Re: [Qemu-devel] [PATCH v27 6/8] target/avr: Add example board configuration

[Philippe Mathieu-Daudé]

Hi Michael,

On 7/19/19 10:26 AM, Michael Rolnik wrote:
> From: Sarah Harris <address@hidden>
> 
> A simple board setup that configures an AVR CPU to run a given firmware image.
> This is all that's useful to implement without peripheral emulation as AVR 
> CPUs include a lot of on-board peripherals.
> 
> Signed-off-by: Michael Rolnik <address@hidden>
> ---
>  hw/Kconfig           |   1 +
>  hw/avr/Kconfig       |   5 +
>  hw/avr/Makefile.objs |   1 +
>  hw/avr/sample.c      | 237 +++++++++++++++++++++++++++++++++++++++++++
>  4 files changed, 244 insertions(+)
>  create mode 100644 hw/avr/Kconfig
>  create mode 100644 hw/avr/Makefile.objs
>  create mode 100644 hw/avr/sample.c
> 
> diff --git a/hw/Kconfig b/hw/Kconfig
> index 195f541e50..1f25636855 100644
> --- a/hw/Kconfig
> +++ b/hw/Kconfig
> @@ -42,6 +42,7 @@ source watchdog/Kconfig
>  # arch Kconfig
>  source arm/Kconfig
>  source alpha/Kconfig
> +source avr/Kconfig
>  source cris/Kconfig
>  source hppa/Kconfig
>  source i386/Kconfig
> diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
> new file mode 100644
> index 0000000000..dd02a4c37a
> --- /dev/null
> +++ b/hw/avr/Kconfig
> @@ -0,0 +1,5 @@
> +config AVR_SAMPLE
> +    bool
> +    select AVR_TIMER16
> +    select AVR_USART
> +    select AVR_MASK
> diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
> new file mode 100644
> index 0000000000..626b7064b3
> --- /dev/null
> +++ b/hw/avr/Makefile.objs
> @@ -0,0 +1 @@
> +obj-y += sample.o
> diff --git a/hw/avr/sample.c b/hw/avr/sample.c
> new file mode 100644
> index 0000000000..563edbd417
> --- /dev/null
> +++ b/hw/avr/sample.c
> @@ -0,0 +1,237 @@
> +/*
> + * QEMU AVR CPU
> + *
> + * Copyright (c) 2019 Michael Rolnik
> + *
> + * This library is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU Lesser General Public
> + * License as published by the Free Software Foundation; either
> + * version 2.1 of the License, or (at your option) any later version.
> + *
> + * This library is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> + * Lesser General Public License for more details.
> + *
> + * You should have received a copy of the GNU Lesser General Public
> + * License along with this library; if not, see
> + * <http://www.gnu.org/licenses/lgpl-2.1.html>
> + */
> +
> +/*
> + *  NOTE:
> + *      This is not a real AVR board, this is an example!
> + *      The CPU is an approximation of an ATmega2560, but is missing various
> + *      built-in peripherals.
> + *
> + *      This example board loads provided binary file into flash memory and
> + *      executes it from 0x00000000 address in the code memory space.
> + *
> + *      Currently used for AVR CPU validation
> + *
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "qemu-common.h"
> +#include "cpu.h"
> +#include "hw/hw.h"
> +#include "sysemu/sysemu.h"
> +#include "sysemu/qtest.h"
> +#include "ui/console.h"
> +#include "hw/boards.h"
> +#include "hw/loader.h"
> +#include "qemu/error-report.h"
> +#include "exec/address-spaces.h"
> +#include "include/hw/sysbus.h"
> +#include "include/hw/char/avr_usart.h"
> +#include "include/hw/timer/avr_timer16.h"
> +#include "include/hw/misc/avr_mask.h"
> +#include "elf.h"
> +
> +#define SIZE_FLASH 0x00040000
> +#define SIZE_SRAM 0x00002200
> +/*
> + * Size of additional "external" memory, as if the AVR were configured to use
> + * an external RAM chip.
> + * Note that the configuration registers that normally enable this feature 
> are
> + * unimplemented.
> + */
> +#define SIZE_EXMEM 0x00000000
> +
> +/* Offsets of periphals in emulated memory space (i.e. not host addresses)  
> */
> +#define PRR0_BASE 0x64
> +#define PRR1_BASE 0x65
> +#define USART_BASE 0xc0
> +#define TIMER1_BASE 0x80
> +#define TIMER1_IMSK_BASE 0x6f
> +#define TIMER1_IFR_BASE 0x36
> +
> +/* Interrupt numbers used by peripherals */
> +#define USART_RXC_IRQ 24
> +#define USART_DRE_IRQ 25
> +#define USART_TXC_IRQ 26
> +
> +#define TIMER1_CAPT_IRQ 15
> +#define TIMER1_COMPA_IRQ 16
> +#define TIMER1_COMPB_IRQ 17
> +#define TIMER1_COMPC_IRQ 18
> +#define TIMER1_OVF_IRQ 19
> +
> +/*  Power reduction     */
> +#define PRR1_BIT_PRTIM5     0x05    /*  Timer/Counter5  */
> +#define PRR1_BIT_PRTIM4     0x04    /*  Timer/Counter4  */
> +#define PRR1_BIT_PRTIM3     0x03    /*  Timer/Counter3  */
> +#define PRR1_BIT_PRUSART3   0x02    /*  USART3  */
> +#define PRR1_BIT_PRUSART2   0x01    /*  USART2  */
> +#define PRR1_BIT_PRUSART1   0x00    /*  USART1  */
> +
> +#define PRR0_BIT_PRTWI      0x06    /*  TWI */
> +#define PRR0_BIT_PRTIM2     0x05    /*  Timer/Counter2  */
> +#define PRR0_BIT_PRTIM0     0x04    /*  Timer/Counter0  */
> +#define PRR0_BIT_PRTIM1     0x03    /*  Timer/Counter1  */
> +#define PRR0_BIT_PRSPI      0x02    /*  Serial Peripheral Interface */
> +#define PRR0_BIT_PRUSART0   0x01    /*  USART0  */
> +#define PRR0_BIT_PRADC      0x00    /*  ADC */
> +
> +typedef struct {
> +    MachineClass parent;
> +} SampleMachineClass;
> +
> +typedef struct {
> +    MachineState parent;
> +    MemoryRegion *ram;
> +    MemoryRegion *flash;
> +    AVRUsartState *usart0;
> +    AVRTimer16State *timer1;
> +    AVRMaskState *prr[2];
> +} SampleMachineState;
> +
> +#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
> +
> +#define SAMPLE_MACHINE(obj) \
> +    OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
> +#define SAMPLE_MACHINE_GET_CLASS(obj) \
> +    OBJECT_GET_CLASS(SampleMachineClass, obj, TYPE_SAMPLE_MACHINE)
> +#define SAMPLE_MACHINE_CLASS(klass) \
> +    OBJECT_CLASS_CHECK(SampleMachineClass, klass, TYPE_SAMPLE_MACHINE)
> +
> +static void sample_init(MachineState *machine)
> +{
> +    SampleMachineState *sms = SAMPLE_MACHINE(machine);
> +    MemoryRegion *system_memory = get_system_memory();
> +    AVRCPU *cpu;
> +    const char *firmware = NULL;
> +    const char *filename;
> +    int bytes_loaded;
> +    SysBusDevice *busdev;
> +    DeviceState *cpudev;
> +
> +    system_memory = get_system_memory();
> +    sms->ram = g_new(MemoryRegion, 1);
> +    sms->flash = g_new(MemoryRegion, 1);
> +
> +    cpu = AVR_CPU(cpu_create(machine->cpu_type));
> +    cpudev = DEVICE(cpu);
> +
> +    memory_region_allocate_system_memory(
> +        sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
> +    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);

Not sure this is correct, you are filling an area of 0x1e0 I/O registers
with RAM...

So you use system_memory to model the first registers, I wonder if QEMU
supports a such small area. Well, I won't test it, I'll try a quicker hack:

-- >8 --
diff --git a/hw/avr/sample.c b/hw/avr/sample.c
index 563edbd417..cc60a6ca8d 100644
--- a/hw/avr/sample.c
+++ b/hw/avr/sample.c
@@ -48,6 +48,7 @@
 #include "include/hw/timer/avr_timer16.h"
 #include "include/hw/misc/avr_mask.h"
 #include "elf.h"
+#include "hw/misc/unimp.h"

 #define SIZE_FLASH 0x00040000
 #define SIZE_SRAM 0x00002200
@@ -136,12 +137,29 @@ static void sample_init(MachineState *machine)

     memory_region_allocate_system_memory(
         sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
-    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
+    memory_region_add_subregion_overlap(system_memory, OFFSET_DATA,
sms->ram,
+                                        -2000);

     memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
             &error_fatal);
     memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);

+    create_unimplemented_device("io", 0x800000 + 0x20, 0x40);
+    create_unimplemented_device("data", 0x800000 + 0x20 + 0x40, 0x1a0);
+
+    create_unimplemented_device("gpio", 0x800000 + 0x20 + 0, 0x14);
+    create_unimplemented_device("intc", 0x800000 + 0x20 + 0x1c, 0x2);
+    create_unimplemented_device("tmr0", 0x800000 + 0x20 + 0x26, 0x3);
+    create_unimplemented_device("adc", 0x800000 + 0x20 + 0x78, 0x8);
+    create_unimplemented_device("tmr2", 0x800000 + 0x20 + 0x84, 0xa);
+    create_unimplemented_device("tmr3", 0x800000 + 0x20 + 0x94, 0xa);
+    create_unimplemented_device("tmr4", 0x800000 + 0x20 + 0xa4, 0xa);
+    create_unimplemented_device("uart0", 0x800000 + 0x20 + 0xc0, 0x8);
+    create_unimplemented_device("uart1", 0x800000 + 0x20 + 0xc8, 0x8);
+    create_unimplemented_device("uart2", 0x800000 + 0x20 + 0xd0, 0x8);
+    create_unimplemented_device("tmr5", 0x800000 + 0x20 + 0x124, 0xa);
+    create_unimplemented_device("uart3", 0x800000 + 0x20 + 0x130, 0x8);
+
     /* Power Reduction built-in peripheral */
     sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
                     OFFSET_DATA + PRR0_BASE, NULL));
---

So instead of using a small RAM region for registers, I use the same
amount you used, but with lower priority (-2000). Then I create
'UnimplementedDevice' for the most common blocks and map them (they'll
be mapped at prio -1000).

Now we have this memory map:

(qemu) info mtree
address-space: memory
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    0000000000000000-000000000003ffff (prio 0, rom): avr.flash
    0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
    0000000000800020-0000000000800033 (prio -1000, i/o): gpio
    0000000000800020-000000000080005f (prio -1000, i/o): io
    0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
    000000000080003c-000000000080003d (prio -1000, i/o): intc
    0000000000800046-0000000000800048 (prio -1000, i/o): tmr0
    0000000000800060-00000000008001ff (prio -1000, i/o): data
    0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
    0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
    000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
    0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
    0000000000800098-000000000080009f (prio -1000, i/o): adc
    00000000008000a4-00000000008000ad (prio -1000, i/o): tmr2
    00000000008000b4-00000000008000bd (prio -1000, i/o): tmr3
    00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart
    00000000008000c4-00000000008000cd (prio -1000, i/o): tmr4
    00000000008000e0-00000000008000e7 (prio -1000, i/o): uart0
    00000000008000e8-00000000008000ef (prio -1000, i/o): uart1
    00000000008000f0-00000000008000f7 (prio -1000, i/o): uart2
    0000000000800144-000000000080014d (prio -1000, i/o): tmr5
    0000000000800150-0000000000800157 (prio -1000, i/o): uart3

The UnimplementedDevice is useful to quickly trace accesses from
firmware, you can see:

$ avr-softmmu/qemu-system-avr -bios demo.elf -d unimp
gpio: unimplemented device write (size 1, value 0xff, offset 0x1)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)

So the Demo code first initialize the GPIO direction, then toggle it
(LED blink).

> +
> +    memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
> +            &error_fatal);
> +    memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
> +
> +    /* Power Reduction built-in peripheral */
> +    sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> +                    OFFSET_DATA + PRR0_BASE, NULL));
> +    sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> +                    OFFSET_DATA + PRR1_BASE, NULL));
> +
> +    /* USART 0 built-in peripheral */
> +    sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
> +    busdev = SYS_BUS_DEVICE(sms->usart0);
> +    qdev_prop_set_chr(DEVICE(sms->usart0), "chardev", serial_hd(0));
> +    object_property_set_bool(OBJECT(sms->usart0), true, "realized",
> +            &error_fatal);
> +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);

This OFFSET_DATA makes me wonder... These are I/O devices, it would be
cleaner to map them on the I/O bus, and remap the I/O bus to OFFSET_DATA.

Something like this I guess:

(qemu) info mtree
address-space: memory
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    0000000000000000-000000000003ffff (prio 0, rom): avr.flash
    0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
    0000000000800020-00000000008001ff (prio -1000, i/o): avr.io

address-space: I/O
  0000000000000000-00000000000001ff (prio 0, i/o): avr.io
    0000000000000000-0000000000000033 (prio -1000, i/o): gpio
    0000000000000016-0000000000000016 (prio 0, i/o): avr-timer16
    000000000000001c-000000000000001d (prio -1000, i/o): intc
    0000000000000026-0000000000000028 (prio -1000, i/o): tmr0
    0000000000000044-0000000000000044 (prio 0, i/o): avr-mask
    0000000000000045-0000000000000045 (prio 0, i/o): avr-mask
    000000000000004f-000000000000004f (prio 0, i/o): avr-timer16
    0000000000000060-000000000000006d (prio 0, i/o): avr-timer16
    0000000000000078-000000000000007f (prio -1000, i/o): adc
    0000000000000084-000000000000008d (prio -1000, i/o): tmr2
    0000000000000094-000000000000009d (prio -1000, i/o): tmr3
    00000000000000a0-00000000000000a7 (prio 0, i/o): avr-usart
    00000000000000a4-00000000000000ad (prio -1000, i/o): tmr4
    00000000000000c0-00000000000000c7 (prio -1000, i/o): uart0
    00000000000000c8-00000000000000cf (prio -1000, i/o): uart1
    00000000000000d0-00000000000000d7 (prio -1000, i/o): uart2
    0000000000000124-000000000000012d (prio -1000, i/o): tmr5
    0000000000000130-0000000000000127 (prio -1000, i/o): uart3

> +    /*
> +     * These IRQ numbers don't match the datasheet because we're counting 
> from
> +     * zero and not including reset.
> +     */
> +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, USART_RXC_IRQ));
> +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, USART_DRE_IRQ));
> +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, USART_TXC_IRQ));
> +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]), PRR1_BIT_PRUSART1,
> +            qdev_get_gpio_in(DEVICE(sms->usart0), 0));
> +
> +    /* Timer 1 built-in periphal */
> +    sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
> +    object_property_set_bool(OBJECT(sms->timer1), true, "realized",
> +            &error_fatal);
> +    busdev = SYS_BUS_DEVICE(sms->timer1);
> +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
> +    sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
> +    sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
> +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, TIMER1_CAPT_IRQ));
> +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, 
> TIMER1_COMPA_IRQ));
> +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, 
> TIMER1_COMPB_IRQ));
> +    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev, 
> TIMER1_COMPC_IRQ));
> +    sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev, TIMER1_OVF_IRQ));
> +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]), PRR0_BIT_PRTIM1,
> +            qdev_get_gpio_in(DEVICE(sms->timer1), 0));
> +
> +    /* Load firmware (contents of flash) trying to auto-detect format */
> +    firmware = machine->firmware;
> +    if (firmware != NULL) {
> +        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
> +        if (filename == NULL) {
> +            error_report("Unable to find %s", firmware);
> +            exit(1);
> +        }
> +
> +        bytes_loaded = load_elf(
> +            filename, NULL, NULL, NULL, NULL, NULL, NULL, 0, EM_NONE, 0, 0);
> +        if (bytes_loaded < 0) {
> +            error_report(
> +                "Unable to load %s as ELF, trying again as raw binary",
> +                firmware);
> +            bytes_loaded = load_image_targphys(
> +                filename, OFFSET_CODE, SIZE_FLASH);
> +        }
> +        if (bytes_loaded < 0) {
> +            error_report(
> +                "Unable to load firmware image %s as ELF or raw binary",
> +                firmware);
> +            exit(1);
> +        }
> +    }
> +}
> +
> +static void sample_class_init(ObjectClass *oc, void *data)
> +{
> +    MachineClass *mc = MACHINE_CLASS(oc);
> +
> +    mc->desc = "AVR sample/example board (ATmega2560)";
> +    mc->init = sample_init;
> +    mc->default_cpus = 1;
> +    mc->min_cpus = mc->default_cpus;
> +    mc->max_cpus = mc->default_cpus;
> +    mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
> +    mc->is_default = 1;
> +}
> +
> +static const TypeInfo sample_info = {
> +    .name = TYPE_SAMPLE_MACHINE,
> +    .parent = TYPE_MACHINE,
> +    .instance_size = sizeof(SampleMachineState),
> +    .class_size = sizeof(SampleMachineClass),
> +    .class_init = sample_class_init,
> +};
> +
> +static void sample_machine_init(void)
> +{
> +    type_register_static(&sample_info);
> +}
> +
> +type_init(sample_machine_init);
>