 1 deletion(-)
+file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
+diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub.c
+--- a/docs/system/arm/aspeed.rst
-+++ b/target/arm/gdbstub.c
++++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ static const struct TypeSize vec_lanes[] = {
+@@ -XXX,XX +XXX,XX @@
-     /* 16 bit */
+-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``tiogapass-bmc``, ``tacoma-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-     { "uint16", 16, 'h', 'u' },
+-========================================================================================================================================================================================================================================================================================================================================================================================================
-     { "int16", 16, 'h', 's' },
++Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``tacoma-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
--    { "ieee_half", 16, 'h', 'f' },
++==================================================================================================================================================================================================================================================================================================================================================================================================================================
-+    /*
-+     * TODO: currently there is no reliable way of telling
+ The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
-+     * if the remote gdb actually understands ieee_half so
+ Aspeed evaluation boards. They are based on different releases of the
-+     * we don't expose it in the target description for now.
+@@ -XXX,XX +XXX,XX @@ AST2400 SoC based machines :
-+     * { "ieee_half", 16, 'h', 'f' },
-+     */
+ - ``palmetto-bmc``         OpenPOWER Palmetto POWER8 BMC
-     /* bytes */
+ - ``quanta-q71l-bmc``      OpenBMC Quanta BMC
-     { "uint8", 8, 'b', 'u' },
+-- ``supermicrox11-bmc``    Supermicro X11 BMC
-     { "int8", 8, 'b', 's' },
++- ``supermicrox11-bmc``    Supermicro X11 BMC (ARM926EJ-S)
 +- ``supermicrox11spi-bmc``    Supermicro X11 SPI BMC (ARM1176)
  AST2500 SoC based machines :
 --
-.20.1
+.34.1

-[PULL 02/11] hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
+Deleted patch
-Coverity complains that the collie_init() function leaks the memory
-allocated in sa1110_init().  This is true but not significant since
-the function is called only once on machine init and the memory must
-remain in existence until QEMU exits anyway.
-Still, we can avoid the technical memory leak by keeping the pointer
-to the StrongARMState inside the machine state struct.  Switch from
-the simple DEFINE_MACHINE() style to defining a subclass of
-TYPE_MACHINE which extends the MachineState struct, and keep the
-pointer there.
-Fixes: CID 1421921
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20200326204919.22006-1-peter.maydell@linaro.org
----
- hw/arm/collie.c | 33 ++++++++++++++++++++++++++++-----
-file changed, 28 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/collie.c b/hw/arm/collie.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/collie.c
-+++ b/hw/arm/collie.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/address-spaces.h"
- #include "cpu.h"
-+typedef struct {
-+    MachineState parent;
-+
-+    StrongARMState *sa1110;
-+} CollieMachineState;
-+
-+#define TYPE_COLLIE_MACHINE MACHINE_TYPE_NAME("collie")
-+#define COLLIE_MACHINE(obj) \
-+    OBJECT_CHECK(CollieMachineState, obj, TYPE_COLLIE_MACHINE)
-+
- static struct arm_boot_info collie_binfo = {
-     .loader_start = SA_SDCS0,
-     .ram_size = 0x20000000,
-@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info collie_binfo = {
- static void collie_init(MachineState *machine)
- {
--    StrongARMState *s;
-     DriveInfo *dinfo;
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
-+    CollieMachineState *cms = COLLIE_MACHINE(machine);
-     if (machine->ram_size != mc->default_ram_size) {
-         char *sz = size_to_str(mc->default_ram_size);
-@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
-         exit(EXIT_FAILURE);
-     }
--    s = sa1110_init(machine->cpu_type);
-+    cms->sa1110 = sa1110_init(machine->cpu_type);
-     memory_region_add_subregion(get_system_memory(), SA_SDCS0, machine->ram);
-@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
-     sysbus_create_simple("scoop", 0x40800000, NULL);
-     collie_binfo.board_id = 0x208;
--    arm_load_kernel(s->cpu, machine, &collie_binfo);
-+    arm_load_kernel(cms->sa1110->cpu, machine, &collie_binfo);
- }
--static void collie_machine_init(MachineClass *mc)
-+static void collie_machine_class_init(ObjectClass *oc, void *data)
- {
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+
-     mc->desc = "Sharp SL-5500 (Collie) PDA (SA-1110)";
-     mc->init = collie_init;
-     mc->ignore_memory_transaction_failures = true;
-@@ -XXX,XX +XXX,XX @@ static void collie_machine_init(MachineClass *mc)
-     mc->default_ram_id = "strongarm.sdram";
- }
--DEFINE_MACHINE("collie", collie_machine_init)
-+static const TypeInfo collie_machine_typeinfo = {
-+    .name = TYPE_COLLIE_MACHINE,
-+    .parent = TYPE_MACHINE,
-+    .class_init = collie_machine_class_init,
-+    .instance_size = sizeof(CollieMachineState),
-+};
-+
-+static void collie_machine_register_types(void)
-+{
-+    type_register_static(&collie_machine_typeinfo);
-+}
-+type_init(collie_machine_register_types);
---
-.20.1

-[PULL 03/11] target/arm: PSTATE.PAN should not clear exec bits
+Deleted patch
-Our implementation of the PSTATE.PAN bit incorrectly cleared all
-access permission bits for privileged access to memory which is
-user-accessible.  It should only affect the privileged read and write
-permissions; execute permission is dealt with via XN/PXN instead.
-Fixes: 81636b70c226dc27d7ebc8d
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200330170651.20901-1-peter.maydell@linaro.org
----
- target/arm/helper.c | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-         prot_rw = user_rw;
-     } else {
-         if (user_rw && regime_is_pan(env, mmu_idx)) {
--            return 0;
-+            /* PAN forbids data accesses but doesn't affect insn fetch */
-+            prot_rw = 0;
-+        } else {
-+            prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-         }
--        prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-     }
-     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
---
-.20.1

A collection of bug fixes for rc2...

The following changes since commit 146aa0f104bb3bf88e43c4082a0bfc4bbda4fbd8:

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging (2020-04-03 15:30:11 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200406

for you to fetch changes up to 8893790966d9c964557ad01be4a68ef50696ace8:

dma/xlnx-zdma: Reorg to fix CUR_DSCR (2020-04-06 10:59:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * don't expose "ieee_half" via gdbstub (prevents gdb crashes or errors
   with older GDB versions)
 * hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
 * PSTATE.PAN should not clear exec bits
 * hw/gpio/aspeed_gpio.c: Don't directly include assert.h
   (fixes compilation on some Windows build scenarios)
 * dump: Fix writing of ELF section
 * dma/xlnx-zdma: various bug fixes
 * target/arm/helperc. delete obsolete TODO comment

----------------------------------------------------------------
Alex Bennée (1):
      target/arm: don't expose "ieee_half" via gdbstub

Edgar E. Iglesias (5):
      dma/xlnx-zdma: Remove comment
      dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE
      dma/xlnx-zdma: Clear DMA_DONE when halting
      dma/xlnx-zdma: Advance the descriptor address when stopping
      dma/xlnx-zdma: Reorg to fix CUR_DSCR

Peter Maydell (5):
      hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
      target/arm: PSTATE.PAN should not clear exec bits
      target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
      hw/gpio/aspeed_gpio.c: Don't directly include assert.h
      dump: Fix writing of ELF section

From: Alex Bennée <alex.bennee@linaro.org>

While support for parsing ieee_half in the XML description was added
to gdb in 2019 (a6d0f249) there is no easy way for the gdbstub to know
if the gdb end will understand it. Disable it for now and allow older
gdbs to successfully connect to the default -cpu max SVE enabled
QEMUs.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200402143913.24005-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static const struct TypeSize vec_lanes[] = {
     /* 16 bit */
     { "uint16", 16, 'h', 'u' },
     { "int16", 16, 'h', 's' },
-    { "ieee_half", 16, 'h', 'f' },
+    /*
+     * TODO: currently there is no reliable way of telling
+     * if the remote gdb actually understands ieee_half so
+     * we don't expose it in the target description for now.
+     * { "ieee_half", 16, 'h', 'f' },
+     */
     /* bytes */
     { "uint8", 8, 'b', 'u' },
     { "int8", 8, 'b', 's' },
-- 
2.20.1

Coverity complains that the collie_init() function leaks the memory
allocated in sa1110_init().  This is true but not significant since
the function is called only once on machine init and the memory must
remain in existence until QEMU exits anyway.

Still, we can avoid the technical memory leak by keeping the pointer
to the StrongARMState inside the machine state struct.  Switch from
the simple DEFINE_MACHINE() style to defining a subclass of
TYPE_MACHINE which extends the MachineState struct, and keep the
pointer there.

Fixes: CID 1421921
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200326204919.22006-1-peter.maydell@linaro.org
---
 hw/arm/collie.c | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "cpu.h"
 
+typedef struct {
+    MachineState parent;
+
+    StrongARMState *sa1110;
+} CollieMachineState;
+
+#define TYPE_COLLIE_MACHINE MACHINE_TYPE_NAME("collie")
+#define COLLIE_MACHINE(obj) \
+    OBJECT_CHECK(CollieMachineState, obj, TYPE_COLLIE_MACHINE)
+
 static struct arm_boot_info collie_binfo = {
     .loader_start = SA_SDCS0,
     .ram_size = 0x20000000,
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info collie_binfo = {
 
 static void collie_init(MachineState *machine)
 {
-    StrongARMState *s;
     DriveInfo *dinfo;
     MachineClass *mc = MACHINE_GET_CLASS(machine);
+    CollieMachineState *cms = COLLIE_MACHINE(machine);
 
     if (machine->ram_size != mc->default_ram_size) {
         char *sz = size_to_str(mc->default_ram_size);
@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
-    s = sa1110_init(machine->cpu_type);
+    cms->sa1110 = sa1110_init(machine->cpu_type);
 
     memory_region_add_subregion(get_system_memory(), SA_SDCS0, machine->ram);
 
@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
     sysbus_create_simple("scoop", 0x40800000, NULL);
 
     collie_binfo.board_id = 0x208;
-    arm_load_kernel(s->cpu, machine, &collie_binfo);
+    arm_load_kernel(cms->sa1110->cpu, machine, &collie_binfo);
 }
 
-static void collie_machine_init(MachineClass *mc)
+static void collie_machine_class_init(ObjectClass *oc, void *data)
 {
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Sharp SL-5500 (Collie) PDA (SA-1110)";
     mc->init = collie_init;
     mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ static void collie_machine_init(MachineClass *mc)
     mc->default_ram_id = "strongarm.sdram";
 }
 
-DEFINE_MACHINE("collie", collie_machine_init)
+static const TypeInfo collie_machine_typeinfo = {
+    .name = TYPE_COLLIE_MACHINE,
+    .parent = TYPE_MACHINE,
+    .class_init = collie_machine_class_init,
+    .instance_size = sizeof(CollieMachineState),
+};
+
+static void collie_machine_register_types(void)
+{
+    type_register_static(&collie_machine_typeinfo);
+}
+type_init(collie_machine_register_types);
-- 
2.20.1

Our implementation of the PSTATE.PAN bit incorrectly cleared all
access permission bits for privileged access to memory which is
user-accessible.  It should only affect the privileged read and write
permissions; execute permission is dealt with via XN/PXN instead.

Fixes: 81636b70c226dc27d7ebc8d
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200330170651.20901-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         prot_rw = user_rw;
     } else {
         if (user_rw && regime_is_pan(env, mmu_idx)) {
-            return 0;
+            /* PAN forbids data accesses but doesn't affect insn fetch */
+            prot_rw = 0;
+        } else {
+            prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
         }
-        prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
     }
 
     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
-- 
2.20.1

An old comment in get_phys_addr_lpae() claims that the code does not
support the different format TCR for VTCR_EL2.  This used to be true
but it is not true now (in particular the aa64_va_parameters() and
aa32_va_parameters() functions correctly handle the different
register format by checking whether the mmu_idx is Stage2).
Remove the out of date parts of the comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200331143407.3186-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
     bool aarch64 = arm_el_is_aa64(env, el);
     bool guarded = false;
 
-    /* TODO:
-     * This code does not handle the different format TCR for VTCR_EL2.
-     * This code also does not support shareability levels.
-     * Attribute and permission bit handling should also be checked when adding
-     * support for those page table walks.
-     */
+    /* TODO: This code does not support shareability levels. */
     if (aarch64) {
         param = aa64_va_parameters(env, address, mmu_idx,
                                    access_type != MMU_INST_FETCH);
-- 
2.20.1

In write_elf_section() we set the 'shdr' pointer to point to local
structures shdr32 or shdr64, which we fill in to be written out to
the ELF dump.  Unfortunately the address we pass to fd_write_vmcore()
has a spurious '&' operator, so instead of writing out the section
header we write out the literal pointer value followed by whatever is
on the stack after the 'shdr' local variable.

Pass the correct address into fd_write_vmcore().

Spotted by Coverity: CID 1421970.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200324173630.12221-1-peter.maydell@linaro.org
---
 dump/dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dump/dump.c b/dump/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump/dump.c
+++ b/dump/dump.c
@@ -XXX,XX +XXX,XX @@ static void write_elf_section(DumpState *s, int type, Error **errp)
         shdr = &shdr64;
     }
 
-    ret = fd_write_vmcore(&shdr, shdr_size, s);
+    ret = fd_write_vmcore(shdr, shdr_size, s);
     if (ret < 0) {
         error_setg_errno(errp, -ret,
                          "dump: failed to write section header table");
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Populate DBG0.CMN_BUF_FREE so that SW can see some free space.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20200402134721.27863-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xlnx-zdma.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx-zdma.c
+++ b/hw/dma/xlnx-zdma.c
@@ -XXX,XX +XXX,XX @@ static RegisterAccessInfo zdma_regs_info[] = {
     },{ .name = "ZDMA_CH_DBG0",  .addr = A_ZDMA_CH_DBG0,
         .rsvd = 0xfffffe00,
         .ro = 0x1ff,
+
+        /*
+         * There's SW out there that will check the debug regs for free space.
+         * Claim that we always have 0x100 free.
+         */
+        .reset = 0x100
     },{ .name = "ZDMA_CH_DBG1",  .addr = A_ZDMA_CH_DBG1,
         .rsvd = 0xfffffe00,
         .ro = 0x1ff,
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Reorganize the descriptor handling so that CUR_DSCR always
points to the next descriptor to be processed.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20200402134721.27863-6-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xlnx-zdma.c | 47 ++++++++++++++++++++++------------------------
 1 file changed, 22 insertions(+), 25 deletions(-)

diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx-zdma.c
+++ b/hw/dma/xlnx-zdma.c
@@ -XXX,XX +XXX,XX @@ static void zdma_load_src_descriptor(XlnxZDMA *s)
     }
 }
 
+static void zdma_update_descr_addr(XlnxZDMA *s, bool type,
+                                   unsigned int basereg)
+{
+    uint64_t addr, next;
+
+    if (type == DTYPE_LINEAR) {
+        addr = zdma_get_regaddr64(s, basereg);
+        next = addr + sizeof(s->dsc_dst);
+    } else {
+        addr = zdma_get_regaddr64(s, basereg);
+        addr += sizeof(s->dsc_dst);
+        address_space_read(s->dma_as, addr, s->attr, (void *) &next, 8);
+    }
+
+    zdma_put_regaddr64(s, basereg, next);
+}
+
 static void zdma_load_dst_descriptor(XlnxZDMA *s)
 {
     uint64_t dst_addr;
     unsigned int ptype = ARRAY_FIELD_EX32(s->regs, ZDMA_CH_CTRL0, POINT_TYPE);
+    bool dst_type;
 
     if (ptype == PT_REG) {
         memcpy(&s->dsc_dst, &s->regs[R_ZDMA_CH_DST_DSCR_WORD0],
@@ -XXX,XX +XXX,XX @@ static void zdma_load_dst_descriptor(XlnxZDMA *s)
     if (!zdma_load_descriptor(s, dst_addr, &s->dsc_dst)) {
         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, AXI_RD_DST_DSCR, true);
     }
-}
 
-static uint64_t zdma_update_descr_addr(XlnxZDMA *s, bool type,
-                                       unsigned int basereg)
-{
-    uint64_t addr, next;
-
-    if (type == DTYPE_LINEAR) {
-        next = zdma_get_regaddr64(s, basereg);
-        next += sizeof(s->dsc_dst);
-        zdma_put_regaddr64(s, basereg, next);
-    } else {
-        addr = zdma_get_regaddr64(s, basereg);
-        addr += sizeof(s->dsc_dst);
-        address_space_read(s->dma_as, addr, s->attr, &next, 8);
-        zdma_put_regaddr64(s, basereg, next);
-    }
-    return next;
+    /* Advance the descriptor pointer.  */
+    dst_type = FIELD_EX32(s->dsc_dst.words[3], ZDMA_CH_DST_DSCR_WORD3, TYPE);
+    zdma_update_descr_addr(s, dst_type, R_ZDMA_CH_DST_CUR_DSCR_LSB);
 }
 
 static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
@@ -XXX,XX +XXX,XX @@ static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
         dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                               SIZE);
         if (dst_size == 0 && ptype == PT_MEM) {
-            uint64_t next;
-            bool dst_type = FIELD_EX32(s->dsc_dst.words[3],
-                                       ZDMA_CH_DST_DSCR_WORD3,
-                                       TYPE);
-
-            next = zdma_update_descr_addr(s, dst_type,
-                                          R_ZDMA_CH_DST_CUR_DSCR_LSB);
-            zdma_load_descriptor(s, next, &s->dsc_dst);
+            zdma_load_dst_descriptor(s);
             dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                                   SIZE);
         }
-- 
2.20.1

This one's almost all docs fixes.

thanks
-- PMM

The following changes since commit ba54a7e6b86884e43bed2d2f5a79c719059652a8:

Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2024-11-26 14:06:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20241126

for you to fetch changes up to d8790ead55a2ef1e65332ebec63ae3c5db598942:

docs/system/arm/aspeed: add missing model supermicrox11spi-bmc (2024-11-26 16:22:38 +0000)

----------------------------------------------------------------
target-arm queue:
 * target/arm/tcg/cpu32.c: swap ATCM and BTCM register names
 * docs/system/arm: Fix broken links and missing feature names

----------------------------------------------------------------
Michael Tokarev (1):
      target/arm/tcg/cpu32.c: swap ATCM and BTCM register names

Pierrick Bouvier (8):
      docs/system/arm/emulation: mention armv9
      docs/system/arm/emulation: fix typo in feature name
      docs/system/arm/emulation: add FEAT_SSBS2
      target/arm/tcg/: fix typo in FEAT name
      docs/system/arm/: add FEAT_MTE_ASYNC
      docs/system/arm/: add FEAT_DoubleLock
      docs/system/arm/fby35: update link to product page
      docs/system/arm/aspeed: add missing model supermicrox11spi-bmc

docs/system/arm/aspeed.rst    |  7 ++++---
 docs/system/arm/emulation.rst | 11 +++++++----
 docs/system/arm/fby35.rst     |  2 +-
 target/arm/tcg/cpu32.c        |  6 +++---
 4 files changed, 15 insertions(+), 11 deletions(-)

From: Michael Tokarev <mjt@tls.msk.ru>

According to Cortex-R5 r1p2 manual, register with opcode2=0 is
BTCM and with opcode2=1 is ATCM, - exactly the opposite from how
qemu labels them.  Just swap the labels to avoid confusion, -
both registers are implemented as always-zero.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241121171602.3273252-1-mjt@tls.msk.ru
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu32.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
 
 static const ARMCPRegInfo cortexr5_cp_reginfo[] = {
     /* Dummy the TCM region regs for the moment */
-    { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
+    { .name = "BTCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
       .access = PL1_RW, .type = ARM_CP_CONST },
-    { .name = "BTCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
+    { .name = "ATCM", .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
       .access = PL1_RW, .type = ARM_CP_CONST },
     { .name = "DCACHE_INVAL", .cp = 15, .opc1 = 0, .crn = 15, .crm = 5,
       .opc2 = 0, .access = PL1_W, .type = ARM_CP_NOP },
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-2-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@
 A-profile CPU architecture support
 ==================================
 
-QEMU's TCG emulation includes support for the Armv5, Armv6, Armv7 and
-Armv8 versions of the A-profile architecture. It also has support for
+QEMU's TCG emulation includes support for the Armv5, Armv6, Armv7,
+Armv8 and Armv9 versions of the A-profile architecture. It also has support for
 the following architecture extensions:
 
 - FEAT_AA32BF16 (AArch32 BFloat16 instructions)
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_XNX (Translation table stage 2 Unprivileged Execute-never)
 
 For information on the specifics of these extensions, please refer
-to the `Armv8-A Arm Architecture Reference Manual
+to the `Arm Architecture Reference Manual for A-profile architecture
 <https://developer.arm.com/documentation/ddi0487/latest>`_.
 
 When a specific named CPU is being emulated, only those features which
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

We implemented this at the same times as FEAT_SSBS, but forgot
to list it in the documentation.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-4-pierrick.bouvier@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: improve commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_SVE2 (Scalable Vector Extension version 2)
 - FEAT_SPECRES (Speculation restriction instructions)
 - FEAT_SSBS (Speculative Store Bypass Safe)
+- FEAT_SSBS2 (MRS and MSR instructions for SSBS version 2)
 - FEAT_TGran16K (Support for 16KB memory translation granule size at stage 1)
 - FEAT_TGran4K (Support for 4KB memory translation granule size at stage 1)
 - FEAT_TGran64K (Support for 64KB memory translation granule size at stage 1)
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-5-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
     cpu->isar.id_mmfr5 = t;
 
     t = cpu->isar.id_pfr0;
-    t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CVS2 */
+    t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CSV2 */
     t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
     t = FIELD_DP32(t, ID_PFR0, RAS, 1);           /* FEAT_RAS */
     cpu->isar.id_pfr0 = t;
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

We already implement FEAT_MTE_ASYNC; we just forgot to list it
in the documentation.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241122225049.1617774-6-pierrick.bouvier@linaro.org
[PMM: expand commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_MTE2 (Memory Tagging Extension)
 - FEAT_MTE3 (MTE Asymmetric Fault Handling)
 - FEAT_MTE_ASYM_FAULT (Memory tagging asymmetric faults)
+- FEAT_MTE_ASYNC (Asynchronous reporting of Tag Check Fault)
 - FEAT_NMI (Non-maskable Interrupt)
 - FEAT_NV (Nested Virtualization)
 - FEAT_NV2 (Enhanced nested virtualization support)
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

We already implement FEAT_DoubleLock (see commit f94a6df5dd6a7) when
the ID registers call for it.  This feature is actually one that must
*not* be implemented in v9.0, but since our documentation lists
everything we can emulate, we should include FEAT_DoubleLock in the
list.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20241122225049.1617774-7-pierrick.bouvier@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: expand commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_CSV3 (Cache speculation variant 3)
 - FEAT_DGH (Data gathering hint)
 - FEAT_DIT (Data Independent Timing instructions)
+- FEAT_DoubleLock (Double Lock)
 - FEAT_DPB (DC CVAP instruction)
 - FEAT_DPB2 (DC CVADP instruction)
 - FEAT_Debugv8p1 (Debug with VHE)
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241122225049.1617774-8-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/fby35.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/arm/fby35.rst b/docs/system/arm/fby35.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/fby35.rst
+++ b/docs/system/arm/fby35.rst
@@ -XXX,XX +XXX,XX @@ include various compute accelerators (video, inferencing, etc). At the moment,
 only the first server slot's BIC is included.
 
 Yosemite v3.5 is itself a sled which fits into a 40U chassis, and 3 sleds
-can be fit into a chassis. See `here <https://www.opencompute.org/products/423/wiwynn-yosemite-v3-server>`__
+can be fit into a chassis. See `here <https://www.opencompute.org/products-chiplets/237/wiwynn-yosemite-v3-server>`__
 for an example.
 
 In this generation, the BMC is an AST2600 and each BIC is an AST1030. The BMC
-- 
2.34.1

From: Pierrick Bouvier <pierrick.bouvier@linaro.org>

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Message-id: 20241122225049.1617774-13-pierrick.bouvier@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/aspeed.rst | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``tiogapass-bmc``, ``tacoma-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-========================================================================================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``tacoma-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+==================================================================================================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -XXX,XX +XXX,XX @@ AST2400 SoC based machines :
 
 - ``palmetto-bmc``         OpenPOWER Palmetto POWER8 BMC
 - ``quanta-q71l-bmc``      OpenBMC Quanta BMC
-- ``supermicrox11-bmc``    Supermicro X11 BMC
+- ``supermicrox11-bmc``    Supermicro X11 BMC (ARM926EJ-S)
+- ``supermicrox11spi-bmc``    Supermicro X11 SPI BMC (ARM1176)
 
 AST2500 SoC based machines :
 
-- 
2.34.1