Arm patch queue -- these are all bug fix patches but we might

as well put them in to rc0...

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

* fsl-imx6: Fix incorrect Ethernet interrupt defines

* dump: Update correct kdump phys_base field for AArch64

* char: i.MX: Add support for "TX complete" interrupt

* bcm2836/raspi: Fix various bugs resulting in panics trying

to boot a Debian Linux kernel on raspi3

Andrey Smirnov (2):

char: i.MX: Simplify imx_update()

char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):

fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):

hw/arm/raspi: Don't do board-setup or secure-boot for raspi3

hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64

hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE

hw/arm/bcm2386: Fix parent type of bcm2386

hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x

hw/arm/bcm2836: Create proper bcm2837 device

hw/arm/bcm2836: Use correct affinity values for BCM2837

hw/arm/bcm2836: Hardcode correct CPU type

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):

dump: Update correct kdump phys_base field for AArch64

include/hw/arm/bcm2836.h | 31 +++++++++++++---

include/hw/arm/fsl-imx6.h | 4 +-

include/hw/char/imx_serial.h | 3 ++

dump.c | 14 +++++--

hw/arm/bcm2836.c | 87 +++++++++++++++++++++++++++++++-------------

hw/arm/boot.c | 12 ++++++

hw/arm/raspi.c | 77 +++++++++++++++++++++++++++++++--------

hw/char/imx_serial.c | 44 ++++++++++++++++------

hw/net/imx_fec.c | 28 +++++++++++++-

9 files changed, 237 insertions(+), 63 deletions(-)

If we're directly booting a Linux kernel and the CPU supports both

EL3 and EL2, we start the kernel in EL2, as it expects. We must also

set the SCR_EL3.HCE bit in this situation, so that the HVC

instruction is enabled rather than UNDEFing. Otherwise at least some

kernels will panic when trying to initialize KVM in the guest.

hw/arm/boot.c | 5 +++++

1 file changed, 5 insertions(+)

@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)

assert(!info->secure_board_setup);

}

+ if (arm_feature(env, ARM_FEATURE_EL2)) {

+ /* If we have EL2 then Linux expects the HVC insn to work */

+ env->cp15.scr_el3 |= SCR_HCE;

+ }

+

/* Set to non-secure if not a secure boot */

if (!info->secure_boot &&

(cs != first_cpu || !info->secure_board_setup)) {

2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,

the board code has not mistakenly set either secure_boot or

secure_board_setup. It doesn't make sense to set secure_boot,

because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but

we don't currently support that, because only the AArch32

bootloader[] code calls this hook; bootloader_aarch64[] does not.

Since we don't have a current need for this functionality, just

assert that we don't try to use it. If it's needed we'll add

it later.

Message-id: 20180313153458.26822-3-peter.maydell@linaro.org

hw/arm/boot.c | 7 +++++++

1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c

--- a/hw/arm/boot.c

+++ b/hw/arm/boot.c

@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)

} else {

env->pstate = PSTATE_MODE_EL1h;

}

+ /* AArch64 kernels never boot in secure mode */

+ assert(!info->secure_boot);

+ /* This hook is only supported for AArch32 currently:

+ * bootloader_aarch64[] will not call the hook, and

+ * the code above has already dropped us into EL2 or EL1.

+ */

+ assert(!info->secure_board_setup);

}

/* Set to non-secure if not a secure boot */

2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have

some differences. Notably, the MPIDR affinity aff1 values it

sets for the CPUs are 0x0, rather than the 0xf that the bcm2836

uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that

configure it differently for the two cases, create two

separate QOM devices for the two SoCs. We use the same approach

as hw/arm/aspeed_soc.c and share code and have a data table

that might differ per-SoC. For the moment the two types don't

actually have different behaviour.

include/hw/arm/bcm2836.h | 19 +++++++++++++++++++

hw/arm/bcm2836.c | 37 ++++++++++++++++++++++++++++++++-----

hw/arm/raspi.c | 3 ++-

3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h

--- a/include/hw/arm/bcm2836.h

+++ b/include/hw/arm/bcm2836.h

@@ -XXX,XX +XXX,XX @@

#define BCM283X_NCPUS 4

+/* These type names are for specific SoCs; other than instantiating

+ * them, code using these devices should always handle them via the

+ * BCM283x base class, so they have no BCM2836(obj) etc macros.

+ */

+#define TYPE_BCM2836 "bcm2836"

+#define TYPE_BCM2837 "bcm2837"

typedef struct BCM283XState {

/*< private >*/

DeviceState parent_obj;

@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {

BCM2835PeripheralState peripherals;

} BCM283XState;

+typedef struct BCM283XInfo BCM283XInfo;

+typedef struct BCM283XClass {

+ DeviceClass parent_class;

+ const BCM283XInfo *info;

+} BCM283XClass;

+#define BCM283X_CLASS(klass) \

+ OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)

+#define BCM283X_GET_CLASS(obj) \

+ OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)

+

#endif /* BCM2836_H */

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/bcm2836.c

+++ b/hw/arm/bcm2836.c

@@ -XXX,XX +XXX,XX @@

/* "QA7" (Pi2) interrupt controller and mailboxes etc. */

#define BCM2836_CONTROL_BASE 0x40000000

+struct BCM283XInfo {

+ const char *name;

+};

+

+static const BCM283XInfo bcm283x_socs[] = {

+ {

+ .name = TYPE_BCM2836,

+ },

+ {

+ .name = TYPE_BCM2837,

+ },

+};

+

static void bcm2836_init(Object *obj)

BCM283XState *s = BCM283X(obj);

@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {

DEFINE_PROP_END_OF_LIST()

};

-static void bcm2836_class_init(ObjectClass *oc, void *data)

+static void bcm283x_class_init(ObjectClass *oc, void *data)

DeviceClass *dc = DEVICE_CLASS(oc);

+ BCM283XClass *bc = BCM283X_CLASS(oc);

- dc->props = bcm2836_props;

+ bc->info = data;

dc->realize = bcm2836_realize;

+ dc->props = bcm2836_props;

-static const TypeInfo bcm2836_type_info = {

+static const TypeInfo bcm283x_type_info = {

.name = TYPE_BCM283X,

.parent = TYPE_DEVICE,

.instance_size = sizeof(BCM283XState),

.instance_init = bcm2836_init,

- .class_init = bcm2836_class_init,

+ .class_size = sizeof(BCM283XClass),

+ .abstract = true,

};

static void bcm2836_register_types(void)

- type_register_static(&bcm2836_type_info);

+ int i;

+

+ type_register_static(&bcm283x_type_info);

+ for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {

+ TypeInfo ti = {

+ .name = bcm283x_socs[i].name,

+ .parent = TYPE_BCM283X,

+ .class_init = bcm283x_class_init,

+ .class_data = (void *) &bcm283x_socs[i],

+ };

+ type_register(&ti);

+ }

type_init(bcm2836_register_types)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)

BusState *bus;

DeviceState *carddev;

- object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);

+ object_initialize(&s->soc, sizeof(s->soc),

+ version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);

object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),

&error_abort);

2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable

doesn't really corespond to anything in real hardware and server as a

kitchensink accumulating events normally reported via USR1 and USR2

registers.

Change the code to explicitly evaluate state of interrupts reported

via USR1 and USR2 against corresponding masking bits and use the to

detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two

reasons:

1. Emulation code implements a single character FIFO, so this flag

will always be set since characters are trasmitted as a part of

the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing

of reported events, so checking for UTS1_TXEMPTY should happen,

if it's ever really needed should probably happen outside of

it.

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

Cc: Bill Paul <wpaul@windriver.com>

Cc: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>

Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com

hw/char/imx_serial.c | 24 ++++++++++++++++--------

1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c

--- a/hw/char/imx_serial.c

+++ b/hw/char/imx_serial.c

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {

static void imx_update(IMXSerialState *s)

- uint32_t flags;

+ uint32_t usr1;

+ uint32_t usr2;

+ uint32_t mask;

- flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);

- if (s->ucr1 & UCR1_TXMPTYEN) {

- flags |= (s->uts1 & UTS1_TXEMPTY);

- } else {

- flags &= ~USR1_TRDY;

- }

+ /*

+ * Lucky for us TRDY and RRDY has the same offset in both USR1 and

+ * UCR1, so we can get away with something as simple as the

+ * following:

+ */

+ usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);

+ /*

+ * Bits that we want in USR2 are not as conveniently laid out,

+ * unfortunately.

+ */

+ mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;

+ usr2 = s->usr2 & mask;

- qemu_set_irq(s->irq, !!flags);

+ qemu_set_irq(s->irq, usr1 || usr2);

static void imx_serial_reset(IMXSerialState *s)

2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot

code for keeping the secondary CPUs in a pen needs to have

a version for A64 as well as A32. Without this, the

secondary CPUs go into an infinite loop of taking undefined

instruction exceptions.

hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-

1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@

#define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */

#define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */

#define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */

+#define SPINTABLE_ADDR 0xd8 /* Pi 3 bootloader spintable */

/* Table of Linux board IDs for different Pi versions */

static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};

@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)

info->smp_loader_start);

+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)

+ /* Unlike the AArch32 version we don't need to call the board setup hook.

+ * The mechanism for doing the spin-table is also entirely different.

+ * We must have four 64-bit fields at absolute addresses

+ * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for

+ * our CPUs, and which we must ensure are zero initialized before

+ * the primary CPU goes into the kernel. We put these variables inside

+ * a rom blob, so that the reset for ROM contents zeroes them for us.

+ */

+ static const uint32_t smpboot[] = {

+ 0xd2801b05, /* mov x5, 0xd8 */

+ 0xd53800a6, /* mrs x6, mpidr_el1 */

+ 0x924004c6, /* and x6, x6, #0x3 */

+ 0xd503205f, /* spin: wfe */

+ 0xf86678a4, /* ldr x4, [x5,x6,lsl #3] */

+ 0xb4ffffc4, /* cbz x4, spin */

+ 0xd2800000, /* mov x0, #0x0 */

+ 0xd2800001, /* mov x1, #0x0 */

+ 0xd2800002, /* mov x2, #0x0 */

+ 0xd2800003, /* mov x3, #0x0 */

+ 0xd61f0080, /* br x4 */

+ };

+ static const uint64_t spintables[] = {

+ 0, 0, 0, 0

+ };

+ rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),

+ info->smp_loader_start);

+ rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),

+ SPINTABLE_ADDR);

static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)

arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);

@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)

/* Pi2 and Pi3 requires SMP setup */

if (version >= 2) {

binfo.smp_loader_start = SMPBOOT_ADDR;

- binfo.write_secondary_boot = write_smpboot;

+ if (version == 2) {

+ binfo.write_secondary_boot = write_smpboot;

+ } else {

+ binfo.write_secondary_boot = write_smpboot64;

+ }

binfo.secondary_cpu_reset_hook = reset_secondary;

2.16.2

Now we have separate types for BCM2386 and BCM2387, we might as well

just hard-code the CPU type they use rather than having it passed

through as an object property. This then lets us put the initialization

of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on

the command line to use -cpu to ask for a different kind of

CPU than the SoC supports. This was never a supported thing to

do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on

TARGET_AARCH64 configs, since otherwise it won't instantiate

due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20180313153458.26822-9-peter.maydell@linaro.org

---

hw/arm/bcm2836.c | 24 +++++++++++++++---------

hw/arm/raspi.c | 2 --

2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c

--- a/hw/arm/bcm2836.c

+++ b/hw/arm/bcm2836.c

@@ -XXX,XX +XXX,XX @@

struct BCM283XInfo {

const char *name;

+ const char *cpu_type;

int clusterid;

};

static const BCM283XInfo bcm283x_socs[] = {

{

.name = TYPE_BCM2836,

+ .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),

.clusterid = 0xf,

},

+#ifdef TARGET_AARCH64

{

.name = TYPE_BCM2837,

+ .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),

.clusterid = 0x0,

},

+#endif

};

static void bcm2836_init(Object *obj)

BCM283XState *s = BCM283X(obj);

+ BCM283XClass *bc = BCM283X_GET_CLASS(obj);

+ const BCM283XInfo *info = bc->info;

+ int n;

+

+ for (n = 0; n < BCM283X_NCPUS; n++) {

+ object_initialize(&s->cpus[n], sizeof(s->cpus[n]),

+ info->cpu_type);

+ object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),

+ &error_abort);

+ }

object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);

object_property_add_child(obj, "control", OBJECT(&s->control), NULL);

@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)

/* common peripherals from bcm2835 */

- obj = OBJECT(dev);

- for (n = 0; n < BCM283X_NCPUS; n++) {

- object_initialize(&s->cpus[n], sizeof(s->cpus[n]),

- s->cpu_type);

- object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),

- &error_abort);

- }

-

obj = object_property_get_link(OBJECT(dev), "ram", &err);

if (obj == NULL) {

error_setg(errp, "%s: required ram link not found: %s",

@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)

2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since

it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:

https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

Cc: Bill Paul <wpaul@windriver.com>

Cc: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Bill Paul <wpaul@windriver.com>

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>

Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com

include/hw/char/imx_serial.h | 3 +++

hw/char/imx_serial.c | 20 +++++++++++++++++---

2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h

--- a/include/hw/char/imx_serial.h

+++ b/include/hw/char/imx_serial.h

@@ -XXX,XX +XXX,XX @@

#define UCR2_RXEN (1<<1) /* Receiver enable */

#define UCR2_SRST (1<<0) /* Reset complete */

+#define UCR4_TCEN BIT(3) /* TX complete interrupt enable */

+

#define UTS1_TXEMPTY (1<<6)

#define UTS1_RXEMPTY (1<<5)

#define UTS1_TXFULL (1<<4)

@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {

uint32_t ubmr;

uint32_t ubrc;

uint32_t ucr3;

+ uint32_t ucr4;

qemu_irq irq;

CharBackend chr;

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c

--- a/hw/char/imx_serial.c

+++ b/hw/char/imx_serial.c

@@ -XXX,XX +XXX,XX @@

static const VMStateDescription vmstate_imx_serial = {

.name = TYPE_IMX_SERIAL,

- .version_id = 1,

- .minimum_version_id = 1,

+ .version_id = 2,

+ .minimum_version_id = 2,

.fields = (VMStateField[]) {

VMSTATE_INT32(readbuff, IMXSerialState),

VMSTATE_UINT32(usr1, IMXSerialState),

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {

VMSTATE_UINT32(ubmr, IMXSerialState),

VMSTATE_UINT32(ubrc, IMXSerialState),

VMSTATE_UINT32(ucr3, IMXSerialState),

+ VMSTATE_UINT32(ucr4, IMXSerialState),

VMSTATE_END_OF_LIST()

},

};

@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)

* unfortunately.

*/

mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;

+ /*

+ * TCEN and TXDC are both bit 3

+ */

+ mask |= s->ucr4 & UCR4_TCEN;

+

usr2 = s->usr2 & mask;

qemu_set_irq(s->irq, usr1 || usr2);

@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,

return s->ucr3;

case 0x23: /* UCR4 */

+ return s->ucr4;

+

case 0x29: /* BRM Incremental */

return 0x0; /* TODO */

@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,

* qemu_chr_fe_write and background I/O callbacks */

qemu_chr_fe_write_all(&s->chr, &ch, 1);

s->usr1 &= ~USR1_TRDY;

+ s->usr2 &= ~USR2_TXDC;

imx_update(s);

s->usr1 |= USR1_TRDY;

+ s->usr2 |= USR2_TXDC;

imx_update(s);

}

break;

@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,

s->ucr3 = value & 0xffff;

break;

- case 0x2d: /* UTS1 */

case 0x23: /* UCR4 */

+ s->ucr4 = value & 0xffff;

+ imx_update(s);

+ break;