Cc'ing the SABRELITE maintainers:

$ ./scripts/get_maintainer.pl -f hw/misc/imx6_ccm.c Peter Maydell peter.maydell@linaro.org (odd fixer:SABRELITE / i.MX6) Jean-Christophe Dubois jcd@tribudubois.net (reviewer:SABRELITE / i.MX6) qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)

On 10/3/19 1:54 PM, Bin Meng wrote:

+QEMU developers ML On Thu, Oct 3, 2019 at 7:37 PM Waseem ALKurdi waseem19992009@outlook.com wrote:

...

I'm trying to get mainline U-Boot to boot on mainline QEMU 4.1.0 for the 'sabrelite' board, using the configuration 'mx6qsabrelite_defconfig'.

It's not booting at all. Actually, not a single U-Boot build for an i.MX board would boot, with the exception of 'imx25-pdk'.

I'm compiling U-Boot by un-tarring the source tarball and running the following commands:

$ time CROSS_COMPILE=/path/to/toolchain/arm-2014.05/bin/arm-none-linux-gnueabi- make ARCH=arm clean $ time CROSS_COMPILE=/path/to/toolchain/arm-2014.05/bin/arm-none-linux-gnueabi- make ARCH=arm mrproper $ time CROSS_COMPILE=/path/to/toolchain/arm-2014.05/bin/arm-none-linux-gnueabi- make ARCH=arm mx6qsabrelite_defconfig

then after the build finishes:

$ qemu-system-arm -M sabrelite -m 512M -kernel ~/Downloads/u-boot-2019.10-rc3/u-boot.imx -monitor stdio

And other variations on this command as well. No amount of kernel commandline options or anything would make it boot. What should I do?

Running QEMU with '-d in_asm,cpu' shows the guest is looping polling a mmio mapped register:

IN: arch_cpu_init 0x17803264: e5943150 ldr r3, [r4, #0x150] 0x17803268: f57ff05f dmb sy 0x1780326c: e3130080 tst r3, #0x80 0x17803270: 0afffffb beq #0x17803264

R00=00000000 R01=00000000 R02=00000001 R03=04000000 R04=020c8000 R05=17864a7c R06=17864a78 R07=00000000 R08=00000000 R09=0093dde0 R10=00000000 R11=00000000 R12=0093dee8 R13=0093ddc8 R14=178033e4 R15=17803264 PSR=400001d3 -Z-- A S svc32 R00=00000000 R01=00000000 R02=00000001 R03=04000000 R04=020c8000 R05=17864a7c R06=17864a78 R07=00000000 R08=00000000 R09=0093dde0 R10=00000000 R11=00000000 R12=0093dee8 R13=0093ddc8 R14=178033e4 R15=17803264 PSR=400001d3 -Z-- A S svc32

R04 + 0x150 = 0x020c8000 + 0x150 = 0x020c8150, which is the CCM_ANALOG_MISC0 register.

Looking at u-boot arch/arm/mach-imx/mx6/soc.c we have:

int arch_cpu_init(void) { struct mxc_ccm_reg *ccm = (struct mxc_ccm_reg *)CCM_BASE_ADDR;

init_aips();

/* Need to clear MMDC_CHx_MASK to make warm reset work. */ clear_mmdc_ch_mask();

/* * Disable self-bias circuit in the analog bandap. * The self-bias circuit is used by the bandgap during startup. * This bit should be set after the bandgap has initialized. */ init_bandgap();

...

With:

static void init_bandgap(void) { struct anatop_regs *anatop = (struct anatop_regs *)ANATOP_BASE_ADDR; struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; struct fuse_bank *bank = &ocotp->bank[1]; struct fuse_bank1_regs *fuse = (struct fuse_bank1_regs *)bank->fuse_regs; uint32_t val;

/* * Ensure the bandgap has stabilized. */ while (!(readl(&anatop->ana_misc0) & 0x80)) ;

QEMU returns R03=04000000 which comes from hw/misc/imx6_ccm.c:

static void imx6_ccm_reset(DeviceState *dev) { ... s->analog[PMU_MISC0] = 0x04000000; s->analog[PMU_MISC1] = 0x00000000; s->analog[PMU_MISC2] = 0x00272727;

Changing the PMU_MISC0 register to return the bit u-boot is polling with this snippet (I have no clue what this does) with:

-- >8 -- diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c index 7fec8f0a47..3a52ea640a 100644 --- a/hw/misc/imx6_ccm.c +++ b/hw/misc/imx6_ccm.c @@ -450,7 +450,7 @@ static void imx6_ccm_reset(DeviceState *dev) s->analog[PMU_REG_3P0] = 0x00000F74; s->analog[PMU_REG_2P5] = 0x00005071; s->analog[PMU_REG_CORE] = 0x00402010; - s->analog[PMU_MISC0] = 0x04000000; + s->analog[PMU_MISC0] = 0x04000080; s->analog[PMU_MISC1] = 0x00000000; s->analog[PMU_MISC2] = 0x00272727; ---

I see u-boot going further.

I suspect mainline QEMU sabrelite machine only supports booting the Linux kernel directly, but not booting U-Boot.

Note this u-boot code is ~4 years old:

commit 1f516faa45611aedc8c2e3f303b3866f615d481e Author: Peng Fan Peng.Fan@freescale.com Date: Thu Jan 15 14:22:32 2015 +0800

ARM: imx6: disable bandgap self-bias after boot

The self-bias circuit is used by the bandgap during startup. Once the bandgap has stabilized, the self-bias circuit should be disabled for best noise performance of analog blocks. Also this bit should be disabled before the chip enters STOP mode or when ever the regular bandgap is disabled.

The QEMU device code was added later:

commit a66d815cd558193182b09fb23211f7ebf88d0661 Author: Jean-Christophe Dubois jcd@tribudubois.net Date: Wed Mar 16 17:06:00 2016 +0000

i.MX: Add i.MX6 CCM and ANALOG device.

So I believe QEMU never booted u-boot on the i.MX6.

Waseem, you can enable some QEMU i.MX debug changing DEBUG_IMX* definitions, such:

-- >8 -- diff --git a/hw/misc/imx6_ccm.c b/hw/misc/imx6_ccm.c index 7fec8f0a47..3a52ea640a 100644 --- a/hw/misc/imx6_ccm.c +++ b/hw/misc/imx6_ccm.c @@ -17,7 +17,7 @@ #include "qemu/module.h"

#ifndef DEBUG_IMX6_CCM -#define DEBUG_IMX6_CCM 0 +#define DEBUG_IMX6_CCM 1 #endif

#define DPRINTF(fmt, args...) \ ---

There are more:

$ git grep ifndef.*DEBUG_IMX hw/char/imx_serial.c:29:#ifndef DEBUG_IMX_UART hw/gpio/imx_gpio.c:28:#ifndef DEBUG_IMX_GPIO hw/i2c/imx_i2c.c:29:#ifndef DEBUG_IMX_I2C hw/intc/imx_avic.c:25:#ifndef DEBUG_IMX_AVIC hw/misc/imx25_ccm.c:20:#ifndef DEBUG_IMX25_CCM hw/misc/imx31_ccm.c:22:#ifndef DEBUG_IMX31_CCM hw/misc/imx6_ccm.c:19:#ifndef DEBUG_IMX6_CCM hw/misc/imx6_src.c:21:#ifndef DEBUG_IMX6_SRC hw/misc/imx_ccm.c:19:#ifndef DEBUG_IMX_CCM hw/net/imx_fec.c:38:#ifndef DEBUG_IMX_FEC hw/net/imx_fec.c:50:#ifndef DEBUG_IMX_PHY hw/ssi/imx_spi.c:18:#ifndef DEBUG_IMX_SPI hw/timer/imx_epit.c:24:#ifndef DEBUG_IMX_EPIT hw/timer/imx_gpt.c:23:#ifndef DEBUG_IMX_GPT

Regards,

Phil.