First arm pullreq of the 2.11 cycle. I know I still have some more stuff on my queue to review, but 36 patches is big enough as it is; I expect I'll do another pull later this week. thanks -- PMM The following changes since commit 32f0f68bb77289b75a82925f712bb52e16eac3ba: Merge remote-tracking branch 'remotes/ehabkost/tags/x86-and-machine-pull-request' into staging (2017-09-01 17:28:54 +0100) are available in the git repository at: git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170904 for you to fetch changes up to 1e35c4ce33a94cf78dbf639695cb877ef35920b0: arm_gicv3_kvm: Fix compile warning (2017-09-04 12:09:32 +0100) ---------------------------------------------------------------- target-arm: * collection of M profile cleanups and minor bugfixes * loader: handle ELF files with overlapping zero-init data * virt: allow PMU instantiation with userspace irqchip * wdt_aspeed: Add support for the reset width register * cpu: Define new cpu_transaction_failed() hook * arm: Support generating CPU exceptions on memory transaction failures (bus faults) * Mark some SoC devices as not user-creatable * arm: Fix aa64 ldp register writeback * arm_gicv3_kvm: Fix compile warning ---------------------------------------------------------------- Andrew Jeffery (2): watchdog: wdt_aspeed: Add support for the reset width register aspeed_soc: Propagate silicon-rev to watchdog Andrew Jones (4): hw/arm/virt: add pmu interrupt state target/arm/kvm: pmu: split init and set-irq stages hw/arm/virt: allow pmu instantiation with userspace irqchip target/arm/kvm: pmu: improve error handling Peter Maydell (25): target/arm: Use MMUAccessType enum rather than int target/arm: Don't trap WFI/WFE for M profile target/arm: Consolidate PMSA handling in get_phys_addr() target/arm: Tighten up Thumb decode where new v8M insns will be hw/intc/armv7m_nvic.c: Remove out of date comment target/arm: Remove incorrect comment about MPU_CTRL target/arm: Fix outdated comment about exception exit target/arm: Define and use XPSR bit masks target/arm: Don't store M profile PRIMASK and FAULTMASK in daif target/arm: Don't use cpsr_write/cpsr_read to transfer M profile XPSR target/arm: Make arm_cpu_dump_state() handle the M-profile XPSR target/arm: Don't calculate lr in arm_v7m_cpu_do_interrupt() until needed target/arm: Create and use new function arm_v7m_is_handler_mode() armv7m_nvic.h: Move from include/hw/arm to include/hw/intc nvic: Implement "user accesses BusFault" SCS region behaviour loader: Handle ELF files with overlapping zero-initialized data loader: Ignore zero-sized ELF segments memory.h: Move MemTxResult type to memattrs.h cpu: Define new cpu_transaction_failed() hook cputlb: Support generating CPU exceptions on memory transaction failures boards.h: Define new flag ignore_memory_transaction_failures hw/arm: Set ignore_memory_transaction_failures for most ARM boards target/arm: Factor out fault delivery code target/arm: Allow deliver_fault() caller to specify EA bit target/arm: Implement new do_transaction_failed hook Philippe Mathieu-Daudé (1): hw/arm: use defined type name instead of hard-coded string Pranith Kumar (1): arm_gicv3_kvm: Fix compile warning Richard Henderson (1): target/arm: Fix aa64 ldp register writeback Thomas Huth (2): hw/arm/aspeed_soc: Mark devices as user_creatable = false hw/arm/digic: Mark device with user_creatable = false include/exec/memattrs.h | 10 +++ include/exec/memory.h | 10 --- include/hw/arm/armv7m.h | 2 +- include/hw/boards.h | 11 +++ include/hw/elf_ops.h | 72 +++++++++++++-- include/hw/{arm => intc}/armv7m_nvic.h | 0 include/hw/watchdog/wdt_aspeed.h | 2 + include/qom/cpu.h | 27 ++++++ softmmu_template.h | 4 +- target/arm/cpu.h | 56 +++++++++--- target/arm/internals.h | 15 +++- target/arm/kvm_arm.h | 9 +- accel/tcg/cputlb.c | 32 ++++++- hw/arm/armv7m.c | 4 +- hw/arm/aspeed.c | 3 + hw/arm/aspeed_soc.c | 4 + hw/arm/collie.c | 1 + hw/arm/cubieboard.c | 1 + hw/arm/digic.c | 2 + hw/arm/digic_boards.c | 1 + hw/arm/exynos4210.c | 4 +- hw/arm/exynos4_boards.c | 2 + hw/arm/gumstix.c | 2 + hw/arm/highbank.c | 13 ++- hw/arm/imx25_pdk.c | 1 + hw/arm/integratorcp.c | 1 + hw/arm/kzm.c | 1 + hw/arm/mainstone.c | 1 + hw/arm/musicpal.c | 1 + hw/arm/netduino2.c | 1 + hw/arm/nseries.c | 2 + hw/arm/omap_sx1.c | 2 + hw/arm/palm.c | 1 + hw/arm/raspi.c | 1 + hw/arm/realview.c | 10 ++- hw/arm/sabrelite.c | 1 + hw/arm/spitz.c | 4 + hw/arm/stellaris.c | 2 + hw/arm/tosa.c | 1 + hw/arm/versatilepb.c | 2 + hw/arm/vexpress.c | 7 +- hw/arm/virt.c | 12 ++- hw/arm/xilinx_zynq.c | 15 ++-- hw/arm/xlnx-ep108.c | 2 + hw/arm/z2.c | 1 + hw/intc/arm_gicv3_kvm.c | 2 +- hw/intc/armv7m_nvic.c | 68 +++++++++----- hw/watchdog/wdt_aspeed.c | 93 ++++++++++++++++--- qom/cpu.c | 7 ++ target/arm/cpu.c | 8 +- target/arm/helper.c | 124 ++++++++++++------------- target/arm/kvm.c | 6 +- target/arm/kvm32.c | 7 +- target/arm/kvm64.c | 63 +++++++------ target/arm/machine.c | 54 ++++++++++- target/arm/op_helper.c | 160 ++++++++++++++++++++++----------- target/arm/translate-a64.c | 29 +++--- target/arm/translate.c | 106 ++++++++++++++++------ 58 files changed, 795 insertions(+), 288 deletions(-) rename include/hw/{arm => intc}/armv7m_nvic.h (100%) In the ARM get_phys_addr() code, switch to using the MMUAccessType enum and its MMU_* values rather than int and literal 0/1/2. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-2-git-send-email-peter.maydell@linaro.org --- target/arm/internals.h | 3 ++- target/arm/helper.c | 30 +++++++++++++++--------------- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/target/arm/internals.h b/target/arm/internals.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -XXX,XX +XXX,XX @@ struct ARMMMUFaultInfo { }; /* Do a page table walk and add page to TLB if possible */ -bool arm_tlb_fill(CPUState *cpu, vaddr address, int rw, int mmu_idx, +bool arm_tlb_fill(CPUState *cpu, vaddr address, + MMUAccessType access_type, int mmu_idx, uint32_t *fsr, ARMMMUFaultInfo *fi); /* Return true if the stage 1 translation regime is using LPAE format page diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ #ifndef CONFIG_USER_ONLY static bool get_phys_addr(CPUARMState *env, target_ulong address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, target_ulong *page_size, uint32_t *fsr, ARMMMUFaultInfo *fi); static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, target_ulong *page_size_ptr, uint32_t *fsr, ARMMMUFaultInfo *fi); @@ -XXX,XX +XXX,XX @@ static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri, } static uint64_t do_ats_write(CPUARMState *env, uint64_t value, - int access_type, ARMMMUIdx mmu_idx) + MMUAccessType access_type, ARMMMUIdx mmu_idx) { hwaddr phys_addr; target_ulong page_size; @@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value, static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { - int access_type = ri->opc2 & 1; + MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; uint64_t par64; ARMMMUIdx mmu_idx; int el = arm_current_el(env); @@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { - int access_type = ri->opc2 & 1; + MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; uint64_t par64; par64 = do_ats_write(env, value, access_type, ARMMMUIdx_S2NS); @@ -XXX,XX +XXX,XX @@ static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri, static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value) { - int access_type = ri->opc2 & 1; + MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD; ARMMMUIdx mmu_idx; int secure = arm_is_secure_below_el3(env); @@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure, } static bool get_phys_addr_v5(CPUARMState *env, uint32_t address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, int *prot, target_ulong *page_size, uint32_t *fsr, ARMMMUFaultInfo *fi) @@ -XXX,XX +XXX,XX @@ do_fault: } static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, target_ulong *page_size, uint32_t *fsr, ARMMMUFaultInfo *fi) @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, uint32_t address, if (pxn && !regime_is_user(env, mmu_idx)) { xn = 1; } - if (xn && access_type == 2) + if (xn && access_type == MMU_INST_FETCH) goto do_fault; if (arm_feature(env, ARM_FEATURE_V6K) && @@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level, } static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot, target_ulong *page_size_ptr, uint32_t *fsr, ARMMMUFaultInfo *fi) @@ -XXX,XX +XXX,XX @@ static inline bool m_is_system_region(CPUARMState *env, uint32_t address) } static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, int *prot, uint32_t *fsr) { ARMCPU *cpu = arm_env_get_cpu(env); @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address, } static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, int *prot, uint32_t *fsr) { int n; @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, return true; } - if (access_type == 2) { + if (access_type == MMU_INST_FETCH) { mask = env->cp15.pmsav5_insn_ap; } else { mask = env->cp15.pmsav5_data_ap; @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, * @fsr: set to the DFSR/IFSR value on failure */ static bool get_phys_addr(CPUARMState *env, target_ulong address, - int access_type, ARMMMUIdx mmu_idx, + MMUAccessType access_type, ARMMMUIdx mmu_idx, hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot, target_ulong *page_size, uint32_t *fsr, ARMMMUFaultInfo *fi) @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address, * fsr with ARM DFSR/IFSR fault register format value on failure. */ bool arm_tlb_fill(CPUState *cs, vaddr address, - int access_type, int mmu_idx, uint32_t *fsr, + MMUAccessType access_type, int mmu_idx, uint32_t *fsr, ARMMMUFaultInfo *fi) { ARMCPU *cpu = ARM_CPU(cs); -- 2.7.4 M profile cores can never trap on WFI or WFE instructions. Check for M profile in check_wfx_trap() to ensure this. The existing code will do the right thing for v7M cores because the hcr_el2 and scr_el3 registers will be all-zeroes and so we won't attempt to trap, but when we start setting ARM_FEATURE_V8 for v8M cores the v8A handling of SCTLR.nTWE and .nTWI will not give the right results. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-3-git-send-email-peter.maydell@linaro.org --- target/arm/op_helper.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -XXX,XX +XXX,XX @@ static inline int check_wfx_trap(CPUARMState *env, bool is_wfe) int cur_el = arm_current_el(env); uint64_t mask; + if (arm_feature(env, ARM_FEATURE_M)) { + /* M profile cores can never trap WFI/WFE. */ + return 0; + } + /* If we are currently in EL0 then we need to check if SCTLR is set up for * WFx instructions being trapped to EL1. These trap bits don't exist in v7. */ -- 2.7.4 Currently get_phys_addr() has PMSAv7 handling before the "is translation disabled?" check, and then PMSAv5 after it. Tidy this up by making the PMSAv5 code handle the "MPU disabled" case itself, so that we have all the PMSA code in one place. This will make adding the PMSAv8 code slightly cleaner, and also means that pre-v7 PMSA cores benefit from the MPU lookup logging that the PMSAv7 codepath had. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-4-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address, uint32_t base; bool is_user = regime_is_user(env, mmu_idx); + if (regime_translation_disabled(env, mmu_idx)) { + /* MPU disabled. */ + *phys_ptr = address; + *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; + return false; + } + *phys_ptr = address; for (n = 7; n >= 0; n--) { base = env->cp15.c6_region[n]; @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address, } } - /* pmsav7 has special handling for when MPU is disabled so call it before - * the common MMU/MPU disabled check below. - */ - if (arm_feature(env, ARM_FEATURE_PMSA) && - arm_feature(env, ARM_FEATURE_V7)) { + if (arm_feature(env, ARM_FEATURE_PMSA)) { bool ret; *page_size = TARGET_PAGE_SIZE; - ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, - phys_ptr, prot, fsr); - qemu_log_mask(CPU_LOG_MMU, "PMSAv7 MPU lookup for %s at 0x%08" PRIx32 + + if (arm_feature(env, ARM_FEATURE_V7)) { + /* PMSAv7 */ + ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx, + phys_ptr, prot, fsr); + } else { + /* Pre-v7 MPU */ + ret = get_phys_addr_pmsav5(env, address, access_type, mmu_idx, + phys_ptr, prot, fsr); + } + qemu_log_mask(CPU_LOG_MMU, "PMSA MPU lookup for %s at 0x%08" PRIx32 " mmu_idx %u -> %s (prot %c%c%c)\n", access_type == MMU_DATA_LOAD ? "reading" : (access_type == MMU_DATA_STORE ? "writing" : "execute"), @@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address, return ret; } + /* Definitely a real MMU, not an MPU */ + if (regime_translation_disabled(env, mmu_idx)) { - /* MMU/MPU disabled. */ + /* MMU disabled. */ *phys_ptr = address; *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC; *page_size = TARGET_PAGE_SIZE; return 0; } - if (arm_feature(env, ARM_FEATURE_PMSA)) { - /* Pre-v7 MPU */ - *page_size = TARGET_PAGE_SIZE; - return get_phys_addr_pmsav5(env, address, access_type, mmu_idx, - phys_ptr, prot, fsr); - } - if (regime_using_lpae_format(env, mmu_idx)) { return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr, attrs, prot, page_size, fsr, fi); -- 2.7.4 Tighten up the T32 decoder in the places where new v8M instructions will be: * TT/TTT/TTA/TTAT are in what was nominally LDREX/STREX r15, ... which is UNPREDICTABLE: make the UNPREDICTABLE behaviour be to UNDEF * BXNS/BLXNS are distinguished from BX/BLX via the low 3 bits, which in previous architectural versions are SBZ: enforce the SBZ via UNDEF rather than ignoring it, and move the "ARCH(5)" UNDEF case up so we don't leak a TCG temporary * SG is in the encoding which would be LDRD/STRD with rn = r15; this is UNPREDICTABLE and we currently UNDEF: move this check further up the code so that we don't leak TCG temporaries in the UNDEF case and have a better place to put the SG decode. This means that if a v8M binary is accidentally run on v7M or if a test case hits something that we haven't implemented yet the behaviour will be obvious (UNDEF) rather than obscure (plough on treating it as a different instruction). In the process, add some comments about the instruction patterns at these points in the decode. Our Thumb and ARM decoders are very difficult to understand currently, but gradually adding comments like this should help to clarify what exactly has been decoded when. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-5-git-send-email-peter.maydell@linaro.org --- target/arm/translate.c | 48 +++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 39 insertions(+), 9 deletions(-) diff --git a/target/arm/translate.c b/target/arm/translate.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw abort(); case 4: if (insn & (1 << 22)) { - /* Other load/store, table branch. */ + /* 0b1110_100x_x1xx_xxxx_xxxx_xxxx_xxxx_xxxx + * - load/store doubleword, load/store exclusive, ldacq/strel, + * table branch. + */ if (insn & 0x01200000) { - /* Load/store doubleword. */ + /* 0b1110_1000_x11x_xxxx_xxxx_xxxx_xxxx_xxxx + * - load/store dual (post-indexed) + * 0b1111_1001_x10x_xxxx_xxxx_xxxx_xxxx_xxxx + * - load/store dual (literal and immediate) + * 0b1111_1001_x11x_xxxx_xxxx_xxxx_xxxx_xxxx + * - load/store dual (pre-indexed) + */ if (rn == 15) { + if (insn & (1 << 21)) { + /* UNPREDICTABLE */ + goto illegal_op; + } addr = tcg_temp_new_i32(); tcg_gen_movi_i32(addr, s->pc & ~3); } else { @@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw } if (insn & (1 << 21)) { /* Base writeback. */ - if (rn == 15) - goto illegal_op; tcg_gen_addi_i32(addr, addr, offset - 4); store_reg(s, rn, addr); } else { tcg_temp_free_i32(addr); } } else if ((insn & (1 << 23)) == 0) { - /* Load/store exclusive word. */ + /* 0b1110_1000_010x_xxxx_xxxx_xxxx_xxxx_xxxx + * - load/store exclusive word + */ + if (rs == 15) { + goto illegal_op; + } addr = tcg_temp_local_new_i32(); load_reg_var(s, addr, rn); tcg_gen_addi_i32(addr, addr, (insn & 0xff) << 2); @@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) break; } if (insn & (1 << 10)) { - /* data processing extended or blx */ + /* 0b0100_01xx_xxxx_xxxx + * - data processing extended, branch and exchange + */ rd = (insn & 7) | ((insn >> 4) & 8); rm = (insn >> 3) & 0xf; op = (insn >> 8) & 3; @@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) tmp = load_reg(s, rm); store_reg(s, rd, tmp); break; - case 3:/* branch [and link] exchange thumb register */ - tmp = load_reg(s, rm); - if (insn & (1 << 7)) { + case 3: + { + /* 0b0100_0111_xxxx_xxxx + * - branch [and link] exchange thumb register + */ + bool link = insn & (1 << 7); + + if (insn & 7) { + goto undef; + } + if (link) { ARCH(5); + } + tmp = load_reg(s, rm); + if (link) { val = (uint32_t)s->pc | 1; tmp2 = tcg_temp_new_i32(); tcg_gen_movi_i32(tmp2, val); @@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s) } break; } + } break; } -- 2.7.4 Remove an out of date comment which says there's only one item in the NVIC container region -- we put systick into its own device object a while back and so now there are two things in the container. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-6-git-send-email-peter.maydell@linaro.org --- hw/intc/armv7m_nvic.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_realize(DeviceState *dev, Error **errp) * 0xd00..0xd3c - SCS registers * 0xd40..0xeff - Reserved or Not implemented * 0xf00 - STIR - * - * At the moment there is only one thing in the container region, - * but we leave it in place to allow us to pull systick out into - * its own device object later. */ memory_region_init(&s->container, OBJECT(s), "nvic", 0x1000); /* The system register region goes at the bottom of the priority -- 2.7.4 Remove the comment that claims that some MPU_CTRL bits are stored in sctlr_el[1]. This has never been true since MPU_CTRL was added in commit 29c483a50607 -- the comment is a leftover from Michael Davidsaver's original implementation, which I modified not to use sctlr_el[1]; I forgot to delete the comment then. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-7-git-send-email-peter.maydell@linaro.org --- target/arm/cpu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState { uint32_t dfsr; /* Debug Fault Status Register */ uint32_t mmfar; /* MemManage Fault Address */ uint32_t bfar; /* BusFault Address */ - unsigned mpu_ctrl; /* MPU_CTRL (some bits kept in sctlr_el[1]) */ + unsigned mpu_ctrl; /* MPU_CTRL */ int exception; } v7m; -- 2.7.4 When we switched our handling of exception exit to detect the magic addresses at translate time rather than via a do_unassigned_access hook, we forgot to update a comment; correct the omission. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-8-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) bool rettobase = false; /* We can only get here from an EXCP_EXCEPTION_EXIT, and - * arm_v7m_do_unassigned_access() enforces the architectural rule + * gen_bx_excret() enforces the architectural rule * that jumps to magic addresses don't have magic behaviour unless * we're in Handler mode (compare pseudocode BXWritePC()). */ -- 2.7.4 The M profile XPSR is almost the same format as the A profile CPSR, but not quite. Define some XPSR_* macros and use them where we definitely dealing with an XPSR rather than reusing the CPSR ones. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-9-git-send-email-peter.maydell@linaro.org --- target/arm/cpu.h | 38 ++++++++++++++++++++++++++++---------- target/arm/helper.c | 15 ++++++++------- 2 files changed, 36 insertions(+), 17 deletions(-) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ void pmccntr_sync(CPUARMState *env); /* Mask of bits which may be set by exception return copying them from SPSR */ #define CPSR_ERET_MASK (~CPSR_RESERVED) +/* Bit definitions for M profile XPSR. Most are the same as CPSR. */ +#define XPSR_EXCP 0x1ffU +#define XPSR_SPREALIGN (1U << 9) /* Only set in exception stack frames */ +#define XPSR_IT_2_7 CPSR_IT_2_7 +#define XPSR_GE CPSR_GE +#define XPSR_SFPA (1U << 20) /* Only set in exception stack frames */ +#define XPSR_T (1U << 24) /* Not the same as CPSR_T ! */ +#define XPSR_IT_0_1 CPSR_IT_0_1 +#define XPSR_Q CPSR_Q +#define XPSR_V CPSR_V +#define XPSR_C CPSR_C +#define XPSR_Z CPSR_Z +#define XPSR_N CPSR_N +#define XPSR_NZCV CPSR_NZCV +#define XPSR_IT CPSR_IT + #define TTBCR_N (7U << 0) /* TTBCR.EAE==0 */ #define TTBCR_T0SZ (7U << 0) /* TTBCR.EAE==1 */ #define TTBCR_PD0 (1U << 4) @@ -XXX,XX +XXX,XX @@ static inline uint32_t xpsr_read(CPUARMState *env) /* Set the xPSR. Note that some bits of mask must be all-set or all-clear. */ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask) { - if (mask & CPSR_NZCV) { - env->ZF = (~val) & CPSR_Z; + if (mask & XPSR_NZCV) { + env->ZF = (~val) & XPSR_Z; env->NF = val; env->CF = (val >> 29) & 1; env->VF = (val << 3) & 0x80000000; } - if (mask & CPSR_Q) - env->QF = ((val & CPSR_Q) != 0); - if (mask & (1 << 24)) - env->thumb = ((val & (1 << 24)) != 0); - if (mask & CPSR_IT_0_1) { + if (mask & XPSR_Q) { + env->QF = ((val & XPSR_Q) != 0); + } + if (mask & XPSR_T) { + env->thumb = ((val & XPSR_T) != 0); + } + if (mask & XPSR_IT_0_1) { env->condexec_bits &= ~3; env->condexec_bits |= (val >> 25) & 3; } - if (mask & CPSR_IT_2_7) { + if (mask & XPSR_IT_2_7) { env->condexec_bits &= 3; env->condexec_bits |= (val >> 8) & 0xfc; } - if (mask & 0x1ff) { - env->v7m.exception = val & 0x1ff; + if (mask & XPSR_EXCP) { + env->v7m.exception = val & XPSR_EXCP; } } diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu) /* Align stack pointer if the guest wants that */ if ((env->regs[13] & 4) && (env->v7m.ccr & R_V7M_CCR_STKALIGN_MASK)) { env->regs[13] -= 4; - xpsr |= 0x200; + xpsr |= XPSR_SPREALIGN; } /* Switch to the handler mode. */ v7m_push(env, xpsr); @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) env->regs[15] &= ~1U; } xpsr = v7m_pop(env); - xpsr_write(env, xpsr, 0xfffffdff); + xpsr_write(env, xpsr, ~XPSR_SPREALIGN); /* Undo stack alignment. */ - if (xpsr & 0x200) + if (xpsr & XPSR_SPREALIGN) { env->regs[13] |= 4; + } /* The restored xPSR exception field will be zero if we're * resuming in Thread mode. If that doesn't match what the @@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) case 0 ... 7: /* xPSR sub-fields */ mask = 0; if ((reg & 1) && el) { - mask |= 0x000001ff; /* IPSR (unpriv. reads as zero) */ + mask |= XPSR_EXCP; /* IPSR (unpriv. reads as zero) */ } if (!(reg & 4)) { - mask |= 0xf8000000; /* APSR */ + mask |= XPSR_NZCV | XPSR_Q; /* APSR */ } /* EPSR reads as zero */ return xpsr_read(env) & mask; @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) uint32_t apsrmask = 0; if (mask & 8) { - apsrmask |= 0xf8000000; /* APSR NZCVQ */ + apsrmask |= XPSR_NZCV | XPSR_Q; } if ((mask & 4) && arm_feature(env, ARM_FEATURE_THUMB_DSP)) { - apsrmask |= 0x000f0000; /* APSR GE[3:0] */ + apsrmask |= XPSR_GE; } xpsr_write(env, val, apsrmask); } -- 2.7.4 We currently store the M profile CPU register state PRIMASK and FAULTMASK in the daif field of the CPU state in its I and F bits. This is a legacy from the original implementation, which tried to share the cpu_exec_interrupt code between A profile and M profile. We've since separated out the two cases because they are significantly different, so now there is no common code between M and A profile which looks at env->daif: all the uses are either in A-only or M-only code paths. Sharing the state fields now is just confusing, and will make things awkward when we implement v8M, where the PRIMASK and FAULTMASK registers are banked between security states. Switch M profile over to using v7m.faultmask and v7m.primask fields for these registers. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-10-git-send-email-peter.maydell@linaro.org --- target/arm/cpu.h | 4 +++- hw/intc/armv7m_nvic.c | 4 ++-- target/arm/cpu.c | 5 ----- target/arm/helper.c | 18 +++++------------- target/arm/machine.c | 33 +++++++++++++++++++++++++++++++++ 5 files changed, 43 insertions(+), 21 deletions(-) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState { uint32_t bfar; /* BusFault Address */ unsigned mpu_ctrl; /* MPU_CTRL */ int exception; + uint32_t primask; + uint32_t faultmask; } v7m; /* Information associated with an exception about to be taken: @@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch) * we're in a HardFault or NMI handler. */ if ((env->v7m.exception > 0 && env->v7m.exception <= 3) - || env->daif & PSTATE_F) { + || env->v7m.faultmask) { return arm_to_core_mmu_idx(ARMMMUIdx_MNegPri); } diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -XXX,XX +XXX,XX @@ static inline int nvic_exec_prio(NVICState *s) CPUARMState *env = &s->cpu->env; int running; - if (env->daif & PSTATE_F) { /* FAULTMASK */ + if (env->v7m.faultmask) { running = -1; - } else if (env->daif & PSTATE_I) { /* PRIMASK */ + } else if (env->v7m.primask) { running = 0; } else if (env->v7m.basepri > 0) { running = env->v7m.basepri & nvic_gprio_mask(s); diff --git a/target/arm/cpu.c b/target/arm/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s) uint32_t initial_pc; /* Loaded from 0x4 */ uint8_t *rom; - /* For M profile we store FAULTMASK and PRIMASK in the - * PSTATE F and I bits; these are both clear at reset. - */ - env->daif &= ~(PSTATE_I | PSTATE_F); - /* The reset value of this bit is IMPDEF, but ARM recommends * that it resets to 1, so QEMU always does that rather than making * it dependent on CPU model. diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) if (env->v7m.exception != ARMV7M_EXCP_NMI) { /* Auto-clear FAULTMASK on return from other than NMI */ - env->daif &= ~PSTATE_F; + env->v7m.faultmask = 0; } switch (armv7m_nvic_complete_irq(env->nvic, env->v7m.exception)) { @@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg) return (env->v7m.control & R_V7M_CONTROL_SPSEL_MASK) ? env->regs[13] : env->v7m.other_sp; case 16: /* PRIMASK */ - return (env->daif & PSTATE_I) != 0; + return env->v7m.primask; case 17: /* BASEPRI */ case 18: /* BASEPRI_MAX */ return env->v7m.basepri; case 19: /* FAULTMASK */ - return (env->daif & PSTATE_F) != 0; + return env->v7m.faultmask; default: qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special" " register %d\n", reg); @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) } break; case 16: /* PRIMASK */ - if (val & 1) { - env->daif |= PSTATE_I; - } else { - env->daif &= ~PSTATE_I; - } + env->v7m.primask = val & 1; break; case 17: /* BASEPRI */ env->v7m.basepri = val & 0xff; @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) env->v7m.basepri = val; break; case 19: /* FAULTMASK */ - if (val & 1) { - env->daif |= PSTATE_F; - } else { - env->daif &= ~PSTATE_F; - } + env->v7m.faultmask = val & 1; break; case 20: /* CONTROL */ /* Writing to the SPSEL bit only has an effect if we are in diff --git a/target/arm/machine.c b/target/arm/machine.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/machine.c +++ b/target/arm/machine.c @@ -XXX,XX +XXX,XX @@ static bool m_needed(void *opaque) return arm_feature(env, ARM_FEATURE_M); } +static const VMStateDescription vmstate_m_faultmask_primask = { + .name = "cpu/m/faultmask-primask", + .version_id = 1, + .minimum_version_id = 1, + .fields = (VMStateField[]) { + VMSTATE_UINT32(env.v7m.faultmask, ARMCPU), + VMSTATE_UINT32(env.v7m.primask, ARMCPU), + VMSTATE_END_OF_LIST() + } +}; + static const VMStateDescription vmstate_m = { .name = "cpu/m", .version_id = 4, @@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = { VMSTATE_UINT32(env.v7m.mpu_ctrl, ARMCPU), VMSTATE_INT32(env.v7m.exception, ARMCPU), VMSTATE_END_OF_LIST() + }, + .subsections = (const VMStateDescription*[]) { + &vmstate_m_faultmask_primask, + NULL } }; @@ -XXX,XX +XXX,XX @@ static int get_cpsr(QEMUFile *f, void *opaque, size_t size, CPUARMState *env = &cpu->env; uint32_t val = qemu_get_be32(f); + if (arm_feature(env, ARM_FEATURE_M)) { + /* If the I or F bits are set then this is a migration from + * an old QEMU which still stored the M profile FAULTMASK + * and PRIMASK in env->daif. Set v7m.faultmask and v7m.primask + * accordingly, and then clear the bits so they don't confuse + * cpsr_write(). For a new QEMU, the bits here will always be + * clear, and the data is transferred using the + * vmstate_m_faultmask_primask subsection. + */ + if (val & CPSR_F) { + env->v7m.faultmask = 1; + } + if (val & CPSR_I) { + env->v7m.primask = 1; + } + val &= ~(CPSR_F | CPSR_I); + } + env->aarch64 = ((val & PSTATE_nRW) == 0); if (is_a64(env)) { -- 2.7.4 For M profile the XPSR is a similar but not identical format to the A profile CPSR/SPSR. (For instance the Thumb bit is in a different place.) For guest accesses we make the M profile code go through xpsr_read() and xpsr_write() which handle the different layout. However for migration we use cpsr_read() and cpsr_write() to marshal state into and out of the migration data stream. This is pretty confusing and works more by luck than anything else. Make M profile migration use xpsr_read() and xpsr_write() instead. The most complicated part of this is handling the possibility that the migration source is an older QEMU which hands us a CPSR format value; helpfully we can always tell the two apart. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-11-git-send-email-peter.maydell@linaro.org --- target/arm/machine.c | 49 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 34 insertions(+), 15 deletions(-) diff --git a/target/arm/machine.c b/target/arm/machine.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/machine.c +++ b/target/arm/machine.c @@ -XXX,XX +XXX,XX @@ static int get_cpsr(QEMUFile *f, void *opaque, size_t size, uint32_t val = qemu_get_be32(f); if (arm_feature(env, ARM_FEATURE_M)) { - /* If the I or F bits are set then this is a migration from - * an old QEMU which still stored the M profile FAULTMASK - * and PRIMASK in env->daif. Set v7m.faultmask and v7m.primask - * accordingly, and then clear the bits so they don't confuse - * cpsr_write(). For a new QEMU, the bits here will always be - * clear, and the data is transferred using the - * vmstate_m_faultmask_primask subsection. - */ - if (val & CPSR_F) { - env->v7m.faultmask = 1; - } - if (val & CPSR_I) { - env->v7m.primask = 1; + if (val & XPSR_EXCP) { + /* This is a CPSR format value from an older QEMU. (We can tell + * because values transferred in XPSR format always have zero + * for the EXCP field, and CPSR format will always have bit 4 + * set in CPSR_M.) Rearrange it into XPSR format. The significant + * differences are that the T bit is not in the same place, the + * primask/faultmask info may be in the CPSR I and F bits, and + * we do not want the mode bits. + */ + uint32_t newval = val; + + newval &= (CPSR_NZCV | CPSR_Q | CPSR_IT | CPSR_GE); + if (val & CPSR_T) { + newval |= XPSR_T; + } + /* If the I or F bits are set then this is a migration from + * an old QEMU which still stored the M profile FAULTMASK + * and PRIMASK in env->daif. For a new QEMU, the data is + * transferred using the vmstate_m_faultmask_primask subsection. + */ + if (val & CPSR_F) { + env->v7m.faultmask = 1; + } + if (val & CPSR_I) { + env->v7m.primask = 1; + } + val = newval; } - val &= ~(CPSR_F | CPSR_I); + /* Ignore the low bits, they are handled by vmstate_m. */ + xpsr_write(env, val, ~XPSR_EXCP); + return 0; } env->aarch64 = ((val & PSTATE_nRW) == 0); @@ -XXX,XX +XXX,XX @@ static int put_cpsr(QEMUFile *f, void *opaque, size_t size, CPUARMState *env = &cpu->env; uint32_t val; - if (is_a64(env)) { + if (arm_feature(env, ARM_FEATURE_M)) { + /* The low 9 bits are v7m.exception, which is handled by vmstate_m. */ + val = xpsr_read(env) & ~XPSR_EXCP; + } else if (is_a64(env)) { val = pstate_read(env); } else { val = cpsr_read(env); -- 2.7.4 Make the arm_cpu_dump_state() debug logging handle the M-profile XPSR rather than assuming it's an A-profile CPSR. On M profile the PSR line of a register dump will now look like this: XPSR=41000000 -Z-- T priv-thread Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-12-git-send-email-peter.maydell@linaro.org --- target/arm/translate.c | 58 ++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 18 deletions(-) diff --git a/target/arm/translate.c b/target/arm/translate.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/translate.c +++ b/target/arm/translate.c @@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf, ARMCPU *cpu = ARM_CPU(cs); CPUARMState *env = &cpu->env; int i; - uint32_t psr; - const char *ns_status; if (is_a64(env)) { aarch64_cpu_dump_state(cs, f, cpu_fprintf, flags); @@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf, else cpu_fprintf(f, " "); } - psr = cpsr_read(env); - if (arm_feature(env, ARM_FEATURE_EL3) && - (psr & CPSR_M) != ARM_CPU_MODE_MON) { - ns_status = env->cp15.scr_el3 & SCR_NS ? "NS " : "S "; + if (arm_feature(env, ARM_FEATURE_M)) { + uint32_t xpsr = xpsr_read(env); + const char *mode; + + if (xpsr & XPSR_EXCP) { + mode = "handler"; + } else { + if (env->v7m.control & R_V7M_CONTROL_NPRIV_MASK) { + mode = "unpriv-thread"; + } else { + mode = "priv-thread"; + } + } + + cpu_fprintf(f, "XPSR=%08x %c%c%c%c %c %s\n", + xpsr, + xpsr & XPSR_N ? 'N' : '-', + xpsr & XPSR_Z ? 'Z' : '-', + xpsr & XPSR_C ? 'C' : '-', + xpsr & XPSR_V ? 'V' : '-', + xpsr & XPSR_T ? 'T' : 'A', + mode); } else { - ns_status = ""; - } - - cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%s%d\n", - psr, - psr & (1 << 31) ? 'N' : '-', - psr & (1 << 30) ? 'Z' : '-', - psr & (1 << 29) ? 'C' : '-', - psr & (1 << 28) ? 'V' : '-', - psr & CPSR_T ? 'T' : 'A', - ns_status, - cpu_mode_names[psr & 0xf], (psr & 0x10) ? 32 : 26); + uint32_t psr = cpsr_read(env); + const char *ns_status = ""; + + if (arm_feature(env, ARM_FEATURE_EL3) && + (psr & CPSR_M) != ARM_CPU_MODE_MON) { + ns_status = env->cp15.scr_el3 & SCR_NS ? "NS " : "S "; + } + + cpu_fprintf(f, "PSR=%08x %c%c%c%c %c %s%s%d\n", + psr, + psr & CPSR_N ? 'N' : '-', + psr & CPSR_Z ? 'Z' : '-', + psr & CPSR_C ? 'C' : '-', + psr & CPSR_V ? 'V' : '-', + psr & CPSR_T ? 'T' : 'A', + ns_status, + cpu_mode_names[psr & 0xf], (psr & 0x10) ? 32 : 26); + } if (flags & CPU_DUMP_FPU) { int numvfpregs = 0; -- 2.7.4 Move the code in arm_v7m_cpu_do_interrupt() that calculates the magic LR value down to when we're actually going to use it. Having the calculation and use so far apart makes the code a little harder to understand than it needs to be. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-13-git-send-email-peter.maydell@linaro.org --- target/arm/helper.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) arm_log_exception(cs->exception_index); - lr = 0xfffffff1; - if (env->v7m.control & R_V7M_CONTROL_SPSEL_MASK) { - lr |= 4; - } - if (env->v7m.exception == 0) - lr |= 8; - /* For exceptions we just mark as pending on the NVIC, and let that handle it. */ switch (cs->exception_index) { @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) return; /* Never happens. Keep compiler happy. */ } + lr = 0xfffffff1; + if (env->v7m.control & R_V7M_CONTROL_SPSEL_MASK) { + lr |= 4; + } + if (env->v7m.exception == 0) { + lr |= 8; + } + v7m_push_stack(cpu); v7m_exception_taken(cpu, lr); qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception); -- 2.7.4 Add a utility function for testing whether the CPU is in Handler mode; this is just a check whether v7m.exception is non-zero, but we do it in several places and it makes the code a bit easier to read to not have to mentally figure out what the test is testing. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-14-git-send-email-peter.maydell@linaro.org --- target/arm/cpu.h | 10 ++++++++-- target/arm/helper.c | 8 ++++---- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ static inline int arm_highest_el(CPUARMState *env) return 1; } +/* Return true if a v7M CPU is in Handler mode */ +static inline bool arm_v7m_is_handler_mode(CPUARMState *env) +{ + return env->v7m.exception != 0; +} + /* Return the current Exception Level (as per ARMv8; note that this differs * from the ARMv7 Privilege Level). */ static inline int arm_current_el(CPUARMState *env) { if (arm_feature(env, ARM_FEATURE_M)) { - return !((env->v7m.exception == 0) && (env->v7m.control & 1)); + return arm_v7m_is_handler_mode(env) || !(env->v7m.control & 1); } if (is_a64(env)) { @@ -XXX,XX +XXX,XX @@ static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc, } *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT; - if (env->v7m.exception != 0) { + if (arm_v7m_is_handler_mode(env)) { *flags |= ARM_TBFLAG_HANDLER_MASK; } diff --git a/target/arm/helper.c b/target/arm/helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) * that jumps to magic addresses don't have magic behaviour unless * we're in Handler mode (compare pseudocode BXWritePC()). */ - assert(env->v7m.exception != 0); + assert(arm_v7m_is_handler_mode(env)); /* In the spec pseudocode ExceptionReturn() is called directly * from BXWritePC() and gets the full target PC value including @@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu) * resuming in Thread mode. If that doesn't match what the * exception return type specified then this is a UsageFault. */ - if (return_to_handler == (env->v7m.exception == 0)) { + if (return_to_handler != arm_v7m_is_handler_mode(env)) { /* Take an INVPC UsageFault by pushing the stack again. */ armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE); env->v7m.cfsr |= R_V7M_CFSR_INVPC_MASK; @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs) if (env->v7m.control & R_V7M_CONTROL_SPSEL_MASK) { lr |= 4; } - if (env->v7m.exception == 0) { + if (!arm_v7m_is_handler_mode(env)) { lr |= 8; } @@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val) * switch_v7m_sp() deals with updating the SPSEL bit in * env->v7m.control, so we only need update the others. */ - if (env->v7m.exception == 0) { + if (!arm_v7m_is_handler_mode(env)) { switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0); } env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK; -- 2.7.4 The armv7m_nvic.h header file was accidentally placed in include/hw/arm; move it to include/hw/intc to match where its corresponding .c file lives. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-15-git-send-email-peter.maydell@linaro.org --- include/hw/arm/armv7m.h | 2 +- include/hw/{arm => intc}/armv7m_nvic.h | 0 hw/intc/armv7m_nvic.c | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) rename include/hw/{arm => intc}/armv7m_nvic.h (100%) diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armv7m.h +++ b/include/hw/arm/armv7m.h @@ -XXX,XX +XXX,XX @@ #define HW_ARM_ARMV7M_H #include "hw/sysbus.h" -#include "hw/arm/armv7m_nvic.h" +#include "hw/intc/armv7m_nvic.h" #define TYPE_BITBAND "ARM,bitband-memory" #define BITBAND(obj) OBJECT_CHECK(BitBandState, (obj), TYPE_BITBAND) diff --git a/include/hw/arm/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h similarity index 100% rename from include/hw/arm/armv7m_nvic.h rename to include/hw/intc/armv7m_nvic.h diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -XXX,XX +XXX,XX @@ #include "hw/sysbus.h" #include "qemu/timer.h" #include "hw/arm/arm.h" -#include "hw/arm/armv7m_nvic.h" +#include "hw/intc/armv7m_nvic.h" #include "target/arm/cpu.h" #include "exec/exec-all.h" #include "qemu/log.h" -- 2.7.4 The ARMv7M architecture specifies that most of the addresses in the PPB region (which includes the NVIC, systick and system registers) are not accessible to unprivileged accesses, which should BusFault with a few exceptions: * the STIR is configurably user-accessible * the ITM (which we don't implement at all) is always user-accessible Implement this by switching the register access functions to the _with_attrs scheme that lets us distinguish user mode accesses. This allows us to pull the handling of the CCR.USERSETMPEND flag up to the level where we can make it generate a BusFault as it should for non-permitted accesses. Note that until the core ARM CPU code implements turning MEMTX_ERROR into a BusFault the registers will continue to act as RAZ/WI to user accesses. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1501692241-23310-16-git-send-email-peter.maydell@linaro.org --- hw/intc/armv7m_nvic.c | 58 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 41 insertions(+), 17 deletions(-) diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/armv7m_nvic.c +++ b/hw/intc/armv7m_nvic.c @@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value) } case 0xf00: /* Software Triggered Interrupt Register */ { - /* user mode can only write to STIR if CCR.USERSETMPEND permits it */ int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ; - if (excnum < s->num_irq && - (arm_current_el(&cpu->env) || - (cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK))) { + if (excnum < s->num_irq) { armv7m_nvic_set_pending(s, excnum); } break; @@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value) } } -static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, - unsigned size) +static bool nvic_user_access_ok(NVICState *s, hwaddr offset) +{ + /* Return true if unprivileged access to this register is permitted. */ + switch (offset) { + case 0xf00: /* STIR: accessible only if CCR.USERSETMPEND permits */ + return s->cpu->env.v7m.ccr & R_V7M_CCR_USERSETMPEND_MASK; + default: + /* All other user accesses cause a BusFault unconditionally */ + return false; + } +} + +static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr, + uint64_t *data, unsigned size, + MemTxAttrs attrs) { NVICState *s = (NVICState *)opaque; uint32_t offset = addr; unsigned i, startvec, end; uint32_t val; + if (attrs.user && !nvic_user_access_ok(s, addr)) { + /* Generate BusFault for unprivileged accesses */ + return MEMTX_ERROR; + } + switch (offset) { /* reads of set and clear both return the status */ case 0x100 ... 0x13f: /* NVIC Set enable */ @@ -XXX,XX +XXX,XX @@ static uint64_t nvic_sysreg_read(void *opaque, hwaddr addr, } trace_nvic_sysreg_read(addr, val, size); - return val; + *data = val; + return MEMTX_OK; } -static void nvic_sysreg_write(void *opaque, hwaddr addr, - uint64_t value, unsigned size) +static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr, + uint64_t value, unsigned size, + MemTxAttrs attrs) { NVICState *s = (NVICState *)opaque; uint32_t offset = addr; @@ -XXX,XX +XXX,XX @@ static void nvic_sysreg_write(void *opaque, hwaddr addr, trace_nvic_sysreg_write(addr, value, size); + if (attrs.user && !nvic_user_access_ok(s, addr)) { + /* Generate BusFault for unprivileged accesses */ + return MEMTX_ERROR; + } + switch (offset) { case 0x100 ... 0x13f: /* NVIC Set enable */ offset += 0x80; @@ -XXX,XX +XXX,XX @@ static void nvic_sysreg_write(void *opaque, hwaddr addr, } } nvic_irq_update(s); - return; + return MEMTX_OK; case 0x200 ... 0x23f: /* NVIC Set pend */ /* the special logic in armv7m_nvic_set_pending() * is not needed since IRQs are never escalated @@ -XXX,XX +XXX,XX @@ static void nvic_sysreg_write(void *opaque, hwaddr addr, } } nvic_irq_update(s); - return; + return MEMTX_OK; case 0x300 ... 0x33f: /* NVIC Active */ - return; /* R/O */ + return MEMTX_OK; /* R/O */ case 0x400 ... 0x5ef: /* NVIC Priority */ startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */ @@ -XXX,XX +XXX,XX @@ static void nvic_sysreg_write(void *opaque, hwaddr addr, set_prio(s, startvec + i, (value >> (i * 8)) & 0xff); } nvic_irq_update(s); - return; + return MEMTX_OK; case 0xd18 ... 0xd23: /* System Handler Priority. */ for (i = 0; i < size; i++) { unsigned hdlidx = (offset - 0xd14) + i; set_prio(s, hdlidx, (value >> (i * 8)) & 0xff); } nvic_irq_update(s); - return; + return MEMTX_OK; } if (size == 4) { nvic_writel(s, offset, value); - return; + return MEMTX_OK; } qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad write of size %d at offset 0x%x\n", size, offset); + /* This is UNPREDICTABLE; treat as RAZ/WI */ + return MEMTX_OK; } static const MemoryRegionOps nvic_sysreg_ops = { - .read = nvic_sysreg_read, - .write = nvic_sysreg_write, + .read_with_attrs = nvic_sysreg_read, + .write_with_attrs = nvic_sysreg_write, .endianness = DEVICE_NATIVE_ENDIAN, }; -- 2.7.4 For embedded systems, notably ARM, one common use of ELF file segments is that the 'physical addresses' represent load addresses and the 'virtual addresses' execution addresses, such that the load addresses are packed into ROM or flash, and the relocation and zero-initialization of data is done at runtime. This means that the 'memsz' in the segment header represents the runtime size of the segment, but the size that needs to be loaded is only the 'filesz'. In particular, paddr+memsz may overlap with the next segment to be loaded, as in this example: 0x70000001 off 0x00007f68 vaddr 0x00008150 paddr 0x00008150 align 2**2 filesz 0x00000008 memsz 0x00000008 flags r-- LOAD off 0x000000f4 vaddr 0x00000000 paddr 0x00000000 align 2**2 filesz 0x00000124 memsz 0x00000124 flags r-- LOAD off 0x00000218 vaddr 0x00000400 paddr 0x00000400 align 2**3 filesz 0x00007d58 memsz 0x00007d58 flags r-x LOAD off 0x00007f70 vaddr 0x20000140 paddr 0x00008158 align 2**3 filesz 0x00000a80 memsz 0x000022f8 flags rw- LOAD off 0x000089f0 vaddr 0x20002438 paddr 0x00008bd8 align 2**0 filesz 0x00000000 memsz 0x00004000 flags rw- LOAD off 0x000089f0 vaddr 0x20000000 paddr 0x20000000 align 2**0 filesz 0x00000000 memsz 0x00000140 flags rw- where the segment at paddr 0x8158 has a memsz of 0x2258 and would overlap with the segment at paddr 0x8bd8 if QEMU's loader tried to honour it. (At runtime the segments will not overlap since their vaddrs are more widely spaced than their paddrs.) Currently if you try to load an ELF file like this with QEMU then it will fail with an error "rom: requested regions overlap", because we create a ROM image for each segment using the memsz as the size. Support ELF files using this scheme, by truncating the zero-initialized part of the segment if it would overlap another segment. This will retain the existing loader behaviour for all ELF files we currently accept, and also accept ELF files which only need 'filesz' bytes to be loaded. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 1502116754-18867-2-git-send-email-peter.maydell@linaro.org --- include/hw/elf_ops.h | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/elf_ops.h +++ b/include/hw/elf_ops.h @@ -XXX,XX +XXX,XX @@ static int glue(load_elf, SZ)(const char *name, int fd, goto fail; } } + + /* The ELF spec is somewhat vague about the purpose of the + * physical address field. One common use in the embedded world + * is that physical address field specifies the load address + * and the virtual address field specifies the execution address. + * Segments are packed into ROM or flash, and the relocation + * and zero-initialization of data is done at runtime. This + * means that the memsz header represents the runtime size of the + * segment, but the filesz represents the loadtime size. If + * we try to honour the memsz value for an ELF file like this + * we will end up with overlapping segments (which the + * loader.c code will later reject). + * We support ELF files using this scheme by by checking whether + * paddr + memsz for this segment would overlap with any other + * segment. If so, then we assume it's using this scheme and + * truncate the loaded segment to the filesz size. + * If the segment considered as being memsz size doesn't overlap + * then we use memsz for the segment length, to handle ELF files + * which assume that the loader will do the zero-initialization. + */ + if (mem_size > file_size) { + /* If this segment's zero-init portion overlaps another + * segment's data or zero-init portion, then truncate this one. + * Invalid ELF files where the segments overlap even when + * only file_size bytes are loaded will be rejected by + * the ROM overlap check in loader.c, so we don't try to + * explicitly detect those here. + */ + int j; + elf_word zero_start = ph->p_paddr + file_size; + elf_word zero_end = ph->p_paddr + mem_size; + + for (j = 0; j < ehdr.e_phnum; j++) { + struct elf_phdr *jph = &phdr[j]; + + if (i != j && jph->p_type == PT_LOAD) { + elf_word other_start = jph->p_paddr; + elf_word other_end = jph->p_paddr + jph->p_memsz; + + if (!(other_start >= zero_end || + zero_start >= other_end)) { + mem_size = file_size; + break; + } + } + } + } + /* address_offset is hack for kernel images that are linked at the wrong physical address. */ if (translate_fn) { -- 2.7.4 Some ELF files have program headers that specify segments that are of zero size. Ignore them, rather than trying to create zero-length ROM blobs for them, because the zero-length blob can falsely trigger the overlapping-ROM-blobs check. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Tested-by: Hua Yanghao <huayanghao@gmail.com> Message-id: 1502116754-18867-3-git-send-email-peter.maydell@linaro.org --- include/hw/elf_ops.h | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/elf_ops.h +++ b/include/hw/elf_ops.h @@ -XXX,XX +XXX,XX @@ static int glue(load_elf, SZ)(const char *name, int fd, *pentry = ehdr.e_entry - ph->p_vaddr + ph->p_paddr; } - if (load_rom) { - snprintf(label, sizeof(label), "phdr #%d: %s", i, name); - - /* rom_add_elf_program() seize the ownership of 'data' */ - rom_add_elf_program(label, data, file_size, mem_size, addr, as); - } else { - cpu_physical_memory_write(addr, data, file_size); + if (mem_size == 0) { + /* Some ELF files really do have segments of zero size; + * just ignore them rather than trying to create empty + * ROM blobs, because the zero-length blob can falsely + * trigger the overlapping-ROM-blobs check. + */ g_free(data); + } else { + if (load_rom) { + snprintf(label, sizeof(label), "phdr #%d: %s", i, name); + + /* rom_add_elf_program() seize the ownership of 'data' */ + rom_add_elf_program(label, data, file_size, mem_size, + addr, as); + } else { + cpu_physical_memory_write(addr, data, file_size); + g_free(data); + } } total_size += mem_size; -- 2.7.4 From: Philippe Mathieu-Daudé <f4bug@amsat.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/arm/armv7m.c | 4 ++-- hw/arm/exynos4210.c | 4 ++-- hw/arm/highbank.c | 11 +++++++---- hw/arm/realview.c | 6 ++++-- hw/arm/vexpress.c | 6 ++++-- hw/arm/xilinx_zynq.c | 14 ++++++++------ 6 files changed, 27 insertions(+), 18 deletions(-) diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armv7m.c +++ b/hw/arm/armv7m.c @@ -XXX,XX +XXX,XX @@ static void armv7m_instance_init(Object *obj) &error_abort); memory_region_init(&s->container, obj, "armv7m-container", UINT64_MAX); - object_initialize(&s->nvic, sizeof(s->nvic), "armv7m_nvic"); + object_initialize(&s->nvic, sizeof(s->nvic), TYPE_NVIC); qdev_set_parent_bus(DEVICE(&s->nvic), sysbus_get_default()); object_property_add_alias(obj, "num-irq", OBJECT(&s->nvic), "num-irq", &error_abort); @@ -XXX,XX +XXX,XX @@ DeviceState *armv7m_init(MemoryRegion *system_memory, int mem_size, int num_irq, cpu_model = "cortex-m3"; } - armv7m = qdev_create(NULL, "armv7m"); + armv7m = qdev_create(NULL, TYPE_ARMV7M); qdev_prop_set_uint32(armv7m, "num-irq", num_irq); qdev_prop_set_string(armv7m, "cpu-model", cpu_model); object_property_set_link(OBJECT(armv7m), OBJECT(get_system_memory()), diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/exynos4210.c +++ b/hw/arm/exynos4210.c @@ -XXX,XX +XXX,XX @@ #include "hw/arm/arm.h" #include "hw/loader.h" #include "hw/arm/exynos4210.h" -#include "hw/sd/sd.h" +#include "hw/sd/sdhci.h" #include "hw/usb/hcd-ehci.h" #define EXYNOS4210_CHIPID_ADDR 0x10000000 @@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem) BlockBackend *blk; DriveInfo *di; - dev = qdev_create(NULL, "generic-sdhci"); + dev = qdev_create(NULL, TYPE_SYSBUS_SDHCI); qdev_prop_set_uint32(dev, "capareg", EXYNOS4210_SDHCI_CAPABILITIES); qdev_init_nofail(dev); diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/highbank.c +++ b/hw/arm/highbank.c @@ -XXX,XX +XXX,XX @@ #include "exec/address-spaces.h" #include "qemu/error-report.h" #include "hw/char/pl011.h" +#include "hw/ide/ahci.h" +#include "hw/cpu/a9mpcore.h" +#include "hw/cpu/a15mpcore.h" #define SMP_BOOT_ADDR 0x100 #define SMP_BOOT_REG 0x40 @@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id) busdev = SYS_BUS_DEVICE(dev); sysbus_mmio_map(busdev, 0, 0xfff12000); - dev = qdev_create(NULL, "a9mpcore_priv"); + dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV); break; case CALXEDA_MIDWAY: - dev = qdev_create(NULL, "a15mpcore_priv"); + dev = qdev_create(NULL, TYPE_A15MPCORE_PRIV); break; } qdev_prop_set_uint32(dev, "num-cpu", smp_cpus); @@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id) sysbus_connect_irq(busdev, 0, pic[18]); pl011_create(0xfff36000, pic[20], serial_hds[0]); - dev = qdev_create(NULL, "highbank-regs"); + dev = qdev_create(NULL, TYPE_HIGHBANK_REGISTERS); qdev_init_nofail(dev); busdev = SYS_BUS_DEVICE(dev); sysbus_mmio_map(busdev, 0, 0xfff3c000); @@ -XXX,XX +XXX,XX @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id) sysbus_create_simple("pl031", 0xfff35000, pic[19]); sysbus_create_simple("pl022", 0xfff39000, pic[23]); - sysbus_create_simple("sysbus-ahci", 0xffe08000, pic[83]); + sysbus_create_simple(TYPE_SYSBUS_AHCI, 0xffe08000, pic[83]); if (nd_table[0].used) { qemu_check_nic_model(&nd_table[0], "xgmac"); diff --git a/hw/arm/realview.c b/hw/arm/realview.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/realview.c +++ b/hw/arm/realview.c @@ -XXX,XX +XXX,XX @@ #include "exec/address-spaces.h" #include "qemu/error-report.h" #include "hw/char/pl011.h" +#include "hw/cpu/a9mpcore.h" +#include "hw/intc/realview_gic.h" #define SMP_BOOT_ADDR 0xe0000000 #define SMP_BOOTREG_ADDR 0x10000030 @@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine, sysbus_mmio_map(SYS_BUS_DEVICE(sysctl), 0, 0x10000000); if (is_mpcore) { - dev = qdev_create(NULL, is_pb ? "a9mpcore_priv": "realview_mpcore"); + dev = qdev_create(NULL, is_pb ? TYPE_A9MPCORE_PRIV : "realview_mpcore"); qdev_prop_set_uint32(dev, "num-cpu", smp_cpus); qdev_init_nofail(dev); busdev = SYS_BUS_DEVICE(dev); @@ -XXX,XX +XXX,XX @@ static void realview_init(MachineState *machine, } else { uint32_t gic_addr = is_pb ? 0x1e000000 : 0x10040000; /* For now just create the nIRQ GIC, and ignore the others. */ - dev = sysbus_create_simple("realview_gic", gic_addr, cpu_irq[0]); + dev = sysbus_create_simple(TYPE_REALVIEW_GIC, gic_addr, cpu_irq[0]); } for (n = 0; n < 64; n++) { pic[n] = qdev_get_gpio_in(dev, n); diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/vexpress.c +++ b/hw/arm/vexpress.c @@ -XXX,XX +XXX,XX @@ #include "qemu/error-report.h" #include <libfdt.h> #include "hw/char/pl011.h" +#include "hw/cpu/a9mpcore.h" +#include "hw/cpu/a15mpcore.h" #define VEXPRESS_BOARD_ID 0x8e0 #define VEXPRESS_FLASH_SIZE (64 * 1024 * 1024) @@ -XXX,XX +XXX,XX @@ static void a9_daughterboard_init(const VexpressMachineState *vms, memory_region_add_subregion(sysmem, 0x60000000, ram); /* 0x1e000000 A9MPCore (SCU) private memory region */ - init_cpus(cpu_model, "a9mpcore_priv", 0x1e000000, pic, vms->secure); + init_cpus(cpu_model, TYPE_A9MPCORE_PRIV, 0x1e000000, pic, vms->secure); /* Daughterboard peripherals : 0x10020000 .. 0x20000000 */ @@ -XXX,XX +XXX,XX @@ static void a15_daughterboard_init(const VexpressMachineState *vms, memory_region_add_subregion(sysmem, 0x80000000, ram); /* 0x2c000000 A15MPCore private memory region (GIC) */ - init_cpus(cpu_model, "a15mpcore_priv", 0x2c000000, pic, vms->secure); + init_cpus(cpu_model, TYPE_A15MPCORE_PRIV, 0x2c000000, pic, vms->secure); /* A15 daughterboard peripherals: */ diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/xilinx_zynq.c +++ b/hw/arm/xilinx_zynq.c @@ -XXX,XX +XXX,XX @@ #include "hw/misc/zynq-xadc.h" #include "hw/ssi/ssi.h" #include "qemu/error-report.h" -#include "hw/sd/sd.h" +#include "hw/sd/sdhci.h" #include "hw/char/cadence_uart.h" +#include "hw/net/cadence_gem.h" +#include "hw/cpu/a9mpcore.h" #define NUM_SPI_FLASHES 4 #define NUM_QSPI_FLASHES 2 @@ -XXX,XX +XXX,XX @@ static void gem_init(NICInfo *nd, uint32_t base, qemu_irq irq) DeviceState *dev; SysBusDevice *s; - dev = qdev_create(NULL, "cadence_gem"); + dev = qdev_create(NULL, TYPE_CADENCE_GEM); if (nd->used) { - qemu_check_nic_model(nd, "cadence_gem"); + qemu_check_nic_model(nd, TYPE_CADENCE_GEM); qdev_set_nic_properties(dev, nd); } qdev_init_nofail(dev); @@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine) qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xF8000000); - dev = qdev_create(NULL, "a9mpcore_priv"); + dev = qdev_create(NULL, TYPE_A9MPCORE_PRIV); qdev_prop_set_uint32(dev, "num-cpu", 1); qdev_init_nofail(dev); busdev = SYS_BUS_DEVICE(dev); @@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine) gem_init(&nd_table[0], 0xE000B000, pic[54-IRQ_OFFSET]); gem_init(&nd_table[1], 0xE000C000, pic[77-IRQ_OFFSET]); - dev = qdev_create(NULL, "generic-sdhci"); + dev = qdev_create(NULL, TYPE_SYSBUS_SDHCI); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xE0100000); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[56-IRQ_OFFSET]); @@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine) qdev_prop_set_drive(carddev, "drive", blk, &error_fatal); object_property_set_bool(OBJECT(carddev), true, "realized", &error_fatal); - dev = qdev_create(NULL, "generic-sdhci"); + dev = qdev_create(NULL, TYPE_SYSBUS_SDHCI); qdev_init_nofail(dev); sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, 0xE0101000); sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[79-IRQ_OFFSET]); -- 2.7.4 From: Andrew Jones <drjones@redhat.com> Mimicking gicv3-maintenance-interrupt, add the PMU's interrupt to CPU state. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1500471597-2517-2-git-send-email-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/cpu.h | 2 ++ hw/arm/virt.c | 3 +++ target/arm/cpu.c | 2 ++ 3 files changed, 7 insertions(+) diff --git a/target/arm/cpu.h b/target/arm/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.h +++ b/target/arm/cpu.h @@ -XXX,XX +XXX,XX @@ struct ARMCPU { qemu_irq gt_timer_outputs[NUM_GTIMERS]; /* GPIO output for GICv3 maintenance interrupt signal */ qemu_irq gicv3_maintenance_interrupt; + /* GPIO output for the PMU interrupt */ + qemu_irq pmu_interrupt; /* MemoryRegion to use for secure physical accesses */ MemoryRegion *secure_memory; diff --git a/hw/arm/virt.c b/hw/arm/virt.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms, qemu_irq *pic) qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt", 0, qdev_get_gpio_in(gicdev, ppibase + ARCH_GICV3_MAINT_IRQ)); + qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0, + qdev_get_gpio_in(gicdev, ppibase + + VIRTUAL_PMU_IRQ)); sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ)); sysbus_connect_irq(gicbusdev, i + smp_cpus, diff --git a/target/arm/cpu.c b/target/arm/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj) qdev_init_gpio_out_named(DEVICE(cpu), &cpu->gicv3_maintenance_interrupt, "gicv3-maintenance-interrupt", 1); + qdev_init_gpio_out_named(DEVICE(cpu), &cpu->pmu_interrupt, + "pmu-interrupt", 1); #endif /* DTB consumers generally don't in fact care what the 'compatible' -- 2.7.4 From: Andrew Jones <drjones@redhat.com> When adding a PMU with a userspace irqchip we skip the set-irq stage of device creation. Split the 'create' function into two functions 'init' and 'set-irq' so they may be called separately. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Christoffer Dall <cdall@linaro.org> Message-id: 1500471597-2517-3-git-send-email-drjones@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/kvm_arm.h | 10 ++++++++-- hw/arm/virt.c | 11 +++++++++-- target/arm/kvm32.c | 8 +++++++- target/arm/kvm64.c | 52 +++++++++++++++++++++++++--------------------------- 4 files changed, 49 insertions(+), 32 deletions(-) diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm_arm.h +++ b/target/arm/kvm_arm.h @@ -XXX,XX +XXX,XX @@ int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu); int kvm_arm_vgic_probe(void); -int kvm_arm_pmu_create(CPUState *cs, int irq); +int kvm_arm_pmu_set_irq(CPUState *cs, int irq); +int kvm_arm_pmu_init(CPUState *cs); #else @@ -XXX,XX +XXX,XX @@ static inline int kvm_arm_vgic_probe(void) return 0; } -static inline int kvm_arm_pmu_create(CPUState *cs, int irq) +static inline int kvm_arm_pmu_set_irq(CPUState *cs, int irq) +{ + return 0; +} + +static inline int kvm_arm_pmu_init(CPUState *cs) { return 0; } diff --git a/hw/arm/virt.c b/hw/arm/virt.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms) CPU_FOREACH(cpu) { armcpu = ARM_CPU(cpu); - if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU) || - (kvm_enabled() && !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ)))) { + if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) { return; } + if (kvm_enabled()) { + if (!kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ))) { + return; + } + if (!kvm_arm_pmu_init(cpu)) { + return; + } + } } if (vms->gic_version == 2) { diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm32.c +++ b/target/arm/kvm32.c @@ -XXX,XX +XXX,XX @@ bool kvm_arm_hw_debug_active(CPUState *cs) return false; } -int kvm_arm_pmu_create(CPUState *cs, int irq) +int kvm_arm_pmu_set_irq(CPUState *cs, int irq) +{ + qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__); + return 0; +} + +int kvm_arm_pmu_init(CPUState *cs) { qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__); return 0; diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm64.c +++ b/target/arm/kvm64.c @@ -XXX,XX +XXX,XX @@ static CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr) return NULL; } -static bool kvm_arm_pmu_support_ctrl(CPUState *cs, struct kvm_device_attr *attr) -{ - return kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr) == 0; -} - -int kvm_arm_pmu_create(CPUState *cs, int irq) +static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr) { int err; - struct kvm_device_attr attr = { - .group = KVM_ARM_VCPU_PMU_V3_CTRL, - .addr = (intptr_t)&irq, - .attr = KVM_ARM_VCPU_PMU_V3_IRQ, - .flags = 0, - }; - - if (!kvm_arm_pmu_support_ctrl(cs, &attr)) { - return 0; + err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr); + if (err != 0) { + return false; } - err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, &attr); + err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr); if (err < 0) { fprintf(stderr, "KVM_SET_DEVICE_ATTR failed: %s\n", strerror(-err)); abort(); } - attr.group = KVM_ARM_VCPU_PMU_V3_CTRL; - attr.attr = KVM_ARM_VCPU_PMU_V3_INIT; - attr.addr = 0; - attr.flags = 0; + return true; +} - err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, &attr); - if (err < 0) { - fprintf(stderr, "KVM_SET_DEVICE_ATTR failed: %s\n", - strerror(-err)); - abort(); - } +int kvm_arm_pmu_init(CPUState *cs) +{ + struct kvm_device_attr attr = { + .group = KVM_ARM_VCPU_PMU_V3_CTRL, + .attr = KVM_ARM_VCPU_PMU_V3_INIT, + }; + + return kvm_arm_pmu_set_attr(cs, &attr); +} + +int kvm_arm_pmu_set_irq(CPUState *cs, int irq) +{ + struct kvm_device_attr attr = { + .group = KVM_ARM_VCPU_PMU_V3_CTRL, + .addr = (intptr_t)&irq, + .attr = KVM_ARM_VCPU_PMU_V3_IRQ, + }; - return 1; + return kvm_arm_pmu_set_attr(cs, &attr); } static inline void set_feature(uint64_t *features, int feature) -- 2.7.4 From: Andrew Jones <drjones@redhat.com> Move the in-kernel-irqchip test to only guard the set-irq stage, not the init stage of the PMU. Also add the PMU to the KVM device irq line synchronization to enable its use. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Christoffer Dall <cdall@linaro.org> Message-id: 1500471597-2517-4-git-send-email-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/arm/virt.c | 3 ++- target/arm/kvm.c | 6 +++++- target/arm/kvm64.c | 3 +-- 3 files changed, 8 insertions(+), 4 deletions(-) diff --git a/hw/arm/virt.c b/hw/arm/virt.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms) return; } if (kvm_enabled()) { - if (!kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ))) { + if (kvm_irqchip_in_kernel() && + !kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ))) { return; } if (!kvm_arm_pmu_init(cpu)) { diff --git a/target/arm/kvm.c b/target/arm/kvm.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm.c +++ b/target/arm/kvm.c @@ -XXX,XX +XXX,XX @@ MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run) switched_level &= ~KVM_ARM_DEV_EL1_PTIMER; } - /* XXX PMU IRQ is missing */ + if (switched_level & KVM_ARM_DEV_PMU) { + qemu_set_irq(cpu->pmu_interrupt, + !!(run->s.regs.device_irq_level & KVM_ARM_DEV_PMU)); + switched_level &= ~KVM_ARM_DEV_PMU; + } if (switched_level) { qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n", diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm64.c +++ b/target/arm/kvm64.c @@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs) if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) { cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT; } - if (!kvm_irqchip_in_kernel() || - !kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) { + if (!kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) { cpu->has_pmu = false; } if (cpu->has_pmu) { -- 2.7.4 From: Andrew Jones <drjones@redhat.com> If a KVM PMU init or set-irq attr call fails we just silently stop the PMU DT node generation. The only way they could fail, though, is if the attr's respective KVM has-attr call fails. But that should never happen if KVM advertises the PMU capability, because both attrs have been available since the capability was introduced. Let's just abort if this should-never-happen stuff does happen, because, if it does, then something is obviously horribly wrong. Signed-off-by: Andrew Jones <drjones@redhat.com> Reviewed-by: Christoffer Dall <cdall@linaro.org> Message-id: 1500471597-2517-5-git-send-email-drjones@redhat.com Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/kvm_arm.h | 15 ++++----------- hw/arm/virt.c | 9 +++------ target/arm/kvm32.c | 3 +-- target/arm/kvm64.c | 28 ++++++++++++++++++++-------- 4 files changed, 28 insertions(+), 27 deletions(-) diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm_arm.h +++ b/target/arm/kvm_arm.h @@ -XXX,XX +XXX,XX @@ int kvm_arm_sync_mpstate_to_qemu(ARMCPU *cpu); int kvm_arm_vgic_probe(void); -int kvm_arm_pmu_set_irq(CPUState *cs, int irq); -int kvm_arm_pmu_init(CPUState *cs); +void kvm_arm_pmu_set_irq(CPUState *cs, int irq); +void kvm_arm_pmu_init(CPUState *cs); #else @@ -XXX,XX +XXX,XX @@ static inline int kvm_arm_vgic_probe(void) return 0; } -static inline int kvm_arm_pmu_set_irq(CPUState *cs, int irq) -{ - return 0; -} - -static inline int kvm_arm_pmu_init(CPUState *cs) -{ - return 0; -} +static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {} +static inline void kvm_arm_pmu_init(CPUState *cs) {} #endif diff --git a/hw/arm/virt.c b/hw/arm/virt.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/virt.c +++ b/hw/arm/virt.c @@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms) return; } if (kvm_enabled()) { - if (kvm_irqchip_in_kernel() && - !kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ))) { - return; - } - if (!kvm_arm_pmu_init(cpu)) { - return; + if (kvm_irqchip_in_kernel()) { + kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ)); } + kvm_arm_pmu_init(cpu); } } diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm32.c +++ b/target/arm/kvm32.c @@ -XXX,XX +XXX,XX @@ bool kvm_arm_hw_debug_active(CPUState *cs) return false; } -int kvm_arm_pmu_set_irq(CPUState *cs, int irq) +void kvm_arm_pmu_set_irq(CPUState *cs, int irq) { qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__); - return 0; } int kvm_arm_pmu_init(CPUState *cs) diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/kvm64.c +++ b/target/arm/kvm64.c @@ -XXX,XX +XXX,XX @@ static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr) err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr); if (err != 0) { + error_report("PMU: KVM_HAS_DEVICE_ATTR: %s", strerror(-err)); return false; } err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr); - if (err < 0) { - fprintf(stderr, "KVM_SET_DEVICE_ATTR failed: %s\n", - strerror(-err)); - abort(); + if (err != 0) { + error_report("PMU: KVM_SET_DEVICE_ATTR: %s", strerror(-err)); + return false; } return true; } -int kvm_arm_pmu_init(CPUState *cs) +void kvm_arm_pmu_init(CPUState *cs) { struct kvm_device_attr attr = { .group = KVM_ARM_VCPU_PMU_V3_CTRL, .attr = KVM_ARM_VCPU_PMU_V3_INIT, }; - return kvm_arm_pmu_set_attr(cs, &attr); + if (!ARM_CPU(cs)->has_pmu) { + return; + } + if (!kvm_arm_pmu_set_attr(cs, &attr)) { + error_report("failed to init PMU"); + abort(); + } } -int kvm_arm_pmu_set_irq(CPUState *cs, int irq) +void kvm_arm_pmu_set_irq(CPUState *cs, int irq) { struct kvm_device_attr attr = { .group = KVM_ARM_VCPU_PMU_V3_CTRL, @@ -XXX,XX +XXX,XX @@ int kvm_arm_pmu_set_irq(CPUState *cs, int irq) .attr = KVM_ARM_VCPU_PMU_V3_IRQ, }; - return kvm_arm_pmu_set_attr(cs, &attr); + if (!ARM_CPU(cs)->has_pmu) { + return; + } + if (!kvm_arm_pmu_set_attr(cs, &attr)) { + error_report("failed to set irq for PMU"); + abort(); + } } static inline void set_feature(uint64_t *features, int feature) -- 2.7.4 From: Andrew Jeffery <andrew@aj.id.au> The reset width register controls how the pulse on the SoC's WDTRST{1,2} pins behaves. A pulse is emitted if the external reset bit is set in WDT_CTRL. On the AST2500 WDT_RESET_WIDTH can consume magic bit patterns to configure push-pull/open-drain and active-high/active-low behaviours and thus needs some special handling in the write path. As some of the capabilities depend on the SoC version a silicon-rev property is introduced, which is used to guard version-specific behaviour. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- include/hw/watchdog/wdt_aspeed.h | 2 + hw/watchdog/wdt_aspeed.c | 93 +++++++++++++++++++++++++++++++++++----- 2 files changed, 84 insertions(+), 11 deletions(-) diff --git a/include/hw/watchdog/wdt_aspeed.h b/include/hw/watchdog/wdt_aspeed.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/watchdog/wdt_aspeed.h +++ b/include/hw/watchdog/wdt_aspeed.h @@ -XXX,XX +XXX,XX @@ typedef struct AspeedWDTState { uint32_t regs[ASPEED_WDT_REGS_MAX]; uint32_t pclk_freq; + uint32_t silicon_rev; + uint32_t ext_pulse_width_mask; } AspeedWDTState; #endif /* ASPEED_WDT_H */ diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c index XXXXXXX..XXXXXXX 100644 --- a/hw/watchdog/wdt_aspeed.c +++ b/hw/watchdog/wdt_aspeed.c @@ -XXX,XX +XXX,XX @@ */ #include "qemu/osdep.h" + +#include "qapi/error.h" #include "qemu/log.h" +#include "qemu/timer.h" #include "sysemu/watchdog.h" +#include "hw/misc/aspeed_scu.h" #include "hw/sysbus.h" -#include "qemu/timer.h" #include "hw/watchdog/wdt_aspeed.h" -#define WDT_STATUS (0x00 / 4) -#define WDT_RELOAD_VALUE (0x04 / 4) -#define WDT_RESTART (0x08 / 4) -#define WDT_CTRL (0x0C / 4) +#define WDT_STATUS (0x00 / 4) +#define WDT_RELOAD_VALUE (0x04 / 4) +#define WDT_RESTART (0x08 / 4) +#define WDT_CTRL (0x0C / 4) #define WDT_CTRL_RESET_MODE_SOC (0x00 << 5) #define WDT_CTRL_RESET_MODE_FULL_CHIP (0x01 << 5) #define WDT_CTRL_1MHZ_CLK BIT(4) @@ -XXX,XX +XXX,XX @@ #define WDT_CTRL_WDT_INTR BIT(2) #define WDT_CTRL_RESET_SYSTEM BIT(1) #define WDT_CTRL_ENABLE BIT(0) +#define WDT_RESET_WIDTH (0x18 / 4) +#define WDT_RESET_WIDTH_ACTIVE_HIGH BIT(31) +#define WDT_POLARITY_MASK (0xFF << 24) +#define WDT_ACTIVE_HIGH_MAGIC (0xA5 << 24) +#define WDT_ACTIVE_LOW_MAGIC (0x5A << 24) +#define WDT_RESET_WIDTH_PUSH_PULL BIT(30) +#define WDT_DRIVE_TYPE_MASK (0xFF << 24) +#define WDT_PUSH_PULL_MAGIC (0xA8 << 24) +#define WDT_OPEN_DRAIN_MAGIC (0x8A << 24) -#define WDT_TIMEOUT_STATUS (0x10 / 4) -#define WDT_TIMEOUT_CLEAR (0x14 / 4) -#define WDT_RESET_WDITH (0x18 / 4) +#define WDT_TIMEOUT_STATUS (0x10 / 4) +#define WDT_TIMEOUT_CLEAR (0x14 / 4) -#define WDT_RESTART_MAGIC 0x4755 +#define WDT_RESTART_MAGIC 0x4755 static bool aspeed_wdt_is_enabled(const AspeedWDTState *s) { return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE; } +static bool is_ast2500(const AspeedWDTState *s) +{ + switch (s->silicon_rev) { + case AST2500_A0_SILICON_REV: + case AST2500_A1_SILICON_REV: + return true; + case AST2400_A0_SILICON_REV: + case AST2400_A1_SILICON_REV: + default: + break; + } + + return false; +} + static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size) { AspeedWDTState *s = ASPEED_WDT(opaque); @@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size) return 0; case WDT_CTRL: return s->regs[WDT_CTRL]; + case WDT_RESET_WIDTH: + return s->regs[WDT_RESET_WIDTH]; case WDT_TIMEOUT_STATUS: case WDT_TIMEOUT_CLEAR: - case WDT_RESET_WDITH: qemu_log_mask(LOG_UNIMP, "%s: uninmplemented read at offset 0x%" HWADDR_PRIx "\n", __func__, offset); @@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data, timer_del(s->timer); } break; + case WDT_RESET_WIDTH: + { + uint32_t property = data & WDT_POLARITY_MASK; + + if (property && is_ast2500(s)) { + if (property == WDT_ACTIVE_HIGH_MAGIC) { + s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_ACTIVE_HIGH; + } else if (property == WDT_ACTIVE_LOW_MAGIC) { + s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_ACTIVE_HIGH; + } else if (property == WDT_PUSH_PULL_MAGIC) { + s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_PUSH_PULL; + } else if (property == WDT_OPEN_DRAIN_MAGIC) { + s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_PUSH_PULL; + } + } + s->regs[WDT_RESET_WIDTH] &= ~s->ext_pulse_width_mask; + s->regs[WDT_RESET_WIDTH] |= data & s->ext_pulse_width_mask; + break; + } case WDT_TIMEOUT_STATUS: case WDT_TIMEOUT_CLEAR: - case WDT_RESET_WDITH: qemu_log_mask(LOG_UNIMP, "%s: uninmplemented write at offset 0x%" HWADDR_PRIx "\n", __func__, offset); @@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_reset(DeviceState *dev) s->regs[WDT_RELOAD_VALUE] = 0x03EF1480; s->regs[WDT_RESTART] = 0; s->regs[WDT_CTRL] = 0; + s->regs[WDT_RESET_WIDTH] = 0xFF; timer_del(s->timer); } @@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_realize(DeviceState *dev, Error **errp) SysBusDevice *sbd = SYS_BUS_DEVICE(dev); AspeedWDTState *s = ASPEED_WDT(dev); + if (!is_supported_silicon_rev(s->silicon_rev)) { + error_setg(errp, "Unknown silicon revision: 0x%" PRIx32, + s->silicon_rev); + return; + } + + switch (s->silicon_rev) { + case AST2400_A0_SILICON_REV: + case AST2400_A1_SILICON_REV: + s->ext_pulse_width_mask = 0xff; + break; + case AST2500_A0_SILICON_REV: + case AST2500_A1_SILICON_REV: + s->ext_pulse_width_mask = 0xfffff; + break; + default: + g_assert_not_reached(); + } + s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev); /* FIXME: This setting should be derived from the SCU hw strapping @@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_realize(DeviceState *dev, Error **errp) sysbus_init_mmio(sbd, &s->iomem); } +static Property aspeed_wdt_properties[] = { + DEFINE_PROP_UINT32("silicon-rev", AspeedWDTState, silicon_rev, 0), + DEFINE_PROP_END_OF_LIST(), +}; + static void aspeed_wdt_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); @@ -XXX,XX +XXX,XX @@ static void aspeed_wdt_class_init(ObjectClass *klass, void *data) dc->reset = aspeed_wdt_reset; set_bit(DEVICE_CATEGORY_MISC, dc->categories); dc->vmsd = &vmstate_aspeed_wdt; + dc->props = aspeed_wdt_properties; } static const TypeInfo aspeed_wdt_info = { -- 2.7.4 From: Andrew Jeffery <andrew@aj.id.au> This is required to configure differences in behaviour between the AST2400 and AST2500 watchdog IPs. Signed-off-by: Andrew Jeffery <andrew@aj.id.au> Reviewed-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/arm/aspeed_soc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/aspeed_soc.c +++ b/hw/arm/aspeed_soc.c @@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj) object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT); object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL); qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default()); + qdev_prop_set_uint32(DEVICE(&s->wdt[i]), "silicon-rev", + sc->info->silicon_rev); } object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100); -- 2.7.4 Move the MemTxResult type to memattrs.h. We're going to want to use it in cpu/qom.h, which doesn't want to include all of memory.h. In practice MemTxResult and MemTxAttrs are pretty closely linked since both are used for the new-style read_with_attrs and write_with_attrs callbacks, so memattrs.h is a reasonable home for this rather than creating a whole new header file for it. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> --- include/exec/memattrs.h | 10 ++++++++++ include/exec/memory.h | 10 ---------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/include/exec/memattrs.h b/include/exec/memattrs.h index XXXXXXX..XXXXXXX 100644 --- a/include/exec/memattrs.h +++ b/include/exec/memattrs.h @@ -XXX,XX +XXX,XX @@ typedef struct MemTxAttrs { */ #define MEMTXATTRS_UNSPECIFIED ((MemTxAttrs) { .unspecified = 1 }) +/* New-style MMIO accessors can indicate that the transaction failed. + * A zero (MEMTX_OK) response means success; anything else is a failure + * of some kind. The memory subsystem will bitwise-OR together results + * if it is synthesizing an operation from multiple smaller accesses. + */ +#define MEMTX_OK 0 +#define MEMTX_ERROR (1U << 0) /* device returned an error */ +#define MEMTX_DECODE_ERROR (1U << 1) /* nothing at that address */ +typedef uint32_t MemTxResult; + #endif diff --git a/include/exec/memory.h b/include/exec/memory.h index XXXXXXX..XXXXXXX 100644 --- a/include/exec/memory.h +++ b/include/exec/memory.h @@ -XXX,XX +XXX,XX @@ static inline void iommu_notifier_init(IOMMUNotifier *n, IOMMUNotify fn, n->end = end; } -/* New-style MMIO accessors can indicate that the transaction failed. - * A zero (MEMTX_OK) response means success; anything else is a failure - * of some kind. The memory subsystem will bitwise-OR together results - * if it is synthesizing an operation from multiple smaller accesses. - */ -#define MEMTX_OK 0 -#define MEMTX_ERROR (1U << 0) /* device returned an error */ -#define MEMTX_DECODE_ERROR (1U << 1) /* nothing at that address */ -typedef uint32_t MemTxResult; - /* * Memory region callbacks */ -- 2.7.4 Currently we have a rather half-baked setup for allowing CPUs to generate exceptions on accesses to invalid memory: the CPU has a cpu_unassigned_access() hook which the memory system calls in unassigned_mem_write() and unassigned_mem_read() if the current_cpu pointer is non-NULL. This was originally designed before we implemented the MemTxResult type that allows memory operations to report a success or failure code, which is why the hook is called right at the bottom of the memory system. The major problem with this is that it means that the hook can be called even when the access was not actually done by the CPU: for instance if the CPU writes to a DMA engine register which causes the DMA engine to begin a transaction which has been set up by the guest to operate on invalid memory then this will casue the CPU to take an exception incorrectly. Another minor problem is that currently if a device returns a transaction error then this won't turn into a CPU exception at all. The right way to do this is to have allow the CPU to respond to memory system transaction failures at the point where the CPU specific code calls into the memory system. Define a new QOM CPU method and utility function cpu_transaction_failed() which is called in these cases. The functionality here overlaps with the existing cpu_unassigned_access() because individual target CPUs will need some work to convert them to the new system. When this transition is complete we can remove the old cpu_unassigned_access() code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- include/qom/cpu.h | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/include/qom/cpu.h b/include/qom/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/include/qom/cpu.h +++ b/include/qom/cpu.h @@ -XXX,XX +XXX,XX @@ struct TranslationBlock; * @has_work: Callback for checking if there is work to do. * @do_interrupt: Callback for interrupt handling. * @do_unassigned_access: Callback for unassigned access handling. + * (this is deprecated: new targets should use do_transaction_failed instead) * @do_unaligned_access: Callback for unaligned access handling, if * the target defines #ALIGNED_ONLY. + * @do_transaction_failed: Callback for handling failed memory transactions + * (ie bus faults or external aborts; not MMU faults) * @virtio_is_big_endian: Callback to return %true if a CPU which supports * runtime configurable endianness is currently big-endian. Non-configurable * CPUs can use the default implementation of this method. This method should @@ -XXX,XX +XXX,XX @@ typedef struct CPUClass { void (*do_unaligned_access)(CPUState *cpu, vaddr addr, MMUAccessType access_type, int mmu_idx, uintptr_t retaddr); + void (*do_transaction_failed)(CPUState *cpu, hwaddr physaddr, vaddr addr, + unsigned size, MMUAccessType access_type, + int mmu_idx, MemTxAttrs attrs, + MemTxResult response, uintptr_t retaddr); bool (*virtio_is_big_endian)(CPUState *cpu); int (*memory_rw_debug)(CPUState *cpu, vaddr addr, uint8_t *buf, int len, bool is_write); @@ -XXX,XX +XXX,XX @@ static inline void cpu_unaligned_access(CPUState *cpu, vaddr addr, cc->do_unaligned_access(cpu, addr, access_type, mmu_idx, retaddr); } + +static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr, + vaddr addr, unsigned size, + MMUAccessType access_type, + int mmu_idx, MemTxAttrs attrs, + MemTxResult response, + uintptr_t retaddr) +{ + CPUClass *cc = CPU_GET_CLASS(cpu); + + if (cc->do_transaction_failed) { + cc->do_transaction_failed(cpu, physaddr, addr, size, access_type, + mmu_idx, attrs, response, retaddr); + } +} #endif #endif /* NEED_CPU_H */ -- 2.7.4 Call the new cpu_transaction_failed() hook at the places where CPU generated code interacts with the memory system: io_readx() io_writex() get_page_addr_code() Any access from C code (eg via cpu_physical_memory_rw(), address_space_rw(), ld/st_*_phys()) will *not* trigger CPU exceptions via cpu_transaction_failed(). Handling for transactions failures for this kind of call should be done by using a function which returns a MemTxResult and treating the failure case appropriately in the calling code. In an ideal world we would not generate CPU exceptions for instruction fetch failures in get_page_addr_code() but instead wait until the code translation process tried a load and it failed; however that change would require too great a restructuring and redesign to attempt at this point. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- softmmu_template.h | 4 ++-- accel/tcg/cputlb.c | 32 ++++++++++++++++++++++++++++++-- 2 files changed, 32 insertions(+), 4 deletions(-) diff --git a/softmmu_template.h b/softmmu_template.h index XXXXXXX..XXXXXXX 100644 --- a/softmmu_template.h +++ b/softmmu_template.h @@ -XXX,XX +XXX,XX @@ static inline DATA_TYPE glue(io_read, SUFFIX)(CPUArchState *env, uintptr_t retaddr) { CPUIOTLBEntry *iotlbentry = &env->iotlb[mmu_idx][index]; - return io_readx(env, iotlbentry, addr, retaddr, DATA_SIZE); + return io_readx(env, iotlbentry, mmu_idx, addr, retaddr, DATA_SIZE); } #endif @@ -XXX,XX +XXX,XX @@ static inline void glue(io_write, SUFFIX)(CPUArchState *env, uintptr_t retaddr) { CPUIOTLBEntry *iotlbentry = &env->iotlb[mmu_idx][index]; - return io_writex(env, iotlbentry, val, addr, retaddr, DATA_SIZE); + return io_writex(env, iotlbentry, mmu_idx, val, addr, retaddr, DATA_SIZE); } void helper_le_st_name(CPUArchState *env, target_ulong addr, DATA_TYPE val, diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c index XXXXXXX..XXXXXXX 100644 --- a/accel/tcg/cputlb.c +++ b/accel/tcg/cputlb.c @@ -XXX,XX +XXX,XX @@ static inline ram_addr_t qemu_ram_addr_from_host_nofail(void *ptr) } static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry, + int mmu_idx, target_ulong addr, uintptr_t retaddr, int size) { CPUState *cpu = ENV_GET_CPU(env); @@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry, MemoryRegion *mr = iotlb_to_region(cpu, physaddr, iotlbentry->attrs); uint64_t val; bool locked = false; + MemTxResult r; physaddr = (physaddr & TARGET_PAGE_MASK) + addr; cpu->mem_io_pc = retaddr; @@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry, qemu_mutex_lock_iothread(); locked = true; } - memory_region_dispatch_read(mr, physaddr, &val, size, iotlbentry->attrs); + r = memory_region_dispatch_read(mr, physaddr, + &val, size, iotlbentry->attrs); + if (r != MEMTX_OK) { + cpu_transaction_failed(cpu, physaddr, addr, size, MMU_DATA_LOAD, + mmu_idx, iotlbentry->attrs, r, retaddr); + } if (locked) { qemu_mutex_unlock_iothread(); } @@ -XXX,XX +XXX,XX @@ static uint64_t io_readx(CPUArchState *env, CPUIOTLBEntry *iotlbentry, } static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry, + int mmu_idx, uint64_t val, target_ulong addr, uintptr_t retaddr, int size) { @@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry, hwaddr physaddr = iotlbentry->addr; MemoryRegion *mr = iotlb_to_region(cpu, physaddr, iotlbentry->attrs); bool locked = false; + MemTxResult r; physaddr = (physaddr & TARGET_PAGE_MASK) + addr; if (mr != &io_mem_rom && mr != &io_mem_notdirty && !cpu->can_do_io) { @@ -XXX,XX +XXX,XX @@ static void io_writex(CPUArchState *env, CPUIOTLBEntry *iotlbentry, qemu_mutex_lock_iothread(); locked = true; } - memory_region_dispatch_write(mr, physaddr, val, size, iotlbentry->attrs); + r = memory_region_dispatch_write(mr, physaddr, + val, size, iotlbentry->attrs); + if (r != MEMTX_OK) { + cpu_transaction_failed(cpu, physaddr, addr, size, MMU_DATA_STORE, + mmu_idx, iotlbentry->attrs, r, retaddr); + } if (locked) { qemu_mutex_unlock_iothread(); } @@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr) MemoryRegion *mr; CPUState *cpu = ENV_GET_CPU(env); CPUIOTLBEntry *iotlbentry; + hwaddr physaddr; index = (addr >> TARGET_PAGE_BITS) & (CPU_TLB_SIZE - 1); mmu_idx = cpu_mmu_index(env, true); @@ -XXX,XX +XXX,XX @@ tb_page_addr_t get_page_addr_code(CPUArchState *env, target_ulong addr) } qemu_mutex_unlock_iothread(); + /* Give the new-style cpu_transaction_failed() hook first chance + * to handle this. + * This is not the ideal place to detect and generate CPU + * exceptions for instruction fetch failure (for instance + * we don't know the length of the access that the CPU would + * use, and it would be better to go ahead and try the access + * and use the MemTXResult it produced). However it is the + * simplest place we have currently available for the check. + */ + physaddr = (iotlbentry->addr & TARGET_PAGE_MASK) + addr; + cpu_transaction_failed(cpu, physaddr, addr, 0, MMU_INST_FETCH, mmu_idx, + iotlbentry->attrs, MEMTX_DECODE_ERROR, 0); + cpu_unassigned_access(cpu, addr, false, true, 0, 4); /* The CPU's unassigned access hook might have longjumped out * with an exception. If it didn't (or there was no hook) then -- 2.7.4 Define a new MachineClass field ignore_memory_transaction_failures. If this is flag is true then the CPU will ignore memory transaction failures which should cause the CPU to take an exception due to an access to an unassigned physical address; the transaction will instead return zero (for a read) or be ignored (for a write). This should be set only by legacy board models which rely on the old RAZ/WI behaviour for handling devices that QEMU does not yet model. New board models should instead use "unimplemented-device" for all memory ranges where the guest will attempt to probe for a device that QEMU doesn't implement and a stub device is required. We need this for ARM boards, where we're about to implement support for generating external aborts on memory transaction failures. Too many of our legacy board models rely on the RAZ/WI behaviour and we would break currently working guests when their "probe for device" code provoked an external abort rather than a RAZ. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- include/hw/boards.h | 11 +++++++++++ include/qom/cpu.h | 7 ++++++- qom/cpu.c | 7 +++++++ 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/include/hw/boards.h b/include/hw/boards.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/boards.h +++ b/include/hw/boards.h @@ -XXX,XX +XXX,XX @@ typedef struct { * size than the target architecture's minimum. (Attempting to create * such a CPU will fail.) Note that changing this is a migration * compatibility break for the machine. + * @ignore_memory_transaction_failures: + * If this is flag is true then the CPU will ignore memory transaction + * failures which should cause the CPU to take an exception due to an + * access to an unassigned physical address; the transaction will instead + * return zero (for a read) or be ignored (for a write). This should be + * set only by legacy board models which rely on the old RAZ/WI behaviour + * for handling devices that QEMU does not yet model. New board models + * should instead use "unimplemented-device" for all memory ranges where + * the guest will attempt to probe for a device that QEMU doesn't + * implement and a stub device is required. */ struct MachineClass { /*< private >*/ @@ -XXX,XX +XXX,XX @@ struct MachineClass { bool rom_file_has_mr; int minimum_page_bits; bool has_hotpluggable_cpus; + bool ignore_memory_transaction_failures; int numa_mem_align_shift; void (*numa_auto_assign_ram)(MachineClass *mc, NodeInfo *nodes, int nb_nodes, ram_addr_t size); diff --git a/include/qom/cpu.h b/include/qom/cpu.h index XXXXXXX..XXXXXXX 100644 --- a/include/qom/cpu.h +++ b/include/qom/cpu.h @@ -XXX,XX +XXX,XX @@ struct qemu_work_item; * @trace_dstate_delayed: Delayed changes to trace_dstate (includes all changes * to @trace_dstate). * @trace_dstate: Dynamic tracing state of events for this vCPU (bitmask). + * @ignore_memory_transaction_failures: Cached copy of the MachineState + * flag of the same name: allows the board to suppress calling of the + * CPU do_transaction_failed hook function. * * State of one CPU core or thread. */ @@ -XXX,XX +XXX,XX @@ struct CPUState { */ bool throttle_thread_scheduled; + bool ignore_memory_transaction_failures; + /* Note that this is accessed at the start of every TB via a negative offset from AREG0. Leave this field at the end so as to make the (absolute value) offset as small as possible. This reduces code @@ -XXX,XX +XXX,XX @@ static inline void cpu_transaction_failed(CPUState *cpu, hwaddr physaddr, { CPUClass *cc = CPU_GET_CLASS(cpu); - if (cc->do_transaction_failed) { + if (!cpu->ignore_memory_transaction_failures && cc->do_transaction_failed) { cc->do_transaction_failed(cpu, physaddr, addr, size, access_type, mmu_idx, attrs, response, retaddr); } diff --git a/qom/cpu.c b/qom/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/qom/cpu.c +++ b/qom/cpu.c @@ -XXX,XX +XXX,XX @@ #include "exec/cpu-common.h" #include "qemu/error-report.h" #include "sysemu/sysemu.h" +#include "hw/boards.h" #include "hw/qdev-properties.h" #include "trace-root.h" @@ -XXX,XX +XXX,XX @@ static void cpu_common_parse_features(const char *typename, char *features, static void cpu_common_realizefn(DeviceState *dev, Error **errp) { CPUState *cpu = CPU(dev); + Object *machine = qdev_get_machine(); + ObjectClass *oc = object_get_class(machine); + MachineClass *mc = MACHINE_CLASS(oc); + + cpu->ignore_memory_transaction_failures = + mc->ignore_memory_transaction_failures; if (dev->hotplugged) { cpu_synchronize_post_init(cpu); -- 2.7.4 Set the MachineClass flag ignore_memory_transaction_failures for almost all ARM boards. This means they retain the legacy behaviour that accesses to unimplemented addresses will RAZ/WI rather than aborting, when a subsequent commit adds support for external aborts. The exceptions are: * virt -- we know that guests won't try to prod devices that we don't describe in the device tree or ACPI tables * mps2 -- this board was written to use unimplemented-device for all the ranges with devices we don't yet handle New boards should not set the flag, but instead be written like the mps2. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> For the Xilinx boards: Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- hw/arm/aspeed.c | 3 +++ hw/arm/collie.c | 1 + hw/arm/cubieboard.c | 1 + hw/arm/digic_boards.c | 1 + hw/arm/exynos4_boards.c | 2 ++ hw/arm/gumstix.c | 2 ++ hw/arm/highbank.c | 2 ++ hw/arm/imx25_pdk.c | 1 + hw/arm/integratorcp.c | 1 + hw/arm/kzm.c | 1 + hw/arm/mainstone.c | 1 + hw/arm/musicpal.c | 1 + hw/arm/netduino2.c | 1 + hw/arm/nseries.c | 2 ++ hw/arm/omap_sx1.c | 2 ++ hw/arm/palm.c | 1 + hw/arm/raspi.c | 1 + hw/arm/realview.c | 4 ++++ hw/arm/sabrelite.c | 1 + hw/arm/spitz.c | 4 ++++ hw/arm/stellaris.c | 2 ++ hw/arm/tosa.c | 1 + hw/arm/versatilepb.c | 2 ++ hw/arm/vexpress.c | 1 + hw/arm/xilinx_zynq.c | 1 + hw/arm/xlnx-ep108.c | 2 ++ hw/arm/z2.c | 1 + 27 files changed, 43 insertions(+) diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/aspeed.c +++ b/hw/arm/aspeed.c @@ -XXX,XX +XXX,XX @@ static void palmetto_bmc_class_init(ObjectClass *oc, void *data) mc->no_floppy = 1; mc->no_cdrom = 1; mc->no_parallel = 1; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo palmetto_bmc_type = { @@ -XXX,XX +XXX,XX @@ static void ast2500_evb_class_init(ObjectClass *oc, void *data) mc->no_floppy = 1; mc->no_cdrom = 1; mc->no_parallel = 1; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo ast2500_evb_type = { @@ -XXX,XX +XXX,XX @@ static void romulus_bmc_class_init(ObjectClass *oc, void *data) mc->no_floppy = 1; mc->no_cdrom = 1; mc->no_parallel = 1; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo romulus_bmc_type = { diff --git a/hw/arm/collie.c b/hw/arm/collie.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/collie.c +++ b/hw/arm/collie.c @@ -XXX,XX +XXX,XX @@ static void collie_machine_init(MachineClass *mc) { mc->desc = "Sharp SL-5500 (Collie) PDA (SA-1110)"; mc->init = collie_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("collie", collie_machine_init) diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/cubieboard.c +++ b/hw/arm/cubieboard.c @@ -XXX,XX +XXX,XX @@ static void cubieboard_machine_init(MachineClass *mc) mc->init = cubieboard_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("cubieboard", cubieboard_machine_init) diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/digic_boards.c +++ b/hw/arm/digic_boards.c @@ -XXX,XX +XXX,XX @@ static void canon_a1100_machine_init(MachineClass *mc) { mc->desc = "Canon PowerShot A1100 IS"; mc->init = &canon_a1100_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("canon-a1100", canon_a1100_machine_init) diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/exynos4_boards.c +++ b/hw/arm/exynos4_boards.c @@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data) mc->desc = "Samsung NURI board (Exynos4210)"; mc->init = nuri_init; mc->max_cpus = EXYNOS4210_NCPUS; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo nuri_type = { @@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data) mc->desc = "Samsung SMDKC210 board (Exynos4210)"; mc->init = smdkc210_init; mc->max_cpus = EXYNOS4210_NCPUS; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo smdkc210_type = { diff --git a/hw/arm/gumstix.c b/hw/arm/gumstix.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/gumstix.c +++ b/hw/arm/gumstix.c @@ -XXX,XX +XXX,XX @@ static void connex_class_init(ObjectClass *oc, void *data) mc->desc = "Gumstix Connex (PXA255)"; mc->init = connex_init; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo connex_type = { @@ -XXX,XX +XXX,XX @@ static void verdex_class_init(ObjectClass *oc, void *data) mc->desc = "Gumstix Verdex (PXA270)"; mc->init = verdex_init; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo verdex_type = { diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/highbank.c +++ b/hw/arm/highbank.c @@ -XXX,XX +XXX,XX @@ static void highbank_class_init(ObjectClass *oc, void *data) mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; mc->max_cpus = 4; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo highbank_type = { @@ -XXX,XX +XXX,XX @@ static void midway_class_init(ObjectClass *oc, void *data) mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; mc->max_cpus = 4; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo midway_type = { diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/imx25_pdk.c +++ b/hw/arm/imx25_pdk.c @@ -XXX,XX +XXX,XX @@ static void imx25_pdk_machine_init(MachineClass *mc) { mc->desc = "ARM i.MX25 PDK board (ARM926)"; mc->init = imx25_pdk_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("imx25-pdk", imx25_pdk_machine_init) diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/integratorcp.c +++ b/hw/arm/integratorcp.c @@ -XXX,XX +XXX,XX @@ static void integratorcp_machine_init(MachineClass *mc) { mc->desc = "ARM Integrator/CP (ARM926EJ-S)"; mc->init = integratorcp_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("integratorcp", integratorcp_machine_init) diff --git a/hw/arm/kzm.c b/hw/arm/kzm.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/kzm.c +++ b/hw/arm/kzm.c @@ -XXX,XX +XXX,XX @@ static void kzm_machine_init(MachineClass *mc) { mc->desc = "ARM KZM Emulation Baseboard (ARM1136)"; mc->init = kzm_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("kzm", kzm_machine_init) diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/mainstone.c +++ b/hw/arm/mainstone.c @@ -XXX,XX +XXX,XX @@ static void mainstone2_machine_init(MachineClass *mc) { mc->desc = "Mainstone II (PXA27x)"; mc->init = mainstone_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("mainstone", mainstone2_machine_init) diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/musicpal.c +++ b/hw/arm/musicpal.c @@ -XXX,XX +XXX,XX @@ static void musicpal_machine_init(MachineClass *mc) { mc->desc = "Marvell 88w8618 / MusicPal (ARM926EJ-S)"; mc->init = musicpal_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("musicpal", musicpal_machine_init) diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/netduino2.c +++ b/hw/arm/netduino2.c @@ -XXX,XX +XXX,XX @@ static void netduino2_machine_init(MachineClass *mc) { mc->desc = "Netduino 2 Machine"; mc->init = netduino2_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("netduino2", netduino2_machine_init) diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/nseries.c +++ b/hw/arm/nseries.c @@ -XXX,XX +XXX,XX @@ static void n800_class_init(ObjectClass *oc, void *data) mc->desc = "Nokia N800 tablet aka. RX-34 (OMAP2420)"; mc->init = n800_init; mc->default_boot_order = ""; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo n800_type = { @@ -XXX,XX +XXX,XX @@ static void n810_class_init(ObjectClass *oc, void *data) mc->desc = "Nokia N810 tablet aka. RX-44 (OMAP2420)"; mc->init = n810_init; mc->default_boot_order = ""; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo n810_type = { diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/omap_sx1.c +++ b/hw/arm/omap_sx1.c @@ -XXX,XX +XXX,XX @@ static void sx1_machine_v2_class_init(ObjectClass *oc, void *data) mc->desc = "Siemens SX1 (OMAP310) V2"; mc->init = sx1_init_v2; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo sx1_machine_v2_type = { @@ -XXX,XX +XXX,XX @@ static void sx1_machine_v1_class_init(ObjectClass *oc, void *data) mc->desc = "Siemens SX1 (OMAP310) V1"; mc->init = sx1_init_v1; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo sx1_machine_v1_type = { diff --git a/hw/arm/palm.c b/hw/arm/palm.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/palm.c +++ b/hw/arm/palm.c @@ -XXX,XX +XXX,XX @@ static void palmte_machine_init(MachineClass *mc) { mc->desc = "Palm Tungsten|E aka. Cheetah PDA (OMAP310)"; mc->init = palmte_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("cheetah", palmte_machine_init) diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/raspi.c +++ b/hw/arm/raspi.c @@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc) mc->no_cdrom = 1; mc->max_cpus = BCM2836_NCPUS; mc->default_ram_size = 1024 * 1024 * 1024; + mc->ignore_memory_transaction_failures = true; }; DEFINE_MACHINE("raspi2", raspi2_machine_init) diff --git a/hw/arm/realview.c b/hw/arm/realview.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/realview.c +++ b/hw/arm/realview.c @@ -XXX,XX +XXX,XX @@ static void realview_eb_class_init(ObjectClass *oc, void *data) mc->desc = "ARM RealView Emulation Baseboard (ARM926EJ-S)"; mc->init = realview_eb_init; mc->block_default_type = IF_SCSI; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo realview_eb_type = { @@ -XXX,XX +XXX,XX @@ static void realview_eb_mpcore_class_init(ObjectClass *oc, void *data) mc->init = realview_eb_mpcore_init; mc->block_default_type = IF_SCSI; mc->max_cpus = 4; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo realview_eb_mpcore_type = { @@ -XXX,XX +XXX,XX @@ static void realview_pb_a8_class_init(ObjectClass *oc, void *data) mc->desc = "ARM RealView Platform Baseboard for Cortex-A8"; mc->init = realview_pb_a8_init; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo realview_pb_a8_type = { @@ -XXX,XX +XXX,XX @@ static void realview_pbx_a9_class_init(ObjectClass *oc, void *data) mc->desc = "ARM RealView Platform Baseboard Explore for Cortex-A9"; mc->init = realview_pbx_a9_init; mc->max_cpus = 4; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo realview_pbx_a9_type = { diff --git a/hw/arm/sabrelite.c b/hw/arm/sabrelite.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/sabrelite.c +++ b/hw/arm/sabrelite.c @@ -XXX,XX +XXX,XX @@ static void sabrelite_machine_init(MachineClass *mc) mc->desc = "Freescale i.MX6 Quad SABRE Lite Board (Cortex A9)"; mc->init = sabrelite_init; mc->max_cpus = FSL_IMX6_NUM_CPUS; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("sabrelite", sabrelite_machine_init) diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/spitz.c +++ b/hw/arm/spitz.c @@ -XXX,XX +XXX,XX @@ static void akitapda_class_init(ObjectClass *oc, void *data) mc->desc = "Sharp SL-C1000 (Akita) PDA (PXA270)"; mc->init = akita_init; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo akitapda_type = { @@ -XXX,XX +XXX,XX @@ static void spitzpda_class_init(ObjectClass *oc, void *data) mc->desc = "Sharp SL-C3000 (Spitz) PDA (PXA270)"; mc->init = spitz_init; mc->block_default_type = IF_IDE; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo spitzpda_type = { @@ -XXX,XX +XXX,XX @@ static void borzoipda_class_init(ObjectClass *oc, void *data) mc->desc = "Sharp SL-C3100 (Borzoi) PDA (PXA270)"; mc->init = borzoi_init; mc->block_default_type = IF_IDE; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo borzoipda_type = { @@ -XXX,XX +XXX,XX @@ static void terrierpda_class_init(ObjectClass *oc, void *data) mc->desc = "Sharp SL-C3200 (Terrier) PDA (PXA270)"; mc->init = terrier_init; mc->block_default_type = IF_IDE; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo terrierpda_type = { diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/stellaris.c +++ b/hw/arm/stellaris.c @@ -XXX,XX +XXX,XX @@ static void lm3s811evb_class_init(ObjectClass *oc, void *data) mc->desc = "Stellaris LM3S811EVB"; mc->init = lm3s811evb_init; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo lm3s811evb_type = { @@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_class_init(ObjectClass *oc, void *data) mc->desc = "Stellaris LM3S6965EVB"; mc->init = lm3s6965evb_init; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo lm3s6965evb_type = { diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/tosa.c +++ b/hw/arm/tosa.c @@ -XXX,XX +XXX,XX @@ static void tosapda_machine_init(MachineClass *mc) mc->desc = "Sharp SL-6000 (Tosa) PDA (PXA255)"; mc->init = tosa_init; mc->block_default_type = IF_IDE; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("tosa", tosapda_machine_init) diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/versatilepb.c +++ b/hw/arm/versatilepb.c @@ -XXX,XX +XXX,XX @@ static void versatilepb_class_init(ObjectClass *oc, void *data) mc->desc = "ARM Versatile/PB (ARM926EJ-S)"; mc->init = vpb_init; mc->block_default_type = IF_SCSI; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo versatilepb_type = { @@ -XXX,XX +XXX,XX @@ static void versatileab_class_init(ObjectClass *oc, void *data) mc->desc = "ARM Versatile/AB (ARM926EJ-S)"; mc->init = vab_init; mc->block_default_type = IF_SCSI; + mc->ignore_memory_transaction_failures = true; } static const TypeInfo versatileab_type = { diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/vexpress.c +++ b/hw/arm/vexpress.c @@ -XXX,XX +XXX,XX @@ static void vexpress_class_init(ObjectClass *oc, void *data) mc->desc = "ARM Versatile Express"; mc->init = vexpress_common_init; mc->max_cpus = 4; + mc->ignore_memory_transaction_failures = true; } static void vexpress_a9_class_init(ObjectClass *oc, void *data) diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/xilinx_zynq.c +++ b/hw/arm/xilinx_zynq.c @@ -XXX,XX +XXX,XX @@ static void zynq_machine_init(MachineClass *mc) mc->init = zynq_init; mc->max_cpus = 1; mc->no_sdcard = 1; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("xilinx-zynq-a9", zynq_machine_init) diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-ep108.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/xlnx-ep108.c +++ b/hw/arm/xlnx-ep108.c @@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_init(MachineClass *mc) mc->init = xlnx_ep108_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init) @@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc) mc->init = xlnx_ep108_init; mc->block_default_type = IF_IDE; mc->units_per_default_bus = 1; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init) diff --git a/hw/arm/z2.c b/hw/arm/z2.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/z2.c +++ b/hw/arm/z2.c @@ -XXX,XX +XXX,XX @@ static void z2_machine_init(MachineClass *mc) { mc->desc = "Zipit Z2 (PXA27x)"; mc->init = z2_init; + mc->ignore_memory_transaction_failures = true; } DEFINE_MACHINE("z2", z2_machine_init) -- 2.7.4 We currently have some similar code in tlb_fill() and in arm_cpu_do_unaligned_access() for delivering a data abort or prefetch abort. We're also going to want to do the same thing to handle external aborts. Factor out the common code into a new function deliver_fault(). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Acked-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- target/arm/op_helper.c | 110 +++++++++++++++++++++++++------------------------ 1 file changed, 57 insertions(+), 53 deletions(-) diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn, return syn; } +static void deliver_fault(ARMCPU *cpu, vaddr addr, MMUAccessType access_type, + uint32_t fsr, uint32_t fsc, ARMMMUFaultInfo *fi) +{ + CPUARMState *env = &cpu->env; + int target_el; + bool same_el; + uint32_t syn, exc; + + target_el = exception_target_el(env); + if (fi->stage2) { + target_el = 2; + env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4; + } + same_el = (arm_current_el(env) == target_el); + + if (fsc == 0x3f) { + /* Caller doesn't have a long-format fault status code. This + * should only happen if this fault will never actually be reported + * to an EL that uses a syndrome register. Check that here. + * 0x3f is a (currently) reserved FSC code, in case the constructed + * syndrome does leak into the guest somehow. + */ + assert(target_el != 2 && !arm_el_is_aa64(env, target_el)); + } + + if (access_type == MMU_INST_FETCH) { + syn = syn_insn_abort(same_el, 0, fi->s1ptw, fsc); + exc = EXCP_PREFETCH_ABORT; + } else { + syn = merge_syn_data_abort(env->exception.syndrome, target_el, + same_el, fi->s1ptw, + access_type == MMU_DATA_STORE, + fsc); + if (access_type == MMU_DATA_STORE + && arm_feature(env, ARM_FEATURE_V6)) { + fsr |= (1 << 11); + } + exc = EXCP_DATA_ABORT; + } + + env->exception.vaddress = addr; + env->exception.fsr = fsr; + raise_exception(env, exc, syn, target_el); +} + /* try to fill the TLB and return an exception if error. If retaddr is * NULL, it means that the function was called in C code (i.e. not * from generated code or from helper.c) @@ -XXX,XX +XXX,XX @@ void tlb_fill(CPUState *cs, target_ulong addr, MMUAccessType access_type, ret = arm_tlb_fill(cs, addr, access_type, mmu_idx, &fsr, &fi); if (unlikely(ret)) { ARMCPU *cpu = ARM_CPU(cs); - CPUARMState *env = &cpu->env; - uint32_t syn, exc, fsc; - unsigned int target_el; - bool same_el; + uint32_t fsc; if (retaddr) { /* now we have a real cpu fault */ cpu_restore_state(cs, retaddr); } - target_el = exception_target_el(env); - if (fi.stage2) { - target_el = 2; - env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4; - } - same_el = arm_current_el(env) == target_el; - if (fsr & (1 << 9)) { /* LPAE format fault status register : bottom 6 bits are * status code in the same form as needed for syndrome @@ -XXX,XX +XXX,XX @@ void tlb_fill(CPUState *cs, target_ulong addr, MMUAccessType access_type, fsc = extract32(fsr, 0, 6); } else { /* Short format FSR : this fault will never actually be reported - * to an EL that uses a syndrome register. Check that here, - * and use a (currently) reserved FSR code in case the constructed - * syndrome does leak into the guest somehow. + * to an EL that uses a syndrome register. Use a (currently) + * reserved FSR code in case the constructed syndrome does leak + * into the guest somehow. deliver_fault will assert that + * we don't target an EL using the syndrome. */ - assert(target_el != 2 && !arm_el_is_aa64(env, target_el)); fsc = 0x3f; } - /* For insn and data aborts we assume there is no instruction syndrome - * information; this is always true for exceptions reported to EL1. - */ - if (access_type == MMU_INST_FETCH) { - syn = syn_insn_abort(same_el, 0, fi.s1ptw, fsc); - exc = EXCP_PREFETCH_ABORT; - } else { - syn = merge_syn_data_abort(env->exception.syndrome, target_el, - same_el, fi.s1ptw, - access_type == MMU_DATA_STORE, fsc); - if (access_type == MMU_DATA_STORE - && arm_feature(env, ARM_FEATURE_V6)) { - fsr |= (1 << 11); - } - exc = EXCP_DATA_ABORT; - } - - env->exception.vaddress = addr; - env->exception.fsr = fsr; - raise_exception(env, exc, syn, target_el); + deliver_fault(cpu, addr, access_type, fsr, fsc, &fi); } } @@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, { ARMCPU *cpu = ARM_CPU(cs); CPUARMState *env = &cpu->env; - int target_el; - bool same_el; - uint32_t syn; + uint32_t fsr, fsc; + ARMMMUFaultInfo fi = {}; ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx); if (retaddr) { @@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, cpu_restore_state(cs, retaddr); } - target_el = exception_target_el(env); - same_el = (arm_current_el(env) == target_el); - - env->exception.vaddress = vaddr; - /* the DFSR for an alignment fault depends on whether we're using * the LPAE long descriptor format, or the short descriptor format */ if (arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) { - env->exception.fsr = (1 << 9) | 0x21; + fsr = (1 << 9) | 0x21; } else { - env->exception.fsr = 0x1; - } - - if (access_type == MMU_DATA_STORE && arm_feature(env, ARM_FEATURE_V6)) { - env->exception.fsr |= (1 << 11); + fsr = 0x1; } + fsc = 0x21; - syn = merge_syn_data_abort(env->exception.syndrome, target_el, - same_el, 0, access_type == MMU_DATA_STORE, - 0x21); - raise_exception(env, EXCP_DATA_ABORT, syn, target_el); + deliver_fault(cpu, vaddr, access_type, fsr, fsc, &fi); } #endif /* !defined(CONFIG_USER_ONLY) */ -- 2.7.4 For external aborts, we will want to be able to specify the EA (external abort type) bit in the syndrome field. Allow callers of deliver_fault() to do that by adding a field to ARMMMUFaultInfo which we use when constructing the syndrome values. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- target/arm/internals.h | 2 ++ target/arm/op_helper.c | 10 +++++----- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/target/arm/internals.h b/target/arm/internals.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu); * @s2addr: Address that caused a fault at stage 2 * @stage2: True if we faulted at stage 2 * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk + * @ea: True if we should set the EA (external abort type) bit in syndrome */ typedef struct ARMMMUFaultInfo ARMMMUFaultInfo; struct ARMMMUFaultInfo { target_ulong s2addr; bool stage2; bool s1ptw; + bool ea; }; /* Do a page table walk and add page to TLB if possible */ diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -XXX,XX +XXX,XX @@ uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def, static inline uint32_t merge_syn_data_abort(uint32_t template_syn, unsigned int target_el, - bool same_el, + bool same_el, bool ea, bool s1ptw, bool is_write, int fsc) { @@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn, */ if (!(template_syn & ARM_EL_ISV) || target_el != 2 || s1ptw) { syn = syn_data_abort_no_iss(same_el, - 0, 0, s1ptw, is_write, fsc); + ea, 0, s1ptw, is_write, fsc); } else { /* Fields: IL, ISV, SAS, SSE, SRT, SF and AR come from the template * syndrome created at translation time. @@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn, */ syn = syn_data_abort_with_iss(same_el, 0, 0, 0, 0, 0, - 0, 0, s1ptw, is_write, fsc, + ea, 0, s1ptw, is_write, fsc, false); /* Merge the runtime syndrome with the template syndrome. */ syn |= template_syn; @@ -XXX,XX +XXX,XX @@ static void deliver_fault(ARMCPU *cpu, vaddr addr, MMUAccessType access_type, } if (access_type == MMU_INST_FETCH) { - syn = syn_insn_abort(same_el, 0, fi->s1ptw, fsc); + syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc); exc = EXCP_PREFETCH_ABORT; } else { syn = merge_syn_data_abort(env->exception.syndrome, target_el, - same_el, fi->s1ptw, + same_el, fi->ea, fi->s1ptw, access_type == MMU_DATA_STORE, fsc); if (access_type == MMU_DATA_STORE -- 2.7.4 Implement the new do_transaction_failed hook for ARM, which should cause the CPU to take a prefetch abort or data abort. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> --- target/arm/internals.h | 10 ++++++++++ target/arm/cpu.c | 1 + target/arm/op_helper.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 54 insertions(+) diff --git a/target/arm/internals.h b/target/arm/internals.h index XXXXXXX..XXXXXXX 100644 --- a/target/arm/internals.h +++ b/target/arm/internals.h @@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, MMUAccessType access_type, int mmu_idx, uintptr_t retaddr); +/* arm_cpu_do_transaction_failed: handle a memory system error response + * (eg "no device/memory present at address") by raising an external abort + * exception + */ +void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, + vaddr addr, unsigned size, + MMUAccessType access_type, + int mmu_idx, MemTxAttrs attrs, + MemTxResult response, uintptr_t retaddr); + /* Call the EL change hook if one has been registered */ static inline void arm_call_el_change_hook(ARMCPU *cpu) { diff --git a/target/arm/cpu.c b/target/arm/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data) #else cc->do_interrupt = arm_cpu_do_interrupt; cc->do_unaligned_access = arm_cpu_do_unaligned_access; + cc->do_transaction_failed = arm_cpu_do_transaction_failed; cc->get_phys_page_attrs_debug = arm_cpu_get_phys_page_attrs_debug; cc->asidx_from_attrs = arm_asidx_from_attrs; cc->vmsd = &vmstate_arm_cpu; diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/op_helper.c +++ b/target/arm/op_helper.c @@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr, deliver_fault(cpu, vaddr, access_type, fsr, fsc, &fi); } +/* arm_cpu_do_transaction_failed: handle a memory system error response + * (eg "no device/memory present at address") by raising an external abort + * exception + */ +void arm_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr, + vaddr addr, unsigned size, + MMUAccessType access_type, + int mmu_idx, MemTxAttrs attrs, + MemTxResult response, uintptr_t retaddr) +{ + ARMCPU *cpu = ARM_CPU(cs); + CPUARMState *env = &cpu->env; + uint32_t fsr, fsc; + ARMMMUFaultInfo fi = {}; + ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx); + + if (retaddr) { + /* now we have a real cpu fault */ + cpu_restore_state(cs, retaddr); + } + + /* The EA bit in syndromes and fault status registers is an + * IMPDEF classification of external aborts. ARM implementations + * usually use this to indicate AXI bus Decode error (0) or + * Slave error (1); in QEMU we follow that. + */ + fi.ea = (response != MEMTX_DECODE_ERROR); + + /* The fault status register format depends on whether we're using + * the LPAE long descriptor format, or the short descriptor format. + */ + if (arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) { + /* long descriptor form, STATUS 0b010000: synchronous ext abort */ + fsr = (fi.ea << 12) | (1 << 9) | 0x10; + } else { + /* short descriptor form, FSR 0b01000 : synchronous ext abort */ + fsr = (fi.ea << 12) | 0x8; + } + fsc = 0x10; + + deliver_fault(cpu, addr, access_type, fsr, fsc, &fi); +} + #endif /* !defined(CONFIG_USER_ONLY) */ uint32_t HELPER(add_setq)(CPUARMState *env, uint32_t a, uint32_t b) -- 2.7.4 From: Thomas Huth <thuth@redhat.com> QEMU currently aborts if the user is accidentially trying to do something like this: $ aarch64-softmmu/qemu-system-aarch64 -S -M integratorcp -nographic QEMU 2.9.93 monitor - type 'help' for more information (qemu) device_add ast2400 Unexpected error in error_set_from_qdev_prop_error() at hw/core/qdev-properties.c:1032: Aborted (core dumped) The ast2400 SoC devices are clearly not creatable by the user since they are using the serial_hds and nd_table arrays directly in their realize function, so mark them with user_creatable = false. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/arm/aspeed_soc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/aspeed_soc.c +++ b/hw/arm/aspeed_soc.c @@ -XXX,XX +XXX,XX @@ static void aspeed_soc_class_init(ObjectClass *oc, void *data) sc->info = (AspeedSoCInfo *) data; dc->realize = aspeed_soc_realize; + /* Reason: Uses serial_hds and nd_table in realize() directly */ + dc->user_creatable = false; } static const TypeInfo aspeed_soc_type_info = { -- 2.7.4 From: Thomas Huth <thuth@redhat.com> QEMU currently shows some unexpected behavior when the user trys to do a "device_add digic" on an unrelated ARM machine like integratorcp in "-nographic" mode (the device_add command does not immediately return to the monitor prompt), and trying to "device_del" the device later results in a "qemu/qdev-monitor.c:872:qdev_unplug: assertion failed: (hotplug_ctrl)" error condition. Looking at the realize function of the device, it uses serial_hds directly and this means that the device can not be added a second time, so let's simply mark it with "user_creatable = false" now. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/arm/digic.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/arm/digic.c b/hw/arm/digic.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/digic.c +++ b/hw/arm/digic.c @@ -XXX,XX +XXX,XX @@ static void digic_class_init(ObjectClass *oc, void *data) DeviceClass *dc = DEVICE_CLASS(oc); dc->realize = digic_realize; + /* Reason: Uses serial_hds in the realize function --> not usable twice */ + dc->user_creatable = false; } static const TypeInfo digic_type_info = { -- 2.7.4 From: Richard Henderson <richard.henderson@linaro.org> For "ldp x0, x1, [x0]", if the second load is on a second page and the second page is unmapped, the exception would be raised with x0 already modified. This means the instruction couldn't be restarted. Cc: qemu-arm@nongnu.org Cc: qemu-stable@nongnu.org Reported-by: Andrew <andrew@fubar.geek.nz> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20170825224833.4463-1-richard.henderson@linaro.org Fixes: https://bugs.launchpad.net/qemu/+bug/1713066 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> [PMM: tweaked comment format] Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/translate-a64.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -XXX,XX +XXX,XX @@ static void disas_ldst_pair(DisasContext *s, uint32_t insn) } else { do_fp_st(s, rt, tcg_addr, size); } - } else { - TCGv_i64 tcg_rt = cpu_reg(s, rt); - if (is_load) { - do_gpr_ld(s, tcg_rt, tcg_addr, size, is_signed, false, - false, 0, false, false); - } else { - do_gpr_st(s, tcg_rt, tcg_addr, size, - false, 0, false, false); - } - } - tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size); - if (is_vector) { + tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size); if (is_load) { do_fp_ld(s, rt2, tcg_addr, size); } else { do_fp_st(s, rt2, tcg_addr, size); } } else { + TCGv_i64 tcg_rt = cpu_reg(s, rt); TCGv_i64 tcg_rt2 = cpu_reg(s, rt2); + if (is_load) { + TCGv_i64 tmp = tcg_temp_new_i64(); + + /* Do not modify tcg_rt before recognizing any exception + * from the second load. + */ + do_gpr_ld(s, tmp, tcg_addr, size, is_signed, false, + false, 0, false, false); + tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size); do_gpr_ld(s, tcg_rt2, tcg_addr, size, is_signed, false, false, 0, false, false); + + tcg_gen_mov_i64(tcg_rt, tmp); + tcg_temp_free_i64(tmp); } else { + do_gpr_st(s, tcg_rt, tcg_addr, size, + false, 0, false, false); + tcg_gen_addi_i64(tcg_addr, tcg_addr, 1 << size); do_gpr_st(s, tcg_rt2, tcg_addr, size, false, 0, false, false); } -- 2.7.4 From: Pranith Kumar <bobby.prani@gmail.com> Fix the following warning: /home/pranith/qemu/hw/intc/arm_gicv3_kvm.c:296:17: warning: logical not is only applied to the left hand side of this bitwise operator [-Wlogical-not-parentheses] if (!c->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) { ^ ~ /home/pranith/qemu/hw/intc/arm_gicv3_kvm.c:296:17: note: add parentheses after the '!' to evaluate the bitwise operator first if (!c->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) { ^ /home/pranith/qemu/hw/intc/arm_gicv3_kvm.c:296:17: note: add parentheses around left hand side expression to silence this warning if (!c->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) { ^ This logic error meant we were not setting the PTZ bit when we should -- luckily as the comment suggests this wouldn't have had any effects beyond making GIC initialization take a little longer. Signed-off-by: Pranith Kumar <bobby.prani@gmail.com> Message-id: 20170829173226.7625-1-bobby.prani@gmail.com Cc: qemu-stable@nongnu.org Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/intc/arm_gicv3_kvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c index XXXXXXX..XXXXXXX 100644 --- a/hw/intc/arm_gicv3_kvm.c +++ b/hw/intc/arm_gicv3_kvm.c @@ -XXX,XX +XXX,XX @@ static void kvm_arm_gicv3_put(GICv3State *s) kvm_gicr_access(s, GICR_PROPBASER + 4, ncpu, &regh, true); reg64 = c->gicr_pendbaser; - if (!c->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) { + if (!(c->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) { /* Setting PTZ is advised if LPIs are disabled, to reduce * GIC initialization time. */ -- 2.7.4 This is almost all the mps3-an547 series, but there are a few other bits in there too. thanks -- PMM The following changes since commit 0436c55edf6b357ff56e2a5bf688df8636f83456: Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-08 13:51:41 +0000) are available in the Git repository at: https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210308-1 for you to fetch changes up to da2140183ac3a04b1ccb861aeac1f2c048c71b66: hw/timer/renesas_tmr: Fix use of uninitialized data in read_tcnt() (2021-03-08 17:20:04 +0000) ---------------------------------------------------------------- * Add new mps3-an547 board * target/arm: Restrict v7A TCG cpus to TCG accel * Implement a Xilinx CSU DMA model * hw/timer/renesas_tmr: Fix use of uninitialized data in read_tcnt() ---------------------------------------------------------------- Peter Maydell (48): clock: Add ClockEvent parameter to callbacks clock: Add ClockPreUpdate callback event type clock: Add clock_ns_to_ticks() function hw/timer/npcm7xx_timer: Use new clock_ns_to_ticks() hw/arm/armsse: Introduce SSE subsystem version property hw/misc/iotkit-sysctl: Remove is_sse200 flag hw/misc/iotkit-secctl.c: Implement SSE-300 PID register values hw/misc/iotkit-sysinfo.c: Implement SSE-300 PID register values hw/arm/armsse.c: Use correct SYS_CONFIG0 register value for SSE-300 hw/misc/iotkit-sysinfo.c: Implement SYS_CONFIG1 and IIDR hw/timer/sse-counter: Model the SSE Subsystem System Counter hw/timer/sse-timer: Model the SSE Subsystem System Timer hw/misc/iotkit-sysctl: Add SSE-300 cases which match SSE-200 behaviour hw/misc/iotkit-sysctl: Handle CPU_WAIT, NMI_ENABLE for SSE-300 hw/misc/iotkit-sysctl: Handle INITSVTOR* for SSE-300 hw/misc/iotkit-sysctl: Implement dummy version of SSE-300 PWRCTRL register hw/misc/iotkit-sysctl: Handle SSE-300 changes to PDCM_PD_*_SENSE registers hw/misc/iotkit-sysctl: Implement SSE-200 and SSE-300 PID register values hw/arm/Kconfig: Move ARMSSE_CPUID and ARMSSE_MHU stanzas to hw/misc hw/misc/sse-cpu-pwrctrl: Implement SSE-300 CPU<N>_PWRCTRL register block hw/arm/armsse: Use an array for apb_ppc fields in the state structure hw/arm/armsse: Add a define for number of IRQs used by the SSE itself hw/arm/armsse: Add framework for data-driven device placement hw/arm/armsse: Move dual-timer device into data-driven framework hw/arm/armsse: Move watchdogs into data-driven framework hw/arm/armsse: Move s32ktimer into data-driven framework hw/arm/armsse: Move sysinfo register block into data-driven framework hw/arm/armsse: Move sysctl register block into data-driven framework hw/arm/armsse: Move PPUs into data-driven framework hw/arm/armsse: Add missing SSE-200 SYS_PPU hw/arm/armsse: Indirect irq_is_common[] through ARMSSEInfo hw/arm/armsse: Add support for SSE variants with a system counter hw/arm/armsse: Add support for TYPE_SSE_TIMER in ARMSSEDeviceInfo hw/arm/armsse: Support variants with ARMSSE_CPU_PWRCTRL block hw/arm/armsse: Add SSE-300 support hw/arm/mps2-tz: Make UART overflow IRQ board-specific hw/misc/mps2-fpgaio: Fold counters subsection into main vmstate hw/misc/mps2-fpgaio: Support AN547 DBGCTRL register hw/misc/mps2-scc: Implement changes for AN547 hw/arm/mps2-tz: Support running APB peripherals on different clock hw/arm/mps2-tz: Make initsvtor0 setting board-specific hw/arm/mps2-tz: Add new mps3-an547 board docs/system/arm/mps2.rst: Document the new mps3-an547 board tests/qtest/sse-timer-test: Add simple test of the SSE counter tests/qtest/sse-timer-test: Test the system timer tests/qtest/sse-timer-test: Test counter scaling changes hw/timer/renesas_tmr: Prefix constants for CSS values with CSS_ hw/timer/renesas_tmr: Fix use of uninitialized data in read_tcnt() Philippe Mathieu-Daudé (1): target/arm: Restrict v7A TCG cpus to TCG accel Xuzhou Cheng (5): hw/dma: Implement a Xilinx CSU DMA model hw/arm: xlnx-zynqmp: Clean up coding convention issues hw/arm: xlnx-zynqmp: Connect a Xilinx CSU DMA module for QSPI hw/ssi: xilinx_spips: Clean up coding convention issues hw/ssi: xilinx_spips: Remove DMA related dead codes from zynqmp_spips docs/devel/clocks.rst | 71 ++- docs/system/arm/mps2.rst | 6 +- include/hw/arm/armsse-version.h | 42 ++ include/hw/arm/armsse.h | 40 +- include/hw/arm/xlnx-zynqmp.h | 5 +- include/hw/clock.h | 63 ++- include/hw/dma/xlnx_csu_dma.h | 52 ++ include/hw/misc/armsse-cpu-pwrctrl.h | 40 ++ include/hw/misc/iotkit-secctl.h | 2 + include/hw/misc/iotkit-sysctl.h | 13 +- include/hw/misc/iotkit-sysinfo.h | 2 + include/hw/misc/mps2-fpgaio.h | 2 + include/hw/qdev-clock.h | 17 +- include/hw/ssi/xilinx_spips.h | 2 +- include/hw/timer/sse-counter.h | 105 ++++ include/hw/timer/sse-timer.h | 53 ++ hw/adc/npcm7xx_adc.c | 2 +- hw/arm/armsse.c | 1008 +++++++++++++++++++++++++--------- hw/arm/mps2-tz.c | 168 +++++- hw/arm/xlnx-zynqmp.c | 21 +- hw/char/cadence_uart.c | 4 +- hw/char/ibex_uart.c | 4 +- hw/char/pl011.c | 5 +- hw/core/clock.c | 24 +- hw/core/qdev-clock.c | 8 +- hw/dma/xlnx_csu_dma.c | 745 +++++++++++++++++++++++++ hw/mips/cps.c | 2 +- hw/misc/armsse-cpu-pwrctrl.c | 149 +++++ hw/misc/bcm2835_cprman.c | 23 +- hw/misc/iotkit-secctl.c | 50 +- hw/misc/iotkit-sysctl.c | 522 +++++++++++++++--- hw/misc/iotkit-sysinfo.c | 51 +- hw/misc/mps2-fpgaio.c | 52 +- hw/misc/mps2-scc.c | 15 +- hw/misc/npcm7xx_clk.c | 26 +- hw/misc/npcm7xx_pwm.c | 2 +- hw/misc/zynq_slcr.c | 5 +- hw/ssi/xilinx_spips.c | 33 +- hw/timer/cmsdk-apb-dualtimer.c | 5 +- hw/timer/cmsdk-apb-timer.c | 4 +- hw/timer/npcm7xx_timer.c | 6 +- hw/timer/renesas_tmr.c | 33 +- hw/timer/sse-counter.c | 474 ++++++++++++++++ hw/timer/sse-timer.c | 470 ++++++++++++++++ hw/watchdog/cmsdk-apb-watchdog.c | 5 +- target/arm/cpu.c | 335 ----------- target/arm/cpu_tcg.c | 318 +++++++++++ target/mips/cpu.c | 2 +- tests/qtest/sse-timer-test.c | 240 ++++++++ MAINTAINERS | 7 + hw/arm/Kconfig | 10 +- hw/dma/Kconfig | 4 + hw/dma/meson.build | 1 + hw/misc/Kconfig | 9 + hw/misc/meson.build | 1 + hw/misc/trace-events | 4 + hw/timer/Kconfig | 6 + hw/timer/meson.build | 2 + hw/timer/trace-events | 12 + tests/qtest/meson.build | 1 + 60 files changed, 4537 insertions(+), 846 deletions(-) create mode 100644 include/hw/arm/armsse-version.h create mode 100644 include/hw/dma/xlnx_csu_dma.h create mode 100644 include/hw/misc/armsse-cpu-pwrctrl.h create mode 100644 include/hw/timer/sse-counter.h create mode 100644 include/hw/timer/sse-timer.h create mode 100644 hw/dma/xlnx_csu_dma.c create mode 100644 hw/misc/armsse-cpu-pwrctrl.c create mode 100644 hw/timer/sse-counter.c create mode 100644 hw/timer/sse-timer.c create mode 100644 tests/qtest/sse-timer-test.c The Clock framework allows users to specify a callback which is called after the clock's period has been updated. Some users need to also have a callback which is called before the clock period is updated. As the first step in adding support for notifying Clock users on pre-update events, add an argument to the ClockCallback to specify what event is being notified, and add an argument to the various functions for registering a callback to specify which events are of interest to that callback. Note that the documentation update renders correct the previously incorrect claim in 'Adding a new clock' that callbacks "will be explained in a following section". Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Luc Michel <luc@lmichel.fr> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-2-peter.maydell@linaro.org --- docs/devel/clocks.rst | 52 +++++++++++++++++++++++++++----- include/hw/clock.h | 21 +++++++++++-- include/hw/qdev-clock.h | 17 ++++++++--- hw/adc/npcm7xx_adc.c | 2 +- hw/arm/armsse.c | 9 +++--- hw/char/cadence_uart.c | 4 +-- hw/char/ibex_uart.c | 4 +-- hw/char/pl011.c | 5 +-- hw/core/clock.c | 21 ++++++++++--- hw/core/qdev-clock.c | 8 +++-- hw/mips/cps.c | 2 +- hw/misc/bcm2835_cprman.c | 23 ++++++++------ hw/misc/npcm7xx_clk.c | 26 +++++++++++++--- hw/misc/npcm7xx_pwm.c | 2 +- hw/misc/zynq_slcr.c | 5 +-- hw/timer/cmsdk-apb-dualtimer.c | 5 +-- hw/timer/cmsdk-apb-timer.c | 4 +-- hw/timer/npcm7xx_timer.c | 2 +- hw/watchdog/cmsdk-apb-watchdog.c | 5 +-- target/mips/cpu.c | 2 +- 20 files changed, 161 insertions(+), 58 deletions(-) diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst index XXXXXXX..XXXXXXX 100644 --- a/docs/devel/clocks.rst +++ b/docs/devel/clocks.rst @@ -XXX,XX +XXX,XX @@ Adding clocks to a device must be done during the init method of the Device instance. To add an input clock to a device, the function ``qdev_init_clock_in()`` -must be used. It takes the name, a callback and an opaque parameter -for the callback (this will be explained in a following section). +must be used. It takes the name, a callback, an opaque parameter +for the callback and a mask of events when the callback should be +called (this will be explained in a following section). Output is simpler; only the name is required. Typically:: - qdev_init_clock_in(DEVICE(dev), "clk_in", clk_in_callback, dev); + qdev_init_clock_in(DEVICE(dev), "clk_in", clk_in_callback, dev, ClockUpdate); qdev_init_clock_out(DEVICE(dev), "clk_out"); Both functions return the created Clock pointer, which should be saved in the @@ -XXX,XX +XXX,XX @@ output. * callback for the input clock (see "Callback on input clock * change" section below for more information). */ - static void clk_in_callback(void *opaque); + static void clk_in_callback(void *opaque, ClockEvent event); /* * static array describing clocks: @@ -XXX,XX +XXX,XX @@ output. * the clk_out field of a MyDeviceState structure. */ static const ClockPortInitArray mydev_clocks = { - QDEV_CLOCK_IN(MyDeviceState, clk_in, clk_in_callback), + QDEV_CLOCK_IN(MyDeviceState, clk_in, clk_in_callback, ClockUpdate), QDEV_CLOCK_OUT(MyDeviceState, clk_out), QDEV_CLOCK_END }; @@ -XXX,XX +XXX,XX @@ nothing else to do. This value will be propagated to other clocks when connecting the clocks together and devices will fetch the right value during the first reset. +Clock callbacks +--------------- + +You can give a clock a callback function in several ways: + + * by passing it as an argument to ``qdev_init_clock_in()`` + * as an argument to the ``QDEV_CLOCK_IN()`` macro initializing an + array to be passed to ``qdev_init_clocks()`` + * by directly calling the ``clock_set_callback()`` function + +The callback function must be of this type: + +.. code-block:: c + + typedef void ClockCallback(void *opaque, ClockEvent event); + +The ``opaque`` argument is the pointer passed to ``qdev_init_clock_in()`` +or ``clock_set_callback()``; for ``qdev_init_clocks()`` it is the +``dev`` device pointer. + +The ``event`` argument specifies why the callback has been called. +When you register the callback you specify a mask of ClockEvent values +that you are interested in. The callback will only be called for those +events. + +The events currently supported are: + + * ``ClockUpdate`` : called after the input clock's period has changed + +Note that a clock only has one callback: it is not possible to register +different functions for different events. You must register a single +callback which listens for all of the events you are interested in, +and use the ``event`` argument to identify which event has happened. + Retrieving clocks from a device ------------------------------- @@ -XXX,XX +XXX,XX @@ object during device instance init. For example: .. code-block:: c clk = qdev_init_clock_in(DEVICE(dev), "clk-in", clk_in_callback, - dev); + dev, ClockUpdate); /* set initial value to 10ns / 100MHz */ clock_set_ns(clk, 10); @@ -XXX,XX +XXX,XX @@ next lowest integer. This implies some inaccuracy due to the rounding, so be cautious about using it in calculations. It is also possible to register a callback on clock frequency changes. -Here is an example: +Here is an example, which assumes that ``clock_callback`` has been +specified as the callback for the ``ClockUpdate`` event: .. code-block:: c - void clock_callback(void *opaque) { + void clock_callback(void *opaque, ClockEvent event) { MyDeviceState *s = (MyDeviceState *) opaque; /* * 'opaque' is the argument passed to qdev_init_clock_in(); diff --git a/include/hw/clock.h b/include/hw/clock.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/clock.h +++ b/include/hw/clock.h @@ -XXX,XX +XXX,XX @@ #define TYPE_CLOCK "clock" OBJECT_DECLARE_SIMPLE_TYPE(Clock, CLOCK) -typedef void ClockCallback(void *opaque); +/* + * Argument to ClockCallback functions indicating why the callback + * has been called. A mask of these values logically ORed together + * is used to specify which events are interesting when the callback + * is registered, so these values must all be different bit values. + */ +typedef enum ClockEvent { + ClockUpdate = 1, /* Clock period has just updated */ +} ClockEvent; + +typedef void ClockCallback(void *opaque, ClockEvent event); /* * clock store a value representing the clock's period in 2^-32ns unit. @@ -XXX,XX +XXX,XX @@ typedef void ClockCallback(void *opaque); * @canonical_path: clock path string cache (used for trace purpose) * @callback: called when clock changes * @callback_opaque: argument for @callback + * @callback_events: mask of events when callback should be called * @source: source (or parent in clock tree) of the clock * @children: list of clocks connected to this one (it is their source) * @sibling: structure used to form a clock list @@ -XXX,XX +XXX,XX @@ struct Clock { char *canonical_path; ClockCallback *callback; void *callback_opaque; + unsigned int callback_events; /* Clocks are organized in a clock tree */ Clock *source; @@ -XXX,XX +XXX,XX @@ Clock *clock_new(Object *parent, const char *name); * @clk: the clock to register the callback into * @cb: the callback function * @opaque: the argument to the callback + * @events: the events the callback should be called for + * (logical OR of ClockEvent enum values) * * Register a callback called on every clock update. + * Note that a clock has only one callback: you cannot register + * different callback functions for different events. */ -void clock_set_callback(Clock *clk, ClockCallback *cb, void *opaque); +void clock_set_callback(Clock *clk, ClockCallback *cb, + void *opaque, unsigned int events); /** * clock_clear_callback: diff --git a/include/hw/qdev-clock.h b/include/hw/qdev-clock.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/qdev-clock.h +++ b/include/hw/qdev-clock.h @@ -XXX,XX +XXX,XX @@ * @name: the name of the clock (can't be NULL). * @callback: optional callback to be called on update or NULL. * @opaque: argument for the callback + * @events: the events the callback should be called for + * (logical OR of ClockEvent enum values) * @returns: a pointer to the newly added clock * * Add an input clock to device @dev as a clock named @name. @@ -XXX,XX +XXX,XX @@ * The callback will be called with @opaque as opaque parameter. */ Clock *qdev_init_clock_in(DeviceState *dev, const char *name, - ClockCallback *callback, void *opaque); + ClockCallback *callback, void *opaque, + unsigned int events); /** * qdev_init_clock_out: @@ -XXX,XX +XXX,XX @@ void qdev_finalize_clocklist(DeviceState *dev); * @output: indicates whether the clock is input or output * @callback: for inputs, optional callback to be called on clock's update * with device as opaque + * @callback_events: mask of ClockEvent values for when callback is called * @offset: optional offset to store the ClockIn or ClockOut pointer in device * state structure (0 means unused) */ @@ -XXX,XX +XXX,XX @@ struct ClockPortInitElem { const char *name; bool is_output; ClockCallback *callback; + unsigned int callback_events; size_t offset; }; @@ -XXX,XX +XXX,XX @@ struct ClockPortInitElem { (offsetof(devstate, field) + \ type_check(Clock *, typeof_field(devstate, field))) -#define QDEV_CLOCK(out_not_in, devstate, field, cb) { \ +#define QDEV_CLOCK(out_not_in, devstate, field, cb, cbevents) { \ .name = (stringify(field)), \ .is_output = out_not_in, \ .callback = cb, \ + .callback_events = cbevents, \ .offset = clock_offset_value(devstate, field), \ } @@ -XXX,XX +XXX,XX @@ struct ClockPortInitElem { * @field: a field in @_devstate (must be Clock*) * @callback: (for input only) callback (or NULL) to be called with the device * state as argument + * @cbevents: (for input only) ClockEvent mask for when callback is called * * The name of the clock will be derived from @field */ -#define QDEV_CLOCK_IN(devstate, field, callback) \ - QDEV_CLOCK(false, devstate, field, callback) +#define QDEV_CLOCK_IN(devstate, field, callback, cbevents) \ + QDEV_CLOCK(false, devstate, field, callback, cbevents) #define QDEV_CLOCK_OUT(devstate, field) \ - QDEV_CLOCK(true, devstate, field, NULL) + QDEV_CLOCK(true, devstate, field, NULL, 0) #define QDEV_CLOCK_END { .name = NULL } diff --git a/hw/adc/npcm7xx_adc.c b/hw/adc/npcm7xx_adc.c index XXXXXXX..XXXXXXX 100644 --- a/hw/adc/npcm7xx_adc.c +++ b/hw/adc/npcm7xx_adc.c @@ -XXX,XX +XXX,XX @@ static void npcm7xx_adc_init(Object *obj) memory_region_init_io(&s->iomem, obj, &npcm7xx_adc_ops, s, TYPE_NPCM7XX_ADC, 4 * KiB); sysbus_init_mmio(sbd, &s->iomem); - s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL); + s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL, 0); for (i = 0; i < NPCM7XX_ADC_NUM_INPUTS; ++i) { object_property_add_uint32_ptr(obj, "adci[*]", diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static void armsse_forward_sec_resp_cfg(ARMSSE *s) qdev_connect_gpio_out(dev_splitter, 2, s->sec_resp_cfg_in); } -static void armsse_mainclk_update(void *opaque) +static void armsse_mainclk_update(void *opaque, ClockEvent event) { ARMSSE *s = ARM_SSE(opaque); + /* * Set system_clock_scale from our Clock input; this is what * controls the tick rate of the CPU SysTick timer. @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) assert(info->num_cpus <= SSE_MAX_CPUS); s->mainclk = qdev_init_clock_in(DEVICE(s), "MAINCLK", - armsse_mainclk_update, s); - s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL); + armsse_mainclk_update, s, ClockUpdate); + s->s32kclk = qdev_init_clock_in(DEVICE(s), "S32KCLK", NULL, NULL, 0); memory_region_init(&s->container, obj, "armsse-container", UINT64_MAX); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->container); /* Set initial system_clock_scale from MAINCLK */ - armsse_mainclk_update(s); + armsse_mainclk_update(s, ClockUpdate); } static void armsse_idau_check(IDAUInterface *ii, uint32_t address, diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c index XXXXXXX..XXXXXXX 100644 --- a/hw/char/cadence_uart.c +++ b/hw/char/cadence_uart.c @@ -XXX,XX +XXX,XX @@ static void cadence_uart_realize(DeviceState *dev, Error **errp) uart_event, NULL, s, NULL, true); } -static void cadence_uart_refclk_update(void *opaque) +static void cadence_uart_refclk_update(void *opaque, ClockEvent event) { CadenceUARTState *s = opaque; @@ -XXX,XX +XXX,XX @@ static void cadence_uart_init(Object *obj) sysbus_init_irq(sbd, &s->irq); s->refclk = qdev_init_clock_in(DEVICE(obj), "refclk", - cadence_uart_refclk_update, s); + cadence_uart_refclk_update, s, ClockUpdate); /* initialize the frequency in case the clock remains unconnected */ clock_set_hz(s->refclk, UART_DEFAULT_REF_CLK); diff --git a/hw/char/ibex_uart.c b/hw/char/ibex_uart.c index XXXXXXX..XXXXXXX 100644 --- a/hw/char/ibex_uart.c +++ b/hw/char/ibex_uart.c @@ -XXX,XX +XXX,XX @@ static void ibex_uart_write(void *opaque, hwaddr addr, } } -static void ibex_uart_clk_update(void *opaque) +static void ibex_uart_clk_update(void *opaque, ClockEvent event) { IbexUartState *s = opaque; @@ -XXX,XX +XXX,XX @@ static void ibex_uart_init(Object *obj) IbexUartState *s = IBEX_UART(obj); s->f_clk = qdev_init_clock_in(DEVICE(obj), "f_clock", - ibex_uart_clk_update, s); + ibex_uart_clk_update, s, ClockUpdate); clock_set_hz(s->f_clk, IBEX_UART_CLOCK); sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->tx_watermark); diff --git a/hw/char/pl011.c b/hw/char/pl011.c index XXXXXXX..XXXXXXX 100644 --- a/hw/char/pl011.c +++ b/hw/char/pl011.c @@ -XXX,XX +XXX,XX @@ static void pl011_event(void *opaque, QEMUChrEvent event) pl011_put_fifo(opaque, 0x400); } -static void pl011_clock_update(void *opaque) +static void pl011_clock_update(void *opaque, ClockEvent event) { PL011State *s = PL011(opaque); @@ -XXX,XX +XXX,XX @@ static void pl011_init(Object *obj) sysbus_init_irq(sbd, &s->irq[i]); } - s->clk = qdev_init_clock_in(DEVICE(obj), "clk", pl011_clock_update, s); + s->clk = qdev_init_clock_in(DEVICE(obj), "clk", pl011_clock_update, s, + ClockUpdate); s->read_trigger = 1; s->ifl = 0x12; diff --git a/hw/core/clock.c b/hw/core/clock.c index XXXXXXX..XXXXXXX 100644 --- a/hw/core/clock.c +++ b/hw/core/clock.c @@ -XXX,XX +XXX,XX @@ Clock *clock_new(Object *parent, const char *name) return clk; } -void clock_set_callback(Clock *clk, ClockCallback *cb, void *opaque) +void clock_set_callback(Clock *clk, ClockCallback *cb, void *opaque, + unsigned int events) { clk->callback = cb; clk->callback_opaque = opaque; + clk->callback_events = events; } void clock_clear_callback(Clock *clk) { - clock_set_callback(clk, NULL, NULL); + clock_set_callback(clk, NULL, NULL, 0); } bool clock_set(Clock *clk, uint64_t period) @@ -XXX,XX +XXX,XX @@ bool clock_set(Clock *clk, uint64_t period) return true; } +static void clock_call_callback(Clock *clk, ClockEvent event) +{ + /* + * Call the Clock's callback for this event, if it has one and + * is interested in this event. + */ + if (clk->callback && (clk->callback_events & event)) { + clk->callback(clk->callback_opaque, event); + } +} + static void clock_propagate_period(Clock *clk, bool call_callbacks) { Clock *child; @@ -XXX,XX +XXX,XX @@ static void clock_propagate_period(Clock *clk, bool call_callbacks) trace_clock_update(CLOCK_PATH(child), CLOCK_PATH(clk), CLOCK_PERIOD_TO_HZ(clk->period), call_callbacks); - if (call_callbacks && child->callback) { - child->callback(child->callback_opaque); + if (call_callbacks) { + clock_call_callback(child, ClockUpdate); } clock_propagate_period(child, call_callbacks); } diff --git a/hw/core/qdev-clock.c b/hw/core/qdev-clock.c index XXXXXXX..XXXXXXX 100644 --- a/hw/core/qdev-clock.c +++ b/hw/core/qdev-clock.c @@ -XXX,XX +XXX,XX @@ Clock *qdev_init_clock_out(DeviceState *dev, const char *name) } Clock *qdev_init_clock_in(DeviceState *dev, const char *name, - ClockCallback *callback, void *opaque) + ClockCallback *callback, void *opaque, + unsigned int events) { NamedClockList *ncl; @@ -XXX,XX +XXX,XX @@ Clock *qdev_init_clock_in(DeviceState *dev, const char *name, ncl = qdev_init_clocklist(dev, name, false, NULL); if (callback) { - clock_set_callback(ncl->clock, callback, opaque); + clock_set_callback(ncl->clock, callback, opaque, events); } return ncl->clock; } @@ -XXX,XX +XXX,XX @@ void qdev_init_clocks(DeviceState *dev, const ClockPortInitArray clocks) if (elem->is_output) { *clkp = qdev_init_clock_out(dev, elem->name); } else { - *clkp = qdev_init_clock_in(dev, elem->name, elem->callback, dev); + *clkp = qdev_init_clock_in(dev, elem->name, elem->callback, dev, + elem->callback_events); } } } diff --git a/hw/mips/cps.c b/hw/mips/cps.c index XXXXXXX..XXXXXXX 100644 --- a/hw/mips/cps.c +++ b/hw/mips/cps.c @@ -XXX,XX +XXX,XX @@ static void mips_cps_init(Object *obj) SysBusDevice *sbd = SYS_BUS_DEVICE(obj); MIPSCPSState *s = MIPS_CPS(obj); - s->clock = qdev_init_clock_in(DEVICE(obj), "clk-in", NULL, NULL); + s->clock = qdev_init_clock_in(DEVICE(obj), "clk-in", NULL, NULL, 0); /* * Cover entire address space as there do not seem to be any * constraints for the base address of CPC and GIC. diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/bcm2835_cprman.c +++ b/hw/misc/bcm2835_cprman.c @@ -XXX,XX +XXX,XX @@ static void pll_update(CprmanPllState *pll) clock_update_hz(pll->out, freq); } -static void pll_xosc_update(void *opaque) +static void pll_xosc_update(void *opaque, ClockEvent event) { pll_update(CPRMAN_PLL(opaque)); } @@ -XXX,XX +XXX,XX @@ static void pll_init(Object *obj) { CprmanPllState *s = CPRMAN_PLL(obj); - s->xosc_in = qdev_init_clock_in(DEVICE(s), "xosc-in", pll_xosc_update, s); + s->xosc_in = qdev_init_clock_in(DEVICE(s), "xosc-in", pll_xosc_update, + s, ClockUpdate); s->out = qdev_init_clock_out(DEVICE(s), "out"); } @@ -XXX,XX +XXX,XX @@ static void pll_update_all_channels(BCM2835CprmanState *s, } } -static void pll_channel_pll_in_update(void *opaque) +static void pll_channel_pll_in_update(void *opaque, ClockEvent event) { pll_channel_update(CPRMAN_PLL_CHANNEL(opaque)); } @@ -XXX,XX +XXX,XX @@ static void pll_channel_init(Object *obj) CprmanPllChannelState *s = CPRMAN_PLL_CHANNEL(obj); s->pll_in = qdev_init_clock_in(DEVICE(s), "pll-in", - pll_channel_pll_in_update, s); + pll_channel_pll_in_update, s, + ClockUpdate); s->out = qdev_init_clock_out(DEVICE(s), "out"); } @@ -XXX,XX +XXX,XX @@ static void clock_mux_update(CprmanClockMuxState *mux) clock_update_hz(mux->out, freq); } -static void clock_mux_src_update(void *opaque) +static void clock_mux_src_update(void *opaque, ClockEvent event) { CprmanClockMuxState **backref = opaque; CprmanClockMuxState *s = *backref; @@ -XXX,XX +XXX,XX @@ static void clock_mux_init(Object *obj) s->backref[i] = s; s->srcs[i] = qdev_init_clock_in(DEVICE(s), name, clock_mux_src_update, - &s->backref[i]); + &s->backref[i], + ClockUpdate); g_free(name); } @@ -XXX,XX +XXX,XX @@ static void dsi0hsck_mux_update(CprmanDsi0HsckMuxState *s) clock_update(s->out, clock_get(src)); } -static void dsi0hsck_mux_in_update(void *opaque) +static void dsi0hsck_mux_in_update(void *opaque, ClockEvent event) { dsi0hsck_mux_update(CPRMAN_DSI0HSCK_MUX(opaque)); } @@ -XXX,XX +XXX,XX @@ static void dsi0hsck_mux_init(Object *obj) CprmanDsi0HsckMuxState *s = CPRMAN_DSI0HSCK_MUX(obj); DeviceState *dev = DEVICE(obj); - s->plla_in = qdev_init_clock_in(dev, "plla-in", dsi0hsck_mux_in_update, s); - s->plld_in = qdev_init_clock_in(dev, "plld-in", dsi0hsck_mux_in_update, s); + s->plla_in = qdev_init_clock_in(dev, "plla-in", dsi0hsck_mux_in_update, + s, ClockUpdate); + s->plld_in = qdev_init_clock_in(dev, "plld-in", dsi0hsck_mux_in_update, + s, ClockUpdate); s->out = qdev_init_clock_out(DEVICE(s), "out"); } diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/npcm7xx_clk.c +++ b/hw/misc/npcm7xx_clk.c @@ -XXX,XX +XXX,XX @@ static const DividerInitInfo divider_init_info_list[] = { }, }; +static void npcm7xx_clk_update_pll_cb(void *opaque, ClockEvent event) +{ + npcm7xx_clk_update_pll(opaque); +} + static void npcm7xx_clk_pll_init(Object *obj) { NPCM7xxClockPLLState *pll = NPCM7XX_CLOCK_PLL(obj); pll->clock_in = qdev_init_clock_in(DEVICE(pll), "clock-in", - npcm7xx_clk_update_pll, pll); + npcm7xx_clk_update_pll_cb, pll, + ClockUpdate); pll->clock_out = qdev_init_clock_out(DEVICE(pll), "clock-out"); } +static void npcm7xx_clk_update_sel_cb(void *opaque, ClockEvent event) +{ + npcm7xx_clk_update_sel(opaque); +} + static void npcm7xx_clk_sel_init(Object *obj) { int i; @@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj) for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) { sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), g_strdup_printf("clock-in[%d]", i), - npcm7xx_clk_update_sel, sel); + npcm7xx_clk_update_sel_cb, sel, ClockUpdate); } sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out"); } + +static void npcm7xx_clk_update_divider_cb(void *opaque, ClockEvent event) +{ + npcm7xx_clk_update_divider(opaque); +} + static void npcm7xx_clk_divider_init(Object *obj) { NPCM7xxClockDividerState *div = NPCM7XX_CLOCK_DIVIDER(obj); div->clock_in = qdev_init_clock_in(DEVICE(div), "clock-in", - npcm7xx_clk_update_divider, div); + npcm7xx_clk_update_divider_cb, + div, ClockUpdate); div->clock_out = qdev_init_clock_out(DEVICE(div), "clock-out"); } @@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_init_clock_hierarchy(NPCM7xxCLKState *s) { int i; - s->clkref = qdev_init_clock_in(DEVICE(s), "clkref", NULL, NULL); + s->clkref = qdev_init_clock_in(DEVICE(s), "clkref", NULL, NULL, 0); /* First pass: init all converter modules */ QEMU_BUILD_BUG_ON(ARRAY_SIZE(pll_init_info_list) != NPCM7XX_CLOCK_NR_PLLS); diff --git a/hw/misc/npcm7xx_pwm.c b/hw/misc/npcm7xx_pwm.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/npcm7xx_pwm.c +++ b/hw/misc/npcm7xx_pwm.c @@ -XXX,XX +XXX,XX @@ static void npcm7xx_pwm_init(Object *obj) memory_region_init_io(&s->iomem, obj, &npcm7xx_pwm_ops, s, TYPE_NPCM7XX_PWM, 4 * KiB); sysbus_init_mmio(sbd, &s->iomem); - s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL); + s->clock = qdev_init_clock_in(DEVICE(s), "clock", NULL, NULL, 0); for (i = 0; i < NPCM7XX_PWM_PER_MODULE; ++i) { object_property_add_uint32_ptr(obj, "freq[*]", diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/zynq_slcr.c +++ b/hw/misc/zynq_slcr.c @@ -XXX,XX +XXX,XX @@ static void zynq_slcr_propagate_clocks(ZynqSLCRState *s) clock_propagate(s->uart1_ref_clk); } -static void zynq_slcr_ps_clk_callback(void *opaque) +static void zynq_slcr_ps_clk_callback(void *opaque, ClockEvent event) { ZynqSLCRState *s = (ZynqSLCRState *) opaque; + zynq_slcr_compute_clocks(s); zynq_slcr_propagate_clocks(s); } @@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps slcr_ops = { }; static const ClockPortInitArray zynq_slcr_clocks = { - QDEV_CLOCK_IN(ZynqSLCRState, ps_clk, zynq_slcr_ps_clk_callback), + QDEV_CLOCK_IN(ZynqSLCRState, ps_clk, zynq_slcr_ps_clk_callback, ClockUpdate), QDEV_CLOCK_OUT(ZynqSLCRState, uart0_ref_clk), QDEV_CLOCK_OUT(ZynqSLCRState, uart1_ref_clk), QDEV_CLOCK_END diff --git a/hw/timer/cmsdk-apb-dualtimer.c b/hw/timer/cmsdk-apb-dualtimer.c index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/cmsdk-apb-dualtimer.c +++ b/hw/timer/cmsdk-apb-dualtimer.c @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_reset(DeviceState *dev) s->timeritop = 0; } -static void cmsdk_apb_dualtimer_clk_update(void *opaque) +static void cmsdk_apb_dualtimer_clk_update(void *opaque, ClockEvent event) { CMSDKAPBDualTimer *s = CMSDK_APB_DUALTIMER(opaque); int i; @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_dualtimer_init(Object *obj) sysbus_init_irq(sbd, &s->timermod[i].timerint); } s->timclk = qdev_init_clock_in(DEVICE(s), "TIMCLK", - cmsdk_apb_dualtimer_clk_update, s); + cmsdk_apb_dualtimer_clk_update, s, + ClockUpdate); } static void cmsdk_apb_dualtimer_realize(DeviceState *dev, Error **errp) diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/cmsdk-apb-timer.c +++ b/hw/timer/cmsdk-apb-timer.c @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_reset(DeviceState *dev) ptimer_transaction_commit(s->timer); } -static void cmsdk_apb_timer_clk_update(void *opaque) +static void cmsdk_apb_timer_clk_update(void *opaque, ClockEvent event) { CMSDKAPBTimer *s = CMSDK_APB_TIMER(opaque); @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_init(Object *obj) sysbus_init_mmio(sbd, &s->iomem); sysbus_init_irq(sbd, &s->timerint); s->pclk = qdev_init_clock_in(DEVICE(s), "pclk", - cmsdk_apb_timer_clk_update, s); + cmsdk_apb_timer_clk_update, s, ClockUpdate); } static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp) diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/npcm7xx_timer.c +++ b/hw/timer/npcm7xx_timer.c @@ -XXX,XX +XXX,XX @@ static void npcm7xx_timer_init(Object *obj) sysbus_init_mmio(sbd, &s->iomem); qdev_init_gpio_out_named(dev, &w->reset_signal, NPCM7XX_WATCHDOG_RESET_GPIO_OUT, 1); - s->clock = qdev_init_clock_in(dev, "clock", NULL, NULL); + s->clock = qdev_init_clock_in(dev, "clock", NULL, NULL, 0); } static const VMStateDescription vmstate_npcm7xx_base_timer = { diff --git a/hw/watchdog/cmsdk-apb-watchdog.c b/hw/watchdog/cmsdk-apb-watchdog.c index XXXXXXX..XXXXXXX 100644 --- a/hw/watchdog/cmsdk-apb-watchdog.c +++ b/hw/watchdog/cmsdk-apb-watchdog.c @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_reset(DeviceState *dev) ptimer_transaction_commit(s->timer); } -static void cmsdk_apb_watchdog_clk_update(void *opaque) +static void cmsdk_apb_watchdog_clk_update(void *opaque, ClockEvent event) { CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque); @@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_watchdog_init(Object *obj) sysbus_init_mmio(sbd, &s->iomem); sysbus_init_irq(sbd, &s->wdogint); s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK", - cmsdk_apb_watchdog_clk_update, s); + cmsdk_apb_watchdog_clk_update, s, + ClockUpdate); s->is_luminary = false; s->id = cmsdk_apb_watchdog_id; diff --git a/target/mips/cpu.c b/target/mips/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/mips/cpu.c +++ b/target/mips/cpu.c @@ -XXX,XX +XXX,XX @@ static void mips_cpu_initfn(Object *obj) MIPSCPUClass *mcc = MIPS_CPU_GET_CLASS(obj); cpu_set_cpustate_pointers(cpu); - cpu->clock = qdev_init_clock_in(DEVICE(obj), "clk-in", NULL, cpu); + cpu->clock = qdev_init_clock_in(DEVICE(obj), "clk-in", NULL, cpu, 0); env->cpu_model = mcc->cpu_def; } -- 2.20.1 Add a new callback event type ClockPreUpdate, which is called on period changes before the period is updated. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Luc Michel <luc@lmichel.fr> Reviewed-by: Hao Wu <wuhaotsh@google.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219144617.4782-3-peter.maydell@linaro.org --- docs/devel/clocks.rst | 9 ++++++++- include/hw/clock.h | 1 + hw/core/clock.c | 3 +++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst index XXXXXXX..XXXXXXX 100644 --- a/docs/devel/clocks.rst +++ b/docs/devel/clocks.rst @@ -XXX,XX +XXX,XX @@ events. The events currently supported are: - * ``ClockUpdate`` : called after the input clock's period has changed + * ``ClockPreUpdate`` : called when the input clock's period is about to + update. This is useful if the device needs to do some action for + which it needs to know the old value of the clock period. During + this callback, Clock API functions like ``clock_get()`` or + ``clock_ticks_to_ns()`` will use the old period. + * ``ClockUpdate`` : called after the input clock's period has changed. + During this callback, Clock API functions like ``clock_ticks_to_ns()`` + will use the new period. Note that a clock only has one callback: it is not possible to register different functions for different events. You must register a single diff --git a/include/hw/clock.h b/include/hw/clock.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/clock.h +++ b/include/hw/clock.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(Clock, CLOCK) */ typedef enum ClockEvent { ClockUpdate = 1, /* Clock period has just updated */ + ClockPreUpdate = 2, /* Clock period is about to update */ } ClockEvent; typedef void ClockCallback(void *opaque, ClockEvent event); diff --git a/hw/core/clock.c b/hw/core/clock.c index XXXXXXX..XXXXXXX 100644 --- a/hw/core/clock.c +++ b/hw/core/clock.c @@ -XXX,XX +XXX,XX @@ static void clock_propagate_period(Clock *clk, bool call_callbacks) QLIST_FOREACH(child, &clk->children, sibling) { if (child->period != clk->period) { + if (call_callbacks) { + clock_call_callback(child, ClockPreUpdate); + } child->period = clk->period; trace_clock_update(CLOCK_PATH(child), CLOCK_PATH(clk), CLOCK_PERIOD_TO_HZ(clk->period), -- 2.20.1 Add a clock_ns_to_ticks() function which does the opposite of clock_ticks_to_ns(): given a duration in nanoseconds, it returns the number of clock ticks that would happen in that time. This is useful for devices that have a free running counter register whose value can be calculated when it is read. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Luc Michel <luc@lmichel.fr> Reviewed-by: Hao Wu <wuhaotsh@google.com> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219144617.4782-4-peter.maydell@linaro.org --- docs/devel/clocks.rst | 12 ++++++++++++ include/hw/clock.h | 41 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/docs/devel/clocks.rst b/docs/devel/clocks.rst index XXXXXXX..XXXXXXX 100644 --- a/docs/devel/clocks.rst +++ b/docs/devel/clocks.rst @@ -XXX,XX +XXX,XX @@ rather than simply passing it to a QEMUTimer function like ``timer_mod_ns()`` then you should be careful to avoid overflow in those calculations, of course.) +Obtaining tick counts +--------------------- + +For calculations where you need to know the number of ticks in +a given duration, use ``clock_ns_to_ticks()``. This function handles +possible non-whole-number-of-nanoseconds periods and avoids +potential rounding errors. It will return '0' if the clock is stopped +(i.e. it has period zero). If the inputs imply a tick count that +overflows a 64-bit value (a very long duration for a clock with a +very short period) the output value is truncated, so effectively +the 64-bit output wraps around. + Changing a clock period ----------------------- diff --git a/include/hw/clock.h b/include/hw/clock.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/clock.h +++ b/include/hw/clock.h @@ -XXX,XX +XXX,XX @@ static inline uint64_t clock_ticks_to_ns(const Clock *clk, uint64_t ticks) return ns_low >> 32 | ns_high << 32; } +/** + * clock_ns_to_ticks: + * @clk: the clock to query + * @ns: duration in nanoseconds + * + * Returns the number of ticks this clock would make in the given + * number of nanoseconds. Because a clock can have a period which + * is not a whole number of nanoseconds, it is important to use this + * function rather than attempting to obtain a "period in nanoseconds" + * value and then dividing the duration by that value. + * + * If the clock is stopped (ie it has period zero), returns 0. + * + * For some inputs the result could overflow a 64-bit value (because + * the clock's period is short and the duration is long). In these + * cases we truncate the result to a 64-bit value. This is on the + * assumption that generally the result is going to be used to report + * a 32-bit or 64-bit guest register value, so wrapping either cannot + * happen or is the desired behaviour. + */ +static inline uint64_t clock_ns_to_ticks(const Clock *clk, uint64_t ns) +{ + /* + * ticks = duration_in_ns / period_in_ns + * = ns / (period / 2^32) + * = (ns * 2^32) / period + * The hi, lo inputs to divu128() are (ns << 32) as a 128 bit value. + */ + uint64_t lo = ns << 32; + uint64_t hi = ns >> 32; + if (clk->period == 0) { + return 0; + } + /* + * Ignore divu128() return value as we've caught div-by-zero and don't + * need different behaviour for overflow. + */ + divu128(&lo, &hi, clk->period); + return lo; +} + /** * clock_is_enabled: * @clk: a clock -- 2.20.1 Use the new clock_ns_to_ticks() function in npcm7xx_timer where appropriate. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Luc Michel <luc@lmichel.fr> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Hao Wu <wuhaotsh@google.com> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219144617.4782-5-peter.maydell@linaro.org --- hw/timer/npcm7xx_timer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/timer/npcm7xx_timer.c b/hw/timer/npcm7xx_timer.c index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/npcm7xx_timer.c +++ b/hw/timer/npcm7xx_timer.c @@ -XXX,XX +XXX,XX @@ static int64_t npcm7xx_timer_count_to_ns(NPCM7xxTimer *t, uint32_t count) /* Convert a time interval in nanoseconds to a timer cycle count. */ static uint32_t npcm7xx_timer_ns_to_count(NPCM7xxTimer *t, int64_t ns) { - return ns / clock_ticks_to_ns(t->ctrl->clock, - npcm7xx_tcsr_prescaler(t->tcsr)); + return clock_ns_to_ticks(t->ctrl->clock, ns) / + npcm7xx_tcsr_prescaler(t->tcsr); } static uint32_t npcm7xx_watchdog_timer_prescaler(const NPCM7xxWatchdogTimer *t) -- 2.20.1 We model Arm "Subsystems for Embedded" SoC subsystems using generic code which is split into various sub-devices which are configurable by QOM properties to handle the behaviour differences between the SSE subsystems we implement. Currently the only sub-device which needs to change is the IOTKIT_SYSCTL device, and we do this with a mix of properties that directly specify divergent behaviours (eg CPUWAIT_RST) and passing it the SYS_VERSION register value as a way for it to distinguish IoTKit from SSE-200. The "pass SYS_VERSION" approach is already a bit hacky, since the IOTKIT_SYSCTL device has to know that the different part of the register value happens to be bits [31:28]. For SSE-300 this register is renamed SOC_IDENTITY and has a different format entirely, all of whose fields can be configured by the SoC integrator when they integrate the SSE into their SoC, and so "pass SYS_VERSION" breaks down completely. Switch to using a simple integer property representing an internal-to-QEMU enumeration of the SSE flavour. For the moment we only need this in IOTKIT_SYSCTL, but as we add SSE-300 support a few of the other devices will also need to know. We define and permit a value for the SSE-300 so we can start using it in subsequent commits which add SSE-300 support. The now-redundant is_sse200 flag in IoTKitSysCtl will be removed in the following commit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-6-peter.maydell@linaro.org --- include/hw/arm/armsse-version.h | 42 +++++++++++++++++++++++++++++++++ include/hw/misc/iotkit-sysctl.h | 7 +++--- hw/arm/armsse.c | 8 +++++-- hw/misc/iotkit-sysctl.c | 11 +++++---- 4 files changed, 58 insertions(+), 10 deletions(-) create mode 100644 include/hw/arm/armsse-version.h diff --git a/include/hw/arm/armsse-version.h b/include/hw/arm/armsse-version.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/include/hw/arm/armsse-version.h @@ -XXX,XX +XXX,XX @@ +/* + * ARM SSE (Subsystems for Embedded): IoTKit, SSE-200 + * + * Copyright (c) 2020 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +#ifndef ARMSSE_VERSION_H +#define ARMSSE_VERSION_H + + +/* + * Define an enumeration of the possible values of the sse-version + * property implemented by various sub-devices of the SSE, and + * a validation function that checks that a valid value has been passed. + * These are arbitrary QEMU-internal values (nobody should be creating + * the sub-devices of the SSE except for the SSE object itself), but + * we pick obvious numbers for the benefit of people debugging with gdb. + */ +enum { + ARMSSE_IOTKIT = 0, + ARMSSE_SSE200 = 200, + ARMSSE_SSE300 = 300, +}; + +static inline bool armsse_version_valid(uint32_t sse_version) +{ + switch (sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + case ARMSSE_SSE300: + return true; + default: + return false; + } +} + +#endif diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-sysctl.h +++ b/include/hw/misc/iotkit-sysctl.h @@ -XXX,XX +XXX,XX @@ * "system control register" blocks. * * QEMU interface: - * + QOM property "SYS_VERSION": value of the SYS_VERSION register of the - * system information block of the SSE - * (used to identify whether to provide SSE-200-only registers) + * + QOM property "sse-version": indicates which SSE version this is part of + * (used to identify whether to provide SSE-200-only registers, etc) * + sysbus MMIO region 0: the system information register bank * + sysbus MMIO region 1: the system control register bank */ @@ -XXX,XX +XXX,XX @@ struct IoTKitSysCtl { uint32_t pdcm_pd_sram3_sense; /* Properties */ - uint32_t sys_version; + uint32_t sse_version; uint32_t cpuwait_rst; uint32_t initsvtor0_rst; uint32_t initsvtor1_rst; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ #include "migration/vmstate.h" #include "hw/registerfields.h" #include "hw/arm/armsse.h" +#include "hw/arm/armsse-version.h" #include "hw/arm/boot.h" #include "hw/irq.h" #include "hw/qdev-clock.h" @@ -XXX,XX +XXX,XX @@ typedef enum SysConfigFormat { struct ARMSSEInfo { const char *name; + uint32_t sse_version; int sram_banks; int num_cpus; uint32_t sys_version; @@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = { static const ARMSSEInfo armsse_variants[] = { { .name = TYPE_IOTKIT, + .sse_version = ARMSSE_IOTKIT, .sram_banks = 1, .num_cpus = 1, .sys_version = 0x41743, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { }, { .name = TYPE_SSE200, + .sse_version = ARMSSE_SSE200, .sram_banks = 4, .num_cpus = 2, .sys_version = 0x22041743, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) /* System information registers */ sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysinfo), 0, 0x40020000); /* System control registers */ - object_property_set_int(OBJECT(&s->sysctl), "SYS_VERSION", - info->sys_version, &error_abort); + object_property_set_int(OBJECT(&s->sysctl), "sse-version", + info->sse_version, &error_abort); object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST", info->cpuwait_rst, &error_abort); object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST", diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ #include "hw/registerfields.h" #include "hw/misc/iotkit-sysctl.h" #include "hw/qdev-properties.h" +#include "hw/arm/armsse-version.h" #include "target/arm/arm-powerctl.h" #include "target/arm/cpu.h" @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_realize(DeviceState *dev, Error **errp) { IoTKitSysCtl *s = IOTKIT_SYSCTL(dev); - /* The top 4 bits of the SYS_VERSION register tell us if we're an SSE-200 */ - if (extract32(s->sys_version, 28, 4) == 2) { - s->is_sse200 = true; + if (!armsse_version_valid(s->sse_version)) { + error_setg(errp, "invalid sse-version value %d", s->sse_version); + return; } + + s->is_sse200 = s->sse_version == ARMSSE_SSE200; } static bool sse200_needed(void *opaque) @@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = { }; static Property iotkit_sysctl_props[] = { - DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysCtl, sys_version, 0), + DEFINE_PROP_UINT32("sse-version", IoTKitSysCtl, sse_version, 0), DEFINE_PROP_UINT32("CPUWAIT_RST", IoTKitSysCtl, cpuwait_rst, 0), DEFINE_PROP_UINT32("INITSVTOR0_RST", IoTKitSysCtl, initsvtor0_rst, 0x10000000), -- 2.20.1 Remove the is_sse200 flag in favour of just directly testing the new sse_version field. Since some of these registers exist in the SSE-300 but some do not or have different behaviour, we expand out the if() statements in the read and write functions into switch()es, so we have an easy place to put SSE-300 specific behaviour. (Until we do add the SSE-300 behaviour, the thing preventing us reaching the "unreachable" default cases is that armsse.c doesn't yet pass us an ARMSSE_SSE300 version.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-7-peter.maydell@linaro.org --- include/hw/misc/iotkit-sysctl.h | 2 - hw/misc/iotkit-sysctl.c | 256 +++++++++++++++++++++++--------- 2 files changed, 187 insertions(+), 71 deletions(-) diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-sysctl.h +++ b/include/hw/misc/iotkit-sysctl.h @@ -XXX,XX +XXX,XX @@ struct IoTKitSysCtl { uint32_t cpuwait_rst; uint32_t initsvtor0_rst; uint32_t initsvtor1_rst; - - bool is_sse200; }; #endif diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, r = s->secure_debug; break; case A_SCSECCTRL: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->scsecctrl; + break; + default: + g_assert_not_reached(); } - r = s->scsecctrl; break; case A_FCLK_DIV: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->fclk_div; + break; + default: + g_assert_not_reached(); } - r = s->fclk_div; break; case A_SYSCLK_DIV: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->sysclk_div; + break; + default: + g_assert_not_reached(); } - r = s->sysclk_div; break; case A_CLOCK_FORCE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->clock_force; + break; + default: + g_assert_not_reached(); } - r = s->clock_force; break; case A_RESET_SYNDROME: r = s->reset_syndrome; @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, r = s->initsvtor0; break; case A_INITSVTOR1: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->initsvtor1; + break; + default: + g_assert_not_reached(); } - r = s->initsvtor1; break; case A_CPUWAIT: r = s->cpuwait; break; case A_NMI_ENABLE: - /* In IoTKit this is named BUSWAIT but is marked reserved, R/O, zero */ - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: + /* In IoTKit this is named BUSWAIT but marked reserved, R/O, zero */ r = 0; break; + case ARMSSE_SSE200: + r = s->nmi_enable; + break; + default: + g_assert_not_reached(); } - r = s->nmi_enable; break; case A_WICCTRL: r = s->wicctrl; break; case A_EWCTRL: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->ewctrl; + break; + default: + g_assert_not_reached(); } - r = s->ewctrl; break; case A_PDCM_PD_SYS_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->pdcm_pd_sys_sense; + break; + default: + g_assert_not_reached(); } - r = s->pdcm_pd_sys_sense; break; case A_PDCM_PD_SRAM0_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->pdcm_pd_sram0_sense; + break; + default: + g_assert_not_reached(); } - r = s->pdcm_pd_sram0_sense; break; case A_PDCM_PD_SRAM1_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->pdcm_pd_sram1_sense; + break; + default: + g_assert_not_reached(); } - r = s->pdcm_pd_sram1_sense; break; case A_PDCM_PD_SRAM2_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->pdcm_pd_sram2_sense; + break; + default: + g_assert_not_reached(); } - r = s->pdcm_pd_sram2_sense; break; case A_PDCM_PD_SRAM3_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + r = s->pdcm_pd_sram3_sense; + break; + default: + g_assert_not_reached(); } - r = s->pdcm_pd_sram3_sense; break; case A_PID4 ... A_CID3: r = sysctl_id[(offset - A_PID4) / 4]; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, } break; case A_SCSECCTRL: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SCSECCTRL unimplemented\n"); + s->scsecctrl = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SCSECCTRL unimplemented\n"); - s->scsecctrl = value; break; case A_FCLK_DIV: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl FCLK_DIV unimplemented\n"); + s->fclk_div = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl FCLK_DIV unimplemented\n"); - s->fclk_div = value; break; case A_SYSCLK_DIV: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SYSCLK_DIV unimplemented\n"); + s->sysclk_div = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SYSCLK_DIV unimplemented\n"); - s->sysclk_div = value; break; case A_CLOCK_FORCE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CLOCK_FORCE unimplemented\n"); + s->clock_force = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CLOCK_FORCE unimplemented\n"); - s->clock_force = value; break; case A_INITSVTOR1: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + s->initsvtor1 = value; + set_init_vtor(1, s->initsvtor1); + break; + default: + g_assert_not_reached(); } - s->initsvtor1 = value; - set_init_vtor(1, s->initsvtor1); break; case A_EWCTRL: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl EWCTRL unimplemented\n"); + s->ewctrl = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl EWCTRL unimplemented\n"); - s->ewctrl = value; break; case A_PDCM_PD_SYS_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_SYS_SENSE unimplemented\n"); + s->pdcm_pd_sys_sense = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, - "IoTKit SysCtl PDCM_PD_SYS_SENSE unimplemented\n"); - s->pdcm_pd_sys_sense = value; break; case A_PDCM_PD_SRAM0_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_SRAM0_SENSE unimplemented\n"); + s->pdcm_pd_sram0_sense = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, - "IoTKit SysCtl PDCM_PD_SRAM0_SENSE unimplemented\n"); - s->pdcm_pd_sram0_sense = value; break; case A_PDCM_PD_SRAM1_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_SRAM1_SENSE unimplemented\n"); + s->pdcm_pd_sram1_sense = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, - "IoTKit SysCtl PDCM_PD_SRAM1_SENSE unimplemented\n"); - s->pdcm_pd_sram1_sense = value; break; case A_PDCM_PD_SRAM2_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_SRAM2_SENSE unimplemented\n"); + s->pdcm_pd_sram2_sense = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, - "IoTKit SysCtl PDCM_PD_SRAM2_SENSE unimplemented\n"); - s->pdcm_pd_sram2_sense = value; break; case A_PDCM_PD_SRAM3_SENSE: - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto bad_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_SRAM3_SENSE unimplemented\n"); + s->pdcm_pd_sram3_sense = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, - "IoTKit SysCtl PDCM_PD_SRAM3_SENSE unimplemented\n"); - s->pdcm_pd_sram3_sense = value; break; case A_NMI_ENABLE: /* In IoTKit this is BUSWAIT: reserved, R/O, zero */ - if (!s->is_sse200) { + switch (s->sse_version) { + case ARMSSE_IOTKIT: goto ro_offset; + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n"); + s->nmi_enable = value; + break; + default: + g_assert_not_reached(); } - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n"); - s->nmi_enable = value; break; case A_SECDBGSTAT: case A_PID4 ... A_CID3: @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_realize(DeviceState *dev, Error **errp) error_setg(errp, "invalid sse-version value %d", s->sse_version); return; } - - s->is_sse200 = s->sse_version == ARMSSE_SSE200; } static bool sse200_needed(void *opaque) { IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque); - return s->is_sse200; + return s->sse_version == ARMSSE_SSE200; } static const VMStateDescription iotkit_sysctl_sse200_vmstate = { -- 2.20.1 The versions of the Secure Access Configuration Register Block and Non-secure Access Configuration Register Block in the SSE-300 are the same as those in the SSE-200, but the CIDR/PIDR ID register values are different. Plumb through the sse-version property and use it to select the correct ID register values. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-8-peter.maydell@linaro.org --- include/hw/misc/iotkit-secctl.h | 2 ++ hw/arm/armsse.c | 2 ++ hw/misc/iotkit-secctl.c | 50 +++++++++++++++++++++++++++++++-- 3 files changed, 52 insertions(+), 2 deletions(-) diff --git a/include/hw/misc/iotkit-secctl.h b/include/hw/misc/iotkit-secctl.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-secctl.h +++ b/include/hw/misc/iotkit-secctl.h @@ -XXX,XX +XXX,XX @@ struct IoTKitSecCtl { IoTKitSecCtlPPC apb[IOTS_NUM_APB_PPC]; IoTKitSecCtlPPC apbexp[IOTS_NUM_APB_EXP_PPC]; IoTKitSecCtlPPC ahbexp[IOTS_NUM_APB_EXP_PPC]; + + uint32_t sse_version; }; #endif diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } /* Security controller */ + object_property_set_int(OBJECT(&s->secctl), "sse-version", + info->sse_version, &error_abort); if (!sysbus_realize(SYS_BUS_DEVICE(&s->secctl), errp)) { return; } diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-secctl.c +++ b/hw/misc/iotkit-secctl.c @@ -XXX,XX +XXX,XX @@ #include "hw/registerfields.h" #include "hw/irq.h" #include "hw/misc/iotkit-secctl.h" +#include "hw/arm/armsse-version.h" +#include "hw/qdev-properties.h" /* Registers in the secure privilege control block */ REG32(SECRESPCFG, 0x10) @@ -XXX,XX +XXX,XX @@ static const uint8_t iotkit_secctl_ns_idregs[] = { 0x0d, 0xf0, 0x05, 0xb1, }; +static const uint8_t iotkit_secctl_s_sse300_idregs[] = { + 0x04, 0x00, 0x00, 0x00, + 0x52, 0xb8, 0x2b, 0x00, + 0x0d, 0xf0, 0x05, 0xb1, +}; + +static const uint8_t iotkit_secctl_ns_sse300_idregs[] = { + 0x04, 0x00, 0x00, 0x00, + 0x53, 0xb8, 0x2b, 0x00, + 0x0d, 0xf0, 0x05, 0xb1, +}; + + /* The register sets for the various PPCs (AHB internal, APB internal, * AHB expansion, APB expansion) are all set up so that they are * in 16-aligned blocks so offsets 0xN0, 0xN4, 0xN8, 0xNC are PPCs @@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr, case A_CID1: case A_CID2: case A_CID3: - r = iotkit_secctl_s_idregs[(offset - A_PID4) / 4]; + switch (s->sse_version) { + case ARMSSE_SSE300: + r = iotkit_secctl_s_sse300_idregs[(offset - A_PID4) / 4]; + break; + default: + r = iotkit_secctl_s_idregs[(offset - A_PID4) / 4]; + break; + } break; case A_SECPPCINTCLR: case A_SECMSCINTCLR: @@ -XXX,XX +XXX,XX @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr, case A_CID1: case A_CID2: case A_CID3: - r = iotkit_secctl_ns_idregs[(offset - A_PID4) / 4]; + switch (s->sse_version) { + case ARMSSE_SSE300: + r = iotkit_secctl_ns_sse300_idregs[(offset - A_PID4) / 4]; + break; + default: + r = iotkit_secctl_ns_idregs[(offset - A_PID4) / 4]; + break; + } break; default: qemu_log_mask(LOG_GUEST_ERROR, @@ -XXX,XX +XXX,XX @@ static void iotkit_secctl_init(Object *obj) sysbus_init_mmio(sbd, &s->ns_regs); } +static void iotkit_secctl_realize(DeviceState *dev, Error **errp) +{ + IoTKitSecCtl *s = IOTKIT_SECCTL(dev); + + if (!armsse_version_valid(s->sse_version)) { + error_setg(errp, "invalid sse-version value %d", s->sse_version); + return; + } +} + static const VMStateDescription iotkit_secctl_ppc_vmstate = { .name = "iotkit-secctl-ppc", .version_id = 1, @@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_secctl_vmstate = { }, }; +static Property iotkit_secctl_props[] = { + DEFINE_PROP_UINT32("sse-version", IoTKitSecCtl, sse_version, 0), + DEFINE_PROP_END_OF_LIST() +}; + static void iotkit_secctl_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); dc->vmsd = &iotkit_secctl_vmstate; dc->reset = iotkit_secctl_reset; + dc->realize = iotkit_secctl_realize; + device_class_set_props(dc, iotkit_secctl_props); } static const TypeInfo iotkit_secctl_info = { -- 2.20.1 The version of the SYSINFO Register Block in the SSE-300 has different CIDR/PIDR register values to the SSE-200; pass in the sse-version property and use it to select the correct ID register values. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-9-peter.maydell@linaro.org --- include/hw/misc/iotkit-sysinfo.h | 1 + hw/arm/armsse.c | 2 ++ hw/misc/iotkit-sysinfo.c | 29 +++++++++++++++++++++++++++-- 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/include/hw/misc/iotkit-sysinfo.h b/include/hw/misc/iotkit-sysinfo.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-sysinfo.h +++ b/include/hw/misc/iotkit-sysinfo.h @@ -XXX,XX +XXX,XX @@ struct IoTKitSysInfo { /* Properties */ uint32_t sys_version; uint32_t sys_config; + uint32_t sse_version; }; #endif diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) armsse_sys_config_value(s, info), errp)) { return; } + object_property_set_int(OBJECT(&s->sysinfo), "sse-version", + info->sse_version, &error_abort); if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysinfo), errp)) { return; } diff --git a/hw/misc/iotkit-sysinfo.c b/hw/misc/iotkit-sysinfo.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysinfo.c +++ b/hw/misc/iotkit-sysinfo.c @@ -XXX,XX +XXX,XX @@ #include "hw/registerfields.h" #include "hw/misc/iotkit-sysinfo.h" #include "hw/qdev-properties.h" +#include "hw/arm/armsse-version.h" REG32(SYS_VERSION, 0x0) REG32(SYS_CONFIG, 0x4) @@ -XXX,XX +XXX,XX @@ static const int sysinfo_id[] = { 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ }; +static const int sysinfo_sse300_id[] = { + 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ + 0x58, 0xb8, 0x1b, 0x00, /* PID0..PID3 */ + 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ +}; + static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset, unsigned size) { @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset, r = s->sys_config; break; case A_PID4 ... A_CID3: - r = sysinfo_id[(offset - A_PID4) / 4]; + switch (s->sse_version) { + case ARMSSE_SSE300: + r = sysinfo_sse300_id[(offset - A_PID4) / 4]; + break; + default: + r = sysinfo_id[(offset - A_PID4) / 4]; + break; + } break; default: qemu_log_mask(LOG_GUEST_ERROR, @@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps iotkit_sysinfo_ops = { static Property iotkit_sysinfo_props[] = { DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysInfo, sys_version, 0), DEFINE_PROP_UINT32("SYS_CONFIG", IoTKitSysInfo, sys_config, 0), + DEFINE_PROP_UINT32("sse-version", IoTKitSysInfo, sse_version, 0), DEFINE_PROP_END_OF_LIST() }; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysinfo_init(Object *obj) sysbus_init_mmio(sbd, &s->iomem); } +static void iotkit_sysinfo_realize(DeviceState *dev, Error **errp) +{ + IoTKitSysInfo *s = IOTKIT_SYSINFO(dev); + + if (!armsse_version_valid(s->sse_version)) { + error_setg(errp, "invalid sse-version value %d", s->sse_version); + return; + } +} + static void iotkit_sysinfo_class_init(ObjectClass *klass, void *data) { DeviceClass *dc = DEVICE_CLASS(klass); @@ -XXX,XX +XXX,XX @@ static void iotkit_sysinfo_class_init(ObjectClass *klass, void *data) * This device has no guest-modifiable state and so it * does not need a reset function or VMState. */ - + dc->realize = iotkit_sysinfo_realize; device_class_set_props(dc, iotkit_sysinfo_props); } -- 2.20.1 In the SSE-300, the format of the SYS_CONFIG0 register has changed again; pass through the correct value to the SYSINFO register block device. We drop the old SysConfigFormat enum, which was implemented in the hope that different flavours of SSE would share the same format; since they all seem to be different and we now have an sse_version enum to key off, just use that. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-10-peter.maydell@linaro.org --- hw/arm/armsse.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ #include "hw/irq.h" #include "hw/qdev-clock.h" -/* Format of the System Information block SYS_CONFIG register */ -typedef enum SysConfigFormat { - IoTKitFormat, - SSE200Format, -} SysConfigFormat; - struct ARMSSEInfo { const char *name; uint32_t sse_version; @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { int num_cpus; uint32_t sys_version; uint32_t cpuwait_rst; - SysConfigFormat sys_config_format; bool has_mhus; bool has_ppus; bool has_cachectrl; @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .num_cpus = 1, .sys_version = 0x41743, .cpuwait_rst = 0, - .sys_config_format = IoTKitFormat, .has_mhus = false, .has_ppus = false, .has_cachectrl = false, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .num_cpus = 2, .sys_version = 0x22041743, .cpuwait_rst = 2, - .sys_config_format = SSE200Format, .has_mhus = true, .has_ppus = true, .has_cachectrl = true, @@ -XXX,XX +XXX,XX @@ static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) /* Return the SYS_CONFIG value for this SSE */ uint32_t sys_config; - switch (info->sys_config_format) { - case IoTKitFormat: + switch (info->sse_version) { + case ARMSSE_IOTKIT: sys_config = 0; sys_config = deposit32(sys_config, 0, 4, info->sram_banks); sys_config = deposit32(sys_config, 4, 4, s->sram_addr_width - 12); break; - case SSE200Format: + case ARMSSE_SSE200: sys_config = 0; sys_config = deposit32(sys_config, 0, 4, info->sram_banks); sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); @@ -XXX,XX +XXX,XX @@ static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) sys_config = deposit32(sys_config, 28, 4, 2); } break; + case ARMSSE_SSE300: + sys_config = 0; + sys_config = deposit32(sys_config, 0, 4, info->sram_banks); + sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width); + sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */ + break; default: g_assert_not_reached(); } -- 2.20.1 For SSE-300, the SYSINFO register block has two new registers: * SYS_CONFIG1 indicates the config for a potential CPU2 and CPU3; since the SSE-300 can only be configured with a single CPU it is always zero * IIDR is the subsystem implementation identity register; its value is set by the SoC integrator, so we plumb this in from the armsse.c code as we do with SYS_VERSION and SYS_CONFIG Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-11-peter.maydell@linaro.org --- include/hw/misc/iotkit-sysinfo.h | 1 + hw/arm/armsse.c | 5 +++++ hw/misc/iotkit-sysinfo.c | 22 ++++++++++++++++++++++ 3 files changed, 28 insertions(+) diff --git a/include/hw/misc/iotkit-sysinfo.h b/include/hw/misc/iotkit-sysinfo.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-sysinfo.h +++ b/include/hw/misc/iotkit-sysinfo.h @@ -XXX,XX +XXX,XX @@ struct IoTKitSysInfo { uint32_t sys_version; uint32_t sys_config; uint32_t sse_version; + uint32_t iidr; }; #endif diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { int sram_banks; int num_cpus; uint32_t sys_version; + uint32_t iidr; uint32_t cpuwait_rst; bool has_mhus; bool has_ppus; @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .sram_banks = 1, .num_cpus = 1, .sys_version = 0x41743, + .iidr = 0, .cpuwait_rst = 0, .has_mhus = false, .has_ppus = false, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .sram_banks = 4, .num_cpus = 2, .sys_version = 0x22041743, + .iidr = 0, .cpuwait_rst = 2, .has_mhus = true, .has_ppus = true, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } object_property_set_int(OBJECT(&s->sysinfo), "sse-version", info->sse_version, &error_abort); + object_property_set_int(OBJECT(&s->sysinfo), "IIDR", + info->iidr, &error_abort); if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysinfo), errp)) { return; } diff --git a/hw/misc/iotkit-sysinfo.c b/hw/misc/iotkit-sysinfo.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysinfo.c +++ b/hw/misc/iotkit-sysinfo.c @@ -XXX,XX +XXX,XX @@ REG32(SYS_VERSION, 0x0) REG32(SYS_CONFIG, 0x4) +REG32(SYS_CONFIG1, 0x8) +REG32(IIDR, 0xfc8) REG32(PID4, 0xfd0) REG32(PID5, 0xfd4) REG32(PID6, 0xfd8) @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset, case A_SYS_CONFIG: r = s->sys_config; break; + case A_SYS_CONFIG1: + switch (s->sse_version) { + case ARMSSE_SSE300: + return 0; + break; + default: + goto bad_read; + } + break; + case A_IIDR: + switch (s->sse_version) { + case ARMSSE_SSE300: + return s->iidr; + break; + default: + goto bad_read; + } + break; case A_PID4 ... A_CID3: switch (s->sse_version) { case ARMSSE_SSE300: @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset, } break; default: + bad_read: qemu_log_mask(LOG_GUEST_ERROR, "IoTKit SysInfo read: bad offset %x\n", (int)offset); r = 0; @@ -XXX,XX +XXX,XX @@ static Property iotkit_sysinfo_props[] = { DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysInfo, sys_version, 0), DEFINE_PROP_UINT32("SYS_CONFIG", IoTKitSysInfo, sys_config, 0), DEFINE_PROP_UINT32("sse-version", IoTKitSysInfo, sse_version, 0), + DEFINE_PROP_UINT32("IIDR", IoTKitSysInfo, iidr, 0), DEFINE_PROP_END_OF_LIST() }; -- 2.20.1 The SSE-300 includes a counter module; implement a model of it. This counter is documented in the SSE-123 Example Subsystem Technical Reference Manual: https://developer.arm.com/documentation/101370/latest/ Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-12-peter.maydell@linaro.org --- include/hw/timer/sse-counter.h | 105 ++++++++ hw/timer/sse-counter.c | 474 +++++++++++++++++++++++++++++++++ MAINTAINERS | 2 + hw/arm/Kconfig | 1 + hw/timer/Kconfig | 3 + hw/timer/meson.build | 1 + hw/timer/trace-events | 7 + 7 files changed, 593 insertions(+) create mode 100644 include/hw/timer/sse-counter.h create mode 100644 hw/timer/sse-counter.c diff --git a/include/hw/timer/sse-counter.h b/include/hw/timer/sse-counter.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/include/hw/timer/sse-counter.h @@ -XXX,XX +XXX,XX @@ +/* + * Arm SSE Subsystem System Counter + * + * Copyright (c) 2020 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +/* + * This is a model of the "System counter" which is documented in + * the Arm SSE-123 Example Subsystem Technical Reference Manual: + * https://developer.arm.com/documentation/101370/latest/ + * + * QEMU interface: + * + Clock input "CLK": clock + * + sysbus MMIO region 0: the control register frame + * + sysbus MMIO region 1: the status register frame + * + * Consumers of the system counter's timestamp, such as the SSE + * System Timer device, can also use the APIs sse_counter_for_timestamp(), + * sse_counter_tick_to_time() and sse_counter_register_consumer() to + * interact with an instance of the System Counter. Generally the + * consumer device should have a QOM link property which the board + * code can set to the appropriate instance of the system counter. + */ + +#ifndef SSE_COUNTER_H +#define SSE_COUNTER_H + +#include "hw/sysbus.h" +#include "qom/object.h" +#include "qemu/notify.h" + +#define TYPE_SSE_COUNTER "sse-counter" +OBJECT_DECLARE_SIMPLE_TYPE(SSECounter, SSE_COUNTER) + +struct SSECounter { + /*< private >*/ + SysBusDevice parent_obj; + + /*< public >*/ + MemoryRegion control_mr; + MemoryRegion status_mr; + Clock *clk; + NotifierList notifier_list; + + uint32_t cntcr; + uint32_t cntscr0; + + /* + * These are used for handling clock frequency changes: they are a + * tuple of (QEMU_CLOCK_VIRTUAL timestamp, CNTCV at that time), + * taken when the clock frequency changes. sse_cntcv() needs them + * to calculate the current CNTCV. + */ + uint64_t ns_then; + uint64_t ticks_then; +}; + +/* + * These functions are the interface by which a consumer of + * the system timestamp (such as the SSE system timer device) + * can communicate with the SSECounter. + */ + +/** + * sse_counter_for_timestamp: + * @counter: SSECounter + * @ns: timestamp of QEMU_CLOCK_VIRTUAL in nanoseconds + * + * Returns the value of the timestamp counter at the specified + * point in time (assuming that no changes to scale factor, enable, etc + * happen in the meantime). + */ +uint64_t sse_counter_for_timestamp(SSECounter *counter, uint64_t ns); + +/** + * sse_counter_tick_to_time: + * @counter: SSECounter + * @tick: tick value + * + * Returns the time (a QEMU_CLOCK_VIRTUAL timestamp in nanoseconds) + * when the timestamp counter will reach the specified tick count. + * If the counter is not currently running, returns UINT64_MAX. + */ +uint64_t sse_counter_tick_to_time(SSECounter *counter, uint64_t tick); + +/** + * sse_counter_register_consumer: + * @counter: SSECounter + * @notifier: Notifier which is notified on counter changes + * + * Registers @notifier with the SSECounter. When the counter's + * configuration changes in a way that might invalidate information + * previously returned via sse_counter_for_timestamp() or + * sse_counter_tick_to_time(), the notifier will be called. + * Devices which consume the timestamp counter can use this as + * a cue to recalculate timer events. + */ +void sse_counter_register_consumer(SSECounter *counter, Notifier *notifier); + +#endif diff --git a/hw/timer/sse-counter.c b/hw/timer/sse-counter.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/hw/timer/sse-counter.c @@ -XXX,XX +XXX,XX @@ +/* + * Arm SSE Subsystem System Counter + * + * Copyright (c) 2020 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +/* + * This is a model of the "System counter" which is documented in + * the Arm SSE-123 Example Subsystem Technical Reference Manual: + * https://developer.arm.com/documentation/101370/latest/ + * + * The system counter is a non-stop 64-bit up-counter. It provides + * this count value to other devices like the SSE system timer, + * which are driven by this system timestamp rather than directly + * from a clock. Internally to the counter the count is actually + * 88-bit precision (64.24 fixed point), with a programmable scale factor. + * + * The hardware has the optional feature that it supports dynamic + * clock switching, where two clock inputs are connected, and which + * one is used is selected via a CLKSEL input signal. Since the + * users of this device in QEMU don't use this feature, we only model + * the HWCLKSW=0 configuration. + */ +#include "qemu/osdep.h" +#include "qemu/log.h" +#include "qemu/timer.h" +#include "qapi/error.h" +#include "trace.h" +#include "hw/timer/sse-counter.h" +#include "hw/sysbus.h" +#include "hw/irq.h" +#include "hw/registerfields.h" +#include "hw/clock.h" +#include "hw/qdev-clock.h" +#include "migration/vmstate.h" + +/* Registers in the control frame */ +REG32(CNTCR, 0x0) + FIELD(CNTCR, EN, 0, 1) + FIELD(CNTCR, HDBG, 1, 1) + FIELD(CNTCR, SCEN, 2, 1) + FIELD(CNTCR, INTRMASK, 3, 1) + FIELD(CNTCR, PSLVERRDIS, 4, 1) + FIELD(CNTCR, INTRCLR, 5, 1) +/* + * Although CNTCR defines interrupt-related bits, the counter doesn't + * appear to actually have an interrupt output. So INTRCLR is + * effectively a RAZ/WI bit, as are the reserved bits [31:6]. + */ +#define CNTCR_VALID_MASK (R_CNTCR_EN_MASK | R_CNTCR_HDBG_MASK | \ + R_CNTCR_SCEN_MASK | R_CNTCR_INTRMASK_MASK | \ + R_CNTCR_PSLVERRDIS_MASK) +REG32(CNTSR, 0x4) +REG32(CNTCV_LO, 0x8) +REG32(CNTCV_HI, 0xc) +REG32(CNTSCR, 0x10) /* Aliased with CNTSCR0 */ +REG32(CNTID, 0x1c) + FIELD(CNTID, CNTSC, 0, 4) + FIELD(CNTID, CNTCS, 16, 1) + FIELD(CNTID, CNTSELCLK, 17, 2) + FIELD(CNTID, CNTSCR_OVR, 19, 1) +REG32(CNTSCR0, 0xd0) +REG32(CNTSCR1, 0xd4) + +/* Registers in the status frame */ +REG32(STATUS_CNTCV_LO, 0x0) +REG32(STATUS_CNTCV_HI, 0x4) + +/* Standard ID registers, present in both frames */ +REG32(PID4, 0xFD0) +REG32(PID5, 0xFD4) +REG32(PID6, 0xFD8) +REG32(PID7, 0xFDC) +REG32(PID0, 0xFE0) +REG32(PID1, 0xFE4) +REG32(PID2, 0xFE8) +REG32(PID3, 0xFEC) +REG32(CID0, 0xFF0) +REG32(CID1, 0xFF4) +REG32(CID2, 0xFF8) +REG32(CID3, 0xFFC) + +/* PID/CID values */ +static const int control_id[] = { + 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ + 0xba, 0xb0, 0x0b, 0x00, /* PID0..PID3 */ + 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ +}; + +static const int status_id[] = { + 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ + 0xbb, 0xb0, 0x0b, 0x00, /* PID0..PID3 */ + 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ +}; + +static void sse_counter_notify_users(SSECounter *s) +{ + /* + * Notify users of the count timestamp that they may + * need to recalculate. + */ + notifier_list_notify(&s->notifier_list, NULL); +} + +static bool sse_counter_enabled(SSECounter *s) +{ + return (s->cntcr & R_CNTCR_EN_MASK) != 0; +} + +uint64_t sse_counter_tick_to_time(SSECounter *s, uint64_t tick) +{ + if (!sse_counter_enabled(s)) { + return UINT64_MAX; + } + + tick -= s->ticks_then; + + if (s->cntcr & R_CNTCR_SCEN_MASK) { + /* Adjust the tick count to account for the scale factor */ + tick = muldiv64(tick, 0x01000000, s->cntscr0); + } + + return s->ns_then + clock_ticks_to_ns(s->clk, tick); +} + +void sse_counter_register_consumer(SSECounter *s, Notifier *notifier) +{ + /* + * For the moment we assume that both we and the devices + * which consume us last for the life of the simulation, + * and so there is no mechanism for removing a notifier. + */ + notifier_list_add(&s->notifier_list, notifier); +} + +uint64_t sse_counter_for_timestamp(SSECounter *s, uint64_t now) +{ + /* Return the CNTCV value for a particular timestamp (clock ns value). */ + uint64_t ticks; + + if (!sse_counter_enabled(s)) { + /* Counter is disabled and does not increment */ + return s->ticks_then; + } + + ticks = clock_ns_to_ticks(s->clk, now - s->ns_then); + if (s->cntcr & R_CNTCR_SCEN_MASK) { + /* + * Scaling is enabled. The CNTSCR value is the amount added to + * the underlying 88-bit counter for every tick of the + * underlying clock; CNTCV is the top 64 bits of that full + * 88-bit value. Multiplying the tick count by CNTSCR tells us + * how much the full 88-bit counter has moved on; we then + * divide that by 0x01000000 to find out how much the 64-bit + * visible portion has advanced. muldiv64() gives us the + * necessary at-least-88-bit precision for the intermediate + * result. + */ + ticks = muldiv64(ticks, s->cntscr0, 0x01000000); + } + return s->ticks_then + ticks; +} + +static uint64_t sse_cntcv(SSECounter *s) +{ + /* Return the CNTCV value for the current time */ + return sse_counter_for_timestamp(s, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)); +} + +static void sse_write_cntcv(SSECounter *s, uint32_t value, unsigned startbit) +{ + /* + * Write one 32-bit half of the counter value; startbit is the + * bit position of this half in the 64-bit word, either 0 or 32. + */ + uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); + uint64_t cntcv = sse_counter_for_timestamp(s, now); + + cntcv = deposit64(cntcv, startbit, 32, value); + s->ticks_then = cntcv; + s->ns_then = now; + sse_counter_notify_users(s); +} + +static uint64_t sse_counter_control_read(void *opaque, hwaddr offset, + unsigned size) +{ + SSECounter *s = SSE_COUNTER(opaque); + uint64_t r; + + switch (offset) { + case A_CNTCR: + r = s->cntcr; + break; + case A_CNTSR: + /* + * The only bit here is DBGH, indicating that the counter has been + * halted via the Halt-on-Debug signal. We don't implement halting + * debug, so the whole register always reads as zero. + */ + r = 0; + break; + case A_CNTCV_LO: + r = extract64(sse_cntcv(s), 0, 32); + break; + case A_CNTCV_HI: + r = extract64(sse_cntcv(s), 32, 32); + break; + case A_CNTID: + /* + * For our implementation: + * - CNTSCR can only be written when CNTCR.EN == 0 + * - HWCLKSW=0, so selected clock is always CLK0 + * - counter scaling is implemented + */ + r = (1 << R_CNTID_CNTSELCLK_SHIFT) | (1 << R_CNTID_CNTSC_SHIFT); + break; + case A_CNTSCR: + case A_CNTSCR0: + r = s->cntscr0; + break; + case A_CNTSCR1: + /* If HWCLKSW == 0, CNTSCR1 is RAZ/WI */ + r = 0; + break; + case A_PID4 ... A_CID3: + r = control_id[(offset - A_PID4) / 4]; + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Counter control frame read: bad offset 0x%x", + (unsigned)offset); + r = 0; + break; + } + + trace_sse_counter_control_read(offset, r, size); + return r; +} + +static void sse_counter_control_write(void *opaque, hwaddr offset, + uint64_t value, unsigned size) +{ + SSECounter *s = SSE_COUNTER(opaque); + + trace_sse_counter_control_write(offset, value, size); + + switch (offset) { + case A_CNTCR: + /* + * Although CNTCR defines interrupt-related bits, the counter doesn't + * appear to actually have an interrupt output. So INTRCLR is + * effectively a RAZ/WI bit, as are the reserved bits [31:6]. + * The documentation does not explicitly say so, but we assume + * that changing the scale factor while the counter is enabled + * by toggling CNTCR.SCEN has the same behaviour (making the counter + * value UNKNOWN) as changing it by writing to CNTSCR, and so we + * don't need to try to recalculate for that case. + */ + value &= CNTCR_VALID_MASK; + if ((value ^ s->cntcr) & R_CNTCR_EN_MASK) { + /* + * Whether the counter is being enabled or disabled, the + * required action is the same: sync the (ns_then, ticks_then) + * tuple. + */ + uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); + s->ticks_then = sse_counter_for_timestamp(s, now); + s->ns_then = now; + sse_counter_notify_users(s); + } + s->cntcr = value; + break; + case A_CNTCV_LO: + sse_write_cntcv(s, value, 0); + break; + case A_CNTCV_HI: + sse_write_cntcv(s, value, 32); + break; + case A_CNTSCR: + case A_CNTSCR0: + /* + * If the scale registers are changed when the counter is enabled, + * the count value becomes UNKNOWN. So we don't try to recalculate + * anything here but only do it on a write to CNTCR.EN. + */ + s->cntscr0 = value; + break; + case A_CNTSCR1: + /* If HWCLKSW == 0, CNTSCR1 is RAZ/WI */ + break; + case A_CNTSR: + case A_CNTID: + case A_PID4 ... A_CID3: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Counter control frame: write to RO offset 0x%x\n", + (unsigned)offset); + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Counter control frame: write to bad offset 0x%x\n", + (unsigned)offset); + break; + } +} + +static uint64_t sse_counter_status_read(void *opaque, hwaddr offset, + unsigned size) +{ + SSECounter *s = SSE_COUNTER(opaque); + uint64_t r; + + switch (offset) { + case A_STATUS_CNTCV_LO: + r = extract64(sse_cntcv(s), 0, 32); + break; + case A_STATUS_CNTCV_HI: + r = extract64(sse_cntcv(s), 32, 32); + break; + case A_PID4 ... A_CID3: + r = status_id[(offset - A_PID4) / 4]; + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Counter status frame read: bad offset 0x%x", + (unsigned)offset); + r = 0; + break; + } + + trace_sse_counter_status_read(offset, r, size); + return r; +} + +static void sse_counter_status_write(void *opaque, hwaddr offset, + uint64_t value, unsigned size) +{ + trace_sse_counter_status_write(offset, value, size); + + switch (offset) { + case A_STATUS_CNTCV_LO: + case A_STATUS_CNTCV_HI: + case A_PID4 ... A_CID3: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Counter status frame: write to RO offset 0x%x\n", + (unsigned)offset); + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Counter status frame: write to bad offset 0x%x\n", + (unsigned)offset); + break; + } +} + +static const MemoryRegionOps sse_counter_control_ops = { + .read = sse_counter_control_read, + .write = sse_counter_control_write, + .endianness = DEVICE_LITTLE_ENDIAN, + .valid.min_access_size = 4, + .valid.max_access_size = 4, +}; + +static const MemoryRegionOps sse_counter_status_ops = { + .read = sse_counter_status_read, + .write = sse_counter_status_write, + .endianness = DEVICE_LITTLE_ENDIAN, + .valid.min_access_size = 4, + .valid.max_access_size = 4, +}; + +static void sse_counter_reset(DeviceState *dev) +{ + SSECounter *s = SSE_COUNTER(dev); + + trace_sse_counter_reset(); + + s->cntcr = 0; + s->cntscr0 = 0x01000000; + s->ns_then = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); + s->ticks_then = 0; +} + +static void sse_clk_callback(void *opaque, ClockEvent event) +{ + SSECounter *s = SSE_COUNTER(opaque); + uint64_t now; + + switch (event) { + case ClockPreUpdate: + /* + * Before the clock period updates, set (ticks_then, ns_then) + * to the current time and tick count (as calculated with + * the old clock period). + */ + if (sse_counter_enabled(s)) { + now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); + s->ticks_then = sse_counter_for_timestamp(s, now); + s->ns_then = now; + } + break; + case ClockUpdate: + sse_counter_notify_users(s); + break; + default: + break; + } +} + +static void sse_counter_init(Object *obj) +{ + SysBusDevice *sbd = SYS_BUS_DEVICE(obj); + SSECounter *s = SSE_COUNTER(obj); + + notifier_list_init(&s->notifier_list); + + s->clk = qdev_init_clock_in(DEVICE(obj), "CLK", sse_clk_callback, s, + ClockPreUpdate | ClockUpdate); + memory_region_init_io(&s->control_mr, obj, &sse_counter_control_ops, + s, "sse-counter-control", 0x1000); + memory_region_init_io(&s->status_mr, obj, &sse_counter_status_ops, + s, "sse-counter-status", 0x1000); + sysbus_init_mmio(sbd, &s->control_mr); + sysbus_init_mmio(sbd, &s->status_mr); +} + +static void sse_counter_realize(DeviceState *dev, Error **errp) +{ + SSECounter *s = SSE_COUNTER(dev); + + if (!clock_has_source(s->clk)) { + error_setg(errp, "SSE system counter: CLK must be connected"); + return; + } +} + +static const VMStateDescription sse_counter_vmstate = { + .name = "sse-counter", + .version_id = 1, + .minimum_version_id = 1, + .fields = (VMStateField[]) { + VMSTATE_CLOCK(clk, SSECounter), + VMSTATE_END_OF_LIST() + } +}; + +static void sse_counter_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + + dc->realize = sse_counter_realize; + dc->vmsd = &sse_counter_vmstate; + dc->reset = sse_counter_reset; +} + +static const TypeInfo sse_counter_info = { + .name = TYPE_SSE_COUNTER, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(SSECounter), + .instance_init = sse_counter_init, + .class_init = sse_counter_class_init, +}; + +static void sse_counter_register_types(void) +{ + type_register_static(&sse_counter_info); +} + +type_init(sse_counter_register_types); diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: hw/misc/armsse-cpuid.c F: include/hw/misc/armsse-cpuid.h F: hw/misc/armsse-mhu.c F: include/hw/misc/armsse-mhu.h +F: hw/timer/sse-counter.c +F: include/hw/timer/sse-counter.h F: docs/system/arm/mps2.rst Musca diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config ARMSSE select TZ_MSC select TZ_PPC select UNIMP + select SSE_COUNTER config ARMSSE_CPUID bool diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/Kconfig +++ b/hw/timer/Kconfig @@ -XXX,XX +XXX,XX @@ config RENESAS_TMR config RENESAS_CMT bool +config SSE_COUNTER + bool + config AVR_TIMER16 bool diff --git a/hw/timer/meson.build b/hw/timer/meson.build index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/meson.build +++ b/hw/timer/meson.build @@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_timer.c')) softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_systmr.c')) softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_timer.c')) softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_timer.c')) +softmmu_ss.add(when: 'CONFIG_SSE_COUNTER', if_true: files('sse-counter.c')) softmmu_ss.add(when: 'CONFIG_STM32F2XX_TIMER', if_true: files('stm32f2xx_timer.c')) softmmu_ss.add(when: 'CONFIG_XILINX', if_true: files('xilinx_timer.c')) diff --git a/hw/timer/trace-events b/hw/timer/trace-events index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/trace-events +++ b/hw/timer/trace-events @@ -XXX,XX +XXX,XX @@ avr_timer16_interrupt_count(uint8_t cnt) "count: %u" avr_timer16_interrupt_overflow(const char *reason) "overflow: %s" avr_timer16_next_alarm(uint64_t delay_ns) "next alarm: %" PRIu64 " ns from now" avr_timer16_clksrc_update(uint64_t freq_hz, uint64_t period_ns, uint64_t delay_s) "timer frequency: %" PRIu64 " Hz, period: %" PRIu64 " ns (%" PRId64 " us)" + +# sse_counter.c +sse_counter_control_read(uint64_t offset, uint64_t data, unsigned size) "SSE system counter control frame read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +sse_counter_control_write(uint64_t offset, uint64_t data, unsigned size) "SSE system counter control framen write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +sse_counter_status_read(uint64_t offset, uint64_t data, unsigned size) "SSE system counter status frame read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +sse_counter_status_write(uint64_t offset, uint64_t data, unsigned size) "SSE system counter status frame write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +sse_counter_reset(void) "SSE system counter: reset" -- 2.20.1 The SSE-300 includes some timers which are a different kind to those in the SSE-200. Model them. These timers are documented in the SSE-123 Example Subsystem Technical Reference Manual: https://developer.arm.com/documentation/101370/latest/ Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-13-peter.maydell@linaro.org --- include/hw/timer/sse-timer.h | 53 ++++ hw/timer/sse-timer.c | 470 +++++++++++++++++++++++++++++++++++ MAINTAINERS | 2 + hw/arm/Kconfig | 1 + hw/timer/Kconfig | 3 + hw/timer/meson.build | 1 + hw/timer/trace-events | 5 + 7 files changed, 535 insertions(+) create mode 100644 include/hw/timer/sse-timer.h create mode 100644 hw/timer/sse-timer.c diff --git a/include/hw/timer/sse-timer.h b/include/hw/timer/sse-timer.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/include/hw/timer/sse-timer.h @@ -XXX,XX +XXX,XX @@ +/* + * Arm SSE Subsystem System Timer + * + * Copyright (c) 2020 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +/* + * This is a model of the "System timer" which is documented in + * the Arm SSE-123 Example Subsystem Technical Reference Manual: + * https://developer.arm.com/documentation/101370/latest/ + * + * QEMU interface: + * + QOM property "counter": link property to be set to the + * TYPE_SSE_COUNTER timestamp counter device this timer runs off + * + sysbus MMIO region 0: the register bank + * + sysbus IRQ 0: timer interrupt + */ + +#ifndef SSE_TIMER_H +#define SSE_TIMER_H + +#include "hw/sysbus.h" +#include "qom/object.h" +#include "hw/timer/sse-counter.h" + +#define TYPE_SSE_TIMER "sse-timer" +OBJECT_DECLARE_SIMPLE_TYPE(SSETimer, SSE_TIMER) + +struct SSETimer { + /*< private >*/ + SysBusDevice parent_obj; + + /*< public >*/ + MemoryRegion iomem; + qemu_irq irq; + SSECounter *counter; + QEMUTimer timer; + Notifier counter_notifier; + + uint32_t cntfrq; + uint32_t cntp_ctl; + uint64_t cntp_cval; + uint64_t cntp_aival; + uint32_t cntp_aival_ctl; + uint32_t cntp_aival_reload; +}; + +#endif diff --git a/hw/timer/sse-timer.c b/hw/timer/sse-timer.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/hw/timer/sse-timer.c @@ -XXX,XX +XXX,XX @@ +/* + * Arm SSE Subsystem System Timer + * + * Copyright (c) 2020 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +/* + * This is a model of the "System timer" which is documented in + * the Arm SSE-123 Example Subsystem Technical Reference Manual: + * https://developer.arm.com/documentation/101370/latest/ + * + * The timer is based around a simple 64-bit incrementing counter + * (readable from CNTPCT_HI/LO). The timer fires when + * Counter - CompareValue >= 0. + * The CompareValue is guest-writable, via CNTP_CVAL_HI/LO. + * CNTP_TVAL is an alternative view of the CompareValue defined by + * TimerValue = CompareValue[31:0] - Counter[31:0] + * which can be both read and written. + * This part is similar to the generic timer in an Arm A-class CPU. + * + * The timer also has a separate auto-increment timer. When this + * timer is enabled, then the AutoIncrValue is set to: + * AutoIncrValue = Reload + Counter + * and this timer fires when + * Counter - AutoIncrValue >= 0 + * at which point, an interrupt is generated and the new AutoIncrValue + * is calculated. + * When the auto-increment timer is enabled, interrupt generation + * via the compare/timervalue registers is disabled. + */ +#include "qemu/osdep.h" +#include "qemu/log.h" +#include "qemu/timer.h" +#include "qapi/error.h" +#include "trace.h" +#include "hw/timer/sse-timer.h" +#include "hw/timer/sse-counter.h" +#include "hw/sysbus.h" +#include "hw/irq.h" +#include "hw/registerfields.h" +#include "hw/clock.h" +#include "hw/qdev-clock.h" +#include "hw/qdev-properties.h" +#include "migration/vmstate.h" + +REG32(CNTPCT_LO, 0x0) +REG32(CNTPCT_HI, 0x4) +REG32(CNTFRQ, 0x10) +REG32(CNTP_CVAL_LO, 0x20) +REG32(CNTP_CVAL_HI, 0x24) +REG32(CNTP_TVAL, 0x28) +REG32(CNTP_CTL, 0x2c) + FIELD(CNTP_CTL, ENABLE, 0, 1) + FIELD(CNTP_CTL, IMASK, 1, 1) + FIELD(CNTP_CTL, ISTATUS, 2, 1) +REG32(CNTP_AIVAL_LO, 0x40) +REG32(CNTP_AIVAL_HI, 0x44) +REG32(CNTP_AIVAL_RELOAD, 0x48) +REG32(CNTP_AIVAL_CTL, 0x4c) + FIELD(CNTP_AIVAL_CTL, EN, 0, 1) + FIELD(CNTP_AIVAL_CTL, CLR, 1, 1) +REG32(CNTP_CFG, 0x50) + FIELD(CNTP_CFG, AIVAL, 0, 4) +#define R_CNTP_CFG_AIVAL_IMPLEMENTED 1 +REG32(PID4, 0xFD0) +REG32(PID5, 0xFD4) +REG32(PID6, 0xFD8) +REG32(PID7, 0xFDC) +REG32(PID0, 0xFE0) +REG32(PID1, 0xFE4) +REG32(PID2, 0xFE8) +REG32(PID3, 0xFEC) +REG32(CID0, 0xFF0) +REG32(CID1, 0xFF4) +REG32(CID2, 0xFF8) +REG32(CID3, 0xFFC) + +/* PID/CID values */ +static const int timer_id[] = { + 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ + 0xb7, 0xb0, 0x0b, 0x00, /* PID0..PID3 */ + 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ +}; + +static bool sse_is_autoinc(SSETimer *s) +{ + return (s->cntp_aival_ctl & R_CNTP_AIVAL_CTL_EN_MASK) != 0; +} + +static bool sse_enabled(SSETimer *s) +{ + return (s->cntp_ctl & R_CNTP_CTL_ENABLE_MASK) != 0; +} + +static uint64_t sse_cntpct(SSETimer *s) +{ + /* Return the CNTPCT value for the current time */ + return sse_counter_for_timestamp(s->counter, + qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)); +} + +static bool sse_timer_status(SSETimer *s) +{ + /* + * Return true if timer condition is met. This is used for both + * the CNTP_CTL.ISTATUS bit and for whether (unless masked) we + * assert our IRQ. + * The documentation is unclear about the behaviour of ISTATUS when + * in autoincrement mode; we assume that it follows CNTP_AIVAL_CTL.CLR + * (ie whether the autoincrement timer is asserting the interrupt). + */ + if (!sse_enabled(s)) { + return false; + } + + if (sse_is_autoinc(s)) { + return s->cntp_aival_ctl & R_CNTP_AIVAL_CTL_CLR_MASK; + } else { + return sse_cntpct(s) >= s->cntp_cval; + } +} + +static void sse_update_irq(SSETimer *s) +{ + bool irqstate = (!(s->cntp_ctl & R_CNTP_CTL_IMASK_MASK) && + sse_timer_status(s)); + + qemu_set_irq(s->irq, irqstate); +} + +static void sse_set_timer(SSETimer *s, uint64_t nexttick) +{ + /* Set the timer to expire at nexttick */ + uint64_t expiry = sse_counter_tick_to_time(s->counter, nexttick); + + if (expiry <= INT64_MAX) { + timer_mod_ns(&s->timer, expiry); + } else { + /* + * nexttick is so far in the future that it would overflow the + * signed 64-bit range of a QEMUTimer. Since timer_mod_ns() + * expiry times are absolute, not relative, we are never going + * to be able to set the timer to this value, so we must just + * assume that guest execution can never run so long that it + * reaches the theoretical point when the timer fires. + * This is also the code path for "counter is not running", + * which is signalled by expiry == UINT64_MAX. + */ + timer_del(&s->timer); + } +} + +static void sse_recalc_timer(SSETimer *s) +{ + /* Recalculate the normal timer */ + uint64_t count, nexttick; + + if (sse_is_autoinc(s)) { + return; + } + + if (!sse_enabled(s)) { + timer_del(&s->timer); + return; + } + + count = sse_cntpct(s); + + if (count >= s->cntp_cval) { + /* + * Timer condition already met. In theory we have a transition when + * the count rolls back over to 0, but that is so far in the future + * that it is not representable as a timer_mod() expiry, so in + * fact sse_set_timer() will always just delete the timer. + */ + nexttick = UINT64_MAX; + } else { + /* Next transition is when count hits cval */ + nexttick = s->cntp_cval; + } + sse_set_timer(s, nexttick); + sse_update_irq(s); +} + +static void sse_autoinc(SSETimer *s) +{ + /* Auto-increment the AIVAL, and set the timer accordingly */ + s->cntp_aival = sse_cntpct(s) + s->cntp_aival_reload; + sse_set_timer(s, s->cntp_aival); +} + +static void sse_timer_cb(void *opaque) +{ + SSETimer *s = SSE_TIMER(opaque); + + if (sse_is_autoinc(s)) { + uint64_t count = sse_cntpct(s); + + if (count >= s->cntp_aival) { + /* Timer condition met, set CLR and do another autoinc */ + s->cntp_aival_ctl |= R_CNTP_AIVAL_CTL_CLR_MASK; + s->cntp_aival = count + s->cntp_aival_reload; + } + sse_set_timer(s, s->cntp_aival); + sse_update_irq(s); + } else { + sse_recalc_timer(s); + } +} + +static uint64_t sse_timer_read(void *opaque, hwaddr offset, unsigned size) +{ + SSETimer *s = SSE_TIMER(opaque); + uint64_t r; + + switch (offset) { + case A_CNTPCT_LO: + r = extract64(sse_cntpct(s), 0, 32); + break; + case A_CNTPCT_HI: + r = extract64(sse_cntpct(s), 32, 32); + break; + case A_CNTFRQ: + r = s->cntfrq; + break; + case A_CNTP_CVAL_LO: + r = extract64(s->cntp_cval, 0, 32); + break; + case A_CNTP_CVAL_HI: + r = extract64(s->cntp_cval, 32, 32); + break; + case A_CNTP_TVAL: + r = extract64(s->cntp_cval - sse_cntpct(s), 0, 32); + break; + case A_CNTP_CTL: + r = s->cntp_ctl; + if (sse_timer_status(s)) { + r |= R_CNTP_CTL_ISTATUS_MASK; + } + break; + case A_CNTP_AIVAL_LO: + r = extract64(s->cntp_aival, 0, 32); + break; + case A_CNTP_AIVAL_HI: + r = extract64(s->cntp_aival, 32, 32); + break; + case A_CNTP_AIVAL_RELOAD: + r = s->cntp_aival_reload; + break; + case A_CNTP_AIVAL_CTL: + /* + * All the bits of AIVAL_CTL are documented as WO, but this is probably + * a documentation error. We implement them as readable. + */ + r = s->cntp_aival_ctl; + break; + case A_CNTP_CFG: + r = R_CNTP_CFG_AIVAL_IMPLEMENTED << R_CNTP_CFG_AIVAL_SHIFT; + break; + case A_PID4 ... A_CID3: + r = timer_id[(offset - A_PID4) / 4]; + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Timer read: bad offset 0x%x", + (unsigned) offset); + r = 0; + break; + } + + trace_sse_timer_read(offset, r, size); + return r; +} + +static void sse_timer_write(void *opaque, hwaddr offset, uint64_t value, + unsigned size) +{ + SSETimer *s = SSE_TIMER(opaque); + + trace_sse_timer_write(offset, value, size); + + switch (offset) { + case A_CNTFRQ: + s->cntfrq = value; + break; + case A_CNTP_CVAL_LO: + s->cntp_cval = deposit64(s->cntp_cval, 0, 32, value); + sse_recalc_timer(s); + break; + case A_CNTP_CVAL_HI: + s->cntp_cval = deposit64(s->cntp_cval, 32, 32, value); + sse_recalc_timer(s); + break; + case A_CNTP_TVAL: + s->cntp_cval = sse_cntpct(s) + sextract64(value, 0, 32); + sse_recalc_timer(s); + break; + case A_CNTP_CTL: + { + uint32_t old_ctl = s->cntp_ctl; + value &= R_CNTP_CTL_ENABLE_MASK | R_CNTP_CTL_IMASK_MASK; + s->cntp_ctl = value; + if ((old_ctl ^ s->cntp_ctl) & R_CNTP_CTL_ENABLE_MASK) { + if (sse_enabled(s)) { + if (sse_is_autoinc(s)) { + sse_autoinc(s); + } else { + sse_recalc_timer(s); + } + } + } + sse_update_irq(s); + break; + } + case A_CNTP_AIVAL_RELOAD: + s->cntp_aival_reload = value; + break; + case A_CNTP_AIVAL_CTL: + { + uint32_t old_ctl = s->cntp_aival_ctl; + + /* EN bit is writeable; CLR bit is write-0-to-clear, write-1-ignored */ + s->cntp_aival_ctl &= ~R_CNTP_AIVAL_CTL_EN_MASK; + s->cntp_aival_ctl |= value & R_CNTP_AIVAL_CTL_EN_MASK; + if (!(value & R_CNTP_AIVAL_CTL_CLR_MASK)) { + s->cntp_aival_ctl &= ~R_CNTP_AIVAL_CTL_CLR_MASK; + } + if ((old_ctl ^ s->cntp_aival_ctl) & R_CNTP_AIVAL_CTL_EN_MASK) { + /* Auto-increment toggled on/off */ + if (sse_enabled(s)) { + if (sse_is_autoinc(s)) { + sse_autoinc(s); + } else { + sse_recalc_timer(s); + } + } + } + sse_update_irq(s); + break; + } + case A_CNTPCT_LO: + case A_CNTPCT_HI: + case A_CNTP_CFG: + case A_CNTP_AIVAL_LO: + case A_CNTP_AIVAL_HI: + case A_PID4 ... A_CID3: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Timer write: write to RO offset 0x%x\n", + (unsigned)offset); + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE System Timer write: bad offset 0x%x\n", + (unsigned)offset); + break; + } +} + +static const MemoryRegionOps sse_timer_ops = { + .read = sse_timer_read, + .write = sse_timer_write, + .endianness = DEVICE_LITTLE_ENDIAN, + .valid.min_access_size = 4, + .valid.max_access_size = 4, +}; + +static void sse_timer_reset(DeviceState *dev) +{ + SSETimer *s = SSE_TIMER(dev); + + trace_sse_timer_reset(); + + timer_del(&s->timer); + s->cntfrq = 0; + s->cntp_ctl = 0; + s->cntp_cval = 0; + s->cntp_aival = 0; + s->cntp_aival_ctl = 0; + s->cntp_aival_reload = 0; +} + +static void sse_timer_counter_callback(Notifier *notifier, void *data) +{ + SSETimer *s = container_of(notifier, SSETimer, counter_notifier); + + /* System counter told us we need to recalculate */ + if (sse_enabled(s)) { + if (sse_is_autoinc(s)) { + sse_set_timer(s, s->cntp_aival); + } else { + sse_recalc_timer(s); + } + } +} + +static void sse_timer_init(Object *obj) +{ + SysBusDevice *sbd = SYS_BUS_DEVICE(obj); + SSETimer *s = SSE_TIMER(obj); + + memory_region_init_io(&s->iomem, obj, &sse_timer_ops, + s, "sse-timer", 0x1000); + sysbus_init_mmio(sbd, &s->iomem); + sysbus_init_irq(sbd, &s->irq); +} + +static void sse_timer_realize(DeviceState *dev, Error **errp) +{ + SSETimer *s = SSE_TIMER(dev); + + if (!s->counter) { + error_setg(errp, "counter property was not set"); + } + + s->counter_notifier.notify = sse_timer_counter_callback; + sse_counter_register_consumer(s->counter, &s->counter_notifier); + + timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL, sse_timer_cb, s); +} + +static const VMStateDescription sse_timer_vmstate = { + .name = "sse-timer", + .version_id = 1, + .minimum_version_id = 1, + .fields = (VMStateField[]) { + VMSTATE_TIMER(timer, SSETimer), + VMSTATE_UINT32(cntfrq, SSETimer), + VMSTATE_UINT32(cntp_ctl, SSETimer), + VMSTATE_UINT64(cntp_cval, SSETimer), + VMSTATE_UINT64(cntp_aival, SSETimer), + VMSTATE_UINT32(cntp_aival_ctl, SSETimer), + VMSTATE_UINT32(cntp_aival_reload, SSETimer), + VMSTATE_END_OF_LIST() + } +}; + +static Property sse_timer_properties[] = { + DEFINE_PROP_LINK("counter", SSETimer, counter, TYPE_SSE_COUNTER, SSECounter *), + DEFINE_PROP_END_OF_LIST(), +}; + +static void sse_timer_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + + dc->realize = sse_timer_realize; + dc->vmsd = &sse_timer_vmstate; + dc->reset = sse_timer_reset; + device_class_set_props(dc, sse_timer_properties); +} + +static const TypeInfo sse_timer_info = { + .name = TYPE_SSE_TIMER, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(SSETimer), + .instance_init = sse_timer_init, + .class_init = sse_timer_class_init, +}; + +static void sse_timer_register_types(void) +{ + type_register_static(&sse_timer_info); +} + +type_init(sse_timer_register_types); diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: hw/misc/armsse-mhu.c F: include/hw/misc/armsse-mhu.h F: hw/timer/sse-counter.c F: include/hw/timer/sse-counter.h +F: hw/timer/sse-timer.c +F: include/hw/timer/sse-timer.h F: docs/system/arm/mps2.rst Musca diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config ARMSSE select TZ_PPC select UNIMP select SSE_COUNTER + select SSE_TIMER config ARMSSE_CPUID bool diff --git a/hw/timer/Kconfig b/hw/timer/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/Kconfig +++ b/hw/timer/Kconfig @@ -XXX,XX +XXX,XX @@ config RENESAS_CMT config SSE_COUNTER bool +config SSE_TIMER + bool + config AVR_TIMER16 bool diff --git a/hw/timer/meson.build b/hw/timer/meson.build index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/meson.build +++ b/hw/timer/meson.build @@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_systmr.c')) softmmu_ss.add(when: 'CONFIG_SH4', if_true: files('sh_timer.c')) softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_timer.c')) softmmu_ss.add(when: 'CONFIG_SSE_COUNTER', if_true: files('sse-counter.c')) +softmmu_ss.add(when: 'CONFIG_SSE_TIMER', if_true: files('sse-timer.c')) softmmu_ss.add(when: 'CONFIG_STM32F2XX_TIMER', if_true: files('stm32f2xx_timer.c')) softmmu_ss.add(when: 'CONFIG_XILINX', if_true: files('xilinx_timer.c')) diff --git a/hw/timer/trace-events b/hw/timer/trace-events index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/trace-events +++ b/hw/timer/trace-events @@ -XXX,XX +XXX,XX @@ sse_counter_control_write(uint64_t offset, uint64_t data, unsigned size) "SSE sy sse_counter_status_read(uint64_t offset, uint64_t data, unsigned size) "SSE system counter status frame read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" sse_counter_status_write(uint64_t offset, uint64_t data, unsigned size) "SSE system counter status frame write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" sse_counter_reset(void) "SSE system counter: reset" + +# sse_timer.c +sse_timer_read(uint64_t offset, uint64_t data, unsigned size) "SSE system timer read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +sse_timer_write(uint64_t offset, uint64_t data, unsigned size) "SSE system timer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +sse_timer_reset(void) "SSE system timer: reset" -- 2.20.1 The SSE-300's iokit-sysctl device is similar to the SSE-200, but some registers have moved address or have different behaviours. In this commit we add case statements for the registers where the SSE-300 and SSE-200 have the same behaviour. Some registers are the same on all SSE versions and so need no code change at all. Putting both of these categories together covers: 0x0 SECDBGSTAT 0x4 SECDBGSET 0x8 SECDBGCLR 0xc SCSECCTRL 0x10 CLK_CFG0 -- this is like SSE-200 FCLK_DIV but with a different set of clocks being controlled; our implementation is a dummy reads-as-written anyway 0x14 CLK_CFG1 -- similar to SSE-200 SYSCLK_DIV; our implementation is a dummy 0x18 CLK_FORCE -- similar to SSE-200 but different bit allocations; we have a dummy implementation 0x100 RESET_SYNDROME -- bit allocation differs from SSE-200 but our implementation is a dummy 0x104 RESET_MASK -- bit allocation differs from SSE-200 but our implementation is a dummy 0x108 SWRESET 0x10c GRETREG 0x200 PDCM_PD_SYS_SENSE -- some bit allocations differ, but our implementation is a dummy We also need to migrate the state of these registers which are shared between the SSE-200 and SSE-300, so update the vmstate 'needed' function to do this. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-14-peter.maydell@linaro.org --- hw/misc/iotkit-sysctl.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: r = s->scsecctrl; break; default: @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: r = s->fclk_div; break; default: @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: r = s->sysclk_div; break; default: @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: r = s->clock_force; break; default: @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: r = s->pdcm_pd_sys_sense; break; default: @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SCSECCTRL unimplemented\n"); s->scsecctrl = value; break; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl FCLK_DIV unimplemented\n"); s->fclk_div = value; break; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SYSCLK_DIV unimplemented\n"); s->sysclk_div = value; break; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CLOCK_FORCE unimplemented\n"); s->clock_force = value; break; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, case ARMSSE_IOTKIT: goto bad_offset; case ARMSSE_SSE200: + case ARMSSE_SSE300: qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl PDCM_PD_SYS_SENSE unimplemented\n"); s->pdcm_pd_sys_sense = value; @@ -XXX,XX +XXX,XX @@ static bool sse200_needed(void *opaque) { IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque); - return s->sse_version == ARMSSE_SSE200; + return s->sse_version != ARMSSE_IOTKIT; } static const VMStateDescription iotkit_sysctl_sse200_vmstate = { -- 2.20.1 In the SSE-300 the CPU_WAIT and NMI_ENABLE registers have moved offsets, so they are now where the SSE-200's WICCTRL and EWCTRL were. The SSE-300 does not have WICCTLR or EWCTRL at all, and the old offsets are reserved: Offset SSE-200 SSE-300 ----------------------------------- 0x118 CPUWAIT reserved 0x118 NMI_ENABLE reserved 0x120 WICCTRL CPUWAIT 0x124 EWCTRL NMI_ENABLE Handle this reshuffle, and the fact that SSE-300 has only one CPU and so only one active bit in CPUWAIT. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-15-peter.maydell@linaro.org --- hw/misc/iotkit-sysctl.c | 88 +++++++++++++++++++++++++++++++++++------ 1 file changed, 76 insertions(+), 12 deletions(-) diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, } break; case A_CPUWAIT: - r = s->cpuwait; + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + r = s->cpuwait; + break; + case ARMSSE_SSE300: + /* In SSE300 this is reserved (for INITSVTOR2) */ + goto bad_offset; + default: + g_assert_not_reached(); + } break; case A_NMI_ENABLE: switch (s->sse_version) { @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->nmi_enable; break; + case ARMSSE_SSE300: + /* In SSE300 this is reserved (for INITSVTOR3) */ + goto bad_offset; default: g_assert_not_reached(); } break; case A_WICCTRL: - r = s->wicctrl; + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + r = s->wicctrl; + break; + case ARMSSE_SSE300: + /* In SSE300 this offset is CPUWAIT */ + r = s->cpuwait; + break; + default: + g_assert_not_reached(); + } break; case A_EWCTRL: switch (s->sse_version) { @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->ewctrl; break; + case ARMSSE_SSE300: + /* In SSE300 this offset is is NMI_ENABLE */ + r = s->nmi_enable; + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, return r; } +static void cpuwait_write(IoTKitSysCtl *s, uint32_t value) +{ + int num_cpus = (s->sse_version == ARMSSE_SSE300) ? 1 : 2; + int i; + + for (i = 0; i < num_cpus; i++) { + uint32_t mask = 1 << i; + if ((s->cpuwait & mask) && !(value & mask)) { + /* Powering up CPU 0 */ + arm_set_cpu_on_and_reset(i); + } + } + s->cpuwait = value; +} + static void iotkit_sysctl_write(void *opaque, hwaddr offset, uint64_t value, unsigned size) { @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, set_init_vtor(0, s->initsvtor0); break; case A_CPUWAIT: - if ((s->cpuwait & 1) && !(value & 1)) { - /* Powering up CPU 0 */ - arm_set_cpu_on_and_reset(0); + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + cpuwait_write(s, value); + break; + case ARMSSE_SSE300: + /* In SSE300 this is reserved (for INITSVTOR2) */ + goto bad_offset; + default: + g_assert_not_reached(); } - if ((s->cpuwait & 2) && !(value & 2)) { - /* Powering up CPU 1 */ - arm_set_cpu_on_and_reset(1); - } - s->cpuwait = value; break; case A_WICCTRL: - qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl WICCTRL unimplemented\n"); - s->wicctrl = value; + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl WICCTRL unimplemented\n"); + s->wicctrl = value; + break; + case ARMSSE_SSE300: + /* In SSE300 this offset is CPUWAIT */ + cpuwait_write(s, value); + break; + default: + g_assert_not_reached(); + } break; case A_SECDBGSET: /* write-1-to-set */ @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl EWCTRL unimplemented\n"); s->ewctrl = value; break; + case ARMSSE_SSE300: + /* In SSE300 this offset is is NMI_ENABLE */ + qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n"); + s->nmi_enable = value; + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n"); s->nmi_enable = value; break; + case ARMSSE_SSE300: + /* In SSE300 this is reserved (for INITSVTOR3) */ + goto bad_offset; default: g_assert_not_reached(); } -- 2.20.1 The SSE-300 has only one CPU and so no INITSVTOR1. It does have INITSVTOR0, but unlike the SSE-200 this register now has a LOCK bit which can be set to 1 to prevent any further writes to the register. Implement these differences. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-16-peter.maydell@linaro.org --- hw/misc/iotkit-sysctl.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ REG32(SWRESET, 0x108) FIELD(SWRESET, SWRESETREQ, 9, 1) REG32(GRETREG, 0x10c) REG32(INITSVTOR0, 0x110) + FIELD(INITSVTOR0, LOCK, 0, 1) + FIELD(INITSVTOR0, VTOR, 7, 25) REG32(INITSVTOR1, 0x114) REG32(CPUWAIT, 0x118) REG32(NMI_ENABLE, 0x11c) /* BUSWAIT in IoTKit */ @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->initsvtor1; break; + case ARMSSE_SSE300: + goto bad_offset; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, s->gretreg = value; break; case A_INITSVTOR0: - s->initsvtor0 = value; - set_init_vtor(0, s->initsvtor0); + switch (s->sse_version) { + case ARMSSE_SSE300: + /* SSE300 has a LOCK bit which prevents further writes when set */ + if (s->initsvtor0 & R_INITSVTOR0_LOCK_MASK) { + qemu_log_mask(LOG_GUEST_ERROR, + "IoTKit INITSVTOR0 write when register locked\n"); + break; + } + s->initsvtor0 = value; + set_init_vtor(0, s->initsvtor0 & R_INITSVTOR0_VTOR_MASK); + break; + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + s->initsvtor0 = value; + set_init_vtor(0, s->initsvtor0); + break; + default: + g_assert_not_reached(); + } break; case A_CPUWAIT: switch (s->sse_version) { @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, s->initsvtor1 = value; set_init_vtor(1, s->initsvtor1); break; + case ARMSSE_SSE300: + goto bad_offset; default: g_assert_not_reached(); } -- 2.20.1 The SSE-300 has a new PWRCTRL register at offset 0x1fc (previously reserved). This register controls accessibility of some registers in the Power Policy Units (PPUs). Since QEMU doesn't implement the PPUs, we don't need to implement any real behaviour for this register, so we just handle the UNLOCK bit which controls whether writes to the register itself are permitted and otherwise make it be reads-as-written. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-17-peter.maydell@linaro.org --- include/hw/misc/iotkit-sysctl.h | 1 + hw/misc/iotkit-sysctl.c | 52 +++++++++++++++++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-sysctl.h +++ b/include/hw/misc/iotkit-sysctl.h @@ -XXX,XX +XXX,XX @@ struct IoTKitSysCtl { uint32_t initsvtor1; uint32_t nmi_enable; uint32_t ewctrl; + uint32_t pwrctrl; uint32_t pdcm_pd_sys_sense; uint32_t pdcm_pd_sram0_sense; uint32_t pdcm_pd_sram1_sense; diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ REG32(CPUWAIT, 0x118) REG32(NMI_ENABLE, 0x11c) /* BUSWAIT in IoTKit */ REG32(WICCTRL, 0x120) REG32(EWCTRL, 0x124) +REG32(PWRCTRL, 0x1fc) + FIELD(PWRCTRL, PPU_ACCESS_UNLOCK, 0, 1) + FIELD(PWRCTRL, PPU_ACCESS_FILTER, 1, 1) REG32(PDCM_PD_SYS_SENSE, 0x200) REG32(PDCM_PD_SRAM0_SENSE, 0x20c) REG32(PDCM_PD_SRAM1_SENSE, 0x210) @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, g_assert_not_reached(); } break; + case A_PWRCTRL: + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + goto bad_offset; + case ARMSSE_SSE300: + r = s->pwrctrl; + break; + default: + g_assert_not_reached(); + } + break; case A_PDCM_PD_SYS_SENSE: switch (s->sse_version) { case ARMSSE_IOTKIT: @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, g_assert_not_reached(); } break; + case A_PWRCTRL: + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + goto bad_offset; + case ARMSSE_SSE300: + if (!(s->pwrctrl & R_PWRCTRL_PPU_ACCESS_UNLOCK_MASK)) { + qemu_log_mask(LOG_GUEST_ERROR, + "IoTKit PWRCTRL write when register locked\n"); + break; + } + s->pwrctrl = value; + break; + default: + g_assert_not_reached(); + } + break; case A_PDCM_PD_SYS_SENSE: switch (s->sse_version) { case ARMSSE_IOTKIT: @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev) s->clock_force = 0; s->nmi_enable = 0; s->ewctrl = 0; + s->pwrctrl = 0x3; s->pdcm_pd_sys_sense = 0x7f; s->pdcm_pd_sram0_sense = 0; s->pdcm_pd_sram1_sense = 0; @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_realize(DeviceState *dev, Error **errp) } } +static bool sse300_needed(void *opaque) +{ + IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque); + + return s->sse_version == ARMSSE_SSE300; +} + +static const VMStateDescription iotkit_sysctl_sse300_vmstate = { + .name = "iotkit-sysctl/sse-300", + .version_id = 1, + .minimum_version_id = 1, + .needed = sse300_needed, + .fields = (VMStateField[]) { + VMSTATE_UINT32(pwrctrl, IoTKitSysCtl), + VMSTATE_END_OF_LIST() + } +}; + static bool sse200_needed(void *opaque) { IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque); @@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = { }, .subsections = (const VMStateDescription*[]) { &iotkit_sysctl_sse200_vmstate, + &iotkit_sysctl_sse300_vmstate, NULL } }; -- 2.20.1 The sysctl PDCM_PD_*_SENSE registers control various power domains in the system and allow the guest to configure which conditions keep a power domain awake and what power state to use when the domain is in a low power state. QEMU doesn't model power domains, so for us these registers are dummy reads-as-written implementations. The SSE-300 has a different power domain setup, so the set of registers is slightly different: Offset SSE-200 SSE-300 --------------------------------------------------- 0x200 PDCM_PD_SYS_SENSE PDCM_PD_SYS_SENSE 0x204 reserved PDCM_PD_CPU0_SENSE 0x208 reserved reserved 0x20c PDCM_PD_SRAM0_SENSE reserved 0x210 PDCM_PD_SRAM1_SENSE reserved 0x214 PDCM_PD_SRAM2_SENSE PDCM_PD_VMR0_SENSE 0x218 PDCM_PD_SRAM3_SENSE PDCM_PD_VMR1_SENSE Offsets 0x200 and 0x208 are the same for both, so handled in a previous commit; here we deal with 0x204, 0x20c, 0x210, 0x214, 0x218. (We can safely add new lines to the SSE300 vmstate because no board uses this device in an SSE300 yet.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-18-peter.maydell@linaro.org --- include/hw/misc/iotkit-sysctl.h | 3 ++ hw/misc/iotkit-sysctl.c | 61 +++++++++++++++++++++++++++++++-- 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/iotkit-sysctl.h +++ b/include/hw/misc/iotkit-sysctl.h @@ -XXX,XX +XXX,XX @@ struct IoTKitSysCtl { uint32_t pdcm_pd_sram1_sense; uint32_t pdcm_pd_sram2_sense; uint32_t pdcm_pd_sram3_sense; + uint32_t pdcm_pd_cpu0_sense; + uint32_t pdcm_pd_vmr0_sense; + uint32_t pdcm_pd_vmr1_sense; /* Properties */ uint32_t sse_version; diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ REG32(PWRCTRL, 0x1fc) FIELD(PWRCTRL, PPU_ACCESS_UNLOCK, 0, 1) FIELD(PWRCTRL, PPU_ACCESS_FILTER, 1, 1) REG32(PDCM_PD_SYS_SENSE, 0x200) +REG32(PDCM_PD_CPU0_SENSE, 0x204) REG32(PDCM_PD_SRAM0_SENSE, 0x20c) REG32(PDCM_PD_SRAM1_SENSE, 0x210) -REG32(PDCM_PD_SRAM2_SENSE, 0x214) -REG32(PDCM_PD_SRAM3_SENSE, 0x218) +REG32(PDCM_PD_SRAM2_SENSE, 0x214) /* PDCM_PD_VMR0_SENSE on SSE300 */ +REG32(PDCM_PD_SRAM3_SENSE, 0x218) /* PDCM_PD_VMR1_SENSE on SSE300 */ REG32(PID4, 0xfd0) REG32(PID5, 0xfd4) REG32(PID6, 0xfd8) @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, g_assert_not_reached(); } break; + case A_PDCM_PD_CPU0_SENSE: + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + goto bad_offset; + case ARMSSE_SSE300: + r = s->pdcm_pd_cpu0_sense; + break; + default: + g_assert_not_reached(); + } + break; case A_PDCM_PD_SRAM0_SENSE: switch (s->sse_version) { case ARMSSE_IOTKIT: @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->pdcm_pd_sram0_sense; break; + case ARMSSE_SSE300: + goto bad_offset; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->pdcm_pd_sram1_sense; break; + case ARMSSE_SSE300: + goto bad_offset; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->pdcm_pd_sram2_sense; break; + case ARMSSE_SSE300: + r = s->pdcm_pd_vmr0_sense; + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, case ARMSSE_SSE200: r = s->pdcm_pd_sram3_sense; break; + case ARMSSE_SSE300: + r = s->pdcm_pd_vmr1_sense; + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, g_assert_not_reached(); } break; + case A_PDCM_PD_CPU0_SENSE: + switch (s->sse_version) { + case ARMSSE_IOTKIT: + case ARMSSE_SSE200: + goto bad_offset; + case ARMSSE_SSE300: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_CPU0_SENSE unimplemented\n"); + s->pdcm_pd_cpu0_sense = value; + break; + default: + g_assert_not_reached(); + } + break; case A_PDCM_PD_SRAM0_SENSE: switch (s->sse_version) { case ARMSSE_IOTKIT: @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, "IoTKit SysCtl PDCM_PD_SRAM0_SENSE unimplemented\n"); s->pdcm_pd_sram0_sense = value; break; + case ARMSSE_SSE300: + goto bad_offset; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, "IoTKit SysCtl PDCM_PD_SRAM1_SENSE unimplemented\n"); s->pdcm_pd_sram1_sense = value; break; + case ARMSSE_SSE300: + goto bad_offset; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, "IoTKit SysCtl PDCM_PD_SRAM2_SENSE unimplemented\n"); s->pdcm_pd_sram2_sense = value; break; + case ARMSSE_SSE300: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_VMR0_SENSE unimplemented\n"); + s->pdcm_pd_vmr0_sense = value; + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset, "IoTKit SysCtl PDCM_PD_SRAM3_SENSE unimplemented\n"); s->pdcm_pd_sram3_sense = value; break; + case ARMSSE_SSE300: + qemu_log_mask(LOG_UNIMP, + "IoTKit SysCtl PDCM_PD_VMR1_SENSE unimplemented\n"); + s->pdcm_pd_vmr1_sense = value; + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev) s->pdcm_pd_sram1_sense = 0; s->pdcm_pd_sram2_sense = 0; s->pdcm_pd_sram3_sense = 0; + s->pdcm_pd_cpu0_sense = 0; + s->pdcm_pd_vmr0_sense = 0; + s->pdcm_pd_vmr1_sense = 0; } static void iotkit_sysctl_init(Object *obj) @@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_sse300_vmstate = { .needed = sse300_needed, .fields = (VMStateField[]) { VMSTATE_UINT32(pwrctrl, IoTKitSysCtl), + VMSTATE_UINT32(pdcm_pd_cpu0_sense, IoTKitSysCtl), + VMSTATE_UINT32(pdcm_pd_vmr0_sense, IoTKitSysCtl), + VMSTATE_UINT32(pdcm_pd_vmr1_sense, IoTKitSysCtl), VMSTATE_END_OF_LIST() } }; -- 2.20.1 The SSE-200 and SSE-300 have different PID register values from the IoTKit for the sysctl register block. We incorrectly implemented the SSE-200 with the same PID values as IoTKit. Fix the SSE-200 bug and report these register values for SSE-300. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-19-peter.maydell@linaro.org --- hw/misc/iotkit-sysctl.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/iotkit-sysctl.c +++ b/hw/misc/iotkit-sysctl.c @@ -XXX,XX +XXX,XX @@ REG32(CID2, 0xff8) REG32(CID3, 0xffc) /* PID/CID values */ -static const int sysctl_id[] = { +static const int iotkit_sysctl_id[] = { 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ 0x54, 0xb8, 0x0b, 0x00, /* PID0..PID3 */ 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ }; +/* Also used by the SSE300 */ +static const int sse200_sysctl_id[] = { + 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ + 0x54, 0xb8, 0x1b, 0x00, /* PID0..PID3 */ + 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ +}; + /* * Set the initial secure vector table offset address for the core. * This will take effect when the CPU next resets. @@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset, } break; case A_PID4 ... A_CID3: - r = sysctl_id[(offset - A_PID4) / 4]; + switch (s->sse_version) { + case ARMSSE_IOTKIT: + r = iotkit_sysctl_id[(offset - A_PID4) / 4]; + break; + case ARMSSE_SSE200: + case ARMSSE_SSE300: + r = sse200_sysctl_id[(offset - A_PID4) / 4]; + break; + default: + g_assert_not_reached(); + } break; case A_SECDBGSET: case A_SECDBGCLR: -- 2.20.1 The ARMSSE_CPUID and ARMSSE_MHU Kconfig stanzas are for the devices implemented by hw/misc/cpuid.c and hw/misc/armsse-mhu.c. Move them to hw/misc/Kconfig where they belong. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-20-peter.maydell@linaro.org --- hw/arm/Kconfig | 6 ------ hw/misc/Kconfig | 6 ++++++ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config ARMSSE select UNIMP select SSE_COUNTER select SSE_TIMER - -config ARMSSE_CPUID - bool - -config ARMSSE_MHU - bool diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/Kconfig +++ b/hw/misc/Kconfig @@ -XXX,XX +XXX,XX @@ config APPLESMC bool depends on ISA_BUS +config ARMSSE_CPUID + bool + +config ARMSSE_MHU + bool + config MAX111X bool -- 2.20.1 The SSE-300 has a new register block CPU<N>_PWRCTRL. There is one instance of this per CPU in the system (so just one for the SSE-300), and as well as the usual CIDR/PIDR ID registers it has just one register, CPUPWRCFG. This register allows the guest to configure behaviour of the system in power-down and deep-sleep states. Since QEMU does not model those, we make the register a dummy reads-as-written implementation. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-21-peter.maydell@linaro.org --- include/hw/misc/armsse-cpu-pwrctrl.h | 40 +++++++ hw/misc/armsse-cpu-pwrctrl.c | 149 +++++++++++++++++++++++++++ MAINTAINERS | 2 + hw/arm/Kconfig | 1 + hw/misc/Kconfig | 3 + hw/misc/meson.build | 1 + hw/misc/trace-events | 4 + 7 files changed, 200 insertions(+) create mode 100644 include/hw/misc/armsse-cpu-pwrctrl.h create mode 100644 hw/misc/armsse-cpu-pwrctrl.c diff --git a/include/hw/misc/armsse-cpu-pwrctrl.h b/include/hw/misc/armsse-cpu-pwrctrl.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/include/hw/misc/armsse-cpu-pwrctrl.h @@ -XXX,XX +XXX,XX @@ +/* + * ARM SSE CPU PWRCTRL register block + * + * Copyright (c) 2021 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +/* + * This is a model of the "CPU<N>_PWRCTRL block" which is part of the + * Arm Corstone SSE-300 Example Subsystem and documented in + * https://developer.arm.com/documentation/101773/0000 + * + * QEMU interface: + * + sysbus MMIO region 0: the register bank + */ + +#ifndef HW_MISC_ARMSSE_CPU_PWRCTRL_H +#define HW_MISC_ARMSSE_CPU_PWRCTRL_H + +#include "hw/sysbus.h" +#include "qom/object.h" + +#define TYPE_ARMSSE_CPU_PWRCTRL "armsse-cpu-pwrctrl" +OBJECT_DECLARE_SIMPLE_TYPE(ARMSSECPUPwrCtrl, ARMSSE_CPU_PWRCTRL) + +struct ARMSSECPUPwrCtrl { + /*< private >*/ + SysBusDevice parent_obj; + + /*< public >*/ + MemoryRegion iomem; + + uint32_t cpupwrcfg; +}; + +#endif diff --git a/hw/misc/armsse-cpu-pwrctrl.c b/hw/misc/armsse-cpu-pwrctrl.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/hw/misc/armsse-cpu-pwrctrl.c @@ -XXX,XX +XXX,XX @@ +/* + * Arm SSE CPU PWRCTRL register block + * + * Copyright (c) 2021 Linaro Limited + * Written by Peter Maydell + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 or + * (at your option) any later version. + */ + +/* + * This is a model of the "CPU<N>_PWRCTRL block" which is part of the + * Arm Corstone SSE-300 Example Subsystem and documented in + * https://developer.arm.com/documentation/101773/0000 + */ + +#include "qemu/osdep.h" +#include "qemu/log.h" +#include "qemu/module.h" +#include "trace.h" +#include "qapi/error.h" +#include "migration/vmstate.h" +#include "hw/sysbus.h" +#include "hw/registerfields.h" +#include "hw/misc/armsse-cpu-pwrctrl.h" + +REG32(CPUPWRCFG, 0x0) +REG32(PID4, 0xfd0) +REG32(PID5, 0xfd4) +REG32(PID6, 0xfd8) +REG32(PID7, 0xfdc) +REG32(PID0, 0xfe0) +REG32(PID1, 0xfe4) +REG32(PID2, 0xfe8) +REG32(PID3, 0xfec) +REG32(CID0, 0xff0) +REG32(CID1, 0xff4) +REG32(CID2, 0xff8) +REG32(CID3, 0xffc) + +/* PID/CID values */ +static const int cpu_pwrctrl_id[] = { + 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */ + 0x5a, 0xb8, 0x0b, 0x00, /* PID0..PID3 */ + 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */ +}; + +static uint64_t pwrctrl_read(void *opaque, hwaddr offset, unsigned size) +{ + ARMSSECPUPwrCtrl *s = ARMSSE_CPU_PWRCTRL(opaque); + uint64_t r; + + switch (offset) { + case A_CPUPWRCFG: + r = s->cpupwrcfg; + break; + case A_PID4 ... A_CID3: + r = cpu_pwrctrl_id[(offset - A_PID4) / 4]; + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE CPU_PWRCTRL read: bad offset %x\n", (int)offset); + r = 0; + break; + } + trace_armsse_cpu_pwrctrl_read(offset, r, size); + return r; +} + +static void pwrctrl_write(void *opaque, hwaddr offset, + uint64_t value, unsigned size) +{ + ARMSSECPUPwrCtrl *s = ARMSSE_CPU_PWRCTRL(opaque); + + trace_armsse_cpu_pwrctrl_write(offset, value, size); + + switch (offset) { + case A_CPUPWRCFG: + qemu_log_mask(LOG_UNIMP, + "SSE CPU_PWRCTRL: CPUPWRCFG unimplemented\n"); + s->cpupwrcfg = value; + break; + default: + qemu_log_mask(LOG_GUEST_ERROR, + "SSE CPU_PWRCTRL write: bad offset 0x%x\n", (int)offset); + break; + } +} + +static const MemoryRegionOps pwrctrl_ops = { + .read = pwrctrl_read, + .write = pwrctrl_write, + .endianness = DEVICE_LITTLE_ENDIAN, + .impl.min_access_size = 4, + .impl.max_access_size = 4, + .valid.min_access_size = 4, + .valid.max_access_size = 4, +}; + +static void pwrctrl_reset(DeviceState *dev) +{ + ARMSSECPUPwrCtrl *s = ARMSSE_CPU_PWRCTRL(dev); + + s->cpupwrcfg = 0; +} + +static const VMStateDescription pwrctrl_vmstate = { + .name = "armsse-cpu-pwrctrl", + .version_id = 1, + .minimum_version_id = 1, + .fields = (VMStateField[]) { + VMSTATE_UINT32(cpupwrcfg, ARMSSECPUPwrCtrl), + VMSTATE_END_OF_LIST() + }, +}; + +static void pwrctrl_init(Object *obj) +{ + SysBusDevice *sbd = SYS_BUS_DEVICE(obj); + ARMSSECPUPwrCtrl *s = ARMSSE_CPU_PWRCTRL(obj); + + memory_region_init_io(&s->iomem, obj, &pwrctrl_ops, + s, "armsse-cpu-pwrctrl", 0x1000); + sysbus_init_mmio(sbd, &s->iomem); +} + +static void pwrctrl_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + + dc->reset = pwrctrl_reset; + dc->vmsd = &pwrctrl_vmstate; +} + +static const TypeInfo pwrctrl_info = { + .name = TYPE_ARMSSE_CPU_PWRCTRL, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(ARMSSECPUPwrCtrl), + .instance_init = pwrctrl_init, + .class_init = pwrctrl_class_init, +}; + +static void pwrctrl_register_types(void) +{ + type_register_static(&pwrctrl_info); +} + +type_init(pwrctrl_register_types); diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: hw/misc/iotkit-sysctl.c F: include/hw/misc/iotkit-sysctl.h F: hw/misc/iotkit-sysinfo.c F: include/hw/misc/iotkit-sysinfo.h +F: hw/misc/armsse-cpu-pwrctrl.c +F: include/hw/misc/armsse-cpu-pwrctrl.h F: hw/misc/armsse-cpuid.c F: include/hw/misc/armsse-cpuid.h F: hw/misc/armsse-mhu.c diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config ARM11MPCORE config ARMSSE bool select ARM_V7M + select ARMSSE_CPU_PWRCTRL select ARMSSE_CPUID select ARMSSE_MHU select CMSDK_APB_TIMER diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/Kconfig +++ b/hw/misc/Kconfig @@ -XXX,XX +XXX,XX @@ config ARMSSE_CPUID config ARMSSE_MHU bool +config ARMSSE_CPU_PWRCTRL + bool + config MAX111X bool diff --git a/hw/misc/meson.build b/hw/misc/meson.build index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/meson.build +++ b/hw/misc/meson.build @@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_TZ_MSC', if_true: files('tz-msc.c')) softmmu_ss.add(when: 'CONFIG_TZ_PPC', if_true: files('tz-ppc.c')) softmmu_ss.add(when: 'CONFIG_IOTKIT_SECCTL', if_true: files('iotkit-secctl.c')) softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')) +softmmu_ss.add(when: 'CONFIG_ARMSSE_CPU_PWRCTRL', if_true: files('armsse-cpu-pwrctrl.c')) softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c')) softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c')) diff --git a/hw/misc/trace-events b/hw/misc/trace-events index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/trace-events +++ b/hw/misc/trace-events @@ -XXX,XX +XXX,XX @@ iotkit_sysctl_read(uint64_t offset, uint64_t data, unsigned size) "IoTKit SysCtl iotkit_sysctl_write(uint64_t offset, uint64_t data, unsigned size) "IoTKit SysCtl write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" iotkit_sysctl_reset(void) "IoTKit SysCtl: reset" +# armsse-cpu-pwrctrl.c +armsse_cpu_pwrctrl_read(uint64_t offset, uint64_t data, unsigned size) "SSE-300 CPU_PWRCTRL read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" +armsse_cpu_pwrctrl_write(uint64_t offset, uint64_t data, unsigned size) "SSE-300 CPU_PWRCTRL write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" + # armsse-cpuid.c armsse_cpuid_read(uint64_t offset, uint64_t data, unsigned size) "SSE-200 CPU_IDENTITY read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" armsse_cpuid_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 CPU_IDENTITY write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u" -- 2.20.1 Convert the apb_ppc0 and apb_ppc1 fields in the ARMSSE state struct to use an array instead of two separate fields. We already had one place in the code that wanted to be able to refer to the PPC by index, and we're about to add more code like that. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-22-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 6 +++--- hw/arm/armsse.c | 32 ++++++++++++++++++-------------- 2 files changed, 21 insertions(+), 17 deletions(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(ARMSSE, ARMSSEClass, /* We have an IRQ splitter and an OR gate input for each external PPC * and the 2 internal PPCs */ +#define NUM_INTERNAL_PPCS 2 #define NUM_EXTERNAL_PPCS (IOTS_NUM_AHB_EXP_PPC + IOTS_NUM_APB_EXP_PPC) -#define NUM_PPCS (NUM_EXTERNAL_PPCS + 2) +#define NUM_PPCS (NUM_EXTERNAL_PPCS + NUM_INTERNAL_PPCS) #define MAX_SRAM_BANKS 4 #if MAX_SRAM_BANKS > IOTS_NUM_MPC @@ -XXX,XX +XXX,XX @@ struct ARMSSE { ARMv7MState armv7m[SSE_MAX_CPUS]; CPUClusterState cluster[SSE_MAX_CPUS]; IoTKitSecCtl secctl; - TZPPC apb_ppc0; - TZPPC apb_ppc1; + TZPPC apb_ppc[NUM_INTERNAL_PPCS]; TZMPC mpc[IOTS_NUM_MPC]; CMSDKAPBTimer timer0; CMSDKAPBTimer timer1; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) } object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL); - object_initialize_child(obj, "apb-ppc0", &s->apb_ppc0, TYPE_TZ_PPC); - object_initialize_child(obj, "apb-ppc1", &s->apb_ppc1, TYPE_TZ_PPC); + + for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) { + g_autofree char *name = g_strdup_printf("apb-ppc%d", i); + object_initialize_child(obj, name, &s->apb_ppc[i], TYPE_TZ_PPC); + } + for (i = 0; i < info->sram_banks; i++) { char *name = g_strdup_printf("mpc%d", i); object_initialize_child(obj, name, &s->mpc[i], TYPE_TZ_MPC); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer0), 0, armsse_get_common_irq_in(s, 3)); mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer0), 0); - object_property_set_link(OBJECT(&s->apb_ppc0), "port[0]", OBJECT(mr), + object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[0]", OBJECT(mr), &error_abort); qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer1), 0, armsse_get_common_irq_in(s, 4)); mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer1), 0); - object_property_set_link(OBJECT(&s->apb_ppc0), "port[1]", OBJECT(mr), + object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[1]", OBJECT(mr), &error_abort); qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->dualtimer), 0, armsse_get_common_irq_in(s, 5)); mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dualtimer), 0); - object_property_set_link(OBJECT(&s->apb_ppc0), "port[2]", OBJECT(mr), + object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[2]", OBJECT(mr), &error_abort); if (info->has_mhus) { @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } port = g_strdup_printf("port[%d]", i + 3); mr = sysbus_mmio_get_region(mhu_sbd, 0); - object_property_set_link(OBJECT(&s->apb_ppc0), port, OBJECT(mr), + object_property_set_link(OBJECT(&s->apb_ppc[0]), port, OBJECT(mr), &error_abort); g_free(port); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } } - if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc0), errp)) { + if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[0]), errp)) { return; } - sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc0); - dev_apb_ppc0 = DEVICE(&s->apb_ppc0); + sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]); + dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]); mr = sysbus_mmio_get_region(sbd_apb_ppc0, 0); memory_region_add_subregion(&s->container, 0x40000000, mr); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32ktimer), 0, armsse_get_common_irq_in(s, 2)); mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->s32ktimer), 0); - object_property_set_link(OBJECT(&s->apb_ppc1), "port[0]", OBJECT(mr), + object_property_set_link(OBJECT(&s->apb_ppc[1]), "port[0]", OBJECT(mr), &error_abort); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc1), errp)) { + if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) { return; } - mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc1), 0); + mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc[1]), 0); memory_region_add_subregion(&s->container, 0x4002f000, mr); - dev_apb_ppc1 = DEVICE(&s->apb_ppc1); + dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]); qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0, qdev_get_gpio_in_named(dev_apb_ppc1, "cfg_nonsec", 0)); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) DeviceState *devs = DEVICE(&s->ppc_irq_splitter[i]); char *gpioname = g_strdup_printf("apb_ppc%d_irq_status", i - NUM_EXTERNAL_PPCS); - TZPPC *ppc = (i == NUM_EXTERNAL_PPCS) ? &s->apb_ppc0 : &s->apb_ppc1; + TZPPC *ppc = &s->apb_ppc[i - NUM_EXTERNAL_PPCS]; qdev_connect_gpio_out(devs, 0, qdev_get_gpio_in_named(dev_secctl, gpioname, 0)); -- 2.20.1 The SSE uses 32 interrupts for its own devices, and then passes through its expansion IRQ inputs to the CPU's interrupts 33 and upward. Add a define for the number of IRQs the SSE uses for itself, instead of hardcoding 32. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-23-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 5 ++++- hw/arm/armsse.c | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(ARMSSE, ARMSSEClass, #define RAM3_PPU 6 #define NUM_PPUS 7 +/* Number of CPU IRQs used by the SSE itself */ +#define NUM_SSE_IRQS 32 + struct ARMSSE { /*< private >*/ SysBusDevice parent_obj; @@ -XXX,XX +XXX,XX @@ struct ARMSSE { qemu_or_irq mpc_irq_orgate; qemu_or_irq nmi_orgate; - SplitIRQ cpu_irq_splitter[32]; + SplitIRQ cpu_irq_splitter[NUM_SSE_IRQS]; CMSDKAPBDualTimer dualtimer; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) int j; char *gpioname; - qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + 32); + qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + NUM_SSE_IRQS); /* * In real hardware the initial Secure VTOR is set from the INITSVTOR* * registers in the IoT Kit System Control Register block. In QEMU @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */ s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq); for (j = 0; j < s->exp_numirq; j++) { - s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + 32); + s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + NUM_SSE_IRQS); } if (i == 0) { gpioname = g_strdup("EXP_IRQ"); -- 2.20.1 The SSE-300 is mostly the same as the SSE-200, but it has moved some of the devices in the memory map and uses different device types in some cases. To accommodate this, add a framework where the placement and wiring of some devices can be specified in a data table. This commit adds the framework for this data-driven device placement, and makes the CMSDK APB timer devices use it. Subsequent commits will convert the other devices which differ between SSE-200 and SSE-300. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-24-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 3 +- hw/arm/armsse.c | 147 +++++++++++++++++++++++++++++++++------- 2 files changed, 125 insertions(+), 25 deletions(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ struct ARMSSE { IoTKitSecCtl secctl; TZPPC apb_ppc[NUM_INTERNAL_PPCS]; TZMPC mpc[IOTS_NUM_MPC]; - CMSDKAPBTimer timer0; - CMSDKAPBTimer timer1; + CMSDKAPBTimer timer[2]; CMSDKAPBTimer s32ktimer; qemu_or_irq ppc_irq_orgate; SplitIRQ sec_resp_splitter; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ #include "hw/irq.h" #include "hw/qdev-clock.h" +/* + * The SSE-300 puts some devices in different places to the + * SSE-200 (and original IoTKit). We use an array of these structs + * to define how each variant lays out these devices. (Parts of the + * SoC that are the same for all variants aren't handled via these + * data structures.) + */ + +#define NO_IRQ -1 +#define NO_PPC -1 + +typedef struct ARMSSEDeviceInfo { + const char *name; /* name to use for the QOM object; NULL terminates list */ + const char *type; /* QOM type name */ + unsigned int index; /* Which of the N devices of this type is this ? */ + hwaddr addr; + int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */ + int ppc_port; /* Port number of this device on the PPC */ + int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1 */ +} ARMSSEDeviceInfo; + struct ARMSSEInfo { const char *name; uint32_t sse_version; @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { bool has_cpusecctrl; bool has_cpuid; Property *props; + const ARMSSEDeviceInfo *devinfo; }; static Property iotkit_properties[] = { @@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = { DEFINE_PROP_END_OF_LIST() }; +static const ARMSSEDeviceInfo sse200_devices[] = { + { + .name = "timer0", + .type = TYPE_CMSDK_APB_TIMER, + .index = 0, + .addr = 0x40000000, + .ppc = 0, + .ppc_port = 0, + .irq = 3, + }, + { + .name = "timer1", + .type = TYPE_CMSDK_APB_TIMER, + .index = 1, + .addr = 0x40001000, + .ppc = 0, + .ppc_port = 1, + .irq = 4, + }, + { + .name = NULL, + } +}; + static const ARMSSEInfo armsse_variants[] = { { .name = TYPE_IOTKIT, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cpusecctrl = false, .has_cpuid = false, .props = iotkit_properties, + .devinfo = sse200_devices, }, { .name = TYPE_SSE200, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cpusecctrl = true, .has_cpuid = true, .props = armsse_properties, + .devinfo = sse200_devices, }, }; @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) ARMSSE *s = ARM_SSE(obj); ARMSSEClass *asc = ARM_SSE_GET_CLASS(obj); const ARMSSEInfo *info = asc->info; + const ARMSSEDeviceInfo *devinfo; int i; assert(info->sram_banks <= MAX_SRAM_BANKS); @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) } } + for (devinfo = info->devinfo; devinfo->name; devinfo++) { + assert(devinfo->ppc == NO_PPC || devinfo->ppc < ARRAY_SIZE(s->apb_ppc)); + if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { + assert(devinfo->index < ARRAY_SIZE(s->timer)); + object_initialize_child(obj, devinfo->name, + &s->timer[devinfo->index], + TYPE_CMSDK_APB_TIMER); + } else { + g_assert_not_reached(); + } + } + object_initialize_child(obj, "secctl", &s->secctl, TYPE_IOTKIT_SECCTL); for (i = 0; i < ARRAY_SIZE(s->apb_ppc); i++) { @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); g_free(name); } - object_initialize_child(obj, "timer0", &s->timer0, TYPE_CMSDK_APB_TIMER); - object_initialize_child(obj, "timer1", &s->timer1, TYPE_CMSDK_APB_TIMER); object_initialize_child(obj, "s32ktimer", &s->s32ktimer, TYPE_CMSDK_APB_TIMER); object_initialize_child(obj, "dualtimer", &s->dualtimer, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) ARMSSE *s = ARM_SSE(dev); ARMSSEClass *asc = ARM_SSE_GET_CLASS(dev); const ARMSSEInfo *info = asc->info; + const ARMSSEDeviceInfo *devinfo; int i; MemoryRegion *mr; Error *err = NULL; @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) * it to the appropriate PPC port; then we can realize the PPC and * map its upstream ends to the right place in the container. */ - qdev_connect_clock_in(DEVICE(&s->timer0), "pclk", s->mainclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer0), errp)) { - return; - } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer0), 0, - armsse_get_common_irq_in(s, 3)); - mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer0), 0); - object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[0]", OBJECT(mr), - &error_abort); + for (devinfo = info->devinfo; devinfo->name; devinfo++) { + SysBusDevice *sbd; + qemu_irq irq; - qdev_connect_clock_in(DEVICE(&s->timer1), "pclk", s->mainclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer1), errp)) { - return; + if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { + sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]); + + qdev_connect_clock_in(DEVICE(sbd), "pclk", s->mainclk); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); + } else { + g_assert_not_reached(); + } + + switch (devinfo->irq) { + case NO_IRQ: + irq = NULL; + break; + case 0 ... NUM_SSE_IRQS - 1: + irq = armsse_get_common_irq_in(s, devinfo->irq); + break; + default: + g_assert_not_reached(); + } + + if (irq) { + sysbus_connect_irq(sbd, 0, irq); + } + + /* + * Devices connected to a PPC are connected to the port here; + * we will map the upstream end of that port to the right address + * in the container later after the PPC has been realized. + * Devices not connected to a PPC can be mapped immediately. + */ + if (devinfo->ppc != NO_PPC) { + TZPPC *ppc = &s->apb_ppc[devinfo->ppc]; + g_autofree char *portname = g_strdup_printf("port[%d]", + devinfo->ppc_port); + object_property_set_link(OBJECT(ppc), portname, OBJECT(mr), + &error_abort); + } else { + memory_region_add_subregion(&s->container, devinfo->addr, mr); + } } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer1), 0, - armsse_get_common_irq_in(s, 4)); - mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->timer1), 0); - object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[1]", OBJECT(mr), - &error_abort); qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk); if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) { @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]); dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]); - mr = sysbus_mmio_get_region(sbd_apb_ppc0, 0); - memory_region_add_subregion(&s->container, 0x40000000, mr); - mr = sysbus_mmio_get_region(sbd_apb_ppc0, 1); - memory_region_add_subregion(&s->container, 0x40001000, mr); mr = sysbus_mmio_get_region(sbd_apb_ppc0, 2); memory_region_add_subregion(&s->container, 0x40002000, mr); if (info->has_mhus) { @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) qdev_get_gpio_in_named(dev_apb_ppc1, "cfg_sec_resp", 0)); + /* + * Now both PPCs are realized we can map the upstream ends of + * ports which correspond to entries in the devinfo array. + * The ports which are connected to non-devinfo devices have + * already been mapped. + */ + for (devinfo = info->devinfo; devinfo->name; devinfo++) { + SysBusDevice *ppc_sbd; + + if (devinfo->ppc == NO_PPC) { + continue; + } + ppc_sbd = SYS_BUS_DEVICE(&s->apb_ppc[devinfo->ppc]); + mr = sysbus_mmio_get_region(ppc_sbd, devinfo->ppc_port); + memory_region_add_subregion(&s->container, devinfo->addr, mr); + } + if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION", info->sys_version, errp)) { return; -- 2.20.1 Move the CMSDK dualtimer device handling into the data-driven device placement framework. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-25-peter.maydell@linaro.org --- hw/arm/armsse.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { .ppc_port = 1, .irq = 4, }, + { + .name = "dualtimer", + .type = TYPE_CMSDK_APB_DUALTIMER, + .index = 0, + .addr = 0x40002000, + .ppc = 0, + .ppc_port = 2, + .irq = 5, + }, { .name = NULL, } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) object_initialize_child(obj, devinfo->name, &s->timer[devinfo->index], TYPE_CMSDK_APB_TIMER); + } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) { + assert(devinfo->index == 0); + object_initialize_child(obj, devinfo->name, &s->dualtimer, + TYPE_CMSDK_APB_DUALTIMER); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) } object_initialize_child(obj, "s32ktimer", &s->s32ktimer, TYPE_CMSDK_APB_TIMER); - object_initialize_child(obj, "dualtimer", &s->dualtimer, - TYPE_CMSDK_APB_DUALTIMER); object_initialize_child(obj, "s32kwatchdog", &s->s32kwatchdog, TYPE_CMSDK_APB_WATCHDOG); object_initialize_child(obj, "nswatchdog", &s->nswatchdog, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) return; } mr = sysbus_mmio_get_region(sbd, 0); + } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_DUALTIMER)) { + sbd = SYS_BUS_DEVICE(&s->dualtimer); + + qdev_connect_clock_in(DEVICE(sbd), "TIMCLK", s->mainclk); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } } - qdev_connect_clock_in(DEVICE(&s->dualtimer), "TIMCLK", s->mainclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->dualtimer), errp)) { - return; - } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->dualtimer), 0, - armsse_get_common_irq_in(s, 5)); - mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->dualtimer), 0); - object_property_set_link(OBJECT(&s->apb_ppc[0]), "port[2]", OBJECT(mr), - &error_abort); - if (info->has_mhus) { /* * An SSE-200 with only one CPU should have only one MHU created, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) sbd_apb_ppc0 = SYS_BUS_DEVICE(&s->apb_ppc[0]); dev_apb_ppc0 = DEVICE(&s->apb_ppc[0]); - mr = sysbus_mmio_get_region(sbd_apb_ppc0, 2); - memory_region_add_subregion(&s->container, 0x40002000, mr); if (info->has_mhus) { mr = sysbus_mmio_get_region(sbd_apb_ppc0, 3); memory_region_add_subregion(&s->container, 0x40003000, mr); -- 2.20.1 Move the CMSDK watchdog device handling into the data-driven device placement framework. This is slightly more complicated because these devices might wire their IRQs up to the NMI line, and because one of them uses the slow 32KHz clock rather than the main clock. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-26-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 4 +- hw/arm/armsse.c | 109 ++++++++++++++++++++++++---------------- 2 files changed, 66 insertions(+), 47 deletions(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ struct ARMSSE { CMSDKAPBDualTimer dualtimer; - CMSDKAPBWatchdog s32kwatchdog; - CMSDKAPBWatchdog nswatchdog; - CMSDKAPBWatchdog swatchdog; + CMSDKAPBWatchdog cmsdk_watchdog[3]; IoTKitSysCtl sysctl; IoTKitSysCtl sysinfo; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ #define NO_IRQ -1 #define NO_PPC -1 +/* + * Special values for ARMSSEDeviceInfo::irq to indicate that this + * device uses one of the inputs to the OR gate that feeds into the + * CPU NMI input. + */ +#define NMI_0 10000 +#define NMI_1 10001 typedef struct ARMSSEDeviceInfo { const char *name; /* name to use for the QOM object; NULL terminates list */ @@ -XXX,XX +XXX,XX @@ typedef struct ARMSSEDeviceInfo { hwaddr addr; int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */ int ppc_port; /* Port number of this device on the PPC */ - int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1 */ + int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1, or NMI_0 or NMI_1 */ + bool slowclk; /* true if device uses the slow 32KHz clock */ } ARMSSEDeviceInfo; struct ARMSSEInfo { @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { .ppc_port = 2, .irq = 5, }, + { + .name = "s32kwatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 0, + .addr = 0x5002e000, + .ppc = NO_PPC, + .irq = NMI_0, + .slowclk = true, + }, + { + .name = "nswatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 1, + .addr = 0x40081000, + .ppc = NO_PPC, + .irq = 1, + }, + { + .name = "swatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 2, + .addr = 0x50081000, + .ppc = NO_PPC, + .irq = NMI_1, + }, { .name = NULL, } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) assert(devinfo->index == 0); object_initialize_child(obj, devinfo->name, &s->dualtimer, TYPE_CMSDK_APB_DUALTIMER); + } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { + assert(devinfo->index < ARRAY_SIZE(s->cmsdk_watchdog)); + object_initialize_child(obj, devinfo->name, + &s->cmsdk_watchdog[devinfo->index], + TYPE_CMSDK_APB_WATCHDOG); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) object_initialize_child(obj, name, splitter, TYPE_SPLIT_IRQ); g_free(name); } + object_initialize_child(obj, "s32ktimer", &s->s32ktimer, TYPE_CMSDK_APB_TIMER); - object_initialize_child(obj, "s32kwatchdog", &s->s32kwatchdog, - TYPE_CMSDK_APB_WATCHDOG); - object_initialize_child(obj, "nswatchdog", &s->nswatchdog, - TYPE_CMSDK_APB_WATCHDOG); - object_initialize_child(obj, "swatchdog", &s->swatchdog, - TYPE_CMSDK_APB_WATCHDOG); object_initialize_child(obj, "armsse-sysctl", &s->sysctl, TYPE_IOTKIT_SYSCTL); object_initialize_child(obj, "armsse-sysinfo", &s->sysinfo, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) qdev_connect_gpio_out(DEVICE(&s->mpc_irq_orgate), 0, armsse_get_common_irq_in(s, 9)); + /* This OR gate wires together outputs from the secure watchdogs to NMI */ + if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2, + errp)) { + return; + } + if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) { + return; + } + qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, + qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); + /* Devices behind APB PPC0: * 0x40000000: timer0 * 0x40001000: timer1 @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) return; } mr = sysbus_mmio_get_region(sbd, 0); + } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { + sbd = SYS_BUS_DEVICE(&s->cmsdk_watchdog[devinfo->index]); + + qdev_connect_clock_in(DEVICE(sbd), "WDOGCLK", + devinfo->slowclk ? s->s32kclk : s->mainclk); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) case 0 ... NUM_SSE_IRQS - 1: irq = armsse_get_common_irq_in(s, devinfo->irq); break; + case NMI_0: + case NMI_1: + irq = qdev_get_gpio_in(DEVICE(&s->nmi_orgate), + devinfo->irq - NMI_0); + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } } - /* This OR gate wires together outputs from the secure watchdogs to NMI */ - if (!object_property_set_int(OBJECT(&s->nmi_orgate), "num-lines", 2, - errp)) { - return; - } - if (!qdev_realize(DEVICE(&s->nmi_orgate), NULL, errp)) { - return; - } - qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, - qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); - - qdev_connect_clock_in(DEVICE(&s->s32kwatchdog), "WDOGCLK", s->s32kclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32kwatchdog), errp)) { - return; - } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32kwatchdog), 0, - qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 0)); - sysbus_mmio_map(SYS_BUS_DEVICE(&s->s32kwatchdog), 0, 0x5002e000); - - /* 0x40080000 .. 0x4008ffff : ARMSSE second Base peripheral region */ - - qdev_connect_clock_in(DEVICE(&s->nswatchdog), "WDOGCLK", s->mainclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->nswatchdog), errp)) { - return; - } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->nswatchdog), 0, - armsse_get_common_irq_in(s, 1)); - sysbus_mmio_map(SYS_BUS_DEVICE(&s->nswatchdog), 0, 0x40081000); - - qdev_connect_clock_in(DEVICE(&s->swatchdog), "WDOGCLK", s->mainclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->swatchdog), errp)) { - return; - } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->swatchdog), 0, - qdev_get_gpio_in(DEVICE(&s->nmi_orgate), 1)); - sysbus_mmio_map(SYS_BUS_DEVICE(&s->swatchdog), 0, 0x50081000); - for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { Object *splitter = OBJECT(&s->ppc_irq_splitter[i]); -- 2.20.1 Move the CMSDK timer that uses the S32K slow clock into the data-driven device placement framework. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-27-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 3 +-- hw/arm/armsse.c | 31 ++++++++++++------------------- 2 files changed, 13 insertions(+), 21 deletions(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ struct ARMSSE { IoTKitSecCtl secctl; TZPPC apb_ppc[NUM_INTERNAL_PPCS]; TZMPC mpc[IOTS_NUM_MPC]; - CMSDKAPBTimer timer[2]; - CMSDKAPBTimer s32ktimer; + CMSDKAPBTimer timer[3]; qemu_or_irq ppc_irq_orgate; SplitIRQ sec_resp_splitter; SplitIRQ ppc_irq_splitter[NUM_PPCS]; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { .ppc_port = 1, .irq = 4, }, + { + .name = "s32ktimer", + .type = TYPE_CMSDK_APB_TIMER, + .index = 2, + .addr = 0x4002f000, + .ppc = 1, + .ppc_port = 0, + .irq = 2, + .slowclk = true, + }, { .name = "dualtimer", .type = TYPE_CMSDK_APB_DUALTIMER, @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) g_free(name); } - object_initialize_child(obj, "s32ktimer", &s->s32ktimer, - TYPE_CMSDK_APB_TIMER); object_initialize_child(obj, "armsse-sysctl", &s->sysctl, TYPE_IOTKIT_SYSCTL); object_initialize_child(obj, "armsse-sysinfo", &s->sysinfo, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) if (!strcmp(devinfo->type, TYPE_CMSDK_APB_TIMER)) { sbd = SYS_BUS_DEVICE(&s->timer[devinfo->index]); - qdev_connect_clock_in(DEVICE(sbd), "pclk", s->mainclk); + qdev_connect_clock_in(DEVICE(sbd), "pclk", + devinfo->slowclk ? s->s32kclk : s->mainclk); if (!sysbus_realize(sbd, errp)) { return; } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) } } - /* 0x40020000 .. 0x4002ffff : ARMSSE system control peripheral region */ - /* Devices behind APB PPC1: - * 0x4002f000: S32K timer - */ - qdev_connect_clock_in(DEVICE(&s->s32ktimer), "pclk", s->s32kclk); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->s32ktimer), errp)) { - return; - } - sysbus_connect_irq(SYS_BUS_DEVICE(&s->s32ktimer), 0, - armsse_get_common_irq_in(s, 2)); - mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->s32ktimer), 0); - object_property_set_link(OBJECT(&s->apb_ppc[1]), "port[0]", OBJECT(mr), - &error_abort); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) { return; } - mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->apb_ppc[1]), 0); - memory_region_add_subregion(&s->container, 0x4002f000, mr); dev_apb_ppc1 = DEVICE(&s->apb_ppc[1]); qdev_connect_gpio_out_named(dev_secctl, "apb_ppc1_nonsec", 0, -- 2.20.1 Move the sysinfo register block into the data-driven framework. While we are moving the code for configuring this device around, regularize on using &error_abortw when setting the integer properties: they are all simple DEFINE_PROP_UINT32 properties so the setting can never fail. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-28-peter.maydell@linaro.org --- hw/arm/armsse.c | 47 ++++++++++++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 19 deletions(-) diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { .ppc = NO_PPC, .irq = NMI_1, }, + { + .name = "armsse-sysinfo", + .type = TYPE_IOTKIT_SYSINFO, + .index = 0, + .addr = 0x40020000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, { .name = NULL, } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) object_initialize_child(obj, devinfo->name, &s->cmsdk_watchdog[devinfo->index], TYPE_CMSDK_APB_WATCHDOG); + } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) { + assert(devinfo->index == 0); + object_initialize_child(obj, devinfo->name, &s->sysinfo, + TYPE_IOTKIT_SYSINFO); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) object_initialize_child(obj, "armsse-sysctl", &s->sysctl, TYPE_IOTKIT_SYSCTL); - object_initialize_child(obj, "armsse-sysinfo", &s->sysinfo, - TYPE_IOTKIT_SYSINFO); if (info->has_mhus) { object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU); object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) return; } mr = sysbus_mmio_get_region(sbd, 0); + } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSINFO)) { + sbd = SYS_BUS_DEVICE(&s->sysinfo); + + object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION", + info->sys_version, &error_abort); + object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG", + armsse_sys_config_value(s, info), + &error_abort); + object_property_set_int(OBJECT(&s->sysinfo), "sse-version", + info->sse_version, &error_abort); + object_property_set_int(OBJECT(&s->sysinfo), "IIDR", + info->iidr, &error_abort); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) memory_region_add_subregion(&s->container, devinfo->addr, mr); } - if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_VERSION", - info->sys_version, errp)) { - return; - } - if (!object_property_set_int(OBJECT(&s->sysinfo), "SYS_CONFIG", - armsse_sys_config_value(s, info), errp)) { - return; - } - object_property_set_int(OBJECT(&s->sysinfo), "sse-version", - info->sse_version, &error_abort); - object_property_set_int(OBJECT(&s->sysinfo), "IIDR", - info->iidr, &error_abort); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysinfo), errp)) { - return; - } - /* System information registers */ - sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysinfo), 0, 0x40020000); /* System control registers */ object_property_set_int(OBJECT(&s->sysctl), "sse-version", info->sse_version, &error_abort); -- 2.20.1 Move the sysctl register block into the data-driven device placement framework. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-29-peter.maydell@linaro.org --- hw/arm/armsse.c | 44 ++++++++++++++++++++++++++++---------------- 1 file changed, 28 insertions(+), 16 deletions(-) diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { .ppc = NO_PPC, .irq = NO_IRQ, }, + { + .name = "armsse-sysctl", + .type = TYPE_IOTKIT_SYSCTL, + .index = 0, + .addr = 0x50021000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, { .name = NULL, } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) assert(devinfo->index == 0); object_initialize_child(obj, devinfo->name, &s->sysinfo, TYPE_IOTKIT_SYSINFO); + } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) { + assert(devinfo->index == 0); + object_initialize_child(obj, devinfo->name, &s->sysctl, + TYPE_IOTKIT_SYSCTL); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) g_free(name); } - object_initialize_child(obj, "armsse-sysctl", &s->sysctl, - TYPE_IOTKIT_SYSCTL); if (info->has_mhus) { object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU); object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) return; } mr = sysbus_mmio_get_region(sbd, 0); + } else if (!strcmp(devinfo->type, TYPE_IOTKIT_SYSCTL)) { + /* System control registers */ + sbd = SYS_BUS_DEVICE(&s->sysctl); + + object_property_set_int(OBJECT(&s->sysctl), "sse-version", + info->sse_version, &error_abort); + object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST", + info->cpuwait_rst, &error_abort); + object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST", + s->init_svtor, &error_abort); + object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST", + s->init_svtor, &error_abort); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) memory_region_add_subregion(&s->container, devinfo->addr, mr); } - /* System control registers */ - object_property_set_int(OBJECT(&s->sysctl), "sse-version", - info->sse_version, &error_abort); - object_property_set_int(OBJECT(&s->sysctl), "CPUWAIT_RST", - info->cpuwait_rst, &error_abort); - object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR0_RST", - s->init_svtor, &error_abort); - object_property_set_int(OBJECT(&s->sysctl), "INITSVTOR1_RST", - s->init_svtor, &error_abort); - if (!sysbus_realize(SYS_BUS_DEVICE(&s->sysctl), errp)) { - return; - } - sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysctl), 0, 0x50021000); - if (info->has_ppus) { /* CPUnCORE_PPU for each CPU */ for (i = 0; i < info->num_cpus; i++) { -- 2.20.1 Move the PPUs into the data-driven device placement framework. We don't implement them, so they are just TYPE_UNIMPLEMENTED stubs. Because the SSE-200 and the IotKit diverge here (the IoTKit does not have the PPUs) we need to separate out the ARMSSEDeviceInfo for the two variants, and only add the PPUs to the SSE-200. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-30-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 10 +- hw/arm/armsse.c | 222 +++++++++++++++++++++++++++++----------- 2 files changed, 165 insertions(+), 67 deletions(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(ARMSSE, ARMSSEClass, #define SSE_MAX_CPUS 2 -/* These define what each PPU in the ppu[] index is for */ -#define CPU0CORE_PPU 0 -#define CPU1CORE_PPU 1 -#define DBG_PPU 2 -#define RAM0_PPU 3 -#define RAM1_PPU 4 -#define RAM2_PPU 5 -#define RAM3_PPU 6 #define NUM_PPUS 7 /* Number of CPU IRQs used by the SSE itself */ @@ -XXX,XX +XXX,XX @@ struct ARMSSE { IoTKitSysCtl sysinfo; ARMSSEMHU mhu[2]; - UnimplementedDeviceState ppu[NUM_PPUS]; + UnimplementedDeviceState unimp[NUM_PPUS]; UnimplementedDeviceState cachectrl[SSE_MAX_CPUS]; UnimplementedDeviceState cpusecctrl[SSE_MAX_CPUS]; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ typedef struct ARMSSEDeviceInfo { const char *type; /* QOM type name */ unsigned int index; /* Which of the N devices of this type is this ? */ hwaddr addr; + hwaddr size; /* only needed for TYPE_UNIMPLEMENTED_DEVICE */ int ppc; /* Index of APB PPC this device is wired up to, or NO_PPC */ int ppc_port; /* Port number of this device on the PPC */ int irq; /* NO_IRQ, or 0..NUM_SSE_IRQS-1, or NMI_0 or NMI_1 */ @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { uint32_t iidr; uint32_t cpuwait_rst; bool has_mhus; - bool has_ppus; bool has_cachectrl; bool has_cpusecctrl; bool has_cpuid; @@ -XXX,XX +XXX,XX @@ static Property armsse_properties[] = { DEFINE_PROP_END_OF_LIST() }; -static const ARMSSEDeviceInfo sse200_devices[] = { +static const ARMSSEDeviceInfo iotkit_devices[] = { { .name = "timer0", .type = TYPE_CMSDK_APB_TIMER, @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { } }; +static const ARMSSEDeviceInfo sse200_devices[] = { + { + .name = "timer0", + .type = TYPE_CMSDK_APB_TIMER, + .index = 0, + .addr = 0x40000000, + .ppc = 0, + .ppc_port = 0, + .irq = 3, + }, + { + .name = "timer1", + .type = TYPE_CMSDK_APB_TIMER, + .index = 1, + .addr = 0x40001000, + .ppc = 0, + .ppc_port = 1, + .irq = 4, + }, + { + .name = "s32ktimer", + .type = TYPE_CMSDK_APB_TIMER, + .index = 2, + .addr = 0x4002f000, + .ppc = 1, + .ppc_port = 0, + .irq = 2, + .slowclk = true, + }, + { + .name = "dualtimer", + .type = TYPE_CMSDK_APB_DUALTIMER, + .index = 0, + .addr = 0x40002000, + .ppc = 0, + .ppc_port = 2, + .irq = 5, + }, + { + .name = "s32kwatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 0, + .addr = 0x5002e000, + .ppc = NO_PPC, + .irq = NMI_0, + .slowclk = true, + }, + { + .name = "nswatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 1, + .addr = 0x40081000, + .ppc = NO_PPC, + .irq = 1, + }, + { + .name = "swatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 2, + .addr = 0x50081000, + .ppc = NO_PPC, + .irq = NMI_1, + }, + { + .name = "armsse-sysinfo", + .type = TYPE_IOTKIT_SYSINFO, + .index = 0, + .addr = 0x40020000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "armsse-sysctl", + .type = TYPE_IOTKIT_SYSCTL, + .index = 0, + .addr = 0x50021000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "CPU0CORE_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 0, + .addr = 0x50023000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "CPU1CORE_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 1, + .addr = 0x50025000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "DBG_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 2, + .addr = 0x50029000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "RAM0_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 3, + .addr = 0x5002a000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "RAM1_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 4, + .addr = 0x5002b000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "RAM2_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 5, + .addr = 0x5002c000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "RAM3_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 6, + .addr = 0x5002d000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = NULL, + } +}; + static const ARMSSEInfo armsse_variants[] = { { .name = TYPE_IOTKIT, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .iidr = 0, .cpuwait_rst = 0, .has_mhus = false, - .has_ppus = false, .has_cachectrl = false, .has_cpusecctrl = false, .has_cpuid = false, .props = iotkit_properties, - .devinfo = sse200_devices, + .devinfo = iotkit_devices, }, { .name = TYPE_SSE200, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .iidr = 0, .cpuwait_rst = 2, .has_mhus = true, - .has_ppus = true, .has_cachectrl = true, .has_cpusecctrl = true, .has_cpuid = true, @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) assert(devinfo->index == 0); object_initialize_child(obj, devinfo->name, &s->sysctl, TYPE_IOTKIT_SYSCTL); + } else if (!strcmp(devinfo->type, TYPE_UNIMPLEMENTED_DEVICE)) { + assert(devinfo->index < ARRAY_SIZE(s->unimp)); + object_initialize_child(obj, devinfo->name, + &s->unimp[devinfo->index], + TYPE_UNIMPLEMENTED_DEVICE); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) object_initialize_child(obj, "mhu0", &s->mhu[0], TYPE_ARMSSE_MHU); object_initialize_child(obj, "mhu1", &s->mhu[1], TYPE_ARMSSE_MHU); } - if (info->has_ppus) { - for (i = 0; i < info->num_cpus; i++) { - char *name = g_strdup_printf("CPU%dCORE_PPU", i); - int ppuidx = CPU0CORE_PPU + i; - - object_initialize_child(obj, name, &s->ppu[ppuidx], - TYPE_UNIMPLEMENTED_DEVICE); - g_free(name); - } - object_initialize_child(obj, "DBG_PPU", &s->ppu[DBG_PPU], - TYPE_UNIMPLEMENTED_DEVICE); - for (i = 0; i < info->sram_banks; i++) { - char *name = g_strdup_printf("RAM%d_PPU", i); - int ppuidx = RAM0_PPU + i; - - object_initialize_child(obj, name, &s->ppu[ppuidx], - TYPE_UNIMPLEMENTED_DEVICE); - g_free(name); - } - } if (info->has_cachectrl) { for (i = 0; i < info->num_cpus; i++) { char *name = g_strdup_printf("cachectrl%d", i); @@ -XXX,XX +XXX,XX @@ static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno) } } -static void map_ppu(ARMSSE *s, int ppuidx, const char *name, hwaddr addr) -{ - /* Map a PPU unimplemented device stub */ - DeviceState *dev = DEVICE(&s->ppu[ppuidx]); - - qdev_prop_set_string(dev, "name", name); - qdev_prop_set_uint64(dev, "size", 0x1000); - sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal); - sysbus_mmio_map(SYS_BUS_DEVICE(&s->ppu[ppuidx]), 0, addr); -} - static void armsse_realize(DeviceState *dev, Error **errp) { ARMSSE *s = ARM_SSE(dev); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) return; } mr = sysbus_mmio_get_region(sbd, 0); + } else if (!strcmp(devinfo->type, TYPE_UNIMPLEMENTED_DEVICE)) { + sbd = SYS_BUS_DEVICE(&s->unimp[devinfo->index]); + + qdev_prop_set_string(DEVICE(sbd), "name", devinfo->name); + qdev_prop_set_uint64(DEVICE(sbd), "size", devinfo->size); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); } else { g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) memory_region_add_subregion(&s->container, devinfo->addr, mr); } - if (info->has_ppus) { - /* CPUnCORE_PPU for each CPU */ - for (i = 0; i < info->num_cpus; i++) { - char *name = g_strdup_printf("CPU%dCORE_PPU", i); - - map_ppu(s, CPU0CORE_PPU + i, name, 0x50023000 + i * 0x2000); - /* - * We don't support CPU debug so don't create the - * CPU0DEBUG_PPU at 0x50024000 and 0x50026000. - */ - g_free(name); - } - map_ppu(s, DBG_PPU, "DBG_PPU", 0x50029000); - - for (i = 0; i < info->sram_banks; i++) { - char *name = g_strdup_printf("RAM%d_PPU", i); - - map_ppu(s, RAM0_PPU + i, name, 0x5002a000 + i * 0x1000); - g_free(name); - } - } - for (i = 0; i < ARRAY_SIZE(s->ppc_irq_splitter); i++) { Object *splitter = OBJECT(&s->ppc_irq_splitter[i]); -- 2.20.1 We forgot to implement a TYPE_UNIMPLEMENTED_DEVICE stub for the SYS_PPU in the SSE-200, which is at 0x50022000. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-31-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 2 +- hw/arm/armsse.c | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(ARMSSE, ARMSSEClass, #define SSE_MAX_CPUS 2 -#define NUM_PPUS 7 +#define NUM_PPUS 8 /* Number of CPU IRQs used by the SSE itself */ #define NUM_SSE_IRQS 32 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { .ppc = NO_PPC, .irq = NO_IRQ, }, + { + .name = "SYS_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 7, + .addr = 0x50022000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, { .name = NULL, } -- 2.20.1 The SSE-300 has a slightly different set of shared-per-CPU interrupts, allow the irq_is_common[] array to be different per SSE variant. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-32-peter.maydell@linaro.org --- hw/arm/armsse.c | 39 +++++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { bool has_cpuid; Property *props; const ARMSSEDeviceInfo *devinfo; + const bool *irq_is_common; }; static Property iotkit_properties[] = { @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { } }; +/* Is internal IRQ n shared between CPUs in a multi-core SSE ? */ +static const bool sse200_irq_is_common[32] = { + [0 ... 5] = true, + /* 6, 7: per-CPU MHU interrupts */ + [8 ... 12] = true, + /* 13: per-CPU icache interrupt */ + /* 14: reserved */ + [15 ... 20] = true, + /* 21: reserved */ + [22 ... 26] = true, + /* 27: reserved */ + /* 28, 29: per-CPU CTI interrupts */ + /* 30, 31: reserved */ +}; + static const ARMSSEInfo armsse_variants[] = { { .name = TYPE_IOTKIT, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cpuid = false, .props = iotkit_properties, .devinfo = iotkit_devices, + .irq_is_common = sse200_irq_is_common, }, { .name = TYPE_SSE200, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cpuid = true, .props = armsse_properties, .devinfo = sse200_devices, + .irq_is_common = sse200_irq_is_common, }, }; @@ -XXX,XX +XXX,XX @@ static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) /* Clock frequency in HZ of the 32KHz "slow clock" */ #define S32KCLK (32 * 1000) -/* Is internal IRQ n shared between CPUs in a multi-core SSE ? */ -static bool irq_is_common[32] = { - [0 ... 5] = true, - /* 6, 7: per-CPU MHU interrupts */ - [8 ... 12] = true, - /* 13: per-CPU icache interrupt */ - /* 14: reserved */ - [15 ... 20] = true, - /* 21: reserved */ - [22 ... 26] = true, - /* 27: reserved */ - /* 28, 29: per-CPU CTI interrupts */ - /* 30, 31: reserved */ -}; - /* * Create an alias region in @container of @size bytes starting at @base * which mirrors the memory starting at @orig. @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) } if (info->num_cpus > 1) { for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { - if (irq_is_common[i]) { + if (info->irq_is_common[i]) { char *name = g_strdup_printf("cpu-irq-splitter%d", i); SplitIRQ *splitter = &s->cpu_irq_splitter[i]; @@ -XXX,XX +XXX,XX @@ static qemu_irq armsse_get_common_irq_in(ARMSSE *s, int irqno) ARMSSEClass *asc = ARM_SSE_GET_CLASS(s); const ARMSSEInfo *info = asc->info; - assert(irq_is_common[irqno]); + assert(info->irq_is_common[irqno]); if (info->num_cpus == 1) { /* Only one CPU -- just connect directly to it */ @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) /* Wire up the splitters that connect common IRQs to all CPUs */ if (info->num_cpus > 1) { for (i = 0; i < ARRAY_SIZE(s->cpu_irq_splitter); i++) { - if (irq_is_common[i]) { + if (info->irq_is_common[i]) { Object *splitter = OBJECT(&s->cpu_irq_splitter[i]); DeviceState *devs = DEVICE(splitter); int cpunum; -- 2.20.1 The SSE-300 has a system counter device; add support for SSE variants having this device. As with the existing devices like the cache control block, CPUID block, etc, we don't try to make the MMIO addresses configurable. We can do that if and when we need to model a future SSE variant which has the counter in a different location. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-33-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 3 +++ hw/arm/armsse.c | 27 +++++++++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ #include "hw/misc/tz-mpc.h" #include "hw/timer/cmsdk-apb-timer.h" #include "hw/timer/cmsdk-apb-dualtimer.h" +#include "hw/timer/sse-counter.h" #include "hw/watchdog/cmsdk-apb-watchdog.h" #include "hw/misc/iotkit-sysctl.h" #include "hw/misc/iotkit-sysinfo.h" @@ -XXX,XX +XXX,XX @@ struct ARMSSE { CMSDKAPBWatchdog cmsdk_watchdog[3]; + SSECounter sse_counter; + IoTKitSysCtl sysctl; IoTKitSysCtl sysinfo; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { bool has_cachectrl; bool has_cpusecctrl; bool has_cpuid; + bool has_sse_counter; Property *props; const ARMSSEDeviceInfo *devinfo; const bool *irq_is_common; @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cachectrl = false, .has_cpusecctrl = false, .has_cpuid = false, + .has_sse_counter = false, .props = iotkit_properties, .devinfo = iotkit_devices, .irq_is_common = sse200_irq_is_common, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cachectrl = true, .has_cpusecctrl = true, .has_cpuid = true, + .has_sse_counter = false, .props = armsse_properties, .devinfo = sse200_devices, .irq_is_common = sse200_irq_is_common, @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) g_free(name); } } + if (info->has_sse_counter) { + object_initialize_child(obj, "sse-counter", &s->sse_counter, + TYPE_SSE_COUNTER); + } + object_initialize_child(obj, "nmi-orgate", &s->nmi_orgate, TYPE_OR_IRQ); object_initialize_child(obj, "ppc-irq-orgate", &s->ppc_irq_orgate, TYPE_OR_IRQ); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0, qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0)); + /* The SSE-300 has a System Counter / System Timestamp Generator */ + if (info->has_sse_counter) { + SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sse_counter); + + qdev_connect_clock_in(DEVICE(sbd), "CLK", s->mainclk); + if (!sysbus_realize(sbd, errp)) { + return; + } + /* + * The control frame is only in the Secure region; + * the status frame is in the NS region (and visible in the + * S region via the alias mapping). + */ + memory_region_add_subregion(&s->container, 0x58100000, + sysbus_mmio_get_region(sbd, 0)); + memory_region_add_subregion(&s->container, 0x48101000, + sysbus_mmio_get_region(sbd, 1)); + } + /* Devices behind APB PPC0: * 0x40000000: timer0 * 0x40001000: timer1 -- 2.20.1 The SSE-300 has four timers of type TYPE_SSE_TIMER; add support in the code for having these in an ARMSSEDeviceInfo array. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-34-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 2 ++ hw/arm/armsse.c | 15 +++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ #include "hw/timer/cmsdk-apb-timer.h" #include "hw/timer/cmsdk-apb-dualtimer.h" #include "hw/timer/sse-counter.h" +#include "hw/timer/sse-timer.h" #include "hw/watchdog/cmsdk-apb-watchdog.h" #include "hw/misc/iotkit-sysctl.h" #include "hw/misc/iotkit-sysinfo.h" @@ -XXX,XX +XXX,XX @@ struct ARMSSE { CMSDKAPBWatchdog cmsdk_watchdog[3]; SSECounter sse_counter; + SSETimer sse_timer[4]; IoTKitSysCtl sysctl; IoTKitSysCtl sysinfo; diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) assert(devinfo->index == 0); object_initialize_child(obj, devinfo->name, &s->dualtimer, TYPE_CMSDK_APB_DUALTIMER); + } else if (!strcmp(devinfo->type, TYPE_SSE_TIMER)) { + assert(devinfo->index < ARRAY_SIZE(s->sse_timer)); + object_initialize_child(obj, devinfo->name, + &s->sse_timer[devinfo->index], + TYPE_SSE_TIMER); } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { assert(devinfo->index < ARRAY_SIZE(s->cmsdk_watchdog)); object_initialize_child(obj, devinfo->name, @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) return; } mr = sysbus_mmio_get_region(sbd, 0); + } else if (!strcmp(devinfo->type, TYPE_SSE_TIMER)) { + sbd = SYS_BUS_DEVICE(&s->sse_timer[devinfo->index]); + + assert(info->has_sse_counter); + object_property_set_link(OBJECT(sbd), "counter", + OBJECT(&s->sse_counter), &error_abort); + if (!sysbus_realize(sbd, errp)) { + return; + } + mr = sysbus_mmio_get_region(sbd, 0); } else if (!strcmp(devinfo->type, TYPE_CMSDK_APB_WATCHDOG)) { sbd = SYS_BUS_DEVICE(&s->cmsdk_watchdog[devinfo->index]); -- 2.20.1 Support SSE variants like the SSE-300 with an ARMSSE_CPU_PWRCTRL register block. Because this block is per-CPU and does not clash with any of the SSE-200 devices, we handle it with a has_cpu_pwrctrl flag like the existing has_cachectrl, has_cpusectrl and has_cpuid, rather than trying to add per-CPU-device support to the devinfo array handling code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-35-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 3 +++ hw/arm/armsse.c | 26 ++++++++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ #include "hw/misc/iotkit-sysinfo.h" #include "hw/misc/armsse-cpuid.h" #include "hw/misc/armsse-mhu.h" +#include "hw/misc/armsse-cpu-pwrctrl.h" #include "hw/misc/unimp.h" #include "hw/or-irq.h" #include "hw/clock.h" @@ -XXX,XX +XXX,XX @@ struct ARMSSE { ARMSSECPUID cpuid[SSE_MAX_CPUS]; + ARMSSECPUPwrCtrl cpu_pwrctrl[SSE_MAX_CPUS]; + /* * 'container' holds all devices seen by all CPUs. * 'cpu_container[i]' is the view that CPU i has: this has the diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo { bool has_cachectrl; bool has_cpusecctrl; bool has_cpuid; + bool has_cpu_pwrctrl; bool has_sse_counter; Property *props; const ARMSSEDeviceInfo *devinfo; @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cachectrl = false, .has_cpusecctrl = false, .has_cpuid = false, + .has_cpu_pwrctrl = false, .has_sse_counter = false, .props = iotkit_properties, .devinfo = iotkit_devices, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .has_cachectrl = true, .has_cpusecctrl = true, .has_cpuid = true, + .has_cpu_pwrctrl = false, .has_sse_counter = false, .props = armsse_properties, .devinfo = sse200_devices, @@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj) g_free(name); } } + if (info->has_cpu_pwrctrl) { + for (i = 0; i < info->num_cpus; i++) { + char *name = g_strdup_printf("cpu_pwrctrl%d", i); + + object_initialize_child(obj, name, &s->cpu_pwrctrl[i], + TYPE_ARMSSE_CPU_PWRCTRL); + g_free(name); + } + } if (info->has_sse_counter) { object_initialize_child(obj, "sse-counter", &s->sse_counter, TYPE_SSE_COUNTER); @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) * 0x50010000: L1 icache control registers * 0x50011000: CPUSECCTRL (CPU local security control registers) * 0x4001f000 and 0x5001f000: CPU_IDENTITY register block + * The SSE-300 has an extra: + * 0x40012000 and 0x50012000: CPU_PWRCTRL register block */ if (info->has_cachectrl) { for (i = 0; i < info->num_cpus; i++) { @@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp) memory_region_add_subregion(&s->cpu_container[i], 0x4001F000, mr); } } + if (info->has_cpu_pwrctrl) { + for (i = 0; i < info->num_cpus; i++) { + MemoryRegion *mr; + + if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu_pwrctrl[i]), errp)) { + return; + } + + mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cpu_pwrctrl[i]), 0); + memory_region_add_subregion(&s->cpu_container[i], 0x40012000, mr); + } + } if (!sysbus_realize(SYS_BUS_DEVICE(&s->apb_ppc[1]), errp)) { return; -- 2.20.1 Now we have sufficiently parameterised the code, we can add SSE-300 support by adding a new entry to the armsse_variants[] array. Note that the main watchdog (unlike the s32k watchdog) in the SSE-300 is a different device from the CMSDK watchdog; we don't have a model of it so we leave it as a TYPE_UNIMPLEMENTED_DEVICE stub. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-36-peter.maydell@linaro.org --- include/hw/arm/armsse.h | 1 + hw/arm/armsse.c | 152 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 153 insertions(+) diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/armsse.h +++ b/include/hw/arm/armsse.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_TYPE(ARMSSE, ARMSSEClass, */ #define TYPE_IOTKIT "iotkit" #define TYPE_SSE200 "sse-200" +#define TYPE_SSE300 "sse-300" /* We have an IRQ splitter and an OR gate input for each external PPC * and the 2 internal PPCs diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/armsse.c +++ b/hw/arm/armsse.c @@ -XXX,XX +XXX,XX @@ static const ARMSSEDeviceInfo sse200_devices[] = { } }; +static const ARMSSEDeviceInfo sse300_devices[] = { + { + .name = "timer0", + .type = TYPE_SSE_TIMER, + .index = 0, + .addr = 0x48000000, + .ppc = 0, + .ppc_port = 0, + .irq = 3, + }, + { + .name = "timer1", + .type = TYPE_SSE_TIMER, + .index = 1, + .addr = 0x48001000, + .ppc = 0, + .ppc_port = 1, + .irq = 4, + }, + { + .name = "timer2", + .type = TYPE_SSE_TIMER, + .index = 2, + .addr = 0x48002000, + .ppc = 0, + .ppc_port = 2, + .irq = 5, + }, + { + .name = "timer3", + .type = TYPE_SSE_TIMER, + .index = 3, + .addr = 0x48003000, + .ppc = 0, + .ppc_port = 5, + .irq = 27, + }, + { + .name = "s32ktimer", + .type = TYPE_CMSDK_APB_TIMER, + .index = 0, + .addr = 0x4802f000, + .ppc = 1, + .ppc_port = 0, + .irq = 2, + .slowclk = true, + }, + { + .name = "s32kwatchdog", + .type = TYPE_CMSDK_APB_WATCHDOG, + .index = 0, + .addr = 0x4802e000, + .ppc = NO_PPC, + .irq = NMI_0, + .slowclk = true, + }, + { + .name = "watchdog", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 0, + .addr = 0x48040000, + .size = 0x2000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "armsse-sysinfo", + .type = TYPE_IOTKIT_SYSINFO, + .index = 0, + .addr = 0x48020000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "armsse-sysctl", + .type = TYPE_IOTKIT_SYSCTL, + .index = 0, + .addr = 0x58021000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "SYS_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 1, + .addr = 0x58022000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "CPU0CORE_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 2, + .addr = 0x50023000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "MGMT_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 3, + .addr = 0x50028000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = "DEBUG_PPU", + .type = TYPE_UNIMPLEMENTED_DEVICE, + .index = 4, + .addr = 0x50029000, + .size = 0x1000, + .ppc = NO_PPC, + .irq = NO_IRQ, + }, + { + .name = NULL, + } +}; + /* Is internal IRQ n shared between CPUs in a multi-core SSE ? */ static const bool sse200_irq_is_common[32] = { [0 ... 5] = true, @@ -XXX,XX +XXX,XX @@ static const bool sse200_irq_is_common[32] = { /* 30, 31: reserved */ }; +static const bool sse300_irq_is_common[32] = { + [0 ... 5] = true, + /* 6, 7: per-CPU MHU interrupts */ + [8 ... 12] = true, + /* 13: reserved */ + [14 ... 16] = true, + /* 17-25: reserved */ + [26 ... 27] = true, + /* 28, 29: per-CPU CTI interrupts */ + /* 30, 31: reserved */ +}; + static const ARMSSEInfo armsse_variants[] = { { .name = TYPE_IOTKIT, @@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = { .devinfo = sse200_devices, .irq_is_common = sse200_irq_is_common, }, + { + .name = TYPE_SSE300, + .sse_version = ARMSSE_SSE300, + .sram_banks = 2, + .num_cpus = 1, + .sys_version = 0x7e00043b, + .iidr = 0x74a0043b, + .cpuwait_rst = 0, + .has_mhus = false, + .has_cachectrl = false, + .has_cpusecctrl = true, + .has_cpuid = true, + .has_cpu_pwrctrl = true, + .has_sse_counter = true, + .props = armsse_properties, + .devinfo = sse300_devices, + .irq_is_common = sse300_irq_is_common, + }, }; static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info) -- 2.20.1 The AN547 puts the combined UART overflow IRQ at 48, not 47 like the other images. Make this setting board-specific. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-37-peter.maydell@linaro.org --- hw/arm/mps2-tz.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/mps2-tz.c +++ b/hw/arm/mps2-tz.c @@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineClass { uint32_t fpgaio_num_leds; /* Number of LEDs in FPGAIO LED0 register */ bool fpgaio_has_switches; /* Does FPGAIO have SWITCH register? */ int numirq; /* Number of external interrupts */ + int uart_overflow_irq; /* number of the combined UART overflow IRQ */ const RAMInfo *raminfo; const char *armsse_type; }; @@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine) &error_fatal); qdev_realize(DEVICE(&mms->uart_irq_orgate), NULL, &error_fatal); qdev_connect_gpio_out(DEVICE(&mms->uart_irq_orgate), 0, - get_sse_irq_in(mms, 47)); + get_sse_irq_in(mms, mmc->uart_overflow_irq)); /* Most of the devices in the FPGA are behind Peripheral Protection * Controllers. The required order for initializing things is: @@ -XXX,XX +XXX,XX @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data) mmc->fpgaio_num_leds = 2; mmc->fpgaio_has_switches = false; mmc->numirq = 92; + mmc->uart_overflow_irq = 47; mmc->raminfo = an505_raminfo; mmc->armsse_type = TYPE_IOTKIT; mps2tz_set_default_ram_info(mmc); @@ -XXX,XX +XXX,XX @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data) mmc->fpgaio_num_leds = 2; mmc->fpgaio_has_switches = false; mmc->numirq = 92; + mmc->uart_overflow_irq = 47; mmc->raminfo = an505_raminfo; /* AN521 is the same as AN505 here */ mmc->armsse_type = TYPE_SSE200; mps2tz_set_default_ram_info(mmc); @@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data) mmc->fpgaio_num_leds = 10; mmc->fpgaio_has_switches = true; mmc->numirq = 95; + mmc->uart_overflow_irq = 47; mmc->raminfo = an524_raminfo; mmc->armsse_type = TYPE_SSE200; mps2tz_set_default_ram_info(mmc); -- 2.20.1 We've already broken migration compatibility for all the MPS boards, so we might as well take advantage of this to simplify the vmstate for the FPGAIO device by folding the counters subsection into the main vmstate description. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-38-peter.maydell@linaro.org --- hw/misc/mps2-fpgaio.c | 30 +++++------------------------- 1 file changed, 5 insertions(+), 25 deletions(-) diff --git a/hw/misc/mps2-fpgaio.c b/hw/misc/mps2-fpgaio.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/mps2-fpgaio.c +++ b/hw/misc/mps2-fpgaio.c @@ -XXX,XX +XXX,XX @@ static void mps2_fpgaio_realize(DeviceState *dev, Error **errp) } } -static bool mps2_fpgaio_counters_needed(void *opaque) -{ - /* Currently vmstate.c insists all subsections have a 'needed' function */ - return true; -} - -static const VMStateDescription mps2_fpgaio_counters_vmstate = { - .name = "mps2-fpgaio/counters", +static const VMStateDescription mps2_fpgaio_vmstate = { + .name = "mps2-fpgaio", .version_id = 2, .minimum_version_id = 2, - .needed = mps2_fpgaio_counters_needed, .fields = (VMStateField[]) { + VMSTATE_UINT32(led0, MPS2FPGAIO), + VMSTATE_UINT32(prescale, MPS2FPGAIO), + VMSTATE_UINT32(misc, MPS2FPGAIO), VMSTATE_INT64(clk1hz_tick_offset, MPS2FPGAIO), VMSTATE_INT64(clk100hz_tick_offset, MPS2FPGAIO), VMSTATE_UINT32(counter, MPS2FPGAIO), VMSTATE_UINT32(pscntr, MPS2FPGAIO), VMSTATE_INT64(pscntr_sync_ticks, MPS2FPGAIO), VMSTATE_END_OF_LIST() - } -}; - -static const VMStateDescription mps2_fpgaio_vmstate = { - .name = "mps2-fpgaio", - .version_id = 1, - .minimum_version_id = 1, - .fields = (VMStateField[]) { - VMSTATE_UINT32(led0, MPS2FPGAIO), - VMSTATE_UINT32(prescale, MPS2FPGAIO), - VMSTATE_UINT32(misc, MPS2FPGAIO), - VMSTATE_END_OF_LIST() }, - .subsections = (const VMStateDescription*[]) { - &mps2_fpgaio_counters_vmstate, - NULL - } }; static Property mps2_fpgaio_properties[] = { -- 2.20.1 For the AN547 image, the FPGAIO block has an extra DBGCTRL register, which is used to control the SPNIDEN, SPIDEN, NPIDEN and DBGEN inputs to the CPU. These signals control when the CPU permits use of the external debug interface. Our CPU models don't implement the external debug interface, so we model the register as reads-as-written. Implement the register, with a property defining whether it is present, and allow mps2-tz boards to specify that it is present. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-39-peter.maydell@linaro.org --- include/hw/misc/mps2-fpgaio.h | 2 ++ hw/arm/mps2-tz.c | 5 +++++ hw/misc/mps2-fpgaio.c | 22 ++++++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) diff --git a/include/hw/misc/mps2-fpgaio.h b/include/hw/misc/mps2-fpgaio.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/misc/mps2-fpgaio.h +++ b/include/hw/misc/mps2-fpgaio.h @@ -XXX,XX +XXX,XX @@ struct MPS2FPGAIO { LEDState *led[MPS2FPGAIO_MAX_LEDS]; uint32_t num_leds; bool has_switches; + bool has_dbgctrl; uint32_t led0; uint32_t prescale; uint32_t misc; + uint32_t dbgctrl; /* QEMU_CLOCK_VIRTUAL time at which counter and pscntr were last synced */ int64_t pscntr_sync_ticks; diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/mps2-tz.c +++ b/hw/arm/mps2-tz.c @@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineClass { const uint32_t *oscclk; uint32_t fpgaio_num_leds; /* Number of LEDs in FPGAIO LED0 register */ bool fpgaio_has_switches; /* Does FPGAIO have SWITCH register? */ + bool fpgaio_has_dbgctrl; /* Does FPGAIO have DBGCTRL register? */ int numirq; /* Number of external interrupts */ int uart_overflow_irq; /* number of the combined UART overflow IRQ */ const RAMInfo *raminfo; @@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque, object_initialize_child(OBJECT(mms), "fpgaio", fpgaio, TYPE_MPS2_FPGAIO); qdev_prop_set_uint32(DEVICE(fpgaio), "num-leds", mmc->fpgaio_num_leds); qdev_prop_set_bit(DEVICE(fpgaio), "has-switches", mmc->fpgaio_has_switches); + qdev_prop_set_bit(DEVICE(fpgaio), "has-dbgctrl", mmc->fpgaio_has_dbgctrl); sysbus_realize(SYS_BUS_DEVICE(fpgaio), &error_fatal); return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0); } @@ -XXX,XX +XXX,XX @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data) mmc->len_oscclk = ARRAY_SIZE(an505_oscclk); mmc->fpgaio_num_leds = 2; mmc->fpgaio_has_switches = false; + mmc->fpgaio_has_dbgctrl = false; mmc->numirq = 92; mmc->uart_overflow_irq = 47; mmc->raminfo = an505_raminfo; @@ -XXX,XX +XXX,XX @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data) mmc->len_oscclk = ARRAY_SIZE(an505_oscclk); mmc->fpgaio_num_leds = 2; mmc->fpgaio_has_switches = false; + mmc->fpgaio_has_dbgctrl = false; mmc->numirq = 92; mmc->uart_overflow_irq = 47; mmc->raminfo = an505_raminfo; /* AN521 is the same as AN505 here */ @@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data) mmc->len_oscclk = ARRAY_SIZE(an524_oscclk); mmc->fpgaio_num_leds = 10; mmc->fpgaio_has_switches = true; + mmc->fpgaio_has_dbgctrl = false; mmc->numirq = 95; mmc->uart_overflow_irq = 47; mmc->raminfo = an524_raminfo; diff --git a/hw/misc/mps2-fpgaio.c b/hw/misc/mps2-fpgaio.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/mps2-fpgaio.c +++ b/hw/misc/mps2-fpgaio.c @@ -XXX,XX +XXX,XX @@ #include "qemu/timer.h" REG32(LED0, 0) +REG32(DBGCTRL, 4) REG32(BUTTON, 8) REG32(CLK1HZ, 0x10) REG32(CLK100HZ, 0x14) @@ -XXX,XX +XXX,XX @@ static uint64_t mps2_fpgaio_read(void *opaque, hwaddr offset, unsigned size) case A_LED0: r = s->led0; break; + case A_DBGCTRL: + if (!s->has_dbgctrl) { + goto bad_offset; + } + r = s->dbgctrl; + break; case A_BUTTON: /* User-pressable board buttons. We don't model that, so just return * zeroes. @@ -XXX,XX +XXX,XX @@ static void mps2_fpgaio_write(void *opaque, hwaddr offset, uint64_t value, } } break; + case A_DBGCTRL: + if (!s->has_dbgctrl) { + goto bad_offset; + } + qemu_log_mask(LOG_UNIMP, + "MPS2 FPGAIO: DBGCTRL unimplemented\n"); + s->dbgctrl = value; + break; case A_PRESCALE: resync_counter(s); s->prescale = value; @@ -XXX,XX +XXX,XX @@ static void mps2_fpgaio_write(void *opaque, hwaddr offset, uint64_t value, s->pscntr = value; break; default: + bad_offset: qemu_log_mask(LOG_GUEST_ERROR, "MPS2 FPGAIO write: bad offset 0x%x\n", (int) offset); break; @@ -XXX,XX +XXX,XX @@ static void mps2_fpgaio_realize(DeviceState *dev, Error **errp) static const VMStateDescription mps2_fpgaio_vmstate = { .name = "mps2-fpgaio", - .version_id = 2, - .minimum_version_id = 2, + .version_id = 3, + .minimum_version_id = 3, .fields = (VMStateField[]) { VMSTATE_UINT32(led0, MPS2FPGAIO), VMSTATE_UINT32(prescale, MPS2FPGAIO), VMSTATE_UINT32(misc, MPS2FPGAIO), + VMSTATE_UINT32(dbgctrl, MPS2FPGAIO), VMSTATE_INT64(clk1hz_tick_offset, MPS2FPGAIO), VMSTATE_INT64(clk100hz_tick_offset, MPS2FPGAIO), VMSTATE_UINT32(counter, MPS2FPGAIO), @@ -XXX,XX +XXX,XX @@ static Property mps2_fpgaio_properties[] = { /* Number of LEDs controlled by LED0 register */ DEFINE_PROP_UINT32("num-leds", MPS2FPGAIO, num_leds, 2), DEFINE_PROP_BOOL("has-switches", MPS2FPGAIO, has_switches, false), + DEFINE_PROP_BOOL("has-dbgctrl", MPS2FPGAIO, has_dbgctrl, false), DEFINE_PROP_END_OF_LIST(), }; -- 2.20.1 Implement the minor changes required to the SCC block for AN547 images: * CFG2 and CFG5 exist (like AN524) * CFG3 is reserved (like AN524) * CFG0 bit 1 is CPU_WAIT; we don't implement it, but note this in the TODO comment Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-40-peter.maydell@linaro.org --- hw/misc/mps2-scc.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/hw/misc/mps2-scc.c b/hw/misc/mps2-scc.c index XXXXXXX..XXXXXXX 100644 --- a/hw/misc/mps2-scc.c +++ b/hw/misc/mps2-scc.c @@ -XXX,XX +XXX,XX @@ static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size) r = s->cfg1; break; case A_CFG2: - if (scc_partno(s) != 0x524) { + if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { /* CFG2 reserved on other boards */ goto bad_offset; } r = s->cfg2; break; case A_CFG3: - if (scc_partno(s) == 0x524) { + if (scc_partno(s) == 0x524 && scc_partno(s) == 0x547) { /* CFG3 reserved on AN524 */ goto bad_offset; } @@ -XXX,XX +XXX,XX @@ static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size) r = s->cfg4; break; case A_CFG5: - if (scc_partno(s) != 0x524) { + if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { /* CFG5 reserved on other boards */ goto bad_offset; } @@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value, switch (offset) { case A_CFG0: - /* TODO on some boards bit 0 controls RAM remapping */ + /* + * TODO on some boards bit 0 controls RAM remapping; + * on others bit 1 is CPU_WAIT. + */ s->cfg0 = value; break; case A_CFG1: @@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value, } break; case A_CFG2: - if (scc_partno(s) != 0x524) { + if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { /* CFG2 reserved on other boards */ goto bad_offset; } @@ -XXX,XX +XXX,XX @@ static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value, s->cfg2 = value; break; case A_CFG5: - if (scc_partno(s) != 0x524) { + if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { /* CFG5 reserved on other boards */ goto bad_offset; } -- 2.20.1 The AN547 runs the APB peripherals outside the SSE-300 on a different and slightly slower clock than it runs the SSE-300 with. Support making the APB peripheral clock frequency board-specific. (For our implementation only the UARTs actually take a clock.) Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-41-peter.maydell@linaro.org --- hw/arm/mps2-tz.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/mps2-tz.c +++ b/hw/arm/mps2-tz.c @@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineClass { MPS2TZFPGAType fpga_type; uint32_t scc_id; uint32_t sysclk_frq; /* Main SYSCLK frequency in Hz */ + uint32_t apb_periph_frq; /* APB peripheral frequency in Hz */ uint32_t len_oscclk; const uint32_t *oscclk; uint32_t fpgaio_num_leds; /* Number of LEDs in FPGAIO LED0 register */ @@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque, object_initialize_child(OBJECT(mms), name, uart, TYPE_CMSDK_APB_UART); qdev_prop_set_chr(DEVICE(uart), "chardev", serial_hd(i)); - qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", mmc->sysclk_frq); + qdev_prop_set_uint32(DEVICE(uart), "pclk-frq", mmc->apb_periph_frq); sysbus_realize(SYS_BUS_DEVICE(uart), &error_fatal); s = SYS_BUS_DEVICE(uart); sysbus_connect_irq(s, 0, get_sse_irq_in(mms, irqs[0])); @@ -XXX,XX +XXX,XX @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data) mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33"); mmc->scc_id = 0x41045050; mmc->sysclk_frq = 20 * 1000 * 1000; /* 20MHz */ + mmc->apb_periph_frq = mmc->sysclk_frq; mmc->oscclk = an505_oscclk; mmc->len_oscclk = ARRAY_SIZE(an505_oscclk); mmc->fpgaio_num_leds = 2; @@ -XXX,XX +XXX,XX @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data) mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33"); mmc->scc_id = 0x41045210; mmc->sysclk_frq = 20 * 1000 * 1000; /* 20MHz */ + mmc->apb_periph_frq = mmc->sysclk_frq; mmc->oscclk = an505_oscclk; /* AN521 is the same as AN505 here */ mmc->len_oscclk = ARRAY_SIZE(an505_oscclk); mmc->fpgaio_num_leds = 2; @@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data) mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m33"); mmc->scc_id = 0x41045240; mmc->sysclk_frq = 32 * 1000 * 1000; /* 32MHz */ + mmc->apb_periph_frq = mmc->sysclk_frq; mmc->oscclk = an524_oscclk; mmc->len_oscclk = ARRAY_SIZE(an524_oscclk); mmc->fpgaio_num_leds = 10; -- 2.20.1 The AN547 configures the SSE-300 with a different initsvtor0 setting from its default; make this a board-specific setting. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-42-peter.maydell@linaro.org --- hw/arm/mps2-tz.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/mps2-tz.c +++ b/hw/arm/mps2-tz.c @@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineClass { bool fpgaio_has_dbgctrl; /* Does FPGAIO have DBGCTRL register? */ int numirq; /* Number of external interrupts */ int uart_overflow_irq; /* number of the combined UART overflow IRQ */ + uint32_t init_svtor; /* init-svtor setting for SSE */ const RAMInfo *raminfo; const char *armsse_type; }; @@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine) object_property_set_link(OBJECT(&mms->iotkit), "memory", OBJECT(system_memory), &error_abort); qdev_prop_set_uint32(iotkitdev, "EXP_NUMIRQ", mmc->numirq); + qdev_prop_set_uint32(iotkitdev, "init-svtor", mmc->init_svtor); qdev_connect_clock_in(iotkitdev, "MAINCLK", mms->sysclk); qdev_connect_clock_in(iotkitdev, "S32KCLK", mms->s32kclk); sysbus_realize(SYS_BUS_DEVICE(&mms->iotkit), &error_fatal); @@ -XXX,XX +XXX,XX @@ static void mps2tz_an505_class_init(ObjectClass *oc, void *data) mmc->fpgaio_has_dbgctrl = false; mmc->numirq = 92; mmc->uart_overflow_irq = 47; + mmc->init_svtor = 0x10000000; mmc->raminfo = an505_raminfo; mmc->armsse_type = TYPE_IOTKIT; mps2tz_set_default_ram_info(mmc); @@ -XXX,XX +XXX,XX @@ static void mps2tz_an521_class_init(ObjectClass *oc, void *data) mmc->fpgaio_has_dbgctrl = false; mmc->numirq = 92; mmc->uart_overflow_irq = 47; + mmc->init_svtor = 0x10000000; mmc->raminfo = an505_raminfo; /* AN521 is the same as AN505 here */ mmc->armsse_type = TYPE_SSE200; mps2tz_set_default_ram_info(mmc); @@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data) mmc->fpgaio_has_dbgctrl = false; mmc->numirq = 95; mmc->uart_overflow_irq = 47; + mmc->init_svtor = 0x10000000; mmc->raminfo = an524_raminfo; mmc->armsse_type = TYPE_SSE200; mps2tz_set_default_ram_info(mmc); -- 2.20.1 Add support for the mps3-an547 board; this is an SSE-300 based FPGA image that runs on the MPS3. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20210219144617.4782-43-peter.maydell@linaro.org --- hw/arm/mps2-tz.c | 146 ++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 144 insertions(+), 2 deletions(-) diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/mps2-tz.c +++ b/hw/arm/mps2-tz.c @@ -XXX,XX +XXX,XX @@ * "mps2-an505" -- Cortex-M33 as documented in ARM Application Note AN505 * "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521 * "mps2-an524" -- Dual Cortex-M33 as documented in Application Note AN524 + * "mps2-an547" -- Single Cortex-M55 as documented in Application Note AN547 * * Links to the TRM for the board itself and to the various Application * Notes which document the FPGA images can be found here: @@ -XXX,XX +XXX,XX @@ * https://developer.arm.com/documentation/dai0521/latest/ * Application Note AN524: * https://developer.arm.com/documentation/dai0524/latest/ + * Application Note AN547: + * https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/DAI0547B_SSE300_PLUS_U55_FPGA_for_mps3.pdf * * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide * (ARM ECM0601256) for the details of some of the device layout: @@ -XXX,XX +XXX,XX @@ * Similarly, the AN521 and AN524 use the SSE-200, and the SSE-200 TRM defines * most of the device layout: * https://developer.arm.com/documentation/101104/latest/ + * and the AN547 uses the SSE-300, whose layout is in the SSE-300 TRM: + * https://developer.arm.com/documentation/101773/latest/ */ #include "qemu/osdep.h" @@ -XXX,XX +XXX,XX @@ #include "hw/qdev-clock.h" #include "qom/object.h" -#define MPS2TZ_NUMIRQ_MAX 95 -#define MPS2TZ_RAM_MAX 4 +#define MPS2TZ_NUMIRQ_MAX 96 +#define MPS2TZ_RAM_MAX 5 typedef enum MPS2TZFPGAType { FPGA_AN505, FPGA_AN521, FPGA_AN524, + FPGA_AN547, } MPS2TZFPGAType; /* @@ -XXX,XX +XXX,XX @@ struct MPS2TZMachineState { #define TYPE_MPS2TZ_AN505_MACHINE MACHINE_TYPE_NAME("mps2-an505") #define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521") #define TYPE_MPS3TZ_AN524_MACHINE MACHINE_TYPE_NAME("mps3-an524") +#define TYPE_MPS3TZ_AN547_MACHINE MACHINE_TYPE_NAME("mps3-an547") OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE) @@ -XXX,XX +XXX,XX @@ static const RAMInfo an524_raminfo[] = { { }, }; +static const RAMInfo an547_raminfo[] = { { + .name = "itcm", + .base = 0x00000000, + .size = 512 * KiB, + .mpc = -1, + .mrindex = 0, + }, { + .name = "sram", + .base = 0x01000000, + .size = 2 * MiB, + .mpc = 0, + .mrindex = 1, + }, { + .name = "dtcm", + .base = 0x20000000, + .size = 4 * 128 * KiB, + .mpc = -1, + .mrindex = 2, + }, { + .name = "sram 2", + .base = 0x21000000, + .size = 4 * MiB, + .mpc = -1, + .mrindex = 3, + }, { + /* We don't model QSPI flash yet; for now expose it as simple ROM */ + .name = "QSPI", + .base = 0x28000000, + .size = 8 * MiB, + .mpc = 1, + .mrindex = 4, + .flags = IS_ROM, + }, { + .name = "DDR", + .base = 0x60000000, + .size = MPS3_DDR_SIZE, + .mpc = 2, + .mrindex = -1, + }, { + .name = NULL, + }, +}; + static const RAMInfo *find_raminfo_for_mpc(MPS2TZMachineState *mms, int mpc) { MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms); @@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine) }, }; + const PPCInfo an547_ppcs[] = { { + .name = "apb_ppcexp0", + .ports = { + { "ssram-mpc", make_mpc, &mms->mpc[0], 0x57000000, 0x1000 }, + { "qspi-mpc", make_mpc, &mms->mpc[1], 0x57001000, 0x1000 }, + { "ddr-mpc", make_mpc, &mms->mpc[2], 0x57002000, 0x1000 }, + }, + }, { + .name = "apb_ppcexp1", + .ports = { + { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 }, + { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 }, + { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } }, + { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } }, + { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } }, + { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 }, + { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 }, + { /* port 7 reserved */ }, + { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 }, + }, + }, { + .name = "apb_ppcexp2", + .ports = { + { "scc", make_scc, &mms->scc, 0x49300000, 0x1000 }, + { "i2s-audio", make_unimp_dev, &mms->i2s_audio, 0x49301000, 0x1000 }, + { "fpgaio", make_fpgaio, &mms->fpgaio, 0x49302000, 0x1000 }, + { "uart0", make_uart, &mms->uart[0], 0x49303000, 0x1000, { 33, 34, 43 } }, + { "uart1", make_uart, &mms->uart[1], 0x49304000, 0x1000, { 35, 36, 44 } }, + { "uart2", make_uart, &mms->uart[2], 0x49305000, 0x1000, { 37, 38, 45 } }, + { "uart3", make_uart, &mms->uart[3], 0x49306000, 0x1000, { 39, 40, 46 } }, + { "uart4", make_uart, &mms->uart[4], 0x49307000, 0x1000, { 41, 42, 47 } }, + { "uart5", make_uart, &mms->uart[5], 0x49308000, 0x1000, { 125, 126, 127 } }, + + { /* port 9 reserved */ }, + { "clcd", make_unimp_dev, &mms->cldc, 0x4930a000, 0x1000 }, + { "rtc", make_rtc, &mms->rtc, 0x4930b000, 0x1000 }, + }, + }, { + .name = "ahb_ppcexp0", + .ports = { + { "gpio0", make_unimp_dev, &mms->gpio[0], 0x41100000, 0x1000 }, + { "gpio1", make_unimp_dev, &mms->gpio[1], 0x41101000, 0x1000 }, + { "gpio2", make_unimp_dev, &mms->gpio[2], 0x41102000, 0x1000 }, + { "gpio3", make_unimp_dev, &mms->gpio[3], 0x41103000, 0x1000 }, + { "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 49 } }, + }, + }, + }; + switch (mmc->fpga_type) { case FPGA_AN505: case FPGA_AN521: @@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine) ppcs = an524_ppcs; num_ppcs = ARRAY_SIZE(an524_ppcs); break; + case FPGA_AN547: + ppcs = an547_ppcs; + num_ppcs = ARRAY_SIZE(an547_ppcs); + break; default: g_assert_not_reached(); } @@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine) create_unimplemented_device("FPGA NS PC", 0x48007000, 0x1000); + if (mmc->fpga_type == FPGA_AN547) { + create_unimplemented_device("U55 timing adapter 0", 0x48102000, 0x1000); + create_unimplemented_device("U55 timing adapter 1", 0x48103000, 0x1000); + } + create_non_mpc_ram(mms); armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, @@ -XXX,XX +XXX,XX @@ static void mps3tz_an524_class_init(ObjectClass *oc, void *data) mps2tz_set_default_ram_info(mmc); } +static void mps3tz_an547_class_init(ObjectClass *oc, void *data) +{ + MachineClass *mc = MACHINE_CLASS(oc); + MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc); + + mc->desc = "ARM MPS3 with AN547 FPGA image for Cortex-M55"; + mc->default_cpus = 1; + mc->min_cpus = mc->default_cpus; + mc->max_cpus = mc->default_cpus; + mmc->fpga_type = FPGA_AN547; + mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m55"); + mmc->scc_id = 0x41055470; + mmc->sysclk_frq = 32 * 1000 * 1000; /* 32MHz */ + mmc->apb_periph_frq = 25 * 1000 * 1000; /* 25MHz */ + mmc->oscclk = an524_oscclk; /* same as AN524 */ + mmc->len_oscclk = ARRAY_SIZE(an524_oscclk); + mmc->fpgaio_num_leds = 10; + mmc->fpgaio_has_switches = true; + mmc->fpgaio_has_dbgctrl = true; + mmc->numirq = 96; + mmc->uart_overflow_irq = 48; + mmc->init_svtor = 0x00000000; + mmc->raminfo = an547_raminfo; + mmc->armsse_type = TYPE_SSE300; + mps2tz_set_default_ram_info(mmc); +} + static const TypeInfo mps2tz_info = { .name = TYPE_MPS2TZ_MACHINE, .parent = TYPE_MACHINE, @@ -XXX,XX +XXX,XX @@ static const TypeInfo mps3tz_an524_info = { .class_init = mps3tz_an524_class_init, }; +static const TypeInfo mps3tz_an547_info = { + .name = TYPE_MPS3TZ_AN547_MACHINE, + .parent = TYPE_MPS2TZ_MACHINE, + .class_init = mps3tz_an547_class_init, +}; + static void mps2tz_machine_init(void) { type_register_static(&mps2tz_info); type_register_static(&mps2tz_an505_info); type_register_static(&mps2tz_an521_info); type_register_static(&mps3tz_an524_info); + type_register_static(&mps3tz_an547_info); } type_init(mps2tz_machine_init); -- 2.20.1 Add brief documentation of the new mps3-an547 board. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219144617.4782-44-peter.maydell@linaro.org --- docs/system/arm/mps2.rst | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst index XXXXXXX..XXXXXXX 100644 --- a/docs/system/arm/mps2.rst +++ b/docs/system/arm/mps2.rst @@ -XXX,XX +XXX,XX @@ -Arm MPS2 and MPS3 boards (``mps2-an385``, ``mps2-an386``, ``mps2-an500``, ``mps2-an505``, ``mps2-an511``, ``mps2-an521``, ``mps3-an524``) -========================================================================================================================================= +Arm MPS2 and MPS3 boards (``mps2-an385``, ``mps2-an386``, ``mps2-an500``, ``mps2-an505``, ``mps2-an511``, ``mps2-an521``, ``mps3-an524``, ``mps3-an547``) +========================================================================================================================================================= These board models all use Arm M-profile CPUs. @@ -XXX,XX +XXX,XX @@ QEMU models the following FPGA images: Dual Cortex-M33 as documented in Arm Application Note AN521 ``mps3-an524`` Dual Cortex-M33 on an MPS3, as documented in Arm Application Note AN524 +``mps3-an547`` + Cortex-M55 on an MPS3, as documented in Arm Application Note AN547 Differences between QEMU and real hardware: -- 2.20.1 Add a simple qtest to exercise the new system counter device in the SSE-300. We'll add tests of the system timer device here too, so this includes scaffolding (register definitions, etc) for those. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219144617.4782-45-peter.maydell@linaro.org --- tests/qtest/sse-timer-test.c | 117 +++++++++++++++++++++++++++++++++++ MAINTAINERS | 1 + tests/qtest/meson.build | 1 + 3 files changed, 119 insertions(+) create mode 100644 tests/qtest/sse-timer-test.c diff --git a/tests/qtest/sse-timer-test.c b/tests/qtest/sse-timer-test.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/tests/qtest/sse-timer-test.c @@ -XXX,XX +XXX,XX @@ +/* + * QTest testcase for the SSE timer device + * + * Copyright (c) 2021 Linaro Limited + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "qemu/osdep.h" +#include "libqtest-single.h" + +/* + * SSE-123/SSE-300 timer in the mps3-an547 board, where it is driven + * at 32MHz, so 31.25ns per tick. + */ +#define TIMER_BASE 0x48000000 + +/* PERIPHNSPPC0 register in the SSE-300 Secure Access Configuration block */ +#define PERIPHNSPPC0 (0x50080000 + 0x70) + +/* Base of the System Counter control frame */ +#define COUNTER_BASE 0x58100000 + +/* SSE counter register offsets in the control frame */ +#define CNTCR 0 +#define CNTSR 0x4 +#define CNTCV_LO 0x8 +#define CNTCV_HI 0xc +#define CNTSCR 0x10 + +/* SSE timer register offsets */ +#define CNTPCT_LO 0 +#define CNTPCT_HI 4 +#define CNTFRQ 0x10 +#define CNTP_CVAL_LO 0x20 +#define CNTP_CVAL_HI 0x24 +#define CNTP_TVAL 0x28 +#define CNTP_CTL 0x2c +#define CNTP_AIVAL_LO 0x40 +#define CNTP_AIVAL_HI 0x44 +#define CNTP_AIVAL_RELOAD 0x48 +#define CNTP_AIVAL_CTL 0x4c + +/* 4 ticks in nanoseconds (so we can work in integers) */ +#define FOUR_TICKS 125 + +static void clock_step_ticks(uint64_t ticks) +{ + /* + * Advance the qtest clock by however many nanoseconds we + * need to move the timer forward the specified number of ticks. + * ticks must be a multiple of 4, so we get a whole number of ns. + */ + assert(!(ticks & 3)); + clock_step(FOUR_TICKS * (ticks >> 2)); +} + +static void reset_counter_and_timer(void) +{ + /* + * Reset the system counter and the timer between tests. This + * isn't a full reset, but it's sufficient for what the tests check. + */ + writel(COUNTER_BASE + CNTCR, 0); + writel(TIMER_BASE + CNTP_CTL, 0); + writel(TIMER_BASE + CNTP_AIVAL_CTL, 0); + writel(COUNTER_BASE + CNTCV_LO, 0); + writel(COUNTER_BASE + CNTCV_HI, 0); +} + +static void test_counter(void) +{ + /* Basic counter functionality test */ + + reset_counter_and_timer(); + /* The counter should start disabled: check that it doesn't move */ + clock_step_ticks(100); + g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_LO), ==, 0); + g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_HI), ==, 0); + /* Now enable it and check that it does count */ + writel(COUNTER_BASE + CNTCR, 1); + clock_step_ticks(100); + g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_LO), ==, 100); + g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_HI), ==, 0); + /* Check the counter scaling functionality */ + writel(COUNTER_BASE + CNTCR, 0); + writel(COUNTER_BASE + CNTSCR, 0x00100000); /* 1/16th normal speed */ + writel(COUNTER_BASE + CNTCR, 5); /* EN, SCEN */ + clock_step_ticks(160); + g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_LO), ==, 110); + g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_HI), ==, 0); +} + +int main(int argc, char **argv) +{ + int r; + + g_test_init(&argc, &argv, NULL); + + qtest_start("-machine mps3-an547"); + + qtest_add_func("/sse-timer/counter", test_counter); + + r = g_test_run(); + + qtest_end(); + + return r; +} diff --git a/MAINTAINERS b/MAINTAINERS index XXXXXXX..XXXXXXX 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -XXX,XX +XXX,XX @@ F: hw/timer/sse-counter.c F: include/hw/timer/sse-counter.h F: hw/timer/sse-timer.c F: include/hw/timer/sse-timer.h +F: tests/qtest/sse-timer-test.c F: docs/system/arm/mps2.rst Musca diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/meson.build +++ b/tests/qtest/meson.build @@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \ 'npcm7xx_watchdog_timer-test'] + \ (slirp.found() ? ['npcm7xx_emc-test'] : []) qtests_arm = \ + (config_all_devices.has_key('CONFIG_MPS2') ? ['sse-timer-test'] : []) + \ (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \ (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \ (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \ -- 2.20.1 Add a test which tests various parts of the functionality of the SSE system timer. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> --- tests/qtest/sse-timer-test.c | 91 ++++++++++++++++++++++++++++++++++++ 1 file changed, 91 insertions(+) diff --git a/tests/qtest/sse-timer-test.c b/tests/qtest/sse-timer-test.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/sse-timer-test.c +++ b/tests/qtest/sse-timer-test.c @@ -XXX,XX +XXX,XX @@ static void test_counter(void) g_assert_cmpuint(readl(COUNTER_BASE + CNTCV_HI), ==, 0); } +static void test_timer(void) +{ + /* Basic timer functionality test */ + + reset_counter_and_timer(); + /* + * The timer is behind a Peripheral Protection Controller, and + * qtest accesses are always non-secure (no memory attributes), + * so we must program the PPC to accept NS transactions. TIMER0 + * is on port 0 of PPC0, controlled by bit 0 of this register. + */ + writel(PERIPHNSPPC0, 1); + /* We must enable the System Counter or the timer won't run. */ + writel(COUNTER_BASE + CNTCR, 1); + + /* Timer starts disabled and with a counter of 0 */ + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 0); + g_assert_cmpuint(readl(TIMER_BASE + CNTPCT_LO), ==, 0); + g_assert_cmpuint(readl(TIMER_BASE + CNTPCT_HI), ==, 0); + + /* Turn it on */ + writel(TIMER_BASE + CNTP_CTL, 1); + + /* Is the timer ticking? */ + clock_step_ticks(100); + g_assert_cmpuint(readl(TIMER_BASE + CNTPCT_LO), ==, 100); + g_assert_cmpuint(readl(TIMER_BASE + CNTPCT_HI), ==, 0); + + /* Set the CompareValue to 4000 ticks */ + writel(TIMER_BASE + CNTP_CVAL_LO, 4000); + writel(TIMER_BASE + CNTP_CVAL_HI, 0); + + /* Check TVAL view of the counter */ + g_assert_cmpuint(readl(TIMER_BASE + CNTP_TVAL), ==, 3900); + + /* Advance to the CompareValue mark and check ISTATUS is set */ + clock_step_ticks(3900); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_TVAL), ==, 0); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 5); + + /* Now exercise the auto-reload part of the timer */ + writel(TIMER_BASE + CNTP_AIVAL_RELOAD, 200); + writel(TIMER_BASE + CNTP_AIVAL_CTL, 1); + + /* Check AIVAL was reloaded and that ISTATUS is now clear */ + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_LO), ==, 4200); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_HI), ==, 0); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 1); + + /* + * Check that when we advance forward to the reload time the interrupt + * fires and the value reloads + */ + clock_step_ticks(100); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 1); + clock_step_ticks(100); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 5); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_LO), ==, 4400); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_HI), ==, 0); + + clock_step_ticks(100); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 5); + /* Check that writing 0 to CLR clears the interrupt */ + writel(TIMER_BASE + CNTP_AIVAL_CTL, 1); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 1); + /* Check that when we move forward to the reload time it fires again */ + clock_step_ticks(100); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 5); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_LO), ==, 4600); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_HI), ==, 0); + + /* + * Step the clock far enough that we overflow the low half of the + * CNTPCT and AIVAL registers, and check that their high halves + * give the right values. We do the forward movement in + * non-autoinc mode because otherwise it takes forever as the + * timer has to emulate all the 'reload at t + N, t + 2N, etc' + * steps. + */ + writel(TIMER_BASE + CNTP_AIVAL_CTL, 0); + clock_step_ticks(0x42ULL << 32); + g_assert_cmpuint(readl(TIMER_BASE + CNTPCT_LO), ==, 4400); + g_assert_cmpuint(readl(TIMER_BASE + CNTPCT_HI), ==, 0x42); + + /* Turn on the autoinc again to check AIVAL_HI */ + writel(TIMER_BASE + CNTP_AIVAL_CTL, 1); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_LO), ==, 4600); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_HI), ==, 0x42); +} + int main(int argc, char **argv) { int r; @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv) qtest_start("-machine mps3-an547"); qtest_add_func("/sse-timer/counter", test_counter); + qtest_add_func("/sse-timer/timer", test_timer); r = g_test_run(); -- 2.20.1 Test that when we change the scaling of the system counter that the system timer responds appropriately. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> --- tests/qtest/sse-timer-test.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/tests/qtest/sse-timer-test.c b/tests/qtest/sse-timer-test.c index XXXXXXX..XXXXXXX 100644 --- a/tests/qtest/sse-timer-test.c +++ b/tests/qtest/sse-timer-test.c @@ -XXX,XX +XXX,XX @@ static void test_timer(void) g_assert_cmpuint(readl(TIMER_BASE + CNTP_AIVAL_HI), ==, 0x42); } +static void test_timer_scale_change(void) +{ + /* + * Test that the timer responds correctly to counter + * scaling changes while it has an active timer. + */ + reset_counter_and_timer(); + /* Give ourselves access to the timer, and enable the counter and timer */ + writel(PERIPHNSPPC0, 1); + writel(COUNTER_BASE + CNTCR, 1); + writel(TIMER_BASE + CNTP_CTL, 1); + /* Set the CompareValue to 4000 ticks */ + writel(TIMER_BASE + CNTP_CVAL_LO, 4000); + writel(TIMER_BASE + CNTP_CVAL_HI, 0); + /* Advance halfway and check ISTATUS is not set */ + clock_step_ticks(2000); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 1); + /* Reprogram the counter to run at 1/16th speed */ + writel(COUNTER_BASE + CNTCR, 0); + writel(COUNTER_BASE + CNTSCR, 0x00100000); /* 1/16th normal speed */ + writel(COUNTER_BASE + CNTCR, 5); /* EN, SCEN */ + /* Advance to where the timer would have fired and check it has not */ + clock_step_ticks(2000); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 1); + /* Advance to where the timer must fire at the new clock rate */ + clock_step_ticks(29996); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 1); + clock_step_ticks(4); + g_assert_cmpuint(readl(TIMER_BASE + CNTP_CTL), ==, 5); +} + int main(int argc, char **argv) { int r; @@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv) qtest_add_func("/sse-timer/counter", test_counter); qtest_add_func("/sse-timer/timer", test_timer); + qtest_add_func("/sse-timer/timer-scale-change", test_timer_scale_change); r = g_test_run(); -- 2.20.1 From: Philippe Mathieu-Daudé <f4bug@amsat.org> KVM requires the target cpu to be at least ARMv8 architecture (support on ARMv7 has been dropped in commit 82bf7ae84ce: "target/arm: Remove KVM support for 32-bit Arm hosts"). A KVM-only build won't be able to run TCG cpus, move the v7A CPU definitions to cpu_tcg.c. Reported-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210306151801.2388182-1-f4bug@amsat.org Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- target/arm/cpu.c | 335 ------------------------------------------- target/arm/cpu_tcg.c | 318 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 318 insertions(+), 335 deletions(-) diff --git a/target/arm/cpu.c b/target/arm/cpu.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -XXX,XX +XXX,XX @@ static ObjectClass *arm_cpu_class_by_name(const char *cpu_model) return oc; } -/* CPU models. These are not needed for the AArch64 linux-user build. */ -#if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64) - -static const ARMCPRegInfo cortexa8_cp_reginfo[] = { - { .name = "L2LOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 0, - .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, - { .name = "L2AUXCR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 2, - .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, - REGINFO_SENTINEL -}; - -static void cortex_a8_initfn(Object *obj) -{ - ARMCPU *cpu = ARM_CPU(obj); - - cpu->dtb_compatible = "arm,cortex-a8"; - set_feature(&cpu->env, ARM_FEATURE_V7); - set_feature(&cpu->env, ARM_FEATURE_NEON); - set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); - set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS); - set_feature(&cpu->env, ARM_FEATURE_EL3); - cpu->midr = 0x410fc080; - cpu->reset_fpsid = 0x410330c0; - cpu->isar.mvfr0 = 0x11110222; - cpu->isar.mvfr1 = 0x00011111; - cpu->ctr = 0x82048004; - cpu->reset_sctlr = 0x00c50078; - cpu->isar.id_pfr0 = 0x1031; - cpu->isar.id_pfr1 = 0x11; - cpu->isar.id_dfr0 = 0x400; - cpu->id_afr0 = 0; - cpu->isar.id_mmfr0 = 0x31100003; - cpu->isar.id_mmfr1 = 0x20000000; - cpu->isar.id_mmfr2 = 0x01202000; - cpu->isar.id_mmfr3 = 0x11; - cpu->isar.id_isar0 = 0x00101111; - cpu->isar.id_isar1 = 0x12112111; - cpu->isar.id_isar2 = 0x21232031; - cpu->isar.id_isar3 = 0x11112131; - cpu->isar.id_isar4 = 0x00111142; - cpu->isar.dbgdidr = 0x15141000; - cpu->clidr = (1 << 27) | (2 << 24) | 3; - cpu->ccsidr[0] = 0xe007e01a; /* 16k L1 dcache. */ - cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */ - cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */ - cpu->reset_auxcr = 2; - define_arm_cp_regs(cpu, cortexa8_cp_reginfo); -} - -static const ARMCPRegInfo cortexa9_cp_reginfo[] = { - /* - * power_control should be set to maximum latency. Again, - * default to 0 and set by private hook - */ - { .name = "A9_PWRCTL", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, - .access = PL1_RW, .resetvalue = 0, - .fieldoffset = offsetof(CPUARMState, cp15.c15_power_control) }, - { .name = "A9_DIAG", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 1, - .access = PL1_RW, .resetvalue = 0, - .fieldoffset = offsetof(CPUARMState, cp15.c15_diagnostic) }, - { .name = "A9_PWRDIAG", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 2, - .access = PL1_RW, .resetvalue = 0, - .fieldoffset = offsetof(CPUARMState, cp15.c15_power_diagnostic) }, - { .name = "NEONBUSY", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, - .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, - /* TLB lockdown control */ - { .name = "TLB_LOCKR", .cp = 15, .crn = 15, .crm = 4, .opc1 = 5, .opc2 = 2, - .access = PL1_W, .resetvalue = 0, .type = ARM_CP_NOP }, - { .name = "TLB_LOCKW", .cp = 15, .crn = 15, .crm = 4, .opc1 = 5, .opc2 = 4, - .access = PL1_W, .resetvalue = 0, .type = ARM_CP_NOP }, - { .name = "TLB_VA", .cp = 15, .crn = 15, .crm = 5, .opc1 = 5, .opc2 = 2, - .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, - { .name = "TLB_PA", .cp = 15, .crn = 15, .crm = 6, .opc1 = 5, .opc2 = 2, - .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, - { .name = "TLB_ATTR", .cp = 15, .crn = 15, .crm = 7, .opc1 = 5, .opc2 = 2, - .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, - REGINFO_SENTINEL -}; - -static void cortex_a9_initfn(Object *obj) -{ - ARMCPU *cpu = ARM_CPU(obj); - - cpu->dtb_compatible = "arm,cortex-a9"; - set_feature(&cpu->env, ARM_FEATURE_V7); - set_feature(&cpu->env, ARM_FEATURE_NEON); - set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); - set_feature(&cpu->env, ARM_FEATURE_EL3); - /* - * Note that A9 supports the MP extensions even for - * A9UP and single-core A9MP (which are both different - * and valid configurations; we don't model A9UP). - */ - set_feature(&cpu->env, ARM_FEATURE_V7MP); - set_feature(&cpu->env, ARM_FEATURE_CBAR); - cpu->midr = 0x410fc090; - cpu->reset_fpsid = 0x41033090; - cpu->isar.mvfr0 = 0x11110222; - cpu->isar.mvfr1 = 0x01111111; - cpu->ctr = 0x80038003; - cpu->reset_sctlr = 0x00c50078; - cpu->isar.id_pfr0 = 0x1031; - cpu->isar.id_pfr1 = 0x11; - cpu->isar.id_dfr0 = 0x000; - cpu->id_afr0 = 0; - cpu->isar.id_mmfr0 = 0x00100103; - cpu->isar.id_mmfr1 = 0x20000000; - cpu->isar.id_mmfr2 = 0x01230000; - cpu->isar.id_mmfr3 = 0x00002111; - cpu->isar.id_isar0 = 0x00101111; - cpu->isar.id_isar1 = 0x13112111; - cpu->isar.id_isar2 = 0x21232041; - cpu->isar.id_isar3 = 0x11112131; - cpu->isar.id_isar4 = 0x00111142; - cpu->isar.dbgdidr = 0x35141000; - cpu->clidr = (1 << 27) | (1 << 24) | 3; - cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */ - cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */ - define_arm_cp_regs(cpu, cortexa9_cp_reginfo); -} - -#ifndef CONFIG_USER_ONLY -static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri) -{ - MachineState *ms = MACHINE(qdev_get_machine()); - - /* - * Linux wants the number of processors from here. - * Might as well set the interrupt-controller bit too. - */ - return ((ms->smp.cpus - 1) << 24) | (1 << 23); -} -#endif - -static const ARMCPRegInfo cortexa15_cp_reginfo[] = { -#ifndef CONFIG_USER_ONLY - { .name = "L2CTLR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 2, - .access = PL1_RW, .resetvalue = 0, .readfn = a15_l2ctlr_read, - .writefn = arm_cp_write_ignore, }, -#endif - { .name = "L2ECTLR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 3, - .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, - REGINFO_SENTINEL -}; - -static void cortex_a7_initfn(Object *obj) -{ - ARMCPU *cpu = ARM_CPU(obj); - - cpu->dtb_compatible = "arm,cortex-a7"; - set_feature(&cpu->env, ARM_FEATURE_V7VE); - set_feature(&cpu->env, ARM_FEATURE_NEON); - set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); - set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER); - set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS); - set_feature(&cpu->env, ARM_FEATURE_CBAR_RO); - set_feature(&cpu->env, ARM_FEATURE_EL2); - set_feature(&cpu->env, ARM_FEATURE_EL3); - set_feature(&cpu->env, ARM_FEATURE_PMU); - cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A7; - cpu->midr = 0x410fc075; - cpu->reset_fpsid = 0x41023075; - cpu->isar.mvfr0 = 0x10110222; - cpu->isar.mvfr1 = 0x11111111; - cpu->ctr = 0x84448003; - cpu->reset_sctlr = 0x00c50078; - cpu->isar.id_pfr0 = 0x00001131; - cpu->isar.id_pfr1 = 0x00011011; - cpu->isar.id_dfr0 = 0x02010555; - cpu->id_afr0 = 0x00000000; - cpu->isar.id_mmfr0 = 0x10101105; - cpu->isar.id_mmfr1 = 0x40000000; - cpu->isar.id_mmfr2 = 0x01240000; - cpu->isar.id_mmfr3 = 0x02102211; - /* - * a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but - * table 4-41 gives 0x02101110, which includes the arm div insns. - */ - cpu->isar.id_isar0 = 0x02101110; - cpu->isar.id_isar1 = 0x13112111; - cpu->isar.id_isar2 = 0x21232041; - cpu->isar.id_isar3 = 0x11112131; - cpu->isar.id_isar4 = 0x10011142; - cpu->isar.dbgdidr = 0x3515f005; - cpu->clidr = 0x0a200023; - cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */ - cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */ - cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */ - define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */ -} - -static void cortex_a15_initfn(Object *obj) -{ - ARMCPU *cpu = ARM_CPU(obj); - - cpu->dtb_compatible = "arm,cortex-a15"; - set_feature(&cpu->env, ARM_FEATURE_V7VE); - set_feature(&cpu->env, ARM_FEATURE_NEON); - set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); - set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER); - set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS); - set_feature(&cpu->env, ARM_FEATURE_CBAR_RO); - set_feature(&cpu->env, ARM_FEATURE_EL2); - set_feature(&cpu->env, ARM_FEATURE_EL3); - set_feature(&cpu->env, ARM_FEATURE_PMU); - cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A15; - cpu->midr = 0x412fc0f1; - cpu->reset_fpsid = 0x410430f0; - cpu->isar.mvfr0 = 0x10110222; - cpu->isar.mvfr1 = 0x11111111; - cpu->ctr = 0x8444c004; - cpu->reset_sctlr = 0x00c50078; - cpu->isar.id_pfr0 = 0x00001131; - cpu->isar.id_pfr1 = 0x00011011; - cpu->isar.id_dfr0 = 0x02010555; - cpu->id_afr0 = 0x00000000; - cpu->isar.id_mmfr0 = 0x10201105; - cpu->isar.id_mmfr1 = 0x20000000; - cpu->isar.id_mmfr2 = 0x01240000; - cpu->isar.id_mmfr3 = 0x02102211; - cpu->isar.id_isar0 = 0x02101110; - cpu->isar.id_isar1 = 0x13112111; - cpu->isar.id_isar2 = 0x21232041; - cpu->isar.id_isar3 = 0x11112131; - cpu->isar.id_isar4 = 0x10011142; - cpu->isar.dbgdidr = 0x3515f021; - cpu->clidr = 0x0a200023; - cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */ - cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */ - cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */ - define_arm_cp_regs(cpu, cortexa15_cp_reginfo); -} - -#ifndef TARGET_AARCH64 -/* - * -cpu max: a CPU with as many features enabled as our emulation supports. - * The version of '-cpu max' for qemu-system-aarch64 is defined in cpu64.c; - * this only needs to handle 32 bits, and need not care about KVM. - */ -static void arm_max_initfn(Object *obj) -{ - ARMCPU *cpu = ARM_CPU(obj); - - cortex_a15_initfn(obj); - - /* old-style VFP short-vector support */ - cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1); - -#ifdef CONFIG_USER_ONLY - /* - * We don't set these in system emulation mode for the moment, - * since we don't correctly set (all of) the ID registers to - * advertise them. - */ - set_feature(&cpu->env, ARM_FEATURE_V8); - { - uint32_t t; - - t = cpu->isar.id_isar5; - t = FIELD_DP32(t, ID_ISAR5, AES, 2); - t = FIELD_DP32(t, ID_ISAR5, SHA1, 1); - t = FIELD_DP32(t, ID_ISAR5, SHA2, 1); - t = FIELD_DP32(t, ID_ISAR5, CRC32, 1); - t = FIELD_DP32(t, ID_ISAR5, RDM, 1); - t = FIELD_DP32(t, ID_ISAR5, VCMA, 1); - cpu->isar.id_isar5 = t; - - t = cpu->isar.id_isar6; - t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1); - t = FIELD_DP32(t, ID_ISAR6, DP, 1); - t = FIELD_DP32(t, ID_ISAR6, FHM, 1); - t = FIELD_DP32(t, ID_ISAR6, SB, 1); - t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1); - cpu->isar.id_isar6 = t; - - t = cpu->isar.mvfr1; - t = FIELD_DP32(t, MVFR1, FPHP, 3); /* v8.2-FP16 */ - t = FIELD_DP32(t, MVFR1, SIMDHP, 2); /* v8.2-FP16 */ - cpu->isar.mvfr1 = t; - - t = cpu->isar.mvfr2; - t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */ - t = FIELD_DP32(t, MVFR2, FPMISC, 4); /* FP MaxNum */ - cpu->isar.mvfr2 = t; - - t = cpu->isar.id_mmfr3; - t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */ - cpu->isar.id_mmfr3 = t; - - t = cpu->isar.id_mmfr4; - t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */ - t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */ - t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */ - t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */ - cpu->isar.id_mmfr4 = t; - - t = cpu->isar.id_pfr0; - t = FIELD_DP32(t, ID_PFR0, DIT, 1); - cpu->isar.id_pfr0 = t; - - t = cpu->isar.id_pfr2; - t = FIELD_DP32(t, ID_PFR2, SSBS, 1); - cpu->isar.id_pfr2 = t; - } -#endif -} -#endif - -#endif /* !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64) */ - -static const ARMCPUInfo arm_cpus[] = { -#if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64) - { .name = "cortex-a7", .initfn = cortex_a7_initfn }, - { .name = "cortex-a8", .initfn = cortex_a8_initfn }, - { .name = "cortex-a9", .initfn = cortex_a9_initfn }, - { .name = "cortex-a15", .initfn = cortex_a15_initfn }, -#ifndef TARGET_AARCH64 - { .name = "max", .initfn = arm_max_initfn }, -#endif -#ifdef CONFIG_USER_ONLY - { .name = "any", .initfn = arm_max_initfn }, -#endif -#endif -}; - static Property arm_cpu_properties[] = { DEFINE_PROP_UINT32("psci-conduit", ARMCPU, psci_conduit, 0), DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0), @@ -XXX,XX +XXX,XX @@ static const TypeInfo arm_cpu_type_info = { static void arm_cpu_register_types(void) { - const size_t cpu_count = ARRAY_SIZE(arm_cpus); - type_register_static(&arm_cpu_type_info); #ifdef CONFIG_KVM type_register_static(&host_arm_cpu_type_info); #endif - - if (cpu_count) { - size_t i; - - for (i = 0; i < cpu_count; ++i) { - arm_cpu_register(&arm_cpus[i]); - } - } } type_init(arm_cpu_register_types) diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c index XXXXXXX..XXXXXXX 100644 --- a/target/arm/cpu_tcg.c +++ b/target/arm/cpu_tcg.c @@ -XXX,XX +XXX,XX @@ #endif /* CONFIG_TCG */ #include "internals.h" #include "target/arm/idau.h" +#if !defined(CONFIG_USER_ONLY) +#include "hw/boards.h" +#endif /* CPU models. These are not needed for the AArch64 linux-user build. */ #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64) @@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj) cpu->reset_auxcr = 1; } +static const ARMCPRegInfo cortexa8_cp_reginfo[] = { + { .name = "L2LOCKDOWN", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 0, + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, + { .name = "L2AUXCR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 2, + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, + REGINFO_SENTINEL +}; + +static void cortex_a8_initfn(Object *obj) +{ + ARMCPU *cpu = ARM_CPU(obj); + + cpu->dtb_compatible = "arm,cortex-a8"; + set_feature(&cpu->env, ARM_FEATURE_V7); + set_feature(&cpu->env, ARM_FEATURE_NEON); + set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); + set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS); + set_feature(&cpu->env, ARM_FEATURE_EL3); + cpu->midr = 0x410fc080; + cpu->reset_fpsid = 0x410330c0; + cpu->isar.mvfr0 = 0x11110222; + cpu->isar.mvfr1 = 0x00011111; + cpu->ctr = 0x82048004; + cpu->reset_sctlr = 0x00c50078; + cpu->isar.id_pfr0 = 0x1031; + cpu->isar.id_pfr1 = 0x11; + cpu->isar.id_dfr0 = 0x400; + cpu->id_afr0 = 0; + cpu->isar.id_mmfr0 = 0x31100003; + cpu->isar.id_mmfr1 = 0x20000000; + cpu->isar.id_mmfr2 = 0x01202000; + cpu->isar.id_mmfr3 = 0x11; + cpu->isar.id_isar0 = 0x00101111; + cpu->isar.id_isar1 = 0x12112111; + cpu->isar.id_isar2 = 0x21232031; + cpu->isar.id_isar3 = 0x11112131; + cpu->isar.id_isar4 = 0x00111142; + cpu->isar.dbgdidr = 0x15141000; + cpu->clidr = (1 << 27) | (2 << 24) | 3; + cpu->ccsidr[0] = 0xe007e01a; /* 16k L1 dcache. */ + cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */ + cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */ + cpu->reset_auxcr = 2; + define_arm_cp_regs(cpu, cortexa8_cp_reginfo); +} + +static const ARMCPRegInfo cortexa9_cp_reginfo[] = { + /* + * power_control should be set to maximum latency. Again, + * default to 0 and set by private hook + */ + { .name = "A9_PWRCTL", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 0, + .access = PL1_RW, .resetvalue = 0, + .fieldoffset = offsetof(CPUARMState, cp15.c15_power_control) }, + { .name = "A9_DIAG", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 1, + .access = PL1_RW, .resetvalue = 0, + .fieldoffset = offsetof(CPUARMState, cp15.c15_diagnostic) }, + { .name = "A9_PWRDIAG", .cp = 15, .crn = 15, .crm = 0, .opc1 = 0, .opc2 = 2, + .access = PL1_RW, .resetvalue = 0, + .fieldoffset = offsetof(CPUARMState, cp15.c15_power_diagnostic) }, + { .name = "NEONBUSY", .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, + .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, + /* TLB lockdown control */ + { .name = "TLB_LOCKR", .cp = 15, .crn = 15, .crm = 4, .opc1 = 5, .opc2 = 2, + .access = PL1_W, .resetvalue = 0, .type = ARM_CP_NOP }, + { .name = "TLB_LOCKW", .cp = 15, .crn = 15, .crm = 4, .opc1 = 5, .opc2 = 4, + .access = PL1_W, .resetvalue = 0, .type = ARM_CP_NOP }, + { .name = "TLB_VA", .cp = 15, .crn = 15, .crm = 5, .opc1 = 5, .opc2 = 2, + .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, + { .name = "TLB_PA", .cp = 15, .crn = 15, .crm = 6, .opc1 = 5, .opc2 = 2, + .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, + { .name = "TLB_ATTR", .cp = 15, .crn = 15, .crm = 7, .opc1 = 5, .opc2 = 2, + .access = PL1_RW, .resetvalue = 0, .type = ARM_CP_CONST }, + REGINFO_SENTINEL +}; + +static void cortex_a9_initfn(Object *obj) +{ + ARMCPU *cpu = ARM_CPU(obj); + + cpu->dtb_compatible = "arm,cortex-a9"; + set_feature(&cpu->env, ARM_FEATURE_V7); + set_feature(&cpu->env, ARM_FEATURE_NEON); + set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); + set_feature(&cpu->env, ARM_FEATURE_EL3); + /* + * Note that A9 supports the MP extensions even for + * A9UP and single-core A9MP (which are both different + * and valid configurations; we don't model A9UP). + */ + set_feature(&cpu->env, ARM_FEATURE_V7MP); + set_feature(&cpu->env, ARM_FEATURE_CBAR); + cpu->midr = 0x410fc090; + cpu->reset_fpsid = 0x41033090; + cpu->isar.mvfr0 = 0x11110222; + cpu->isar.mvfr1 = 0x01111111; + cpu->ctr = 0x80038003; + cpu->reset_sctlr = 0x00c50078; + cpu->isar.id_pfr0 = 0x1031; + cpu->isar.id_pfr1 = 0x11; + cpu->isar.id_dfr0 = 0x000; + cpu->id_afr0 = 0; + cpu->isar.id_mmfr0 = 0x00100103; + cpu->isar.id_mmfr1 = 0x20000000; + cpu->isar.id_mmfr2 = 0x01230000; + cpu->isar.id_mmfr3 = 0x00002111; + cpu->isar.id_isar0 = 0x00101111; + cpu->isar.id_isar1 = 0x13112111; + cpu->isar.id_isar2 = 0x21232041; + cpu->isar.id_isar3 = 0x11112131; + cpu->isar.id_isar4 = 0x00111142; + cpu->isar.dbgdidr = 0x35141000; + cpu->clidr = (1 << 27) | (1 << 24) | 3; + cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */ + cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */ + define_arm_cp_regs(cpu, cortexa9_cp_reginfo); +} + +#ifndef CONFIG_USER_ONLY +static uint64_t a15_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri) +{ + MachineState *ms = MACHINE(qdev_get_machine()); + + /* + * Linux wants the number of processors from here. + * Might as well set the interrupt-controller bit too. + */ + return ((ms->smp.cpus - 1) << 24) | (1 << 23); +} +#endif + +static const ARMCPRegInfo cortexa15_cp_reginfo[] = { +#ifndef CONFIG_USER_ONLY + { .name = "L2CTLR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 2, + .access = PL1_RW, .resetvalue = 0, .readfn = a15_l2ctlr_read, + .writefn = arm_cp_write_ignore, }, +#endif + { .name = "L2ECTLR", .cp = 15, .crn = 9, .crm = 0, .opc1 = 1, .opc2 = 3, + .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 }, + REGINFO_SENTINEL +}; + +static void cortex_a7_initfn(Object *obj) +{ + ARMCPU *cpu = ARM_CPU(obj); + + cpu->dtb_compatible = "arm,cortex-a7"; + set_feature(&cpu->env, ARM_FEATURE_V7VE); + set_feature(&cpu->env, ARM_FEATURE_NEON); + set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); + set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER); + set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS); + set_feature(&cpu->env, ARM_FEATURE_CBAR_RO); + set_feature(&cpu->env, ARM_FEATURE_EL2); + set_feature(&cpu->env, ARM_FEATURE_EL3); + set_feature(&cpu->env, ARM_FEATURE_PMU); + cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A7; + cpu->midr = 0x410fc075; + cpu->reset_fpsid = 0x41023075; + cpu->isar.mvfr0 = 0x10110222; + cpu->isar.mvfr1 = 0x11111111; + cpu->ctr = 0x84448003; + cpu->reset_sctlr = 0x00c50078; + cpu->isar.id_pfr0 = 0x00001131; + cpu->isar.id_pfr1 = 0x00011011; + cpu->isar.id_dfr0 = 0x02010555; + cpu->id_afr0 = 0x00000000; + cpu->isar.id_mmfr0 = 0x10101105; + cpu->isar.id_mmfr1 = 0x40000000; + cpu->isar.id_mmfr2 = 0x01240000; + cpu->isar.id_mmfr3 = 0x02102211; + /* + * a7_mpcore_r0p5_trm, page 4-4 gives 0x01101110; but + * table 4-41 gives 0x02101110, which includes the arm div insns. + */ + cpu->isar.id_isar0 = 0x02101110; + cpu->isar.id_isar1 = 0x13112111; + cpu->isar.id_isar2 = 0x21232041; + cpu->isar.id_isar3 = 0x11112131; + cpu->isar.id_isar4 = 0x10011142; + cpu->isar.dbgdidr = 0x3515f005; + cpu->clidr = 0x0a200023; + cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */ + cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */ + cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */ + define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */ +} + +static void cortex_a15_initfn(Object *obj) +{ + ARMCPU *cpu = ARM_CPU(obj); + + cpu->dtb_compatible = "arm,cortex-a15"; + set_feature(&cpu->env, ARM_FEATURE_V7VE); + set_feature(&cpu->env, ARM_FEATURE_NEON); + set_feature(&cpu->env, ARM_FEATURE_THUMB2EE); + set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER); + set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS); + set_feature(&cpu->env, ARM_FEATURE_CBAR_RO); + set_feature(&cpu->env, ARM_FEATURE_EL2); + set_feature(&cpu->env, ARM_FEATURE_EL3); + set_feature(&cpu->env, ARM_FEATURE_PMU); + cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A15; + cpu->midr = 0x412fc0f1; + cpu->reset_fpsid = 0x410430f0; + cpu->isar.mvfr0 = 0x10110222; + cpu->isar.mvfr1 = 0x11111111; + cpu->ctr = 0x8444c004; + cpu->reset_sctlr = 0x00c50078; + cpu->isar.id_pfr0 = 0x00001131; + cpu->isar.id_pfr1 = 0x00011011; + cpu->isar.id_dfr0 = 0x02010555; + cpu->id_afr0 = 0x00000000; + cpu->isar.id_mmfr0 = 0x10201105; + cpu->isar.id_mmfr1 = 0x20000000; + cpu->isar.id_mmfr2 = 0x01240000; + cpu->isar.id_mmfr3 = 0x02102211; + cpu->isar.id_isar0 = 0x02101110; + cpu->isar.id_isar1 = 0x13112111; + cpu->isar.id_isar2 = 0x21232041; + cpu->isar.id_isar3 = 0x11112131; + cpu->isar.id_isar4 = 0x10011142; + cpu->isar.dbgdidr = 0x3515f021; + cpu->clidr = 0x0a200023; + cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */ + cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */ + cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */ + define_arm_cp_regs(cpu, cortexa15_cp_reginfo); +} + static void cortex_m0_initfn(Object *obj) { ARMCPU *cpu = ARM_CPU(obj); @@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data) cc->gdb_core_xml_file = "arm-m-profile.xml"; } +#ifndef TARGET_AARCH64 +/* + * -cpu max: a CPU with as many features enabled as our emulation supports. + * The version of '-cpu max' for qemu-system-aarch64 is defined in cpu64.c; + * this only needs to handle 32 bits, and need not care about KVM. + */ +static void arm_max_initfn(Object *obj) +{ + ARMCPU *cpu = ARM_CPU(obj); + + cortex_a15_initfn(obj); + + /* old-style VFP short-vector support */ + cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1); + +#ifdef CONFIG_USER_ONLY + /* + * We don't set these in system emulation mode for the moment, + * since we don't correctly set (all of) the ID registers to + * advertise them. + */ + set_feature(&cpu->env, ARM_FEATURE_V8); + { + uint32_t t; + + t = cpu->isar.id_isar5; + t = FIELD_DP32(t, ID_ISAR5, AES, 2); + t = FIELD_DP32(t, ID_ISAR5, SHA1, 1); + t = FIELD_DP32(t, ID_ISAR5, SHA2, 1); + t = FIELD_DP32(t, ID_ISAR5, CRC32, 1); + t = FIELD_DP32(t, ID_ISAR5, RDM, 1); + t = FIELD_DP32(t, ID_ISAR5, VCMA, 1); + cpu->isar.id_isar5 = t; + + t = cpu->isar.id_isar6; + t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1); + t = FIELD_DP32(t, ID_ISAR6, DP, 1); + t = FIELD_DP32(t, ID_ISAR6, FHM, 1); + t = FIELD_DP32(t, ID_ISAR6, SB, 1); + t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1); + cpu->isar.id_isar6 = t; + + t = cpu->isar.mvfr1; + t = FIELD_DP32(t, MVFR1, FPHP, 3); /* v8.2-FP16 */ + t = FIELD_DP32(t, MVFR1, SIMDHP, 2); /* v8.2-FP16 */ + cpu->isar.mvfr1 = t; + + t = cpu->isar.mvfr2; + t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */ + t = FIELD_DP32(t, MVFR2, FPMISC, 4); /* FP MaxNum */ + cpu->isar.mvfr2 = t; + + t = cpu->isar.id_mmfr3; + t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */ + cpu->isar.id_mmfr3 = t; + + t = cpu->isar.id_mmfr4; + t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */ + t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */ + t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */ + t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */ + cpu->isar.id_mmfr4 = t; + + t = cpu->isar.id_pfr0; + t = FIELD_DP32(t, ID_PFR0, DIT, 1); + cpu->isar.id_pfr0 = t; + + t = cpu->isar.id_pfr2; + t = FIELD_DP32(t, ID_PFR2, SSBS, 1); + cpu->isar.id_pfr2 = t; + } +#endif /* CONFIG_USER_ONLY */ +} +#endif /* !TARGET_AARCH64 */ + static const ARMCPUInfo arm_tcg_cpus[] = { { .name = "arm926", .initfn = arm926_initfn }, { .name = "arm946", .initfn = arm946_initfn }, @@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = { { .name = "arm1136", .initfn = arm1136_initfn }, { .name = "arm1176", .initfn = arm1176_initfn }, { .name = "arm11mpcore", .initfn = arm11mpcore_initfn }, + { .name = "cortex-a7", .initfn = cortex_a7_initfn }, + { .name = "cortex-a8", .initfn = cortex_a8_initfn }, + { .name = "cortex-a9", .initfn = cortex_a9_initfn }, + { .name = "cortex-a15", .initfn = cortex_a15_initfn }, { .name = "cortex-m0", .initfn = cortex_m0_initfn, .class_init = arm_v7m_class_init }, { .name = "cortex-m3", .initfn = cortex_m3_initfn, @@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_tcg_cpus[] = { { .name = "pxa270-b1", .initfn = pxa270b1_initfn }, { .name = "pxa270-c0", .initfn = pxa270c0_initfn }, { .name = "pxa270-c5", .initfn = pxa270c5_initfn }, +#ifndef TARGET_AARCH64 + { .name = "max", .initfn = arm_max_initfn }, +#endif +#ifdef CONFIG_USER_ONLY + { .name = "any", .initfn = arm_max_initfn }, +#endif }; static const TypeInfo idau_interface_type_info = { -- 2.20.1 From: Xuzhou Cheng <xuzhou.cheng@windriver.com> ZynqMP QSPI supports SPI transfer using DMA mode, but currently this is unimplemented. When QSPI is programmed to use DMA mode, QEMU will crash. This is observed when testing VxWorks 7. This adds a Xilinx CSU DMA model and the implementation is based on https://github.com/Xilinx/qemu/blob/master/hw/dma/csu_stream_dma.c. The DST part of the model is verified along with ZynqMP GQSPI model. Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Tested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20210303135254.3970-2-bmeng.cn@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- include/hw/dma/xlnx_csu_dma.h | 52 +++ hw/dma/xlnx_csu_dma.c | 745 ++++++++++++++++++++++++++++++++++ hw/dma/Kconfig | 4 + hw/dma/meson.build | 1 + 4 files changed, 802 insertions(+) create mode 100644 include/hw/dma/xlnx_csu_dma.h create mode 100644 hw/dma/xlnx_csu_dma.c diff --git a/include/hw/dma/xlnx_csu_dma.h b/include/hw/dma/xlnx_csu_dma.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/include/hw/dma/xlnx_csu_dma.h @@ -XXX,XX +XXX,XX @@ +/* + * Xilinx Platform CSU Stream DMA emulation + * + * This implementation is based on + * https://github.com/Xilinx/qemu/blob/master/hw/dma/csu_stream_dma.c + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 or + * (at your option) version 3 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +#ifndef XLNX_CSU_DMA_H +#define XLNX_CSU_DMA_H + +#define TYPE_XLNX_CSU_DMA "xlnx.csu_dma" + +#define XLNX_CSU_DMA_R_MAX (0x2c / 4) + +typedef struct XlnxCSUDMA { + SysBusDevice busdev; + MemoryRegion iomem; + MemTxAttrs attr; + MemoryRegion *dma_mr; + AddressSpace *dma_as; + qemu_irq irq; + StreamSink *tx_dev; /* Used as generic StreamSink */ + ptimer_state *src_timer; + + uint16_t width; + bool is_dst; + bool r_size_last_word; + + StreamCanPushNotifyFn notify; + void *notify_opaque; + + uint32_t regs[XLNX_CSU_DMA_R_MAX]; + RegisterInfo regs_info[XLNX_CSU_DMA_R_MAX]; +} XlnxCSUDMA; + +#define XLNX_CSU_DMA(obj) \ + OBJECT_CHECK(XlnxCSUDMA, (obj), TYPE_XLNX_CSU_DMA) + +#endif diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/hw/dma/xlnx_csu_dma.c @@ -XXX,XX +XXX,XX @@ +/* + * Xilinx Platform CSU Stream DMA emulation + * + * This implementation is based on + * https://github.com/Xilinx/qemu/blob/master/hw/dma/csu_stream_dma.c + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 or + * (at your option) version 3 of the License. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, see <http://www.gnu.org/licenses/>. + */ + +#include "qemu/osdep.h" +#include "qemu/log.h" +#include "qapi/error.h" +#include "hw/hw.h" +#include "hw/irq.h" +#include "hw/qdev-properties.h" +#include "hw/sysbus.h" +#include "migration/vmstate.h" +#include "sysemu/dma.h" +#include "hw/ptimer.h" +#include "hw/stream.h" +#include "hw/register.h" +#include "hw/dma/xlnx_csu_dma.h" + +/* + * Ref: UG1087 (v1.7) February 8, 2019 + * https://www.xilinx.com/html_docs/registers/ug1087/ug1087-zynq-ultrascale-registers.html + * CSUDMA Module section + */ +REG32(ADDR, 0x0) + FIELD(ADDR, ADDR, 2, 30) /* wo */ +REG32(SIZE, 0x4) + FIELD(SIZE, SIZE, 2, 27) /* wo */ + FIELD(SIZE, LAST_WORD, 0, 1) /* rw, only exists in SRC */ +REG32(STATUS, 0x8) + FIELD(STATUS, DONE_CNT, 13, 3) /* wtc */ + FIELD(STATUS, FIFO_LEVEL, 5, 8) /* ro */ + FIELD(STATUS, OUTSTANDING, 1, 4) /* ro */ + FIELD(STATUS, BUSY, 0, 1) /* ro */ +REG32(CTRL, 0xc) + FIELD(CTRL, FIFOTHRESH, 25, 7) /* rw, only exists in DST, reset 0x40 */ + FIELD(CTRL, APB_ERR_RESP, 24, 1) /* rw */ + FIELD(CTRL, ENDIANNESS, 23, 1) /* rw */ + FIELD(CTRL, AXI_BRST_TYPE, 22, 1) /* rw */ + FIELD(CTRL, TIMEOUT_VAL, 10, 12) /* rw, reset: 0xFFE */ + FIELD(CTRL, FIFO_THRESH, 2, 8) /* rw, reset: 0x80 */ + FIELD(CTRL, PAUSE_STRM, 1, 1) /* rw */ + FIELD(CTRL, PAUSE_MEM, 0, 1) /* rw */ +REG32(CRC, 0x10) +REG32(INT_STATUS, 0x14) + FIELD(INT_STATUS, FIFO_OVERFLOW, 7, 1) /* wtc */ + FIELD(INT_STATUS, INVALID_APB, 6, 1) /* wtc */ + FIELD(INT_STATUS, THRESH_HIT, 5, 1) /* wtc */ + FIELD(INT_STATUS, TIMEOUT_MEM, 4, 1) /* wtc */ + FIELD(INT_STATUS, TIMEOUT_STRM, 3, 1) /* wtc */ + FIELD(INT_STATUS, AXI_BRESP_ERR, 2, 1) /* wtc, SRC: AXI_RDERR */ + FIELD(INT_STATUS, DONE, 1, 1) /* wtc */ + FIELD(INT_STATUS, MEM_DONE, 0, 1) /* wtc */ +REG32(INT_ENABLE, 0x18) + FIELD(INT_ENABLE, FIFO_OVERFLOW, 7, 1) /* wtc */ + FIELD(INT_ENABLE, INVALID_APB, 6, 1) /* wtc */ + FIELD(INT_ENABLE, THRESH_HIT, 5, 1) /* wtc */ + FIELD(INT_ENABLE, TIMEOUT_MEM, 4, 1) /* wtc */ + FIELD(INT_ENABLE, TIMEOUT_STRM, 3, 1) /* wtc */ + FIELD(INT_ENABLE, AXI_BRESP_ERR, 2, 1) /* wtc, SRC: AXI_RDERR */ + FIELD(INT_ENABLE, DONE, 1, 1) /* wtc */ + FIELD(INT_ENABLE, MEM_DONE, 0, 1) /* wtc */ +REG32(INT_DISABLE, 0x1c) + FIELD(INT_DISABLE, FIFO_OVERFLOW, 7, 1) /* wtc */ + FIELD(INT_DISABLE, INVALID_APB, 6, 1) /* wtc */ + FIELD(INT_DISABLE, THRESH_HIT, 5, 1) /* wtc */ + FIELD(INT_DISABLE, TIMEOUT_MEM, 4, 1) /* wtc */ + FIELD(INT_DISABLE, TIMEOUT_STRM, 3, 1) /* wtc */ + FIELD(INT_DISABLE, AXI_BRESP_ERR, 2, 1) /* wtc, SRC: AXI_RDERR */ + FIELD(INT_DISABLE, DONE, 1, 1) /* wtc */ + FIELD(INT_DISABLE, MEM_DONE, 0, 1) /* wtc */ +REG32(INT_MASK, 0x20) + FIELD(INT_MASK, FIFO_OVERFLOW, 7, 1) /* ro, reset: 0x1 */ + FIELD(INT_MASK, INVALID_APB, 6, 1) /* ro, reset: 0x1 */ + FIELD(INT_MASK, THRESH_HIT, 5, 1) /* ro, reset: 0x1 */ + FIELD(INT_MASK, TIMEOUT_MEM, 4, 1) /* ro, reset: 0x1 */ + FIELD(INT_MASK, TIMEOUT_STRM, 3, 1) /* ro, reset: 0x1 */ + FIELD(INT_MASK, AXI_BRESP_ERR, 2, 1) /* ro, reset: 0x1, SRC: AXI_RDERR */ + FIELD(INT_MASK, DONE, 1, 1) /* ro, reset: 0x1 */ + FIELD(INT_MASK, MEM_DONE, 0, 1) /* ro, reset: 0x1 */ +REG32(CTRL2, 0x24) + FIELD(CTRL2, ARCACHE, 24, 3) /* rw */ + FIELD(CTRL2, ROUTE_BIT, 23, 1) /* rw */ + FIELD(CTRL2, TIMEOUT_EN, 22, 1) /* rw */ + FIELD(CTRL2, TIMEOUT_PRE, 4, 12) /* rw, reset: 0xFFF */ + FIELD(CTRL2, MAX_OUTS_CMDS, 0, 4) /* rw, reset: 0x8 */ +REG32(ADDR_MSB, 0x28) + FIELD(ADDR_MSB, ADDR_MSB, 0, 17) /* wo */ + +#define R_CTRL_TIMEOUT_VAL_RESET (0xFFE) +#define R_CTRL_FIFO_THRESH_RESET (0x80) +#define R_CTRL_FIFOTHRESH_RESET (0x40) + +#define R_CTRL2_TIMEOUT_PRE_RESET (0xFFF) +#define R_CTRL2_MAX_OUTS_CMDS_RESET (0x8) + +#define XLNX_CSU_DMA_ERR_DEBUG (0) +#define XLNX_CSU_DMA_INT_R_MASK (0xff) + +/* UG1807: Set the prescaler value for the timeout in clk (~2.5ns) cycles */ +#define XLNX_CSU_DMA_TIMER_FREQ (400 * 1000 * 1000) + +static bool xlnx_csu_dma_is_paused(XlnxCSUDMA *s) +{ + bool paused; + + paused = !!(s->regs[R_CTRL] & R_CTRL_PAUSE_STRM_MASK); + paused |= !!(s->regs[R_CTRL] & R_CTRL_PAUSE_MEM_MASK); + + return paused; +} + +static bool xlnx_csu_dma_get_eop(XlnxCSUDMA *s) +{ + return s->r_size_last_word; +} + +static bool xlnx_csu_dma_burst_is_fixed(XlnxCSUDMA *s) +{ + return !!(s->regs[R_CTRL] & R_CTRL_AXI_BRST_TYPE_MASK); +} + +static bool xlnx_csu_dma_timeout_enabled(XlnxCSUDMA *s) +{ + return !!(s->regs[R_CTRL2] & R_CTRL2_TIMEOUT_EN_MASK); +} + +static void xlnx_csu_dma_update_done_cnt(XlnxCSUDMA *s, int a) +{ + int cnt; + + /* Increase DONE_CNT */ + cnt = ARRAY_FIELD_EX32(s->regs, STATUS, DONE_CNT) + a; + ARRAY_FIELD_DP32(s->regs, STATUS, DONE_CNT, cnt); +} + +static void xlnx_csu_dma_data_process(XlnxCSUDMA *s, uint8_t *buf, uint32_t len) +{ + uint32_t bswap; + uint32_t i; + + bswap = s->regs[R_CTRL] & R_CTRL_ENDIANNESS_MASK; + if (s->is_dst && !bswap) { + /* Fast when ENDIANNESS cleared */ + return; + } + + for (i = 0; i < len; i += 4) { + uint8_t *b = &buf[i]; + union { + uint8_t u8[4]; + uint32_t u32; + } v = { + .u8 = { b[0], b[1], b[2], b[3] } + }; + + if (!s->is_dst) { + s->regs[R_CRC] += v.u32; + } + if (bswap) { + /* + * No point using bswap, we need to writeback + * into a potentially unaligned pointer. + */ + b[0] = v.u8[3]; + b[1] = v.u8[2]; + b[2] = v.u8[1]; + b[3] = v.u8[0]; + } + } +} + +static void xlnx_csu_dma_update_irq(XlnxCSUDMA *s) +{ + qemu_set_irq(s->irq, !!(s->regs[R_INT_STATUS] & ~s->regs[R_INT_MASK])); +} + +/* len is in bytes */ +static uint32_t xlnx_csu_dma_read(XlnxCSUDMA *s, uint8_t *buf, uint32_t len) +{ + hwaddr addr = (hwaddr)s->regs[R_ADDR_MSB] << 32 | s->regs[R_ADDR]; + MemTxResult result = MEMTX_OK; + + if (xlnx_csu_dma_burst_is_fixed(s)) { + uint32_t i; + + for (i = 0; i < len && (result == MEMTX_OK); i += s->width) { + uint32_t mlen = MIN(len - i, s->width); + + result = address_space_rw(s->dma_as, addr, s->attr, + buf + i, mlen, false); + } + } else { + result = address_space_rw(s->dma_as, addr, s->attr, buf, len, false); + } + + if (result == MEMTX_OK) { + xlnx_csu_dma_data_process(s, buf, len); + } else { + qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address 0x%lx for mem read", + __func__, addr); + s->regs[R_INT_STATUS] |= R_INT_STATUS_AXI_BRESP_ERR_MASK; + xlnx_csu_dma_update_irq(s); + } + return len; +} + +/* len is in bytes */ +static uint32_t xlnx_csu_dma_write(XlnxCSUDMA *s, uint8_t *buf, uint32_t len) +{ + hwaddr addr = (hwaddr)s->regs[R_ADDR_MSB] << 32 | s->regs[R_ADDR]; + MemTxResult result = MEMTX_OK; + + xlnx_csu_dma_data_process(s, buf, len); + if (xlnx_csu_dma_burst_is_fixed(s)) { + uint32_t i; + + for (i = 0; i < len && (result == MEMTX_OK); i += s->width) { + uint32_t mlen = MIN(len - i, s->width); + + result = address_space_rw(s->dma_as, addr, s->attr, + buf, mlen, true); + buf += mlen; + } + } else { + result = address_space_rw(s->dma_as, addr, s->attr, buf, len, true); + } + + if (result != MEMTX_OK) { + qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address 0x%lx for mem write", + __func__, addr); + s->regs[R_INT_STATUS] |= R_INT_STATUS_AXI_BRESP_ERR_MASK; + xlnx_csu_dma_update_irq(s); + } + return len; +} + +static void xlnx_csu_dma_done(XlnxCSUDMA *s) +{ + s->regs[R_STATUS] &= ~R_STATUS_BUSY_MASK; + s->regs[R_INT_STATUS] |= R_INT_STATUS_DONE_MASK; + + if (!s->is_dst) { + s->regs[R_INT_STATUS] |= R_INT_STATUS_MEM_DONE_MASK; + } + + xlnx_csu_dma_update_done_cnt(s, 1); +} + +static uint32_t xlnx_csu_dma_advance(XlnxCSUDMA *s, uint32_t len) +{ + uint32_t size = s->regs[R_SIZE]; + hwaddr dst = (hwaddr)s->regs[R_ADDR_MSB] << 32 | s->regs[R_ADDR]; + + assert(len <= size); + + size -= len; + s->regs[R_SIZE] = size; + + if (!xlnx_csu_dma_burst_is_fixed(s)) { + dst += len; + s->regs[R_ADDR] = (uint32_t) dst; + s->regs[R_ADDR_MSB] = dst >> 32; + } + + if (size == 0) { + xlnx_csu_dma_done(s); + } + + return size; +} + +static void xlnx_csu_dma_src_notify(void *opaque) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(opaque); + unsigned char buf[4 * 1024]; + size_t rlen = 0; + + ptimer_transaction_begin(s->src_timer); + /* Stop the backpreassure timer */ + ptimer_stop(s->src_timer); + + while (s->regs[R_SIZE] && !xlnx_csu_dma_is_paused(s) && + stream_can_push(s->tx_dev, xlnx_csu_dma_src_notify, s)) { + uint32_t plen = MIN(s->regs[R_SIZE], sizeof buf); + bool eop = false; + + /* Did we fit it all? */ + if (s->regs[R_SIZE] == plen && xlnx_csu_dma_get_eop(s)) { + eop = true; + } + + /* DMA transfer */ + xlnx_csu_dma_read(s, buf, plen); + rlen = stream_push(s->tx_dev, buf, plen, eop); + xlnx_csu_dma_advance(s, rlen); + } + + if (xlnx_csu_dma_timeout_enabled(s) && s->regs[R_SIZE] && + !stream_can_push(s->tx_dev, xlnx_csu_dma_src_notify, s)) { + uint32_t timeout = ARRAY_FIELD_EX32(s->regs, CTRL, TIMEOUT_VAL); + uint32_t div = ARRAY_FIELD_EX32(s->regs, CTRL2, TIMEOUT_PRE) + 1; + uint32_t freq = XLNX_CSU_DMA_TIMER_FREQ; + + freq /= div; + ptimer_set_freq(s->src_timer, freq); + ptimer_set_count(s->src_timer, timeout); + ptimer_run(s->src_timer, 1); + } + + ptimer_transaction_commit(s->src_timer); + xlnx_csu_dma_update_irq(s); +} + +static uint64_t addr_pre_write(RegisterInfo *reg, uint64_t val) +{ + /* Address is word aligned */ + return val & R_ADDR_ADDR_MASK; +} + +static uint64_t size_pre_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + if (s->regs[R_SIZE] != 0) { + qemu_log_mask(LOG_GUEST_ERROR, + "%s: Starting DMA while already running.\n", __func__); + } + + if (!s->is_dst) { + s->r_size_last_word = !!(val & R_SIZE_LAST_WORD_MASK); + } + + /* Size is word aligned */ + return val & R_SIZE_SIZE_MASK; +} + +static uint64_t size_post_read(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + return val | s->r_size_last_word; +} + +static void size_post_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + s->regs[R_STATUS] |= R_STATUS_BUSY_MASK; + + /* + * Note that if SIZE is programmed to 0, and the DMA is started, + * the interrupts DONE and MEM_DONE will be asserted. + */ + if (s->regs[R_SIZE] == 0) { + xlnx_csu_dma_done(s); + xlnx_csu_dma_update_irq(s); + return; + } + + /* Set SIZE is considered the last step in transfer configuration */ + if (!s->is_dst) { + xlnx_csu_dma_src_notify(s); + } else { + if (s->notify) { + s->notify(s->notify_opaque); + } + } +} + +static uint64_t status_pre_write(RegisterInfo *reg, uint64_t val) +{ + return val & (R_STATUS_DONE_CNT_MASK | R_STATUS_BUSY_MASK); +} + +static void ctrl_post_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + if (!s->is_dst) { + if (!xlnx_csu_dma_is_paused(s)) { + xlnx_csu_dma_src_notify(s); + } + } else { + if (!xlnx_csu_dma_is_paused(s) && s->notify) { + s->notify(s->notify_opaque); + } + } +} + +static uint64_t int_status_pre_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + /* DMA counter decrements when flag 'DONE' is cleared */ + if ((val & s->regs[R_INT_STATUS] & R_INT_STATUS_DONE_MASK)) { + xlnx_csu_dma_update_done_cnt(s, -1); + } + + return s->regs[R_INT_STATUS] & ~val; +} + +static void int_status_post_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + xlnx_csu_dma_update_irq(s); +} + +static uint64_t int_enable_pre_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + uint32_t v32 = val; + + /* + * R_INT_ENABLE doesn't have its own state. + * It is used to indirectly modify R_INT_MASK. + * + * 1: Enable this interrupt field (the mask bit will be cleared to 0) + * 0: No effect + */ + s->regs[R_INT_MASK] &= ~v32; + return 0; +} + +static void int_enable_post_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + xlnx_csu_dma_update_irq(s); +} + +static uint64_t int_disable_pre_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + uint32_t v32 = val; + + /* + * R_INT_DISABLE doesn't have its own state. + * It is used to indirectly modify R_INT_MASK. + * + * 1: Disable this interrupt field (the mask bit will be set to 1) + * 0: No effect + */ + s->regs[R_INT_MASK] |= v32; + return 0; +} + +static void int_disable_post_write(RegisterInfo *reg, uint64_t val) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(reg->opaque); + + xlnx_csu_dma_update_irq(s); +} + +static uint64_t addr_msb_pre_write(RegisterInfo *reg, uint64_t val) +{ + return val & R_ADDR_MSB_ADDR_MSB_MASK; +} + +static const RegisterAccessInfo *xlnx_csu_dma_regs_info[] = { +#define DMACH_REGINFO(NAME, snd) \ + (const RegisterAccessInfo []) { \ + { \ + .name = #NAME "_ADDR", \ + .addr = A_ADDR, \ + .pre_write = addr_pre_write \ + }, { \ + .name = #NAME "_SIZE", \ + .addr = A_SIZE, \ + .pre_write = size_pre_write, \ + .post_write = size_post_write, \ + .post_read = size_post_read \ + }, { \ + .name = #NAME "_STATUS", \ + .addr = A_STATUS, \ + .pre_write = status_pre_write, \ + .w1c = R_STATUS_DONE_CNT_MASK, \ + .ro = (R_STATUS_BUSY_MASK \ + | R_STATUS_FIFO_LEVEL_MASK \ + | R_STATUS_OUTSTANDING_MASK) \ + }, { \ + .name = #NAME "_CTRL", \ + .addr = A_CTRL, \ + .post_write = ctrl_post_write, \ + .reset = ((R_CTRL_TIMEOUT_VAL_RESET << R_CTRL_TIMEOUT_VAL_SHIFT) \ + | (R_CTRL_FIFO_THRESH_RESET << R_CTRL_FIFO_THRESH_SHIFT)\ + | (snd ? 0 : R_CTRL_FIFOTHRESH_RESET \ + << R_CTRL_FIFOTHRESH_SHIFT)) \ + }, { \ + .name = #NAME "_CRC", \ + .addr = A_CRC, \ + }, { \ + .name = #NAME "_INT_STATUS", \ + .addr = A_INT_STATUS, \ + .pre_write = int_status_pre_write, \ + .post_write = int_status_post_write \ + }, { \ + .name = #NAME "_INT_ENABLE", \ + .addr = A_INT_ENABLE, \ + .pre_write = int_enable_pre_write, \ + .post_write = int_enable_post_write \ + }, { \ + .name = #NAME "_INT_DISABLE", \ + .addr = A_INT_DISABLE, \ + .pre_write = int_disable_pre_write, \ + .post_write = int_disable_post_write \ + }, { \ + .name = #NAME "_INT_MASK", \ + .addr = A_INT_MASK, \ + .ro = ~0, \ + .reset = XLNX_CSU_DMA_INT_R_MASK \ + }, { \ + .name = #NAME "_CTRL2", \ + .addr = A_CTRL2, \ + .reset = ((R_CTRL2_TIMEOUT_PRE_RESET \ + << R_CTRL2_TIMEOUT_PRE_SHIFT) \ + | (R_CTRL2_MAX_OUTS_CMDS_RESET \ + << R_CTRL2_MAX_OUTS_CMDS_SHIFT)) \ + }, { \ + .name = #NAME "_ADDR_MSB", \ + .addr = A_ADDR_MSB, \ + .pre_write = addr_msb_pre_write \ + } \ + } + + DMACH_REGINFO(DMA_SRC, true), + DMACH_REGINFO(DMA_DST, false) +}; + +static const MemoryRegionOps xlnx_csu_dma_ops = { + .read = register_read_memory, + .write = register_write_memory, + .endianness = DEVICE_LITTLE_ENDIAN, + .valid = { + .min_access_size = 4, + .max_access_size = 4, + } +}; + +static void xlnx_csu_dma_src_timeout_hit(void *opaque) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(opaque); + + /* Ignore if the timeout is masked */ + if (!xlnx_csu_dma_timeout_enabled(s)) { + return; + } + + s->regs[R_INT_STATUS] |= R_INT_STATUS_TIMEOUT_STRM_MASK; + xlnx_csu_dma_update_irq(s); +} + +static size_t xlnx_csu_dma_stream_push(StreamSink *obj, uint8_t *buf, + size_t len, bool eop) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(obj); + uint32_t size = s->regs[R_SIZE]; + uint32_t mlen = MIN(size, len) & (~3); /* Size is word aligned */ + + /* Be called when it's DST */ + assert(s->is_dst); + + if (size == 0 || len <= 0) { + return 0; + } + + if (len && (xlnx_csu_dma_is_paused(s) || mlen == 0)) { + qemu_log_mask(LOG_GUEST_ERROR, + "csu-dma: DST channel dropping %zd b of data.\n", len); + s->regs[R_INT_STATUS] |= R_INT_STATUS_FIFO_OVERFLOW_MASK; + return len; + } + + if (xlnx_csu_dma_write(s, buf, mlen) != mlen) { + return 0; + } + + xlnx_csu_dma_advance(s, mlen); + xlnx_csu_dma_update_irq(s); + + return mlen; +} + +static bool xlnx_csu_dma_stream_can_push(StreamSink *obj, + StreamCanPushNotifyFn notify, + void *notify_opaque) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(obj); + + if (s->regs[R_SIZE] != 0) { + return true; + } else { + s->notify = notify; + s->notify_opaque = notify_opaque; + return false; + } +} + +static void xlnx_csu_dma_reset(DeviceState *dev) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(dev); + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) { + register_reset(&s->regs_info[i]); + } +} + +static void xlnx_csu_dma_realize(DeviceState *dev, Error **errp) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(dev); + RegisterInfoArray *reg_array; + + reg_array = + register_init_block32(dev, xlnx_csu_dma_regs_info[!!s->is_dst], + XLNX_CSU_DMA_R_MAX, + s->regs_info, s->regs, + &xlnx_csu_dma_ops, + XLNX_CSU_DMA_ERR_DEBUG, + XLNX_CSU_DMA_R_MAX * 4); + memory_region_add_subregion(&s->iomem, + 0x0, + &reg_array->mem); + + sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem); + sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq); + + if (!s->is_dst && !s->tx_dev) { + error_setg(errp, "zynqmp.csu-dma: Stream not connected"); + return; + } + + s->src_timer = ptimer_init(xlnx_csu_dma_src_timeout_hit, + s, PTIMER_POLICY_DEFAULT); + + if (s->dma_mr) { + s->dma_as = g_malloc0(sizeof(AddressSpace)); + address_space_init(s->dma_as, s->dma_mr, NULL); + } else { + s->dma_as = &address_space_memory; + } + + s->attr = MEMTXATTRS_UNSPECIFIED; + + s->r_size_last_word = 0; +} + +static const VMStateDescription vmstate_xlnx_csu_dma = { + .name = TYPE_XLNX_CSU_DMA, + .version_id = 0, + .minimum_version_id = 0, + .minimum_version_id_old = 0, + .fields = (VMStateField[]) { + VMSTATE_PTIMER(src_timer, XlnxCSUDMA), + VMSTATE_UINT16(width, XlnxCSUDMA), + VMSTATE_BOOL(is_dst, XlnxCSUDMA), + VMSTATE_BOOL(r_size_last_word, XlnxCSUDMA), + VMSTATE_UINT32_ARRAY(regs, XlnxCSUDMA, XLNX_CSU_DMA_R_MAX), + VMSTATE_END_OF_LIST(), + } +}; + +static Property xlnx_csu_dma_properties[] = { + /* + * Ref PG021, Stream Data Width: + * Data width in bits of the AXI S2MM AXI4-Stream Data bus. + * This value must be equal or less than the Memory Map Data Width. + * Valid values are 8, 16, 32, 64, 128, 512 and 1024. + * "dma-width" is the byte value of the "Stream Data Width". + */ + DEFINE_PROP_UINT16("dma-width", XlnxCSUDMA, width, 4), + /* + * The CSU DMA is a two-channel, simple DMA, allowing separate control of + * the SRC (read) channel and DST (write) channel. "is-dst" is used to mark + * which channel the device is connected to. + */ + DEFINE_PROP_BOOL("is-dst", XlnxCSUDMA, is_dst, true), + DEFINE_PROP_END_OF_LIST(), +}; + +static void xlnx_csu_dma_class_init(ObjectClass *klass, void *data) +{ + DeviceClass *dc = DEVICE_CLASS(klass); + StreamSinkClass *ssc = STREAM_SINK_CLASS(klass); + + dc->reset = xlnx_csu_dma_reset; + dc->realize = xlnx_csu_dma_realize; + dc->vmsd = &vmstate_xlnx_csu_dma; + device_class_set_props(dc, xlnx_csu_dma_properties); + + ssc->push = xlnx_csu_dma_stream_push; + ssc->can_push = xlnx_csu_dma_stream_can_push; +} + +static void xlnx_csu_dma_init(Object *obj) +{ + XlnxCSUDMA *s = XLNX_CSU_DMA(obj); + + memory_region_init(&s->iomem, obj, TYPE_XLNX_CSU_DMA, + XLNX_CSU_DMA_R_MAX * 4); + + object_property_add_link(obj, "stream-connected-dma", TYPE_STREAM_SINK, + (Object **)&s->tx_dev, + qdev_prop_allow_set_link_before_realize, + OBJ_PROP_LINK_STRONG); + object_property_add_link(obj, "dma", TYPE_MEMORY_REGION, + (Object **)&s->dma_mr, + qdev_prop_allow_set_link_before_realize, + OBJ_PROP_LINK_STRONG); +} + +static const TypeInfo xlnx_csu_dma_info = { + .name = TYPE_XLNX_CSU_DMA, + .parent = TYPE_SYS_BUS_DEVICE, + .instance_size = sizeof(XlnxCSUDMA), + .class_init = xlnx_csu_dma_class_init, + .instance_init = xlnx_csu_dma_init, + .interfaces = (InterfaceInfo[]) { + { TYPE_STREAM_SINK }, + { } + } +}; + +static void xlnx_csu_dma_register_types(void) +{ + type_register_static(&xlnx_csu_dma_info); +} + +type_init(xlnx_csu_dma_register_types) diff --git a/hw/dma/Kconfig b/hw/dma/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/dma/Kconfig +++ b/hw/dma/Kconfig @@ -XXX,XX +XXX,XX @@ config STP2000 config SIFIVE_PDMA bool + +config XLNX_CSU_DMA + bool + select REGISTER diff --git a/hw/dma/meson.build b/hw/dma/meson.build index XXXXXXX..XXXXXXX 100644 --- a/hw/dma/meson.build +++ b/hw/dma/meson.build @@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_dma.c', 'soc_dma.c')) softmmu_ss.add(when: 'CONFIG_PXA2XX', if_true: files('pxa2xx_dma.c')) softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files('bcm2835_dma.c')) softmmu_ss.add(when: 'CONFIG_SIFIVE_PDMA', if_true: files('sifive_pdma.c')) +softmmu_ss.add(when: 'CONFIG_XLNX_CSU_DMA', if_true: files('xlnx_csu_dma.c')) -- 2.20.1 From: Xuzhou Cheng <xuzhou.cheng@windriver.com> There are some coding convention warnings in xlnx-zynqmp.c and xlnx-zynqmp.h, as reported by: $ ./scripts/checkpatch.pl include/hw/arm/xlnx-zynqmp.h $ ./scripts/checkpatch.pl hw/arm/xlnx-zynqmp.c Let's clean them up. Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20210303135254.3970-3-bmeng.cn@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- include/hw/arm/xlnx-zynqmp.h | 3 ++- hw/arm/xlnx-zynqmp.c | 9 ++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/xlnx-zynqmp.h +++ b/include/hw/arm/xlnx-zynqmp.h @@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP) #define XLNX_ZYNQMP_GIC_REGIONS 6 -/* ZynqMP maps the ARM GIC regions (GICC, GICD ...) at consecutive 64k offsets +/* + * ZynqMP maps the ARM GIC regions (GICC, GICD ...) at consecutive 64k offsets * and under-decodes the 64k region. This mirrors the 4k regions to every 4k * aligned address in the 64k region. To implement each GIC region needs a * number of memory region aliases. diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/xlnx-zynqmp.c +++ b/hw/arm/xlnx-zynqmp.c @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) ram_size = memory_region_size(s->ddr_ram); - /* Create the DDR Memory Regions. User friendly checks should happen at + /* + * Create the DDR Memory Regions. User friendly checks should happen at * the board level */ if (ram_size > XLNX_ZYNQMP_MAX_LOW_RAM_SIZE) { - /* The RAM size is above the maximum available for the low DDR. + /* + * The RAM size is above the maximum available for the low DDR. * Create the high DDR memory region as well. */ assert(ram_size <= XLNX_ZYNQMP_MAX_RAM_SIZE); @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sdhci[i]); Object *sdhci = OBJECT(&s->sdhci[i]); - /* Compatible with: + /* + * Compatible with: * - SD Host Controller Specification Version 3.00 * - SDIO Specification Version 3.0 * - eMMC Specification Version 4.51 -- 2.20.1 From: Xuzhou Cheng <xuzhou.cheng@windriver.com> Add a Xilinx CSU DMA module to ZynqMP SoC, and connent the stream link of GQSPI to CSU DMA. Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20210303135254.3970-4-bmeng.cn@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- include/hw/arm/xlnx-zynqmp.h | 2 ++ hw/arm/xlnx-zynqmp.c | 12 ++++++++++++ hw/arm/Kconfig | 1 + 3 files changed, 15 insertions(+) diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/arm/xlnx-zynqmp.h +++ b/include/hw/arm/xlnx-zynqmp.h @@ -XXX,XX +XXX,XX @@ #include "target/arm/cpu.h" #include "qom/object.h" #include "net/can_emu.h" +#include "hw/dma/xlnx_csu_dma.h" #define TYPE_XLNX_ZYNQMP "xlnx,zynqmp" OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP) @@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState { XlnxZynqMPRTC rtc; XlnxZDMA gdma[XLNX_ZYNQMP_NUM_GDMA_CH]; XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH]; + XlnxCSUDMA qspi_dma; char *boot_cpu; ARMCPU *boot_cpu_ptr; diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/xlnx-zynqmp.c +++ b/hw/arm/xlnx-zynqmp.c @@ -XXX,XX +XXX,XX @@ #define QSPI_ADDR 0xff0f0000 #define LQSPI_ADDR 0xc0000000 #define QSPI_IRQ 15 +#define QSPI_DMA_ADDR 0xff0f0800 #define DP_ADDR 0xfd4a0000 #define DP_IRQ 113 @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj) for (i = 0; i < XLNX_ZYNQMP_NUM_ADMA_CH; i++) { object_initialize_child(obj, "adma[*]", &s->adma[i], TYPE_XLNX_ZDMA); } + + object_initialize_child(obj, "qspi-dma", &s->qspi_dma, TYPE_XLNX_CSU_DMA); } static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp) sysbus_connect_irq(SYS_BUS_DEVICE(&s->adma[i]), 0, gic_spi[adma_ch_intr[i]]); } + + if (!sysbus_realize(SYS_BUS_DEVICE(&s->qspi_dma), errp)) { + return; + } + + sysbus_mmio_map(SYS_BUS_DEVICE(&s->qspi_dma), 0, QSPI_DMA_ADDR); + sysbus_connect_irq(SYS_BUS_DEVICE(&s->qspi_dma), 0, gic_spi[QSPI_IRQ]); + object_property_set_link(OBJECT(&s->qspi), "stream-connected-dma", + OBJECT(&s->qspi_dma), errp); } static Property xlnx_zynqmp_props[] = { diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/hw/arm/Kconfig +++ b/hw/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM select SSI_M25P80 select XILINX_AXI select XILINX_SPIPS + select XLNX_CSU_DMA select XLNX_ZYNQMP select XLNX_ZDMA -- 2.20.1 From: Xuzhou Cheng <xuzhou.cheng@windriver.com> There are some coding convention warnings in xilinx_spips.c, as reported by: $ ./scripts/checkpatch.pl hw/ssi/xilinx_spips.c Let's clean them up. Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20210303135254.3970-5-bmeng.cn@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- hw/ssi/xilinx_spips.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c index XXXXXXX..XXXXXXX 100644 --- a/hw/ssi/xilinx_spips.c +++ b/hw/ssi/xilinx_spips.c @@ -XXX,XX +XXX,XX @@ FIELD(GQSPI_FIFO_CTRL, GENERIC_FIFO_RESET, 0, 1) #define R_GQSPI_GFIFO_THRESH (0x150 / 4) #define R_GQSPI_DATA_STS (0x15c / 4) -/* We use the snapshot register to hold the core state for the currently +/* + * We use the snapshot register to hold the core state for the currently * or most recently executed command. So the generic fifo format is defined * for the snapshot register */ @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_qspips_reset(DeviceState *d) xlnx_zynqmp_qspips_update_ixr(s); } -/* N way (num) in place bit striper. Lay out row wise bits (MSB to LSB) +/* + * N way (num) in place bit striper. Lay out row wise bits (MSB to LSB) * column wise (from element 0 to N-1). num is the length of x, and dir * reverses the direction of the transform. Best illustrated by example: * Each digit in the below array is a single bit (num == 3): @@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s) tx_rx[i] = tx; } } else { - /* Extract a dummy byte and generate dummy cycles according to the - * link state */ + /* + * Extract a dummy byte and generate dummy cycles according to the + * link state + */ tx = fifo8_pop(&s->tx_fifo); dummy_cycles = 8 / s->link_state; } @@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s) } break; case (SNOOP_ADDR): - /* Address has been transmitted, transmit dummy cycles now if - * needed */ + /* + * Address has been transmitted, transmit dummy cycles now if needed + */ if (s->cmd_dummies < 0) { s->snoop_state = SNOOP_NONE; } else { @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_qspips_notify(void *opaque) } static uint64_t xilinx_spips_read(void *opaque, hwaddr addr, - unsigned size) + unsigned size) { XilinxSPIPS *s = opaque; uint32_t mask = ~0; @@ -XXX,XX +XXX,XX @@ static uint64_t xlnx_zynqmp_qspips_read(void *opaque, } static void xilinx_spips_write(void *opaque, hwaddr addr, - uint64_t value, unsigned size) + uint64_t value, unsigned size) { int mask = ~0; XilinxSPIPS *s = opaque; @@ -XXX,XX +XXX,XX @@ static void xilinx_qspips_write(void *opaque, hwaddr addr, } static void xlnx_zynqmp_qspips_write(void *opaque, hwaddr addr, - uint64_t value, unsigned size) + uint64_t value, unsigned size) { XlnxZynqMPQSPIPS *s = XLNX_ZYNQMP_QSPIPS(opaque); uint32_t reg = addr / 4; -- 2.20.1 From: Xuzhou Cheng <xuzhou.cheng@windriver.com> Now that the Xilinx CSU DMA model is implemented, the existing DMA related dead codes in the ZynqMP QSPI are useless and should be removed. The maximum register number is also updated to only include the QSPI registers. Signed-off-by: Xuzhou Cheng <xuzhou.cheng@windriver.com> Signed-off-by: Bin Meng <bin.meng@windriver.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: 20210303135254.3970-6-bmeng.cn@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- include/hw/ssi/xilinx_spips.h | 2 +- hw/ssi/xilinx_spips.c | 10 ---------- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/include/hw/ssi/xilinx_spips.h b/include/hw/ssi/xilinx_spips.h index XXXXXXX..XXXXXXX 100644 --- a/include/hw/ssi/xilinx_spips.h +++ b/include/hw/ssi/xilinx_spips.h @@ -XXX,XX +XXX,XX @@ typedef struct XilinxSPIPS XilinxSPIPS; #define XLNX_SPIPS_R_MAX (0x100 / 4) -#define XLNX_ZYNQMP_SPIPS_R_MAX (0x830 / 4) +#define XLNX_ZYNQMP_SPIPS_R_MAX (0x200 / 4) /* Bite off 4k chunks at a time */ #define LQSPI_CACHE_SIZE 1024 diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c index XXXXXXX..XXXXXXX 100644 --- a/hw/ssi/xilinx_spips.c +++ b/hw/ssi/xilinx_spips.c @@ -XXX,XX +XXX,XX @@ #define R_GQSPI_MOD_ID (0x1fc / 4) #define R_GQSPI_MOD_ID_RESET (0x10a0000) -#define R_QSPIDMA_DST_CTRL (0x80c / 4) -#define R_QSPIDMA_DST_CTRL_RESET (0x803ffa00) -#define R_QSPIDMA_DST_I_MASK (0x820 / 4) -#define R_QSPIDMA_DST_I_MASK_RESET (0xfe) -#define R_QSPIDMA_DST_CTRL2 (0x824 / 4) -#define R_QSPIDMA_DST_CTRL2_RESET (0x081bfff8) - /* size of TXRX FIFOs */ #define RXFF_A (128) #define TXFF_A (128) @@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_qspips_reset(DeviceState *d) s->regs[R_GQSPI_GPIO] = 1; s->regs[R_GQSPI_LPBK_DLY_ADJ] = R_GQSPI_LPBK_DLY_ADJ_RESET; s->regs[R_GQSPI_MOD_ID] = R_GQSPI_MOD_ID_RESET; - s->regs[R_QSPIDMA_DST_CTRL] = R_QSPIDMA_DST_CTRL_RESET; - s->regs[R_QSPIDMA_DST_I_MASK] = R_QSPIDMA_DST_I_MASK_RESET; - s->regs[R_QSPIDMA_DST_CTRL2] = R_QSPIDMA_DST_CTRL2_RESET; s->man_start_com_g = false; s->gqspi_irqline = 0; xlnx_zynqmp_qspips_update_ixr(s); -- 2.20.1 The #defines INTERNAL and CASCADING represent different possible values for the TCCR.CSS register field; prefix them with CSS_ to make this more obvious, before we add more defines to represent the other possible values of the field in the next commit. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219223241.16344-2-peter.maydell@linaro.org --- hw/timer/renesas_tmr.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/hw/timer/renesas_tmr.c b/hw/timer/renesas_tmr.c index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/renesas_tmr.c +++ b/hw/timer/renesas_tmr.c @@ -XXX,XX +XXX,XX @@ REG8(TCCR, 10) FIELD(TCCR, CSS, 3, 2) FIELD(TCCR, TMRIS, 7, 1) -#define INTERNAL 0x01 -#define CASCADING 0x03 +#define CSS_INTERNAL 0x01 +#define CSS_CASCADING 0x03 #define CCLR_A 0x01 #define CCLR_B 0x02 @@ -XXX,XX +XXX,XX @@ static void update_events(RTMRState *tmr, int ch) /* event not happened */ return ; } - if (FIELD_EX8(tmr->tccr[0], TCCR, CSS) == CASCADING) { + if (FIELD_EX8(tmr->tccr[0], TCCR, CSS) == CSS_CASCADING) { /* cascading mode */ if (ch == 1) { tmr->next[ch] = none; @@ -XXX,XX +XXX,XX @@ static uint16_t read_tcnt(RTMRState *tmr, unsigned size, int ch) if (delta > 0) { tmr->tick = now; - if (FIELD_EX8(tmr->tccr[1], TCCR, CSS) == INTERNAL) { + if (FIELD_EX8(tmr->tccr[1], TCCR, CSS) == CSS_INTERNAL) { /* timer1 count update */ elapsed = elapsed_time(tmr, 1, delta); if (elapsed >= 0x100) { @@ -XXX,XX +XXX,XX @@ static uint16_t read_tcnt(RTMRState *tmr, unsigned size, int ch) tcnt[1] = tmr->tcnt[1] + (elapsed & 0xff); } switch (FIELD_EX8(tmr->tccr[0], TCCR, CSS)) { - case INTERNAL: + case CSS_INTERNAL: elapsed = elapsed_time(tmr, 0, delta); tcnt[0] = tmr->tcnt[0] + elapsed; break; - case CASCADING: + case CSS_CASCADING: if (ovf > 0) { tcnt[0] = tmr->tcnt[0] + ovf; } @@ -XXX,XX +XXX,XX @@ static uint16_t issue_event(RTMRState *tmr, int ch, int sz, qemu_irq_pulse(tmr->cmia[ch]); } if (sz == 8 && ch == 0 && - FIELD_EX8(tmr->tccr[1], TCCR, CSS) == CASCADING) { + FIELD_EX8(tmr->tccr[1], TCCR, CSS) == CSS_CASCADING) { tmr->tcnt[1]++; timer_events(tmr, 1); } @@ -XXX,XX +XXX,XX @@ static void timer_events(RTMRState *tmr, int ch) uint16_t tcnt; tmr->tcnt[ch] = read_tcnt(tmr, 1, ch); - if (FIELD_EX8(tmr->tccr[0], TCCR, CSS) != CASCADING) { + if (FIELD_EX8(tmr->tccr[0], TCCR, CSS) != CSS_CASCADING) { tmr->tcnt[ch] = issue_event(tmr, ch, 8, tmr->tcnt[ch], tmr->tcora[ch], -- 2.20.1 The read_tcnt() function calculates the TCNT register values for the two channels of the timer module; it sets these up in the local tcnt[] array, and eventually returns either one or both of them, depending on whether the access is 8 or 16 bits. However, not all of the code paths through this function set both elements of this array: if the guest has programmed the TCCR.CSS register fields to values which are either documented as not to be used or which QEMU does not implement, then the function will return uninitialized data. (This was spotted by Coverity.) Add the missing CSS cases to this code, so that we return a consistent value instead of uninitialized data, and so the code structure indicates what's happening. Fixes: CID 1429976 Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org> Message-id: 20210219223241.16344-3-peter.maydell@linaro.org --- hw/timer/renesas_tmr.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/hw/timer/renesas_tmr.c b/hw/timer/renesas_tmr.c index XXXXXXX..XXXXXXX 100644 --- a/hw/timer/renesas_tmr.c +++ b/hw/timer/renesas_tmr.c @@ -XXX,XX +XXX,XX @@ REG8(TCCR, 10) FIELD(TCCR, CSS, 3, 2) FIELD(TCCR, TMRIS, 7, 1) +#define CSS_EXTERNAL 0x00 #define CSS_INTERNAL 0x01 +#define CSS_INVALID 0x02 #define CSS_CASCADING 0x03 #define CCLR_A 0x01 #define CCLR_B 0x02 @@ -XXX,XX +XXX,XX @@ static uint16_t read_tcnt(RTMRState *tmr, unsigned size, int ch) if (delta > 0) { tmr->tick = now; - if (FIELD_EX8(tmr->tccr[1], TCCR, CSS) == CSS_INTERNAL) { + switch (FIELD_EX8(tmr->tccr[1], TCCR, CSS)) { + case CSS_INTERNAL: /* timer1 count update */ elapsed = elapsed_time(tmr, 1, delta); if (elapsed >= 0x100) { ovf = elapsed >> 8; } tcnt[1] = tmr->tcnt[1] + (elapsed & 0xff); + break; + case CSS_INVALID: /* guest error to have set this */ + case CSS_EXTERNAL: /* QEMU doesn't implement these */ + case CSS_CASCADING: + tcnt[1] = tmr->tcnt[1]; + break; } switch (FIELD_EX8(tmr->tccr[0], TCCR, CSS)) { case CSS_INTERNAL: @@ -XXX,XX +XXX,XX @@ static uint16_t read_tcnt(RTMRState *tmr, unsigned size, int ch) tcnt[0] = tmr->tcnt[0] + elapsed; break; case CSS_CASCADING: - if (ovf > 0) { - tcnt[0] = tmr->tcnt[0] + ovf; - } + tcnt[0] = tmr->tcnt[0] + ovf; + break; + case CSS_INVALID: /* guest error to have set this */ + case CSS_EXTERNAL: /* QEMU doesn't implement this */ + tcnt[0] = tmr->tcnt[0]; break; } } else { -- 2.20.1