Arm patch queue -- these are all bug fix patches but we might

as well put them in to rc0...

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

* fsl-imx6: Fix incorrect Ethernet interrupt defines

* dump: Update correct kdump phys_base field for AArch64

* char: i.MX: Add support for "TX complete" interrupt

* bcm2836/raspi: Fix various bugs resulting in panics trying

to boot a Debian Linux kernel on raspi3

Andrey Smirnov (2):

char: i.MX: Simplify imx_update()

char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):

fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):

hw/arm/raspi: Don't do board-setup or secure-boot for raspi3

hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64

hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE

hw/arm/bcm2386: Fix parent type of bcm2386

hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x

hw/arm/bcm2836: Create proper bcm2837 device

hw/arm/bcm2836: Use correct affinity values for BCM2837

hw/arm/bcm2836: Hardcode correct CPU type

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):

dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the

Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet

controller which is supported in QEMU using the imx_fec.c module

(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the

imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118

#define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,

page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,

interrupts are as follows.

150 ENET MAC 0 IRQ

151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118

151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:

The Ethernet interface will fail to probe with Linux v4.9 and earlier.

Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe

error handling. This is a Linux kernel problem, not a qemu problem:

the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt

lines. This was shown to work from all Linux kernel releases starting with

v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309

Signed-off-by: Guenter Roeck <linux@roeck-us.net>

Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net

include/hw/arm/fsl-imx6.h | 4 ++--

hw/net/imx_fec.c | 28 +++++++++++++++++++++++++++-

2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h

--- a/include/hw/arm/fsl-imx6.h

+++ b/include/hw/arm/fsl-imx6.h

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {

#define FSL_IMX6_HDMI_MASTER_IRQ 115

#define FSL_IMX6_HDMI_CEC_IRQ 116

#define FSL_IMX6_MLB150_LOW_IRQ 117

-#define FSL_IMX6_ENET_MAC_1588_IRQ 118

-#define FSL_IMX6_ENET_MAC_IRQ 119

+#define FSL_IMX6_ENET_MAC_IRQ 118

+#define FSL_IMX6_ENET_MAC_1588_IRQ 119

#define FSL_IMX6_PCIE1_IRQ 120

#define FSL_IMX6_PCIE2_IRQ 121

#define FSL_IMX6_PCIE3_IRQ 122

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/imx_fec.c

+++ b/hw/net/imx_fec.c

@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)

static void imx_eth_update(IMXFECState *s)

{

- if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {

+ /*

+ * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER

+ * interrupts swapped. This worked with older versions of Linux (4.14

+ * and older) since Linux associated both interrupt lines with Ethernet

+ * MAC interrupts. Specifically,

+ * - Linux 4.15 and later have separate interrupt handlers for the MAC and

+ * timer interrupts. Those versions of Linux fail with versions of QEMU

+ * with swapped interrupt assignments.

+ * - In linux 4.14, both interrupt lines were registered with the Ethernet

+ * MAC interrupt handler. As a result, all versions of qemu happen to

+ * work, though that is accidental.

+ * - In Linux 4.9 and older, the timer interrupt was registered directly

+ * with the Ethernet MAC interrupt handler. The MAC interrupt was

+ * redirected to a GPIO interrupt to work around erratum ERR006687.

+ * This was implemented using the SOC's IOMUX block. In qemu, this GPIO

+ * interrupt never fired since IOMUX is currently not supported in qemu.

+ * Linux instead received MAC interrupts on the timer interrupt.

+ * As a result, qemu versions with the swapped interrupt assignment work,

+ * albeit accidentally, but qemu versions with the correct interrupt

+ * assignment fail.

+ *

+ * To ensure that all versions of Linux work, generate ENET_INT_MAC

+ * interrrupts on both interrupt lines. This should be changed if and when

+ * qemu supports IOMUX.

+ */

+ if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &

+ (ENET_INT_MAC | ENET_INT_TS_TIMER)) {

qemu_set_irq(s->irq[1], 1);

} else {

qemu_set_irq(s->irq[1], 0);

2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since

it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:

https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org

Cc: qemu-arm@nongnu.org

Cc: Bill Paul <wpaul@windriver.com>

Cc: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Bill Paul <wpaul@windriver.com>

Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>

Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com

include/hw/char/imx_serial.h | 3 +++

hw/char/imx_serial.c | 20 +++++++++++++++++---

2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h

--- a/include/hw/char/imx_serial.h

+++ b/include/hw/char/imx_serial.h

@@ -XXX,XX +XXX,XX @@

#define UCR2_RXEN (1<<1) /* Receiver enable */

#define UCR2_SRST (1<<0) /* Reset complete */

+#define UCR4_TCEN BIT(3) /* TX complete interrupt enable */

+

#define UTS1_TXEMPTY (1<<6)

#define UTS1_RXEMPTY (1<<5)

#define UTS1_TXFULL (1<<4)

@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {

uint32_t ubmr;

uint32_t ubrc;

uint32_t ucr3;

+ uint32_t ucr4;

qemu_irq irq;

CharBackend chr;

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/char/imx_serial.c

+++ b/hw/char/imx_serial.c

@@ -XXX,XX +XXX,XX @@

static const VMStateDescription vmstate_imx_serial = {

.name = TYPE_IMX_SERIAL,

- .version_id = 1,

- .minimum_version_id = 1,

+ .version_id = 2,

+ .minimum_version_id = 2,

.fields = (VMStateField[]) {

VMSTATE_INT32(readbuff, IMXSerialState),

VMSTATE_UINT32(usr1, IMXSerialState),

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {

VMSTATE_UINT32(ubmr, IMXSerialState),

VMSTATE_UINT32(ubrc, IMXSerialState),

VMSTATE_UINT32(ucr3, IMXSerialState),

+ VMSTATE_UINT32(ucr4, IMXSerialState),

VMSTATE_END_OF_LIST()

},

};

@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)

* unfortunately.

*/

mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;

+ /*

+ * TCEN and TXDC are both bit 3

+ */

+ mask |= s->ucr4 & UCR4_TCEN;

+

usr2 = s->usr2 & mask;

qemu_set_irq(s->irq, usr1 || usr2);

@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,

return s->ucr3;

case 0x23: /* UCR4 */

+ return s->ucr4;

+

case 0x29: /* BRM Incremental */

return 0x0; /* TODO */

@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,

* qemu_chr_fe_write and background I/O callbacks */

qemu_chr_fe_write_all(&s->chr, &ch, 1);

s->usr1 &= ~USR1_TRDY;

+ s->usr2 &= ~USR2_TXDC;

imx_update(s);

s->usr1 |= USR1_TRDY;

+ s->usr2 |= USR2_TXDC;

imx_update(s);

@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,

s->ucr3 = value & 0xffff;

break;

- case 0x2d: /* UTS1 */

case 0x23: /* UCR4 */

+ s->ucr4 = value & 0xffff;

+ imx_update(s);

+ break;

+

+ case 0x2d: /* UTS1 */

qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"

HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);

/* TODO */

2.16.2

Now we have separate types for BCM2386 and BCM2387, we might as well

just hard-code the CPU type they use rather than having it passed

through as an object property. This then lets us put the initialization

of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on

the command line to use -cpu to ask for a different kind of

CPU than the SoC supports. This was never a supported thing to

do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on

TARGET_AARCH64 configs, since otherwise it won't instantiate

due to the missing cortex-a53 device and "make check" will fail.

Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20180313153458.26822-9-peter.maydell@linaro.org

hw/arm/bcm2836.c | 24 +++++++++++++++---------

hw/arm/raspi.c | 2 --

2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c

--- a/hw/arm/bcm2836.c

+++ b/hw/arm/bcm2836.c

@@ -XXX,XX +XXX,XX @@

struct BCM283XInfo {

const char *name;

+ const char *cpu_type;

int clusterid;

};

static const BCM283XInfo bcm283x_socs[] = {

{

.name = TYPE_BCM2836,

+ .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),

.clusterid = 0xf,

},

+#ifdef TARGET_AARCH64

{

.name = TYPE_BCM2837,

+ .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),

.clusterid = 0x0,

},

+#endif

};

static void bcm2836_init(Object *obj)

BCM283XState *s = BCM283X(obj);

+ BCM283XClass *bc = BCM283X_GET_CLASS(obj);

+ const BCM283XInfo *info = bc->info;

+ int n;

+ for (n = 0; n < BCM283X_NCPUS; n++) {

+ object_initialize(&s->cpus[n], sizeof(s->cpus[n]),

+ info->cpu_type);

+ object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),

+ &error_abort);

+ }

object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);

object_property_add_child(obj, "control", OBJECT(&s->control), NULL);

@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)

/* common peripherals from bcm2835 */

- obj = OBJECT(dev);

- for (n = 0; n < BCM283X_NCPUS; n++) {

- object_initialize(&s->cpus[n], sizeof(s->cpus[n]),

- s->cpu_type);

- object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),

- &error_abort);

- }

obj = object_property_get_link(OBJECT(dev), "ram", &err);

if (obj == NULL) {

error_setg(errp, "%s: required ram link not found: %s",

@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)

static Property bcm2836_props[] = {

- DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),

DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,

BCM283X_NCPUS),

DEFINE_PROP_END_OF_LIST()

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)

/* Setup the SOC */

object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),

&error_abort);

- object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",

- &error_abort);

object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",

&error_abort);

int board_rev = version == 3 ? 0xa02082 : 0xa21041;

2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have

some differences. Notably, the MPIDR affinity aff1 values it

sets for the CPUs are 0x0, rather than the 0xf that the bcm2836

uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that

configure it differently for the two cases, create two

separate QOM devices for the two SoCs. We use the same approach

as hw/arm/aspeed_soc.c and share code and have a data table

that might differ per-SoC. For the moment the two types don't

actually have different behaviour.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20180313153458.26822-7-peter.maydell@linaro.org

include/hw/arm/bcm2836.h | 19 +++++++++++++++++++

hw/arm/bcm2836.c | 37 ++++++++++++++++++++++++++++++++-----

hw/arm/raspi.c | 3 ++-

3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h

--- a/include/hw/arm/bcm2836.h

+++ b/include/hw/arm/bcm2836.h

@@ -XXX,XX +XXX,XX @@

#define BCM283X_NCPUS 4

+/* These type names are for specific SoCs; other than instantiating

+ * them, code using these devices should always handle them via the

+ * BCM283x base class, so they have no BCM2836(obj) etc macros.

+#define TYPE_BCM2836 "bcm2836"

+#define TYPE_BCM2837 "bcm2837"

typedef struct BCM283XState {

/*< private >*/

DeviceState parent_obj;

@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {

BCM2835PeripheralState peripherals;

} BCM283XState;

+typedef struct BCM283XInfo BCM283XInfo;

+

+typedef struct BCM283XClass {

+ DeviceClass parent_class;

+ const BCM283XInfo *info;

+} BCM283XClass;

+

+#define BCM283X_CLASS(klass) \

+ OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)

+#define BCM283X_GET_CLASS(obj) \

+ OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)

+

#endif /* BCM2836_H */

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c

--- a/hw/arm/bcm2836.c

+++ b/hw/arm/bcm2836.c

@@ -XXX,XX +XXX,XX @@

/* "QA7" (Pi2) interrupt controller and mailboxes etc. */

#define BCM2836_CONTROL_BASE 0x40000000

+struct BCM283XInfo {

+ const char *name;

+};

+

+static const BCM283XInfo bcm283x_socs[] = {

+ {

+ .name = TYPE_BCM2836,

+ },

+ {

+ .name = TYPE_BCM2837,

+ },

+};

+

static void bcm2836_init(Object *obj)

{

BCM283XState *s = BCM283X(obj);

@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {

DEFINE_PROP_END_OF_LIST()

};

-static void bcm2836_class_init(ObjectClass *oc, void *data)

+static void bcm283x_class_init(ObjectClass *oc, void *data)

{

DeviceClass *dc = DEVICE_CLASS(oc);

+ BCM283XClass *bc = BCM283X_CLASS(oc);

- dc->props = bcm2836_props;

+ bc->info = data;

dc->realize = bcm2836_realize;

+ dc->props = bcm2836_props;

}

-static const TypeInfo bcm2836_type_info = {

+static const TypeInfo bcm283x_type_info = {

.name = TYPE_BCM283X,

.parent = TYPE_DEVICE,

.instance_size = sizeof(BCM283XState),

.instance_init = bcm2836_init,

- .class_init = bcm2836_class_init,

+ .class_size = sizeof(BCM283XClass),

+ .abstract = true,

};

static void bcm2836_register_types(void)

{

- type_register_static(&bcm2836_type_info);

+ int i;

+

+ type_register_static(&bcm283x_type_info);

+ for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {

+ TypeInfo ti = {

+ .name = bcm283x_socs[i].name,

+ .parent = TYPE_BCM283X,

+ .class_init = bcm283x_class_init,

+ .class_data = (void *) &bcm283x_socs[i],

+ };

+ type_register(&ti);

+ }

}

type_init(bcm2836_register_types)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)

BusState *bus;

DeviceState *carddev;

- object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);

+ object_initialize(&s->soc, sizeof(s->soc),

+ version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);

object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),

&error_abort);

2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot

code for keeping the secondary CPUs in a pen needs to have

a version for A64 as well as A32. Without this, the

secondary CPUs go into an infinite loop of taking undefined

instruction exceptions.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20180313153458.26822-10-peter.maydell@linaro.org

hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-

1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c

--- a/hw/arm/raspi.c

+++ b/hw/arm/raspi.c

@@ -XXX,XX +XXX,XX @@

#define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */

#define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */

#define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */

+#define SPINTABLE_ADDR 0xd8 /* Pi 3 bootloader spintable */

/* Table of Linux board IDs for different Pi versions */

static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};

@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)

info->smp_loader_start);

}

+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)

+{

+ /* Unlike the AArch32 version we don't need to call the board setup hook.

+ * The mechanism for doing the spin-table is also entirely different.

+ * We must have four 64-bit fields at absolute addresses

+ * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for

+ * our CPUs, and which we must ensure are zero initialized before

+ * the primary CPU goes into the kernel. We put these variables inside

+ * a rom blob, so that the reset for ROM contents zeroes them for us.

+ */

+ static const uint32_t smpboot[] = {

+ 0xd2801b05, /* mov x5, 0xd8 */

+ 0xd53800a6, /* mrs x6, mpidr_el1 */

+ 0x924004c6, /* and x6, x6, #0x3 */

+ 0xd503205f, /* spin: wfe */

+ 0xf86678a4, /* ldr x4, [x5,x6,lsl #3] */

+ 0xb4ffffc4, /* cbz x4, spin */

+ 0xd2800000, /* mov x0, #0x0 */

+ 0xd2800001, /* mov x1, #0x0 */

+ 0xd2800002, /* mov x2, #0x0 */

+ 0xd2800003, /* mov x3, #0x0 */

+ 0xd61f0080, /* br x4 */

+ };

+

+ static const uint64_t spintables[] = {

+ 0, 0, 0, 0

+ };

+

+ rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),

+ info->smp_loader_start);

+ rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),

+ SPINTABLE_ADDR);

+}

+

static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)

{

arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);

@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)