All of lore.kernel.org
 help / color / mirror / Atom feed
* [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
@ 2018-07-15 22:06 Guenter Roeck
  2018-07-16  9:08 ` Peter Maydell
                   ` (2 more replies)
  0 siblings, 3 replies; 11+ messages in thread
From: Guenter Roeck @ 2018-07-15 22:06 UTC (permalink / raw)
  To: Peter Maydell; +Cc: qemu-arm, qemu-devel, Pekka Enberg, Guenter Roeck

Add basic support for BCM283x CPRMAN. Provide support for reading and
writing CPRMAN registers and initialize registers with sensible default
values. During runtime retain any written values.

Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
and raspi3 systems.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
---
I don't seriously expect this patch to get accepted, but I thought
it might be valuable enough for others to use it when playing with
raspi2 and raspi3 emulations.

 hw/arm/bcm2835_peripherals.c         |  15 +++++
 hw/misc/Makefile.objs                |   1 +
 hw/misc/bcm2835_cprman.c             | 126 +++++++++++++++++++++++++++++++++++
 include/hw/arm/bcm2835_peripherals.h |   2 +
 include/hw/arm/raspi_platform.h      |   1 +
 include/hw/misc/bcm2835_cprman.h     |  28 ++++++++
 6 files changed, 173 insertions(+)
 create mode 100644 hw/misc/bcm2835_cprman.c
 create mode 100644 include/hw/misc/bcm2835_cprman.h

diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index 6be7660..1a8993f 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -85,6 +85,11 @@ static void bcm2835_peripherals_init(Object *obj)
     object_property_add_const_link(OBJECT(&s->property), "dma-mr",
                                    OBJECT(&s->gpu_bus_mr), &error_abort);
 
+    /* Clock subsystem */
+    object_initialize(&s->cprman, sizeof(s->cprman), TYPE_BCM2835_CPRMAN);
+    object_property_add_child(obj, "cprman", OBJECT(&s->cprman), NULL);
+    qdev_set_parent_bus(DEVICE(&s->cprman), sysbus_get_default());
+
     /* Random Number Generator */
     object_initialize(&s->rng, sizeof(s->rng), TYPE_BCM2835_RNG);
     object_property_add_child(obj, "rng", OBJECT(&s->rng), NULL);
@@ -244,6 +249,13 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->property), 0,
                       qdev_get_gpio_in(DEVICE(&s->mboxes), MBOX_CHAN_PROPERTY));
 
+    /* Clock subsystem */
+    object_property_set_bool(OBJECT(&s->cprman), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
     /* Random Number Generator */
     object_property_set_bool(OBJECT(&s->rng), true, "realized", &err);
     if (err) {
@@ -251,6 +263,9 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    memory_region_add_subregion(&s->peri_mr, CPRMAN_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cprman), 0));
+
     memory_region_add_subregion(&s->peri_mr, RNG_OFFSET,
                 sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0));
 
diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index 9350900..ae5fc8a 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -52,6 +52,7 @@ obj-$(CONFIG_OMAP) += omap_tap.o
 obj-$(CONFIG_RASPI) += bcm2835_mbox.o
 obj-$(CONFIG_RASPI) += bcm2835_property.o
 obj-$(CONFIG_RASPI) += bcm2835_rng.o
+obj-$(CONFIG_RASPI) += bcm2835_cprman.o
 obj-$(CONFIG_SLAVIO) += slavio_misc.o
 obj-$(CONFIG_ZYNQ) += zynq_slcr.o
 obj-$(CONFIG_ZYNQ) += zynq-xadc.o
diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c
new file mode 100644
index 0000000..4051f2b
--- /dev/null
+++ b/hw/misc/bcm2835_cprman.c
@@ -0,0 +1,126 @@
+/*
+ * BCM2835 Clock subsystem (poor man's version)
+ *
+ * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "crypto/random.h"
+#include "hw/misc/bcm2835_cprman.h"
+
+static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
+                                 unsigned size)
+{
+    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
+    uint32_t res = 0;
+
+    assert(size == 4);
+
+    if (offset / 4 < CPRMAN_NUM_REGS) {
+        res = s->regs[offset / 4];
+    }
+
+    return res;
+}
+
+#define CM_PASSWORD             0x5a000000
+#define CM_PASSWORD_MASK        0xff000000
+
+static void bcm2835_cprman_write(void *opaque, hwaddr offset,
+                              uint64_t value, unsigned size)
+{
+    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
+
+    assert(size == 4);
+
+    if ((value & 0xff000000) == CM_PASSWORD &&
+        offset / 4 < CPRMAN_NUM_REGS)
+            s->regs[offset / 4] = value & ~CM_PASSWORD_MASK;
+}
+
+static const MemoryRegionOps bcm2835_cprman_ops = {
+    .read = bcm2835_cprman_read,
+    .write = bcm2835_cprman_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const VMStateDescription vmstate_bcm2835_cprman = {
+    .name = TYPE_BCM2835_CPRMAN,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, BCM2835CprmanState, CPRMAN_NUM_REGS),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_cprman_init(Object *obj)
+{
+    BCM2835CprmanState *s = BCM2835_CPRMAN(obj);
+
+    memory_region_init_io(&s->iomem, obj, &bcm2835_cprman_ops, s,
+                          TYPE_BCM2835_CPRMAN, 0x2000);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+#define CM_GNRICCTL        (0x000 / 4)
+#define CM_VECCTL        (0x0f8 / 4)
+#define CM_DFTCTL        (0x168 / 4)
+#define CM_EMMCCTL        (0x1c0 / 4)
+#define A2W_PLLA_CTRL        (0x1100 / 4)
+#define A2W_PLLB_CTRL        (0x11e0 / 4)
+
+static void bcm2835_cprman_reset(DeviceState *dev)
+{
+    BCM2835CprmanState *s = BCM2835_CPRMAN(dev);
+    int i;
+
+    /*
+     * Available information suggests that CPRMAN registers have default
+     * values which are not overwritten by ROMMON (u-boot). The hardware
+     * default values are unknown at this time.
+     * The default values selected here are necessary and sufficient
+     * to boot Linux directly (on raspi2 and raspi3). The selected
+     * values enable all clocks and set clock rates to match their
+     * parent rates.
+     */
+    for (i = CM_GNRICCTL; i <= CM_VECCTL; i += 2) {
+        s->regs[i] = 0x11;
+        s->regs[i + 1] = 0x1000;
+    }
+    for (i = CM_DFTCTL; i <= CM_EMMCCTL; i += 2) {
+        s->regs[i] = 0x11;
+        s->regs[i + 1] = 0x1000;
+    }
+    for (i = A2W_PLLA_CTRL; i <= A2W_PLLB_CTRL; i += 8) {
+        s->regs[i] = 0x10001;
+    }
+}
+
+static void bcm2835_cprman_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = bcm2835_cprman_reset;
+    dc->vmsd = &vmstate_bcm2835_cprman;
+}
+
+static TypeInfo bcm2835_cprman_info = {
+    .name          = TYPE_BCM2835_CPRMAN,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835CprmanState),
+    .class_init    = bcm2835_cprman_class_init,
+    .instance_init = bcm2835_cprman_init,
+};
+
+static void bcm2835_cprman_register_types(void)
+{
+    type_register_static(&bcm2835_cprman_info);
+}
+
+type_init(bcm2835_cprman_register_types)
diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index f5b193f..f9f53e3 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -19,6 +19,7 @@
 #include "hw/intc/bcm2835_ic.h"
 #include "hw/misc/bcm2835_property.h"
 #include "hw/misc/bcm2835_rng.h"
+#include "hw/misc/bcm2835_cprman.h"
 #include "hw/misc/bcm2835_mbox.h"
 #include "hw/sd/sdhci.h"
 #include "hw/sd/bcm2835_sdhost.h"
@@ -44,6 +45,7 @@ typedef struct BCM2835PeripheralState {
     BCM2835ICState ic;
     BCM2835PropertyState property;
     BCM2835RngState rng;
+    BCM2835CprmanState cprman;
     BCM2835MboxState mboxes;
     SDHCIState sdhci;
     BCM2835SDHostState sdhost;
diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
index 6467e88..412d010 100644
--- a/include/hw/arm/raspi_platform.h
+++ b/include/hw/arm/raspi_platform.h
@@ -36,6 +36,7 @@
                                                       * Doorbells & Mailboxes */
 #define PM_OFFSET               0x100000 /* Power Management, Reset controller
                                           * and Watchdog registers */
+#define CPRMAN_OFFSET           0x101000
 #define PCM_CLOCK_OFFSET        0x101098
 #define RNG_OFFSET              0x104000
 #define GPIO_OFFSET             0x200000
diff --git a/include/hw/misc/bcm2835_cprman.h b/include/hw/misc/bcm2835_cprman.h
new file mode 100644
index 0000000..db250b3
--- /dev/null
+++ b/include/hw/misc/bcm2835_cprman.h
@@ -0,0 +1,28 @@
+/*
+ * BCM2835 Poor-man's version of CPRMAN
+ *
+ * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef BCM2835_CPRMAN_H
+#define BCM2835_CPRMAN_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_BCM2835_CPRMAN "bcm2835-cprman"
+#define BCM2835_CPRMAN(obj) \
+        OBJECT_CHECK(BCM2835CprmanState, (obj), TYPE_BCM2835_CPRMAN)
+
+#define CPRMAN_NUM_REGS         (0x1200 / 4)
+
+typedef struct {
+    SysBusDevice busdev;
+    MemoryRegion iomem;
+
+    uint32_t regs[CPRMAN_NUM_REGS];
+} BCM2835CprmanState;
+
+#endif
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-15 22:06 [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem) Guenter Roeck
@ 2018-07-16  9:08 ` Peter Maydell
  2018-07-16 13:51   ` Guenter Roeck
  2018-07-16 14:33 ` Peter Maydell
  2018-07-17  1:53 ` [Qemu-devel] [Qemu-arm] " Philippe Mathieu-Daudé
  2 siblings, 1 reply; 11+ messages in thread
From: Peter Maydell @ 2018-07-16  9:08 UTC (permalink / raw)
  To: Guenter Roeck; +Cc: qemu-arm, QEMU Developers, Pekka Enberg

On 15 July 2018 at 23:06, Guenter Roeck <linux@roeck-us.net> wrote:
> Add basic support for BCM283x CPRMAN. Provide support for reading and
> writing CPRMAN registers and initialize registers with sensible default
> values. During runtime retain any written values.
>
> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
> and raspi3 systems.

I can boot Linux on raspi3 with current upstream's level
of cprman support:
https://translatedcode.wordpress.com/2018/04/25/debian-on-qemus-raspberry-pi-3-model/

> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> I don't seriously expect this patch to get accepted, but I thought
> it might be valuable enough for others to use it when playing with
> raspi2 and raspi3 emulations.

I'm not necessarily going to rule it out entirely, but I'm
definitely not very happy about having a model of hardware
that's very clearly "do something that Linux likes". I'd
really rather see hardware documentation here -- presumably
whoever is writing the Linux drivers has that?

thanks
-- PMM

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-16  9:08 ` Peter Maydell
@ 2018-07-16 13:51   ` Guenter Roeck
  2018-07-16 14:07     ` Peter Maydell
  0 siblings, 1 reply; 11+ messages in thread
From: Guenter Roeck @ 2018-07-16 13:51 UTC (permalink / raw)
  To: Peter Maydell; +Cc: qemu-arm, QEMU Developers, Pekka Enberg

On 07/16/2018 02:08 AM, Peter Maydell wrote:
> On 15 July 2018 at 23:06, Guenter Roeck <linux@roeck-us.net> wrote:
>> Add basic support for BCM283x CPRMAN. Provide support for reading and
>> writing CPRMAN registers and initialize registers with sensible default
>> values. During runtime retain any written values.
>>
>> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
>> and raspi3 systems.
> 
> I can boot Linux on raspi3 with current upstream's level
> of cprman support:
> https://translatedcode.wordpress.com/2018/04/25/debian-on-qemus-raspberry-pi-3-model/

Yes, as long as you use ttyAMA0 as console. Using ttyS1, which is the real console
on raspi3, doesn't work. It doesn't give tracebacks, but it reports

[    8.894257] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    8.973121] bcm2835-aux-uart 3f215040.serial: unable to register 8250 port - -22
[    8.981971] bcm2835-aux-uart: probe of 3f215040.serial failed with error -22

and then there is no console. I have to hack the bcm8250 driver to provide
a dummy clock to get it to work.

> 
>> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
>> ---
>> I don't seriously expect this patch to get accepted, but I thought
>> it might be valuable enough for others to use it when playing with
>> raspi2 and raspi3 emulations.
> 
> I'm not necessarily going to rule it out entirely, but I'm
> definitely not very happy about having a model of hardware
> that's very clearly "do something that Linux likes". I'd
> really rather see hardware documentation here -- presumably
> whoever is writing the Linux drivers has that?
> 

Maybe, but I don't, and I was unable to find it. The published documentation
only lists information for some of the registers (for the general purpose
clocks).

In this context, I can't get mmc to work with ToT Linux on raspi3.

/ # mount /dev/mmcblk0 /mnt
[   47.099074] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware interrupt.
[   57.339803] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware interrupt.
[   57.390449] mmc0: Problem switching card into high-speed mode!
[   67.581559] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware interrupt.
[   67.587832] print_req_error: I/O error, dev mmcblk0, sector 2
[   67.588908] Buffer I/O error on dev mmcblk0, logical block 1, lost sync page write
[   67.610307] EXT4-fs (mmcblk0): I/O error while writing superblock
[   67.620842] EXT4-fs (mmcblk0): mount failed
[   77.819114] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware interrupt.
[   88.058917] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware interrupt.
[   98.298937] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware interrupt.
[   98.303554] print_req_error: I/O error, dev mmcblk0, sector 2
[   98.306044] Buffer I/O error on dev mmcblk0, logical block 1, lost sync page write

Any idea what the problem might be ?

Thanks,
Guenter

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-16 13:51   ` Guenter Roeck
@ 2018-07-16 14:07     ` Peter Maydell
  2018-07-16 22:22       ` Guenter Roeck
  0 siblings, 1 reply; 11+ messages in thread
From: Peter Maydell @ 2018-07-16 14:07 UTC (permalink / raw)
  To: Guenter Roeck; +Cc: qemu-arm, QEMU Developers, Pekka Enberg

On 16 July 2018 at 14:51, Guenter Roeck <linux@roeck-us.net> wrote:
> In this context, I can't get mmc to work with ToT Linux on raspi3.
>
> / # mount /dev/mmcblk0 /mnt
> [   47.099074] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> interrupt.
> [   57.339803] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> interrupt.
> [   57.390449] mmc0: Problem switching card into high-speed mode!
> [   67.581559] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> interrupt.
> [   67.587832] print_req_error: I/O error, dev mmcblk0, sector 2
> [   67.588908] Buffer I/O error on dev mmcblk0, logical block 1, lost sync
> page write
> [   67.610307] EXT4-fs (mmcblk0): I/O error while writing superblock
> [   67.620842] EXT4-fs (mmcblk0): mount failed
> [   77.819114] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> interrupt.
> [   88.058917] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> interrupt.
> [   98.298937] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> interrupt.
> [   98.303554] print_req_error: I/O error, dev mmcblk0, sector 2
> [   98.306044] Buffer I/O error on dev mmcblk0, logical block 1, lost sync
> page write
>
> Any idea what the problem might be ?

Same thing again -- no hardware documentation for that sd controller.
We took our best guess about what the behaviour is supposed to be
for raising hardware interrupts in commit f3d9fe8f959643 earlier
this year, but that was (as the commit message notes) pure guesswork
based largely on what the Linux driver was doing. Somebody would have
to look at what exactly this version of the kernel is expecting the
hardware to do and try to reverse-engineer what the model needs to do
that it isn't currently...

thanks
-- PMM

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-15 22:06 [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem) Guenter Roeck
  2018-07-16  9:08 ` Peter Maydell
@ 2018-07-16 14:33 ` Peter Maydell
  2018-07-16 16:14   ` Guenter Roeck
  2018-07-17  1:53 ` [Qemu-devel] [Qemu-arm] " Philippe Mathieu-Daudé
  2 siblings, 1 reply; 11+ messages in thread
From: Peter Maydell @ 2018-07-16 14:33 UTC (permalink / raw)
  To: Guenter Roeck; +Cc: qemu-arm, QEMU Developers, Pekka Enberg

On 15 July 2018 at 23:06, Guenter Roeck <linux@roeck-us.net> wrote:
> Add basic support for BCM283x CPRMAN. Provide support for reading and
> writing CPRMAN registers and initialize registers with sensible default
> values. During runtime retain any written values.
>
> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
> and raspi3 systems.
>
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> I don't seriously expect this patch to get accepted, but I thought
> it might be valuable enough for others to use it when playing with
> raspi2 and raspi3 emulations.

Looking around I guess that a stub version of this device is
worth having. It's not like we'd be wiring up the clock control
information to anything anyway, given that QEMU doesn't much
care about clocks...

> +#define CM_GNRICCTL        (0x000 / 4)
> +#define CM_VECCTL        (0x0f8 / 4)
> +#define CM_DFTCTL        (0x168 / 4)
> +#define CM_EMMCCTL        (0x1c0 / 4)
> +#define A2W_PLLA_CTRL        (0x1100 / 4)
> +#define A2W_PLLB_CTRL        (0x11e0 / 4)

The information at https://elinux.org/BCM2835_registers#CM
and https://elinux.org/BCM2835_registers#A2W
suggests that the A2W is a separate thing from the CPRMAN...

> +static void bcm2835_cprman_reset(DeviceState *dev)
> +{
> +    BCM2835CprmanState *s = BCM2835_CPRMAN(dev);
> +    int i;
> +
> +    /*
> +     * Available information suggests that CPRMAN registers have default
> +     * values which are not overwritten by ROMMON (u-boot). The hardware
> +     * default values are unknown at this time.
> +     * The default values selected here are necessary and sufficient
> +     * to boot Linux directly (on raspi2 and raspi3). The selected
> +     * values enable all clocks and set clock rates to match their
> +     * parent rates.
> +     */
> +    for (i = CM_GNRICCTL; i <= CM_VECCTL; i += 2) {
> +        s->regs[i] = 0x11;
> +        s->regs[i + 1] = 0x1000;
> +    }
> +    for (i = CM_DFTCTL; i <= CM_EMMCCTL; i += 2) {
> +        s->regs[i] = 0x11;
> +        s->regs[i + 1] = 0x1000;
> +    }

If you believe the register lists from the links above this
loop will set CM_PLLB, which is an exception from the
pairs of CM_FOOCTL/CM_FOODIV) registers in this range.
There are also a few CTL/DIV register pairs in the gap
between CM_VECCTL and CM_EMMCCTL.

> +    for (i = A2W_PLLA_CTRL; i <= A2W_PLLB_CTRL; i += 8) {
> +        s->regs[i] = 0x10001;
> +    }
> +}

thanks
-- PMM

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-16 14:33 ` Peter Maydell
@ 2018-07-16 16:14   ` Guenter Roeck
  0 siblings, 0 replies; 11+ messages in thread
From: Guenter Roeck @ 2018-07-16 16:14 UTC (permalink / raw)
  To: Peter Maydell; +Cc: qemu-arm, QEMU Developers, Pekka Enberg

On Mon, Jul 16, 2018 at 03:33:15PM +0100, Peter Maydell wrote:
> On 15 July 2018 at 23:06, Guenter Roeck <linux@roeck-us.net> wrote:
> > Add basic support for BCM283x CPRMAN. Provide support for reading and
> > writing CPRMAN registers and initialize registers with sensible default
> > values. During runtime retain any written values.
> >
> > Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
> > and raspi3 systems.
> >
> > Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> > ---
> > I don't seriously expect this patch to get accepted, but I thought
> > it might be valuable enough for others to use it when playing with
> > raspi2 and raspi3 emulations.
> 
> Looking around I guess that a stub version of this device is
> worth having. It's not like we'd be wiring up the clock control
> information to anything anyway, given that QEMU doesn't much
> care about clocks...
> 
> > +#define CM_GNRICCTL        (0x000 / 4)
> > +#define CM_VECCTL        (0x0f8 / 4)
> > +#define CM_DFTCTL        (0x168 / 4)
> > +#define CM_EMMCCTL        (0x1c0 / 4)
> > +#define A2W_PLLA_CTRL        (0x1100 / 4)
> > +#define A2W_PLLB_CTRL        (0x11e0 / 4)
> 
> The information at https://elinux.org/BCM2835_registers#CM
> and https://elinux.org/BCM2835_registers#A2W
> suggests that the A2W is a separate thing from the CPRMAN...
>

Both are used together to define individual clocks in the Linux clock
driver (each clock has a CM register and a matching A2W register), so
they must be associated to each other. It might or might not make sense
to treat them as separate devices in qemu. Hard to say without datasheet.

> > +static void bcm2835_cprman_reset(DeviceState *dev)
> > +{
> > +    BCM2835CprmanState *s = BCM2835_CPRMAN(dev);
> > +    int i;
> > +
> > +    /*
> > +     * Available information suggests that CPRMAN registers have default
> > +     * values which are not overwritten by ROMMON (u-boot). The hardware
> > +     * default values are unknown at this time.
> > +     * The default values selected here are necessary and sufficient
> > +     * to boot Linux directly (on raspi2 and raspi3). The selected
> > +     * values enable all clocks and set clock rates to match their
> > +     * parent rates.
> > +     */
> > +    for (i = CM_GNRICCTL; i <= CM_VECCTL; i += 2) {
> > +        s->regs[i] = 0x11;
> > +        s->regs[i + 1] = 0x1000;
> > +    }
> > +    for (i = CM_DFTCTL; i <= CM_EMMCCTL; i += 2) {
> > +        s->regs[i] = 0x11;
> > +        s->regs[i + 1] = 0x1000;
> > +    }
> 
> If you believe the register lists from the links above this
> loop will set CM_PLLB, which is an exception from the
> pairs of CM_FOOCTL/CM_FOODIV) registers in this range.
> There are also a few CTL/DIV register pairs in the gap
> between CM_VECCTL and CM_EMMCCTL.
> 
Good point. I'll fix that up.

Overall it would be great to get a register dump from someone
with real hardware. I don't really like my guesswork too much.

Thanks,
Guenter

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-16 14:07     ` Peter Maydell
@ 2018-07-16 22:22       ` Guenter Roeck
  0 siblings, 0 replies; 11+ messages in thread
From: Guenter Roeck @ 2018-07-16 22:22 UTC (permalink / raw)
  To: Peter Maydell; +Cc: qemu-arm, QEMU Developers, Pekka Enberg

On Mon, Jul 16, 2018 at 03:07:13PM +0100, Peter Maydell wrote:
> On 16 July 2018 at 14:51, Guenter Roeck <linux@roeck-us.net> wrote:
> > In this context, I can't get mmc to work with ToT Linux on raspi3.
> >
> > / # mount /dev/mmcblk0 /mnt
> > [   47.099074] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> > interrupt.
> > [   57.339803] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> > interrupt.
> > [   57.390449] mmc0: Problem switching card into high-speed mode!
> > [   67.581559] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> > interrupt.
> > [   67.587832] print_req_error: I/O error, dev mmcblk0, sector 2
> > [   67.588908] Buffer I/O error on dev mmcblk0, logical block 1, lost sync
> > page write
> > [   67.610307] EXT4-fs (mmcblk0): I/O error while writing superblock
> > [   67.620842] EXT4-fs (mmcblk0): mount failed
> > [   77.819114] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> > interrupt.
> > [   88.058917] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> > interrupt.
> > [   98.298937] sdhost-bcm2835 3f202000.mmc: timeout waiting for hardware
> > interrupt.
> > [   98.303554] print_req_error: I/O error, dev mmcblk0, sector 2
> > [   98.306044] Buffer I/O error on dev mmcblk0, logical block 1, lost sync
> > page write
> >
> > Any idea what the problem might be ?
> 
> Same thing again -- no hardware documentation for that sd controller.
> We took our best guess about what the behaviour is supposed to be
> for raising hardware interrupts in commit f3d9fe8f959643 earlier
> this year, but that was (as the commit message notes) pure guesswork
> based largely on what the Linux driver was doing. Somebody would have
> to look at what exactly this version of the kernel is expecting the
> hardware to do and try to reverse-engineer what the model needs to do
> that it isn't currently...
> 

This failed for me with all kernel versions I tried, starting with 4.14.y.

I'll send a patch in a minute. It is just as much guesswork as before,
but AFAICS it does work.

Guenter

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [Qemu-arm] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-15 22:06 [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem) Guenter Roeck
  2018-07-16  9:08 ` Peter Maydell
  2018-07-16 14:33 ` Peter Maydell
@ 2018-07-17  1:53 ` Philippe Mathieu-Daudé
  2018-07-17  4:07   ` Guenter Roeck
  2 siblings, 1 reply; 11+ messages in thread
From: Philippe Mathieu-Daudé @ 2018-07-17  1:53 UTC (permalink / raw)
  To: Guenter Roeck, Peter Maydell
  Cc: qemu-arm, qemu-devel, Pekka Enberg, Clement Deschamps, Luc Michel

Hi Guenter,

On 07/15/2018 07:06 PM, Guenter Roeck wrote:
> Add basic support for BCM283x CPRMAN. Provide support for reading and
> writing CPRMAN registers and initialize registers with sensible default
> values. During runtime retain any written values.
> 
> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
> and raspi3 systems.
> 
> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> ---
> I don't seriously expect this patch to get accepted, but I thought
> it might be valuable enough for others to use it when playing with
> raspi2 and raspi3 emulations.

I've been working on a very similar patch... But due to soft-freeze I
postponed it.

I don't feel very confident with my local work, as you, it is based on
looking at the Broadcom firmware [1] and how the Linux kernel initialize
the devices. I'll however compare with your work.

[1]: https://github.com/raspberrypi/firmware/tree/master/boot

> 
>  hw/arm/bcm2835_peripherals.c         |  15 +++++
>  hw/misc/Makefile.objs                |   1 +
>  hw/misc/bcm2835_cprman.c             | 126 +++++++++++++++++++++++++++++++++++
>  include/hw/arm/bcm2835_peripherals.h |   2 +
>  include/hw/arm/raspi_platform.h      |   1 +
>  include/hw/misc/bcm2835_cprman.h     |  28 ++++++++
>  6 files changed, 173 insertions(+)
>  create mode 100644 hw/misc/bcm2835_cprman.c
>  create mode 100644 include/hw/misc/bcm2835_cprman.h
> 
> diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
> index 6be7660..1a8993f 100644
> --- a/hw/arm/bcm2835_peripherals.c
> +++ b/hw/arm/bcm2835_peripherals.c
> @@ -85,6 +85,11 @@ static void bcm2835_peripherals_init(Object *obj)
>      object_property_add_const_link(OBJECT(&s->property), "dma-mr",
>                                     OBJECT(&s->gpu_bus_mr), &error_abort);
>  
> +    /* Clock subsystem */
> +    object_initialize(&s->cprman, sizeof(s->cprman), TYPE_BCM2835_CPRMAN);
> +    object_property_add_child(obj, "cprman", OBJECT(&s->cprman), NULL);
> +    qdev_set_parent_bus(DEVICE(&s->cprman), sysbus_get_default());
> +
>      /* Random Number Generator */
>      object_initialize(&s->rng, sizeof(s->rng), TYPE_BCM2835_RNG);
>      object_property_add_child(obj, "rng", OBJECT(&s->rng), NULL);
> @@ -244,6 +249,13 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>      sysbus_connect_irq(SYS_BUS_DEVICE(&s->property), 0,
>                        qdev_get_gpio_in(DEVICE(&s->mboxes), MBOX_CHAN_PROPERTY));
>  
> +    /* Clock subsystem */
> +    object_property_set_bool(OBJECT(&s->cprman), true, "realized", &err);
> +    if (err) {
> +        error_propagate(errp, err);
> +        return;
> +    }
> +
>      /* Random Number Generator */
>      object_property_set_bool(OBJECT(&s->rng), true, "realized", &err);
>      if (err) {
> @@ -251,6 +263,9 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>          return;
>      }
>  
> +    memory_region_add_subregion(&s->peri_mr, CPRMAN_OFFSET,
> +                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cprman), 0));
> +
>      memory_region_add_subregion(&s->peri_mr, RNG_OFFSET,
>                  sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0));
>  
> diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
> index 9350900..ae5fc8a 100644
> --- a/hw/misc/Makefile.objs
> +++ b/hw/misc/Makefile.objs
> @@ -52,6 +52,7 @@ obj-$(CONFIG_OMAP) += omap_tap.o
>  obj-$(CONFIG_RASPI) += bcm2835_mbox.o
>  obj-$(CONFIG_RASPI) += bcm2835_property.o
>  obj-$(CONFIG_RASPI) += bcm2835_rng.o
> +obj-$(CONFIG_RASPI) += bcm2835_cprman.o
>  obj-$(CONFIG_SLAVIO) += slavio_misc.o
>  obj-$(CONFIG_ZYNQ) += zynq_slcr.o
>  obj-$(CONFIG_ZYNQ) += zynq-xadc.o
> diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c
> new file mode 100644
> index 0000000..4051f2b
> --- /dev/null
> +++ b/hw/misc/bcm2835_cprman.c
> @@ -0,0 +1,126 @@
> +/*
> + * BCM2835 Clock subsystem (poor man's version)
> + *
> + * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> + * See the COPYING file in the top-level directory.
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qemu/log.h"
> +#include "qapi/error.h"
> +#include "crypto/random.h"
> +#include "hw/misc/bcm2835_cprman.h"
> +
> +static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
> +                                 unsigned size)
> +{
> +    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
> +    uint32_t res = 0;
> +
> +    assert(size == 4);
> +
> +    if (offset / 4 < CPRMAN_NUM_REGS) {
> +        res = s->regs[offset / 4];
> +    }
> +
> +    return res;
> +}

Yes, this read() works.

A bit more verbose:

static const char *names[64] = {
    [0] = "GNRIC",
    [1] = "VPU",
    [2] = "SYS",
    [3] = "PERIA",
    [4] = "PERII",
    [5] = "H264",
    [6] = "ISP",
    [7] = "V3D",
    [8] = "CAM0",
    [9] = "CAM1",
    [10] = "CCP2",
    [11] = "DSI0E",
    [12] = "DSI0P",
    [13] = "DPI",
    [14] = "GP0",
    [15] = "GP1",
    [16] = "GP2",
    [17] = "HSM",
    [18] = "OTP",
    [19] = "PCM",
    [20] = "PWM",
    [21] = "SLIM",
    [22] = "SMI",
    [24] = "TCNT",
    [25] = "TEC",
    [26] = "TD0",
    [27] = "TD1",
    [28] = "TSENS",
    [29] = "TIMER",
    [30] = "UART",
    [31] = "VEC",
    [50] = "PULSE",
    [53] = "SDC",
    [54] = "ARM",
    [55] = "AVEO",
    [56] = "EMMC",
};

static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
                                    unsigned size)
{
    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
    int idx = addr / 8;
    bool div = addr % 8;
    const char *name = names[idx] ? names[idx] : "UNKN";
    uint64_t value = s->regs[addr >> 2];

    switch (addr) {
    case 0 ... 0x100:
        qemu_log_mask(LOG_UNIMP, "[CM]: %s unimp r%02d  0x%04"
HWADDR_PRIx " = 0x%"PRIx64 " (%s)\n",
                      div ? "DIV" : "CTL", size << 3, addr, value, name);
        break;
    case 0x104 ... 0x114:
        qemu_log_mask(LOG_UNIMP, "[CM]: PLL? unimp r%02d  0x%04"
HWADDR_PRIx " = 0x%"PRIx64 "\n",
                      size << 3, addr, value);
        value = -1; /* FIXME PLL lock? */
        break;
    }
    return value;
}

> +
> +#define CM_PASSWORD             0x5a000000
> +#define CM_PASSWORD_MASK        0xff000000
> +
> +static void bcm2835_cprman_write(void *opaque, hwaddr offset,
> +                              uint64_t value, unsigned size)
> +{
> +    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
> +
> +    assert(size == 4);

Instead of this assert() ...

> +
> +    if ((value & 0xff000000) == CM_PASSWORD &&
> +        offset / 4 < CPRMAN_NUM_REGS)
> +            s->regs[offset / 4] = value & ~CM_PASSWORD_MASK;
> +}
> +
> +static const MemoryRegionOps bcm2835_cprman_ops = {
> +    .read = bcm2835_cprman_read,
> +    .write = bcm2835_cprman_write,

... I used:

       .impl.min_access_size = 4,
       .valid.min_access_size = 4,

> +    .endianness = DEVICE_NATIVE_ENDIAN,
> +};

Same verbose write():

static void bcm2835_cprman_write(void *opaque, hwaddr offset,
                                 uint64_t value, unsigned size)
{
    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
    int idx = addr / 8;
    bool div = addr % 8;
    const char *name = names[idx] ? names[idx] : "UNKN";

    if (extract64(value, 24, 8) != CM_KEY) {
        qemu_log_mask(LOG_GUEST_ERROR, "[CM]: %s error w%02d *0x%04"
HWADDR_PRIx " = 0x%" PRIx64 " (%s)\n",
                      div ? "DIV" : "CTL", size << 3, addr, value, name);
        return;
    }
    s->regs[addr >> 2] = extract64(value, 0, 24);
    switch (addr) {
    case 0 ... 0x100:
        if (div) {
            qemu_log_mask(LOG_UNIMP, "[CM]: DIV unimp w%02d *0x%04"
HWADDR_PRIx " = 0x%" PRIx64 " (%s) %" PRIu64 ".%" PRIu64 "\n",
                          size << 3, addr, value, name, extract64(value,
12, 12), 1000 * extract64(value, 0, 12) / 1024);
        } else {
            qemu_log_mask(LOG_UNIMP, "[CM]: CTL unimp w%02d *0x%04"
HWADDR_PRIx " = 0x%" PRIx64 " (%s) src=%" PRIu64 " ena:%u\n",
                          size << 3, addr, value, name, value & 0xf,
!!(value & (1 << 4)));
        }
        break;
    case 0x104 ... 0x114:
        qemu_log_mask(LOG_UNIMP, "[CM]: PLL? unimp w%02d *0x%04"
HWADDR_PRIx " = 0x%" PRIx64 "\n",
                      size << 3, addr, value);
        break;
    }
}

> +
> +static const VMStateDescription vmstate_bcm2835_cprman = {
> +    .name = TYPE_BCM2835_CPRMAN,
> +    .version_id = 1,
> +    .minimum_version_id = 1,
> +    .fields = (VMStateField[]) {
> +        VMSTATE_UINT32_ARRAY(regs, BCM2835CprmanState, CPRMAN_NUM_REGS),
> +        VMSTATE_END_OF_LIST()
> +    }
> +};
> +
> +static void bcm2835_cprman_init(Object *obj)
> +{
> +    BCM2835CprmanState *s = BCM2835_CPRMAN(obj);
> +
> +    memory_region_init_io(&s->iomem, obj, &bcm2835_cprman_ops, s,
> +                          TYPE_BCM2835_CPRMAN, 0x2000);
> +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
> +}
> +
> +#define CM_GNRICCTL        (0x000 / 4)
> +#define CM_VECCTL        (0x0f8 / 4)
> +#define CM_DFTCTL        (0x168 / 4)
> +#define CM_EMMCCTL        (0x1c0 / 4)

> +#define A2W_PLLA_CTRL        (0x1100 / 4)
> +#define A2W_PLLB_CTRL        (0x11e0 / 4)

The A2W is another device you don't need to worry about, just use add a
0x1000 UNIMP device.

> +
> +static void bcm2835_cprman_reset(DeviceState *dev)
> +{
> +    BCM2835CprmanState *s = BCM2835_CPRMAN(dev);
> +    int i;
> +
> +    /*
> +     * Available information suggests that CPRMAN registers have default
> +     * values which are not overwritten by ROMMON (u-boot). The hardware
> +     * default values are unknown at this time.
> +     * The default values selected here are necessary and sufficient
> +     * to boot Linux directly (on raspi2 and raspi3). The selected
> +     * values enable all clocks and set clock rates to match their
> +     * parent rates.
> +     */

Lucky you...

> +    for (i = CM_GNRICCTL; i <= CM_VECCTL; i += 2) {
> +        s->regs[i] = 0x11;
> +        s->regs[i + 1] = 0x1000;
> +    }
> +    for (i = CM_DFTCTL; i <= CM_EMMCCTL; i += 2) {
> +        s->regs[i] = 0x11;
> +        s->regs[i + 1] = 0x1000;
> +    }
> +    for (i = A2W_PLLA_CTRL; i <= A2W_PLLB_CTRL; i += 8) {
> +        s->regs[i] = 0x10001;
> +    }
> +}

... I remember having headaches with this CRAP reset():

static void bcm2836_enable_clk(BCM2835ClockState *s, int clk_id, int
clk_src, int div_int, int div_frac)
{
    s->regs[2 * clk_id + 0] = (/* MASH */1 << 9) | (1 << 4) | (clk_src
<< 0);
    s->regs[2 * clk_id + 1] = (div_int << 12) | (div_frac << 0);
}

static void bcm2836_cm_reset(DeviceState *d)
{
    BCM2835ClockState *s = BCM2835_CLOCK(d);

    int osc_freq_hz = 2400000; /* TODO property */
    int baudrate = 115200; /* TODO property */
    int vpu_fracbits = 12; /* TODO property */
    div_t qi = div(osc_freq_hz, baudrate);
    div_t qf = div(qi.rem << vpu_fracbits, baudrate);

    bcm2836_enable_clk(s, 1 /* VPU */, 1 /* OSC */, qi.quot, qf.quot);
    bcm2836_enable_clk(s, 1 /* VPU */, 1 /* OSC */, 1, 0);
}

I can't say it is correct until I reopen this branch (September?).

> +
> +static void bcm2835_cprman_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +
> +    dc->reset = bcm2835_cprman_reset;
> +    dc->vmsd = &vmstate_bcm2835_cprman;
> +}
> +
> +static TypeInfo bcm2835_cprman_info = {
> +    .name          = TYPE_BCM2835_CPRMAN,
> +    .parent        = TYPE_SYS_BUS_DEVICE,
> +    .instance_size = sizeof(BCM2835CprmanState),
> +    .class_init    = bcm2835_cprman_class_init,
> +    .instance_init = bcm2835_cprman_init,
> +};
> +
> +static void bcm2835_cprman_register_types(void)
> +{
> +    type_register_static(&bcm2835_cprman_info);
> +}
> +
> +type_init(bcm2835_cprman_register_types)
> diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
> index f5b193f..f9f53e3 100644
> --- a/include/hw/arm/bcm2835_peripherals.h
> +++ b/include/hw/arm/bcm2835_peripherals.h
> @@ -19,6 +19,7 @@
>  #include "hw/intc/bcm2835_ic.h"
>  #include "hw/misc/bcm2835_property.h"
>  #include "hw/misc/bcm2835_rng.h"
> +#include "hw/misc/bcm2835_cprman.h"
>  #include "hw/misc/bcm2835_mbox.h"
>  #include "hw/sd/sdhci.h"
>  #include "hw/sd/bcm2835_sdhost.h"
> @@ -44,6 +45,7 @@ typedef struct BCM2835PeripheralState {
>      BCM2835ICState ic;
>      BCM2835PropertyState property;
>      BCM2835RngState rng;
> +    BCM2835CprmanState cprman;
>      BCM2835MboxState mboxes;
>      SDHCIState sdhci;
>      BCM2835SDHostState sdhost;
> diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
> index 6467e88..412d010 100644
> --- a/include/hw/arm/raspi_platform.h
> +++ b/include/hw/arm/raspi_platform.h
> @@ -36,6 +36,7 @@
>                                                        * Doorbells & Mailboxes */
>  #define PM_OFFSET               0x100000 /* Power Management, Reset controller
>                                            * and Watchdog registers */
> +#define CPRMAN_OFFSET           0x101000
>  #define PCM_CLOCK_OFFSET        0x101098
>  #define RNG_OFFSET              0x104000
>  #define GPIO_OFFSET             0x200000
> diff --git a/include/hw/misc/bcm2835_cprman.h b/include/hw/misc/bcm2835_cprman.h
> new file mode 100644
> index 0000000..db250b3
> --- /dev/null
> +++ b/include/hw/misc/bcm2835_cprman.h
> @@ -0,0 +1,28 @@
> +/*
> + * BCM2835 Poor-man's version of CPRMAN
> + *
> + * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> + * See the COPYING file in the top-level directory.
> + */
> +
> +#ifndef BCM2835_CPRMAN_H
> +#define BCM2835_CPRMAN_H
> +
> +#include "hw/sysbus.h"
> +
> +#define TYPE_BCM2835_CPRMAN "bcm2835-cprman"
> +#define BCM2835_CPRMAN(obj) \
> +        OBJECT_CHECK(BCM2835CprmanState, (obj), TYPE_BCM2835_CPRMAN)
> +
> +#define CPRMAN_NUM_REGS         (0x1200 / 4)

I have 64 registers (64-bit wide, see below), so the region is 0x200 B.

> +
> +typedef struct {
> +    SysBusDevice busdev;
> +    MemoryRegion iomem;
> +
> +    uint32_t regs[CPRMAN_NUM_REGS];

I used uint64_t for registers.

> +} BCM2835CprmanState;
> +
> +#endif
> 

Regards,

Phil.

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [Qemu-arm] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-17  1:53 ` [Qemu-devel] [Qemu-arm] " Philippe Mathieu-Daudé
@ 2018-07-17  4:07   ` Guenter Roeck
  2018-10-10 13:25     ` Philippe Mathieu-Daudé
  0 siblings, 1 reply; 11+ messages in thread
From: Guenter Roeck @ 2018-07-17  4:07 UTC (permalink / raw)
  To: Philippe Mathieu-Daudé, Peter Maydell
  Cc: qemu-arm, qemu-devel, Pekka Enberg, Clement Deschamps, Luc Michel

On 07/16/2018 06:53 PM, Philippe Mathieu-Daudé wrote:
> Hi Guenter,
> 
> On 07/15/2018 07:06 PM, Guenter Roeck wrote:
>> Add basic support for BCM283x CPRMAN. Provide support for reading and
>> writing CPRMAN registers and initialize registers with sensible default
>> values. During runtime retain any written values.
>>
>> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
>> and raspi3 systems.
>>
>> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
>> ---
>> I don't seriously expect this patch to get accepted, but I thought
>> it might be valuable enough for others to use it when playing with
>> raspi2 and raspi3 emulations.
> 
> I've been working on a very similar patch... But due to soft-freeze I
> postponed it.
> 

> I don't feel very confident with my local work, as you, it is based on
> looking at the Broadcom firmware [1] and how the Linux kernel initialize
> the devices. I'll however compare with your work.
> 

I'll be more than happy to drop my patch and go with yours instead.
Let's just do that - it looks like it is much more comprehensive.

> [1]: https://github.com/raspberrypi/firmware/tree/master/boot
> 
>>
>>   hw/arm/bcm2835_peripherals.c         |  15 +++++
>>   hw/misc/Makefile.objs                |   1 +
>>   hw/misc/bcm2835_cprman.c             | 126 +++++++++++++++++++++++++++++++++++
>>   include/hw/arm/bcm2835_peripherals.h |   2 +
>>   include/hw/arm/raspi_platform.h      |   1 +
>>   include/hw/misc/bcm2835_cprman.h     |  28 ++++++++
>>   6 files changed, 173 insertions(+)
>>   create mode 100644 hw/misc/bcm2835_cprman.c
>>   create mode 100644 include/hw/misc/bcm2835_cprman.h
>>
>> diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
>> index 6be7660..1a8993f 100644
>> --- a/hw/arm/bcm2835_peripherals.c
>> +++ b/hw/arm/bcm2835_peripherals.c
>> @@ -85,6 +85,11 @@ static void bcm2835_peripherals_init(Object *obj)
>>       object_property_add_const_link(OBJECT(&s->property), "dma-mr",
>>                                      OBJECT(&s->gpu_bus_mr), &error_abort);
>>   
>> +    /* Clock subsystem */
>> +    object_initialize(&s->cprman, sizeof(s->cprman), TYPE_BCM2835_CPRMAN);
>> +    object_property_add_child(obj, "cprman", OBJECT(&s->cprman), NULL);
>> +    qdev_set_parent_bus(DEVICE(&s->cprman), sysbus_get_default());
>> +
>>       /* Random Number Generator */
>>       object_initialize(&s->rng, sizeof(s->rng), TYPE_BCM2835_RNG);
>>       object_property_add_child(obj, "rng", OBJECT(&s->rng), NULL);
>> @@ -244,6 +249,13 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>>       sysbus_connect_irq(SYS_BUS_DEVICE(&s->property), 0,
>>                         qdev_get_gpio_in(DEVICE(&s->mboxes), MBOX_CHAN_PROPERTY));
>>   
>> +    /* Clock subsystem */
>> +    object_property_set_bool(OBJECT(&s->cprman), true, "realized", &err);
>> +    if (err) {
>> +        error_propagate(errp, err);
>> +        return;
>> +    }
>> +
>>       /* Random Number Generator */
>>       object_property_set_bool(OBJECT(&s->rng), true, "realized", &err);
>>       if (err) {
>> @@ -251,6 +263,9 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
>>           return;
>>       }
>>   
>> +    memory_region_add_subregion(&s->peri_mr, CPRMAN_OFFSET,
>> +                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cprman), 0));
>> +
>>       memory_region_add_subregion(&s->peri_mr, RNG_OFFSET,
>>                   sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0));
>>   
>> diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
>> index 9350900..ae5fc8a 100644
>> --- a/hw/misc/Makefile.objs
>> +++ b/hw/misc/Makefile.objs
>> @@ -52,6 +52,7 @@ obj-$(CONFIG_OMAP) += omap_tap.o
>>   obj-$(CONFIG_RASPI) += bcm2835_mbox.o
>>   obj-$(CONFIG_RASPI) += bcm2835_property.o
>>   obj-$(CONFIG_RASPI) += bcm2835_rng.o
>> +obj-$(CONFIG_RASPI) += bcm2835_cprman.o
>>   obj-$(CONFIG_SLAVIO) += slavio_misc.o
>>   obj-$(CONFIG_ZYNQ) += zynq_slcr.o
>>   obj-$(CONFIG_ZYNQ) += zynq-xadc.o
>> diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c
>> new file mode 100644
>> index 0000000..4051f2b
>> --- /dev/null
>> +++ b/hw/misc/bcm2835_cprman.c
>> @@ -0,0 +1,126 @@
>> +/*
>> + * BCM2835 Clock subsystem (poor man's version)
>> + *
>> + * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
>> + *
>> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
>> + * See the COPYING file in the top-level directory.
>> + */
>> +
>> +#include "qemu/osdep.h"
>> +#include "qemu/log.h"
>> +#include "qapi/error.h"
>> +#include "crypto/random.h"
>> +#include "hw/misc/bcm2835_cprman.h"
>> +
>> +static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
>> +                                 unsigned size)
>> +{
>> +    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
>> +    uint32_t res = 0;
>> +
>> +    assert(size == 4);
>> +
>> +    if (offset / 4 < CPRMAN_NUM_REGS) {
>> +        res = s->regs[offset / 4];
>> +    }
>> +
>> +    return res;
>> +}
> 
> Yes, this read() works.
> 
> A bit more verbose:
> 
> static const char *names[64] = {
>      [0] = "GNRIC",
>      [1] = "VPU",
>      [2] = "SYS",
>      [3] = "PERIA",
>      [4] = "PERII",
>      [5] = "H264",
>      [6] = "ISP",
>      [7] = "V3D",
>      [8] = "CAM0",
>      [9] = "CAM1",
>      [10] = "CCP2",
>      [11] = "DSI0E",
>      [12] = "DSI0P",
>      [13] = "DPI",
>      [14] = "GP0",
>      [15] = "GP1",
>      [16] = "GP2",
>      [17] = "HSM",
>      [18] = "OTP",
>      [19] = "PCM",
>      [20] = "PWM",
>      [21] = "SLIM",
>      [22] = "SMI",
>      [24] = "TCNT",
>      [25] = "TEC",
>      [26] = "TD0",
>      [27] = "TD1",
>      [28] = "TSENS",
>      [29] = "TIMER",
>      [30] = "UART",
>      [31] = "VEC",
>      [50] = "PULSE",
>      [53] = "SDC",
>      [54] = "ARM",
>      [55] = "AVEO",
>      [56] = "EMMC",
> };
> 
> static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
>                                      unsigned size)
> {
>      BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
>      int idx = addr / 8;
>      bool div = addr % 8;
>      const char *name = names[idx] ? names[idx] : "UNKN";
>      uint64_t value = s->regs[addr >> 2];
> 
>      switch (addr) {
>      case 0 ... 0x100:
>          qemu_log_mask(LOG_UNIMP, "[CM]: %s unimp r%02d  0x%04"
> HWADDR_PRIx " = 0x%"PRIx64 " (%s)\n",
>                        div ? "DIV" : "CTL", size << 3, addr, value, name);
>          break;
>      case 0x104 ... 0x114:
>          qemu_log_mask(LOG_UNIMP, "[CM]: PLL? unimp r%02d  0x%04"
> HWADDR_PRIx " = 0x%"PRIx64 "\n",
>                        size << 3, addr, value);
>          value = -1; /* FIXME PLL lock? */
>          break;
>      }
>      return value;
> }
> 
>> +
>> +#define CM_PASSWORD             0x5a000000
>> +#define CM_PASSWORD_MASK        0xff000000
>> +
>> +static void bcm2835_cprman_write(void *opaque, hwaddr offset,
>> +                              uint64_t value, unsigned size)
>> +{
>> +    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
>> +
>> +    assert(size == 4);
> 
> Instead of this assert() ...
> 
>> +
>> +    if ((value & 0xff000000) == CM_PASSWORD &&
>> +        offset / 4 < CPRMAN_NUM_REGS)
>> +            s->regs[offset / 4] = value & ~CM_PASSWORD_MASK;
>> +}
>> +
>> +static const MemoryRegionOps bcm2835_cprman_ops = {
>> +    .read = bcm2835_cprman_read,
>> +    .write = bcm2835_cprman_write,
> 
> ... I used:
> 
>         .impl.min_access_size = 4,
>         .valid.min_access_size = 4,
> 
>> +    .endianness = DEVICE_NATIVE_ENDIAN,
>> +};
> 
> Same verbose write():
> 
> static void bcm2835_cprman_write(void *opaque, hwaddr offset,
>                                   uint64_t value, unsigned size)
> {
>      BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
>      int idx = addr / 8;
>      bool div = addr % 8;
>      const char *name = names[idx] ? names[idx] : "UNKN";
> 
>      if (extract64(value, 24, 8) != CM_KEY) {
>          qemu_log_mask(LOG_GUEST_ERROR, "[CM]: %s error w%02d *0x%04"
> HWADDR_PRIx " = 0x%" PRIx64 " (%s)\n",
>                        div ? "DIV" : "CTL", size << 3, addr, value, name);
>          return;
>      }
>      s->regs[addr >> 2] = extract64(value, 0, 24);
>      switch (addr) {
>      case 0 ... 0x100:
>          if (div) {
>              qemu_log_mask(LOG_UNIMP, "[CM]: DIV unimp w%02d *0x%04"
> HWADDR_PRIx " = 0x%" PRIx64 " (%s) %" PRIu64 ".%" PRIu64 "\n",
>                            size << 3, addr, value, name, extract64(value,
> 12, 12), 1000 * extract64(value, 0, 12) / 1024);
>          } else {
>              qemu_log_mask(LOG_UNIMP, "[CM]: CTL unimp w%02d *0x%04"
> HWADDR_PRIx " = 0x%" PRIx64 " (%s) src=%" PRIu64 " ena:%u\n",
>                            size << 3, addr, value, name, value & 0xf,
> !!(value & (1 << 4)));
>          }
>          break;
>      case 0x104 ... 0x114:
>          qemu_log_mask(LOG_UNIMP, "[CM]: PLL? unimp w%02d *0x%04"
> HWADDR_PRIx " = 0x%" PRIx64 "\n",
>                        size << 3, addr, value);
>          break;
>      }
> }
> 
>> +
>> +static const VMStateDescription vmstate_bcm2835_cprman = {
>> +    .name = TYPE_BCM2835_CPRMAN,
>> +    .version_id = 1,
>> +    .minimum_version_id = 1,
>> +    .fields = (VMStateField[]) {
>> +        VMSTATE_UINT32_ARRAY(regs, BCM2835CprmanState, CPRMAN_NUM_REGS),
>> +        VMSTATE_END_OF_LIST()
>> +    }
>> +};
>> +
>> +static void bcm2835_cprman_init(Object *obj)
>> +{
>> +    BCM2835CprmanState *s = BCM2835_CPRMAN(obj);
>> +
>> +    memory_region_init_io(&s->iomem, obj, &bcm2835_cprman_ops, s,
>> +                          TYPE_BCM2835_CPRMAN, 0x2000);
>> +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
>> +}
>> +
>> +#define CM_GNRICCTL        (0x000 / 4)
>> +#define CM_VECCTL        (0x0f8 / 4)
>> +#define CM_DFTCTL        (0x168 / 4)
>> +#define CM_EMMCCTL        (0x1c0 / 4)
> 
>> +#define A2W_PLLA_CTRL        (0x1100 / 4)
>> +#define A2W_PLLB_CTRL        (0x11e0 / 4)
> 
> The A2W is another device you don't need to worry about, just use add a
> 0x1000 UNIMP device.
> 

I thought it was needed to get a non-zero divider, but my memory may defeat me.

Guenter

>> +
>> +static void bcm2835_cprman_reset(DeviceState *dev)
>> +{
>> +    BCM2835CprmanState *s = BCM2835_CPRMAN(dev);
>> +    int i;
>> +
>> +    /*
>> +     * Available information suggests that CPRMAN registers have default
>> +     * values which are not overwritten by ROMMON (u-boot). The hardware
>> +     * default values are unknown at this time.
>> +     * The default values selected here are necessary and sufficient
>> +     * to boot Linux directly (on raspi2 and raspi3). The selected
>> +     * values enable all clocks and set clock rates to match their
>> +     * parent rates.
>> +     */
> 
> Lucky you...
> 
>> +    for (i = CM_GNRICCTL; i <= CM_VECCTL; i += 2) {
>> +        s->regs[i] = 0x11;
>> +        s->regs[i + 1] = 0x1000;
>> +    }
>> +    for (i = CM_DFTCTL; i <= CM_EMMCCTL; i += 2) {
>> +        s->regs[i] = 0x11;
>> +        s->regs[i + 1] = 0x1000;
>> +    }
>> +    for (i = A2W_PLLA_CTRL; i <= A2W_PLLB_CTRL; i += 8) {
>> +        s->regs[i] = 0x10001;
>> +    }
>> +}
> 
> ... I remember having headaches with this CRAP reset():
> 
> static void bcm2836_enable_clk(BCM2835ClockState *s, int clk_id, int
> clk_src, int div_int, int div_frac)
> {
>      s->regs[2 * clk_id + 0] = (/* MASH */1 << 9) | (1 << 4) | (clk_src
> << 0);
>      s->regs[2 * clk_id + 1] = (div_int << 12) | (div_frac << 0);
> }
> 
> static void bcm2836_cm_reset(DeviceState *d)
> {
>      BCM2835ClockState *s = BCM2835_CLOCK(d);
> 
>      int osc_freq_hz = 2400000; /* TODO property */
>      int baudrate = 115200; /* TODO property */
>      int vpu_fracbits = 12; /* TODO property */
>      div_t qi = div(osc_freq_hz, baudrate);
>      div_t qf = div(qi.rem << vpu_fracbits, baudrate);
> 
>      bcm2836_enable_clk(s, 1 /* VPU */, 1 /* OSC */, qi.quot, qf.quot);
>      bcm2836_enable_clk(s, 1 /* VPU */, 1 /* OSC */, 1, 0);
> }
> 
> I can't say it is correct until I reopen this branch (September?).
> 
>> +
>> +static void bcm2835_cprman_class_init(ObjectClass *klass, void *data)
>> +{
>> +    DeviceClass *dc = DEVICE_CLASS(klass);
>> +
>> +    dc->reset = bcm2835_cprman_reset;
>> +    dc->vmsd = &vmstate_bcm2835_cprman;
>> +}
>> +
>> +static TypeInfo bcm2835_cprman_info = {
>> +    .name          = TYPE_BCM2835_CPRMAN,
>> +    .parent        = TYPE_SYS_BUS_DEVICE,
>> +    .instance_size = sizeof(BCM2835CprmanState),
>> +    .class_init    = bcm2835_cprman_class_init,
>> +    .instance_init = bcm2835_cprman_init,
>> +};
>> +
>> +static void bcm2835_cprman_register_types(void)
>> +{
>> +    type_register_static(&bcm2835_cprman_info);
>> +}
>> +
>> +type_init(bcm2835_cprman_register_types)
>> diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
>> index f5b193f..f9f53e3 100644
>> --- a/include/hw/arm/bcm2835_peripherals.h
>> +++ b/include/hw/arm/bcm2835_peripherals.h
>> @@ -19,6 +19,7 @@
>>   #include "hw/intc/bcm2835_ic.h"
>>   #include "hw/misc/bcm2835_property.h"
>>   #include "hw/misc/bcm2835_rng.h"
>> +#include "hw/misc/bcm2835_cprman.h"
>>   #include "hw/misc/bcm2835_mbox.h"
>>   #include "hw/sd/sdhci.h"
>>   #include "hw/sd/bcm2835_sdhost.h"
>> @@ -44,6 +45,7 @@ typedef struct BCM2835PeripheralState {
>>       BCM2835ICState ic;
>>       BCM2835PropertyState property;
>>       BCM2835RngState rng;
>> +    BCM2835CprmanState cprman;
>>       BCM2835MboxState mboxes;
>>       SDHCIState sdhci;
>>       BCM2835SDHostState sdhost;
>> diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
>> index 6467e88..412d010 100644
>> --- a/include/hw/arm/raspi_platform.h
>> +++ b/include/hw/arm/raspi_platform.h
>> @@ -36,6 +36,7 @@
>>                                                         * Doorbells & Mailboxes */
>>   #define PM_OFFSET               0x100000 /* Power Management, Reset controller
>>                                             * and Watchdog registers */
>> +#define CPRMAN_OFFSET           0x101000
>>   #define PCM_CLOCK_OFFSET        0x101098
>>   #define RNG_OFFSET              0x104000
>>   #define GPIO_OFFSET             0x200000
>> diff --git a/include/hw/misc/bcm2835_cprman.h b/include/hw/misc/bcm2835_cprman.h
>> new file mode 100644
>> index 0000000..db250b3
>> --- /dev/null
>> +++ b/include/hw/misc/bcm2835_cprman.h
>> @@ -0,0 +1,28 @@
>> +/*
>> + * BCM2835 Poor-man's version of CPRMAN
>> + *
>> + * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
>> + *
>> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
>> + * See the COPYING file in the top-level directory.
>> + */
>> +
>> +#ifndef BCM2835_CPRMAN_H
>> +#define BCM2835_CPRMAN_H
>> +
>> +#include "hw/sysbus.h"
>> +
>> +#define TYPE_BCM2835_CPRMAN "bcm2835-cprman"
>> +#define BCM2835_CPRMAN(obj) \
>> +        OBJECT_CHECK(BCM2835CprmanState, (obj), TYPE_BCM2835_CPRMAN)
>> +
>> +#define CPRMAN_NUM_REGS         (0x1200 / 4)
> 
> I have 64 registers (64-bit wide, see below), so the region is 0x200 B.
> 
>> +
>> +typedef struct {
>> +    SysBusDevice busdev;
>> +    MemoryRegion iomem;
>> +
>> +    uint32_t regs[CPRMAN_NUM_REGS];
> 
> I used uint64_t for registers.
> 
>> +} BCM2835CprmanState;
>> +
>> +#endif
>>
> 
> Regards,
> 
> Phil.
> 

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [Qemu-arm] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-07-17  4:07   ` Guenter Roeck
@ 2018-10-10 13:25     ` Philippe Mathieu-Daudé
  2018-10-10 15:02       ` Guenter Roeck
  0 siblings, 1 reply; 11+ messages in thread
From: Philippe Mathieu-Daudé @ 2018-10-10 13:25 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: Peter Maydell, qemu-arm, qemu-devel@nongnu.org Developers,
	Pekka Enberg, Clement Deschamps, Luc Michel

Hi Guenter,

On Tue, Jul 17, 2018 at 6:08 AM Guenter Roeck <linux@roeck-us.net> wrote:
>
> On 07/16/2018 06:53 PM, Philippe Mathieu-Daudé wrote:
> > Hi Guenter,
> >
> > On 07/15/2018 07:06 PM, Guenter Roeck wrote:
> >> Add basic support for BCM283x CPRMAN. Provide support for reading and
> >> writing CPRMAN registers and initialize registers with sensible default
> >> values. During runtime retain any written values.
> >>
> >> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
> >> and raspi3 systems.
> >>
> >> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> >> ---
> >> I don't seriously expect this patch to get accepted, but I thought
> >> it might be valuable enough for others to use it when playing with
> >> raspi2 and raspi3 emulations.
> >
> > I've been working on a very similar patch... But due to soft-freeze I
> > postponed it.
> >
>
> > I don't feel very confident with my local work, as you, it is based on
> > looking at the Broadcom firmware [1] and how the Linux kernel initialize
> > the devices. I'll however compare with your work.
> >
>
> I'll be more than happy to drop my patch and go with yours instead.
> Let's just do that - it looks like it is much more comprehensive.

Did you make any progress with your work?

Your patch might be useful to solve the following issue:
https://bugs.launchpad.net/bugs/1779017

>
> > [1]: https://github.com/raspberrypi/firmware/tree/master/boot
> >
> >>
> >>   hw/arm/bcm2835_peripherals.c         |  15 +++++
> >>   hw/misc/Makefile.objs                |   1 +
> >>   hw/misc/bcm2835_cprman.c             | 126 +++++++++++++++++++++++++++++++++++
> >>   include/hw/arm/bcm2835_peripherals.h |   2 +
> >>   include/hw/arm/raspi_platform.h      |   1 +
> >>   include/hw/misc/bcm2835_cprman.h     |  28 ++++++++
> >>   6 files changed, 173 insertions(+)
> >>   create mode 100644 hw/misc/bcm2835_cprman.c
> >>   create mode 100644 include/hw/misc/bcm2835_cprman.h
> >>
> >> diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
> >> index 6be7660..1a8993f 100644
> >> --- a/hw/arm/bcm2835_peripherals.c
> >> +++ b/hw/arm/bcm2835_peripherals.c
> >> @@ -85,6 +85,11 @@ static void bcm2835_peripherals_init(Object *obj)
> >>       object_property_add_const_link(OBJECT(&s->property), "dma-mr",
> >>                                      OBJECT(&s->gpu_bus_mr), &error_abort);
> >>
> >> +    /* Clock subsystem */
> >> +    object_initialize(&s->cprman, sizeof(s->cprman), TYPE_BCM2835_CPRMAN);
> >> +    object_property_add_child(obj, "cprman", OBJECT(&s->cprman), NULL);
> >> +    qdev_set_parent_bus(DEVICE(&s->cprman), sysbus_get_default());
> >> +
> >>       /* Random Number Generator */
> >>       object_initialize(&s->rng, sizeof(s->rng), TYPE_BCM2835_RNG);
> >>       object_property_add_child(obj, "rng", OBJECT(&s->rng), NULL);
> >> @@ -244,6 +249,13 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
> >>       sysbus_connect_irq(SYS_BUS_DEVICE(&s->property), 0,
> >>                         qdev_get_gpio_in(DEVICE(&s->mboxes), MBOX_CHAN_PROPERTY));
> >>
> >> +    /* Clock subsystem */
> >> +    object_property_set_bool(OBJECT(&s->cprman), true, "realized", &err);
> >> +    if (err) {
> >> +        error_propagate(errp, err);
> >> +        return;
> >> +    }
> >> +
> >>       /* Random Number Generator */
> >>       object_property_set_bool(OBJECT(&s->rng), true, "realized", &err);
> >>       if (err) {
> >> @@ -251,6 +263,9 @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
> >>           return;
> >>       }
> >>
> >> +    memory_region_add_subregion(&s->peri_mr, CPRMAN_OFFSET,
> >> +                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->cprman), 0));
> >> +
> >>       memory_region_add_subregion(&s->peri_mr, RNG_OFFSET,
> >>                   sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0));
> >>
> >> diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
> >> index 9350900..ae5fc8a 100644
> >> --- a/hw/misc/Makefile.objs
> >> +++ b/hw/misc/Makefile.objs
> >> @@ -52,6 +52,7 @@ obj-$(CONFIG_OMAP) += omap_tap.o
> >>   obj-$(CONFIG_RASPI) += bcm2835_mbox.o
> >>   obj-$(CONFIG_RASPI) += bcm2835_property.o
> >>   obj-$(CONFIG_RASPI) += bcm2835_rng.o
> >> +obj-$(CONFIG_RASPI) += bcm2835_cprman.o
> >>   obj-$(CONFIG_SLAVIO) += slavio_misc.o
> >>   obj-$(CONFIG_ZYNQ) += zynq_slcr.o
> >>   obj-$(CONFIG_ZYNQ) += zynq-xadc.o
> >> diff --git a/hw/misc/bcm2835_cprman.c b/hw/misc/bcm2835_cprman.c
> >> new file mode 100644
> >> index 0000000..4051f2b
> >> --- /dev/null
> >> +++ b/hw/misc/bcm2835_cprman.c
> >> @@ -0,0 +1,126 @@
> >> +/*
> >> + * BCM2835 Clock subsystem (poor man's version)
> >> + *
> >> + * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
> >> + *
> >> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> >> + * See the COPYING file in the top-level directory.
> >> + */
> >> +
> >> +#include "qemu/osdep.h"
> >> +#include "qemu/log.h"
> >> +#include "qapi/error.h"
> >> +#include "crypto/random.h"
> >> +#include "hw/misc/bcm2835_cprman.h"
> >> +
> >> +static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
> >> +                                 unsigned size)
> >> +{
> >> +    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
> >> +    uint32_t res = 0;
> >> +
> >> +    assert(size == 4);
> >> +
> >> +    if (offset / 4 < CPRMAN_NUM_REGS) {
> >> +        res = s->regs[offset / 4];
> >> +    }
> >> +
> >> +    return res;
> >> +}
> >
> > Yes, this read() works.
> >
> > A bit more verbose:
> >
> > static const char *names[64] = {
> >      [0] = "GNRIC",
> >      [1] = "VPU",
> >      [2] = "SYS",
> >      [3] = "PERIA",
> >      [4] = "PERII",
> >      [5] = "H264",
> >      [6] = "ISP",
> >      [7] = "V3D",
> >      [8] = "CAM0",
> >      [9] = "CAM1",
> >      [10] = "CCP2",
> >      [11] = "DSI0E",
> >      [12] = "DSI0P",
> >      [13] = "DPI",
> >      [14] = "GP0",
> >      [15] = "GP1",
> >      [16] = "GP2",
> >      [17] = "HSM",
> >      [18] = "OTP",
> >      [19] = "PCM",
> >      [20] = "PWM",
> >      [21] = "SLIM",
> >      [22] = "SMI",
> >      [24] = "TCNT",
> >      [25] = "TEC",
> >      [26] = "TD0",
> >      [27] = "TD1",
> >      [28] = "TSENS",
> >      [29] = "TIMER",
> >      [30] = "UART",
> >      [31] = "VEC",
> >      [50] = "PULSE",
> >      [53] = "SDC",
> >      [54] = "ARM",
> >      [55] = "AVEO",
> >      [56] = "EMMC",
> > };
> >
> > static uint64_t bcm2835_cprman_read(void *opaque, hwaddr offset,
> >                                      unsigned size)
> > {
> >      BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
> >      int idx = addr / 8;
> >      bool div = addr % 8;
> >      const char *name = names[idx] ? names[idx] : "UNKN";
> >      uint64_t value = s->regs[addr >> 2];
> >
> >      switch (addr) {
> >      case 0 ... 0x100:
> >          qemu_log_mask(LOG_UNIMP, "[CM]: %s unimp r%02d  0x%04"
> > HWADDR_PRIx " = 0x%"PRIx64 " (%s)\n",
> >                        div ? "DIV" : "CTL", size << 3, addr, value, name);
> >          break;
> >      case 0x104 ... 0x114:
> >          qemu_log_mask(LOG_UNIMP, "[CM]: PLL? unimp r%02d  0x%04"
> > HWADDR_PRIx " = 0x%"PRIx64 "\n",
> >                        size << 3, addr, value);
> >          value = -1; /* FIXME PLL lock? */
> >          break;
> >      }
> >      return value;
> > }
> >
> >> +
> >> +#define CM_PASSWORD             0x5a000000
> >> +#define CM_PASSWORD_MASK        0xff000000
> >> +
> >> +static void bcm2835_cprman_write(void *opaque, hwaddr offset,
> >> +                              uint64_t value, unsigned size)
> >> +{
> >> +    BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
> >> +
> >> +    assert(size == 4);
> >
> > Instead of this assert() ...
> >
> >> +
> >> +    if ((value & 0xff000000) == CM_PASSWORD &&
> >> +        offset / 4 < CPRMAN_NUM_REGS)
> >> +            s->regs[offset / 4] = value & ~CM_PASSWORD_MASK;
> >> +}
> >> +
> >> +static const MemoryRegionOps bcm2835_cprman_ops = {
> >> +    .read = bcm2835_cprman_read,
> >> +    .write = bcm2835_cprman_write,
> >
> > ... I used:
> >
> >         .impl.min_access_size = 4,
> >         .valid.min_access_size = 4,
> >
> >> +    .endianness = DEVICE_NATIVE_ENDIAN,
> >> +};
> >
> > Same verbose write():
> >
> > static void bcm2835_cprman_write(void *opaque, hwaddr offset,
> >                                   uint64_t value, unsigned size)
> > {
> >      BCM2835CprmanState *s = (BCM2835CprmanState *)opaque;
> >      int idx = addr / 8;
> >      bool div = addr % 8;
> >      const char *name = names[idx] ? names[idx] : "UNKN";
> >
> >      if (extract64(value, 24, 8) != CM_KEY) {
> >          qemu_log_mask(LOG_GUEST_ERROR, "[CM]: %s error w%02d *0x%04"
> > HWADDR_PRIx " = 0x%" PRIx64 " (%s)\n",
> >                        div ? "DIV" : "CTL", size << 3, addr, value, name);
> >          return;
> >      }
> >      s->regs[addr >> 2] = extract64(value, 0, 24);
> >      switch (addr) {
> >      case 0 ... 0x100:
> >          if (div) {
> >              qemu_log_mask(LOG_UNIMP, "[CM]: DIV unimp w%02d *0x%04"
> > HWADDR_PRIx " = 0x%" PRIx64 " (%s) %" PRIu64 ".%" PRIu64 "\n",
> >                            size << 3, addr, value, name, extract64(value,
> > 12, 12), 1000 * extract64(value, 0, 12) / 1024);
> >          } else {
> >              qemu_log_mask(LOG_UNIMP, "[CM]: CTL unimp w%02d *0x%04"
> > HWADDR_PRIx " = 0x%" PRIx64 " (%s) src=%" PRIu64 " ena:%u\n",
> >                            size << 3, addr, value, name, value & 0xf,
> > !!(value & (1 << 4)));
> >          }
> >          break;
> >      case 0x104 ... 0x114:
> >          qemu_log_mask(LOG_UNIMP, "[CM]: PLL? unimp w%02d *0x%04"
> > HWADDR_PRIx " = 0x%" PRIx64 "\n",
> >                        size << 3, addr, value);
> >          break;
> >      }
> > }
> >
> >> +
> >> +static const VMStateDescription vmstate_bcm2835_cprman = {
> >> +    .name = TYPE_BCM2835_CPRMAN,
> >> +    .version_id = 1,
> >> +    .minimum_version_id = 1,
> >> +    .fields = (VMStateField[]) {
> >> +        VMSTATE_UINT32_ARRAY(regs, BCM2835CprmanState, CPRMAN_NUM_REGS),
> >> +        VMSTATE_END_OF_LIST()
> >> +    }
> >> +};
> >> +
> >> +static void bcm2835_cprman_init(Object *obj)
> >> +{
> >> +    BCM2835CprmanState *s = BCM2835_CPRMAN(obj);
> >> +
> >> +    memory_region_init_io(&s->iomem, obj, &bcm2835_cprman_ops, s,
> >> +                          TYPE_BCM2835_CPRMAN, 0x2000);
> >> +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
> >> +}
> >> +
> >> +#define CM_GNRICCTL        (0x000 / 4)
> >> +#define CM_VECCTL        (0x0f8 / 4)
> >> +#define CM_DFTCTL        (0x168 / 4)
> >> +#define CM_EMMCCTL        (0x1c0 / 4)
> >
> >> +#define A2W_PLLA_CTRL        (0x1100 / 4)
> >> +#define A2W_PLLB_CTRL        (0x11e0 / 4)
> >
> > The A2W is another device you don't need to worry about, just use add a
> > 0x1000 UNIMP device.
> >
>
> I thought it was needed to get a non-zero divider, but my memory may defeat me.

Hmm I never hit this, but you might be using more recent
firmwares/kernels than the ones I tried, which might now access this.

>
> Guenter
>
> >> +
> >> +static void bcm2835_cprman_reset(DeviceState *dev)
> >> +{
> >> +    BCM2835CprmanState *s = BCM2835_CPRMAN(dev);
> >> +    int i;
> >> +
> >> +    /*
> >> +     * Available information suggests that CPRMAN registers have default
> >> +     * values which are not overwritten by ROMMON (u-boot). The hardware
> >> +     * default values are unknown at this time.
> >> +     * The default values selected here are necessary and sufficient
> >> +     * to boot Linux directly (on raspi2 and raspi3). The selected
> >> +     * values enable all clocks and set clock rates to match their
> >> +     * parent rates.
> >> +     */
> >
> > Lucky you...
> >
> >> +    for (i = CM_GNRICCTL; i <= CM_VECCTL; i += 2) {
> >> +        s->regs[i] = 0x11;
> >> +        s->regs[i + 1] = 0x1000;
> >> +    }
> >> +    for (i = CM_DFTCTL; i <= CM_EMMCCTL; i += 2) {
> >> +        s->regs[i] = 0x11;
> >> +        s->regs[i + 1] = 0x1000;
> >> +    }
> >> +    for (i = A2W_PLLA_CTRL; i <= A2W_PLLB_CTRL; i += 8) {
> >> +        s->regs[i] = 0x10001;
> >> +    }
> >> +}
> >
> > ... I remember having headaches with this CRAP reset():
> >
> > static void bcm2836_enable_clk(BCM2835ClockState *s, int clk_id, int
> > clk_src, int div_int, int div_frac)
> > {
> >      s->regs[2 * clk_id + 0] = (/* MASH */1 << 9) | (1 << 4) | (clk_src
> > << 0);
> >      s->regs[2 * clk_id + 1] = (div_int << 12) | (div_frac << 0);
> > }
> >
> > static void bcm2836_cm_reset(DeviceState *d)
> > {
> >      BCM2835ClockState *s = BCM2835_CLOCK(d);
> >
> >      int osc_freq_hz = 2400000; /* TODO property */
> >      int baudrate = 115200; /* TODO property */
> >      int vpu_fracbits = 12; /* TODO property */
> >      div_t qi = div(osc_freq_hz, baudrate);
> >      div_t qf = div(qi.rem << vpu_fracbits, baudrate);
> >
> >      bcm2836_enable_clk(s, 1 /* VPU */, 1 /* OSC */, qi.quot, qf.quot);
> >      bcm2836_enable_clk(s, 1 /* VPU */, 1 /* OSC */, 1, 0);
> > }
> >
> > I can't say it is correct until I reopen this branch (September?).

... November? ...

> >
> >> +
> >> +static void bcm2835_cprman_class_init(ObjectClass *klass, void *data)
> >> +{
> >> +    DeviceClass *dc = DEVICE_CLASS(klass);
> >> +
> >> +    dc->reset = bcm2835_cprman_reset;
> >> +    dc->vmsd = &vmstate_bcm2835_cprman;
> >> +}
> >> +
> >> +static TypeInfo bcm2835_cprman_info = {
> >> +    .name          = TYPE_BCM2835_CPRMAN,
> >> +    .parent        = TYPE_SYS_BUS_DEVICE,
> >> +    .instance_size = sizeof(BCM2835CprmanState),
> >> +    .class_init    = bcm2835_cprman_class_init,
> >> +    .instance_init = bcm2835_cprman_init,
> >> +};
> >> +
> >> +static void bcm2835_cprman_register_types(void)
> >> +{
> >> +    type_register_static(&bcm2835_cprman_info);
> >> +}
> >> +
> >> +type_init(bcm2835_cprman_register_types)
> >> diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
> >> index f5b193f..f9f53e3 100644
> >> --- a/include/hw/arm/bcm2835_peripherals.h
> >> +++ b/include/hw/arm/bcm2835_peripherals.h
> >> @@ -19,6 +19,7 @@
> >>   #include "hw/intc/bcm2835_ic.h"
> >>   #include "hw/misc/bcm2835_property.h"
> >>   #include "hw/misc/bcm2835_rng.h"
> >> +#include "hw/misc/bcm2835_cprman.h"
> >>   #include "hw/misc/bcm2835_mbox.h"
> >>   #include "hw/sd/sdhci.h"
> >>   #include "hw/sd/bcm2835_sdhost.h"
> >> @@ -44,6 +45,7 @@ typedef struct BCM2835PeripheralState {
> >>       BCM2835ICState ic;
> >>       BCM2835PropertyState property;
> >>       BCM2835RngState rng;
> >> +    BCM2835CprmanState cprman;
> >>       BCM2835MboxState mboxes;
> >>       SDHCIState sdhci;
> >>       BCM2835SDHostState sdhost;
> >> diff --git a/include/hw/arm/raspi_platform.h b/include/hw/arm/raspi_platform.h
> >> index 6467e88..412d010 100644
> >> --- a/include/hw/arm/raspi_platform.h
> >> +++ b/include/hw/arm/raspi_platform.h
> >> @@ -36,6 +36,7 @@
> >>                                                         * Doorbells & Mailboxes */
> >>   #define PM_OFFSET               0x100000 /* Power Management, Reset controller
> >>                                             * and Watchdog registers */
> >> +#define CPRMAN_OFFSET           0x101000
> >>   #define PCM_CLOCK_OFFSET        0x101098
> >>   #define RNG_OFFSET              0x104000
> >>   #define GPIO_OFFSET             0x200000
> >> diff --git a/include/hw/misc/bcm2835_cprman.h b/include/hw/misc/bcm2835_cprman.h
> >> new file mode 100644
> >> index 0000000..db250b3
> >> --- /dev/null
> >> +++ b/include/hw/misc/bcm2835_cprman.h
> >> @@ -0,0 +1,28 @@
> >> +/*
> >> + * BCM2835 Poor-man's version of CPRMAN
> >> + *
> >> + * Copyright (C) 2018 Guenter Roeck <linux@roeck-us.net>
> >> + *
> >> + * This work is licensed under the terms of the GNU GPL, version 2 or later.
> >> + * See the COPYING file in the top-level directory.
> >> + */
> >> +
> >> +#ifndef BCM2835_CPRMAN_H
> >> +#define BCM2835_CPRMAN_H
> >> +
> >> +#include "hw/sysbus.h"
> >> +
> >> +#define TYPE_BCM2835_CPRMAN "bcm2835-cprman"
> >> +#define BCM2835_CPRMAN(obj) \
> >> +        OBJECT_CHECK(BCM2835CprmanState, (obj), TYPE_BCM2835_CPRMAN)
> >> +
> >> +#define CPRMAN_NUM_REGS         (0x1200 / 4)
> >
> > I have 64 registers (64-bit wide, see below), so the region is 0x200 B.
> >
> >> +
> >> +typedef struct {
> >> +    SysBusDevice busdev;
> >> +    MemoryRegion iomem;
> >> +
> >> +    uint32_t regs[CPRMAN_NUM_REGS];
> >
> > I used uint64_t for registers.
> >
> >> +} BCM2835CprmanState;
> >> +
> >> +#endif
> >>
> >
> > Regards,
> >
> > Phil.
> >
>

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [Qemu-devel] [Qemu-arm] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem)
  2018-10-10 13:25     ` Philippe Mathieu-Daudé
@ 2018-10-10 15:02       ` Guenter Roeck
  0 siblings, 0 replies; 11+ messages in thread
From: Guenter Roeck @ 2018-10-10 15:02 UTC (permalink / raw)
  To: Philippe Mathieu-Daudé
  Cc: Peter Maydell, qemu-arm, qemu-devel@nongnu.org Developers,
	Pekka Enberg, Clement Deschamps, Luc Michel

On Wed, Oct 10, 2018 at 03:25:22PM +0200, Philippe Mathieu-Daudé wrote:
> Hi Guenter,
> 
> On Tue, Jul 17, 2018 at 6:08 AM Guenter Roeck <linux@roeck-us.net> wrote:
> >
> > On 07/16/2018 06:53 PM, Philippe Mathieu-Daudé wrote:
> > > Hi Guenter,
> > >
> > > On 07/15/2018 07:06 PM, Guenter Roeck wrote:
> > >> Add basic support for BCM283x CPRMAN. Provide support for reading and
> > >> writing CPRMAN registers and initialize registers with sensible default
> > >> values. During runtime retain any written values.
> > >>
> > >> Basic CPRMAN support is necessary and sufficient to boot Linux on raspi2
> > >> and raspi3 systems.
> > >>
> > >> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
> > >> ---
> > >> I don't seriously expect this patch to get accepted, but I thought
> > >> it might be valuable enough for others to use it when playing with
> > >> raspi2 and raspi3 emulations.
> > >
> > > I've been working on a very similar patch... But due to soft-freeze I
> > > postponed it.
> > >
> >
> > > I don't feel very confident with my local work, as you, it is based on
> > > looking at the Broadcom firmware [1] and how the Linux kernel initialize
> > > the devices. I'll however compare with your work.
> > >
> >
> > I'll be more than happy to drop my patch and go with yours instead.
> > Let's just do that - it looks like it is much more comprehensive.
> 
> Did you make any progress with your work?
> 
My patch works for me, and continue using it. My suggestion above was
for you to finalize your patch and submit it. I did not spend any further
time on it. Sorry for any confusion I may have caused.

> Your patch might be useful to solve the following issue:
> https://bugs.launchpad.net/bugs/1779017

Yes, that was one of the reasons for writing the patch in the first place.

Thanks,
Guenter

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2018-10-10 15:02 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-07-15 22:06 [Qemu-devel] [RFC PATCH] hw: arm: Add basic support for cprman (clock subsystem) Guenter Roeck
2018-07-16  9:08 ` Peter Maydell
2018-07-16 13:51   ` Guenter Roeck
2018-07-16 14:07     ` Peter Maydell
2018-07-16 22:22       ` Guenter Roeck
2018-07-16 14:33 ` Peter Maydell
2018-07-16 16:14   ` Guenter Roeck
2018-07-17  1:53 ` [Qemu-devel] [Qemu-arm] " Philippe Mathieu-Daudé
2018-07-17  4:07   ` Guenter Roeck
2018-10-10 13:25     ` Philippe Mathieu-Daudé
2018-10-10 15:02       ` Guenter Roeck

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.