From: Joel Stanley <joel@jms.id.au>

This is a boot stub that is similar to the code u-boot runs, allowing

the kernel to boot the secondary CPU.

u-boot works as follows:

1. Initialises the SMP mailbox area in the SCU at 0x1e6e2180 with default values

2. Copies a stub named 'mailbox_insn' from flash to the SCU, just above the

mailbox area

3. Sets AST_SMP_MBOX_FIELD_READY to a magic value to indicate the

secondary can begin execution from the stub

4. The stub waits until the AST_SMP_MBOX_FIELD_GOSIGN register is set to

a magic value

5. Jumps to the address in AST_SMP_MBOX_FIELD_ENTRY, starting Linux

Linux indicates it is ready by writing the address of its entrypoint

function to AST_SMP_MBOX_FIELD_ENTRY and the 'go' magic number to

AST_SMP_MBOX_FIELD_GOSIGN. The secondary CPU sees this at step 4 and

breaks out of it's loop.

To be compatible, a fixed qemu stub is loaded into the mailbox area. As

qemu can ensure the stub is loaded before execution starts, we do not

need to emulate the AST_SMP_MBOX_FIELD_READY behaviour of u-boot. The

secondary CPU's program counter points to the beginning of the stub,

allowing qemu to start secondaries at step four.

Reboot behaviour is preserved by resetting AST_SMP_MBOX_FIELD_GOSIGN

when the secondaries are reset.

This is only configured when the system is booted with -kernel and qemu

does not execute u-boot first.

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Tested-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Joel Stanley <joel@jms.id.au>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/aspeed.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 65 insertions(+)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed.c

+++ b/hw/arm/aspeed.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps max_ram_ops = {

.endianness = DEVICE_NATIVE_ENDIAN,

};

+#define AST_SMP_MAILBOX_BASE 0x1e6e2180

+#define AST_SMP_MBOX_FIELD_ENTRY (AST_SMP_MAILBOX_BASE + 0x0)

+#define AST_SMP_MBOX_FIELD_GOSIGN (AST_SMP_MAILBOX_BASE + 0x4)

+#define AST_SMP_MBOX_FIELD_READY (AST_SMP_MAILBOX_BASE + 0x8)

+#define AST_SMP_MBOX_FIELD_POLLINSN (AST_SMP_MAILBOX_BASE + 0xc)

+#define AST_SMP_MBOX_CODE (AST_SMP_MAILBOX_BASE + 0x10)

+#define AST_SMP_MBOX_GOSIGN 0xabbaab00

+

+static void aspeed_write_smpboot(ARMCPU *cpu,

+ const struct arm_boot_info *info)

+{

+ static const uint32_t poll_mailbox_ready[] = {

+ /*

+ * r2 = per-cpu go sign value

+ * r1 = AST_SMP_MBOX_FIELD_ENTRY

+ * r0 = AST_SMP_MBOX_FIELD_GOSIGN

+ */

+ 0xee100fb0, /* mrc p15, 0, r0, c0, c0, 5 */

+ 0xe21000ff, /* ands r0, r0, #255 */

+ 0xe59f201c, /* ldr r2, [pc, #28] */

+ 0xe1822000, /* orr r2, r2, r0 */

+

+ 0xe59f1018, /* ldr r1, [pc, #24] */

+ 0xe59f0018, /* ldr r0, [pc, #24] */

+

+ 0xe320f002, /* wfe */

+ 0xe5904000, /* ldr r4, [r0] */

+ 0xe1520004, /* cmp r2, r4 */

+ 0x1afffffb, /* bne <wfe> */

+ 0xe591f000, /* ldr pc, [r1] */

+ AST_SMP_MBOX_GOSIGN,

+ AST_SMP_MBOX_FIELD_ENTRY,

+ AST_SMP_MBOX_FIELD_GOSIGN,

+ };

+

+ rom_add_blob_fixed("aspeed.smpboot", poll_mailbox_ready,

+ sizeof(poll_mailbox_ready),

+ info->smp_loader_start);

+}

+

+static void aspeed_reset_secondary(ARMCPU *cpu,

+ const struct arm_boot_info *info)

+{

+ AddressSpace *as = arm_boot_address_space(cpu, info);

+ CPUState *cs = CPU(cpu);

+

+ /* info->smp_bootreg_addr */

+ address_space_stl_notdirty(as, AST_SMP_MBOX_FIELD_GOSIGN, 0,

+ MEMTXATTRS_UNSPECIFIED, NULL);

+ cpu_set_pc(cs, info->smp_loader_start);

+}

+

#define FIRMWARE_ADDR 0x0

static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size,

@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_init(MachineState *machine)

}

}

+ if (machine->kernel_filename && bmc->soc.num_cpus > 1) {

+ /* With no u-boot we must set up a boot stub for the secondary CPU */

+ MemoryRegion *smpboot = g_new(MemoryRegion, 1);

+ memory_region_init_ram(smpboot, OBJECT(bmc), "aspeed.smpboot",

+ 0x80, &error_abort);

+ memory_region_add_subregion(get_system_memory(),

+ AST_SMP_MAILBOX_BASE, smpboot);

+

+ aspeed_board_binfo.write_secondary_boot = aspeed_write_smpboot;

+ aspeed_board_binfo.secondary_cpu_reset_hook = aspeed_reset_secondary;

+ aspeed_board_binfo.smp_loader_start = AST_SMP_MBOX_CODE;

+ }

+

aspeed_board_binfo.ram_size = ram_size;

aspeed_board_binfo.loader_start = sc->memmap[ASPEED_SDRAM];

aspeed_board_binfo.nb_cpus = bmc->soc.num_cpus;

--

2.20.1

From: Joel Stanley <joel@jms.id.au>

There are minimal differences from Qemu's point of view between the A0

and A1 silicon revisions.

As the A1 exercises different code paths in u-boot it is desirable to

emulate that instead.

Signed-off-by: Joel Stanley <joel@jms.id.au>

Reviewed-by: Andrew Jeffery <andrew@aj.id.au>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20200504093703.261135-1-joel@jms.id.au

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/misc/aspeed_scu.h | 1 +

hw/arm/aspeed.c | 8 ++++----

hw/arm/aspeed_ast2600.c | 6 +++---

hw/misc/aspeed_scu.c | 11 +++++------

4 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/misc/aspeed_scu.h

+++ b/include/hw/misc/aspeed_scu.h

@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {

#define AST2500_A0_SILICON_REV 0x04000303U

#define AST2500_A1_SILICON_REV 0x04010303U

#define AST2600_A0_SILICON_REV 0x05000303U

+#define AST2600_A1_SILICON_REV 0x05010303U

#define ASPEED_IS_AST2500(si_rev) ((((si_rev) >> 24) & 0xff) == 0x04)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed.c

+++ b/hw/arm/aspeed.c

@@ -XXX,XX +XXX,XX @@ struct AspeedBoardState {

/* Tacoma hardware value */

#define TACOMA_BMC_HW_STRAP1 0x00000000

-#define TACOMA_BMC_HW_STRAP2 0x00000000

+#define TACOMA_BMC_HW_STRAP2 0x00000040

/*

* The max ram region is for firmwares that scan the address space

@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc, void *data)

AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);

mc->desc = "Aspeed AST2600 EVB (Cortex A7)";

- amc->soc_name = "ast2600-a0";

+ amc->soc_name = "ast2600-a1";

amc->hw_strap1 = AST2600_EVB_HW_STRAP1;

amc->hw_strap2 = AST2600_EVB_HW_STRAP2;

amc->fmc_model = "w25q512jv";

@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_tacoma_class_init(ObjectClass *oc, void *data)

MachineClass *mc = MACHINE_CLASS(oc);

AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);

- mc->desc = "Aspeed AST2600 EVB (Cortex A7)";

- amc->soc_name = "ast2600-a0";

+ mc->desc = "OpenPOWER Tacoma BMC (Cortex A7)";

+ amc->soc_name = "ast2600-a1";

amc->hw_strap1 = TACOMA_BMC_HW_STRAP1;

amc->hw_strap2 = TACOMA_BMC_HW_STRAP2;

amc->fmc_model = "mx66l1g45g";

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/aspeed_ast2600.c

+++ b/hw/arm/aspeed_ast2600.c

@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)

dc->realize = aspeed_soc_ast2600_realize;

- sc->name = "ast2600-a0";

+ sc->name = "ast2600-a1";

sc->cpu_type = ARM_CPU_TYPE_NAME("cortex-a7");

- sc->silicon_rev = AST2600_A0_SILICON_REV;

+ sc->silicon_rev = AST2600_A1_SILICON_REV;

sc->sram_size = 0x10000;

sc->spis_num = 2;

sc->ehcis_num = 2;

@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, void *data)

}

static const TypeInfo aspeed_soc_ast2600_type_info = {

- .name = "ast2600-a0",

+ .name = "ast2600-a1",

.parent = TYPE_ASPEED_SOC,

.instance_size = sizeof(AspeedSoCState),

.instance_init = aspeed_soc_ast2600_init,

diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/aspeed_scu.c

+++ b/hw/misc/aspeed_scu.c

@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_silicon_revs[] = {

AST2500_A0_SILICON_REV,

AST2500_A1_SILICON_REV,

AST2600_A0_SILICON_REV,

+ AST2600_A1_SILICON_REV,

};

bool is_supported_silicon_rev(uint32_t silicon_rev)

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_ast2600_scu_ops = {

.valid.unaligned = false,

};

-static const uint32_t ast2600_a0_resets[ASPEED_AST2600_SCU_NR_REGS] = {

- [AST2600_SILICON_REV] = AST2600_SILICON_REV,

- [AST2600_SILICON_REV2] = AST2600_SILICON_REV,

- [AST2600_SYS_RST_CTRL] = 0xF7CFFEDC | 0x100,

+static const uint32_t ast2600_a1_resets[ASPEED_AST2600_SCU_NR_REGS] = {

+ [AST2600_SYS_RST_CTRL] = 0xF7C3FED8,

[AST2600_SYS_RST_CTRL2] = 0xFFFFFFFC,

- [AST2600_CLK_STOP_CTRL] = 0xEFF43E8B,

+ [AST2600_CLK_STOP_CTRL] = 0xFFFF7F8A,

[AST2600_CLK_STOP_CTRL2] = 0xFFF0FFF0,

[AST2600_SDRAM_HANDSHAKE] = 0x00000040, /* SoC completed DRAM init */

[AST2600_HPLL_PARAM] = 0x1000405F,

@@ -XXX,XX +XXX,XX @@ static void aspeed_2600_scu_class_init(ObjectClass *klass, void *data)

dc->desc = "ASPEED 2600 System Control Unit";

dc->reset = aspeed_ast2600_scu_reset;

- asc->resets = ast2600_a0_resets;

+ asc->resets = ast2600_a1_resets;

asc->calc_hpll = aspeed_2500_scu_calc_hpll; /* No change since AST2500 */

asc->apb_divider = 4;

asc->nr_regs = ASPEED_AST2600_SCU_NR_REGS;

--

2.20.1

From: Joel Stanley <joel@jms.id.au>

The AST2600 handles this differently with the extra 'hardlock' state, so

move the testing to the soc specific class' write callback.

Signed-off-by: Joel Stanley <joel@jms.id.au>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20200505090136.341426-1-joel@jms.id.au

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/misc/aspeed_sdmc.c | 55 +++++++++++++++++++++++++++++++++++--------

1 file changed, 45 insertions(+), 10 deletions(-)

diff --git a/hw/misc/aspeed_sdmc.c b/hw/misc/aspeed_sdmc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/misc/aspeed_sdmc.c

+++ b/hw/misc/aspeed_sdmc.c

@@ -XXX,XX +XXX,XX @@

/* Protection Key Register */

#define R_PROT (0x00 / 4)

+#define PROT_UNLOCKED 0x01

+#define PROT_HARDLOCKED 0x10 /* AST2600 */

+#define PROT_SOFTLOCKED 0x00

+

#define PROT_KEY_UNLOCK 0xFC600309

+#define PROT_KEY_HARDLOCK 0xDEADDEAD /* AST2600 */

/* Configuration Register */

#define R_CONF (0x04 / 4)

@@ -XXX,XX +XXX,XX @@ static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,

return;

}

- if (addr == R_PROT) {

- s->regs[addr] = (data == PROT_KEY_UNLOCK) ? 1 : 0;

- return;

- }

-

- if (!s->regs[R_PROT]) {

- qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);

- return;

- }

-

asc->write(s, addr, data);

}

@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)

static void aspeed_2400_sdmc_write(AspeedSDMCState *s, uint32_t reg,

uint32_t data)

{

+ if (reg == R_PROT) {

+ s->regs[reg] = (data == PROT_KEY_UNLOCK) ? PROT_UNLOCKED : PROT_SOFTLOCKED;

+ return;

+ }

+

+ if (!s->regs[R_PROT]) {

+ qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);

+ return;

+ }

+

switch (reg) {

case R_CONF:

data = aspeed_2400_sdmc_compute_conf(s, data);

@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)

static void aspeed_2500_sdmc_write(AspeedSDMCState *s, uint32_t reg,

uint32_t data)

{

+ if (reg == R_PROT) {

+ s->regs[reg] = (data == PROT_KEY_UNLOCK) ? PROT_UNLOCKED : PROT_SOFTLOCKED;

+ return;

+ }

+

+ if (!s->regs[R_PROT]) {

+ qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);

+ return;

+ }

+

switch (reg) {

case R_CONF:

data = aspeed_2500_sdmc_compute_conf(s, data);

@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)

static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,

uint32_t data)

{

+ if (s->regs[R_PROT] == PROT_HARDLOCKED) {

+ qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked until system reset!\n",

+ __func__);

+ return;

+ }

+

+ if (reg != R_PROT && s->regs[R_PROT] == PROT_SOFTLOCKED) {

+ qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);

+ return;

+ }

+

switch (reg) {

+ case R_PROT:

+ if (data == PROT_KEY_UNLOCK) {

+ data = PROT_UNLOCKED;

+ } else if (data == PROT_KEY_HARDLOCK) {

+ data = PROT_HARDLOCKED;

+ } else {

+ data = PROT_SOFTLOCKED;

+ }

+ break;

case R_CONF:

data = aspeed_2600_sdmc_compute_conf(s, data);

break;

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

On the NRF51 series, all peripherals have a fixed I/O size

of 4KiB. Define NRF51_PERIPHERAL_SIZE and use it.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200504072822.18799-2-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/nrf51.h | 3 +--

include/hw/i2c/microbit_i2c.h | 2 +-

hw/arm/nrf51_soc.c | 4 ++--

hw/i2c/microbit_i2c.c | 2 +-

hw/timer/nrf51_timer.c | 2 +-

5 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/include/hw/arm/nrf51.h b/include/hw/arm/nrf51.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/nrf51.h

+++ b/include/hw/arm/nrf51.h

@@ -XXX,XX +XXX,XX @@

#define NRF51_IOMEM_BASE 0x40000000

#define NRF51_IOMEM_SIZE 0x20000000

+#define NRF51_PERIPHERAL_SIZE 0x00001000

#define NRF51_UART_BASE 0x40002000

#define NRF51_TWI_BASE 0x40003000

-#define NRF51_TWI_SIZE 0x00001000

#define NRF51_TIMER_BASE 0x40008000

-#define NRF51_TIMER_SIZE 0x00001000

#define NRF51_RNG_BASE 0x4000D000

#define NRF51_NVMC_BASE 0x4001E000

#define NRF51_GPIO_BASE 0x50000000

diff --git a/include/hw/i2c/microbit_i2c.h b/include/hw/i2c/microbit_i2c.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/i2c/microbit_i2c.h

+++ b/include/hw/i2c/microbit_i2c.h

@@ -XXX,XX +XXX,XX @@

#define MICROBIT_I2C(obj) \

OBJECT_CHECK(MicrobitI2CState, (obj), TYPE_MICROBIT_I2C)

-#define MICROBIT_I2C_NREGS (NRF51_TWI_SIZE / sizeof(uint32_t))

+#define MICROBIT_I2C_NREGS (NRF51_PERIPHERAL_SIZE / sizeof(uint32_t))

typedef struct {

SysBusDevice parent_obj;

diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/nrf51_soc.c

+++ b/hw/arm/nrf51_soc.c

@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)

return;

}

- base_addr = NRF51_TIMER_BASE + i * NRF51_TIMER_SIZE;

+ base_addr = NRF51_TIMER_BASE + i * NRF51_PERIPHERAL_SIZE;

sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);

sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,

@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)

/* STUB Peripherals */

memory_region_init_io(&s->clock, OBJECT(dev_soc), &clock_ops, NULL,

- "nrf51_soc.clock", 0x1000);

+ "nrf51_soc.clock", NRF51_PERIPHERAL_SIZE);

memory_region_add_subregion_overlap(&s->container,

NRF51_IOMEM_BASE, &s->clock, -1);

diff --git a/hw/i2c/microbit_i2c.c b/hw/i2c/microbit_i2c.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/i2c/microbit_i2c.c

+++ b/hw/i2c/microbit_i2c.c

@@ -XXX,XX +XXX,XX @@ static void microbit_i2c_realize(DeviceState *dev, Error **errp)

MicrobitI2CState *s = MICROBIT_I2C(dev);

memory_region_init_io(&s->iomem, OBJECT(s), &microbit_i2c_ops, s,

- "microbit.twi", NRF51_TWI_SIZE);

+ "microbit.twi", NRF51_PERIPHERAL_SIZE);

sysbus_init_mmio(sbd, &s->iomem);

}

diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/nrf51_timer.c

+++ b/hw/timer/nrf51_timer.c

@@ -XXX,XX +XXX,XX @@ static void nrf51_timer_init(Object *obj)

SysBusDevice *sbd = SYS_BUS_DEVICE(obj);

memory_region_init_io(&s->iomem, obj, &rng_ops, s,

- TYPE_NRF51_TIMER, NRF51_TIMER_SIZE);

+ TYPE_NRF51_TIMER, NRF51_PERIPHERAL_SIZE);

sysbus_init_mmio(sbd, &s->iomem);

sysbus_init_irq(sbd, &s->irq);

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The NRF51 series SoC have 3 timer peripherals, each having

4 counters. To help differentiate which peripheral is accessed,

display the timer ID in the trace events.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200504072822.18799-4-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/timer/nrf51_timer.h | 1 +

hw/arm/nrf51_soc.c | 5 +++++

hw/timer/nrf51_timer.c | 11 +++++++++--

hw/timer/trace-events | 4 ++--

4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/include/hw/timer/nrf51_timer.h b/include/hw/timer/nrf51_timer.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/timer/nrf51_timer.h

+++ b/include/hw/timer/nrf51_timer.h

@@ -XXX,XX +XXX,XX @@ typedef struct NRF51TimerState {

MemoryRegion iomem;

qemu_irq irq;

+ uint8_t id;

QEMUTimer timer;

int64_t timer_start_ns;

int64_t update_counter_ns;

diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/nrf51_soc.c

+++ b/hw/arm/nrf51_soc.c

@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)

/* TIMER */

for (i = 0; i < NRF51_NUM_TIMERS; i++) {

+ object_property_set_uint(OBJECT(&s->timer[i]), i, "id", &err);

+ if (err) {

+ error_propagate(errp, err);

+ return;

+ }

object_property_set_bool(OBJECT(&s->timer[i]), true, "realized", &err);

if (err) {

error_propagate(errp, err);

diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/nrf51_timer.c

+++ b/hw/timer/nrf51_timer.c

@@ -XXX,XX +XXX,XX @@

#include "hw/arm/nrf51.h"

#include "hw/irq.h"

#include "hw/timer/nrf51_timer.h"

+#include "hw/qdev-properties.h"

#include "migration/vmstate.h"

#include "trace.h"

@@ -XXX,XX +XXX,XX @@ static uint64_t nrf51_timer_read(void *opaque, hwaddr offset, unsigned int size)

__func__, offset);

}

- trace_nrf51_timer_read(offset, r, size);

+ trace_nrf51_timer_read(s->id, offset, r, size);

return r;

}

@@ -XXX,XX +XXX,XX @@ static void nrf51_timer_write(void *opaque, hwaddr offset,

uint64_t now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);

size_t idx;

- trace_nrf51_timer_write(offset, value, size);

+ trace_nrf51_timer_write(s->id, offset, value, size);

switch (offset) {

case NRF51_TIMER_TASK_START:

@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_nrf51_timer = {

}

};

+static Property nrf51_timer_properties[] = {

+ DEFINE_PROP_UINT8("id", NRF51TimerState, id, 0),

+ DEFINE_PROP_END_OF_LIST(),

+};

+

static void nrf51_timer_class_init(ObjectClass *klass, void *data)

{

DeviceClass *dc = DEVICE_CLASS(klass);

dc->reset = nrf51_timer_reset;

dc->vmsd = &vmstate_nrf51_timer;

+ device_class_set_props(dc, nrf51_timer_properties);

}

static const TypeInfo nrf51_timer_info = {

diff --git a/hw/timer/trace-events b/hw/timer/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/trace-events

+++ b/hw/timer/trace-events

@@ -XXX,XX +XXX,XX @@ cmsdk_apb_dualtimer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK

cmsdk_apb_dualtimer_reset(void) "CMSDK APB dualtimer: reset"

# nrf51_timer.c

-nrf51_timer_read(uint64_t addr, uint32_t value, unsigned size) "read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

-nrf51_timer_write(uint64_t addr, uint32_t value, unsigned size) "write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

+nrf51_timer_read(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

+nrf51_timer_write(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

# bcm2835_systmr.c

bcm2835_systmr_irq(bool enable) "timer irq state %u"

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add trace event to display timer's counter value updates.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200504072822.18799-5-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/timer/nrf51_timer.c | 1 +

hw/timer/trace-events | 1 +

2 files changed, 2 insertions(+)

diff --git a/hw/timer/nrf51_timer.c b/hw/timer/nrf51_timer.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/nrf51_timer.c

+++ b/hw/timer/nrf51_timer.c

@@ -XXX,XX +XXX,XX @@ static void nrf51_timer_write(void *opaque, hwaddr offset,

idx = (offset - NRF51_TIMER_TASK_CAPTURE_0) / 4;

s->cc[idx] = s->counter;

+ trace_nrf51_timer_set_count(s->id, idx, s->counter);

}

break;

case NRF51_TIMER_EVENT_COMPARE_0 ... NRF51_TIMER_EVENT_COMPARE_3:

diff --git a/hw/timer/trace-events b/hw/timer/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/trace-events

+++ b/hw/timer/trace-events

@@ -XXX,XX +XXX,XX @@ cmsdk_apb_dualtimer_reset(void) "CMSDK APB dualtimer: reset"

# nrf51_timer.c

nrf51_timer_read(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u read addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

nrf51_timer_write(uint8_t timer_id, uint64_t addr, uint32_t value, unsigned size) "timer %u write addr 0x%" PRIx64 " data 0x%" PRIx32 " size %u"

+nrf51_timer_set_count(uint8_t timer_id, uint8_t counter_id, uint32_t value) "timer %u counter %u count 0x%" PRIx32

# bcm2835_systmr.c

bcm2835_systmr_irq(bool enable) "timer irq state %u"

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200508154359.7494-2-richard.henderson@linaro.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/core/cpu.h | 23 +++++++++++++++++++++++

1 file changed, 23 insertions(+)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/core/cpu.h

+++ b/include/hw/core/cpu.h

@@ -XXX,XX +XXX,XX @@ int cpu_watchpoint_remove(CPUState *cpu, vaddr addr,

vaddr len, int flags);

void cpu_watchpoint_remove_by_ref(CPUState *cpu, CPUWatchpoint *watchpoint);

void cpu_watchpoint_remove_all(CPUState *cpu, int mask);

+

+/**

+ * cpu_check_watchpoint:

+ * @cpu: cpu context

+ * @addr: guest virtual address

+ * @len: access length

+ * @attrs: memory access attributes

+ * @flags: watchpoint access type

+ * @ra: unwind return address

+ *

+ * Check for a watchpoint hit in [addr, addr+len) of the type

+ * specified by @flags. Exit via exception with a hit.

+ */

void cpu_check_watchpoint(CPUState *cpu, vaddr addr, vaddr len,

MemTxAttrs attrs, int flags, uintptr_t ra);

+

+/**

+ * cpu_watchpoint_address_matches:

+ * @cpu: cpu context

+ * @addr: guest virtual address

+ * @len: access length

+ *

+ * Return the watchpoint flags that apply to [addr, addr+len).

+ * If no watchpoint is registered for the range, the result is 0.

+ */

int cpu_watchpoint_address_matches(CPUState *cpu, vaddr addr, vaddr len);

#endif

--

2.20.1