[Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Ramy Sameh]

Hello all,

I have 2 problems regarding UART (pl011) in the emulated board VersatilePB.
(I am using *QEMU version 2.8.1.*)

*My main goal is*:
Disturbing the UART registers (such UARTCR, UARTLCR_H ... etc) in order to
simulate hardware faults (which can make bit flips in the hardware
registers through radiation for example).


*My 2 questions are:*

*First:*
Are interrupts activated in the emulated pl011 ?
I mean, if I enabled the interrupt bits for UARTTXINTR, will this trigger
an interrupt when the FIFO reaches a certain level?

*Second:*
Another problem is that I can't find some of the UART registers (which are
in the data sheet PrimeCell UART (PL011)), in QEMU's emulated UART pl011.

*These are the registers which I can't find their matches in the structure
PL011State:*

1.) Interrupt FIFO level select register, UARTIFLS
2.) Raw interrupt status register, UARTRIS
3.) Masked interrupt status register, UARTMIS
4.) Interrupt clear register, UARTICR
5.) Peripheral identification registers, UARTPeriphID0-3
6.) PrimeCell identification registers, UARTPCellID0-3

*This is the structure where I get pl011 emulated registers:*
typedef struct PL011State
{
    SysBusDevice parent_obj;

    MemoryRegion iomem;
    uint32_t readbuff;
    uint32_t flags;
    uint32_t lcr;
    uint32_t rsr;
    uint32_t cr;
    uint32_t dmacr;
    uint32_t int_enabled;
    uint32_t int_level;
    uint32_t read_fifo[16];
    uint32_t ilpr;
    uint32_t ibrd;
    uint32_t fbrd;
    uint32_t ifl;
    int read_pos;
    int read_count;
    int read_trigger;
    CharBackend chr;
    qemu_irq irq;
    const unsigned char *id;
} PL011State

-- 
Best Regards,
Ramy Sameh
Embedded Software Engineer
+2-010-172-777-14

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Peter Maydell]

On 4 September 2017 at 01:27, Ramy Sameh <ramysameh26@gmail.com> wrote:
> *My 2 questions are:*
>
> *First:*
> Are interrupts activated in the emulated pl011 ?
> I mean, if I enabled the interrupt bits for UARTTXINTR, will this trigger
> an interrupt when the FIFO reaches a certain level?

Yes, we implement interrupts.

> *Second:*
> Another problem is that I can't find some of the UART registers (which are
> in the data sheet PrimeCell UART (PL011)), in QEMU's emulated UART pl011.
>
> *These are the registers which I can't find their matches in the structure
> PL011State:*
>
> 1.) Interrupt FIFO level select register, UARTIFLS
> 2.) Raw interrupt status register, UARTRIS
> 3.) Masked interrupt status register, UARTMIS
> 4.) Interrupt clear register, UARTICR
> 5.) Peripheral identification registers, UARTPeriphID0-3
> 6.) PrimeCell identification registers, UARTPCellID0-3

All these registers are implemented. You can find the code that
implements them in the pl011_read() and pl011_write() functions.

> *This is the structure where I get pl011 emulated registers:*
> typedef struct PL011State

This structure defines (among other things) fields which
hold the underlying state of the device (in hardware terms,
usually information which is in a flipflop or otherwise
stored). This is not the same as a guest-visible register,
although there is very often overlap. For instance, the
ID registers are constant and read-only, so they do not
have any modifiable state that we need to put in the struct
(in hardware, they'll be implemented by just tying off
lines to 0 or 1, not with flops). Sometimes a register
value as seen by the guest is just a logical combination
of state used by other registers, eg UARTMIS is just the
logical OR of UARTRIS and UARTIMSC, so it doesn't need
any extra state in the struct.

Some of the state fields have names that don't correspond
to the register names for historical reasons (eg UARTIFLS
is in s->ifl); you should always start with the read and
write functions to look at how the register behaviour
is implemented, which will show you which state fields
if any are involved.

thanks
-- PMM

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Ramy Sameh]

Thanks Peter for your help.

Are there any documentation or source of information, that can describe how
interrupts are implemented, and how to use them (where is the vector table
to put the ISR ... etc) ?
In addition, any source of info that describes the code workflow when
reading or writing to the uart would be very helpful.
(because I put printfs in the functions to understand the workflow, but the
order of these printfs made me very confused).

Regarding the registers, I have checked pl011_read and pl011_write, and
found them, thanks for that.
But I couldn't find the register "UARTICR" (*Interrupt clear register*)
I think this might be related to my lack of understanding of how interrupts
are implemented in emulated pl011.

Regarding the ID registers, whose values are hard-wired in the board, and
there was no need to implement modifiable states for them.
Do you mean *Peripheral identification registers, UARTPeriphID0-3* and
*PrimeCell
identification registers, UARTPCellID0-3* ?

Thanks in advance for your help.


On Mon, Sep 4, 2017 at 10:50 AM, Peter Maydell <peter.maydell@linaro.org>
wrote:

> On 4 September 2017 at 01:27, Ramy Sameh <ramysameh26@gmail.com> wrote:
> > *My 2 questions are:*
> >
> > *First:*
> > Are interrupts activated in the emulated pl011 ?
> > I mean, if I enabled the interrupt bits for UARTTXINTR, will this trigger
> > an interrupt when the FIFO reaches a certain level?
>
> Yes, we implement interrupts.
>
> > *Second:*
> > Another problem is that I can't find some of the UART registers (which
> are
> > in the data sheet PrimeCell UART (PL011)), in QEMU's emulated UART pl011.
> >
> > *These are the registers which I can't find their matches in the
> structure
> > PL011State:*
> >
> > 1.) Interrupt FIFO level select register, UARTIFLS
> > 2.) Raw interrupt status register, UARTRIS
> > 3.) Masked interrupt status register, UARTMIS
> > 4.) Interrupt clear register, UARTICR
> > 5.) Peripheral identification registers, UARTPeriphID0-3
> > 6.) PrimeCell identification registers, UARTPCellID0-3
>
> All these registers are implemented. You can find the code that
> implements them in the pl011_read() and pl011_write() functions.
>
> > *This is the structure where I get pl011 emulated registers:*
> > typedef struct PL011State
>
> This structure defines (among other things) fields which
> hold the underlying state of the device (in hardware terms,
> usually information which is in a flipflop or otherwise
> stored). This is not the same as a guest-visible register,
> although there is very often overlap. For instance, the
> ID registers are constant and read-only, so they do not
> have any modifiable state that we need to put in the struct
> (in hardware, they'll be implemented by just tying off
> lines to 0 or 1, not with flops). Sometimes a register
> value as seen by the guest is just a logical combination
> of state used by other registers, eg UARTMIS is just the
> logical OR of UARTRIS and UARTIMSC, so it doesn't need
> any extra state in the struct.
>
> Some of the state fields have names that don't correspond
> to the register names for historical reasons (eg UARTIFLS
> is in s->ifl); you should always start with the read and
> write functions to look at how the register behaviour
> is implemented, which will show you which state fields
> if any are involved.
>
> thanks
> -- PMM
>



-- 
Best Regards,
Ramy Sameh
Embedded Software Engineer
+2-010-172-777-14

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Peter Maydell]

On 5 September 2017 at 18:56, Ramy Sameh <ramysameh26@gmail.com> wrote:
> Are there any documentation or source of information, that can describe how
> interrupts are implemented, and how to use them (where is the vector table
> to put the ISR ... etc) ?

The source code is it.

Note that the pl011 is only a UART. It is used in a variety
of different boards, which have different interrupt controllers,
and with different CPUs. Things like ISR vector tables are
generally part of the CPU or interrupt controller emulation.

The pl011's part of this is simply to raise and lower its outbound IRQ line
when the conditions are right -- this happens by calling qemu_set_irq()
in pl011_update(). This corresponds to the hardware's UARTINTR line.
In QEMU that IRQ line is connected up to an emulated interrupt controller
which in turn is connected to an emulated CPU, just as in hardware
the pl011 UARTINTR line is connected to a hardware interrupt controller
and thus to a CPU.

For information on how guest code should use a UART, how it should
set up interrupts and so on, you should consult the documentation
on how the hardware behaves.

> In addition, any source of info that describes the code workflow when
> reading or writing to the uart would be very helpful.
> (because I put printfs in the functions to understand the workflow, but the
> order of these printfs made me very confused).
>
> Regarding the registers, I have checked pl011_read and pl011_write, and
> found them, thanks for that.
> But I couldn't find the register "UARTICR" (Interrupt clear register)
> I think this might be related to my lack of understanding of how interrupts
> are implemented in emulated pl011.

UARTICR is a write-only register, so it is handled only in
pl011_write():

    case 17: /* UARTICR */
        s->int_level &= ~value;
        pl011_update(s);
        break;

(It's write-1-to-clear, hence the &= ~.)

> Regarding the ID registers, whose values are hard-wired in the board, and
> there was no need to implement modifiable states for them.
> Do you mean Peripheral identification registers, UARTPeriphID0-3 and
> PrimeCell identification registers, UARTPCellID0-3 ?

Yes. (See the pl011_id_arm[] array which has the values.)

thanks
-- PMM

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Ramy Sameh]

Thank you very much Peter.

I will check the documentation for VersatilePB and ARM926EJ-S for more
understanding of interrupts handling.



On Tue, Sep 5, 2017 at 8:06 PM, Peter Maydell <peter.maydell@linaro.org>
wrote:

> On 5 September 2017 at 18:56, Ramy Sameh <ramysameh26@gmail.com> wrote:
> > Are there any documentation or source of information, that can describe
> how
> > interrupts are implemented, and how to use them (where is the vector
> table
> > to put the ISR ... etc) ?
>
> The source code is it.
>
> Note that the pl011 is only a UART. It is used in a variety
> of different boards, which have different interrupt controllers,
> and with different CPUs. Things like ISR vector tables are
> generally part of the CPU or interrupt controller emulation.
>
> The pl011's part of this is simply to raise and lower its outbound IRQ line
> when the conditions are right -- this happens by calling qemu_set_irq()
> in pl011_update(). This corresponds to the hardware's UARTINTR line.
> In QEMU that IRQ line is connected up to an emulated interrupt controller
> which in turn is connected to an emulated CPU, just as in hardware
> the pl011 UARTINTR line is connected to a hardware interrupt controller
> and thus to a CPU.
>
> For information on how guest code should use a UART, how it should
> set up interrupts and so on, you should consult the documentation
> on how the hardware behaves.
>
> > In addition, any source of info that describes the code workflow when
> > reading or writing to the uart would be very helpful.
> > (because I put printfs in the functions to understand the workflow, but
> the
> > order of these printfs made me very confused).
> >
> > Regarding the registers, I have checked pl011_read and pl011_write, and
> > found them, thanks for that.
> > But I couldn't find the register "UARTICR" (Interrupt clear register)
> > I think this might be related to my lack of understanding of how
> interrupts
> > are implemented in emulated pl011.
>
> UARTICR is a write-only register, so it is handled only in
> pl011_write():
>
>     case 17: /* UARTICR */
>         s->int_level &= ~value;
>         pl011_update(s);
>         break;
>
> (It's write-1-to-clear, hence the &= ~.)
>
> > Regarding the ID registers, whose values are hard-wired in the board, and
> > there was no need to implement modifiable states for them.
> > Do you mean Peripheral identification registers, UARTPeriphID0-3 and
> > PrimeCell identification registers, UARTPCellID0-3 ?
>
> Yes. (See the pl011_id_arm[] array which has the values.)
>
> thanks
> -- PMM
>



-- 
Best Regards,
Ramy Sameh
Embedded Software Engineer
+2-010-172-777-14

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Ramy Sameh]

Hello Peter,

I have one more simple question please.

Do the emulated baud rate registers have any effect? (I think they would
have no effect, because there is no real clock that can be used to produce
the baud rate).


On Tue, Sep 5, 2017 at 8:50 PM, Ramy Sameh <ramysameh26@gmail.com> wrote:

> Thank you very much Peter.
>
> I will check the documentation for VersatilePB and ARM926EJ-S for more
> understanding of interrupts handling.
>
>
>
> On Tue, Sep 5, 2017 at 8:06 PM, Peter Maydell <peter.maydell@linaro.org>
> wrote:
>
>> On 5 September 2017 at 18:56, Ramy Sameh <ramysameh26@gmail.com> wrote:
>> > Are there any documentation or source of information, that can describe
>> how
>> > interrupts are implemented, and how to use them (where is the vector
>> table
>> > to put the ISR ... etc) ?
>>
>> The source code is it.
>>
>> Note that the pl011 is only a UART. It is used in a variety
>> of different boards, which have different interrupt controllers,
>> and with different CPUs. Things like ISR vector tables are
>> generally part of the CPU or interrupt controller emulation.
>>
>> The pl011's part of this is simply to raise and lower its outbound IRQ
>> line
>> when the conditions are right -- this happens by calling qemu_set_irq()
>> in pl011_update(). This corresponds to the hardware's UARTINTR line.
>> In QEMU that IRQ line is connected up to an emulated interrupt controller
>> which in turn is connected to an emulated CPU, just as in hardware
>> the pl011 UARTINTR line is connected to a hardware interrupt controller
>> and thus to a CPU.
>>
>> For information on how guest code should use a UART, how it should
>> set up interrupts and so on, you should consult the documentation
>> on how the hardware behaves.
>>
>> > In addition, any source of info that describes the code workflow when
>> > reading or writing to the uart would be very helpful.
>> > (because I put printfs in the functions to understand the workflow, but
>> the
>> > order of these printfs made me very confused).
>> >
>> > Regarding the registers, I have checked pl011_read and pl011_write, and
>> > found them, thanks for that.
>> > But I couldn't find the register "UARTICR" (Interrupt clear register)
>> > I think this might be related to my lack of understanding of how
>> interrupts
>> > are implemented in emulated pl011.
>>
>> UARTICR is a write-only register, so it is handled only in
>> pl011_write():
>>
>>     case 17: /* UARTICR */
>>         s->int_level &= ~value;
>>         pl011_update(s);
>>         break;
>>
>> (It's write-1-to-clear, hence the &= ~.)
>>
>> > Regarding the ID registers, whose values are hard-wired in the board,
>> and
>> > there was no need to implement modifiable states for them.
>> > Do you mean Peripheral identification registers, UARTPeriphID0-3 and
>> > PrimeCell identification registers, UARTPCellID0-3 ?
>>
>> Yes. (See the pl011_id_arm[] array which has the values.)
>>
>> thanks
>> -- PMM
>>
>
>
>
> --
> Best Regards,
> Ramy Sameh
> Embedded Software Engineer
> +2-010-172-777-14
>



-- 
Best Regards,
Ramy Sameh
Embedded Software Engineer
+2-010-172-777-14

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Peter Maydell]

On 6 September 2017 at 13:12, Ramy Sameh <ramysameh26@gmail.com> wrote:
> Do the emulated baud rate registers have any effect? (I think they would
> have no effect, because there is no real clock that can be used to produce
> the baud rate).

No, they don't have any effect. (In this UART model we don't implement
the feature that you can connect a guest serial port to a host serial
port and have the guest baud rate etc settings propagate through.
We do that in other UART models and maybe one day we'll add it here,
but for now, baud rate settings are ignored.)

thanks
-- PMM

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Ramy Sameh]

Thanks Peter.

I have made a program to read a string from the UART, then write it again
to the UART.
I made a function to manipulate values in the pl011 registers (bit flipping
the flags inside the registers).
The target is to simulate hardware fault injection.

For each run of the program, I made a bit-flip in *only one flag* in *one
register*, and I observed the output of the program.

*My question is*: where to invoke the call of this fault injection function
to cause *the maximum effect* on the program's output?

*p.s.* I invoked it once inside pl011_read function, and the program gave a
certain output, and I invoked it again in pl011_update, and it gave another
output.
When I invoked the function in pl011_write, the faults injected had no
effect on the output of the program!

Do you have an explanation for this behaviour?

Thanks in advance.


On Wed, Sep 6, 2017 at 2:18 PM, Peter Maydell <peter.maydell@linaro.org>
wrote:

> On 6 September 2017 at 13:12, Ramy Sameh <ramysameh26@gmail.com> wrote:
> > Do the emulated baud rate registers have any effect? (I think they would
> > have no effect, because there is no real clock that can be used to
> produce
> > the baud rate).
>
> No, they don't have any effect. (In this UART model we don't implement
> the feature that you can connect a guest serial port to a host serial
> port and have the guest baud rate etc settings propagate through.
> We do that in other UART models and maybe one day we'll add it here,
> but for now, baud rate settings are ignored.)
>
> thanks
> -- PMM
>



-- 
Best Regards,
Ramy Sameh
Embedded Software Engineer
+2-010-172-777-14

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Ramy Sameh]

Hello Peter,

Any suggestions regarding this topic ?

On Sun, Sep 10, 2017 at 8:33 PM, Ramy Sameh <ramysameh26@gmail.com> wrote:

> Thanks Peter.
>
> I have made a program to read a string from the UART, then write it again
> to the UART.
> I made a function to manipulate values in the pl011 registers (bit
> flipping the flags inside the registers).
> The target is to simulate hardware fault injection.
>
> For each run of the program, I made a bit-flip in *only one flag* in *one
> register*, and I observed the output of the program.
>
> *My question is*: where to invoke the call of this fault injection
> function to cause *the maximum effect* on the program's output?
>
> *p.s.* I invoked it once inside pl011_read function, and the program gave
> a certain output, and I invoked it again in pl011_update, and it gave
> another output.
> When I invoked the function in pl011_write, the faults injected had no
> effect on the output of the program!
>
> Do you have an explanation for this behaviour?
>
> Thanks in advance.
>
>
> On Wed, Sep 6, 2017 at 2:18 PM, Peter Maydell <peter.maydell@linaro.org>
> wrote:
>
>> On 6 September 2017 at 13:12, Ramy Sameh <ramysameh26@gmail.com> wrote:
>> > Do the emulated baud rate registers have any effect? (I think they would
>> > have no effect, because there is no real clock that can be used to
>> produce
>> > the baud rate).
>>
>> No, they don't have any effect. (In this UART model we don't implement
>> the feature that you can connect a guest serial port to a host serial
>> port and have the guest baud rate etc settings propagate through.
>> We do that in other UART models and maybe one day we'll add it here,
>> but for now, baud rate settings are ignored.)
>>
>> thanks
>> -- PMM
>>
>
>
>
> --
> Best Regards,
> Ramy Sameh
> Embedded Software Engineer
> +2-010-172-777-14
>



-- 
Best Regards,
Ramy Sameh
Embedded Software Engineer
+2-010-172-777-14

Re: [Qemu-devel] Questions regarding emulated UART in VersatilePB board

[Peter Maydell]

On 12 September 2017 at 08:49, Ramy Sameh <ramysameh26@gmail.com> wrote:
> Hello Peter,
>
> Any suggestions regarding this topic ?

No, I think at this point you're into the stuff that
you need to think about yourself, ie what exactly
you want fault injection to do.

PS: your emails would be easier to read if you followed
the usual convention of putting replies at the bottom
of or interspersed with the quoted text rather than the top.

thanks
-- PMM