[Qemu-devel] [RFC PATCH 00/14] hw/arm: Add the Raspberry Pi 4B

[Qemu-devel] [RFC PATCH 00/14] hw/arm: Add the Raspberry Pi 4B

[Philippe Mathieu-Daudé]

Esteban wrote me over the weekend asking about raspi4 progress.
I cleaned up my patches/notes to pass him. Other help is also welcomed :)
I got scared trying to understand how to use the GIC, and wire the various
IRQs.

Most important notes about testing are in patch #12:
"Add the BCM2838 which uses a GICv2"

Not much works yet, it only runs a bit until configuring the GIC.

branch pushed at https://gitlab.com/philmd/qemu/commits/raspi4_wip

Regards,

Phil.

based-on: 20190903120555.7551-1-philmd@redhat.com
cutils: Move size_to_str() from "qemu-common.h" to "qemu/cutils.h"
https://lists.gnu.org/archive/html/qemu-devel/2019-09/msg00229.html

Philippe Mathieu-Daudé (14):
  hw/arm/raspi: Use the IEC binary prefix definitions
  hw/misc/bcm2835_property: Add FIXME comment for uninitialized memory
  hw/misc/bcm2835_property: Handle the 'domain state' property
  hw/arm/bcm2835_peripherals: Improve logging
  hw/arm/bcm2835_peripherals: Name various address spaces
  hw/arm/bcm2835: Rename some definitions
  hw/arm/bcm2835: Add various unimplemented peripherals
  hw/arm/bcm2836: Make the SoC code modular
  hw/arm/raspi: Make the board code modular
  hw/arm/raspi: Define various blocks base addresses
  hw/arm/bcm2835_peripherals: Map various BCM2838 blocks
  hw/arm/bcm2836: Add the BCM2838 which uses a GICv2
  hw/arm/bcm2838: Map the PCIe memory space
  hw/arm/raspi: Add the Raspberry Pi 4B board

 hw/arm/bcm2835_peripherals.c         |  49 ++++++++-
 hw/arm/bcm2836.c                     | 103 +++++++++++++++++--
 hw/arm/raspi.c                       | 142 ++++++++++++++++++++++++---
 hw/char/bcm2835_aux.c                |   5 +-
 hw/display/bcm2835_fb.c              |   2 +-
 hw/dma/bcm2835_dma.c                 |  10 +-
 hw/intc/bcm2836_control.c            |   7 +-
 hw/misc/bcm2835_mbox.c               |   9 +-
 hw/misc/bcm2835_property.c           |  28 ++++--
 include/hw/arm/bcm2835_peripherals.h |  18 ++++
 include/hw/arm/bcm2836.h             |   3 +
 include/hw/arm/raspi_platform.h      |  79 ++++++++++++---
 12 files changed, 393 insertions(+), 62 deletions(-)

-- 
2.20.1

[Qemu-devel] [PATCH 01/14] hw/arm/raspi: Use the IEC binary prefix definitions

[Philippe Mathieu-Daudé]

IEC binary prefixes ease code review: the unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/raspi.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 74c062d05e..615d755879 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -230,7 +230,7 @@ static void raspi2_machine_init(MachineClass *mc)
     mc->max_cpus = BCM283X_NCPUS;
     mc->min_cpus = BCM283X_NCPUS;
     mc->default_cpus = BCM283X_NCPUS;
-    mc->default_ram_size = 1024 * 1024 * 1024;
+    mc->default_ram_size = 1 * GiB;
     mc->ignore_memory_transaction_failures = true;
 };
 DEFINE_MACHINE("raspi2", raspi2_machine_init)
@@ -252,7 +252,7 @@ static void raspi3_machine_init(MachineClass *mc)
     mc->max_cpus = BCM283X_NCPUS;
     mc->min_cpus = BCM283X_NCPUS;
     mc->default_cpus = BCM283X_NCPUS;
-    mc->default_ram_size = 1024 * 1024 * 1024;
+    mc->default_ram_size = 1 * GiB;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
 #endif
-- 
2.20.1

Re: [PATCH 01/14] hw/arm/raspi: Use the IEC binary prefix definitions

[Esteban Bosse]

[-- Attachment #1: Type: text/plain, Size: 1235 bytes --]

Reviewed-by: Esteban

El mié., 4 sept. 2019 a las 19:13, Philippe Mathieu-Daudé (<f4bug@amsat.org>)
escribió:

> IEC binary prefixes ease code review: the unit is explicit.
>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/raspi.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
> index 74c062d05e..615d755879 100644
> --- a/hw/arm/raspi.c
> +++ b/hw/arm/raspi.c
> @@ -230,7 +230,7 @@ static void raspi2_machine_init(MachineClass *mc)
>      mc->max_cpus = BCM283X_NCPUS;
>      mc->min_cpus = BCM283X_NCPUS;
>      mc->default_cpus = BCM283X_NCPUS;
> -    mc->default_ram_size = 1024 * 1024 * 1024;
> +    mc->default_ram_size = 1 * GiB;
>      mc->ignore_memory_transaction_failures = true;
>  };
>  DEFINE_MACHINE("raspi2", raspi2_machine_init)
> @@ -252,7 +252,7 @@ static void raspi3_machine_init(MachineClass *mc)
>      mc->max_cpus = BCM283X_NCPUS;
>      mc->min_cpus = BCM283X_NCPUS;
>      mc->default_cpus = BCM283X_NCPUS;
> -    mc->default_ram_size = 1024 * 1024 * 1024;
> +    mc->default_ram_size = 1 * GiB;
>  }
>  DEFINE_MACHINE("raspi3", raspi3_machine_init)
>  #endif
> --
> 2.20.1
>
>

[-- Attachment #2: Type: text/html, Size: 1722 bytes --]

Re: [PATCH 01/14] hw/arm/raspi: Use the IEC binary prefix definitions

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> IEC binary prefixes ease code review: the unit is explicit.
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/raspi.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
> index 74c062d05e..615d755879 100644
> --- a/hw/arm/raspi.c
> +++ b/hw/arm/raspi.c
> @@ -230,7 +230,7 @@ static void raspi2_machine_init(MachineClass *mc)
>      mc->max_cpus = BCM283X_NCPUS;
>      mc->min_cpus = BCM283X_NCPUS;
>      mc->default_cpus = BCM283X_NCPUS;
> -    mc->default_ram_size = 1024 * 1024 * 1024;
> +    mc->default_ram_size = 1 * GiB;
>      mc->ignore_memory_transaction_failures = true;
>  };
>  DEFINE_MACHINE("raspi2", raspi2_machine_init)
> @@ -252,7 +252,7 @@ static void raspi3_machine_init(MachineClass *mc)
>      mc->max_cpus = BCM283X_NCPUS;
>      mc->min_cpus = BCM283X_NCPUS;
>      mc->default_cpus = BCM283X_NCPUS;
> -    mc->default_ram_size = 1024 * 1024 * 1024;
> +    mc->default_ram_size = 1 * GiB;
>  }
>  DEFINE_MACHINE("raspi3", raspi3_machine_init)
>  #endif

Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

[Qemu-devel] [PATCH 02/14] hw/misc/bcm2835_property: Add FIXME comment for uninitialized memory

[Philippe Mathieu-Daudé]

We are returning unintialized memory, this is probably unsafe.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/misc/bcm2835_property.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index d86d510572..399f0d9dd5 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -57,6 +57,7 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
         case 0x00010001: /* Get board model */
             qemu_log_mask(LOG_UNIMP,
                           "bcm2835_property: %x get board model NYI\n", tag);
+            /* FIXME returning uninitialized memory */
             resplen = 4;
             break;
         case 0x00010002: /* Get board revision */
@@ -70,6 +71,7 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
         case 0x00010004: /* Get board serial */
             qemu_log_mask(LOG_UNIMP,
                           "bcm2835_property: %x get board serial NYI\n", tag);
+            /* FIXME returning uninitialized memory */
             resplen = 8;
             break;
         case 0x00010005: /* Get ARM memory */
-- 
2.20.1

[Qemu-devel] [RFC PATCH 03/14] hw/misc/bcm2835_property: Handle the 'domain state' property

[Philippe Mathieu-Daudé]

The kernel is happy with this change, so we don't need
to do anything more sophisticated.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/misc/bcm2835_property.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index 399f0d9dd5..d8eb28f267 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -127,6 +127,14 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             resplen = 8;
             break;
 
+        case 0x00030030: /* Get domain state */
+            qemu_log_mask(LOG_UNIMP,
+                          "bcm2835_property: 0x%08x get domain state NYI\n",
+                          tag);
+            /* FIXME returning uninitialized memory */
+            resplen = 8;
+            break;
+
         case 0x00038002: /* Set clock rate */
         case 0x00038004: /* Set max clock rate */
         case 0x00038007: /* Set min clock rate */
-- 
2.20.1

Re: [RFC PATCH 03/14] hw/misc/bcm2835_property: Handle the 'domain state' property

[Esteban Bosse]

[-- Attachment #1: Type: text/plain, Size: 1556 bytes --]

Searching this property in the kernel, I found a lot of properties not
implemented.
https://github.com/raspberrypi/linux/blob/rpi-4.19.y/include/soc/bcm2835/raspberrypi-firmware.h#L41
Are the properties only added when they are necessaries for the standard
kernel use?

Reviewed-by: EstebanB

El mié., 4 sept. 2019 a las 19:13, Philippe Mathieu-Daudé (<f4bug@amsat.org>)
escribió:

> The kernel is happy with this change, so we don't need
> to do anything more sophisticated.
>
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/misc/bcm2835_property.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
> index 399f0d9dd5..d8eb28f267 100644
> --- a/hw/misc/bcm2835_property.c
> +++ b/hw/misc/bcm2835_property.c
> @@ -127,6 +127,14 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>              resplen = 8;
>              break;
>
> +        case 0x00030030: /* Get domain state */
> +            qemu_log_mask(LOG_UNIMP,
> +                          "bcm2835_property: 0x%08x get domain state
> NYI\n",
> +                          tag);
> +            /* FIXME returning uninitialized memory */
> +            resplen = 8;
> +            break;
> +
>          case 0x00038002: /* Set clock rate */
>          case 0x00038004: /* Set max clock rate */
>          case 0x00038007: /* Set min clock rate */
> --
> 2.20.1
>
>

[-- Attachment #2: Type: text/html, Size: 2233 bytes --]

Re: [RFC PATCH 03/14] hw/misc/bcm2835_property: Handle the 'domain state' property

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> The kernel is happy with this change, so we don't need
> to do anything more sophisticated.
> 
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/misc/bcm2835_property.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
> index 399f0d9dd5..d8eb28f267 100644
> --- a/hw/misc/bcm2835_property.c
> +++ b/hw/misc/bcm2835_property.c
> @@ -127,6 +127,14 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>              resplen = 8;
>              break;
>  
> +        case 0x00030030: /* Get domain state */
> +            qemu_log_mask(LOG_UNIMP,
> +                          "bcm2835_property: 0x%08x get domain state
> NYI\n",
> +                          tag);
> +            /* FIXME returning uninitialized memory */
> +            resplen = 8;
> +            break;
> +
>          case 0x00038002: /* Set clock rate */
>          case 0x00038004: /* Set max clock rate */
>          case 0x00038007: /* Set min clock rate */

Searching this property in the kernel, I found a lot of properties not
implemented. 
https://github.com/raspberrypi/linux/blob/rpi-4.19.y/include/soc/bcm2835/raspberrypi-firmware.h#L41
Are the properties only added when they are necessaries for the
standard kernel use?

Re: [RFC PATCH 03/14] hw/misc/bcm2835_property: Handle the 'domain state' property

[Philippe Mathieu-Daudé]

On 9/29/19 9:01 AM, Esteban Bosse wrote:
> El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
>> The kernel is happy with this change, so we don't need
>> to do anything more sophisticated.
>>
>> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>> ---
>>   hw/misc/bcm2835_property.c | 8 ++++++++
>>   1 file changed, 8 insertions(+)
>>
>> diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
>> index 399f0d9dd5..d8eb28f267 100644
>> --- a/hw/misc/bcm2835_property.c
>> +++ b/hw/misc/bcm2835_property.c
>> @@ -127,6 +127,14 @@ static void
>> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>>               resplen = 8;
>>               break;
>>   
>> +        case 0x00030030: /* Get domain state */
>> +            qemu_log_mask(LOG_UNIMP,
>> +                          "bcm2835_property: 0x%08x get domain state
>> NYI\n",
>> +                          tag);
>> +            /* FIXME returning uninitialized memory */
>> +            resplen = 8;
>> +            break;
>> +
>>           case 0x00038002: /* Set clock rate */
>>           case 0x00038004: /* Set max clock rate */
>>           case 0x00038007: /* Set min clock rate */
> 
> Searching this property in the kernel, I found a lot of properties not
> implemented.
> https://github.com/raspberrypi/linux/blob/rpi-4.19.y/include/soc/bcm2835/raspberrypi-firmware.h#L41
> Are the properties only added when they are necessaries for the
> standard kernel use?

Yes, the idea is to emulate the bare minimum required to run your guest 
code. To test this series I used the closed source kernel provided by 
the Raspberry Pi foundation [1] which the one that does the most of 
UNIMP accesses, the Debian trunk one and I build one from [2].

The problem is old kernels don't support the raspi4, and recent kernels 
do a lot of property calls to use recent features.

A "property call" is a call from the ARM core to the VideoCore firmware, 
like a Remote Procedure Call. The ARM core write some 
arguments/structure to a memory space shared with the VideoCore, use a 
MailBox to send a 'property' key to the VideoCore and wait/poll for a 
response from the VC. The VC handles the 'property' call, if required 
fills the structure in the same memory space the ARM used, then reply 
via another MailBox channel to notify the ARM core.

QEMU does not model the VideoCore. Instead we directly fill the memory 
from the ARM property call. We fake the VC firmware.

[1] https://github.com/raspberrypi/firmware/blob/master/boot/kernel8.img
[2] https://github.com/raspberrypi/linux/tree/rpi-5.3.y

Re: [RFC PATCH 03/14] hw/misc/bcm2835_property: Handle the 'domain state' property

[Esteban Bosse]

El mar, 08-10-2019 a las 11:32 +0200, Philippe Mathieu-Daudé escribió:
> On 9/29/19 9:01 AM, Esteban Bosse wrote:
> > El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé
> > escribió:
> > > The kernel is happy with this change, so we don't need
> > > to do anything more sophisticated.
> > > 
> > > Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
> > > Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> > > ---
> > >   hw/misc/bcm2835_property.c | 8 ++++++++
> > >   1 file changed, 8 insertions(+)
> > > 
> > > diff --git a/hw/misc/bcm2835_property.c
> > > b/hw/misc/bcm2835_property.c
> > > index 399f0d9dd5..d8eb28f267 100644
> > > --- a/hw/misc/bcm2835_property.c
> > > +++ b/hw/misc/bcm2835_property.c
> > > @@ -127,6 +127,14 @@ static void
> > > bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t
> > > value)
> > >               resplen = 8;
> > >               break;
> > >   
> > > +        case 0x00030030: /* Get domain state */
> > > +            qemu_log_mask(LOG_UNIMP,
> > > +                          "bcm2835_property: 0x%08x get domain
> > > state
> > > NYI\n",
> > > +                          tag);
> > > +            /* FIXME returning uninitialized memory */
> > > +            resplen = 8;
> > > +            break;
> > > +
> > >           case 0x00038002: /* Set clock rate */
> > >           case 0x00038004: /* Set max clock rate */
> > >           case 0x00038007: /* Set min clock rate */
> > 
> > Searching this property in the kernel, I found a lot of properties
> > not
> > implemented.
> > https://github.com/raspberrypi/linux/blob/rpi-4.19.y/include/soc/bcm2835/raspberrypi-firmware.h#L41
> > Are the properties only added when they are necessaries for the
> > standard kernel use?
> 
> Yes, the idea is to emulate the bare minimum required to run your
> guest 
> code. To test this series I used the closed source kernel provided
> by 
> the Raspberry Pi foundation [1] which the one that does the most of 
> UNIMP accesses, the Debian trunk one and I build one from [2].
> 
> The problem is old kernels don't support the raspi4, and recent
> kernels 
> do a lot of property calls to use recent features.
> 
> A "property call" is a call from the ARM core to the VideoCore
> firmware, 
> like a Remote Procedure Call. The ARM core write some 
> arguments/structure to a memory space shared with the VideoCore, use
> a 
> MailBox to send a 'property' key to the VideoCore and wait/poll for
> a 
> response from the VC. The VC handles the 'property' call, if
> required 
> fills the structure in the same memory space the ARM used, then
> reply 
> via another MailBox channel to notify the ARM core.
> 
> QEMU does not model the VideoCore. Instead we directly fill the
> memory 
> from the ARM property call. We fake the VC firmware.
> 
> [1] 
> https://github.com/raspberrypi/firmware/blob/master/boot/kernel8.img
> [2] https://github.com/raspberrypi/linux/tree/rpi-5.3.y
Thank you very much for all the data Phil.

Now I understood "the idea is to support the bare minimum for the
guest", I thought that the idea was a full HW support, but make sense
it's a lot of work to give full HW support.

[Qemu-devel] [PATCH 04/14] hw/arm/bcm2835_peripherals: Improve logging

[Philippe Mathieu-Daudé]

Various logging improvements as once:
- Use 0x prefix for hex numbers
- Display value written during write accesses
- Move some logs from GUEST_ERROR to UNIMP

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
v2: Use PRIx64 format (pm215)
---
 hw/char/bcm2835_aux.c      |  5 +++--
 hw/dma/bcm2835_dma.c       |  8 ++++----
 hw/intc/bcm2836_control.c  |  7 ++++---
 hw/misc/bcm2835_mbox.c     |  7 ++++---
 hw/misc/bcm2835_property.c | 16 ++++++++++------
 5 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
index 3f855196e3..a6fc1bf152 100644
--- a/hw/char/bcm2835_aux.c
+++ b/hw/char/bcm2835_aux.c
@@ -162,8 +162,9 @@ static void bcm2835_aux_write(void *opaque, hwaddr offset, uint64_t value,
     switch (offset) {
     case AUX_ENABLES:
         if (value != 1) {
-            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI "
-                          "or disable UART\n", __func__);
+            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI"
+                                     " or disable UART: 0x%"PRIx64"\n",
+                          __func__, value);
         }
         break;
 
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index 192bd377a0..6acc2b644e 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -180,7 +180,7 @@ static uint64_t bcm2835_dma_read(BCM2835DMAState *s, hwaddr offset,
         res = ch->debug;
         break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         break;
     }
@@ -228,7 +228,7 @@ static void bcm2835_dma_write(BCM2835DMAState *s, hwaddr offset,
         ch->debug = value;
         break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         break;
     }
@@ -247,7 +247,7 @@ static uint64_t bcm2835_dma0_read(void *opaque, hwaddr offset, unsigned size)
         case BCM2708_DMA_ENABLE:
             return s->enable;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                           __func__, offset);
             return 0;
         }
@@ -274,7 +274,7 @@ static void bcm2835_dma0_write(void *opaque, hwaddr offset, uint64_t value,
             s->enable = (value & 0xffff);
             break;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%"HWADDR_PRIx"\n",
                           __func__, offset);
         }
     }
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index 04229b8a17..61f884ff9e 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -264,7 +264,7 @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
     } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
         return s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2];
     } else {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         return 0;
     }
@@ -293,8 +293,9 @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
     } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
         s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2] &= ~val;
     } else {
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
-                      __func__, offset);
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
+                                 " value 0x%"PRIx64"\n",
+                      __func__, offset, val);
         return;
     }
 
diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index 79bad11631..7690b9afaf 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -176,7 +176,7 @@ static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
         break;
 
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
                       __func__, offset);
         return 0;
     }
@@ -228,8 +228,9 @@ static void bcm2835_mbox_write(void *opaque, hwaddr offset,
         break;
 
     default:
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
-                      __func__, offset);
+        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
+                                 " value 0x%"PRIx64"\n",
+                      __func__, offset, value);
         return;
     }
 
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index d8eb28f267..ab66d3572e 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -56,7 +56,8 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
         case 0x00010001: /* Get board model */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x get board model NYI\n", tag);
+                          "bcm2835_property: 0x%08x get board model NYI\n",
+                          tag);
             /* FIXME returning uninitialized memory */
             resplen = 4;
             break;
@@ -70,7 +71,8 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
         case 0x00010004: /* Get board serial */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x get board serial NYI\n", tag);
+                          "bcm2835_property: 0x%08x get board serial NYI\n",
+                          tag);
             /* FIXME returning uninitialized memory */
             resplen = 8;
             break;
@@ -106,7 +108,8 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
 
         case 0x00038001: /* Set clock state */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x set clock state NYI\n", tag);
+                          "bcm2835_property: 0x%08x set clock state NYI\n",
+                          tag);
             resplen = 8;
             break;
 
@@ -139,7 +142,8 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
         case 0x00038004: /* Set max clock rate */
         case 0x00038007: /* Set min clock rate */
             qemu_log_mask(LOG_UNIMP,
-                          "bcm2835_property: %x set clock rates NYI\n", tag);
+                          "bcm2835_property: 0x%08x set clock rate NYI\n",
+                          tag);
             resplen = 8;
             break;
 
@@ -284,8 +288,8 @@ static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
             break;
 
         default:
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "bcm2835_property: unhandled tag %08x\n", tag);
+            qemu_log_mask(LOG_UNIMP,
+                          "bcm2835_property: unhandled tag 0x%08x\n", tag);
             break;
         }
 
-- 
2.20.1

Re: [PATCH 04/14] hw/arm/bcm2835_peripherals: Improve logging

[Esteban Bosse]

[-- Attachment #1: Type: text/plain, Size: 10464 bytes --]

El mié., 4 sept. 2019 a las 19:13, Philippe Mathieu-Daudé (<f4bug@amsat.org>)
escribió:

> Various logging improvements as once:
> - Use 0x prefix for hex numbers
> - Display value written during write accesses
> - Move some logs from GUEST_ERROR to UNIMP
>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> v2: Use PRIx64 format (pm215)
> ---
>  hw/char/bcm2835_aux.c      |  5 +++--
>  hw/dma/bcm2835_dma.c       |  8 ++++----
>  hw/intc/bcm2836_control.c  |  7 ++++---
>  hw/misc/bcm2835_mbox.c     |  7 ++++---
>  hw/misc/bcm2835_property.c | 16 ++++++++++------
>  5 files changed, 25 insertions(+), 18 deletions(-)
>
> diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
> index 3f855196e3..a6fc1bf152 100644
> --- a/hw/char/bcm2835_aux.c
> +++ b/hw/char/bcm2835_aux.c
> @@ -162,8 +162,9 @@ static void bcm2835_aux_write(void *opaque, hwaddr
> offset, uint64_t value,
>      switch (offset) {
>      case AUX_ENABLES:
>          if (value != 1) {
> -            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable
> SPI "
> -                          "or disable UART\n", __func__);
> +            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable
> SPI"
> +                                     " or disable UART: 0x%"PRIx64"\n",
> +                          __func__, value);
>          }
>          break;
>
> I found others qemu_log_mask calls in this file, why did you only add
"0x%" to this calls ?

Icho :: qemu/qemu/hw 148 » grep -r qemu_log_mask char/bcm2835_aux.c
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_LCR_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_MCR_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_MSR_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_SCRATCH unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_BAUD_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
            qemu_log_mask(LOG_UNIMP, "%s: unsupported attempt to enable SPI
"
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_LCR_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_MCR_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_SCRATCH unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_CNTL_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_UNIMP, "%s: AUX_MU_BAUD_REG unsupported\n",
__func__);
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",


> diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
> index 192bd377a0..6acc2b644e 100644
> --- a/hw/dma/bcm2835_dma.c
> +++ b/hw/dma/bcm2835_dma.c
> @@ -180,7 +180,7 @@ static uint64_t bcm2835_dma_read(BCM2835DMAState *s,
> hwaddr offset,
>          res = ch->debug;
>          break;
>      default:
> -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
> +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset
> 0x%"HWADDR_PRIx"\n",
>                        __func__, offset);
>          break;
>      }
> @@ -228,7 +228,7 @@ static void bcm2835_dma_write(BCM2835DMAState *s,
> hwaddr offset,
>          ch->debug = value;
>          break;
>      default:
> -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
> +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset
> 0x%"HWADDR_PRIx"\n",
>                        __func__, offset);
>          break;
>      }
> @@ -247,7 +247,7 @@ static uint64_t bcm2835_dma0_read(void *opaque, hwaddr
> offset, unsigned size)
>          case BCM2708_DMA_ENABLE:
>              return s->enable;
>          default:
> -            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset
> %"HWADDR_PRIx"\n",
> +            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset
> 0x%"HWADDR_PRIx"\n",
>                            __func__, offset);
>              return 0;
>          }
> @@ -274,7 +274,7 @@ static void bcm2835_dma0_write(void *opaque, hwaddr
> offset, uint64_t value,
>              s->enable = (value & 0xffff);
>              break;
>          default:
> -            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset
> %"HWADDR_PRIx"\n",
> +            qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset
> 0x%"HWADDR_PRIx"\n",
>                            __func__, offset);
>          }
>      }
> diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
> index 04229b8a17..61f884ff9e 100644
> --- a/hw/intc/bcm2836_control.c
> +++ b/hw/intc/bcm2836_control.c
> @@ -264,7 +264,7 @@ static uint64_t bcm2836_control_read(void *opaque,
> hwaddr offset, unsigned size)
>      } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
>          return s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2];
>      } else {
> -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
> +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset
> 0x%"HWADDR_PRIx"\n",
>                        __func__, offset);
>          return 0;
>      }
> @@ -293,8 +293,9 @@ static void bcm2836_control_write(void *opaque, hwaddr
> offset,
>      } else if (offset >= REG_MBOX0_RDCLR && offset < REG_LIMIT) {
>          s->mailboxes[(offset - REG_MBOX0_RDCLR) >> 2] &= ~val;
>      } else {
> -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
> -                      __func__, offset);
> +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
> +                                 " value 0x%"PRIx64"\n",
> +                      __func__, offset, val);
>          return;
>      }
>
> diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
> index 79bad11631..7690b9afaf 100644
> --- a/hw/misc/bcm2835_mbox.c
> +++ b/hw/misc/bcm2835_mbox.c
> @@ -176,7 +176,7 @@ static uint64_t bcm2835_mbox_read(void *opaque, hwaddr
> offset, unsigned size)
>          break;
>
>      default:
> -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
> +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset
> 0x%"HWADDR_PRIx"\n",
>                        __func__, offset);
>          return 0;
>      }
> @@ -228,8 +228,9 @@ static void bcm2835_mbox_write(void *opaque, hwaddr
> offset,
>          break;
>
>      default:
> -        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
> -                      __func__, offset);
> +        qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
> +                                 " value 0x%"PRIx64"\n",
> +                      __func__, offset, value);
>          return;
>      }
>
> Same question here:
Icho :: qemu/qemu/hw 148 » grep -r qemu_log_mask misc/bcm2835_mbox.c
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
            qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__);
                qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n",
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",


> diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
> index d8eb28f267..ab66d3572e 100644
> --- a/hw/misc/bcm2835_property.c
> +++ b/hw/misc/bcm2835_property.c
> @@ -56,7 +56,8 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>              break;
>          case 0x00010001: /* Get board model */
>              qemu_log_mask(LOG_UNIMP,
> -                          "bcm2835_property: %x get board model NYI\n",
> tag);
> +                          "bcm2835_property: 0x%08x get board model
> NYI\n",
> +                          tag);
>              /* FIXME returning uninitialized memory */
>              resplen = 4;
>              break;
> @@ -70,7 +71,8 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>              break;
>          case 0x00010004: /* Get board serial */
>              qemu_log_mask(LOG_UNIMP,
> -                          "bcm2835_property: %x get board serial NYI\n",
> tag);
> +                          "bcm2835_property: 0x%08x get board serial
> NYI\n",
> +                          tag);
>              /* FIXME returning uninitialized memory */
>              resplen = 8;
>              break;
> @@ -106,7 +108,8 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>
>          case 0x00038001: /* Set clock state */
>              qemu_log_mask(LOG_UNIMP,
> -                          "bcm2835_property: %x set clock state NYI\n",
> tag);
> +                          "bcm2835_property: 0x%08x set clock state
> NYI\n",
> +                          tag);
>              resplen = 8;
>              break;
>
> @@ -139,7 +142,8 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>          case 0x00038004: /* Set max clock rate */
>          case 0x00038007: /* Set min clock rate */
>              qemu_log_mask(LOG_UNIMP,
> -                          "bcm2835_property: %x set clock rates NYI\n",
> tag);
> +                          "bcm2835_property: 0x%08x set clock rate NYI\n",
> +                          tag);
>              resplen = 8;
>              break;
>
> @@ -284,8 +288,8 @@ static void
> bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
>              break;
>
>          default:
> -            qemu_log_mask(LOG_GUEST_ERROR,
> -                          "bcm2835_property: unhandled tag %08x\n", tag);
> +            qemu_log_mask(LOG_UNIMP,
> +                          "bcm2835_property: unhandled tag 0x%08x\n",
> tag);
>              break;
>          }
>
 Same question here:
 Icho :: qemu/qemu/hw 148 » grep -r qemu_log_mask misc/bcm2835_property.c
            qemu_log_mask(LOG_UNIMP,
            qemu_log_mask(LOG_UNIMP,
            qemu_log_mask(LOG_UNIMP,
            qemu_log_mask(LOG_UNIMP,
            qemu_log_mask(LOG_GUEST_ERROR,
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",

>  --
> 2.20.1
>

I found other calls to qemu_log_mask in others files:
hw/display/bcm2835_fb.c, hw/gpio/bcm2835_gpio.c, hw/intc/bcm2835_ic.c,
hw/misc/bcm2835_rng.c and hw/sd/bcm2835_sdhost.c.

[-- Attachment #2: Type: text/html, Size: 13377 bytes --]

[Qemu-devel] [PATCH 05/14] hw/arm/bcm2835_peripherals: Name various address spaces

[Philippe Mathieu-Daudé]

Various address spaces from the BCM2835 are reported as
'anonymous' in memory tree:

  (qemu) info mtree

  address-space: anonymous
    0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
      0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
      0000000000000080-000000000000008f (prio 0, i/o): bcm2835-property

  address-space: anonymous
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

  [...]

Since the address_space_init() function takes a 'name' argument,
set it to correctly describe each address space:

  (qemu) info mtree

  address-space: bcm2835-mbox-memory
    0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
      0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
      0000000000000080-000000000000008f (prio 0, i/o): bcm2835-property

  address-space: bcm2835-fb-memory
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

  address-space: bcm2835-property-memory
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

  address-space: bcm2835-dma-memory
    0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
      0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
      0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
      00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/display/bcm2835_fb.c    | 2 +-
 hw/dma/bcm2835_dma.c       | 2 +-
 hw/misc/bcm2835_mbox.c     | 2 +-
 hw/misc/bcm2835_property.c | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
index 8f856878cd..85aaa54330 100644
--- a/hw/display/bcm2835_fb.c
+++ b/hw/display/bcm2835_fb.c
@@ -425,7 +425,7 @@ static void bcm2835_fb_realize(DeviceState *dev, Error **errp)
     s->initial_config.base = s->vcram_base + BCM2835_FB_OFFSET;
 
     s->dma_mr = MEMORY_REGION(obj);
-    address_space_init(&s->dma_as, s->dma_mr, NULL);
+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_FB "-memory");
 
     bcm2835_fb_reset(dev);
 
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index 6acc2b644e..1e458d7fba 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -383,7 +383,7 @@ static void bcm2835_dma_realize(DeviceState *dev, Error **errp)
     }
 
     s->dma_mr = MEMORY_REGION(obj);
-    address_space_init(&s->dma_as, s->dma_mr, NULL);
+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_DMA "-memory");
 
     bcm2835_dma_reset(dev);
 }
diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index 7690b9afaf..77285624c9 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -311,7 +311,7 @@ static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
     }
 
     s->mbox_mr = MEMORY_REGION(obj);
-    address_space_init(&s->mbox_as, s->mbox_mr, NULL);
+    address_space_init(&s->mbox_as, s->mbox_mr, TYPE_BCM2835_MBOX "-memory");
     bcm2835_mbox_reset(dev);
 }
 
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index ab66d3572e..3dff5a7157 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -417,7 +417,7 @@ static void bcm2835_property_realize(DeviceState *dev, Error **errp)
     }
 
     s->dma_mr = MEMORY_REGION(obj);
-    address_space_init(&s->dma_as, s->dma_mr, NULL);
+    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_PROPERTY "-memory");
 
     /* TODO: connect to MAC address of USB NIC device, once we emulate it */
     qemu_macaddr_default_if_unset(&s->macaddr);
-- 
2.20.1

Re: [PATCH 05/14] hw/arm/bcm2835_peripherals: Name various address spaces

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> Various address spaces from the BCM2835 are reported as
> 'anonymous' in memory tree:
> 
>   (qemu) info mtree
> 
>   address-space: anonymous
>     0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
>       0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
>       0000000000000080-000000000000008f (prio 0, i/o): bcm2835-
> property
> 
>   address-space: anonymous
>     0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
>       0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-
> peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
>       0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
> 
>   [...]
> 
> Since the address_space_init() function takes a 'name' argument,
> set it to correctly describe each address space:
> 
>   (qemu) info mtree
> 
>   address-space: bcm2835-mbox-memory
>     0000000000000000-000000000000008f (prio 0, i/o): bcm2835-mbox
>       0000000000000010-000000000000001f (prio 0, i/o): bcm2835-fb
>       0000000000000080-000000000000008f (prio 0, i/o): bcm2835-
> property
> 
>   address-space: bcm2835-fb-memory
>     0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
>       0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-
> peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
>       0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
> 
>   address-space: bcm2835-property-memory
>     0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
>       0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-
> peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
>       0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
> 
>   address-space: bcm2835-dma-memory
>     0000000000000000-00000000ffffffff (prio 0, i/o): bcm2835-gpu
>       0000000000000000-000000003fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       0000000040000000-000000007fffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       000000007e000000-000000007effffff (prio 1, i/o): alias bcm2835-
> peripherals @bcm2835-peripherals 0000000000000000-0000000000ffffff
>       0000000080000000-00000000bfffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
>       00000000c0000000-00000000ffffffff (prio 0, i/o): alias bcm2835-
> gpu-ram-alias[*] @ram 0000000000000000-000000003fffffff
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/display/bcm2835_fb.c    | 2 +-
>  hw/dma/bcm2835_dma.c       | 2 +-
>  hw/misc/bcm2835_mbox.c     | 2 +-
>  hw/misc/bcm2835_property.c | 2 +-
>  4 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
> index 8f856878cd..85aaa54330 100644
> --- a/hw/display/bcm2835_fb.c
> +++ b/hw/display/bcm2835_fb.c
> @@ -425,7 +425,7 @@ static void bcm2835_fb_realize(DeviceState *dev,
> Error **errp)
>      s->initial_config.base = s->vcram_base + BCM2835_FB_OFFSET;
>  
>      s->dma_mr = MEMORY_REGION(obj);
> -    address_space_init(&s->dma_as, s->dma_mr, NULL);
> +    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_FB "-
> memory");
>  
>      bcm2835_fb_reset(dev);
>  
> diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
> index 6acc2b644e..1e458d7fba 100644
> --- a/hw/dma/bcm2835_dma.c
> +++ b/hw/dma/bcm2835_dma.c
> @@ -383,7 +383,7 @@ static void bcm2835_dma_realize(DeviceState *dev,
> Error **errp)
>      }
>  
>      s->dma_mr = MEMORY_REGION(obj);
> -    address_space_init(&s->dma_as, s->dma_mr, NULL);
> +    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_DMA "-
> memory");
>  
>      bcm2835_dma_reset(dev);
>  }
> diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
> index 7690b9afaf..77285624c9 100644
> --- a/hw/misc/bcm2835_mbox.c
> +++ b/hw/misc/bcm2835_mbox.c
> @@ -311,7 +311,7 @@ static void bcm2835_mbox_realize(DeviceState
> *dev, Error **errp)
>      }
>  
>      s->mbox_mr = MEMORY_REGION(obj);
> -    address_space_init(&s->mbox_as, s->mbox_mr, NULL);
> +    address_space_init(&s->mbox_as, s->mbox_mr, TYPE_BCM2835_MBOX "-
> memory");
>      bcm2835_mbox_reset(dev);
>  }
>  
> diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
> index ab66d3572e..3dff5a7157 100644
> --- a/hw/misc/bcm2835_property.c
> +++ b/hw/misc/bcm2835_property.c
> @@ -417,7 +417,7 @@ static void bcm2835_property_realize(DeviceState
> *dev, Error **errp)
>      }
>  
>      s->dma_mr = MEMORY_REGION(obj);
> -    address_space_init(&s->dma_as, s->dma_mr, NULL);
> +    address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_PROPERTY
> "-memory");
>  
>      /* TODO: connect to MAC address of USB NIC device, once we
> emulate it */
>      qemu_macaddr_default_if_unset(&s->macaddr);

Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

[Qemu-devel] [PATCH 06/14] hw/arm/bcm2835: Rename some definitions

[Philippe Mathieu-Daudé]

The UART1 is part of the AUX peripheral,
the PCM_CLOCK (yet unimplemented) is part of the CPRMAN.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/bcm2835_peripherals.c    | 4 ++--
 include/hw/arm/raspi_platform.h | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index 8984e2e91f..270357b5a8 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -175,7 +175,7 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    memory_region_add_subregion(&s->peri_mr, UART1_OFFSET,
+    memory_region_add_subregion(&s->peri_mr, AUX_OFFSET,
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->aux), 0));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->aux), 0,
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
@@ -268,7 +268,7 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    memory_region_add_subregion(&s->peri_mr, EMMC_OFFSET,
+    memory_region_add_subregion(&s->peri_mr, EMMC1_OFFSET,
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->sdhci), 0));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index 10083d33df..6f7db85bab 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -39,7 +39,7 @@
                                                       * Doorbells & Mailboxes */
 #define PM_OFFSET               0x100000 /* Power Management, Reset controller
                                           * and Watchdog registers */
-#define PCM_CLOCK_OFFSET        0x101098
+#define CPRMAN_OFFSET           0x101000 /* Clock Management */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
 #define UART0_OFFSET            0x201000
@@ -47,11 +47,11 @@
 #define I2S_OFFSET              0x203000
 #define SPI0_OFFSET             0x204000
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
-#define UART1_OFFSET            0x215000
-#define EMMC_OFFSET             0x300000
+#define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
+#define EMMC1_OFFSET            0x300000
 #define SMI_OFFSET              0x600000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
-#define USB_OFFSET              0x980000 /* DTC_OTG USB controller */
+#define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
 
 /* GPU interrupts */
-- 
2.20.1

Re: [PATCH 06/14] hw/arm/bcm2835: Rename some definitions

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> The UART1 is part of the AUX peripheral,
> the PCM_CLOCK (yet unimplemented) is part of the CPRMAN.
> 
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/bcm2835_peripherals.c    | 4 ++--
>  include/hw/arm/raspi_platform.h | 8 ++++----
>  2 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/hw/arm/bcm2835_peripherals.c
> b/hw/arm/bcm2835_peripherals.c
> index 8984e2e91f..270357b5a8 100644
> --- a/hw/arm/bcm2835_peripherals.c
> +++ b/hw/arm/bcm2835_peripherals.c
> @@ -175,7 +175,7 @@ static void
> bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>          return;
>      }
>  
> -    memory_region_add_subregion(&s->peri_mr, UART1_OFFSET,
> +    memory_region_add_subregion(&s->peri_mr, AUX_OFFSET,
>                  sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->aux), 0));
>      sysbus_connect_irq(SYS_BUS_DEVICE(&s->aux), 0,
>          qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
> @@ -268,7 +268,7 @@ static void
> bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>          return;
>      }
>  
> -    memory_region_add_subregion(&s->peri_mr, EMMC_OFFSET,
> +    memory_region_add_subregion(&s->peri_mr, EMMC1_OFFSET,
>                  sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->sdhci),
> 0));
>      sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
>          qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
> diff --git a/include/hw/arm/raspi_platform.h
> b/include/hw/arm/raspi_platform.h
> index 10083d33df..6f7db85bab 100644
> --- a/include/hw/arm/raspi_platform.h
> +++ b/include/hw/arm/raspi_platform.h
> @@ -39,7 +39,7 @@
>                                                        * Doorbells &
> Mailboxes */
>  #define PM_OFFSET               0x100000 /* Power Management, Reset
> controller
>                                            * and Watchdog registers
> */
> -#define PCM_CLOCK_OFFSET        0x101098
> +#define CPRMAN_OFFSET           0x101000 /* Clock Management */
>  #define RNG_OFFSET              0x104000
>  #define GPIO_OFFSET             0x200000
>  #define UART0_OFFSET            0x201000
> @@ -47,11 +47,11 @@
>  #define I2S_OFFSET              0x203000
>  #define SPI0_OFFSET             0x204000
>  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
> -#define UART1_OFFSET            0x215000
> -#define EMMC_OFFSET             0x300000
> +#define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
> +#define EMMC1_OFFSET            0x300000
>  #define SMI_OFFSET              0x600000
>  #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
> -#define USB_OFFSET              0x980000 /* DTC_OTG USB controller
> */
> +#define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller
> */
>  #define DMA15_OFFSET            0xE05000 /* DMA controller, channel
> 15 */
>  
>  /* GPU interrupts */
Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

[Qemu-devel] [PATCH 07/14] hw/arm/bcm2835: Add various unimplemented peripherals

[Philippe Mathieu-Daudé]

Base addresses and sizes taken from the "BCM2835 ARM Peripherals"
datasheet from February 06 2012:
https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/bcm2835_peripherals.c         | 30 ++++++++++++++++++++++++++++
 include/hw/arm/bcm2835_peripherals.h | 14 +++++++++++++
 include/hw/arm/raspi_platform.h      |  8 ++++++++
 3 files changed, 52 insertions(+)

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index 270357b5a8..be6270b8ef 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -22,6 +22,20 @@
 /* Capabilities for SD controller: no DMA, high-speed, default clocks etc. */
 #define BCM2835_SDHC_CAPAREG 0x52134b4
 
+static void create_unimp(BCM2835PeripheralState *ps,
+                         UnimplementedDeviceState *uds,
+                         const char *name, hwaddr ofs, hwaddr size)
+{
+    sysbus_init_child_obj(OBJECT(ps), name, uds,
+                          sizeof(UnimplementedDeviceState),
+                          TYPE_UNIMPLEMENTED_DEVICE);
+    qdev_prop_set_string(DEVICE(uds), "name", name);
+    qdev_prop_set_uint64(DEVICE(uds), "size", size);
+    object_property_set_bool(OBJECT(uds), true, "realized", &error_fatal);
+    memory_region_add_subregion(&ps->peri_mr, ofs,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(uds), 0));
+}
+
 static void bcm2835_peripherals_init(Object *obj)
 {
     BCM2835PeripheralState *s = BCM2835_PERIPHERALS(obj);
@@ -322,6 +336,22 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, err);
         return;
     }
+
+    create_unimp(s, &s->pm, "bcm2835-pm", PM_OFFSET, 0x1000);
+    create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET, 0x1000);
+    create_unimp(s, &s->a2w, "bcm2835-a2w", 0x102000, 0x1000);
+    create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
+    create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
+    create_unimp(s, &s->spi0, "bcm2835-spi0", SPI0_OFFSET, 0x20);
+    create_unimp(s, &s->bscsl, "bcm2835-spis", BSC_SL_OFFSET, 0x100);
+    create_unimp(s, &s->i2c[0], "bcm2835-i2c0", BSC0_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[1], "bcm2835-i2c1", BSC1_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[2], "bcm2835-i2c2", BSC2_OFFSET, 0x20);
+    create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
+    create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
+    create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
+    create_unimp(s, &s->dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x100);
+    create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
 static void bcm2835_peripherals_class_init(ObjectClass *oc, void *data)
diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index 6b17f6a382..44a182b399 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -23,6 +23,7 @@
 #include "hw/sd/sdhci.h"
 #include "hw/sd/bcm2835_sdhost.h"
 #include "hw/gpio/bcm2835_gpio.h"
+#include "hw/misc/unimp.h"
 
 #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
 #define BCM2835_PERIPHERALS(obj) \
@@ -37,6 +38,9 @@ typedef struct BCM2835PeripheralState {
     MemoryRegion ram_alias[4];
     qemu_irq irq, fiq;
 
+    UnimplementedDeviceState pm;
+    UnimplementedDeviceState cprman;
+    UnimplementedDeviceState a2w;
     PL011State uart0;
     BCM2835AuxState aux;
     BCM2835FBState fb;
@@ -48,6 +52,16 @@ typedef struct BCM2835PeripheralState {
     SDHCIState sdhci;
     BCM2835SDHostState sdhost;
     BCM2835GpioState gpio;
+    UnimplementedDeviceState i2s;
+    UnimplementedDeviceState spi0;
+    UnimplementedDeviceState i2c[3];
+    UnimplementedDeviceState otp;
+    UnimplementedDeviceState dbus;
+    UnimplementedDeviceState ave0;
+    UnimplementedDeviceState bscsl;
+    UnimplementedDeviceState smi;
+    UnimplementedDeviceState dwc2;
+    UnimplementedDeviceState sdramc;
 } BCM2835PeripheralState;
 
 #endif /* BCM2835_PERIPHERALS_H */
diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index 6f7db85bab..069edab526 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -40,6 +40,7 @@
 #define PM_OFFSET               0x100000 /* Power Management, Reset controller
                                           * and Watchdog registers */
 #define CPRMAN_OFFSET           0x101000 /* Clock Management */
+#define AVS_OFFSET              0x103000 /* Audio Video Standard */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
 #define UART0_OFFSET            0x201000
@@ -47,11 +48,18 @@
 #define I2S_OFFSET              0x203000
 #define SPI0_OFFSET             0x204000
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
+#define OTP_OFFSET              0x20f000
+#define AVSP_OFFSET             0x130000
+#define BSC_SL_OFFSET           0x214000 /* SPI slave */
 #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 #define EMMC1_OFFSET            0x300000
 #define SMI_OFFSET              0x600000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
+#define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
+#define DBUS_OFFSET             0x900000
+#define AVE0_OFFSET             0x910000
 #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
+#define SDRAMC_OFFSET           0xe00000
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
 
 /* GPU interrupts */
-- 
2.20.1

Re: [PATCH 07/14] hw/arm/bcm2835: Add various unimplemented peripherals

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> Base addresses and sizes taken from the "BCM2835 ARM Peripherals"
> datasheet from February 06 2012:
> https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
> 
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/bcm2835_peripherals.c         | 30
> ++++++++++++++++++++++++++++
>  include/hw/arm/bcm2835_peripherals.h | 14 +++++++++++++
>  include/hw/arm/raspi_platform.h      |  8 ++++++++
>  3 files changed, 52 insertions(+)
> 
> diff --git a/hw/arm/bcm2835_peripherals.c
> b/hw/arm/bcm2835_peripherals.c
> index 270357b5a8..be6270b8ef 100644
> --- a/hw/arm/bcm2835_peripherals.c
> +++ b/hw/arm/bcm2835_peripherals.c
> @@ -22,6 +22,20 @@
>  /* Capabilities for SD controller: no DMA, high-speed, default
> clocks etc. */
>  #define BCM2835_SDHC_CAPAREG 0x52134b4
>  
> +static void create_unimp(BCM2835PeripheralState *ps,
> +                         UnimplementedDeviceState *uds,
> +                         const char *name, hwaddr ofs, hwaddr size)
> +{
> +    sysbus_init_child_obj(OBJECT(ps), name, uds,
> +                          sizeof(UnimplementedDeviceState),
> +                          TYPE_UNIMPLEMENTED_DEVICE);
> +    qdev_prop_set_string(DEVICE(uds), "name", name);
> +    qdev_prop_set_uint64(DEVICE(uds), "size", size);
> +    object_property_set_bool(OBJECT(uds), true, "realized",
> &error_fatal);
> +    memory_region_add_subregion(&ps->peri_mr, ofs,
> +                                sysbus_mmio_get_region(SYS_BUS_DEVIC
> E(uds), 0));
> +}
> +
>  static void bcm2835_peripherals_init(Object *obj)
>  {
>      BCM2835PeripheralState *s = BCM2835_PERIPHERALS(obj);
> @@ -322,6 +336,22 @@ static void
> bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>          error_propagate(errp, err);
>          return;
>      }
> +
> +    create_unimp(s, &s->pm, "bcm2835-pm", PM_OFFSET, 0x1000);
> +    create_unimp(s, &s->cprman, "bcm2835-cprman", CPRMAN_OFFSET,
> 0x1000);
> +    create_unimp(s, &s->a2w, "bcm2835-a2w", 0x102000, 0x1000);
> +    create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
> +    create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
> +    create_unimp(s, &s->spi0, "bcm2835-spi0", SPI0_OFFSET, 0x20);
> +    create_unimp(s, &s->bscsl, "bcm2835-spis", BSC_SL_OFFSET,
> 0x100);
> +    create_unimp(s, &s->i2c[0], "bcm2835-i2c0", BSC0_OFFSET, 0x20);
> +    create_unimp(s, &s->i2c[1], "bcm2835-i2c1", BSC1_OFFSET, 0x20);
> +    create_unimp(s, &s->i2c[2], "bcm2835-i2c2", BSC2_OFFSET, 0x20);
> +    create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
> +    create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
> +    create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
> +    create_unimp(s, &s->dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x100);
> +    create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET,
> 0x100);
>  }
>  
>  static void bcm2835_peripherals_class_init(ObjectClass *oc, void
> *data)
> diff --git a/include/hw/arm/bcm2835_peripherals.h
> b/include/hw/arm/bcm2835_peripherals.h
> index 6b17f6a382..44a182b399 100644
> --- a/include/hw/arm/bcm2835_peripherals.h
> +++ b/include/hw/arm/bcm2835_peripherals.h
> @@ -23,6 +23,7 @@
>  #include "hw/sd/sdhci.h"
>  #include "hw/sd/bcm2835_sdhost.h"
>  #include "hw/gpio/bcm2835_gpio.h"
> +#include "hw/misc/unimp.h"
>  
>  #define TYPE_BCM2835_PERIPHERALS "bcm2835-peripherals"
>  #define BCM2835_PERIPHERALS(obj) \
> @@ -37,6 +38,9 @@ typedef struct BCM2835PeripheralState {
>      MemoryRegion ram_alias[4];
>      qemu_irq irq, fiq;
>  
> +    UnimplementedDeviceState pm;
> +    UnimplementedDeviceState cprman;
> +    UnimplementedDeviceState a2w;
>      PL011State uart0;
>      BCM2835AuxState aux;
>      BCM2835FBState fb;
> @@ -48,6 +52,16 @@ typedef struct BCM2835PeripheralState {
>      SDHCIState sdhci;
>      BCM2835SDHostState sdhost;
>      BCM2835GpioState gpio;
> +    UnimplementedDeviceState i2s;
> +    UnimplementedDeviceState spi0;
> +    UnimplementedDeviceState i2c[3];
> +    UnimplementedDeviceState otp;
> +    UnimplementedDeviceState dbus;
> +    UnimplementedDeviceState ave0;
> +    UnimplementedDeviceState bscsl;
> +    UnimplementedDeviceState smi;
> +    UnimplementedDeviceState dwc2;
> +    UnimplementedDeviceState sdramc;
>  } BCM2835PeripheralState;
>  
>  #endif /* BCM2835_PERIPHERALS_H */
> diff --git a/include/hw/arm/raspi_platform.h
> b/include/hw/arm/raspi_platform.h
> index 6f7db85bab..069edab526 100644
> --- a/include/hw/arm/raspi_platform.h
> +++ b/include/hw/arm/raspi_platform.h
> @@ -40,6 +40,7 @@
>  #define PM_OFFSET               0x100000 /* Power Management, Reset
> controller
>                                            * and Watchdog registers
> */
>  #define CPRMAN_OFFSET           0x101000 /* Clock Management */
> +#define AVS_OFFSET              0x103000 /* Audio Video Standard */
>  #define RNG_OFFSET              0x104000
>  #define GPIO_OFFSET             0x200000
>  #define UART0_OFFSET            0x201000
> @@ -47,11 +48,18 @@
>  #define I2S_OFFSET              0x203000
>  #define SPI0_OFFSET             0x204000
>  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
> +#define OTP_OFFSET              0x20f000
> +#define AVSP_OFFSET             0x130000
> +#define BSC_SL_OFFSET           0x214000 /* SPI slave */
>  #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
>  #define EMMC1_OFFSET            0x300000
>  #define SMI_OFFSET              0x600000
>  #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
> +#define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
> +#define DBUS_OFFSET             0x900000
> +#define AVE0_OFFSET             0x910000
>  #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller
> */
> +#define SDRAMC_OFFSET           0xe00000
>  #define DMA15_OFFSET            0xE05000 /* DMA controller, channel
> 15 */
>  
>  /* GPU interrupts */
Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

[Qemu-devel] [PATCH 08/14] hw/arm/bcm2836: Make the SoC code modular

[Philippe Mathieu-Daudé]

This file creates the BCM2836/BCM2837 blocks.
The biggest differences with the BCM2838 we are going to add, are
the base addresses of the interrupt controller and the peripherals.
Add these addresses in the BCM283XInfo structure to make this
block more modular. Remove the MCORE_OFFSET offset as it is
not useful and rather confusing.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/bcm2836.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 493a913f89..019e67b906 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -16,15 +16,11 @@
 #include "hw/arm/raspi_platform.h"
 #include "hw/sysbus.h"
 
-/* Peripheral base address seen by the CPU */
-#define BCM2836_PERI_BASE       0x3F000000
-
-/* "QA7" (Pi2) interrupt controller and mailboxes etc. */
-#define BCM2836_CONTROL_BASE    0x40000000
-
 struct BCM283XInfo {
     const char *name;
     const char *cpu_type;
+    hwaddr peri_base; /* Peripheral base address seen by the CPU */
+    hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
     int clusterid;
 };
 
@@ -32,12 +28,16 @@ static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
         .cpu_type = ARM_CPU_TYPE_NAME("cortex-a7"),
+        .peri_base = 0x3f000000,
+        .ctrl_base = 0x40000000,
         .clusterid = 0xf,
     },
 #ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
         .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
+        .peri_base = 0x3f000000,
+        .ctrl_base = 0x40000000,
         .clusterid = 0x0,
     },
 #endif
@@ -104,7 +104,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     }
 
     sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->peripherals), 0,
-                            BCM2836_PERI_BASE, 1);
+                            info->peri_base, 1);
 
     /* bcm2836 interrupt controller (and mailboxes, etc.) */
     object_property_set_bool(OBJECT(&s->control), true, "realized", &err);
@@ -113,7 +113,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, BCM2836_CONTROL_BASE);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info->ctrl_base);
 
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-irq", 0));
@@ -126,7 +126,7 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
         /* set periphbase/CBAR value for CPU-local registers */
         object_property_set_int(OBJECT(&s->cpus[n]),
-                                BCM2836_PERI_BASE + MCORE_OFFSET,
+                                info->peri_base,
                                 "reset-cbar", &err);
         if (err) {
             error_propagate(errp, err);
-- 
2.20.1

Re: [PATCH 08/14] hw/arm/bcm2836: Make the SoC code modular

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> This file creates the BCM2836/BCM2837 blocks.
> The biggest differences with the BCM2838 we are going to add, are
> the base addresses of the interrupt controller and the peripherals.
> Add these addresses in the BCM283XInfo structure to make this
> block more modular. Remove the MCORE_OFFSET offset as it is
> not useful and rather confusing.
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/bcm2836.c | 18 +++++++++---------
>  1 file changed, 9 insertions(+), 9 deletions(-)
> 
> diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
> index 493a913f89..019e67b906 100644
> --- a/hw/arm/bcm2836.c
> +++ b/hw/arm/bcm2836.c
> @@ -16,15 +16,11 @@
>  #include "hw/arm/raspi_platform.h"
>  #include "hw/sysbus.h"
>  
> -/* Peripheral base address seen by the CPU */
> -#define BCM2836_PERI_BASE       0x3F000000
> -
> -/* "QA7" (Pi2) interrupt controller and mailboxes etc. */
> -#define BCM2836_CONTROL_BASE    0x40000000
> -
>  struct BCM283XInfo {
>      const char *name;
>      const char *cpu_type;
> +    hwaddr peri_base; /* Peripheral base address seen by the CPU */
> +    hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
>      int clusterid;
>  };
>  
> @@ -32,12 +28,16 @@ static const BCM283XInfo bcm283x_socs[] = {
>      {
>          .name = TYPE_BCM2836,
>          .cpu_type = ARM_CPU_TYPE_NAME("cortex-a7"),
> +        .peri_base = 0x3f000000,
> +        .ctrl_base = 0x40000000,
>          .clusterid = 0xf,
>      },
>  #ifdef TARGET_AARCH64
>      {
>          .name = TYPE_BCM2837,
>          .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
> +        .peri_base = 0x3f000000,
> +        .ctrl_base = 0x40000000,
>          .clusterid = 0x0,
>      },
>  #endif
> @@ -104,7 +104,7 @@ static void bcm2836_realize(DeviceState *dev,
> Error **errp)
>      }
>  
>      sysbus_mmio_map_overlap(SYS_BUS_DEVICE(&s->peripherals), 0,
> -                            BCM2836_PERI_BASE, 1);
> +                            info->peri_base, 1);
>  
>      /* bcm2836 interrupt controller (and mailboxes, etc.) */
>      object_property_set_bool(OBJECT(&s->control), true, "realized",
> &err);
> @@ -113,7 +113,7 @@ static void bcm2836_realize(DeviceState *dev,
> Error **errp)
>          return;
>      }
>  
> -    sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0,
> BCM2836_CONTROL_BASE);
> +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info-
> >ctrl_base);
>  
>      sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
>          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-irq", 0));
> @@ -126,7 +126,7 @@ static void bcm2836_realize(DeviceState *dev,
> Error **errp)
>  
>          /* set periphbase/CBAR value for CPU-local registers */
>          object_property_set_int(OBJECT(&s->cpus[n]),
> -                                BCM2836_PERI_BASE + MCORE_OFFSET,
> +                                info->peri_base,
>                                  "reset-cbar", &err);
>          if (err) {
>              error_propagate(errp, err);
Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

[Qemu-devel] [PATCH 09/14] hw/arm/raspi: Make the board code modular

[Philippe Mathieu-Daudé]

Our code currently create the raspi2 (based on the BCM2836)
and the raspi3 (on the BCM2837). Similarly, the raspi4 is
based on the BCM2838. To be able to add the new board,
make the current code more modular:

- Dynamically fills the 'board-rev' value
- Allow DRAM sizes different than 1 GiB

Rename the board model name as 'B' since this is the one
encoded in the 'board-rev' tag.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/raspi.c | 107 +++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 94 insertions(+), 13 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 615d755879..b4db39661f 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -13,6 +13,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "cpu.h"
 #include "hw/arm/bcm2836.h"
@@ -29,8 +30,67 @@
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
 #define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
-/* Table of Linux board IDs for different Pi versions */
-static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
+enum BoardIdManufacturer {
+    M_SONY_UK = 0,
+    M_EMBEST = 2,
+};
+
+enum BoardIdChip {
+    C_BCM2835 = 0,
+    C_BCM2836 = 1,
+    C_BCM2837 = 2,
+};
+
+enum BoardIdType {
+    T_2B = 0x04,
+    T_3B = 0x08,
+};
+
+enum BoardIdRevision {
+    R_1_0 = 0,
+    R_1_1 = 1,
+    R_1_2 = 2,
+    R_1_3 = 3,
+};
+
+static const char *processor_typename[] = {
+    [C_BCM2836] = TYPE_BCM2836,
+    [C_BCM2837] = TYPE_BCM2837,
+};
+
+typedef struct BoardInfo BoardInfo;
+
+struct BoardInfo {
+    /* Table of Linux board IDs for different Pi versions */
+    int board_id;
+    /*
+     * Board revision codes:
+     * www.raspberrypi.org/documentation/hardware/raspberrypi/revision-codes/
+     */
+    struct {
+        enum BoardIdType type;
+        enum BoardIdRevision revision;
+        enum BoardIdChip chip;
+        enum BoardIdManufacturer manufacturer;
+    } board_rev;
+    uint64_t ram_size_min;
+    uint64_t ram_size_max;
+};
+
+static const BoardInfo bcm283x_boards[] = {
+    [2] = {
+        .board_id = 0xc43,
+        .board_rev = { T_2B, R_1_1, C_BCM2836, M_EMBEST },
+        .ram_size_min = 1 * GiB,
+        .ram_size_max = 1 * GiB,
+    },
+    [3] = {
+        .board_id = 0xc44,
+        .board_rev = { T_3B, R_1_2, C_BCM2837, M_SONY_UK },
+        .ram_size_min = 1 * GiB,
+        .ram_size_max = 1 * GiB,
+    },
+};
 
 typedef struct RasPiState {
     BCM283XState soc;
@@ -114,7 +174,7 @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     static struct arm_boot_info binfo;
     int r;
 
-    binfo.board_id = raspi_boardid[version];
+    binfo.board_id = bcm283x_boards[version].board_id;
     binfo.ram_size = ram_size;
     binfo.nb_cpus = machine->smp.cpus;
 
@@ -146,7 +206,7 @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      * the normal Linux boot process
      */
     if (machine->firmware) {
-        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
+        hwaddr firmware_addr = version >= 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
         /* load the firmware image (typically kernel.img) */
         r = load_image_targphys(machine->firmware, firmware_addr,
                                 ram_size - firmware_addr);
@@ -170,16 +230,32 @@ static void raspi_init(MachineState *machine, int version)
     BlockBackend *blk;
     BusState *bus;
     DeviceState *carddev;
+    char *size_str;
+    int board_rev;
+    const char *soc_type;
 
-    if (machine->ram_size > 1 * GiB) {
+    if (machine->ram_size < bcm283x_boards[version].ram_size_min) {
+        size_str = size_to_str(bcm283x_boards[version].ram_size_min);
+        error_report("Requested ram size is too small for this machine: "
+                     "minimum is %s", size_str);
+        g_free(size_str);
+        exit(1);
+    }
+    if (machine->ram_size > bcm283x_boards[version].ram_size_max) {
+        size_str = size_to_str(bcm283x_boards[version].ram_size_max);
         error_report("Requested ram size is too large for this machine: "
-                     "maximum is 1GB");
+                     "maximum is %s", size_str);
+        g_free(size_str);
+        exit(1);
+    }
+    if (!is_power_of_2(machine->ram_size)) {
+        error_report("Requested ram size is not a power of 2");
         exit(1);
     }
 
+    soc_type = processor_typename[bcm283x_boards[version].board_rev.chip];
     object_initialize_child(OBJECT(machine), "soc", &s->soc, sizeof(s->soc),
-                            version == 3 ? TYPE_BCM2837 : TYPE_BCM2836,
-                            &error_abort, NULL);
+                            soc_type, &error_abort, NULL);
 
     /* Allocate and map RAM */
     memory_region_allocate_system_memory(&s->ram, OBJECT(machine), "ram",
@@ -192,9 +268,14 @@ static void raspi_init(MachineState *machine, int version)
                                    &error_abort);
     object_property_set_int(OBJECT(&s->soc), machine->smp.cpus, "enabled-cpus",
                             &error_abort);
-    int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-    object_property_set_int(OBJECT(&s->soc), board_rev, "board-rev",
-                            &error_abort);
+
+    board_rev = ((63 - clz64(machine->ram_size / MiB)) << 20)
+                | (bcm283x_boards[version].board_rev.manufacturer << 16)
+                | (bcm283x_boards[version].board_rev.chip << 12)
+                | (bcm283x_boards[version].board_rev.type << 4)
+                | (bcm283x_boards[version].board_rev.revision << 0);
+    object_property_set_int(OBJECT(&s->soc), board_rev,
+                            "board-rev", &error_abort);
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_abort);
 
     /* Create and plug in the SD cards */
@@ -221,7 +302,7 @@ static void raspi2_init(MachineState *machine)
 
 static void raspi2_machine_init(MachineClass *mc)
 {
-    mc->desc = "Raspberry Pi 2";
+    mc->desc = "Raspberry Pi 2B";
     mc->init = raspi2_init;
     mc->block_default_type = IF_SD;
     mc->no_parallel = 1;
@@ -243,7 +324,7 @@ static void raspi3_init(MachineState *machine)
 
 static void raspi3_machine_init(MachineClass *mc)
 {
-    mc->desc = "Raspberry Pi 3";
+    mc->desc = "Raspberry Pi 3B";
     mc->init = raspi3_init;
     mc->block_default_type = IF_SD;
     mc->no_parallel = 1;
-- 
2.20.1

[Qemu-devel] [PATCH 10/14] hw/arm/raspi: Define various blocks base addresses

[Philippe Mathieu-Daudé]

The Raspberry firmware is closed-source. While running it, it
accesses various I/O registers. Logging these accesses as UNIMP
(unimplemented) help to understand what the firmware is doing
(ideally we want it able to boot a Linux kernel).

Document various blocks we might use later.

Adresses and names based on:
https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 include/hw/arm/raspi_platform.h | 49 +++++++++++++++++++++++++++------
 1 file changed, 40 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index 069edab526..c6f4985522 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -25,42 +25,73 @@
 #ifndef HW_ARM_RASPI_PLATFORM_H
 #define HW_ARM_RASPI_PLATFORM_H
 
-#define MCORE_OFFSET            0x0000   /* Fake frame buffer device
-                                          * (the multicore sync block) */
-#define IC0_OFFSET              0x2000
+#define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
+#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2 TX */
+#define INTE_OFFSET             0x2000   /* VC Interrupt controller */
 #define ST_OFFSET               0x3000   /* System Timer */
+#define TXP_OFFSET              0x4000
+#define JPEG_OFFSET             0x5000
 #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
 #define DMA_OFFSET              0x7000   /* DMA controller, channels 0-14 */
-#define ARM_OFFSET              0xB000   /* BCM2708 ARM control block */
+#define ARBA_OFFSET             0x9000
+#define BRDG_OFFSET             0xa000
+#define ARM_OFFSET              0xB000   /* ARM control block */
 #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
 #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt controller */
-#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
+#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 (SP804) */
 #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
                                                       * Doorbells & Mailboxes */
 #define PM_OFFSET               0x100000 /* Power Management, Reset controller
                                           * and Watchdog registers */
 #define CPRMAN_OFFSET           0x101000 /* Clock Management */
+#define A2W_OFFSET              0x102000
 #define AVS_OFFSET              0x103000 /* Audio Video Standard */
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
-#define UART0_OFFSET            0x201000
-#define MMCI0_OFFSET            0x202000
-#define I2S_OFFSET              0x203000
-#define SPI0_OFFSET             0x204000
+#define UART0_OFFSET            0x201000 /* PL011 */
+#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
+#define I2S_OFFSET              0x203000 /* PCM */
+#define SPI0_OFFSET             0x204000 /* SPI master */
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
+#define PIXV0_OFFSET            0x206000
+#define PIXV1_OFFSET            0x207000
+#define DPI_OFFSET              0x208000
+#define DSI0_OFFSET             0x209000 /* Display Serial Interface */
+#define PWM_OFFSET              0x20c000
+#define PERM_OFFSET             0x20d000
+#define TEC_OFFSET              0x20e000
 #define OTP_OFFSET              0x20f000
+#define SLIM_OFFSET             0x100000 /* SLIMbus */
+#define CPG_OFFSET              0x110000
 #define AVSP_OFFSET             0x130000
 #define BSC_SL_OFFSET           0x214000 /* SPI slave */
+#define THERMAL_OFFSET          0x212000
 #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
 #define EMMC1_OFFSET            0x300000
+#define EMMC2_OFFSET            0x340000
+#define HVS_OFFSET              0x400000
 #define SMI_OFFSET              0x600000
+#define DSI1_OFFSET             0x700000
+#define UCAM_OFFSET             0x800000
+#define CMI_OFFSET              0x802000
 #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
 #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
+#define VECA_OFFSET             0x806000
+#define PIXV2_OFFSET            0x807000
+#define HDMI_OFFSET             0x808000
+#define HDCP_OFFSET             0x809000
+#define ARBR0_OFFSET            0x80a000
 #define DBUS_OFFSET             0x900000
 #define AVE0_OFFSET             0x910000
 #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
+#define V3D_OFFSET              0xc00000
 #define SDRAMC_OFFSET           0xe00000
+#define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
+#define L1CC_OFFSET             0xe02000 /* Level 1 Cache controller */
+#define ARBR1_OFFSET            0xe04000
 #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
+#define DCRC_OFFSET             0xe07000
+#define AXIP_OFFSET             0xe08000
 
 /* GPU interrupts */
 #define INTERRUPT_TIMER0               0
-- 
2.20.1

Re: [Qemu-devel] [PATCH 10/14] hw/arm/raspi: Define various blocks base addresses

[Philippe Mathieu-Daudé]

On 9/4/19 7:13 PM, Philippe Mathieu-Daudé wrote:
> The Raspberry firmware is closed-source. While running it, it
> accesses various I/O registers. Logging these accesses as UNIMP
> (unimplemented) help to understand what the firmware is doing
> (ideally we want it able to boot a Linux kernel).
> 
> Document various blocks we might use later.
> 
> Adresses and names based on:
> https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  include/hw/arm/raspi_platform.h | 49 +++++++++++++++++++++++++++------
>  1 file changed, 40 insertions(+), 9 deletions(-)
> 
> diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
> index 069edab526..c6f4985522 100644
> --- a/include/hw/arm/raspi_platform.h
> +++ b/include/hw/arm/raspi_platform.h
> @@ -25,42 +25,73 @@
>  #ifndef HW_ARM_RASPI_PLATFORM_H
>  #define HW_ARM_RASPI_PLATFORM_H
>  
> -#define MCORE_OFFSET            0x0000   /* Fake frame buffer device
> -                                          * (the multicore sync block) */
> -#define IC0_OFFSET              0x2000
> +#define MSYNC_OFFSET            0x0000   /* Multicore Sync Block */
> +#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2 TX */
> +#define INTE_OFFSET             0x2000   /* VC Interrupt controller */
>  #define ST_OFFSET               0x3000   /* System Timer */
> +#define TXP_OFFSET              0x4000
> +#define JPEG_OFFSET             0x5000
>  #define MPHI_OFFSET             0x6000   /* Message-based Parallel Host Intf. */
>  #define DMA_OFFSET              0x7000   /* DMA controller, channels 0-14 */
> -#define ARM_OFFSET              0xB000   /* BCM2708 ARM control block */
> +#define ARBA_OFFSET             0x9000
> +#define BRDG_OFFSET             0xa000
> +#define ARM_OFFSET              0xB000   /* ARM control block */
>  #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
>  #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt controller */
> -#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 */
> +#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0 and 1 (SP804) */
>  #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0 (ARM) Semaphores
>                                                        * Doorbells & Mailboxes */
>  #define PM_OFFSET               0x100000 /* Power Management, Reset controller
>                                            * and Watchdog registers */
>  #define CPRMAN_OFFSET           0x101000 /* Clock Management */
> +#define A2W_OFFSET              0x102000
>  #define AVS_OFFSET              0x103000 /* Audio Video Standard */
>  #define RNG_OFFSET              0x104000
>  #define GPIO_OFFSET             0x200000
> -#define UART0_OFFSET            0x201000
> -#define MMCI0_OFFSET            0x202000
> -#define I2S_OFFSET              0x203000
> -#define SPI0_OFFSET             0x204000
> +#define UART0_OFFSET            0x201000 /* PL011 */
> +#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
> +#define I2S_OFFSET              0x203000 /* PCM */
> +#define SPI0_OFFSET             0x204000 /* SPI master */
>  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
> +#define PIXV0_OFFSET            0x206000
> +#define PIXV1_OFFSET            0x207000
> +#define DPI_OFFSET              0x208000
> +#define DSI0_OFFSET             0x209000 /* Display Serial Interface */
> +#define PWM_OFFSET              0x20c000
> +#define PERM_OFFSET             0x20d000
> +#define TEC_OFFSET              0x20e000
>  #define OTP_OFFSET              0x20f000
> +#define SLIM_OFFSET             0x100000 /* SLIMbus */
> +#define CPG_OFFSET              0x110000
>  #define AVSP_OFFSET             0x130000

These should be:

#define SLIM_OFFSET             0x210000 /* SLIMbus */
#define CPG_OFFSET              0x211000
#define AVSP_OFFSET             0x213000

>  #define BSC_SL_OFFSET           0x214000 /* SPI slave */
> +#define THERMAL_OFFSET          0x212000
>  #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2 */
>  #define EMMC1_OFFSET            0x300000
> +#define EMMC2_OFFSET            0x340000
> +#define HVS_OFFSET              0x400000
>  #define SMI_OFFSET              0x600000
> +#define DSI1_OFFSET             0x700000
> +#define UCAM_OFFSET             0x800000
> +#define CMI_OFFSET              0x802000
>  #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
>  #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
> +#define VECA_OFFSET             0x806000
> +#define PIXV2_OFFSET            0x807000
> +#define HDMI_OFFSET             0x808000
> +#define HDCP_OFFSET             0x809000
> +#define ARBR0_OFFSET            0x80a000
>  #define DBUS_OFFSET             0x900000
>  #define AVE0_OFFSET             0x910000
>  #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
> +#define V3D_OFFSET              0xc00000
>  #define SDRAMC_OFFSET           0xe00000
> +#define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
> +#define L1CC_OFFSET             0xe02000 /* Level 1 Cache controller */
> +#define ARBR1_OFFSET            0xe04000
>  #define DMA15_OFFSET            0xE05000 /* DMA controller, channel 15 */
> +#define DCRC_OFFSET             0xe07000
> +#define AXIP_OFFSET             0xe08000
>  
>  /* GPU interrupts */
>  #define INTERRUPT_TIMER0               0
> 

Re: [PATCH 10/14] hw/arm/raspi: Define various blocks base addresses

[Esteban Bosse]

El vie, 06-09-2019 a las 12:07 +0200, Philippe Mathieu-Daudé escribió:
> On 9/4/19 7:13 PM, Philippe Mathieu-Daudé wrote:
> > The Raspberry firmware is closed-source. While running it, it
> > accesses various I/O registers. Logging these accesses as UNIMP
> > (unimplemented) help to understand what the firmware is doing
> > (ideally we want it able to boot a Linux kernel).
> > 
> > Document various blocks we might use later.
> > 
> > Adresses and names based on:
> > https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
> > 
> > Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> > ---
> >  include/hw/arm/raspi_platform.h | 49 +++++++++++++++++++++++++++
> > ------
> >  1 file changed, 40 insertions(+), 9 deletions(-)
> > 
> > diff --git a/include/hw/arm/raspi_platform.h
> > b/include/hw/arm/raspi_platform.h
> > index 069edab526..c6f4985522 100644
> > --- a/include/hw/arm/raspi_platform.h
> > +++ b/include/hw/arm/raspi_platform.h
> > @@ -25,42 +25,73 @@
> >  #ifndef HW_ARM_RASPI_PLATFORM_H
> >  #define HW_ARM_RASPI_PLATFORM_H
> >  
> > -#define MCORE_OFFSET            0x0000   /* Fake frame buffer
> > device
> > -                                          * (the multicore sync
> > block) */
> > -#define IC0_OFFSET              0x2000
> > +#define MSYNC_OFFSET            0x0000   /* Multicore Sync Block
> > */
> > +#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2
> > TX */
> > +#define INTE_OFFSET             0x2000   /* VC Interrupt
> > controller */
> >  #define ST_OFFSET               0x3000   /* System Timer */
> > +#define TXP_OFFSET              0x4000
> > +#define JPEG_OFFSET             0x5000
> >  #define MPHI_OFFSET             0x6000   /* Message-based Parallel
> > Host Intf. */
> >  #define DMA_OFFSET              0x7000   /* DMA controller,
> > channels 0-14 */
> > -#define ARM_OFFSET              0xB000   /* BCM2708 ARM control
> > block */
> > +#define ARBA_OFFSET             0x9000
> > +#define BRDG_OFFSET             0xa000
> > +#define ARM_OFFSET              0xB000   /* ARM control block */
> >  #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
> >  #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt
> > controller */
> > -#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0
> > and 1 */
> > +#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0
> > and 1 (SP804) */
> >  #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0
> > (ARM) Semaphores
> >                                                        * Doorbells
> > & Mailboxes */
> >  #define PM_OFFSET               0x100000 /* Power Management,
> > Reset controller
> >                                            * and Watchdog registers
> > */
> >  #define CPRMAN_OFFSET           0x101000 /* Clock Management */
> > +#define A2W_OFFSET              0x102000
> >  #define AVS_OFFSET              0x103000 /* Audio Video Standard
> > */
> >  #define RNG_OFFSET              0x104000
> >  #define GPIO_OFFSET             0x200000
> > -#define UART0_OFFSET            0x201000
> > -#define MMCI0_OFFSET            0x202000
> > -#define I2S_OFFSET              0x203000
> > -#define SPI0_OFFSET             0x204000
> > +#define UART0_OFFSET            0x201000 /* PL011 */
> > +#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
> > +#define I2S_OFFSET              0x203000 /* PCM */
> > +#define SPI0_OFFSET             0x204000 /* SPI master */
> >  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
> > +#define PIXV0_OFFSET            0x206000
> > +#define PIXV1_OFFSET            0x207000
> > +#define DPI_OFFSET              0x208000
> > +#define DSI0_OFFSET             0x209000 /* Display Serial
> > Interface */
> > +#define PWM_OFFSET              0x20c000
> > +#define PERM_OFFSET             0x20d000
> > +#define TEC_OFFSET              0x20e000
> >  #define OTP_OFFSET              0x20f000
> > +#define SLIM_OFFSET             0x100000 /* SLIMbus */
> > +#define CPG_OFFSET              0x110000
> >  #define AVSP_OFFSET             0x130000
> 
> These should be:
> 
> #define SLIM_OFFSET             0x210000 /* SLIMbus */
> #define CPG_OFFSET              0x211000
> #define AVSP_OFFSET             0x213000
> 
> >  #define BSC_SL_OFFSET           0x214000 /* SPI slave */
Looking in 
https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map I
found that 0x214000 is the "bootrom" register, why the difference?

> > +#define THERMAL_OFFSET          0x212000
> >  #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2
> > */
> >  #define EMMC1_OFFSET            0x300000
> > +#define EMMC2_OFFSET            0x340000
> > +#define HVS_OFFSET              0x400000
In github describe 7E400000 as ddrv register, ddrv is the same as HVS?
> >  #define SMI_OFFSET              0x600000
> > +#define DSI1_OFFSET             0x700000
> > +#define UCAM_OFFSET             0x800000
> > +#define CMI_OFFSET              0x802000
> >  #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
> >  #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
> > +#define VECA_OFFSET             0x806000
> > +#define PIXV2_OFFSET            0x807000
> > +#define HDMI_OFFSET             0x808000
> > +#define HDCP_OFFSET             0x809000
> > +#define ARBR0_OFFSET            0x80a000
> >  #define DBUS_OFFSET             0x900000
> >  #define AVE0_OFFSET             0x910000
> >  #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller
> > */
> > +#define V3D_OFFSET              0xc00000
> >  #define SDRAMC_OFFSET           0xe00000
> > +#define L2CC_OFFSET             0xe01000 /* Level 2 Cache
> > controller */
> > +#define L1CC_OFFSET             0xe02000 /* Level 1 Cache
> > controller */
> > +#define ARBR1_OFFSET            0xe04000
> >  #define DMA15_OFFSET            0xE05000 /* DMA controller,
> > channel 15 */
> > +#define DCRC_OFFSET             0xe07000
> > +#define AXIP_OFFSET             0xe08000
> >  
> >  /* GPU interrupts */
> >  #define INTERRUPT_TIMER0               0
> > 

Re: [PATCH 10/14] hw/arm/raspi: Define various blocks base addresses

[Philippe Mathieu-Daudé]

On 9/29/19 5:27 PM, Esteban Bosse wrote:
> El vie, 06-09-2019 a las 12:07 +0200, Philippe Mathieu-Daudé escribió:
>> On 9/4/19 7:13 PM, Philippe Mathieu-Daudé wrote:
>>> The Raspberry firmware is closed-source. While running it, it
>>> accesses various I/O registers. Logging these accesses as UNIMP
>>> (unimplemented) help to understand what the firmware is doing
>>> (ideally we want it able to boot a Linux kernel).
>>>
>>> Document various blocks we might use later.
>>>
>>> Adresses and names based on:
>>> https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map
>>>
>>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>>> ---
>>>   include/hw/arm/raspi_platform.h | 49 +++++++++++++++++++++++++++
>>> ------
>>>   1 file changed, 40 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/include/hw/arm/raspi_platform.h
>>> b/include/hw/arm/raspi_platform.h
>>> index 069edab526..c6f4985522 100644
>>> --- a/include/hw/arm/raspi_platform.h
>>> +++ b/include/hw/arm/raspi_platform.h
>>> @@ -25,42 +25,73 @@
>>>   #ifndef HW_ARM_RASPI_PLATFORM_H
>>>   #define HW_ARM_RASPI_PLATFORM_H
>>>   
>>> -#define MCORE_OFFSET            0x0000   /* Fake frame buffer
>>> device
>>> -                                          * (the multicore sync
>>> block) */
>>> -#define IC0_OFFSET              0x2000
>>> +#define MSYNC_OFFSET            0x0000   /* Multicore Sync Block
>>> */
>>> +#define CCPT_OFFSET             0x1000   /* Compact Camera Port 2
>>> TX */
>>> +#define INTE_OFFSET             0x2000   /* VC Interrupt
>>> controller */
>>>   #define ST_OFFSET               0x3000   /* System Timer */
>>> +#define TXP_OFFSET              0x4000
>>> +#define JPEG_OFFSET             0x5000
>>>   #define MPHI_OFFSET             0x6000   /* Message-based Parallel
>>> Host Intf. */
>>>   #define DMA_OFFSET              0x7000   /* DMA controller,
>>> channels 0-14 */
>>> -#define ARM_OFFSET              0xB000   /* BCM2708 ARM control
>>> block */
>>> +#define ARBA_OFFSET             0x9000
>>> +#define BRDG_OFFSET             0xa000
>>> +#define ARM_OFFSET              0xB000   /* ARM control block */
>>>   #define ARMCTRL_OFFSET          (ARM_OFFSET + 0x000)
>>>   #define ARMCTRL_IC_OFFSET       (ARM_OFFSET + 0x200) /* Interrupt
>>> controller */
>>> -#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0
>>> and 1 */
>>> +#define ARMCTRL_TIMER0_1_OFFSET (ARM_OFFSET + 0x400) /* Timer 0
>>> and 1 (SP804) */
>>>   #define ARMCTRL_0_SBM_OFFSET    (ARM_OFFSET + 0x800) /* User 0
>>> (ARM) Semaphores
>>>                                                         * Doorbells
>>> & Mailboxes */
>>>   #define PM_OFFSET               0x100000 /* Power Management,
>>> Reset controller
>>>                                             * and Watchdog registers
>>> */
>>>   #define CPRMAN_OFFSET           0x101000 /* Clock Management */
>>> +#define A2W_OFFSET              0x102000
>>>   #define AVS_OFFSET              0x103000 /* Audio Video Standard
>>> */
>>>   #define RNG_OFFSET              0x104000
>>>   #define GPIO_OFFSET             0x200000
>>> -#define UART0_OFFSET            0x201000
>>> -#define MMCI0_OFFSET            0x202000
>>> -#define I2S_OFFSET              0x203000
>>> -#define SPI0_OFFSET             0x204000
>>> +#define UART0_OFFSET            0x201000 /* PL011 */
>>> +#define MMCI0_OFFSET            0x202000 /* Legacy MMC */
>>> +#define I2S_OFFSET              0x203000 /* PCM */
>>> +#define SPI0_OFFSET             0x204000 /* SPI master */
>>>   #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
>>> +#define PIXV0_OFFSET            0x206000
>>> +#define PIXV1_OFFSET            0x207000
>>> +#define DPI_OFFSET              0x208000
>>> +#define DSI0_OFFSET             0x209000 /* Display Serial
>>> Interface */
>>> +#define PWM_OFFSET              0x20c000
>>> +#define PERM_OFFSET             0x20d000
>>> +#define TEC_OFFSET              0x20e000
>>>   #define OTP_OFFSET              0x20f000
>>> +#define SLIM_OFFSET             0x100000 /* SLIMbus */
>>> +#define CPG_OFFSET              0x110000
>>>   #define AVSP_OFFSET             0x130000
>>
>> These should be:
>>
>> #define SLIM_OFFSET             0x210000 /* SLIMbus */
>> #define CPG_OFFSET              0x211000
>> #define AVSP_OFFSET             0x213000
>>
>>>   #define BSC_SL_OFFSET           0x214000 /* SPI slave */
> Looking in
> https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map I
> found that 0x214000 is the "bootrom" register, why the difference?

This chipset family can have various SPI slave interfaces, but this one 
in particular is used by the VideoCore bootloader to load the ARM bootrom.

This file is generic to the chipset, so declaring BSC_SL_OFFSET here is 
OK IMO. Since the "bootrom" is specific to the bootloader, the 
definition should go into hw/arm/raspi.c such:

#define RASPI4_BOOTROM_OFFSET BSC_SL_OFFSET

>>> +#define THERMAL_OFFSET          0x212000
>>>   #define AUX_OFFSET              0x215000 /* AUX: UART1/SPI1/SPI2
>>> */
>>>   #define EMMC1_OFFSET            0x300000
>>> +#define EMMC2_OFFSET            0x340000
>>> +#define HVS_OFFSET              0x400000
> In github describe 7E400000 as ddrv register, ddrv is the same as HVS?

https://github.com/hermanhermitage/videocoreiv/wiki/MMIO-Register-map 
describes the VideoCore IV, this region appears unregistered.

The raspi4 uses the VideoCore VI. HVS means High-speed Video Scaler.
I assume this is a new block added to the VI core, Andrew might confirm.

>>>   #define SMI_OFFSET              0x600000
>>> +#define DSI1_OFFSET             0x700000
>>> +#define UCAM_OFFSET             0x800000
>>> +#define CMI_OFFSET              0x802000
>>>   #define BSC1_OFFSET             0x804000 /* BSC1 I2C/TWI */
>>>   #define BSC2_OFFSET             0x805000 /* BSC2 I2C/TWI */
>>> +#define VECA_OFFSET             0x806000
>>> +#define PIXV2_OFFSET            0x807000
>>> +#define HDMI_OFFSET             0x808000
>>> +#define HDCP_OFFSET             0x809000
>>> +#define ARBR0_OFFSET            0x80a000
>>>   #define DBUS_OFFSET             0x900000
>>>   #define AVE0_OFFSET             0x910000
>>>   #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller
>>> */
>>> +#define V3D_OFFSET              0xc00000
>>>   #define SDRAMC_OFFSET           0xe00000
>>> +#define L2CC_OFFSET             0xe01000 /* Level 2 Cache
>>> controller */
>>> +#define L1CC_OFFSET             0xe02000 /* Level 1 Cache
>>> controller */
>>> +#define ARBR1_OFFSET            0xe04000
>>>   #define DMA15_OFFSET            0xE05000 /* DMA controller,
>>> channel 15 */
>>> +#define DCRC_OFFSET             0xe07000
>>> +#define AXIP_OFFSET             0xe08000
>>>   
>>>   /* GPU interrupts */
>>>   #define INTERRUPT_TIMER0               0
>>>
> 

[Qemu-devel] [PATCH 11/14] hw/arm/bcm2835_peripherals: Map various BCM2838 blocks

[Philippe Mathieu-Daudé]

The BCM2838 provides more peripherals.
Add them as 'unimplemented' so we can track when/how firmware
and kernel access them.

Based on various sources:

* U-boot: https://github.com/raspberrypi/firmware/tree/next/boot

  - arch/arm/dts/bcm283x.dtsi
  - arch/arm/dts/bcm2838.dtsi
  - arch/arm/dts/bcm2838-rpi-4-b.dts

* Arnd Bergmann analysis: https://www.cnx-software.com/2019/06/24/raspberry-pi-4-features-broadcom-bcm2711-processor-up-to-4gb-ram/#comment-563948

* Linux: https://patchwork.kernel.org/patch/11053097/

  - arch/arm/boot/dts/bcm283x.dtsi
  - arch/arm/boot/dts/bcm283x-rpi-usb-peripheral.dtsi
  - arch/arm/boot/dts/bcm2711.dtsi
  - arch/arm/boot/dts/bcm2711-rpi-4-b.dts

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
TODO: At least use proper pl011[2] and pl011[3]
---
 hw/arm/bcm2835_peripherals.c         | 23 +++++++++++++++++++----
 include/hw/arm/bcm2835_peripherals.h |  8 ++++++--
 include/hw/arm/raspi_platform.h      | 14 ++++++++++++++
 3 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index be6270b8ef..72287d5921 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -342,15 +342,30 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     create_unimp(s, &s->a2w, "bcm2835-a2w", 0x102000, 0x1000);
     create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
     create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
-    create_unimp(s, &s->spi0, "bcm2835-spi0", SPI0_OFFSET, 0x20);
+    create_unimp(s, &s->uartu[2], "!pl011[2]", UART2_OFFSET, 0x100);
+    create_unimp(s, &s->uartu[3], "!pl011[3]", UART3_OFFSET, 0x100);
+    create_unimp(s, &s->uartu[4], "!pl011[4]", UART4_OFFSET, 0x100);
+    create_unimp(s, &s->uartu[5], "!pl011[5]", UART5_OFFSET, 0x100);
+    create_unimp(s, &s->spi[0], "bcm2835-spi[0]", SPI0_OFFSET, 0x20);
+    create_unimp(s, &s->spi[3], "bcm2835-spi[3]", SPI3_OFFSET, 0x20);
+    create_unimp(s, &s->spi[4], "bcm2835-spi[4]", SPI4_OFFSET, 0x20);
+    create_unimp(s, &s->spi[5], "bcm2835-spi[5]", SPI5_OFFSET, 0x20);
+    create_unimp(s, &s->spi[6], "bcm2835-spi[6]", SPI6_OFFSET, 0x20);
     create_unimp(s, &s->bscsl, "bcm2835-spis", BSC_SL_OFFSET, 0x100);
-    create_unimp(s, &s->i2c[0], "bcm2835-i2c0", BSC0_OFFSET, 0x20);
-    create_unimp(s, &s->i2c[1], "bcm2835-i2c1", BSC1_OFFSET, 0x20);
-    create_unimp(s, &s->i2c[2], "bcm2835-i2c2", BSC2_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[0], "bcm2835-i2c[0]", BSC0_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[1], "bcm2835-i2c[1]", BSC1_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[2], "bcm2835-i2c[2]", BSC2_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[3], "bcm2835-i2c[3]", BSC3_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[4], "bcm2835-i2c[4]", BSC4_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[5], "bcm2835-i2c[5]", BSC5_OFFSET, 0x20);
+    create_unimp(s, &s->i2c[6], "bcm2835-i2c[6]", BSC6_OFFSET, 0x20);
     create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
     create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
     create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
     create_unimp(s, &s->dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x100);
+    create_unimp(s, &s->xhci, "bcm2838-xhci", USB_XHCI_OFFSET, 0x100000);
+    create_unimp(s, &s->argon, "bcm2838-argon", ARGON_OFFSET, 4 * 0x10000);
+    create_unimp(s, &s->v3d, "bcm2835-v3d", V3D_OFFSET, 0x10000);
     create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET, 0x100);
 }
 
diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index 44a182b399..2e5f243b39 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -42,6 +42,7 @@ typedef struct BCM2835PeripheralState {
     UnimplementedDeviceState cprman;
     UnimplementedDeviceState a2w;
     PL011State uart0;
+    UnimplementedDeviceState uartu[6];
     BCM2835AuxState aux;
     BCM2835FBState fb;
     BCM2835DMAState dma;
@@ -53,14 +54,17 @@ typedef struct BCM2835PeripheralState {
     BCM2835SDHostState sdhost;
     BCM2835GpioState gpio;
     UnimplementedDeviceState i2s;
-    UnimplementedDeviceState spi0;
-    UnimplementedDeviceState i2c[3];
+    UnimplementedDeviceState spi[7];
+    UnimplementedDeviceState i2c[7];
     UnimplementedDeviceState otp;
     UnimplementedDeviceState dbus;
     UnimplementedDeviceState ave0;
     UnimplementedDeviceState bscsl;
     UnimplementedDeviceState smi;
     UnimplementedDeviceState dwc2;
+    UnimplementedDeviceState xhci;
+    UnimplementedDeviceState argon;
+    UnimplementedDeviceState v3d;
     UnimplementedDeviceState sdramc;
 } BCM2835PeripheralState;
 
diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index c6f4985522..0ea547669f 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -49,10 +49,22 @@
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
 #define UART0_OFFSET            0x201000 /* PL011 */
+#define UART2_OFFSET            0x201400 /* PL011 */
+#define UART3_OFFSET            0x201600 /* PL011 */
+#define UART4_OFFSET            0x201800 /* PL011 */
+#define UART5_OFFSET            0x201a00 /* PL011 */
 #define MMCI0_OFFSET            0x202000 /* Legacy MMC */
 #define I2S_OFFSET              0x203000 /* PCM */
 #define SPI0_OFFSET             0x204000 /* SPI master */
+#define SPI3_OFFSET             0x204600
+#define SPI4_OFFSET             0x204800
+#define SPI5_OFFSET             0x204a00
+#define SPI6_OFFSET             0x204c00
 #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
+#define BSC3_OFFSET             0x205600
+#define BSC4_OFFSET             0x205800
+#define BSC5_OFFSET             0x205a00
+#define BSC6_OFFSET             0x205c00
 #define PIXV0_OFFSET            0x206000
 #define PIXV1_OFFSET            0x207000
 #define DPI_OFFSET              0x208000
@@ -84,6 +96,8 @@
 #define DBUS_OFFSET             0x900000
 #define AVE0_OFFSET             0x910000
 #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller */
+#define USB_XHCI_OFFSET         0x9c0000 /* generic-xhci controller */
+#define ARGON_OFFSET            0xb00000
 #define V3D_OFFSET              0xc00000
 #define SDRAMC_OFFSET           0xe00000
 #define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller */
-- 
2.20.1

Re: [PATCH 11/14] hw/arm/bcm2835_peripherals: Map various BCM2838 blocks

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> The BCM2838 provides more peripherals.
> Add them as 'unimplemented' so we can track when/how firmware
> and kernel access them.
> 
> Based on various sources:
> 
> * U-boot: https://github.com/raspberrypi/firmware/tree/next/boot
> 
>   - arch/arm/dts/bcm283x.dtsi
>   - arch/arm/dts/bcm2838.dtsi
>   - arch/arm/dts/bcm2838-rpi-4-b.dts
> 
> * Arnd Bergmann analysis: 
> https://www.cnx-software.com/2019/06/24/raspberry-pi-4-features-broadcom-bcm2711-processor-up-to-4gb-ram/#comment-563948
> 
> * Linux: https://patchwork.kernel.org/patch/11053097/
> 
>   - arch/arm/boot/dts/bcm283x.dtsi
>   - arch/arm/boot/dts/bcm283x-rpi-usb-peripheral.dtsi
>   - arch/arm/boot/dts/bcm2711.dtsi
>   - arch/arm/boot/dts/bcm2711-rpi-4-b.dts
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
> TODO: At least use proper pl011[2] and pl011[3]
> ---
>  hw/arm/bcm2835_peripherals.c         | 23 +++++++++++++++++++----
>  include/hw/arm/bcm2835_peripherals.h |  8 ++++++--
>  include/hw/arm/raspi_platform.h      | 14 ++++++++++++++
>  3 files changed, 39 insertions(+), 6 deletions(-)
> 
> diff --git a/hw/arm/bcm2835_peripherals.c
> b/hw/arm/bcm2835_peripherals.c
> index be6270b8ef..72287d5921 100644
> --- a/hw/arm/bcm2835_peripherals.c
> +++ b/hw/arm/bcm2835_peripherals.c
> @@ -342,15 +342,30 @@ static void
> bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>      create_unimp(s, &s->a2w, "bcm2835-a2w", 0x102000, 0x1000);
>      create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
>      create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
> -    create_unimp(s, &s->spi0, "bcm2835-spi0", SPI0_OFFSET, 0x20);
> +    create_unimp(s, &s->uartu[2], "!pl011[2]", UART2_OFFSET, 0x100);
> +    create_unimp(s, &s->uartu[3], "!pl011[3]", UART3_OFFSET, 0x100);
> +    create_unimp(s, &s->uartu[4], "!pl011[4]", UART4_OFFSET, 0x100);
> +    create_unimp(s, &s->uartu[5], "!pl011[5]", UART5_OFFSET, 0x100);
> +    create_unimp(s, &s->spi[0], "bcm2835-spi[0]", SPI0_OFFSET,
> 0x20);
> +    create_unimp(s, &s->spi[3], "bcm2835-spi[3]", SPI3_OFFSET,
> 0x20);
> +    create_unimp(s, &s->spi[4], "bcm2835-spi[4]", SPI4_OFFSET,
> 0x20);
> +    create_unimp(s, &s->spi[5], "bcm2835-spi[5]", SPI5_OFFSET,
> 0x20);
> +    create_unimp(s, &s->spi[6], "bcm2835-spi[6]", SPI6_OFFSET,
> 0x20);
>      create_unimp(s, &s->bscsl, "bcm2835-spis", BSC_SL_OFFSET,
> 0x100);
> -    create_unimp(s, &s->i2c[0], "bcm2835-i2c0", BSC0_OFFSET, 0x20);
> -    create_unimp(s, &s->i2c[1], "bcm2835-i2c1", BSC1_OFFSET, 0x20);
> -    create_unimp(s, &s->i2c[2], "bcm2835-i2c2", BSC2_OFFSET, 0x20);
> +    create_unimp(s, &s->i2c[0], "bcm2835-i2c[0]", BSC0_OFFSET,
> 0x20);
> +    create_unimp(s, &s->i2c[1], "bcm2835-i2c[1]", BSC1_OFFSET,
> 0x20);
> +    create_unimp(s, &s->i2c[2], "bcm2835-i2c[2]", BSC2_OFFSET,
> 0x20);
> +    create_unimp(s, &s->i2c[3], "bcm2835-i2c[3]", BSC3_OFFSET,
> 0x20);
> +    create_unimp(s, &s->i2c[4], "bcm2835-i2c[4]", BSC4_OFFSET,
> 0x20);
> +    create_unimp(s, &s->i2c[5], "bcm2835-i2c[5]", BSC5_OFFSET,
> 0x20);
> +    create_unimp(s, &s->i2c[6], "bcm2835-i2c[6]", BSC6_OFFSET,
> 0x20);
>      create_unimp(s, &s->otp, "bcm2835-otp", OTP_OFFSET, 0x80);
>      create_unimp(s, &s->dbus, "bcm2835-dbus", DBUS_OFFSET, 0x8000);
>      create_unimp(s, &s->ave0, "bcm2835-ave0", AVE0_OFFSET, 0x8000);
>      create_unimp(s, &s->dwc2, "dwc-usb2", USB_OTG_OFFSET, 0x100);
> +    create_unimp(s, &s->xhci, "bcm2838-xhci", USB_XHCI_OFFSET,
> 0x100000);
> +    create_unimp(s, &s->argon, "bcm2838-argon", ARGON_OFFSET, 4 *
> 0x10000);
> +    create_unimp(s, &s->v3d, "bcm2835-v3d", V3D_OFFSET, 0x10000);
>      create_unimp(s, &s->sdramc, "bcm2835-sdramc", SDRAMC_OFFSET,
> 0x100);
>  }
>  
> diff --git a/include/hw/arm/bcm2835_peripherals.h
> b/include/hw/arm/bcm2835_peripherals.h
> index 44a182b399..2e5f243b39 100644
> --- a/include/hw/arm/bcm2835_peripherals.h
> +++ b/include/hw/arm/bcm2835_peripherals.h
> @@ -42,6 +42,7 @@ typedef struct BCM2835PeripheralState {
>      UnimplementedDeviceState cprman;
>      UnimplementedDeviceState a2w;
>      PL011State uart0;
> +    UnimplementedDeviceState uartu[6];
>      BCM2835AuxState aux;
>      BCM2835FBState fb;
>      BCM2835DMAState dma;
> @@ -53,14 +54,17 @@ typedef struct BCM2835PeripheralState {
>      BCM2835SDHostState sdhost;
>      BCM2835GpioState gpio;
>      UnimplementedDeviceState i2s;
> -    UnimplementedDeviceState spi0;
> -    UnimplementedDeviceState i2c[3];
> +    UnimplementedDeviceState spi[7];
> +    UnimplementedDeviceState i2c[7];
>      UnimplementedDeviceState otp;
>      UnimplementedDeviceState dbus;
>      UnimplementedDeviceState ave0;
>      UnimplementedDeviceState bscsl;
>      UnimplementedDeviceState smi;
>      UnimplementedDeviceState dwc2;
> +    UnimplementedDeviceState xhci;
> +    UnimplementedDeviceState argon;
> +    UnimplementedDeviceState v3d;
>      UnimplementedDeviceState sdramc;
>  } BCM2835PeripheralState;
>  
> diff --git a/include/hw/arm/raspi_platform.h
> b/include/hw/arm/raspi_platform.h
> index c6f4985522..0ea547669f 100644
> --- a/include/hw/arm/raspi_platform.h
> +++ b/include/hw/arm/raspi_platform.h
> @@ -49,10 +49,22 @@
>  #define RNG_OFFSET              0x104000
>  #define GPIO_OFFSET             0x200000
>  #define UART0_OFFSET            0x201000 /* PL011 */
> +#define UART2_OFFSET            0x201400 /* PL011 */
> +#define UART3_OFFSET            0x201600 /* PL011 */
> +#define UART4_OFFSET            0x201800 /* PL011 */
> +#define UART5_OFFSET            0x201a00 /* PL011 */
>  #define MMCI0_OFFSET            0x202000 /* Legacy MMC */
>  #define I2S_OFFSET              0x203000 /* PCM */
>  #define SPI0_OFFSET             0x204000 /* SPI master */
> +#define SPI3_OFFSET             0x204600
> +#define SPI4_OFFSET             0x204800
> +#define SPI5_OFFSET             0x204a00
> +#define SPI6_OFFSET             0x204c00
>  #define BSC0_OFFSET             0x205000 /* BSC0 I2C/TWI */
> +#define BSC3_OFFSET             0x205600
> +#define BSC4_OFFSET             0x205800
> +#define BSC5_OFFSET             0x205a00
> +#define BSC6_OFFSET             0x205c00
>  #define PIXV0_OFFSET            0x206000
>  #define PIXV1_OFFSET            0x207000
>  #define DPI_OFFSET              0x208000
> @@ -84,6 +96,8 @@
>  #define DBUS_OFFSET             0x900000
>  #define AVE0_OFFSET             0x910000
>  #define USB_OTG_OFFSET          0x980000 /* DTC_OTG USB controller
> */
> +#define USB_XHCI_OFFSET         0x9c0000 /* generic-xhci controller
> */
> +#define ARGON_OFFSET            0xb00000
>  #define V3D_OFFSET              0xc00000
>  #define SDRAMC_OFFSET           0xe00000
>  #define L2CC_OFFSET             0xe01000 /* Level 2 Cache controller
> */
Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

[Qemu-devel] [RFC PATCH 12/14] hw/arm/bcm2836: Add the BCM2838 which uses a GICv2

[Philippe Mathieu-Daudé]

The BCM2838 is improvement of the BCM2837:
- Cortex-A72 instead of the A53
- peripheral block and local soc controller are mapped differently,
- GICv2
- PCIe block
- exhanced MMU to address over 4GiB of SDRAM

See https://www.raspberrypi.org/forums/viewtopic.php?t=244479&start=25
and https://patchwork.kernel.org/patch/11053097/

This patch starts mapping the GICv2 but interrupt lines are NOT
wired (yet).

This is enough to start running the Ubuntu kernel8.img from [1].

Extract the kernel with:

  $ mkdir bootpart
  $ guestfish \
      --ro \
      -a ubuntu-18.04.3-preinstalled-server-arm64+raspi4.img \
      -m /dev/sda1
  Welcome to guestfish, the guest filesystem shell for
  editing virtual machine filesystems and disk images.

  ><fs> ls /
  COPYING.linux
  LICENCE.broadcom
  System.map
  armstub8-gic.bin
  bcm2710-rpi-3-b-plus.dtb
  bcm2710-rpi-3-b.dtb
  bcm2710-rpi-cm3.dtb
  bcm2711-rpi-4-b.dtb
  bcm2837-rpi-3-b-plus.dtb
  bcm2837-rpi-3-b.dtb
  cmdline.txt
  config.txt
  fixup4.dat
  fixup4cd.dat
  fixup4db.dat
  fixup4x.dat
  kernel8.img
  overlays
  start4.elf
  start4cd.elf
  start4db.elf
  start4x.elf
  ><fs> copy-out / bootpart/
  ><fs> q

Then some progress can be noticed running:

  $ qemu-system-aarch64 -d unimp,guest_errors,int,in_asm \
      -M raspi4 \
      -kernel bootpart/kernel8.img \
      -dtb bootpart/bcm2711-rpi-4-b.dtb \
      -initrd bootpart/boot/initrd.img \
      -append \
         "earlycon=pl011,0xfe201000 console=ttyAMA0 console=tty1 loglevel=8"

Not very interesting, but it runs until configuring the GIC.
(remove 'in_asm' if too verbose).

TODO:

- wire IRQs to the GIC :)

- map the SPI bootrom from [3] (boot sequence: [4])

- per [2] we could try booting without using the GIC, adding "enable_gic=0"
  in config.txt. this variable is parsed by the firmware:

  $ fgrep -r enable_gic bootpart
  Binary file bootpart/start4x.elf matches
  Binary file bootpart/start4.elf matches
  Binary file bootpart/start4db.elf matches
  Binary file bootpart/start4cd.elf matches
  bootpart/config.txt:enable_gic=1

  the stub [5] doesn't seem to check a register for it.
  maybe it falls back to kernel7l?

- decompile start4.elf to check how 'enable_gic' is used
  using vc4 toolchain from [6]

[1] https://github.com/TheRemote/Ubuntu-Server-raspi4-unofficial/releases
[2] https://jamesachambers.com/raspberry-pi-ubuntu-server-18-04-2-installation-guide/
[3] https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md
[4] https://raspberrypi.stackexchange.com/questions/10442/what-is-the-boot-sequence
[5] https://github.com/raspberrypi/tools/commit/7f4a937e1bacbc111a22552169bc890b4bb26a94#diff-8c41083e9fa0c98f1c3015e11b897444
[6] https://github.com/christinaa/rpi-open-firmware

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/bcm2836.c         | 75 ++++++++++++++++++++++++++++++++++++++++
 include/hw/arm/bcm2836.h |  3 ++
 2 files changed, 78 insertions(+)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index 019e67b906..d89d7cd71d 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -21,6 +21,7 @@ struct BCM283XInfo {
     const char *cpu_type;
     hwaddr peri_base; /* Peripheral base address seen by the CPU */
     hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
+    hwaddr gic_base;
     int clusterid;
 };
 
@@ -40,9 +41,25 @@ static const BCM283XInfo bcm283x_socs[] = {
         .ctrl_base = 0x40000000,
         .clusterid = 0x0,
     },
+    {
+        .name = TYPE_BCM2838,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a72"),
+        .peri_base = 0xfe000000,
+        .ctrl_base = 0xff800000,
+        .gic_base = 0x40000,
+    },
 #endif
 };
 
+#define GIC_NUM_IRQS                256
+
+#define GIC_BASE_OFS                0x0000
+#define GIC_DIST_OFS                0x1000
+#define GIC_CPU_OFS                 0x2000
+#define GIC_VIFACE_THIS_OFS         0x4000
+#define GIC_VIFACE_OTHER_OFS(cpu)  (0x5000 + (cpu) * 0x200)
+#define GIC_VCPU_OFS                0x6000
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -55,6 +72,11 @@ static void bcm2836_init(Object *obj)
                                 info->cpu_type, &error_abort, NULL);
     }
 
+    if (info->gic_base) {
+        sysbus_init_child_obj(obj, "gic", &s->gic, sizeof(s->gic),
+                              TYPE_ARM_GIC);
+    }
+
     sysbus_init_child_obj(obj, "control", &s->control, sizeof(s->control),
                           TYPE_BCM2836_CONTROL);
 
@@ -115,6 +137,59 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info->ctrl_base);
 
+    /* bcm2838 GICv2 */
+    if (info->gic_base) {
+        object_property_set_uint(OBJECT(&s->gic), 2, "revision", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        object_property_set_uint(OBJECT(&s->gic),
+                                 BCM283X_NCPUS, "num-cpu", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        object_property_set_uint(OBJECT(&s->gic),
+                                 32 + GIC_NUM_IRQS, "num-irq", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        object_property_set_bool(OBJECT(&s->gic),
+                                 true, "has-virtualization-extensions", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 0,
+                        info->ctrl_base + info->gic_base + GIC_DIST_OFS);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 1,
+                        info->ctrl_base + info->gic_base + GIC_CPU_OFS);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 2,
+                        info->ctrl_base + info->gic_base + GIC_VIFACE_THIS_OFS);
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 3,
+                        info->ctrl_base + info->gic_base + GIC_VCPU_OFS);
+
+        for (n = 0; n < BCM283X_NCPUS; n++) {
+            sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 4 + n,
+                            info->ctrl_base + info->gic_base
+                            + GIC_VIFACE_OTHER_OFS(n));
+        }
+
+        /* TODO wire IRQs!!! */
+    }
+
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-irq", 0));
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index 97187f72be..31c8fb90bd 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -13,6 +13,7 @@
 
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
+#include "hw/intc/arm_gic.h"
 #include "target/arm/cpu.h"
 
 #define TYPE_BCM283X "bcm283x"
@@ -26,6 +27,7 @@
  */
 #define TYPE_BCM2836 "bcm2836"
 #define TYPE_BCM2837 "bcm2837"
+#define TYPE_BCM2838 "bcm2838"
 
 typedef struct BCM283XState {
     /*< private >*/
@@ -36,6 +38,7 @@ typedef struct BCM283XState {
     uint32_t enabled_cpus;
 
     ARMCPU cpus[BCM283X_NCPUS];
+    GICState gic;
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
 } BCM283XState;
-- 
2.20.1

Re: [Qemu-devel] [RFC PATCH 12/14] hw/arm/bcm2836: Add the BCM2838 which uses a GICv2

[Luc Michel]

Hi Philippe,

On 9/4/19 7:13 PM, Philippe Mathieu-Daudé wrote:
> The BCM2838 is improvement of the BCM2837:
> - Cortex-A72 instead of the A53
> - peripheral block and local soc controller are mapped differently,
> - GICv2
> - PCIe block
> - exhanced MMU to address over 4GiB of SDRAM
> 
> See https://www.raspberrypi.org/forums/viewtopic.php?t=244479&start=25
> and https://patchwork.kernel.org/patch/11053097/
> 
> This patch starts mapping the GICv2 but interrupt lines are NOT
> wired (yet).
> 
> This is enough to start running the Ubuntu kernel8.img from [1].
> 
> Extract the kernel with:
> 
>    $ mkdir bootpart
>    $ guestfish \
>        --ro \
>        -a ubuntu-18.04.3-preinstalled-server-arm64+raspi4.img \
>        -m /dev/sda1
>    Welcome to guestfish, the guest filesystem shell for
>    editing virtual machine filesystems and disk images.
> 
>    ><fs> ls /
>    COPYING.linux
>    LICENCE.broadcom
>    System.map
>    armstub8-gic.bin
>    bcm2710-rpi-3-b-plus.dtb
>    bcm2710-rpi-3-b.dtb
>    bcm2710-rpi-cm3.dtb
>    bcm2711-rpi-4-b.dtb
>    bcm2837-rpi-3-b-plus.dtb
>    bcm2837-rpi-3-b.dtb
>    cmdline.txt
>    config.txt
>    fixup4.dat
>    fixup4cd.dat
>    fixup4db.dat
>    fixup4x.dat
>    kernel8.img
>    overlays
>    start4.elf
>    start4cd.elf
>    start4db.elf
>    start4x.elf
>    ><fs> copy-out / bootpart/
>    ><fs> q
> 
> Then some progress can be noticed running:
> 
>    $ qemu-system-aarch64 -d unimp,guest_errors,int,in_asm \
>        -M raspi4 \
>        -kernel bootpart/kernel8.img \
>        -dtb bootpart/bcm2711-rpi-4-b.dtb \
>        -initrd bootpart/boot/initrd.img \
>        -append \
>           "earlycon=pl011,0xfe201000 console=ttyAMA0 console=tty1 loglevel=8"
> 
> Not very interesting, but it runs until configuring the GIC.
> (remove 'in_asm' if too verbose).
> 
> TODO:
> 
> - wire IRQs to the GIC :)
> 
> - map the SPI bootrom from [3] (boot sequence: [4])
> 
> - per [2] we could try booting without using the GIC, adding "enable_gic=0"
>    in config.txt. this variable is parsed by the firmware:
> 
>    $ fgrep -r enable_gic bootpart
>    Binary file bootpart/start4x.elf matches
>    Binary file bootpart/start4.elf matches
>    Binary file bootpart/start4db.elf matches
>    Binary file bootpart/start4cd.elf matches
>    bootpart/config.txt:enable_gic=1
> 
>    the stub [5] doesn't seem to check a register for it.
>    maybe it falls back to kernel7l?
> 
> - decompile start4.elf to check how 'enable_gic' is used
>    using vc4 toolchain from [6]
> 
> [1] https://github.com/TheRemote/Ubuntu-Server-raspi4-unofficial/releases
> [2] https://jamesachambers.com/raspberry-pi-ubuntu-server-18-04-2-installation-guide/
> [3] https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md
> [4] https://raspberrypi.stackexchange.com/questions/10442/what-is-the-boot-sequence
> [5] https://github.com/raspberrypi/tools/commit/7f4a937e1bacbc111a22552169bc890b4bb26a94#diff-8c41083e9fa0c98f1c3015e11b897444
> [6] https://github.com/christinaa/rpi-open-firmware
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>   hw/arm/bcm2836.c         | 75 ++++++++++++++++++++++++++++++++++++++++
>   include/hw/arm/bcm2836.h |  3 ++
>   2 files changed, 78 insertions(+)
> 
> diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
> index 019e67b906..d89d7cd71d 100644
> --- a/hw/arm/bcm2836.c
> +++ b/hw/arm/bcm2836.c
> @@ -21,6 +21,7 @@ struct BCM283XInfo {
>       const char *cpu_type;
>       hwaddr peri_base; /* Peripheral base address seen by the CPU */
>       hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
> +    hwaddr gic_base;
>       int clusterid;
>   };
>   
> @@ -40,9 +41,25 @@ static const BCM283XInfo bcm283x_socs[] = {
>           .ctrl_base = 0x40000000,
>           .clusterid = 0x0,
>       },
> +    {
> +        .name = TYPE_BCM2838,
> +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a72"),
> +        .peri_base = 0xfe000000,
> +        .ctrl_base = 0xff800000,
> +        .gic_base = 0x40000,
> +    },
>   #endif
>   };
>   
> +#define GIC_NUM_IRQS                256
> +
> +#define GIC_BASE_OFS                0x0000
> +#define GIC_DIST_OFS                0x1000
> +#define GIC_CPU_OFS                 0x2000
> +#define GIC_VIFACE_THIS_OFS         0x4000
> +#define GIC_VIFACE_OTHER_OFS(cpu)  (0x5000 + (cpu) * 0x200)
> +#define GIC_VCPU_OFS                0x6000
> +
>   static void bcm2836_init(Object *obj)
>   {
>       BCM283XState *s = BCM283X(obj);
> @@ -55,6 +72,11 @@ static void bcm2836_init(Object *obj)
>                                   info->cpu_type, &error_abort, NULL);
>       }
>   
> +    if (info->gic_base) {
> +        sysbus_init_child_obj(obj, "gic", &s->gic, sizeof(s->gic),
> +                              TYPE_ARM_GIC);
> +    }
> +
>       sysbus_init_child_obj(obj, "control", &s->control, sizeof(s->control),
>                             TYPE_BCM2836_CONTROL);
>   
> @@ -115,6 +137,59 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
>   
>       sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info->ctrl_base);
>   
> +    /* bcm2838 GICv2 */
> +    if (info->gic_base) {
> +        object_property_set_uint(OBJECT(&s->gic), 2, "revision", &err);
> +        if (err) {
> +            error_propagate(errp, err);
> +            return;
> +        }
> +
> +        object_property_set_uint(OBJECT(&s->gic),
> +                                 BCM283X_NCPUS, "num-cpu", &err);
> +        if (err) {
> +            error_propagate(errp, err);
> +            return;
> +        }
> +
> +        object_property_set_uint(OBJECT(&s->gic),
> +                                 32 + GIC_NUM_IRQS, "num-irq", &err);
> +        if (err) {
> +            error_propagate(errp, err);
> +            return;
> +        }
> +
> +        object_property_set_bool(OBJECT(&s->gic),
> +                                 true, "has-virtualization-extensions", &err);
> +        if (err) {
> +            error_propagate(errp, err);
> +            return;
> +        }
> +
> +        object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
> +        if (err) {
> +            error_propagate(errp, err);
> +            return;
> +        }
> +
> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 0,
> +                        info->ctrl_base + info->gic_base + GIC_DIST_OFS);
> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 1,
> +                        info->ctrl_base + info->gic_base + GIC_CPU_OFS);
> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 2,
> +                        info->ctrl_base + info->gic_base + GIC_VIFACE_THIS_OFS);
> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 3,
> +                        info->ctrl_base + info->gic_base + GIC_VCPU_OFS);
> +
> +        for (n = 0; n < BCM283X_NCPUS; n++) {
> +            sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 4 + n,
> +                            info->ctrl_base + info->gic_base
> +                            + GIC_VIFACE_OTHER_OFS(n));> +        }
> +
> +        /* TODO wire IRQs!!! */

I think as a bare minimum, you must wire:
  - the ARM generic timer IRQs going out of all the CPUs, into their
respective PPI. Looking at [1], they seem to be connected to the usual
PPIs (at least we have the same mapping in the vexpress, the xynqmp and
the virt board).
  - The PMU interrupts
  - Possibly the GICv2 maintenance interrupt, but I can't find the IRQ
number in the DTS. This is related to the virtualization extension. It
should not prevent Linux from booting if it's not connected (I think KVM
does not even use the GICv2 maintenance interrupts anyway).
  - Finally, Connect the four GICv2 output (irq, fiq, virq, vfiq) to
their respective CPU inputs.


[1]
https://github.com/raspberrypi/linux/blob/rpi-5.3.y/arch/arm/boot/dts/bcm2838.dtsi


Here is a snippet of the virt board, quickly adapted foc this SoC (I
didn't test it):

#define BCM2838_ARCH_TIMER_VIRT_IRQ   11
#define BCM2838_ARCH_TIMER_S_EL1_IRQ  13
#define BCM2838_ARCH_TIMER_NS_EL1_IRQ 14
#define BCM2838_ARCH_TIMER_NS_EL2_IRQ 10

#define BCM2838_PMU_SPI_BASE          16
[...]

 for (i = 0; i < BCM283X_NCPUS; i++) {
        DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
        int ppibase = GIC_NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
        int irq;

        /* Mapping from the output timer irq lines from the CPU to the
         * GIC PPI inputs.
         */
        const int timer_irq[] = {
            [GTIMER_PHYS] = BCM2838_ARCH_TIMER_NS_EL1_IRQ,
            [GTIMER_VIRT] = BCM2838_ARCH_TIMER_VIRT_IRQ,
            [GTIMER_HYP]  = BCM2838_ARCH_TIMER_NS_EL2_IRQ,
            [GTIMER_SEC]  = BCM2838_ARCH_TIMER_S_EL1_IRQ,
        };

        for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
            qdev_connect_gpio_out(cpudev, irq,
                                  qdev_get_gpio_in(gicdev,
                                                   ppibase +
timer_irq[irq]));
        }

        /* I don't know the maintenance IRQ number for the this SoC */
#if 0
        qemu_irq irq = qdev_get_gpio_in(gicdev,
                                        ppibase + ARCH_GIC_MAINT_IRQ);
        sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + 4 *
smp_cpus, irq);
#endif

        /* PMU interrupt */
        qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
                                    qdev_get_gpio_in(gicdev,
BCM2838_PMU_SPI_BASE + i));

        /* Connect the GICv2 outputs to the CPU */
        sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i,
                           qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
        sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + smp_cpus,
                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
        sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + 2 *
smp_cpus,
                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
        sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + 3 *
smp_cpus,
                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
    }



HTH!

-- 
Luc

> +    }
> +
>       sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 0,
>           qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-irq", 0));
>       sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
> diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
> index 97187f72be..31c8fb90bd 100644
> --- a/include/hw/arm/bcm2836.h
> +++ b/include/hw/arm/bcm2836.h
> @@ -13,6 +13,7 @@
>   
>   #include "hw/arm/bcm2835_peripherals.h"
>   #include "hw/intc/bcm2836_control.h"
> +#include "hw/intc/arm_gic.h"
>   #include "target/arm/cpu.h"
>   
>   #define TYPE_BCM283X "bcm283x"
> @@ -26,6 +27,7 @@
>    */
>   #define TYPE_BCM2836 "bcm2836"
>   #define TYPE_BCM2837 "bcm2837"
> +#define TYPE_BCM2838 "bcm2838"
>   
>   typedef struct BCM283XState {
>       /*< private >*/
> @@ -36,6 +38,7 @@ typedef struct BCM283XState {
>       uint32_t enabled_cpus;
>   
>       ARMCPU cpus[BCM283X_NCPUS];
> +    GICState gic;
>       BCM2836ControlState control;
>       BCM2835PeripheralState peripherals;
>   } BCM283XState;
> 

Re: [Qemu-devel] [Qemu-arm] [RFC PATCH 12/14] hw/arm/bcm2836: Add the BCM2838 which uses a GICv2

[Philippe Mathieu-Daudé]

Hi Luc,

On 9/5/19 10:41 AM, Luc Michel wrote:
> On 9/4/19 7:13 PM, Philippe Mathieu-Daudé wrote:
>> The BCM2838 is improvement of the BCM2837:
>> - Cortex-A72 instead of the A53
>> - peripheral block and local soc controller are mapped differently,
>> - GICv2
>> - PCIe block
>> - exhanced MMU to address over 4GiB of SDRAM
>>
>> See https://www.raspberrypi.org/forums/viewtopic.php?t=244479&start=25
>> and https://patchwork.kernel.org/patch/11053097/
>>
>> This patch starts mapping the GICv2 but interrupt lines are NOT
>> wired (yet).
>>
>> This is enough to start running the Ubuntu kernel8.img from [1].
>>
>> Extract the kernel with:
>>
>>    $ mkdir bootpart
>>    $ guestfish \
>>        --ro \
>>        -a ubuntu-18.04.3-preinstalled-server-arm64+raspi4.img \
>>        -m /dev/sda1
>>    Welcome to guestfish, the guest filesystem shell for
>>    editing virtual machine filesystems and disk images.
>>
>>    ><fs> ls /
>>    COPYING.linux
>>    LICENCE.broadcom
>>    System.map
>>    armstub8-gic.bin
>>    bcm2710-rpi-3-b-plus.dtb
>>    bcm2710-rpi-3-b.dtb
>>    bcm2710-rpi-cm3.dtb
>>    bcm2711-rpi-4-b.dtb
>>    bcm2837-rpi-3-b-plus.dtb
>>    bcm2837-rpi-3-b.dtb
>>    cmdline.txt
>>    config.txt
>>    fixup4.dat
>>    fixup4cd.dat
>>    fixup4db.dat
>>    fixup4x.dat
>>    kernel8.img
>>    overlays
>>    start4.elf
>>    start4cd.elf
>>    start4db.elf
>>    start4x.elf
>>    ><fs> copy-out / bootpart/
>>    ><fs> q
>>
>> Then some progress can be noticed running:
>>
>>    $ qemu-system-aarch64 -d unimp,guest_errors,int,in_asm \
>>        -M raspi4 \
>>        -kernel bootpart/kernel8.img \
>>        -dtb bootpart/bcm2711-rpi-4-b.dtb \
>>        -initrd bootpart/boot/initrd.img \
>>        -append \
>>           "earlycon=pl011,0xfe201000 console=ttyAMA0 console=tty1 loglevel=8"
>>
>> Not very interesting, but it runs until configuring the GIC.
>> (remove 'in_asm' if too verbose).
>>
>> TODO:
>>
>> - wire IRQs to the GIC :)
>>
>> - map the SPI bootrom from [3] (boot sequence: [4])
>>
>> - per [2] we could try booting without using the GIC, adding "enable_gic=0"
>>    in config.txt. this variable is parsed by the firmware:
>>
>>    $ fgrep -r enable_gic bootpart
>>    Binary file bootpart/start4x.elf matches
>>    Binary file bootpart/start4.elf matches
>>    Binary file bootpart/start4db.elf matches
>>    Binary file bootpart/start4cd.elf matches
>>    bootpart/config.txt:enable_gic=1
>>
>>    the stub [5] doesn't seem to check a register for it.
>>    maybe it falls back to kernel7l?
>>
>> - decompile start4.elf to check how 'enable_gic' is used
>>    using vc4 toolchain from [6]
>>
>> [1] https://github.com/TheRemote/Ubuntu-Server-raspi4-unofficial/releases
>> [2] https://jamesachambers.com/raspberry-pi-ubuntu-server-18-04-2-installation-guide/
>> [3] https://www.raspberrypi.org/documentation/hardware/raspberrypi/booteeprom.md
>> [4] https://raspberrypi.stackexchange.com/questions/10442/what-is-the-boot-sequence
>> [5] https://github.com/raspberrypi/tools/commit/7f4a937e1bacbc111a22552169bc890b4bb26a94#diff-8c41083e9fa0c98f1c3015e11b897444
>> [6] https://github.com/christinaa/rpi-open-firmware
>>
>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>> ---
>>   hw/arm/bcm2836.c         | 75 ++++++++++++++++++++++++++++++++++++++++
>>   include/hw/arm/bcm2836.h |  3 ++
>>   2 files changed, 78 insertions(+)
>>
>> diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
>> index 019e67b906..d89d7cd71d 100644
>> --- a/hw/arm/bcm2836.c
>> +++ b/hw/arm/bcm2836.c
>> @@ -21,6 +21,7 @@ struct BCM283XInfo {
>>       const char *cpu_type;
>>       hwaddr peri_base; /* Peripheral base address seen by the CPU */
>>       hwaddr ctrl_base; /* Interrupt controller and mailboxes etc. */
>> +    hwaddr gic_base;
>>       int clusterid;
>>   };
>>   
>> @@ -40,9 +41,25 @@ static const BCM283XInfo bcm283x_socs[] = {
>>           .ctrl_base = 0x40000000,
>>           .clusterid = 0x0,
>>       },
>> +    {
>> +        .name = TYPE_BCM2838,
>> +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a72"),
>> +        .peri_base = 0xfe000000,
>> +        .ctrl_base = 0xff800000,
>> +        .gic_base = 0x40000,
>> +    },
>>   #endif
>>   };
>>   
>> +#define GIC_NUM_IRQS                256
>> +
>> +#define GIC_BASE_OFS                0x0000
>> +#define GIC_DIST_OFS                0x1000
>> +#define GIC_CPU_OFS                 0x2000
>> +#define GIC_VIFACE_THIS_OFS         0x4000
>> +#define GIC_VIFACE_OTHER_OFS(cpu)  (0x5000 + (cpu) * 0x200)
>> +#define GIC_VCPU_OFS                0x6000
>> +
>>   static void bcm2836_init(Object *obj)
>>   {
>>       BCM283XState *s = BCM283X(obj);
>> @@ -55,6 +72,11 @@ static void bcm2836_init(Object *obj)
>>                                   info->cpu_type, &error_abort, NULL);
>>       }
>>   
>> +    if (info->gic_base) {
>> +        sysbus_init_child_obj(obj, "gic", &s->gic, sizeof(s->gic),
>> +                              TYPE_ARM_GIC);
>> +    }
>> +
>>       sysbus_init_child_obj(obj, "control", &s->control, sizeof(s->control),
>>                             TYPE_BCM2836_CONTROL);
>>   
>> @@ -115,6 +137,59 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
>>   
>>       sysbus_mmio_map(SYS_BUS_DEVICE(&s->control), 0, info->ctrl_base);
>>   
>> +    /* bcm2838 GICv2 */
>> +    if (info->gic_base) {
>> +        object_property_set_uint(OBJECT(&s->gic), 2, "revision", &err);
>> +        if (err) {
>> +            error_propagate(errp, err);
>> +            return;
>> +        }
>> +
>> +        object_property_set_uint(OBJECT(&s->gic),
>> +                                 BCM283X_NCPUS, "num-cpu", &err);
>> +        if (err) {
>> +            error_propagate(errp, err);
>> +            return;
>> +        }
>> +
>> +        object_property_set_uint(OBJECT(&s->gic),
>> +                                 32 + GIC_NUM_IRQS, "num-irq", &err);
>> +        if (err) {
>> +            error_propagate(errp, err);
>> +            return;
>> +        }
>> +
>> +        object_property_set_bool(OBJECT(&s->gic),
>> +                                 true, "has-virtualization-extensions", &err);
>> +        if (err) {
>> +            error_propagate(errp, err);
>> +            return;
>> +        }
>> +
>> +        object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
>> +        if (err) {
>> +            error_propagate(errp, err);
>> +            return;
>> +        }
>> +
>> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 0,
>> +                        info->ctrl_base + info->gic_base + GIC_DIST_OFS);
>> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 1,
>> +                        info->ctrl_base + info->gic_base + GIC_CPU_OFS);
>> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 2,
>> +                        info->ctrl_base + info->gic_base + GIC_VIFACE_THIS_OFS);
>> +        sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 3,
>> +                        info->ctrl_base + info->gic_base + GIC_VCPU_OFS);
>> +
>> +        for (n = 0; n < BCM283X_NCPUS; n++) {
>> +            sysbus_mmio_map(SYS_BUS_DEVICE(&s->gic), 4 + n,
>> +                            info->ctrl_base + info->gic_base
>> +                            + GIC_VIFACE_OTHER_OFS(n));> +        }
>> +
>> +        /* TODO wire IRQs!!! */
> 
> I think as a bare minimum, you must wire:
>   - the ARM generic timer IRQs going out of all the CPUs, into their
> respective PPI. Looking at [1], they seem to be connected to the usual
> PPIs (at least we have the same mapping in the vexpress, the xynqmp and
> the virt board).

Done :)

>   - The PMU interrupts

Still TODO.

>   - Possibly the GICv2 maintenance interrupt, but I can't find the IRQ
> number in the DTS. This is related to the virtualization extension. It
> should not prevent Linux from booting if it's not connected (I think KVM
> does not even use the GICv2 maintenance interrupts anyway).

Done, this is a GIC-400 so it is fixed as PPI IRQ#9 :)

>   - Finally, Connect the four GICv2 output (irq, fiq, virq, vfiq) to
> their respective CPU inputs.

Done.

> [1]
> https://github.com/raspberrypi/linux/blob/rpi-5.3.y/arch/arm/boot/dts/bcm2838.dtsi
> 
> 
> Here is a snippet of the virt board, quickly adapted foc this SoC (I
> didn't test it):

Thanks! It helped :)

> #define BCM2838_ARCH_TIMER_VIRT_IRQ   11
> #define BCM2838_ARCH_TIMER_S_EL1_IRQ  13
> #define BCM2838_ARCH_TIMER_NS_EL1_IRQ 14
> #define BCM2838_ARCH_TIMER_NS_EL2_IRQ 10
> 
> #define BCM2838_PMU_SPI_BASE          16
> [...]
> 
>  for (i = 0; i < BCM283X_NCPUS; i++) {
>         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
>         int ppibase = GIC_NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
>         int irq;
> 
>         /* Mapping from the output timer irq lines from the CPU to the
>          * GIC PPI inputs.
>          */
>         const int timer_irq[] = {
>             [GTIMER_PHYS] = BCM2838_ARCH_TIMER_NS_EL1_IRQ,
>             [GTIMER_VIRT] = BCM2838_ARCH_TIMER_VIRT_IRQ,
>             [GTIMER_HYP]  = BCM2838_ARCH_TIMER_NS_EL2_IRQ,
>             [GTIMER_SEC]  = BCM2838_ARCH_TIMER_S_EL1_IRQ,
>         };
> 
>         for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
>             qdev_connect_gpio_out(cpudev, irq,
>                                   qdev_get_gpio_in(gicdev,
>                                                    ppibase +
> timer_irq[irq]));
>         }
> 
>         /* I don't know the maintenance IRQ number for the this SoC */
> #if 0
>         qemu_irq irq = qdev_get_gpio_in(gicdev,
>                                         ppibase + ARCH_GIC_MAINT_IRQ);
>         sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + 4 *
> smp_cpus, irq);
> #endif
> 
>         /* PMU interrupt */
>         qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
>                                     qdev_get_gpio_in(gicdev,
> BCM2838_PMU_SPI_BASE + i));
> 
>         /* Connect the GICv2 outputs to the CPU */
>         sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i,
>                            qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
>         sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + smp_cpus,
>                            qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
>         sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + 2 *
> smp_cpus,
>                            qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
>         sysbus_connect_irq(SYS_BUS_DEVICE(gicbusdevs->gic), i + 3 *
> smp_cpus,
>                            qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
>     }

With this and few other changes I get some hopeful kernel output:

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd083]
[    0.000000] Linux version 4.19.67-v8+ (james@james-ubuntu2) (gcc
version 9.1.0 (GCC)) #1 SMP PREEMPT Mon Aug 26 21:26:31 MDT 2019
[    0.000000] Machine model: Raspberry Pi 4 Model B
[    0.000000] earlycon: pl11 at MMIO 0x00000000fe201000 (options '')
[    0.000000] bootconsole [pl11] enabled
[    0.000000] efi: Getting EFI parameters from FDT:
[    0.000000] efi: UEFI not found.
[    0.000000] cma: Reserved 8 MiB at 0x000000003b800000
[    0.000000] On node 0 totalpages: 245760
[    0.000000]   DMA32 zone: 3840 pages used for memmap
[    0.000000]   DMA32 zone: 0 pages reserved
[    0.000000]   DMA32 zone: 245760 pages, LIFO batch:63
[    0.000000] random: get_random_bytes called from
start_kernel+0xa0/0x46c with crng_init=0
[    0.000000] percpu: Embedded 24 pages/cpu s57368 r8192 d32744 u98304
[    0.000000] pcpu-alloc: s57368 r8192 d32744 u98304 alloc=24*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
[    0.000000] Detected PIPT I-cache on CPU0
[    0.000000] CPU features: enabling workaround for EL2 vector hardening
[    0.000000] CPU features: detected: Kernel page table isolation (KPTI)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 241920
[    0.000000] Kernel command line: rw earlycon=pl011,0xfe201000
console=ttyAMA0 loglevel=8 root=/dev/mmcblk0p2 fsck.repair=yes
net.ifnames=0 rootwait rdinit=/sbin/init
[    0.000000] Dentry cache hash table entries: 131072 (order: 8,
1048576 bytes)
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288
bytes)
[    0.000000] Memory: 923932K/983040K available (8060K kernel code,
966K rwdata, 2560K rodata, 960K init, 916K bss, 50916K reserved, 8192K
cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] ftrace: allocating 28504 entries in 112 pages
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=64 to
nr_cpu_ids=4.
[    0.000000]  Tasks RCU enabled.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GIC: Using split EOI/Deactivate mode
[    0.000000] arch_timer: cp15 timer(s) running at 54.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff
max_cycles: 0xc743ce346, max_idle_ns: 440795203123 ns
[    0.001377] sched_clock: 56 bits at 54MHz, resolution 18ns, wraps
every 4398046511102ns
[    0.070247] Console: colour dummy device 80x25
[    0.085191] Calibrating delay loop (skipped), value calculated using
timer frequency.. 108.00 BogoMIPS (lpj=216000)
[    0.087407] pid_max: default: 32768 minimum: 301
[    0.118255] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes)
[    0.120037] Mountpoint-cache hash table entries: 2048 (order: 2,
16384 bytes)
[    0.462960] ASID allocator initialised with 32768 entries
[    0.475367] rcu: Hierarchical SRCU implementation.
[    0.540749] EFI services will not be available.
[    0.563715] smp: Bringing up secondary CPUs ...
[    0.624297] Detected PIPT I-cache on CPU1
[    0.628830] CPU1: Booted secondary processor 0x0000000001 [0x410fd083]
[    0.698386] Detected PIPT I-cache on CPU2
[    0.699334] CPU2: Booted secondary processor 0x0000000002 [0x410fd083]
[    0.752144] Detected PIPT I-cache on CPU3
[    0.753057] CPU3: Booted secondary processor 0x0000000003 [0x410fd083]
[    0.759037] smp: Brought up 1 node, 4 CPUs
[    0.762310] SMP: Total of 4 processors activated.
[    0.763888] CPU features: detected: 32-bit EL0 Support
[    0.819489] CPU: All CPU(s) started at EL2
[    0.826062] alternatives: patching kernel code
[    0.948345] devtmpfs: initialized
[    1.235286] Enabled cp15_barrier support
[    1.237025] Enabled setend support
[    1.253695] clocksource: jiffies: mask: 0xffffffff max_cycles:
0xffffffff, max_idle_ns: 7645041785100000 ns
[    1.255510] futex hash table entries: 1024 (order: 4, 65536 bytes)
[    1.275781] pinctrl core: initialized pinctrl subsystem
[    1.347547] DMI not present or invalid.
[    1.378896] NET: Registered protocol family 16
[    1.439424] cpuidle: using governor menu
[    1.450693] vdso: 2 pages (1 code @ (____ptrval____), 1 data @
(____ptrval____))
[    1.452529] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.

Regards.

Phil.

[Qemu-devel] [RFC PATCH 13/14] hw/arm/bcm2838: Map the PCIe memory space

[Philippe Mathieu-Daudé]

The BCM2711 has a BCM54213 Gigabit Ethernet block mapped
in the PCIe range.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
FIXME: create the bcm54213-geth in raspi.c?
---
 hw/arm/bcm2836.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index d89d7cd71d..39190a108f 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -15,6 +15,7 @@
 #include "hw/arm/bcm2836.h"
 #include "hw/arm/raspi_platform.h"
 #include "hw/sysbus.h"
+#include "hw/misc/unimp.h"
 
 struct BCM283XInfo {
     const char *name;
@@ -60,6 +61,8 @@ static const BCM283XInfo bcm283x_socs[] = {
 #define GIC_VIFACE_OTHER_OFS(cpu)  (0x5000 + (cpu) * 0x200)
 #define GIC_VCPU_OFS                0x6000
 
+#define PCIE_BASE                   0x7d500000
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -238,6 +241,13 @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
         qdev_connect_gpio_out(DEVICE(&s->cpus[n]), GTIMER_SEC,
                 qdev_get_gpio_in_named(DEVICE(&s->control), "cntpsirq", n));
     }
+
+    /* bcm2838 kludge to easily create PCIe */
+    if (info->gic_base) {
+        create_unimplemented_device("bcm2838-pcie", PCIE_BASE, 0x100000);
+        create_unimplemented_device("bcm54213-geth",
+                                    PCIE_BASE + 0x80000, 0x10000);
+    }
 }
 
 static Property bcm2836_props[] = {
-- 
2.20.1

[Qemu-devel] [RFC PATCH 14/14] hw/arm/raspi: Add the Raspberry Pi 4B board

[Philippe Mathieu-Daudé]

The Raspberry Pi 4 uses a BCM2711 SoC (based on a BCM2838).
The SoC can handle up to 8GiB of SDRAM, but we limit it to 4GiB
(no 8GiB models in the market yet).

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 hw/arm/raspi.c | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index b4db39661f..59ee2f82b4 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -39,11 +39,13 @@ enum BoardIdChip {
     C_BCM2835 = 0,
     C_BCM2836 = 1,
     C_BCM2837 = 2,
+    C_BCM2711 = 3,
 };
 
 enum BoardIdType {
     T_2B = 0x04,
     T_3B = 0x08,
+    T_4B = 0x11,
 };
 
 enum BoardIdRevision {
@@ -56,6 +58,7 @@ enum BoardIdRevision {
 static const char *processor_typename[] = {
     [C_BCM2836] = TYPE_BCM2836,
     [C_BCM2837] = TYPE_BCM2837,
+    [C_BCM2711] = TYPE_BCM2838,
 };
 
 typedef struct BoardInfo BoardInfo;
@@ -90,6 +93,12 @@ static const BoardInfo bcm283x_boards[] = {
         .ram_size_min = 1 * GiB,
         .ram_size_max = 1 * GiB,
     },
+    [4] = {
+        .board_id = 0xc42,
+        .board_rev = { T_4B, R_1_1, C_BCM2711, M_SONY_UK },
+        .ram_size_min = 1 * GiB,
+        .ram_size_max = 4 * GiB,
+    },
 };
 
 typedef struct RasPiState {
@@ -336,4 +345,24 @@ static void raspi3_machine_init(MachineClass *mc)
     mc->default_ram_size = 1 * GiB;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-#endif
+
+static void raspi4_init(MachineState *machine)
+{
+    raspi_init(machine, 4);
+}
+
+static void raspi4_machine_init(MachineClass *mc)
+{
+    mc->desc = "Raspberry Pi 4B";
+    mc->init = raspi4_init;
+    mc->block_default_type = IF_SD;
+    mc->no_parallel = 1;
+    mc->no_floppy = 1;
+    mc->no_cdrom = 1;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
+    mc->default_ram_size = 1 * GiB;
+}
+DEFINE_MACHINE("raspi4", raspi4_machine_init)
+#endif /* TARGET_AARCH64 */
-- 
2.20.1

Re: [RFC PATCH 14/14] hw/arm/raspi: Add the Raspberry Pi 4B board

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> The Raspberry Pi 4 uses a BCM2711 SoC (based on a BCM2838).
> The SoC can handle up to 8GiB of SDRAM, but we limit it to 4GiB
> (no 8GiB models in the market yet).
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/raspi.c | 31 ++++++++++++++++++++++++++++++-
>  1 file changed, 30 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
> index b4db39661f..59ee2f82b4 100644
> --- a/hw/arm/raspi.c
> +++ b/hw/arm/raspi.c
> @@ -39,11 +39,13 @@ enum BoardIdChip {
>      C_BCM2835 = 0,
>      C_BCM2836 = 1,
>      C_BCM2837 = 2,
> +    C_BCM2711 = 3,
>  };
>  
>  enum BoardIdType {
>      T_2B = 0x04,
>      T_3B = 0x08,
> +    T_4B = 0x11,
>  };
>  
>  enum BoardIdRevision {
> @@ -56,6 +58,7 @@ enum BoardIdRevision {
>  static const char *processor_typename[] = {
>      [C_BCM2836] = TYPE_BCM2836,
>      [C_BCM2837] = TYPE_BCM2837,
> +    [C_BCM2711] = TYPE_BCM2838,
>  };
>  
>  typedef struct BoardInfo BoardInfo;
> @@ -90,6 +93,12 @@ static const BoardInfo bcm283x_boards[] = {
>          .ram_size_min = 1 * GiB,
>          .ram_size_max = 1 * GiB,
>      },
> +    [4] = {
> +        .board_id = 0xc42,
> +        .board_rev = { T_4B, R_1_1, C_BCM2711, M_SONY_UK },
> +        .ram_size_min = 1 * GiB,
> +        .ram_size_max = 4 * GiB,
> +    },
>  };
>  
>  typedef struct RasPiState {
> @@ -336,4 +345,24 @@ static void raspi3_machine_init(MachineClass
> *mc)
>      mc->default_ram_size = 1 * GiB;
>  }
>  DEFINE_MACHINE("raspi3", raspi3_machine_init)
> -#endif
> +
> +static void raspi4_init(MachineState *machine)
> +{
> +    raspi_init(machine, 4);
> +}
> +
> +static void raspi4_machine_init(MachineClass *mc)
> +{
> +    mc->desc = "Raspberry Pi 4B";
> +    mc->init = raspi4_init;
> +    mc->block_default_type = IF_SD;
> +    mc->no_parallel = 1;
> +    mc->no_floppy = 1;
> +    mc->no_cdrom = 1;
> +    mc->max_cpus = BCM283X_NCPUS;
> +    mc->min_cpus = BCM283X_NCPUS;
> +    mc->default_cpus = BCM283X_NCPUS;
> +    mc->default_ram_size = 1 * GiB;
The comercial models are: 1, 2 and 4 GiB. Why do you choose 1 GiB as
default?
> +}
> +DEFINE_MACHINE("raspi4", raspi4_machine_init)
> +#endif /* TARGET_AARCH64 */
Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

Re: [RFC PATCH 14/14] hw/arm/raspi: Add the Raspberry Pi 4B board

[Philippe Mathieu-Daudé]

Hi Esteban,

On 9/29/19 5:53 PM, Esteban Bosse wrote:
> El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
>> The Raspberry Pi 4 uses a BCM2711 SoC (based on a BCM2838).
>> The SoC can handle up to 8GiB of SDRAM, but we limit it to 4GiB
>> (no 8GiB models in the market yet).
>>
>> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
>> ---
>>   hw/arm/raspi.c | 31 ++++++++++++++++++++++++++++++-
>>   1 file changed, 30 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
>> index b4db39661f..59ee2f82b4 100644
>> --- a/hw/arm/raspi.c
>> +++ b/hw/arm/raspi.c
>> @@ -39,11 +39,13 @@ enum BoardIdChip {
>>       C_BCM2835 = 0,
>>       C_BCM2836 = 1,
>>       C_BCM2837 = 2,
>> +    C_BCM2711 = 3,
>>   };
>>   
>>   enum BoardIdType {
>>       T_2B = 0x04,
>>       T_3B = 0x08,
>> +    T_4B = 0x11,
>>   };
>>   
>>   enum BoardIdRevision {
>> @@ -56,6 +58,7 @@ enum BoardIdRevision {
>>   static const char *processor_typename[] = {
>>       [C_BCM2836] = TYPE_BCM2836,
>>       [C_BCM2837] = TYPE_BCM2837,
>> +    [C_BCM2711] = TYPE_BCM2838,
>>   };
>>   
>>   typedef struct BoardInfo BoardInfo;
>> @@ -90,6 +93,12 @@ static const BoardInfo bcm283x_boards[] = {
>>           .ram_size_min = 1 * GiB,
>>           .ram_size_max = 1 * GiB,
>>       },
>> +    [4] = {
>> +        .board_id = 0xc42,
>> +        .board_rev = { T_4B, R_1_1, C_BCM2711, M_SONY_UK },
>> +        .ram_size_min = 1 * GiB,
>> +        .ram_size_max = 4 * GiB,
>> +    },
>>   };
>>   
>>   typedef struct RasPiState {
>> @@ -336,4 +345,24 @@ static void raspi3_machine_init(MachineClass
>> *mc)
>>       mc->default_ram_size = 1 * GiB;
>>   }
>>   DEFINE_MACHINE("raspi3", raspi3_machine_init)
>> -#endif
>> +
>> +static void raspi4_init(MachineState *machine)
>> +{
>> +    raspi_init(machine, 4);
>> +}
>> +
>> +static void raspi4_machine_init(MachineClass *mc)
>> +{
>> +    mc->desc = "Raspberry Pi 4B";
>> +    mc->init = raspi4_init;
>> +    mc->block_default_type = IF_SD;
>> +    mc->no_parallel = 1;
>> +    mc->no_floppy = 1;
>> +    mc->no_cdrom = 1;
>> +    mc->max_cpus = BCM283X_NCPUS;
>> +    mc->min_cpus = BCM283X_NCPUS;
>> +    mc->default_cpus = BCM283X_NCPUS;
>> +    mc->default_ram_size = 1 * GiB;
> The comercial models are: 1, 2 and 4 GiB. Why do you choose 1 GiB as
> default?

Well need one default, and 1GiB is the least beefy :)
You can start a VM with more using the '-m' switch.

Note there is also a 8GiB raspi4, but it is not yet launched apparently.

>> +}
>> +DEFINE_MACHINE("raspi4", raspi4_machine_init)
>> +#endif /* TARGET_AARCH64 */
> Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

Thanks!

Re: [RFC PATCH 14/14] hw/arm/raspi: Add the Raspberry Pi 4B board

[Peter Maydell]

On Tue, 8 Oct 2019 at 10:04, Philippe Mathieu-Daudé <f4bug@amsat.org> wrote:
>
> Hi Esteban,
>
> On 9/29/19 5:53 PM, Esteban Bosse wrote:
> >> +static void raspi4_machine_init(MachineClass *mc)
> >> +{
> >> +    mc->desc = "Raspberry Pi 4B";
> >> +    mc->init = raspi4_init;
> >> +    mc->block_default_type = IF_SD;
> >> +    mc->no_parallel = 1;
> >> +    mc->no_floppy = 1;
> >> +    mc->no_cdrom = 1;
> >> +    mc->max_cpus = BCM283X_NCPUS;
> >> +    mc->min_cpus = BCM283X_NCPUS;
> >> +    mc->default_cpus = BCM283X_NCPUS;
> >> +    mc->default_ram_size = 1 * GiB;
> > The comercial models are: 1, 2 and 4 GiB. Why do you choose 1 GiB as
> > default?
>
> Well need one default, and 1GiB is the least beefy :)
> You can start a VM with more using the '-m' switch.

Among other things, a 2GB or more board will fail
'make check' on a 32-bit host, because 'make check' tries
to start all board models, and 32-bit hosts can only
handle up to 2047MB of guest RAM.

thanks
-- PMM

Re: [RFC PATCH 14/14] hw/arm/raspi: Add the Raspberry Pi 4B board

[Esteban Bosse]

El jue, 24-10-2019 a las 10:07 +0100, Peter Maydell escribió:
> On Tue, 8 Oct 2019 at 10:04, Philippe Mathieu-Daudé <f4bug@amsat.org>
> wrote:
> > Hi Esteban,
> > 
> > On 9/29/19 5:53 PM, Esteban Bosse wrote:
> > > > +static void raspi4_machine_init(MachineClass *mc)
> > > > +{
> > > > +    mc->desc = "Raspberry Pi 4B";
> > > > +    mc->init = raspi4_init;
> > > > +    mc->block_default_type = IF_SD;
> > > > +    mc->no_parallel = 1;
> > > > +    mc->no_floppy = 1;
> > > > +    mc->no_cdrom = 1;
> > > > +    mc->max_cpus = BCM283X_NCPUS;
> > > > +    mc->min_cpus = BCM283X_NCPUS;
> > > > +    mc->default_cpus = BCM283X_NCPUS;
> > > > +    mc->default_ram_size = 1 * GiB;
> > > The comercial models are: 1, 2 and 4 GiB. Why do you choose 1 GiB
> > > as
> > > default?
> > 
> > Well need one default, and 1GiB is the least beefy :)
> > You can start a VM with more using the '-m' switch.
> 
> Among other things, a 2GB or more board will fail
> 'make check' on a 32-bit host, because 'make check' tries
> to start all board models, and 32-bit hosts can only
> handle up to 2047MB of guest RAM.
> 
> thanks
> -- PMM

Understood, thanks again for the info :).

Re: [RFC PATCH 14/14] hw/arm/raspi: Add the Raspberry Pi 4B board

[Esteban Bosse]

El mié, 04-09-2019 a las 19:13 +0200, Philippe Mathieu-Daudé escribió:
> The Raspberry Pi 4 uses a BCM2711 SoC (based on a BCM2838).
> The SoC can handle up to 8GiB of SDRAM, but we limit it to 4GiB
> (no 8GiB models in the market yet).
> 
> Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
> ---
>  hw/arm/raspi.c | 31 ++++++++++++++++++++++++++++++-
>  1 file changed, 30 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
> index b4db39661f..59ee2f82b4 100644
> --- a/hw/arm/raspi.c
> +++ b/hw/arm/raspi.c
> @@ -39,11 +39,13 @@ enum BoardIdChip {
>      C_BCM2835 = 0,
>      C_BCM2836 = 1,
>      C_BCM2837 = 2,
> +    C_BCM2711 = 3,
>  };
>  
>  enum BoardIdType {
>      T_2B = 0x04,
>      T_3B = 0x08,
> +    T_4B = 0x11,
>  };
>  
>  enum BoardIdRevision {
> @@ -56,6 +58,7 @@ enum BoardIdRevision {
>  static const char *processor_typename[] = {
>      [C_BCM2836] = TYPE_BCM2836,
>      [C_BCM2837] = TYPE_BCM2837,
> +    [C_BCM2711] = TYPE_BCM2838,
>  };
>  
>  typedef struct BoardInfo BoardInfo;
> @@ -90,6 +93,12 @@ static const BoardInfo bcm283x_boards[] = {
>          .ram_size_min = 1 * GiB,
>          .ram_size_max = 1 * GiB,
>      },
> +    [4] = {
> +        .board_id = 0xc42,
> +        .board_rev = { T_4B, R_1_1, C_BCM2711, M_SONY_UK },
> +        .ram_size_min = 1 * GiB,
> +        .ram_size_max = 4 * GiB,
> +    },
>  };
>  
>  typedef struct RasPiState {
> @@ -336,4 +345,24 @@ static void raspi3_machine_init(MachineClass
> *mc)
>      mc->default_ram_size = 1 * GiB;
>  }
>  DEFINE_MACHINE("raspi3", raspi3_machine_init)
> -#endif
> +
> +static void raspi4_init(MachineState *machine)
> +{
> +    raspi_init(machine, 4);
> +}
> +
> +static void raspi4_machine_init(MachineClass *mc)
> +{
> +    mc->desc = "Raspberry Pi 4B";
> +    mc->init = raspi4_init;
> +    mc->block_default_type = IF_SD;
> +    mc->no_parallel = 1;
> +    mc->no_floppy = 1;
> +    mc->no_cdrom = 1;
> +    mc->max_cpus = BCM283X_NCPUS;
> +    mc->min_cpus = BCM283X_NCPUS;
> +    mc->default_cpus = BCM283X_NCPUS;
> +    mc->default_ram_size = 1 * GiB;
> +}
> +DEFINE_MACHINE("raspi4", raspi4_machine_init)
> +#endif /* TARGET_AARCH64 */
Reviewed-by: Esteban Bosse <estebanbosse@gmail.com>

RE: [Qemu-arm] [RFC PATCH 00/14] hw/arm: Add the Raspberry Pi 4B

[Stewart Hildebrand]

On Wednesday, September 4, 2019 1:13 PM, Philippe Mathieu-Daudé wrote:
>Esteban wrote me over the weekend asking about raspi4 progress.
>I cleaned up my patches/notes to pass him. Other help is also welcomed :)
>I got scared trying to understand how to use the GIC, and wire the various
>IRQs.
>
>Most important notes about testing are in patch #12:
>"Add the BCM2838 which uses a GICv2"
>
>Not much works yet, it only runs a bit until configuring the GIC.
>
>branch pushed at https://gitlab.com/philmd/qemu/commits/raspi4_wip
>
>Regards,
>
>Phil.

It seems upstream linux may be adopting the BCM2711 naming convention [1], though it doesn't look like the series [1] has been committed yet. The SoC name in documentation is BCM2711 [2]. I have no opinion on which naming convention the QEMU community adopts, I simply wanted to pass along this observation.

-Stew

[1] https://patchwork.kernel.org/cover/11092613/
[2] https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2711/README.md