Hi Michael,
On 7/19/19 10:26 AM, Michael Rolnik wrote:
> From: Sarah Harris <s.e.har...@kent.ac.uk>
>
> A simple board setup that configures an AVR CPU to run a given firmware image.
> This is all that's useful to implement without peripheral emulation as AVR
> CPUs include a lot of on-board peripherals.
>
> Signed-off-by: Michael Rolnik <mrol...@gmail.com>
> ---
> hw/Kconfig | 1 +
> hw/avr/Kconfig | 5 +
> hw/avr/Makefile.objs | 1 +
> hw/avr/sample.c | 237 +++++++++++++++++++++++++++++++++++++++++++
> 4 files changed, 244 insertions(+)
> create mode 100644 hw/avr/Kconfig
> create mode 100644 hw/avr/Makefile.objs
> create mode 100644 hw/avr/sample.c
>
> diff --git a/hw/Kconfig b/hw/Kconfig
> index 195f541e50..1f25636855 100644
> --- a/hw/Kconfig
> +++ b/hw/Kconfig
> @@ -42,6 +42,7 @@ source watchdog/Kconfig
> # arch Kconfig
> source arm/Kconfig
> source alpha/Kconfig
> +source avr/Kconfig
> source cris/Kconfig
> source hppa/Kconfig
> source i386/Kconfig
> diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
> new file mode 100644
> index 0000000000..dd02a4c37a
> --- /dev/null
> +++ b/hw/avr/Kconfig
> @@ -0,0 +1,5 @@
> +config AVR_SAMPLE
> + bool
> + select AVR_TIMER16
> + select AVR_USART
> + select AVR_MASK
> diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
> new file mode 100644
> index 0000000000..626b7064b3
> --- /dev/null
> +++ b/hw/avr/Makefile.objs
> @@ -0,0 +1 @@
> +obj-y += sample.o
> diff --git a/hw/avr/sample.c b/hw/avr/sample.c
> new file mode 100644
> index 0000000000..563edbd417
> --- /dev/null
> +++ b/hw/avr/sample.c
> @@ -0,0 +1,237 @@
> +/*
> + * QEMU AVR CPU
> + *
> + * Copyright (c) 2019 Michael Rolnik
> + *
> + * This library is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU Lesser General Public
> + * License as published by the Free Software Foundation; either
> + * version 2.1 of the License, or (at your option) any later version.
> + *
> + * This library is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
> + * Lesser General Public License for more details.
> + *
> + * You should have received a copy of the GNU Lesser General Public
> + * License along with this library; if not, see
> + * <http://www.gnu.org/licenses/lgpl-2.1.html>
> + */
> +
> +/*
> + * NOTE:
> + * This is not a real AVR board, this is an example!
> + * The CPU is an approximation of an ATmega2560, but is missing various
> + * built-in peripherals.
> + *
> + * This example board loads provided binary file into flash memory and
> + * executes it from 0x00000000 address in the code memory space.
> + *
> + * Currently used for AVR CPU validation
> + *
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "qemu-common.h"
> +#include "cpu.h"
> +#include "hw/hw.h"
> +#include "sysemu/sysemu.h"
> +#include "sysemu/qtest.h"
> +#include "ui/console.h"
> +#include "hw/boards.h"
> +#include "hw/loader.h"
> +#include "qemu/error-report.h"
> +#include "exec/address-spaces.h"
> +#include "include/hw/sysbus.h"
> +#include "include/hw/char/avr_usart.h"
> +#include "include/hw/timer/avr_timer16.h"
> +#include "include/hw/misc/avr_mask.h"
> +#include "elf.h"
> +
> +#define SIZE_FLASH 0x00040000
> +#define SIZE_SRAM 0x00002200
> +/*
> + * Size of additional "external" memory, as if the AVR were configured to use
> + * an external RAM chip.
> + * Note that the configuration registers that normally enable this feature
> are
> + * unimplemented.
> + */
> +#define SIZE_EXMEM 0x00000000
> +
> +/* Offsets of periphals in emulated memory space (i.e. not host addresses)
> */
> +#define PRR0_BASE 0x64
> +#define PRR1_BASE 0x65
> +#define USART_BASE 0xc0
> +#define TIMER1_BASE 0x80
> +#define TIMER1_IMSK_BASE 0x6f
> +#define TIMER1_IFR_BASE 0x36
> +
> +/* Interrupt numbers used by peripherals */
> +#define USART_RXC_IRQ 24
> +#define USART_DRE_IRQ 25
> +#define USART_TXC_IRQ 26
> +
> +#define TIMER1_CAPT_IRQ 15
> +#define TIMER1_COMPA_IRQ 16
> +#define TIMER1_COMPB_IRQ 17
> +#define TIMER1_COMPC_IRQ 18
> +#define TIMER1_OVF_IRQ 19
> +
> +/* Power reduction */
> +#define PRR1_BIT_PRTIM5 0x05 /* Timer/Counter5 */
> +#define PRR1_BIT_PRTIM4 0x04 /* Timer/Counter4 */
> +#define PRR1_BIT_PRTIM3 0x03 /* Timer/Counter3 */
> +#define PRR1_BIT_PRUSART3 0x02 /* USART3 */
> +#define PRR1_BIT_PRUSART2 0x01 /* USART2 */
> +#define PRR1_BIT_PRUSART1 0x00 /* USART1 */
> +
> +#define PRR0_BIT_PRTWI 0x06 /* TWI */
> +#define PRR0_BIT_PRTIM2 0x05 /* Timer/Counter2 */
> +#define PRR0_BIT_PRTIM0 0x04 /* Timer/Counter0 */
> +#define PRR0_BIT_PRTIM1 0x03 /* Timer/Counter1 */
> +#define PRR0_BIT_PRSPI 0x02 /* Serial Peripheral Interface */
> +#define PRR0_BIT_PRUSART0 0x01 /* USART0 */
> +#define PRR0_BIT_PRADC 0x00 /* ADC */
> +
> +typedef struct {
> + MachineClass parent;
> +} SampleMachineClass;
> +
> +typedef struct {
> + MachineState parent;
> + MemoryRegion *ram;
> + MemoryRegion *flash;
> + AVRUsartState *usart0;
> + AVRTimer16State *timer1;
> + AVRMaskState *prr[2];
> +} SampleMachineState;
> +
> +#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
> +
> +#define SAMPLE_MACHINE(obj) \
> + OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
> +#define SAMPLE_MACHINE_GET_CLASS(obj) \
> + OBJECT_GET_CLASS(SampleMachineClass, obj, TYPE_SAMPLE_MACHINE)
> +#define SAMPLE_MACHINE_CLASS(klass) \
> + OBJECT_CLASS_CHECK(SampleMachineClass, klass, TYPE_SAMPLE_MACHINE)
> +
> +static void sample_init(MachineState *machine)
> +{
> + SampleMachineState *sms = SAMPLE_MACHINE(machine);
> + MemoryRegion *system_memory = get_system_memory();
> + AVRCPU *cpu;
> + const char *firmware = NULL;
> + const char *filename;
> + int bytes_loaded;
> + SysBusDevice *busdev;
> + DeviceState *cpudev;
> +
> + system_memory = get_system_memory();
> + sms->ram = g_new(MemoryRegion, 1);
> + sms->flash = g_new(MemoryRegion, 1);
> +
> + cpu = AVR_CPU(cpu_create(machine->cpu_type));
> + cpudev = DEVICE(cpu);
> +
> + memory_region_allocate_system_memory(
> + sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
> + memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
Not sure this is correct, you are filling an area of 0x1e0 I/O registers
with RAM...
So you use system_memory to model the first registers, I wonder if QEMU
supports a such small area. Well, I won't test it, I'll try a quicker hack:
-- >8 --
diff --git a/hw/avr/sample.c b/hw/avr/sample.c
index 563edbd417..cc60a6ca8d 100644
--- a/hw/avr/sample.c
+++ b/hw/avr/sample.c
@@ -48,6 +48,7 @@
#include "include/hw/timer/avr_timer16.h"
#include "include/hw/misc/avr_mask.h"
#include "elf.h"
+#include "hw/misc/unimp.h"
#define SIZE_FLASH 0x00040000
#define SIZE_SRAM 0x00002200
@@ -136,12 +137,29 @@ static void sample_init(MachineState *machine)
memory_region_allocate_system_memory(
sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
- memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
+ memory_region_add_subregion_overlap(system_memory, OFFSET_DATA,
sms->ram,
+ -2000);
memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
&error_fatal);
memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
+ create_unimplemented_device("io", 0x800000 + 0x20, 0x40);
+ create_unimplemented_device("data", 0x800000 + 0x20 + 0x40, 0x1a0);
+
+ create_unimplemented_device("gpio", 0x800000 + 0x20 + 0, 0x14);
+ create_unimplemented_device("intc", 0x800000 + 0x20 + 0x1c, 0x2);
+ create_unimplemented_device("tmr0", 0x800000 + 0x20 + 0x26, 0x3);
+ create_unimplemented_device("adc", 0x800000 + 0x20 + 0x78, 0x8);
+ create_unimplemented_device("tmr2", 0x800000 + 0x20 + 0x84, 0xa);
+ create_unimplemented_device("tmr3", 0x800000 + 0x20 + 0x94, 0xa);
+ create_unimplemented_device("tmr4", 0x800000 + 0x20 + 0xa4, 0xa);
+ create_unimplemented_device("uart0", 0x800000 + 0x20 + 0xc0, 0x8);
+ create_unimplemented_device("uart1", 0x800000 + 0x20 + 0xc8, 0x8);
+ create_unimplemented_device("uart2", 0x800000 + 0x20 + 0xd0, 0x8);
+ create_unimplemented_device("tmr5", 0x800000 + 0x20 + 0x124, 0xa);
+ create_unimplemented_device("uart3", 0x800000 + 0x20 + 0x130, 0x8);
+
/* Power Reduction built-in peripheral */
sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
OFFSET_DATA + PRR0_BASE, NULL));
---
So instead of using a small RAM region for registers, I use the same
amount you used, but with lower priority (-2000). Then I create
'UnimplementedDevice' for the most common blocks and map them (they'll
be mapped at prio -1000).
Now we have this memory map:
(qemu) info mtree
address-space: memory
0000000000000000-ffffffffffffffff (prio 0, i/o): system
0000000000000000-000000000003ffff (prio 0, rom): avr.flash
0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
0000000000800020-0000000000800033 (prio -1000, i/o): gpio
0000000000800020-000000000080005f (prio -1000, i/o): io
0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
000000000080003c-000000000080003d (prio -1000, i/o): intc
0000000000800046-0000000000800048 (prio -1000, i/o): tmr0
0000000000800060-00000000008001ff (prio -1000, i/o): data
0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
0000000000800098-000000000080009f (prio -1000, i/o): adc
00000000008000a4-00000000008000ad (prio -1000, i/o): tmr2
00000000008000b4-00000000008000bd (prio -1000, i/o): tmr3
00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart
00000000008000c4-00000000008000cd (prio -1000, i/o): tmr4
00000000008000e0-00000000008000e7 (prio -1000, i/o): uart0
00000000008000e8-00000000008000ef (prio -1000, i/o): uart1
00000000008000f0-00000000008000f7 (prio -1000, i/o): uart2
0000000000800144-000000000080014d (prio -1000, i/o): tmr5
0000000000800150-0000000000800157 (prio -1000, i/o): uart3
The UnimplementedDevice is useful to quickly trace accesses from
firmware, you can see:
$ avr-softmmu/qemu-system-avr -bios demo.elf -d unimp
gpio: unimplemented device write (size 1, value 0xff, offset 0x1)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
So the Demo code first initialize the GPIO direction, then toggle it
(LED blink).
> +
> + memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
> + &error_fatal);
> + memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
> +
> + /* Power Reduction built-in peripheral */
> + sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> + OFFSET_DATA + PRR0_BASE, NULL));
> + sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> + OFFSET_DATA + PRR1_BASE, NULL));
> +
> + /* USART 0 built-in peripheral */
> + sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
> + busdev = SYS_BUS_DEVICE(sms->usart0);
> + qdev_prop_set_chr(DEVICE(sms->usart0), "chardev", serial_hd(0));
> + object_property_set_bool(OBJECT(sms->usart0), true, "realized",
> + &error_fatal);
> + sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);
This OFFSET_DATA makes me wonder... These are I/O devices, it would be
cleaner to map them on the I/O bus, and remap the I/O bus to OFFSET_DATA.
Something like this I guess:
(qemu) info mtree
address-space: memory
0000000000000000-ffffffffffffffff (prio 0, i/o): system
0000000000000000-000000000003ffff (prio 0, rom): avr.flash
0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
0000000000800020-00000000008001ff (prio -1000, i/o): avr.io
address-space: I/O
0000000000000000-00000000000001ff (prio 0, i/o): avr.io
0000000000000000-0000000000000033 (prio -1000, i/o): gpio
0000000000000016-0000000000000016 (prio 0, i/o): avr-timer16
000000000000001c-000000000000001d (prio -1000, i/o): intc
0000000000000026-0000000000000028 (prio -1000, i/o): tmr0
0000000000000044-0000000000000044 (prio 0, i/o): avr-mask
0000000000000045-0000000000000045 (prio 0, i/o): avr-mask
000000000000004f-000000000000004f (prio 0, i/o): avr-timer16
0000000000000060-000000000000006d (prio 0, i/o): avr-timer16
0000000000000078-000000000000007f (prio -1000, i/o): adc
0000000000000084-000000000000008d (prio -1000, i/o): tmr2
0000000000000094-000000000000009d (prio -1000, i/o): tmr3
00000000000000a0-00000000000000a7 (prio 0, i/o): avr-usart
00000000000000a4-00000000000000ad (prio -1000, i/o): tmr4
00000000000000c0-00000000000000c7 (prio -1000, i/o): uart0
00000000000000c8-00000000000000cf (prio -1000, i/o): uart1
00000000000000d0-00000000000000d7 (prio -1000, i/o): uart2
0000000000000124-000000000000012d (prio -1000, i/o): tmr5
0000000000000130-0000000000000127 (prio -1000, i/o): uart3
> + /*
> + * These IRQ numbers don't match the datasheet because we're counting
> from
> + * zero and not including reset.
> + */
> + sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, USART_RXC_IRQ));
> + sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, USART_DRE_IRQ));
> + sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, USART_TXC_IRQ));
> + sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]), PRR1_BIT_PRUSART1,
> + qdev_get_gpio_in(DEVICE(sms->usart0), 0));
> +
> + /* Timer 1 built-in periphal */
> + sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
> + object_property_set_bool(OBJECT(sms->timer1), true, "realized",
> + &error_fatal);
> + busdev = SYS_BUS_DEVICE(sms->timer1);
> + sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
> + sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
> + sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
> + sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, TIMER1_CAPT_IRQ));
> + sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
> TIMER1_COMPA_IRQ));
> + sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
> TIMER1_COMPB_IRQ));
> + sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev,
> TIMER1_COMPC_IRQ));
> + sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev, TIMER1_OVF_IRQ));
> + sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]), PRR0_BIT_PRTIM1,
> + qdev_get_gpio_in(DEVICE(sms->timer1), 0));
> +
> + /* Load firmware (contents of flash) trying to auto-detect format */
> + firmware = machine->firmware;
> + if (firmware != NULL) {
> + filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
> + if (filename == NULL) {
> + error_report("Unable to find %s", firmware);
> + exit(1);
> + }
> +
> + bytes_loaded = load_elf(
> + filename, NULL, NULL, NULL, NULL, NULL, NULL, 0, EM_NONE, 0, 0);
> + if (bytes_loaded < 0) {
> + error_report(
> + "Unable to load %s as ELF, trying again as raw binary",
> + firmware);
> + bytes_loaded = load_image_targphys(
> + filename, OFFSET_CODE, SIZE_FLASH);
> + }
> + if (bytes_loaded < 0) {
> + error_report(
> + "Unable to load firmware image %s as ELF or raw binary",
> + firmware);
> + exit(1);
> + }
> + }
> +}
> +
> +static void sample_class_init(ObjectClass *oc, void *data)
> +{
> + MachineClass *mc = MACHINE_CLASS(oc);
> +
> + mc->desc = "AVR sample/example board (ATmega2560)";
> + mc->init = sample_init;
> + mc->default_cpus = 1;
> + mc->min_cpus = mc->default_cpus;
> + mc->max_cpus = mc->default_cpus;
> + mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
> + mc->is_default = 1;
> +}
> +
> +static const TypeInfo sample_info = {
> + .name = TYPE_SAMPLE_MACHINE,
> + .parent = TYPE_MACHINE,
> + .instance_size = sizeof(SampleMachineState),
> + .class_size = sizeof(SampleMachineClass),
> + .class_init = sample_class_init,
> +};
> +
> +static void sample_machine_init(void)
> +{
> + type_register_static(&sample_info);
> +}
> +
> +type_init(sample_machine_init);
>
