* [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot
@ 2026-09-04 15:57 Bin Meng
2026-09-04 15:57 ` [PATCH v2 01/24] hw/riscv: pfsoc: Correct the L2LIM maximum mapped size Bin Meng
` (25 more replies)
0 siblings, 26 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Alistair Francis, Alistair Francis, Bin Meng, Chao Liu,
Conor Dooley, Daniel Henrique Barboza, Edgar E. Iglesias,
Fabiano Rosas, Laurent Vivier, Liu Zhiwei, Markus Armbruster,
Palmer Dabbelt, Paolo Bonzini, Peter Maydell,
Philippe Mathieu-Daudé, Pierrick Bouvier, Sebastian Huber,
Thomas Huth, Weiwei Li, qemu-arm, qemu-block, qemu-riscv
The microchip-icicle-kit machine was originally validated with an older
Hart Software Services (HSS) firmware stack. HSS v2024.06 cannot boot
through U-Boot to Linux because several firmware-visible parts of the
PolarFire SoC are missing or incomplete.
The first failure occurs before the UART is initialized because the L2
zero window is not mapped. HSS then needs additional L2 cache controller
and DDR training behavior. Later boot stages exercise system services,
the RTC, SDHC version 4 DMA, and high-capacity SD card block sizing,
along with the complete DDR aliases. The existing models ither reject
these accesses or expose behavior that does not match the hardware
specifications.
This series restores the complete firmware boot flow. With these
changes, QEMU boots the HSS v2024.06 eNVM image, loads its U-Boot
payload from an SD card, and reaches the Buildroot 2026.05 Linux
login prompt.
The changes are organized around the firmware boot sequence:
* Correct the L2-LIM size, map the L2 zero window, and provide the DMC
status transitions required by HSS DDR initialization.
* Model the documented L2CC Config, WayEnable, and WayMask registers,
and resize L2-LIM as cache ways are enabled.
* Complete SDHCI version 4 support used by the Cadence controller,
including Host Control 2, SDMA system addressing, 64-bit ADMA2
descriptors, and SDMA boundary continuation.
* Run ADMA from a bounded timer-driven engine instead of performing work
from command or unrelated MMIO accesses. This keeps DMA progress
independent of guest register traffic and avoids consuming a polling
deadline inside the command write.
* Keep SDHC and SDXC memory transfers at their fixed 512-byte block
size, and advertise the Cadence controller's 64-bit system bus
support.
* Add the PolarFire SoC serial-number system service and RTC, and honor
the system-service notification control bit.
* Correct the DDR aliases and fix the board topology at its physical
configuration of 2 GiB of RAM and five harts.
* Document direct and HSS boot, add focused qtests and a full firmware
functional test, and restore the machine's Supported maintainer
status.
Testing performed:
* Built qemu-system-riscv64 and the documentation.
* Passed various newly added qtests.
* Booted HSS v2024.06, U-Boot, and Buildroot 2026.05 Linux to the login
prompt using the functional-test image.
The functional test downloads this versioned image archive:
https://github.com/processmission/qemu-machine-images/releases/download/
v1.0.0/riscv64-microchip-icicle-kit-v1.0.0.tar.zst
When restoring the HSS boot support, 3 potential bugs were identified in
the upstream HSS source codes that either blocks the DDR training from
succeed or traps in a multi-core race at the very beginning or after
a succesfully DDR training but stuck at OpenSBI/U-Boot hand-off. There
are already bug reports filed aginst various upstream projects.
Changes in v2:
- Use the Resettable API instead of a legacy reset handler
- tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer
- Assert bounded ADMA pacing and MMIO-independent progress
- Reuse existing SDHCI definitions and command helpers
- Verify transferred data against a known image pattern
- Make 64-bit system bus support a device property
- hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
- Reset the RTC to the documented hardware values
- Expect the documented hardware state after RTC reset
- MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
- Drop sdhci patches that are already merged
Bin Meng (23):
hw/riscv: pfsoc: Correct the L2LIM maximum mapped size
hw/riscv: pfsoc: Map the L2 zero device window
hw/misc: pfsoc: Support DDR training with newer HSS
hw/misc: pfsoc: Model L2 cache controller registers
hw/riscv: pfsoc: Couple L2CC to L2-LIM
tests/qtest: Add PolarFire SoC L2CC coverage
hw/sd: sdhci: Run ADMA independently of MMIO
hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
hw/sd: cadence: Add 64-bit system bus property
hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
hw/misc: pfsoc: Model PolarFire SoC serial number service
hw/rtc: Add PolarFire SoC RTC model
hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit
tests/qtest: Add PolarFire SoC RTC coverage
hw/misc: pfsoc: Honor PolarFire service notification requests
hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
hw/riscv: pfsoc: Fix Icicle Kit hart count at five
docs/system/riscv: Document Icicle Kit HSS boot
docs/system/riscv: pfsoc: Document CLINT topology for direct Linux
boot
tests/functional/riscv64: Add Icicle Kit firmware boot test
MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer
MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
Wadim Mueller (1):
tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer
MAINTAINERS | 13 +-
docs/system/riscv/microchip-icicle-kit.rst | 129 ++++-
include/hw/misc/mchp_pfsoc_dmc.h | 6 +
include/hw/misc/mchp_pfsoc_ioscb.h | 8 +
include/hw/misc/mchp_pfsoc_l2cc.h | 31 ++
include/hw/riscv/microchip_pfsoc.h | 7 +
include/hw/rtc/mchp_pfsoc_rtc.h | 46 ++
include/hw/sd/cadence_sdhci.h | 1 +
hw/misc/mchp_pfsoc_dmc.c | 273 +++++++++-
hw/misc/mchp_pfsoc_ioscb.c | 174 ++++++-
hw/misc/mchp_pfsoc_l2cc.c | 231 +++++++++
hw/misc/mchp_pfsoc_sysreg.c | 9 +-
hw/riscv/microchip_pfsoc.c | 94 ++--
hw/rtc/mchp_pfsoc_rtc.c | 477 ++++++++++++++++++
hw/sd/cadence_sdhci.c | 11 +
hw/sd/sd.c | 43 +-
hw/sd/sdhci.c | 143 ++++--
tests/qtest/cadence-sdhci-test.c | 282 +++++++++++
tests/qtest/mchp_pfsoc_l2cc_test.c | 221 ++++++++
tests/qtest/mchp_pfsoc_rtc_test.c | 315 ++++++++++++
hw/misc/Kconfig | 3 +
hw/misc/meson.build | 1 +
hw/riscv/Kconfig | 2 +
hw/rtc/Kconfig | 3 +
hw/rtc/meson.build | 1 +
tests/functional/riscv64/meson.build | 2 +
.../riscv64/test_microchip_icicle_kit.py | 56 ++
tests/qtest/meson.build | 6 +
28 files changed, 2429 insertions(+), 159 deletions(-)
create mode 100644 include/hw/misc/mchp_pfsoc_l2cc.h
create mode 100644 include/hw/rtc/mchp_pfsoc_rtc.h
create mode 100644 hw/misc/mchp_pfsoc_l2cc.c
create mode 100644 hw/rtc/mchp_pfsoc_rtc.c
create mode 100644 tests/qtest/cadence-sdhci-test.c
create mode 100644 tests/qtest/mchp_pfsoc_l2cc_test.c
create mode 100644 tests/qtest/mchp_pfsoc_rtc_test.c
create mode 100644 tests/functional/riscv64/test_microchip_icicle_kit.py
---
base-commit: d2843fbf80260e4346c856819e8cea11768c9d0e
branch: icicle-kit
--
2.53.0
^ permalink raw reply [flat|nested] 48+ messages in thread
* [PATCH v2 01/24] hw/riscv: pfsoc: Correct the L2LIM maximum mapped size
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 02/24] hw/riscv: pfsoc: Map the L2 zero device window Bin Meng
` (24 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Sebastian Huber, Weiwei Li,
qemu-riscv
PolarFire SoC has a 2MiB L2 cache, so the maximum mapped size of
L2LIM should be set to 2MiB too.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
---
(no changes since v1)
hw/riscv/microchip_pfsoc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index edd29626fa..cfba2990b6 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -95,7 +95,7 @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
[MICROCHIP_PFSOC_CLINT] = { 0x2000000, 0x10000 },
[MICROCHIP_PFSOC_L2CC] = { 0x2010000, 0x1000 },
[MICROCHIP_PFSOC_DMA] = { 0x3000000, 0x100000 },
- [MICROCHIP_PFSOC_L2LIM] = { 0x8000000, 0x2000000 },
+ [MICROCHIP_PFSOC_L2LIM] = { 0x8000000, 0x200000 },
[MICROCHIP_PFSOC_PLIC] = { 0xc000000, 0x4000000 },
[MICROCHIP_PFSOC_MMUART0] = { 0x20000000, 0x1000 },
[MICROCHIP_PFSOC_WDOG0] = { 0x20001000, 0x1000 },
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 02/24] hw/riscv: pfsoc: Map the L2 zero device window
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
2026-09-04 15:57 ` [PATCH v2 01/24] hw/riscv: pfsoc: Correct the L2LIM maximum mapped size Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 03/24] hw/misc: pfsoc: Support DDR training with newer HSS Bin Meng
` (23 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Sebastian Huber, Weiwei Li,
qemu-riscv
HSS uses a window at 0x0a000000 while setting up the L2 cache,
decompressing its runtime image, and executing that image.
The missing mapping causes the E51 to trap before firmware can
initialize its UART.
Represent the window with RAM to provide its persistent read,
write, and execute effects without claiming to model the L2
cache itself.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
---
(no changes since v1)
include/hw/riscv/microchip_pfsoc.h | 1 +
hw/riscv/microchip_pfsoc.c | 13 +++++++++++++
2 files changed, 14 insertions(+)
diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index a30b944afa..612fd2b69c 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -90,6 +90,7 @@ enum {
MICROCHIP_PFSOC_L2CC,
MICROCHIP_PFSOC_DMA,
MICROCHIP_PFSOC_L2LIM,
+ MICROCHIP_PFSOC_L2ZERO,
MICROCHIP_PFSOC_PLIC,
MICROCHIP_PFSOC_MMUART0,
MICROCHIP_PFSOC_WDOG0,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index cfba2990b6..8106dbb3ad 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -96,6 +96,7 @@ static const MemMapEntry microchip_pfsoc_memmap[] = {
[MICROCHIP_PFSOC_L2CC] = { 0x2010000, 0x1000 },
[MICROCHIP_PFSOC_DMA] = { 0x3000000, 0x100000 },
[MICROCHIP_PFSOC_L2LIM] = { 0x8000000, 0x200000 },
+ [MICROCHIP_PFSOC_L2ZERO] = { 0xa000000, 0x200000 },
[MICROCHIP_PFSOC_PLIC] = { 0xc000000, 0x4000000 },
[MICROCHIP_PFSOC_MMUART0] = { 0x20000000, 0x1000 },
[MICROCHIP_PFSOC_WDOG0] = { 0x20001000, 0x1000 },
@@ -200,6 +201,7 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
MemoryRegion *rsvd0_mem = g_new(MemoryRegion, 1);
MemoryRegion *e51_dtim_mem = g_new(MemoryRegion, 1);
MemoryRegion *l2lim_mem = g_new(MemoryRegion, 1);
+ MemoryRegion *l2zero_mem = g_new(MemoryRegion, 1);
MemoryRegion *envm_data = g_new(MemoryRegion, 1);
MemoryRegion *qspi_xip_mem = g_new(MemoryRegion, 1);
char *plic_hart_config;
@@ -277,6 +279,17 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
memmap[MICROCHIP_PFSOC_L2LIM].base,
l2lim_mem);
+ /*
+ * HSS decompresses into the L2 zero-device window and executes there.
+ * Model it as RAM because QEMU does not model the backing L2 cache.
+ */
+ memory_region_init_ram(l2zero_mem, NULL, "microchip.pfsoc.l2zero",
+ memmap[MICROCHIP_PFSOC_L2ZERO].size,
+ &error_fatal);
+ memory_region_add_subregion(system_memory,
+ memmap[MICROCHIP_PFSOC_L2ZERO].base,
+ l2zero_mem);
+
/* create PLIC hart topology configuration string */
plic_hart_config = riscv_plic_hart_config_string(ms->smp.cpus);
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 03/24] hw/misc: pfsoc: Support DDR training with newer HSS
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
2026-09-04 15:57 ` [PATCH v2 01/24] hw/riscv: pfsoc: Correct the L2LIM maximum mapped size Bin Meng
2026-09-04 15:57 ` [PATCH v2 02/24] hw/riscv: pfsoc: Map the L2 zero device window Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 04/24] hw/misc: pfsoc: Model L2 cache controller registers Bin Meng
` (22 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Conor Dooley, Sebastian Huber, qemu-riscv
HSS v2024.06 performs DDR and SGMII initialization through the DMC
register window before it can complete platform startup. The existing
model, which was validated against older version HSS in the early days,
exposes only a few fixed training results, so newer version HSS stalls
while waiting for PVT, PLL, DLL, ADDCMD, and verification status.
Update the DMC model by adding the minimum state and status behavior
needed by that firmware flow. Model the SGMII control registers,
main DDR PLL lock, deterministic ADDCMD transitions, and successful
gate and DQ/DQS verification. Keep training progress and writable
controls per device and clear them on reset.
These values are compatibility responses for HSS v2024.06 rather than
a cycle-accurate description of the DDR PHY. Document that limitation
in the source.
While we are here, update the license text to use the SPDX format.
Note at the time being there is an HSS bug [1] that consistenly blocks
the DDR traning from succeed when using an HSS image built from certain
version compiler like GCC 8.3.0. A patch [2] was proposed and verified
against HSS v2024.06.
[1] https://github.com/polarfire-soc/platform/issues/36
[2] https://github.com/processmission/qemu-machine-images/blob/main/
machine/riscv64/microchip-icicle-kit/
0001-mpfs_hal-preserve-DDR-pattern-test-parameters.patch
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- Use the Resettable API instead of a legacy reset handler
include/hw/misc/mchp_pfsoc_dmc.h | 6 +
hw/misc/mchp_pfsoc_dmc.c | 273 ++++++++++++++++++++++++++++---
2 files changed, 255 insertions(+), 24 deletions(-)
diff --git a/include/hw/misc/mchp_pfsoc_dmc.h b/include/hw/misc/mchp_pfsoc_dmc.h
index 2ed582fb8c..6a1986c2c2 100644
--- a/include/hw/misc/mchp_pfsoc_dmc.h
+++ b/include/hw/misc/mchp_pfsoc_dmc.h
@@ -28,10 +28,16 @@
/* DDR SGMII PHY module */
#define MCHP_PFSOC_DDR_SGMII_PHY_REG_SIZE 0x1000
+#define MCHP_PFSOC_DDR_SGMII_PHY_REG_NUM \
+ (MCHP_PFSOC_DDR_SGMII_PHY_REG_SIZE / sizeof(uint32_t))
typedef struct MchpPfSoCDdrSgmiiPhyState {
SysBusDevice parent;
MemoryRegion sgmii_phy;
+ uint32_t regs[MCHP_PFSOC_DDR_SGMII_PHY_REG_NUM];
+ uint8_t training_status_bit;
+ uint8_t addcmd_tap;
+ bool addcmd_move_active;
} MchpPfSoCDdrSgmiiPhyState;
#define TYPE_MCHP_PFSOC_DDR_SGMII_PHY "mchp.pfsoc.ddr_sgmii_phy"
diff --git a/hw/misc/mchp_pfsoc_dmc.c b/hw/misc/mchp_pfsoc_dmc.c
index 1fe4535464..96440dac62 100644
--- a/hw/misc/mchp_pfsoc_dmc.c
+++ b/hw/misc/mchp_pfsoc_dmc.c
@@ -2,22 +2,20 @@
* Microchip PolarFire SoC DDR Memory Controller module emulation
*
* Copyright (c) 2020 Wind River Systems, Inc.
+ * Copyright (c) 2026 Process Mission
*
* Author:
* Bin Meng <bin.meng@windriver.com>
*
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 or
- * (at your option) version 3 of the License.
+ * Updated by Bin Meng <bin.meng@processmission.com> to support DDR
+ * training emulation for with newer version Hart Software Services,
+ * aka HSS.
*
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * The DMC register model is based on HSS v2024.06. Its read/write
+ * behavior is the minimum needed for DDR training to complete and
+ * may not reflect actual hardware register behavior.
*
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, see <http://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: GPL-2.0-or-later
*/
#include "qemu/osdep.h"
@@ -29,17 +27,56 @@
/* DDR SGMII PHY module */
-#define SGMII_PHY_IOC_REG1 0x208
-#define SGMII_PHY_TRAINING_STATUS 0x814
-#define SGMII_PHY_DQ_DQS_ERR_DONE 0x834
-#define SGMII_PHY_DQDQS_STATUS1 0x84c
-#define SGMII_PHY_PVT_STAT 0xc20
+#define PHY_ADDCMD_CK_TRANSITION_TAP 12
+#define PHY_ADDCMD_A5_TRANSITION_TAP 20
+#define PHY_ADDCMD_CK_READBACK 5
+#define PHY_ADDCMD_A5_READBACK (3 << 8)
+#define PHY_GT_TXDLY_VALUE 0x01010101
+#define PHY_DQDQS_STATUS2_VALUE 5
+
+#define SGMII_PHY_PLL_CTRL_MAIN 0x084
+#define SGMII_PHY_PLL_CTRL_MAIN_CONTROL_LO_MASK 0x0000007f
+#define SGMII_PHY_PLL_CTRL_MAIN_LP_REQUIRES_LOCK BIT(24)
+#define SGMII_PHY_PLL_CTRL_MAIN_LOCK BIT(25)
+#define SGMII_PHY_IOC_REG1 0x208
+#define SGMII_PHY_TRAINING_STATUS 0x814
+#define SGMII_PHY_GT_ERR_COMB 0x81c
+#define SGMII_PHY_GT_CLK_SEL 0x820
+#define SGMII_PHY_GT_TXDLY 0x824
+#define SGMII_PHY_DQ_DQS_ERR_DONE 0x834
+#define SGMII_PHY_DQDQS_STATUS1 0x84c
+#define SGMII_PHY_DQDQS_STATUS2 0x850
+#define SGMII_PHY_EXPERT_DLYCNT_MOVE_REG1 0x880
+#define SGMII_PHY_EXPERT_DLYCNT_MOVE_CONTROL_MASK 0x001fffff
+#define SGMII_PHY_EXPERT_DLYCNT_MOVE_ADDCMD_MASK 0x00180000
+#define SGMII_PHY_EXPERT_DLYCNT_LOAD_REG1 0x890
+#define SGMII_PHY_EXPERT_DLYCNT_LOAD_CONTROL_MASK 0x001fffff
+#define SGMII_PHY_EXPERT_DLYCNT_LOAD_ADDCMD_MASK 0x00180000
+#define SGMII_PHY_EXPERT_ADDCMD_LN_READBACK 0x8ac
+#define SGMII_PHY_SOFT_RESET_SGMII 0xc00
+#define SGMII_PHY_SGMII_MODE 0xc04
+#define SGMII_PHY_PLL_CNTL 0xc08
+#define SGMII_PHY_PLL_CNTL_LOCK BIT(7)
+#define SGMII_PHY_CH0_CNTL 0xc0c
+#define SGMII_PHY_CH1_CNTL 0xc10
+#define SGMII_PHY_RECAL_CNTL 0xc14
+#define SGMII_PHY_RECAL_CNTL_STATUS_MASK 0xffff0000
+#define SGMII_PHY_RECAL_CNTL_LOCK BIT(23)
+#define SGMII_PHY_CLK_CNTL 0xc18
+#define SGMII_PHY_DYN_CNTL 0xc1c
+#define SGMII_PHY_PVT_STAT 0xc20
+#define SGMII_PHY_PVT_STAT_IO_ENABLE BIT(6)
+#define SGMII_PHY_PVT_STAT_CALIBRATED BIT(14)
+#define SGMII_PHY_PVT_STAT_GUEST_CTRL_MASK 0xc0000000
+#define SGMII_PHY_SPARE_CNTL 0xc24
+#define SGMII_PHY_SPARE_STAT 0xc28
static uint64_t mchp_pfsoc_ddr_sgmii_phy_read(void *opaque, hwaddr offset,
unsigned size)
{
uint32_t val = 0;
- static int training_status_bit;
+ MchpPfSoCDdrSgmiiPhyState *s = opaque;
+ uint32_t index = offset / sizeof(uint32_t);
switch (offset) {
case SGMII_PHY_IOC_REG1:
@@ -53,8 +90,8 @@ static uint64_t mchp_pfsoc_ddr_sgmii_phy_read(void *opaque, hwaddr offset,
*
* See ddr_setup() in mss_ddr.c in the HSS source codes.
*/
- val = 1 << training_status_bit;
- training_status_bit = (training_status_bit + 1) % 5;
+ val = BIT(s->training_status_bit);
+ s->training_status_bit = (s->training_status_bit + 1) % 5;
break;
case SGMII_PHY_DQ_DQS_ERR_DONE:
/*
@@ -71,8 +108,106 @@ static uint64_t mchp_pfsoc_ddr_sgmii_phy_read(void *opaque, hwaddr offset,
val = 0xff;
break;
case SGMII_PHY_PVT_STAT:
- /* See sgmii_channel_setup() in HSS */
- val = BIT(14) | BIT(6);
+ /*
+ * HSS polls IO enable and calibration status, then writes the
+ * calibration lock. The HSS register definitions mark bits 31:30
+ * as writable controls.
+ *
+ * See sgmii_channel_setup() in mss_sgmii.c in HSS.
+ */
+ val = s->regs[index] | SGMII_PHY_PVT_STAT_IO_ENABLE |
+ SGMII_PHY_PVT_STAT_CALIBRATED;
+ break;
+ case SGMII_PHY_PLL_CTRL_MAIN:
+ /*
+ * HSS programs the main DDR PLL controls and polls LOCK after
+ * changing the PLL dividers during LPDDR4 manual training. The
+ * HSS register definitions mark bits 6:0 and 24 as writable.
+ *
+ * See ddr_pll_config() in mss_pll.c and
+ * lpddr4_manual_training() in mss_ddr.c in HSS.
+ */
+ val = s->regs[index] | SGMII_PHY_PLL_CTRL_MAIN_LOCK;
+ break;
+ case SGMII_PHY_PLL_CNTL:
+ /*
+ * HSS programs the SGMII PLL controls and polls aro_pll0_lock.
+ *
+ * See setup_sgmii_rpc_per_config() and sgmii_channel_setup()
+ * in mss_sgmii.c in HSS.
+ */
+ val = s->regs[index] | SGMII_PHY_PLL_CNTL_LOCK;
+ break;
+ case SGMII_PHY_RECAL_CNTL:
+ /*
+ * HSS programs the low control half, polls sro_dll_lock, and
+ * reads sro_dll_90_code from the read-only status half.
+ *
+ * See setup_sgmii_rpc_per_config() and sgmii_channel_setup()
+ * in mss_sgmii.c in HSS.
+ */
+ val = s->regs[index] | SGMII_PHY_RECAL_CNTL_LOCK;
+ break;
+ case SGMII_PHY_EXPERT_ADDCMD_LN_READBACK:
+ /*
+ * HSS pulses the ADDCMD move controls while sampling CK from
+ * bits 3:0 and A5 from bits 9:8. The transition tap positions
+ * below are deterministic QEMU model choices.
+ *
+ * See lpddr4_manual_training() in mss_ddr.c in HSS.
+ */
+ if (s->addcmd_tap >= PHY_ADDCMD_CK_TRANSITION_TAP) {
+ val |= PHY_ADDCMD_CK_READBACK;
+ }
+ if (s->addcmd_tap >= PHY_ADDCMD_A5_TRANSITION_TAP) {
+ val |= PHY_ADDCMD_A5_READBACK;
+ }
+ break;
+ case SGMII_PHY_GT_ERR_COMB:
+ case SGMII_PHY_GT_CLK_SEL:
+ /*
+ * HSS fails DDR verification on any gate error, a zero delay
+ * selected by gt_clk_sel, or more than one zero delay byte.
+ * Model no gate errors; the all-nonzero delay below makes the
+ * deterministic clock selection immaterial.
+ *
+ * See DDR_TRAINING_IP_SM_VERIFY in ddr_setup() in mss_ddr.c
+ * in HSS.
+ */
+ val = 0;
+ break;
+ case SGMII_PHY_GT_TXDLY:
+ val = PHY_GT_TXDLY_VALUE;
+ break;
+ case SGMII_PHY_DQDQS_STATUS2:
+ /*
+ * HSS requires the calculated DQ/DQS window to be at least
+ * DQ_DQS_NUM_TAPS, which is 5. Return the minimum pass value.
+ *
+ * See DDR_TRAINING_IP_SM_VERIFY in ddr_setup() and the
+ * DQ_DQS_NUM_TAPS definition in mss_ddr.h in HSS.
+ */
+ val = PHY_DQDQS_STATUS2_VALUE;
+ break;
+ case SGMII_PHY_EXPERT_DLYCNT_MOVE_REG1:
+ case SGMII_PHY_EXPERT_DLYCNT_LOAD_REG1:
+ case SGMII_PHY_SOFT_RESET_SGMII:
+ case SGMII_PHY_SGMII_MODE:
+ case SGMII_PHY_CH0_CNTL:
+ case SGMII_PHY_CH1_CNTL:
+ case SGMII_PHY_CLK_CNTL:
+ case SGMII_PHY_DYN_CNTL:
+ case SGMII_PHY_SPARE_CNTL:
+ case SGMII_PHY_SPARE_STAT:
+ /*
+ * HSS programs the ADDCMD and SGMII controls and reads
+ * SPARE_STAT to classify the silicon and select eye-width
+ * thresholds.
+ *
+ * See lpddr4_manual_training() in mss_ddr.c and the SGMII setup
+ * functions in mss_sgmii.c in HSS.
+ */
+ val = s->regs[index];
break;
default:
qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
@@ -87,10 +222,88 @@ static uint64_t mchp_pfsoc_ddr_sgmii_phy_read(void *opaque, hwaddr offset,
static void mchp_pfsoc_ddr_sgmii_phy_write(void *opaque, hwaddr offset,
uint64_t value, unsigned size)
{
- qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
- "(size %d, value 0x%" PRIx64
- ", offset 0x%" HWADDR_PRIx ")\n",
- __func__, size, value, offset);
+ MchpPfSoCDdrSgmiiPhyState *s = opaque;
+ uint32_t index = offset / sizeof(uint32_t);
+
+ switch (offset) {
+ case SGMII_PHY_IOC_REG1:
+ case SGMII_PHY_TRAINING_STATUS:
+ case SGMII_PHY_GT_ERR_COMB:
+ case SGMII_PHY_GT_CLK_SEL:
+ case SGMII_PHY_GT_TXDLY:
+ case SGMII_PHY_DQ_DQS_ERR_DONE:
+ case SGMII_PHY_DQDQS_STATUS1:
+ case SGMII_PHY_DQDQS_STATUS2:
+ case SGMII_PHY_EXPERT_ADDCMD_LN_READBACK:
+ case SGMII_PHY_SPARE_STAT:
+ /*
+ * The HSS register definitions declare these status and
+ * readback registers read-only.
+ *
+ * See mss_ddr_sgmii_phy_defs.h in HSS.
+ */
+ return;
+ case SGMII_PHY_PLL_CTRL_MAIN:
+ value &= SGMII_PHY_PLL_CTRL_MAIN_CONTROL_LO_MASK |
+ SGMII_PHY_PLL_CTRL_MAIN_LP_REQUIRES_LOCK;
+ break;
+ case SGMII_PHY_PLL_CNTL:
+ value &= ~SGMII_PHY_PLL_CNTL_LOCK;
+ break;
+ case SGMII_PHY_RECAL_CNTL:
+ value &= ~SGMII_PHY_RECAL_CNTL_STATUS_MASK;
+ break;
+ case SGMII_PHY_PVT_STAT:
+ value &= SGMII_PHY_PVT_STAT_GUEST_CTRL_MASK;
+ break;
+ case SGMII_PHY_EXPERT_DLYCNT_MOVE_REG1: {
+ bool active;
+
+ /*
+ * HSS pulses 0 -> 0x180000 -> 0 while scanning the ADDCMD eye.
+ * Count each rising pulse as one abstract delay tap.
+ *
+ * See lpddr4_manual_training() in mss_ddr.c in HSS.
+ */
+ value &= SGMII_PHY_EXPERT_DLYCNT_MOVE_CONTROL_MASK;
+ active = value & SGMII_PHY_EXPERT_DLYCNT_MOVE_ADDCMD_MASK;
+ if (active && !s->addcmd_move_active &&
+ s->addcmd_tap != UINT8_MAX) {
+ s->addcmd_tap++;
+ }
+ s->addcmd_move_active = active;
+ break;
+ }
+ case SGMII_PHY_EXPERT_DLYCNT_LOAD_REG1:
+ /*
+ * HSS pulses 0x180000 before each ADDCMD scan. Restart the
+ * abstract QEMU tap position when that load pulse is asserted.
+ *
+ * See lpddr4_manual_training() in mss_ddr.c in HSS.
+ */
+ value &= SGMII_PHY_EXPERT_DLYCNT_LOAD_CONTROL_MASK;
+ if (value & SGMII_PHY_EXPERT_DLYCNT_LOAD_ADDCMD_MASK) {
+ s->addcmd_tap = 0;
+ s->addcmd_move_active = false;
+ }
+ break;
+ case SGMII_PHY_SOFT_RESET_SGMII:
+ case SGMII_PHY_SGMII_MODE:
+ case SGMII_PHY_CH0_CNTL:
+ case SGMII_PHY_CH1_CNTL:
+ case SGMII_PHY_CLK_CNTL:
+ case SGMII_PHY_DYN_CNTL:
+ case SGMII_PHY_SPARE_CNTL:
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
+ "(size %d, value 0x%" PRIx64
+ ", offset 0x%" HWADDR_PRIx ")\n",
+ __func__, size, value, offset);
+ return;
+ }
+
+ s->regs[index] = value;
}
static const MemoryRegionOps mchp_pfsoc_ddr_sgmii_phy_ops = {
@@ -99,6 +312,16 @@ static const MemoryRegionOps mchp_pfsoc_ddr_sgmii_phy_ops = {
.endianness = DEVICE_LITTLE_ENDIAN,
};
+static void mchp_pfsoc_ddr_sgmii_phy_reset_hold(Object *obj, ResetType type)
+{
+ MchpPfSoCDdrSgmiiPhyState *s = MCHP_PFSOC_DDR_SGMII_PHY(obj);
+
+ memset(s->regs, 0, sizeof(s->regs));
+ s->training_status_bit = 0;
+ s->addcmd_tap = 0;
+ s->addcmd_move_active = false;
+}
+
static void mchp_pfsoc_ddr_sgmii_phy_realize(DeviceState *dev, Error **errp)
{
MchpPfSoCDdrSgmiiPhyState *s = MCHP_PFSOC_DDR_SGMII_PHY(dev);
@@ -114,9 +337,11 @@ static void mchp_pfsoc_ddr_sgmii_phy_class_init(ObjectClass *klass,
const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
+ ResettableClass *rc = RESETTABLE_CLASS(klass);
dc->desc = "Microchip PolarFire SoC DDR SGMII PHY module";
dc->realize = mchp_pfsoc_ddr_sgmii_phy_realize;
+ rc->phases.hold = mchp_pfsoc_ddr_sgmii_phy_reset_hold;
}
static const TypeInfo mchp_pfsoc_ddr_sgmii_phy_info = {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 04/24] hw/misc: pfsoc: Model L2 cache controller registers
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (2 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 03/24] hw/misc: pfsoc: Support DDR training with newer HSS Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:38 ` Philippe Mathieu-Daudé
2026-09-04 15:57 ` [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM Bin Meng
` (21 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Alistair Francis, Conor Dooley, Paolo Bonzini, Sebastian Huber,
qemu-riscv
Implement the Config, WayEnable, and per-master WayMask registers
described by the PolarFire SoC MSS reference manual. Make WayEnable
monotonic and report the remaining register space as unimplemented.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
---
Changes in v2:
- Use the Resettable API instead of a legacy reset handler
MAINTAINERS | 2 +
include/hw/misc/mchp_pfsoc_l2cc.h | 30 +++++
hw/misc/mchp_pfsoc_l2cc.c | 180 ++++++++++++++++++++++++++++++
hw/misc/Kconfig | 3 +
hw/misc/meson.build | 1 +
5 files changed, 216 insertions(+)
create mode 100644 include/hw/misc/mchp_pfsoc_l2cc.h
create mode 100644 hw/misc/mchp_pfsoc_l2cc.c
diff --git a/MAINTAINERS b/MAINTAINERS
index f524d90523..d7615b2c2c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1795,11 +1795,13 @@ F: hw/riscv/microchip_pfsoc.c
F: hw/char/mchp_pfsoc_mmuart.c
F: hw/misc/mchp_pfsoc_dmc.c
F: hw/misc/mchp_pfsoc_ioscb.c
+F: hw/misc/mchp_pfsoc_l2cc.c
F: hw/misc/mchp_pfsoc_sysreg.c
F: include/hw/riscv/microchip_pfsoc.h
F: include/hw/char/mchp_pfsoc_mmuart.h
F: include/hw/misc/mchp_pfsoc_dmc.h
F: include/hw/misc/mchp_pfsoc_ioscb.h
+F: include/hw/misc/mchp_pfsoc_l2cc.h
F: include/hw/misc/mchp_pfsoc_sysreg.h
Shakti C class SoC
diff --git a/include/hw/misc/mchp_pfsoc_l2cc.h b/include/hw/misc/mchp_pfsoc_l2cc.h
new file mode 100644
index 0000000000..1b5b3888d5
--- /dev/null
+++ b/include/hw/misc/mchp_pfsoc_l2cc.h
@@ -0,0 +1,30 @@
+/*
+ * Microchip PolarFire SoC L2 cache controller
+ *
+ * Copyright (c) 2026 Process Mission
+ *
+ * Author:
+ * Bin Meng <bin.meng@processmission.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef MCHP_PFSOC_L2CC_H
+#define MCHP_PFSOC_L2CC_H
+
+#include "hw/core/register.h"
+#include "hw/core/sysbus.h"
+
+#define MCHP_PFSOC_L2CC_REG_SIZE 0x1000
+#define MCHP_PFSOC_L2CC_REG_NUM (MCHP_PFSOC_L2CC_REG_SIZE / 8)
+
+typedef struct MchpPfSoCL2ccState {
+ SysBusDevice parent;
+ uint64_t regs[MCHP_PFSOC_L2CC_REG_NUM];
+ RegisterInfo regs_info[MCHP_PFSOC_L2CC_REG_NUM];
+} MchpPfSoCL2ccState;
+
+#define TYPE_MCHP_PFSOC_L2CC "mchp.pfsoc.l2cc"
+OBJECT_DECLARE_SIMPLE_TYPE(MchpPfSoCL2ccState, MCHP_PFSOC_L2CC)
+
+#endif
diff --git a/hw/misc/mchp_pfsoc_l2cc.c b/hw/misc/mchp_pfsoc_l2cc.c
new file mode 100644
index 0000000000..979d904676
--- /dev/null
+++ b/hw/misc/mchp_pfsoc_l2cc.c
@@ -0,0 +1,180 @@
+/*
+ * Microchip PolarFire SoC L2 cache controller
+ *
+ * Copyright (c) 2026 Process Mission
+ *
+ * Author:
+ * Bin Meng <bin.meng@processmission.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/core/register.h"
+#include "hw/core/registerfields.h"
+#include "hw/misc/mchp_pfsoc_l2cc.h"
+
+REG64(L2_CONFIG, 0x000)
+ FIELD(L2_CONFIG, BANKS, 0, 8)
+ FIELD(L2_CONFIG, WAYS, 8, 8)
+ FIELD(L2_CONFIG, SETS, 16, 8)
+ FIELD(L2_CONFIG, BYTES, 24, 8)
+REG64(L2_WAY_ENABLE, 0x008)
+ FIELD(L2_WAY_ENABLE, VALUE, 0, 8)
+REG64(L2_WAY_MASK_DMA, 0x800)
+REG64(L2_WAY_MASK_AXI4_PORT_0, 0x808)
+REG64(L2_WAY_MASK_AXI4_PORT_1, 0x810)
+REG64(L2_WAY_MASK_AXI4_PORT_2, 0x818)
+REG64(L2_WAY_MASK_AXI4_PORT_3, 0x820)
+REG64(L2_WAY_MASK_HART0_DCACHE, 0x828)
+REG64(L2_WAY_MASK_HART0_ICACHE, 0x830)
+REG64(L2_WAY_MASK_HART1_DCACHE, 0x838)
+REG64(L2_WAY_MASK_HART1_ICACHE, 0x840)
+REG64(L2_WAY_MASK_HART2_DCACHE, 0x848)
+REG64(L2_WAY_MASK_HART2_ICACHE, 0x850)
+REG64(L2_WAY_MASK_HART3_DCACHE, 0x858)
+REG64(L2_WAY_MASK_HART3_ICACHE, 0x860)
+REG64(L2_WAY_MASK_HART4_DCACHE, 0x868)
+REG64(L2_WAY_MASK_HART4_ICACHE, 0x870)
+
+#define L2_CONFIG_RESET 0x06091004
+
+static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
+ uint64_t value)
+{
+ uint64_t current = *(uint64_t *)reg->data;
+
+ return MAX(current, value);
+}
+
+#define WAY_MASK_REGISTER(_name) \
+ { \
+ .name = "WAY_MASK_" #_name, \
+ .addr = A_L2_WAY_MASK_ ## _name, \
+ .reset = UINT64_MAX, \
+ }
+
+static const RegisterAccessInfo mchp_pfsoc_l2cc_regs_info[] = {
+ {
+ .name = "CONFIG",
+ .addr = A_L2_CONFIG,
+ .reset = L2_CONFIG_RESET,
+ .ro = UINT64_MAX,
+ }, {
+ .name = "WAY_ENABLE",
+ .addr = A_L2_WAY_ENABLE,
+ .rsvd = ~R_L2_WAY_ENABLE_VALUE_MASK,
+ .pre_write = mchp_pfsoc_l2cc_way_enable_pre_write,
+ },
+ WAY_MASK_REGISTER(DMA),
+ WAY_MASK_REGISTER(AXI4_PORT_0),
+ WAY_MASK_REGISTER(AXI4_PORT_1),
+ WAY_MASK_REGISTER(AXI4_PORT_2),
+ WAY_MASK_REGISTER(AXI4_PORT_3),
+ WAY_MASK_REGISTER(HART0_DCACHE),
+ WAY_MASK_REGISTER(HART0_ICACHE),
+ WAY_MASK_REGISTER(HART1_DCACHE),
+ WAY_MASK_REGISTER(HART1_ICACHE),
+ WAY_MASK_REGISTER(HART2_DCACHE),
+ WAY_MASK_REGISTER(HART2_ICACHE),
+ WAY_MASK_REGISTER(HART3_DCACHE),
+ WAY_MASK_REGISTER(HART3_ICACHE),
+ WAY_MASK_REGISTER(HART4_DCACHE),
+ WAY_MASK_REGISTER(HART4_ICACHE),
+};
+
+static bool mchp_pfsoc_l2cc_register_implemented(hwaddr offset)
+{
+ size_t i;
+
+ for (i = 0; i < ARRAY_SIZE(mchp_pfsoc_l2cc_regs_info); i++) {
+ if (mchp_pfsoc_l2cc_regs_info[i].addr == offset) {
+ return true;
+ }
+ }
+
+ return false;
+}
+
+static uint64_t mchp_pfsoc_l2cc_read(void *opaque, hwaddr offset,
+ unsigned size)
+{
+ if (mchp_pfsoc_l2cc_register_implemented(offset)) {
+ return register_read_memory(opaque, offset, size);
+ }
+
+ qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
+ "(size %u, offset 0x%" HWADDR_PRIx ")\n",
+ __func__, size, offset);
+ return 0;
+}
+
+static void mchp_pfsoc_l2cc_write(void *opaque, hwaddr offset,
+ uint64_t value, unsigned size)
+{
+ if (mchp_pfsoc_l2cc_register_implemented(offset)) {
+ register_write_memory(opaque, offset, value, size);
+ return;
+ }
+
+ qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
+ "(size %u, value 0x%" PRIx64
+ ", offset 0x%" HWADDR_PRIx ")\n",
+ __func__, size, value, offset);
+}
+
+static const MemoryRegionOps mchp_pfsoc_l2cc_ops = {
+ .read = mchp_pfsoc_l2cc_read,
+ .write = mchp_pfsoc_l2cc_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = { .min_access_size = 1, .max_access_size = 8 },
+ .impl = { .min_access_size = 1, .max_access_size = 8 },
+};
+
+static void mchp_pfsoc_l2cc_reset_hold(Object *obj, ResetType type)
+{
+ MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(obj);
+ size_t i;
+
+ memset(s->regs, 0, sizeof(s->regs));
+ for (i = 0; i < ARRAY_SIZE(mchp_pfsoc_l2cc_regs_info); i++) {
+ hwaddr addr = mchp_pfsoc_l2cc_regs_info[i].addr;
+
+ register_reset(&s->regs_info[addr / sizeof(uint64_t)]);
+ }
+}
+
+static void mchp_pfsoc_l2cc_init(Object *obj)
+{
+ MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(obj);
+ RegisterInfoArray *reg_array;
+
+ reg_array = register_init_block64(
+ DEVICE(obj), mchp_pfsoc_l2cc_regs_info,
+ ARRAY_SIZE(mchp_pfsoc_l2cc_regs_info), s->regs_info, s->regs,
+ &mchp_pfsoc_l2cc_ops, false, MCHP_PFSOC_L2CC_REG_SIZE);
+ sysbus_init_mmio(SYS_BUS_DEVICE(obj), ®_array->mem);
+}
+
+static void mchp_pfsoc_l2cc_class_init(ObjectClass *klass, const void *data)
+{
+ ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+ rc->phases.hold = mchp_pfsoc_l2cc_reset_hold;
+}
+
+static const TypeInfo mchp_pfsoc_l2cc_info = {
+ .name = TYPE_MCHP_PFSOC_L2CC,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(MchpPfSoCL2ccState),
+ .instance_init = mchp_pfsoc_l2cc_init,
+ .class_init = mchp_pfsoc_l2cc_class_init,
+};
+
+static void mchp_pfsoc_l2cc_register_types(void)
+{
+ type_register_static(&mchp_pfsoc_l2cc_info);
+}
+
+type_init(mchp_pfsoc_l2cc_register_types)
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 46e3c03cc8..d78880d5b3 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -203,6 +203,9 @@ config MCHP_PFSOC_DMC
config MCHP_PFSOC_IOSCB
bool
+config MCHP_PFSOC_L2CC
+ bool
+
config MCHP_PFSOC_SYSREG
bool
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 54e07aacda..3eeb204f56 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -32,6 +32,7 @@ system_ss.add(when: 'CONFIG_VIRT_CTRL', if_true: files('virt_ctrl.c'))
system_ss.add(when: 'CONFIG_K230', if_true: files('k230_ddr.c'))
system_ss.add(when: 'CONFIG_MCHP_PFSOC_DMC', if_true: files('mchp_pfsoc_dmc.c'))
system_ss.add(when: 'CONFIG_MCHP_PFSOC_IOSCB', if_true: files('mchp_pfsoc_ioscb.c'))
+system_ss.add(when: 'CONFIG_MCHP_PFSOC_L2CC', if_true: files('mchp_pfsoc_l2cc.c'))
system_ss.add(when: 'CONFIG_MCHP_PFSOC_SYSREG', if_true: files('mchp_pfsoc_sysreg.c'))
system_ss.add(when: 'CONFIG_SIFIVE_TEST', if_true: files('sifive_test.c'))
system_ss.add(when: 'CONFIG_SIFIVE_E_PRCI', if_true: files('sifive_e_prci.c'))
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (3 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 04/24] hw/misc: pfsoc: Model L2 cache controller registers Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:38 ` Philippe Mathieu-Daudé
2026-09-04 15:57 ` [PATCH v2 06/24] tests/qtest: Add PolarFire SoC L2CC coverage Bin Meng
` (20 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Paolo Bonzini, Sebastian Huber,
Weiwei Li, qemu-riscv
Instantiate the L2CC in the PolarFire SoC machine and connect its
WayEnable register to the L2-LIM MemoryRegion. Back the complete 2 MiB
aperture and shrink it by 128 KiB for each cache way enabled.
Keep L2 Zero at its fixed aperture because it represents a cache
allocation window rather than the remaining L2-LIM capacity.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
include/hw/misc/mchp_pfsoc_l2cc.h | 1 +
include/hw/riscv/microchip_pfsoc.h | 2 ++
hw/misc/mchp_pfsoc_l2cc.c | 51 ++++++++++++++++++++++++++++++
hw/riscv/microchip_pfsoc.c | 23 +++++++-------
hw/riscv/Kconfig | 1 +
5 files changed, 67 insertions(+), 11 deletions(-)
diff --git a/include/hw/misc/mchp_pfsoc_l2cc.h b/include/hw/misc/mchp_pfsoc_l2cc.h
index 1b5b3888d5..3a175a6340 100644
--- a/include/hw/misc/mchp_pfsoc_l2cc.h
+++ b/include/hw/misc/mchp_pfsoc_l2cc.h
@@ -22,6 +22,7 @@ typedef struct MchpPfSoCL2ccState {
SysBusDevice parent;
uint64_t regs[MCHP_PFSOC_L2CC_REG_NUM];
RegisterInfo regs_info[MCHP_PFSOC_L2CC_REG_NUM];
+ MemoryRegion *l2lim;
} MchpPfSoCL2ccState;
#define TYPE_MCHP_PFSOC_L2CC "mchp.pfsoc.l2cc"
diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index 612fd2b69c..0aeccedf77 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -27,6 +27,7 @@
#include "hw/cpu/cluster.h"
#include "hw/dma/sifive_pdma.h"
#include "hw/misc/mchp_pfsoc_dmc.h"
+#include "hw/misc/mchp_pfsoc_l2cc.h"
#include "hw/misc/mchp_pfsoc_ioscb.h"
#include "hw/misc/mchp_pfsoc_sysreg.h"
#include "hw/net/cadence_gem.h"
@@ -43,6 +44,7 @@ typedef struct MicrochipPFSoCState {
RISCVHartArrayState e_cpus;
RISCVHartArrayState u_cpus;
DeviceState *plic;
+ MchpPfSoCL2ccState l2cc;
MchpPfSoCDdrSgmiiPhyState ddr_sgmii_phy;
MchpPfSoCDdrCfgState ddr_cfg;
MchpPfSoCIoscbState ioscb;
diff --git a/hw/misc/mchp_pfsoc_l2cc.c b/hw/misc/mchp_pfsoc_l2cc.c
index 979d904676..4b87c963fc 100644
--- a/hw/misc/mchp_pfsoc_l2cc.c
+++ b/hw/misc/mchp_pfsoc_l2cc.c
@@ -11,6 +11,9 @@
#include "qemu/osdep.h"
#include "qemu/log.h"
+#include "qemu/units.h"
+#include "qapi/error.h"
+#include "hw/core/qdev-properties.h"
#include "hw/core/register.h"
#include "hw/core/registerfields.h"
#include "hw/misc/mchp_pfsoc_l2cc.h"
@@ -39,6 +42,25 @@ REG64(L2_WAY_MASK_HART4_DCACHE, 0x868)
REG64(L2_WAY_MASK_HART4_ICACHE, 0x870)
#define L2_CONFIG_RESET 0x06091004
+#define L2_LIM_WAY_COUNT 15
+#define L2_WAY_SIZE (128 * KiB)
+
+static void mchp_pfsoc_l2cc_update_l2lim(MchpPfSoCL2ccState *s,
+ uint64_t way_enable)
+{
+ uint64_t l2lim_size;
+
+ if (way_enable >= L2_LIM_WAY_COUNT) {
+ l2lim_size = 0;
+ } else {
+ l2lim_size = (L2_LIM_WAY_COUNT - way_enable) * L2_WAY_SIZE;
+ }
+
+ memory_region_transaction_begin();
+ memory_region_set_size(s->l2lim, l2lim_size);
+ memory_region_set_enabled(s->l2lim, l2lim_size != 0);
+ memory_region_transaction_commit();
+}
static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
uint64_t value)
@@ -48,6 +70,14 @@ static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
return MAX(current, value);
}
+static void mchp_pfsoc_l2cc_way_enable_post_write(RegisterInfo *reg,
+ uint64_t value)
+{
+ MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(reg->opaque);
+
+ mchp_pfsoc_l2cc_update_l2lim(s, value);
+}
+
#define WAY_MASK_REGISTER(_name) \
{ \
.name = "WAY_MASK_" #_name, \
@@ -66,6 +96,7 @@ static const RegisterAccessInfo mchp_pfsoc_l2cc_regs_info[] = {
.addr = A_L2_WAY_ENABLE,
.rsvd = ~R_L2_WAY_ENABLE_VALUE_MASK,
.pre_write = mchp_pfsoc_l2cc_way_enable_pre_write,
+ .post_write = mchp_pfsoc_l2cc_way_enable_post_write,
},
WAY_MASK_REGISTER(DMA),
WAY_MASK_REGISTER(AXI4_PORT_0),
@@ -157,11 +188,31 @@ static void mchp_pfsoc_l2cc_init(Object *obj)
sysbus_init_mmio(SYS_BUS_DEVICE(obj), ®_array->mem);
}
+static void mchp_pfsoc_l2cc_realize(DeviceState *dev, Error **errp)
+{
+ MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(dev);
+
+ if (!s->l2lim) {
+ error_setg(errp, TYPE_MCHP_PFSOC_L2CC ": 'l2-lim' link not set");
+ return;
+ }
+
+ mchp_pfsoc_l2cc_update_l2lim(s, s->regs[R_L2_WAY_ENABLE]);
+}
+
+static const Property mchp_pfsoc_l2cc_properties[] = {
+ DEFINE_PROP_LINK("l2-lim", MchpPfSoCL2ccState, l2lim,
+ TYPE_MEMORY_REGION, MemoryRegion *),
+};
+
static void mchp_pfsoc_l2cc_class_init(ObjectClass *klass, const void *data)
{
+ DeviceClass *dc = DEVICE_CLASS(klass);
ResettableClass *rc = RESETTABLE_CLASS(klass);
rc->phases.hold = mchp_pfsoc_l2cc_reset_hold;
+ device_class_set_props(dc, mchp_pfsoc_l2cc_properties);
+ dc->realize = mchp_pfsoc_l2cc_realize;
}
static const TypeInfo mchp_pfsoc_l2cc_info = {
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 8106dbb3ad..114567867b 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -174,6 +174,9 @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
object_initialize_child(obj, "dma-controller", &s->dma,
TYPE_SIFIVE_PDMA);
+ object_initialize_child(obj, "l2-cache-controller", &s->l2cc,
+ TYPE_MCHP_PFSOC_L2CC);
+
object_initialize_child(obj, "sysreg", &s->sysreg,
TYPE_MCHP_PFSOC_SYSREG);
@@ -260,18 +263,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
iks->clint_timebase_freq, false);
- /* L2 cache controller */
- create_unimplemented_device("microchip.pfsoc.l2cc",
- memmap[MICROCHIP_PFSOC_L2CC].base, memmap[MICROCHIP_PFSOC_L2CC].size);
-
/*
- * Add L2-LIM at reset size.
- * This should be reduced in size as the L2 Cache Controller WayEnable
- * register is incremented. Unfortunately I don't see a nice (or any) way
- * to handle reducing or blocking out the L2 LIM while still allowing it
- * be re returned to all enabled after a reset. For the time being, just
- * leave it enabled all the time. This won't break anything, but will be
- * too generous to misbehaving guests.
+ * Back the complete L2-LIM aperture. The L2 cache controller resizes
+ * this MemoryRegion to 128 KiB for every way assigned to L2-LIM.
*/
memory_region_init_ram(l2lim_mem, NULL, "microchip.pfsoc.l2lim",
memmap[MICROCHIP_PFSOC_L2LIM].size, &error_fatal);
@@ -279,6 +273,13 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
memmap[MICROCHIP_PFSOC_L2LIM].base,
l2lim_mem);
+ /* L2 cache controller */
+ object_property_set_link(OBJECT(&s->l2cc), "l2-lim",
+ OBJECT(l2lim_mem), &error_abort);
+ sysbus_realize(SYS_BUS_DEVICE(&s->l2cc), errp);
+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->l2cc), 0,
+ memmap[MICROCHIP_PFSOC_L2CC].base);
+
/*
* HSS decompresses into the L2 zero-device window and executes there.
* Model it as RAM because QEMU does not model the backing L2 cache.
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index d06ac26648..85b535c7cb 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -18,6 +18,7 @@ config MICROCHIP_PFSOC
select DEVICE_TREE
select MCHP_PFSOC_DMC
select MCHP_PFSOC_IOSCB
+ select MCHP_PFSOC_L2CC
select MCHP_PFSOC_MMUART
select MCHP_PFSOC_SYSREG
select RISCV_ACLINT
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 06/24] tests/qtest: Add PolarFire SoC L2CC coverage
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (4 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 07/24] hw/sd: sdhci: Run ADMA independently of MMIO Bin Meng
` (19 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Conor Dooley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini,
Sebastian Huber, qemu-riscv
Add a dedicated qtest binary for L2CC register and memory-topology
behavior.
Exercise Config, WayEnable, and every WayMask register, including
reset, monotonic writes, and unimplemented-register logging. Verify
that WayEnable resizes the guest-visible L2-LIM region while L2 Zero
remains fixed at the modeled 2 MiB size.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
(no changes since v1)
MAINTAINERS | 1 +
tests/qtest/mchp_pfsoc_l2cc_test.c | 221 +++++++++++++++++++++++++++++
tests/qtest/meson.build | 2 +
3 files changed, 224 insertions(+)
create mode 100644 tests/qtest/mchp_pfsoc_l2cc_test.c
diff --git a/MAINTAINERS b/MAINTAINERS
index d7615b2c2c..8b7319d3d0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1803,6 +1803,7 @@ F: include/hw/misc/mchp_pfsoc_dmc.h
F: include/hw/misc/mchp_pfsoc_ioscb.h
F: include/hw/misc/mchp_pfsoc_l2cc.h
F: include/hw/misc/mchp_pfsoc_sysreg.h
+F: tests/qtest/mchp_pfsoc_l2cc_test.c
Shakti C class SoC
L: qemu-riscv@nongnu.org
diff --git a/tests/qtest/mchp_pfsoc_l2cc_test.c b/tests/qtest/mchp_pfsoc_l2cc_test.c
new file mode 100644
index 0000000000..3401ce4300
--- /dev/null
+++ b/tests/qtest/mchp_pfsoc_l2cc_test.c
@@ -0,0 +1,221 @@
+/*
+ * QTest testcase for the Microchip PolarFire SoC L2 cache controller
+ *
+ * Copyright (c) 2026 Process Mission
+ *
+ * Author:
+ * Bin Meng <bin.meng@processmission.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "libqtest.h"
+
+#define L2CC_BASE 0x02010000
+#define L2CC_CONFIG 0x000
+#define L2CC_CONFIG_VALUE 0x06091004
+#define L2CC_WAY_ENABLE 0x008
+#define L2CC_ECC_INJECT 0x040
+#define L2CC_FLUSH64 0x200
+#define L2CC_WAY_MASK_BASE 0x800
+#define L2CC_WAY_MASK_COUNT 15
+#define L2CC_WAY_MASK(n) (L2CC_WAY_MASK_BASE + 8 * (n))
+#define L2CC_MASTER15 L2CC_WAY_MASK(L2CC_WAY_MASK_COUNT)
+#define L2CC_WAY_ENABLE_RESET 0
+#define L2CC_WAY_MASK_RESET UINT64_MAX
+
+#define L2_LIM_BASE 0x08000000
+#define L2_WAY_SIZE (128 * KiB)
+#define L2_LIM_RESET_WAYS 15
+#define L2_ZERO_BASE 0x0a000000
+#define L2_ZERO_SIZE (2 * MiB)
+
+static QTestState *mchp_pfsoc_l2cc_start(const char *firmware)
+{
+ return qtest_initf("-machine microchip-icicle-kit -smp 5 -m 2G "
+ "-bios \"%s\"", firmware);
+}
+
+static char *mchp_pfsoc_l2cc_create_firmware(void)
+{
+ static const uint8_t firmware[] = {
+ 0x13, 0x00, 0x00, 0x00,
+ 0x6f, 0x00, 0x00, 0x00,
+ };
+ char *path;
+ int fd;
+ ssize_t written;
+
+ fd = g_file_open_tmp("mchp_pfsoc_l2cc_XXXXXX", &path, NULL);
+ g_assert_cmpint(fd, >=, 0);
+
+ written = write(fd, firmware, sizeof(firmware));
+ g_assert_cmpint(written, ==, sizeof(firmware));
+ close(fd);
+
+ return path;
+}
+
+static uint64_t l2cc_way_mask_test_value(unsigned int master)
+{
+ return UINT64_C(0xfedcba9876543201) + master;
+}
+
+static void test_l2cc_registers(void)
+{
+ g_autofree char *firmware = mchp_pfsoc_l2cc_create_firmware();
+ QTestState *qts = mchp_pfsoc_l2cc_start(firmware);
+ unsigned int i;
+
+ unlink(firmware);
+
+ g_assert_cmphex(qtest_readl(qts, L2CC_BASE + L2CC_CONFIG), ==,
+ L2CC_CONFIG_VALUE);
+ qtest_writel(qts, L2CC_BASE + L2CC_CONFIG, UINT32_MAX);
+ g_assert_cmphex(qtest_readl(qts, L2CC_BASE + L2CC_CONFIG), ==,
+ L2CC_CONFIG_VALUE);
+
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==,
+ L2CC_WAY_ENABLE_RESET);
+ qtest_writeb(qts, L2CC_BASE + L2CC_WAY_ENABLE, 0xd);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==, 0xd);
+ qtest_writeb(qts, L2CC_BASE + L2CC_WAY_ENABLE, 3);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==, 0xd);
+ qtest_writeq(qts, L2CC_BASE + L2CC_WAY_ENABLE, 0xf);
+ g_assert_cmphex(qtest_readq(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==, 0xf);
+ qtest_writeb(qts, L2CC_BASE + L2CC_WAY_ENABLE, 0xe);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==, 0xf);
+
+ for (i = 0; i < L2CC_WAY_MASK_COUNT; i++) {
+ g_assert_cmphex(qtest_readq(qts, L2CC_BASE + L2CC_WAY_MASK(i)), ==,
+ L2CC_WAY_MASK_RESET);
+ qtest_writeq(qts, L2CC_BASE + L2CC_WAY_MASK(i),
+ l2cc_way_mask_test_value(i));
+ }
+ for (i = 0; i < L2CC_WAY_MASK_COUNT; i++) {
+ g_assert_cmphex(qtest_readq(qts, L2CC_BASE + L2CC_WAY_MASK(i)), ==,
+ l2cc_way_mask_test_value(i));
+ }
+
+ qtest_system_reset(qts);
+ g_assert_cmphex(qtest_readl(qts, L2CC_BASE + L2CC_CONFIG), ==,
+ L2CC_CONFIG_VALUE);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==,
+ L2CC_WAY_ENABLE_RESET);
+ for (i = 0; i < L2CC_WAY_MASK_COUNT; i++) {
+ g_assert_cmphex(qtest_readq(qts, L2CC_BASE + L2CC_WAY_MASK(i)), ==,
+ L2CC_WAY_MASK_RESET);
+ }
+
+ qtest_quit(qts);
+}
+
+static void test_l2lim_topology(void)
+{
+ g_autofree char *firmware = mchp_pfsoc_l2cc_create_firmware();
+ uint32_t original[L2_LIM_RESET_WAYS];
+ const uint32_t poison = 0xdeadc0de;
+ const uint64_t zero_last = L2_ZERO_BASE + L2_ZERO_SIZE - 4;
+ QTestState *qts = mchp_pfsoc_l2cc_start(firmware);
+ unsigned int i;
+
+ unlink(firmware);
+
+ /* Check the fixed aperture, not the RAM stand-in's eviction behavior */
+ qtest_writel(qts, zero_last, 0xa55a9669);
+ g_assert_cmphex(qtest_readl(qts, zero_last), ==, 0xa55a9669);
+
+ for (i = 1; i <= L2_LIM_RESET_WAYS; i++) {
+ uint64_t l2lim_size = (L2_LIM_RESET_WAYS - i) * L2_WAY_SIZE;
+ uint64_t hidden = L2_LIM_BASE + l2lim_size;
+ uint32_t tail = 0x96000000 | i;
+
+ original[i - 1] = 0x69000000 | i;
+ qtest_writel(qts, hidden, original[i - 1]);
+ g_assert_cmphex(qtest_readl(qts, hidden), ==, original[i - 1]);
+
+ if (l2lim_size) {
+ qtest_writel(qts, hidden - 4, tail);
+ g_assert_cmphex(qtest_readl(qts, hidden - 4), ==, tail);
+ }
+
+ qtest_writeb(qts, L2CC_BASE + L2CC_WAY_ENABLE, i);
+ g_assert_cmphex(qtest_readb(qts,
+ L2CC_BASE + L2CC_WAY_ENABLE), ==, i);
+ if (l2lim_size) {
+ g_assert_cmphex(qtest_readl(qts, hidden - 4), ==, tail);
+ }
+ g_assert_cmphex(qtest_readl(qts, hidden), ==, 0);
+ qtest_writel(qts, hidden, poison);
+ g_assert_cmphex(qtest_readl(qts, hidden), ==, 0);
+ g_assert_cmphex(qtest_readl(qts, zero_last), ==, 0xa55a9669);
+ }
+
+ qtest_writeb(qts, L2CC_BASE + L2CC_WAY_ENABLE, UINT8_MAX);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==,
+ UINT8_MAX);
+ g_assert_cmphex(qtest_readl(qts, L2_LIM_BASE), ==, 0);
+ qtest_writeb(qts, L2CC_BASE + L2CC_WAY_ENABLE, 3);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==,
+ UINT8_MAX);
+ g_assert_cmphex(qtest_readl(qts, L2_LIM_BASE), ==, 0);
+
+ qtest_system_reset(qts);
+ g_assert_cmphex(qtest_readb(qts, L2CC_BASE + L2CC_WAY_ENABLE), ==,
+ L2CC_WAY_ENABLE_RESET);
+ for (i = 1; i <= L2_LIM_RESET_WAYS; i++) {
+ uint64_t restored = L2_LIM_BASE +
+ (L2_LIM_RESET_WAYS - i) * L2_WAY_SIZE;
+
+ g_assert_cmphex(qtest_readl(qts, restored), ==, original[i - 1]);
+ }
+
+ qtest_quit(qts);
+}
+
+static void test_l2cc_unimplemented(void)
+{
+ g_autofree char *firmware = mchp_pfsoc_l2cc_create_firmware();
+ g_autofree char *log_path = NULL;
+ g_autofree char *log = NULL;
+ QTestState *qts;
+ int fd;
+
+ fd = g_file_open_tmp("mchp_pfsoc_l2cc_unimp_XXXXXX", &log_path, NULL);
+ g_assert_cmpint(fd, >=, 0);
+ close(fd);
+
+ qts = qtest_initf(
+ "-machine microchip-icicle-kit -smp 5 -m 2G -bios \"%s\" "
+ "-d unimp -D \"%s\"", firmware, log_path);
+ unlink(firmware);
+
+ g_assert_cmphex(qtest_readl(qts, L2CC_BASE + L2CC_ECC_INJECT), ==, 0);
+ qtest_writeq(qts, L2CC_BASE + L2CC_FLUSH64, 0x1234);
+ g_assert_cmphex(qtest_readq(qts, L2CC_BASE + L2CC_MASTER15), ==, 0);
+ qtest_quit(qts);
+
+ g_assert_true(g_file_get_contents(log_path, &log, NULL, NULL));
+ g_assert_nonnull(strstr(log,
+ "unimplemented device read (size 4, offset 0x40)"));
+ g_assert_nonnull(strstr(log,
+ "unimplemented device write (size 8, value 0x1234, offset 0x200)"));
+ g_assert_nonnull(strstr(log,
+ "unimplemented device read (size 8, offset 0x878)"));
+ unlink(log_path);
+}
+
+int main(int argc, char **argv)
+{
+ g_test_init(&argc, &argv, NULL);
+
+ qtest_add_func("/mchp_pfsoc_l2cc/registers", test_l2cc_registers);
+ qtest_add_func("/mchp_pfsoc_l2cc/l2lim_topology",
+ test_l2lim_topology);
+ qtest_add_func("/mchp_pfsoc_l2cc/unimplemented",
+ test_l2cc_unimplemented);
+
+ return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 17870e339b..e7fea8c180 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -303,6 +303,8 @@ qtests_riscv32 = \
qtests_riscv64 = ['riscv-csr-test'] + \
(unpack_edk2_blobs ? ['bios-tables-test'] : []) + \
+ (config_all_devices.has_key('CONFIG_MICROCHIP_PFSOC') ?
+ ['mchp_pfsoc_l2cc_test'] : []) + \
(config_all_devices.has_key('CONFIG_IOMMU_TESTDEV') and
config_all_devices.has_key('CONFIG_RISCV_IOMMU') ?
['iommu-riscv-test'] : []) + \
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 07/24] hw/sd: sdhci: Run ADMA independently of MMIO
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (5 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 06/24] tests/qtest: Add PolarFire SoC L2CC coverage Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-10-04 11:14 ` Bernhard Beschow
2026-09-04 15:57 ` [PATCH v2 08/24] tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer Bin Meng
` (18 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Bin Meng, Philippe Mathieu-Daudé, qemu-block
The SDHCI model processes the first ADMA descriptor batch inside the
command MMIO write, then resumes pending batches before every later
SDHCI MMIO read or write. This makes register access perform bulk DMA
work and can delay a status read even when completion bits are set.
On the Icicle Kit, U-Boot uses ADMA2-64 and CMD18 to load a roughly
19 MiB FIT image from SD. It can report:
Timeout for status update: 00000001 00000001
Timeout for status update: 00000003 00000001
The status already contains the requested Command Complete bit, and may
also contain Transfer Complete. However, reading the interrupt status
first executes a pending ADMA batch. The MMIO read can therefore return
after U-Boot has reached its one-second polling deadline.
Turn the existing transfer timer into an ADMA-only engine. Starting an
ADMA command arms the engine directly, and each timer callback runs one
bounded batch before yielding. MMIO reads and writes no longer perform
or schedule ADMA work. Keep PIO and SDMA synchronous.
Cancel the engine and clear ADMA activity and error state on DATA or ALL
reset.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
(no changes since v1)
hw/sd/sdhci.c | 143 ++++++++++++++++++++++++++++++--------------------
1 file changed, 87 insertions(+), 56 deletions(-)
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index bd74c60f72..14c312a691 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -277,6 +277,7 @@ static void sdhci_set_inserted(DeviceState *dev, bool level)
}
} else {
s->prnsts = 0x1fa0000;
+ timer_del(s->transfer_timer);
s->pwrcon &= ~SDHC_POWER_ON;
s->clkcon &= ~SDHC_CLOCK_SDCLK_EN;
if (s->norintstsen & SDHC_NISEN_REMOVE) {
@@ -348,7 +349,34 @@ static void sdhci_poweron_reset(DeviceState *dev)
}
}
-static void sdhci_data_transfer(void *opaque);
+static void sdhci_data_transfer(SDHCIState *s);
+static void sdhci_adma_engine(void *opaque);
+
+static void sdhci_set_transfer_active(SDHCIState *s)
+{
+ s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE;
+ if (s->trnmod & SDHC_TRNS_READ) {
+ s->prnsts |= SDHC_DOING_READ;
+ } else {
+ s->prnsts |= SDHC_DOING_WRITE;
+ }
+}
+
+static void sdhci_schedule_adma(SDHCIState *s)
+{
+ timer_mod(s->transfer_timer,
+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_TRANSFER_DELAY);
+}
+
+static bool sdhci_adma_transfer_active(SDHCIState *s)
+{
+ return TRANSFERRING_DATA(s->prnsts) &&
+ (s->trnmod & SDHC_TRNS_DMA) &&
+ (s->cmdreg & SDHC_CMD_DATA_PRESENT) &&
+ sdhci_get_dma_type(s) != SDHC_CTRL_SDMA &&
+ !(s->admaerr & SDHC_ADMAERR_STATE_MASK) &&
+ !(s->errintsts & SDHC_EIS_ADMAERR);
+}
#define BLOCK_SIZE_MASK (4 * KiB - 1)
@@ -405,7 +433,13 @@ static void sdhci_send_command(SDHCIState *s)
if (!timeout && (s->blksize & BLOCK_SIZE_MASK) &&
(s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
s->data_count = 0;
- sdhci_data_transfer(s);
+ if ((s->trnmod & SDHC_TRNS_DMA) &&
+ sdhci_get_dma_type(s) != SDHC_CTRL_SDMA) {
+ sdhci_set_transfer_active(s);
+ sdhci_schedule_adma(s);
+ } else {
+ sdhci_data_transfer(s);
+ }
}
}
@@ -850,7 +884,7 @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
/* Advanced DMA data transfer */
-static void sdhci_do_adma(SDHCIState *s)
+static void sdhci_adma_run_batch(SDHCIState *s)
{
unsigned int begin, length;
const uint16_t block_size = s->blksize & BLOCK_SIZE_MASK;
@@ -956,15 +990,17 @@ static void sdhci_do_adma(SDHCIState *s)
}
if (res != MEMTX_OK) {
s->data_count = 0;
+ s->admaerr &= ~SDHC_ADMAERR_STATE_MASK;
+ s->admaerr |= SDHC_ADMAERR_STATE_ST_TFR;
if (s->errintstsen & SDHC_EISEN_ADMAERR) {
trace_sdhci_error("Set ADMA error flag");
s->errintsts |= SDHC_EIS_ADMAERR;
s->norintsts |= SDHC_NIS_ERR;
}
sdhci_update_irq(s);
- } else {
- s->admasysaddr += dscr.incr;
+ return;
}
+ s->admasysaddr += dscr.incr;
break;
case SDHC_ADMA_ATTR_ACT_LINK: /* link to next descriptor table */
s->admasysaddr = dscr.addr;
@@ -1012,50 +1048,52 @@ static void sdhci_do_adma(SDHCIState *s)
}
/* we have unfinished business - reschedule to continue ADMA */
- timer_mod(s->transfer_timer,
- qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_TRANSFER_DELAY);
+ sdhci_schedule_adma(s);
}
-/* Perform data transfer according to controller configuration */
-
-static void sdhci_data_transfer(void *opaque)
+/* Run one independently scheduled, quota-bounded ADMA batch */
+static void sdhci_adma_engine(void *opaque)
{
SDHCIState *s = (SDHCIState *)opaque;
- if (s->trnmod & SDHC_TRNS_DMA) {
- switch (sdhci_get_dma_type(s)) {
- case SDHC_CTRL_SDMA:
- sdhci_sdma_transfer(s);
- break;
- case SDHC_CTRL_ADMA1_32:
- if (!(s->capareg & R_SDHC_CAPAB_ADMA1_MASK)) {
- trace_sdhci_error("ADMA1 not supported");
- break;
- }
+ if (!sdhci_adma_transfer_active(s)) {
+ return;
+ }
- sdhci_do_adma(s);
- break;
- case SDHC_CTRL_ADMA2_32:
- if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK)) {
- trace_sdhci_error("ADMA2 not supported");
- break;
- }
+ switch (sdhci_get_dma_type(s)) {
+ case SDHC_CTRL_ADMA1_32:
+ if (!(s->capareg & R_SDHC_CAPAB_ADMA1_MASK)) {
+ trace_sdhci_error("ADMA1 not supported");
+ return;
+ }
+ break;
+ case SDHC_CTRL_ADMA2_32:
+ if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK)) {
+ trace_sdhci_error("ADMA2 not supported");
+ return;
+ }
+ break;
+ case SDHC_CTRL_ADMA2_64:
+ if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK) ||
+ !(s->capareg & R_SDHC_CAPAB_BUS64BIT_MASK)) {
+ trace_sdhci_error("64 bit ADMA not supported");
+ return;
+ }
+ break;
+ default:
+ trace_sdhci_error("Unsupported ADMA type");
+ return;
+ }
- sdhci_do_adma(s);
- break;
- case SDHC_CTRL_ADMA2_64:
- if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK) ||
- !(s->capareg & R_SDHC_CAPAB_BUS64BIT_MASK)) {
- trace_sdhci_error("64 bit ADMA not supported");
- break;
- }
+ sdhci_adma_run_batch(s);
+}
- sdhci_do_adma(s);
- break;
- default:
- trace_sdhci_error("Unsupported DMA type");
- break;
- }
+/* Perform synchronous PIO or SDMA data transfer */
+static void sdhci_data_transfer(SDHCIState *s)
+{
+ if (s->trnmod & SDHC_TRNS_DMA) {
+ assert(sdhci_get_dma_type(s) == SDHC_CTRL_SDMA);
+ sdhci_sdma_transfer(s);
} else {
if ((s->trnmod & SDHC_TRNS_READ) && sdbus_data_ready(&s->sdbus)) {
s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
@@ -1098,21 +1136,11 @@ sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
return true;
}
-static void sdhci_resume_pending_transfer(SDHCIState *s)
-{
- timer_del(s->transfer_timer);
- sdhci_data_transfer(s);
-}
-
static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
{
SDHCIState *s = (SDHCIState *)opaque;
uint32_t ret = 0;
- if (timer_pending(s->transfer_timer)) {
- sdhci_resume_pending_transfer(s);
- }
-
switch (offset & ~0x3) {
case SDHC_SYSAD:
ret = s->sdmasysad;
@@ -1235,7 +1263,10 @@ static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)
s->norintsts &= ~SDHC_NIS_CMDCMP;
break;
case SDHC_RESET_DATA:
+ timer_del(s->transfer_timer);
s->data_count = 0;
+ s->admaerr = 0;
+ s->errintsts &= ~SDHC_EIS_ADMAERR;
s->prnsts &= ~(SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE |
SDHC_DOING_READ | SDHC_DOING_WRITE |
SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE);
@@ -1244,6 +1275,10 @@ static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)
s->sdma_boundary_paused = false;
s->norintsts &= ~(SDHC_NIS_WBUFRDY | SDHC_NIS_RBUFRDY |
SDHC_NIS_DMA | SDHC_NIS_TRSCMP | SDHC_NIS_BLKGAP);
+ if (!s->errintsts) {
+ s->norintsts &= ~SDHC_NIS_ERR;
+ }
+ sdhci_update_irq(s);
break;
}
}
@@ -1257,10 +1292,6 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
uint32_t value = val;
value <<= shift;
- if (timer_pending(s->transfer_timer)) {
- sdhci_resume_pending_transfer(s);
- }
-
switch (offset & ~0x3) {
case SDHC_SYSAD:
if (!TRANSFERRING_DATA(s->prnsts) ||
@@ -1521,7 +1552,7 @@ void sdhci_initfn(SDHCIState *s)
s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
sdhci_raise_insertion_irq, s);
s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
- sdhci_data_transfer, s);
+ sdhci_adma_engine, s);
s->io_ops = &sdhci_mmio_ops;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 08/24] tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (6 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 07/24] hw/sd: sdhci: Run ADMA independently of MMIO Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 09/24] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes Bin Meng
` (17 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Wadim Mueller, Bin Meng, Fabiano Rosas, Laurent Vivier,
Paolo Bonzini, Philippe Mathieu-Daudé, qemu-block
From: Wadim Mueller <wafgo01@gmail.com>
Add an image-free qtest for the microchip-icicle-kit machine that drives
the generic SDHCI model (hw/sd/sdhci.c) through the Cadence wrapper
(hw/sd/cadence_sdhci.c, SRS window at 0x20008200) directly over MMIO
under "-accel qtest", where QEMU_CLOCK_VIRTUAL only advances when the
test steps it.
It reproduces two aspects of the ADMA2 engine objectively, without any
guest firmware:
1. Pacing: a 12-descriptor (> SDHC_ADMA_DESCS_PER_DELAY) non-interrupt
ADMA2 CMD18 read completes after a model-dependent number of
SDHC_TRANSFER_DELAY virtual-clock steps, which the test reports.
2. MMIO coupling: a chain carrying a DMA-boundary interrupt descriptor
yields mid-chain and reschedules on the virtual clock. With the
clock frozen, a bare interrupt-status read must not itself resume or
complete the transfer. This asserts the behaviour intended by "Run
ADMA independently of MMIO": it passes on the fixed model and fails
on a model that resumes ADMA from an MMIO read.
The SD bring-up (CMD0/CMD8/ACMD41/CMD2/CMD3/CMD7/CMD16) and the ADMA2
descriptor-table layout mirror the pattern already used by the SDHCI
device model; SDHCI register offsets and ADMA attribute bits are
reproduced locally because sdhci-internal.h is not standalone-includable
from a qtest.
Signed-off-by: Wadim Mueller <wafgo01@gmail.com>
[bmeng: strengthen checks, reuse SDHCI helpers, verify data]
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- Assert bounded ADMA pacing and MMIO-independent progress
- Reuse existing SDHCI definitions and command helpers
- Verify transferred data against a known image pattern
MAINTAINERS | 1 +
tests/qtest/cadence-sdhci-test.c | 282 +++++++++++++++++++++++++++++++
tests/qtest/meson.build | 3 +-
3 files changed, 285 insertions(+), 1 deletion(-)
create mode 100644 tests/qtest/cadence-sdhci-test.c
diff --git a/MAINTAINERS b/MAINTAINERS
index 8b7319d3d0..58425dcad4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2419,6 +2419,7 @@ F: include/hw/sd/sd*
F: hw/sd/core.c
F: hw/sd/sd*
F: hw/sd/ssi-sd.c
+F: tests/qtest/cadence-sdhci-test.c
F: tests/qtest/fuzz-sdcard-test.c
F: tests/qtest/sdhci-test.c
F: tests/qtest/xilinx-zynq-sdhci-test.c
diff --git a/tests/qtest/cadence-sdhci-test.c b/tests/qtest/cadence-sdhci-test.c
new file mode 100644
index 0000000000..71c1e53333
--- /dev/null
+++ b/tests/qtest/cadence-sdhci-test.c
@@ -0,0 +1,282 @@
+/*
+ * QTest for Cadence SDHCI ADMA2 pacing / MMIO coupling on the Microchip
+ * PolarFire SoC Icicle Kit (microchip-icicle-kit).
+ *
+ * Drives the generic SDHCI model (hw/sd/sdhci.c) through the Cadence wrapper
+ * directly over MMIO under "-accel qtest", where QEMU_CLOCK_VIRTUAL only
+ * advances when the test steps it; no guest firmware runs.
+ *
+ * Copyright (c) 2026 Wadim Mueller <wafgo01@gmail.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sd/sdhci.h"
+#include "hw/sd/sdhci-internal.h"
+
+#include "libqtest.h"
+#include "libqos/sdhci-cmd.h"
+
+/*
+ * Use the controller definitions and command helper shared with the existing
+ * SDHCI qtests so this reproducer stays in sync with the device model.
+ */
+
+/* Cadence maps the generic SDHCI (SRS) register window at base + 0x200 */
+#define SDHCI_BASE (0x20008000ULL + 0x200)
+
+/* Scratch in PolarFire DRAM (base 0x80000000): descriptor table + target */
+#define ADMA_TABLE_ADDR 0x82000000ULL
+#define ADMA_BUF_ADDR 0x82100000ULL
+
+#define BLK_LEN 512
+#define NDESC 12 /* > SDHC_ADMA_DESCS_PER_DELAY (5) */
+#define INT_DESC 5 /* ADMA interrupt descriptor */
+#define TRANSFER_SIZE (NDESC * BLK_LEN)
+
+/* CMDREG response-type encodings (bits [1:0]) */
+#define RESP_NONE 0x0000
+#define RESP_R2 0x0001 /* 136-bit */
+#define RESP_R48 0x0002 /* 48-bit */
+#define RESP_R1B 0x0003 /* 48-bit with busy */
+
+#define ACMD41_ARG 0x40FF8000u /* HCS + 3.3-3.6V window */
+#define CMD8_ARG 0x000001AAu /* VHS 2.7-3.6V + check pattern */
+
+static void fill_pattern(uint8_t *buf, size_t len)
+{
+ for (size_t i = 0; i < len; i++) {
+ buf[i] = (i * 13 + 7) & 0xff;
+ }
+}
+
+static void write_pattern(int fd)
+{
+ g_autofree uint8_t *buf = g_malloc(TRANSFER_SIZE);
+ ssize_t written;
+
+ fill_pattern(buf, TRANSFER_SIZE);
+ written = pwrite(fd, buf, TRANSFER_SIZE, 0);
+ g_assert_cmpint(written, ==, TRANSFER_SIZE);
+}
+
+static void check_adma_data(QTestState *qts)
+{
+ g_autofree uint8_t *actual = g_malloc(TRANSFER_SIZE);
+ g_autofree uint8_t *expected = g_malloc(TRANSFER_SIZE);
+
+ fill_pattern(expected, TRANSFER_SIZE);
+ qtest_memread(qts, ADMA_BUF_ADDR, actual, TRANSFER_SIZE);
+ g_assert_cmpmem(actual, TRANSFER_SIZE, expected, TRANSFER_SIZE);
+}
+
+/* Issue an SD command and wait (bounded) for Command Complete */
+static uint16_t sd_cmd(QTestState *qts, uint8_t cmd, uint32_t arg,
+ uint16_t flags)
+{
+ uint16_t sts = 0;
+ int i;
+
+ sdhci_cmd_regs(qts, SDHCI_BASE, 0, 0, arg, 0,
+ ((uint16_t)cmd << 8) | flags);
+
+ for (i = 0; i < 1000; i++) {
+ sts = qtest_readw(qts, SDHCI_BASE + SDHC_NORINTSTS);
+ if (sts & SDHC_NIS_CMDCMP) {
+ break;
+ }
+ }
+ g_assert_cmphex(sts & SDHC_NIS_CMDCMP, ==, SDHC_NIS_CMDCMP);
+
+ qtest_writew(qts, SDHCI_BASE + SDHC_NORINTSTS, 0xffff); /* w1c */
+ return sts;
+}
+
+/* Bring the SD card from idle to transfer state */
+static void sd_bring_up_card(QTestState *qts)
+{
+ uint32_t rca;
+
+ g_assert_cmphex(qtest_readl(qts, SDHCI_BASE + SDHC_PRNSTS) &
+ SDHC_CARD_PRESENT, ==, SDHC_CARD_PRESENT);
+
+ qtest_writeb(qts, SDHCI_BASE + SDHC_SWRST, SDHC_RESET_ALL);
+ qtest_writew(qts, SDHCI_BASE + SDHC_CLKCON,
+ SDHC_CLOCK_INT_EN | SDHC_CLOCK_SDCLK_EN);
+ qtest_writew(qts, SDHCI_BASE + SDHC_NORINTSTSEN, 0xffff);
+ qtest_writew(qts, SDHCI_BASE + SDHC_ERRINTSTSEN, 0xffff);
+ qtest_writew(qts, SDHCI_BASE + SDHC_NORINTSIGEN, 0xffff);
+
+ sd_cmd(qts, 0, 0x00000000, RESP_NONE); /* GO_IDLE_STATE */
+ sd_cmd(qts, 8, CMD8_ARG, RESP_R48); /* SEND_IF_COND */
+ sd_cmd(qts, 55, 0x00000000, RESP_R48); /* APP_CMD */
+ sd_cmd(qts, 41, ACMD41_ARG, RESP_R48); /* SD_SEND_OP_COND */
+ sd_cmd(qts, 2, 0x00000000, RESP_R2); /* ALL_SEND_CID */
+ sd_cmd(qts, 3, 0x00000000, RESP_R48); /* SEND_RELATIVE_ADDR */
+
+ rca = qtest_readl(qts, SDHCI_BASE + SDHC_RSPREG0) >> 16; /* R6 */
+
+ sd_cmd(qts, 7, rca << 16, RESP_R1B); /* SELECT_CARD */
+ sd_cmd(qts, 16, BLK_LEN, RESP_R48); /* SET_BLOCKLEN */
+}
+
+/*
+ * Build a 32-bit ADMA2 table: per 8-byte entry word0 = (len << 16) | attr,
+ * word1 = target address. When int_desc >= 0 that descriptor also carries
+ * the ADMA descriptor interrupt attribute, so the model yields mid-chain
+ * (rescheduling on QEMU_CLOCK_VIRTUAL) instead of running to completion.
+ */
+static void build_adma_table(QTestState *qts, int int_desc)
+{
+ for (int i = 0; i < NDESC; i++) {
+ uint8_t attr = SDHC_ADMA_ATTR_VALID | SDHC_ADMA_ATTR_ACT_TRAN;
+ uint32_t addr = (uint32_t)(ADMA_BUF_ADDR + (uint64_t)i * BLK_LEN);
+
+ if (i == int_desc) {
+ attr |= SDHC_ADMA_ATTR_INT;
+ }
+ if (i == NDESC - 1) {
+ attr |= SDHC_ADMA_ATTR_END;
+ }
+ qtest_writel(qts, ADMA_TABLE_ADDR + (uint64_t)i * 8,
+ ((uint32_t)BLK_LEN << 16) | attr);
+ qtest_writel(qts, ADMA_TABLE_ADDR + (uint64_t)i * 8 + 4, addr);
+ }
+}
+
+/* Program the ADMA2 engine, descriptor pointer and transfer geometry */
+static void program_adma_read(QTestState *qts)
+{
+ qtest_writeb(qts, SDHCI_BASE + SDHC_HOSTCTL, SDHC_CTRL_ADMA2_32);
+ qtest_writel(qts, SDHCI_BASE + SDHC_ADMASYSADDR, (uint32_t)ADMA_TABLE_ADDR);
+ qtest_writel(qts, SDHCI_BASE + SDHC_ADMASYSADDR + 4,
+ (uint32_t)(ADMA_TABLE_ADDR >> 32));
+ qtest_writel(qts, SDHCI_BASE + SDHC_BLKSIZE, BLK_LEN | (NDESC << 16));
+ qtest_writew(qts, SDHCI_BASE + SDHC_TRNMOD,
+ SDHC_TRNS_DMA | SDHC_TRNS_BLK_CNT_EN |
+ SDHC_TRNS_READ | SDHC_TRNS_MULTI);
+ qtest_writel(qts, SDHCI_BASE + SDHC_ARGUMENT, 0); /* start block 0 */
+ qtest_writew(qts, SDHCI_BASE + SDHC_NORINTSTS, 0xffff);
+ qtest_memset(qts, ADMA_BUF_ADDR, 0xa5, TRANSFER_SIZE);
+}
+
+/* CMD18 READ_MULTIPLE_BLOCK with data present -> kicks off ADMA */
+static void kick_cmd18(QTestState *qts)
+{
+ qtest_writew(qts, SDHCI_BASE + SDHC_CMDREG,
+ (18 << 8) | SDHC_CMD_DATA_PRESENT | RESP_R48);
+}
+
+/* Start a card-carrying icicle machine and bring the card to "tran" */
+static QTestState *icicle_start(char **tmp)
+{
+ int fd;
+ GError *err = NULL;
+ QTestState *qts;
+
+ fd = g_file_open_tmp("icicle-sdhci-XXXXXX.raw", tmp, &err);
+ g_assert_no_error(err);
+ g_assert_cmpint(fd, >=, 0);
+ g_assert_cmpint(ftruncate(fd, 1 * 1024 * 1024), ==, 0);
+ write_pattern(fd);
+ close(fd);
+
+ qts = qtest_initf("-machine microchip-icicle-kit -accel qtest "
+ "-display none -drive if=sd,file=%s,format=raw", *tmp);
+ sd_bring_up_card(qts);
+ return qts;
+}
+
+/*
+ * Facet 1 -- pacing. A non-interrupt chain completes after a bounded number
+ * of SDHC_TRANSFER_DELAY steps. With 12 descriptors and a quota of five per
+ * batch, completion requires exactly three virtual-clock steps.
+ */
+static void test_adma_pacing(void)
+{
+ char *tmp = NULL;
+ QTestState *qts = icicle_start(&tmp);
+ const int expected_steps = DIV_ROUND_UP(NDESC,
+ SDHC_ADMA_DESCS_PER_DELAY);
+ uint16_t sts;
+ int steps = 0;
+
+ build_adma_table(qts, -1);
+ program_adma_read(qts);
+ kick_cmd18(qts);
+
+ while (!((sts = qtest_readw(qts, SDHCI_BASE + SDHC_NORINTSTS)) &
+ SDHC_NIS_TRSCMP)) {
+ qtest_clock_step(qts, SDHC_TRANSFER_DELAY);
+ steps++;
+ g_assert_cmpint(steps, <=, expected_steps);
+ }
+
+ g_assert_cmpint(steps, ==, expected_steps);
+ g_assert_cmphex(sts & SDHC_NIS_TRSCMP, ==, SDHC_NIS_TRSCMP);
+ g_assert_cmphex(sts & SDHC_NIS_ERR, ==, 0);
+ check_adma_data(qts);
+
+ g_test_message("ADMA %d descriptors: %d clock steps to Transfer Complete",
+ NDESC, steps);
+
+ qtest_quit(qts);
+ unlink(tmp);
+ g_free(tmp);
+}
+
+/*
+ * Facet 2 -- MMIO coupling (regression for "Run ADMA independently of MMIO").
+ * With the clock frozen, a bare interrupt-status read must not resume the
+ * transfer left pending by the mid-chain interrupt descriptor: Transfer
+ * Complete must still be clear. A model that resumes ADMA from an MMIO read
+ * completes it on that bare read and fails the assertion.
+ */
+static void test_adma_mmio_coupling(void)
+{
+ char *tmp = NULL;
+ QTestState *qts = icicle_start(&tmp);
+ uint16_t sts;
+ int steps = 0;
+
+ build_adma_table(qts, INT_DESC);
+ program_adma_read(qts);
+ kick_cmd18(qts);
+
+ qtest_clock_step(qts, SDHC_TRANSFER_DELAY);
+ qtest_clock_step(qts, SDHC_TRANSFER_DELAY);
+
+ sts = qtest_readw(qts, SDHCI_BASE + SDHC_NORINTSTS);
+ g_assert_cmphex(sts & (SDHC_NIS_DMA | SDHC_NIS_TRSCMP), ==,
+ SDHC_NIS_DMA);
+
+ sts = qtest_readw(qts, SDHCI_BASE + SDHC_NORINTSTS);
+ g_assert_cmphex(sts & (SDHC_NIS_DMA | SDHC_NIS_TRSCMP), ==,
+ SDHC_NIS_DMA);
+
+ while (!((sts = qtest_readw(qts, SDHCI_BASE + SDHC_NORINTSTS)) &
+ SDHC_NIS_TRSCMP)) {
+ qtest_clock_step(qts, SDHC_TRANSFER_DELAY);
+ steps++;
+ g_assert_cmpint(steps, <, 1000);
+ }
+ g_assert_cmphex(sts & SDHC_NIS_ERR, ==, 0);
+ check_adma_data(qts);
+
+ g_test_message("ADMA coupling: %d clock steps to complete after bare read",
+ steps);
+
+ qtest_quit(qts);
+ unlink(tmp);
+ g_free(tmp);
+}
+
+int main(int argc, char **argv)
+{
+ g_test_init(&argc, &argv, NULL);
+ qtest_add_func("/microchip/icicle/sdhci/adma-pacing", test_adma_pacing);
+ qtest_add_func("/microchip/icicle/sdhci/adma-mmio-coupling",
+ test_adma_mmio_coupling);
+ return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index e7fea8c180..abe73370b6 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -304,7 +304,8 @@ qtests_riscv32 = \
qtests_riscv64 = ['riscv-csr-test'] + \
(unpack_edk2_blobs ? ['bios-tables-test'] : []) + \
(config_all_devices.has_key('CONFIG_MICROCHIP_PFSOC') ?
- ['mchp_pfsoc_l2cc_test'] : []) + \
+ ['cadence-sdhci-test',
+ 'mchp_pfsoc_l2cc_test'] : []) + \
(config_all_devices.has_key('CONFIG_IOMMU_TESTDEV') and
config_all_devices.has_key('CONFIG_RISCV_IOMMU') ?
['iommu-riscv-test'] : []) + \
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 09/24] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (7 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 08/24] tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:25 ` Philippe Mathieu-Daudé
2026-09-04 15:57 ` [PATCH v2 10/24] hw/sd: cadence: Add 64-bit system bus property Bin Meng
` (16 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: qemu-stable, Bin Meng, Philippe Mathieu-Daudé, qemu-block
SDHC and SDXC memory commands always transfer 512-byte blocks regardless
of the length selected by CMD16. QEMU stores that selected length for
LOCK_UNLOCK but also used it directly for several memory command paths.
Route single- and multi-block memory sizing through the existing helper
that distinguishes high-capacity cards from SDSC.
This lets PolarFire SoC HSS validate the complete GPT header and locate
its boot partition instead of receiving only the eight-byte signature.
Fixes: 2d7adea4fe57 ("hw/sd: Support SDHC size cards")
Cc: qemu-stable@nongnu.org
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
(no changes since v1)
hw/sd/sd.c | 43 +++++++++++++++++++++++++------------------
1 file changed, 25 insertions(+), 18 deletions(-)
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index b1b3b1226a..0083b8e064 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1975,18 +1975,20 @@ static sd_rsp_type_t sd_cmd_SET_BLOCKLEN(SDState *sd, SDRequest req)
static sd_rsp_type_t sd_cmd_READ_SINGLE_BLOCK(SDState *sd, SDRequest req)
{
uint64_t addr;
+ uint32_t blk_len;
if (sd->state != sd_transfer_state) {
return sd_invalid_state_for_cmd(sd, req);
}
+ blk_len = sd_blk_len(sd);
addr = sd_req_get_address(sd, req);
- if (!address_in_range(sd, "READ_SINGLE_BLOCK", addr, sd->blk_len)) {
+ if (!address_in_range(sd, "READ_SINGLE_BLOCK", addr, blk_len)) {
return sd_r1;
}
- sd_blk_read(sd, addr, sd->blk_len);
- return sd_cmd_to_sendingdata(sd, req, addr, NULL, sd->blk_len);
+ sd_blk_read(sd, addr, blk_len);
+ return sd_cmd_to_sendingdata(sd, req, addr, NULL, blk_len);
}
/* CMD19 */
@@ -2025,13 +2027,15 @@ static sd_rsp_type_t sd_cmd_SET_BLOCK_COUNT(SDState *sd, SDRequest req)
static sd_rsp_type_t sd_cmd_WRITE_SINGLE_BLOCK(SDState *sd, SDRequest req)
{
uint64_t addr;
+ uint32_t blk_len;
if (sd->state != sd_transfer_state) {
return sd_invalid_state_for_cmd(sd, req);
}
+ blk_len = sd_blk_len(sd);
addr = sd_req_get_address(sd, req);
- if (!address_in_range(sd, "WRITE_SINGLE_BLOCK", addr, sd->blk_len)) {
+ if (!address_in_range(sd, "WRITE_SINGLE_BLOCK", addr, blk_len)) {
return sd_r1;
}
@@ -2045,7 +2049,7 @@ static sd_rsp_type_t sd_cmd_WRITE_SINGLE_BLOCK(SDState *sd, SDRequest req)
}
sd->blk_written = 0;
- return sd_cmd_to_receivingdata(sd, req, addr, sd->blk_len);
+ return sd_cmd_to_receivingdata(sd, req, addr, blk_len);
}
/* CMD26 */
@@ -2372,7 +2376,7 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
switch (sd->state) {
case sd_transfer_state:
- if (!address_in_range(sd, "READ_BLOCK", addr, sd->blk_len)) {
+ if (!address_in_range(sd, "READ_BLOCK", addr, sd_blk_len(sd))) {
return sd_r1;
}
@@ -2392,7 +2396,8 @@ static sd_rsp_type_t sd_normal_command(SDState *sd, SDRequest req)
switch (sd->state) {
case sd_transfer_state:
- if (!address_in_range(sd, "WRITE_BLOCK", addr, sd->blk_len)) {
+ if (!address_in_range(sd, "WRITE_BLOCK", addr,
+ sd_blk_len(sd))) {
return sd_r1;
}
@@ -2662,6 +2667,7 @@ static void sdcard_write_data_dump(const char *proto, const char *cmd_desc,
static size_t sd_write_data(SDState *sd, const void *buf, size_t length)
{
unsigned int partition_access;
+ uint32_t blk_len;
int i;
const uint8_t *value = buf;
@@ -2678,6 +2684,7 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)
if (sd->card_status & (ADDRESS_ERROR | WP_VIOLATION))
return length;
+ blk_len = sd_blk_len(sd);
sdcard_write_data_dump(sd->proto->name,
sd->last_cmd_name,
sd->current_cmd, sd->data_offset, buf, length);
@@ -2704,7 +2711,7 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)
if (sd->data_offset == 0) {
/* Start of the block - let's check the address is valid */
if (!address_in_range(sd, "WRITE_MULTIPLE_BLOCK",
- sd->data_start, sd->blk_len)) {
+ sd->data_start, blk_len)) {
break;
}
if (sd->size <= SDSC_MAX_CAPACITY) {
@@ -2715,7 +2722,7 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)
}
}
sd->data[sd->data_offset++] = value[0];
- if (sd->data_offset >= sd->blk_len) {
+ if (sd->data_offset >= blk_len) {
/* TODO: Check CRC before committing */
sd->state = sd_programming_state;
partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
@@ -2726,7 +2733,7 @@ static size_t sd_write_data(SDState *sd, const void *buf, size_t length)
sd_blk_write(sd, sd->data_start, sd->data_offset);
}
sd->blk_written++;
- sd->data_start += sd->blk_len;
+ sd->data_start += blk_len;
sd->data_offset = 0;
sd->csd[14] |= 0x40;
@@ -2810,7 +2817,7 @@ static size_t sd_read_data(SDState *sd, void *buf, size_t length)
/* TODO: Append CRCs */
const uint8_t dummy_byte = 0x00;
unsigned int partition_access;
- uint32_t io_len;
+ uint32_t blk_len;
uint8_t *value = buf;
if (!sd->blk || !blk_is_inserted(sd->blk)) {
@@ -2830,11 +2837,11 @@ static size_t sd_read_data(SDState *sd, void *buf, size_t length)
return length;
}
- io_len = sd_blk_len(sd);
+ blk_len = sd_blk_len(sd);
trace_sdcard_read_data(sd->proto->name,
sd->last_cmd_name, sd->current_cmd,
- sd->data_offset, sd->data_size, io_len);
+ sd->data_offset, sd->data_size, blk_len);
switch (sd->current_cmd) {
case 6: /* CMD6: SWITCH_FUNCTION */
case 8: /* CMD8: SEND_EXT_CSD */
@@ -2859,22 +2866,22 @@ static size_t sd_read_data(SDState *sd, void *buf, size_t length)
if (sd->data_offset == 0) {
if (!address_in_range(sd, "READ_MULTIPLE_BLOCK",
- sd->data_start, io_len)) {
+ sd->data_start, blk_len)) {
*value = dummy_byte;
return length;
}
partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
& EXT_CSD_PART_CONFIG_ACC_MASK;
if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {
- emmc_rpmb_blk_read(sd, sd->data_start, io_len);
+ emmc_rpmb_blk_read(sd, sd->data_start, blk_len);
} else {
- sd_blk_read(sd, sd->data_start, io_len);
+ sd_blk_read(sd, sd->data_start, blk_len);
}
}
*value = sd->data[sd->data_offset++];
- if (sd->data_offset >= io_len) {
- sd->data_start += io_len;
+ if (sd->data_offset >= blk_len) {
+ sd->data_start += blk_len;
sd->data_offset = 0;
if (sd->multi_blk_cnt != 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 10/24] hw/sd: cadence: Add 64-bit system bus property
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (8 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 09/24] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 11/24] hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support Bin Meng
` (15 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Alistair Francis, Edgar E. Iglesias, Peter Maydell, qemu-arm
Cadence SDHCI integrations can differ in whether they provide a 64-bit
system bus. Advertising the capability unconditionally could make a
guest select unsupported ADMA descriptors.
Add a bus64bit property to the Cadence model and keep it disabled by
default. When enabled, expose the corresponding capability through the
generic SDHCI child.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- Make 64-bit system bus support a device property
include/hw/sd/cadence_sdhci.h | 1 +
hw/sd/cadence_sdhci.c | 11 +++++++++++
2 files changed, 12 insertions(+)
diff --git a/include/hw/sd/cadence_sdhci.h b/include/hw/sd/cadence_sdhci.h
index cd8288b7d8..553fa73842 100644
--- a/include/hw/sd/cadence_sdhci.h
+++ b/include/hw/sd/cadence_sdhci.h
@@ -34,6 +34,7 @@ typedef struct CadenceSDHCIState {
MemoryRegion container;
MemoryRegion iomem;
BusState *bus;
+ bool bus64bit;
uint32_t regs[CADENCE_SDHCI_NUM_REGS];
diff --git a/hw/sd/cadence_sdhci.c b/hw/sd/cadence_sdhci.c
index 8476baf67f..875823a50d 100644
--- a/hw/sd/cadence_sdhci.c
+++ b/hw/sd/cadence_sdhci.c
@@ -25,6 +25,7 @@
#include "qemu/error-report.h"
#include "qapi/error.h"
#include "migration/vmstate.h"
+#include "hw/core/qdev-properties.h"
#include "hw/sd/cadence_sdhci.h"
#include "sdhci-internal.h"
@@ -147,6 +148,11 @@ static void cadence_sdhci_realize(DeviceState *dev, Error **errp)
s, TYPE_CADENCE_SDHCI, CADENCE_SDHCI_REG_SIZE);
memory_region_add_subregion(&s->container, 0, &s->iomem);
+ if (s->bus64bit) {
+ object_property_set_uint(OBJECT(&s->sdhci), "capareg",
+ SDHC_CAPAB_REG_DEFAULT |
+ R_SDHC_CAPAB_BUS64BIT_MASK, &error_abort);
+ }
sysbus_realize(sbd_sdhci, errp);
memory_region_add_subregion(&s->container, CADENCE_SDHCI_SRS_BASE,
sysbus_mmio_get_region(sbd_sdhci, 0));
@@ -165,6 +171,10 @@ static const VMStateDescription vmstate_cadence_sdhci = {
},
};
+static const Property cadence_sdhci_properties[] = {
+ DEFINE_PROP_BOOL("bus64bit", CadenceSDHCIState, bus64bit, false),
+};
+
static void cadence_sdhci_class_init(ObjectClass *classp, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(classp);
@@ -172,6 +182,7 @@ static void cadence_sdhci_class_init(ObjectClass *classp, const void *data)
dc->desc = "Cadence SD/SDIO/eMMC Host Controller (SD4HC)";
dc->realize = cadence_sdhci_realize;
device_class_set_legacy_reset(dc, cadence_sdhci_reset);
+ device_class_set_props(dc, cadence_sdhci_properties);
dc->vmsd = &vmstate_cadence_sdhci;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 11/24] hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (9 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 10/24] hw/sd: cadence: Add 64-bit system bus property Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service Bin Meng
` (14 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Alistair Francis, Chao Liu, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Sebastian Huber, Weiwei Li,
qemu-riscv
PolarFire SoC software selects 64-bit ADMA descriptors for the Cadence
SDHCI controller. The controller supports those descriptors, but the
Cadence property remains disabled by default for other integrations.
Enable the bus64bit property from the PolarFire SoC so the generic
SDHCI descriptor engine can execute 64-bit ADMA transfers.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- New patch
hw/riscv/microchip_pfsoc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 114567867b..b1df852ddd 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -190,6 +190,8 @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
object_initialize_child(obj, "sd-controller", &s->sdhci,
TYPE_CADENCE_SDHCI);
+ object_property_set_bool(OBJECT(&s->sdhci), "bus64bit", true,
+ &error_abort);
object_initialize_child(obj, "ioscb", &s->ioscb, TYPE_MCHP_PFSOC_IOSCB);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (10 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 11/24] hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 8:34 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 13/24] hw/rtc: Add PolarFire SoC RTC model Bin Meng
` (13 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Conor Dooley, Sebastian Huber, qemu-riscv
U-Boot requests the PolarFire SoC device serial number during board
late initialization. The IOSCB previously rejected every request, so
board setup could not complete.
Model the System Services control registers and byte-addressable
mailbox. Obtain the 128-bit serial number from an optional device
property, using a deterministic value when it is not configured.
Return an explicit failure for unsupported services and reset the new
runtime state with the rest of the device.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
(no changes since v1)
include/hw/misc/mchp_pfsoc_ioscb.h | 6 ++
hw/misc/mchp_pfsoc_ioscb.c | 141 +++++++++++++++++++++++++----
2 files changed, 130 insertions(+), 17 deletions(-)
diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
index 9687ea25b1..fd31427304 100644
--- a/include/hw/misc/mchp_pfsoc_ioscb.h
+++ b/include/hw/misc/mchp_pfsoc_ioscb.h
@@ -25,6 +25,8 @@
#include "hw/core/sysbus.h"
+#define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
+
typedef struct MchpPfSoCIoscbState {
SysBusDevice parent;
MemoryRegion container;
@@ -47,6 +49,10 @@ typedef struct MchpPfSoCIoscbState {
MemoryRegion cfm_sgmii;
MemoryRegion bc_sgmii;
MemoryRegion io_calib_sgmii;
+ uint32_t services_cr;
+ uint32_t services_sr;
+ uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
+ char *serial_number;
qemu_irq irq;
} MchpPfSoCIoscbState;
diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
index 09b702e520..7c82b55986 100644
--- a/hw/misc/mchp_pfsoc_ioscb.c
+++ b/hw/misc/mchp_pfsoc_ioscb.c
@@ -25,6 +25,7 @@
#include "qemu/log.h"
#include "qapi/error.h"
#include "hw/core/irq.h"
+#include "hw/core/qdev-properties.h"
#include "hw/core/sysbus.h"
#include "hw/misc/mchp_pfsoc_ioscb.h"
@@ -37,6 +38,9 @@
#define IOSCB_CCC_REG_SIZE 0x2000000
#define IOSCB_CTRL_REG_SIZE 0x800
#define IOSCB_QSPIXIP_REG_SIZE 0x200
+#define IOSCB_SERIAL_NUMBER_SIZE 16U
+#define IOSCB_DEFAULT_SERIAL_NUMBER "0123456789abcdef"
+#define IOSCB_PROP_SERIAL_NUMBER "serial-number"
/*
@@ -186,33 +190,71 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
.endianness = DEVICE_LITTLE_ENDIAN,
};
-#define SERVICES_CR 0x50
-#define SERVICES_SR 0x54
-#define SERVICES_STATUS_SHIFT 16
+#define SERVICES_CR 0x50
+#define SERVICES_CR_REQUEST BIT(0)
+#define SERVICES_CR_COMMAND_SHIFT 16
+#define SERVICES_CR_COMMAND_WIDTH 8
+#define SERVICES_CR_COMMAND_MASK \
+ MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
+#define SERVICES_CR_MASK \
+ (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
+#define SERVICES_SR 0x54
+#define SERVICES_SR_STATUS_SHIFT 16
+#define SERVICES_COMMAND_SERIAL_NUMBER 0
+#define SERVICES_STATUS_SUCCESS 0
+#define SERVICES_STATUS_FAILED 1
+#define SERVICES_MAILBOX_RESPONSE_OFFSET 0
+
+static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
+{
+ uint32_t command;
+ uint32_t status = SERVICES_STATUS_FAILED;
+
+ if (device_is_in_reset(DEVICE(s)) ||
+ !(value & SERVICES_CR_REQUEST)) {
+ return;
+ }
+
+ /*
+ * System services complete synchronously in this model, so clear the
+ * request bit before exposing the response to the guest.
+ */
+ s->services_cr &= ~SERVICES_CR_REQUEST;
+
+ command = (value & SERVICES_CR_COMMAND_MASK) >>
+ SERVICES_CR_COMMAND_SHIFT;
+ if (command == SERVICES_COMMAND_SERIAL_NUMBER) {
+ /*
+ * The serial-number service returns a 128-bit response starting at
+ * the beginning of the mailbox.
+ */
+ memset(&s->mailbox_data[SERVICES_MAILBOX_RESPONSE_OFFSET], 0,
+ IOSCB_SERIAL_NUMBER_SIZE);
+ memcpy(&s->mailbox_data[SERVICES_MAILBOX_RESPONSE_OFFSET],
+ s->serial_number, strlen(s->serial_number));
+ status = SERVICES_STATUS_SUCCESS;
+ }
+
+ s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
+ qemu_irq_raise(s->irq);
+}
static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
unsigned size)
{
- uint32_t val = 0;
+ MchpPfSoCIoscbState *s = opaque;
switch (offset) {
+ case SERVICES_CR:
+ return s->services_cr;
case SERVICES_SR:
- /*
- * Although some services have no error codes, most do. All services
- * that do implement errors, begin their error codes at 1. Treat all
- * service requests as failures & return 1.
- * See the "PolarFire® FPGA and PolarFire SoC FPGA System Services"
- * user guide for more information on service error codes.
- */
- val = 1u << SERVICES_STATUS_SHIFT;
- break;
+ return s->services_sr;
default:
qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
"(size %d, offset 0x%" HWADDR_PRIx ")\n",
__func__, size, offset);
+ return 0;
}
-
- return val;
}
static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
@@ -222,13 +264,17 @@ static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
switch (offset) {
case SERVICES_CR:
- qemu_irq_raise(s->irq);
+ s->services_cr = value & SERVICES_CR_MASK;
+ services_cr_write(s, value);
+ break;
+ case SERVICES_SR:
break;
default:
qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
"(size %d, value 0x%" PRIx64
", offset 0x%" HWADDR_PRIx ")\n",
__func__, size, value, offset);
+ break;
}
}
@@ -236,6 +282,55 @@ static const MemoryRegionOps mchp_pfsoc_ctrl_ops = {
.read = mchp_pfsoc_ctrl_read,
.write = mchp_pfsoc_ctrl_write,
.endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = sizeof(uint32_t),
+ .max_access_size = sizeof(uint32_t),
+ },
+};
+
+/*
+ * The System Controller uses the mailbox as a byte-addressable shared buffer
+ * for service command payloads and responses.
+ */
+static uint64_t mchp_pfsoc_mailbox_read(void *opaque, hwaddr offset,
+ unsigned size)
+{
+ MchpPfSoCIoscbState *s = opaque;
+
+ return ldn_le_p(&s->mailbox_data[offset], size);
+}
+
+static void mchp_pfsoc_mailbox_write(void *opaque, hwaddr offset,
+ uint64_t value, unsigned size)
+{
+ MchpPfSoCIoscbState *s = opaque;
+
+ stn_le_p(&s->mailbox_data[offset], size, value);
+}
+
+static const MemoryRegionOps mchp_pfsoc_mailbox_ops = {
+ .read = mchp_pfsoc_mailbox_read,
+ .write = mchp_pfsoc_mailbox_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = sizeof(uint8_t),
+ .max_access_size = sizeof(uint32_t),
+ },
+};
+
+static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
+{
+ MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
+
+ s->services_cr = 0;
+ s->services_sr = 0;
+ memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
+ qemu_irq_lower(s->irq);
+}
+
+static const Property mchp_pfsoc_ioscb_properties[] = {
+ DEFINE_PROP_STRING(IOSCB_PROP_SERIAL_NUMBER,
+ MchpPfSoCIoscbState, serial_number),
};
static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
@@ -243,6 +338,16 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ /* Use a deterministic identity when no serial number is configured */
+ if (!s->serial_number) {
+ s->serial_number = g_strdup(IOSCB_DEFAULT_SERIAL_NUMBER);
+ }
+ if (strlen(s->serial_number) > IOSCB_SERIAL_NUMBER_SIZE) {
+ error_setg(errp, "The serial number can't be longer than %u bytes",
+ IOSCB_SERIAL_NUMBER_SIZE);
+ return;
+ }
+
memory_region_init(&s->container, OBJECT(s),
"mchp.pfsoc.ioscb", IOSCB_WHOLE_REG_SIZE);
sysbus_init_mmio(sbd, &s->container);
@@ -265,7 +370,7 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
"mchp.pfsoc.ioscb.qspixip", IOSCB_QSPIXIP_REG_SIZE);
memory_region_add_subregion(&s->container, IOSCB_QSPIXIP_BASE, &s->qspixip);
- memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
+ memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_mailbox_ops, s,
"mchp.pfsoc.ioscb.mailbox", IOSCB_SUBMOD_REG_SIZE);
memory_region_add_subregion(&s->container, IOSCB_MAILBOX_BASE, &s->mailbox);
@@ -343,6 +448,8 @@ static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, const void *data)
dc->desc = "Microchip PolarFire SoC IOSCB modules";
dc->realize = mchp_pfsoc_ioscb_realize;
+ device_class_set_legacy_reset(dc, mchp_pfsoc_ioscb_reset);
+ device_class_set_props(dc, mchp_pfsoc_ioscb_properties);
}
static const TypeInfo mchp_pfsoc_ioscb_info = {
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 13/24] hw/rtc: Add PolarFire SoC RTC model
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (11 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 14/24] hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit Bin Meng
` (12 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Conor Dooley, Paolo Bonzini, Sebastian Huber, qemu-riscv
The PolarFire SoC exposes an RTC with binary and calendar modes,
programmable prescaling, alarms, and wakeup and match interrupts.
Add a standalone device model with explicit MMIO handling for time,
commands, alarms, interrupt state, reset, and migration. Add its
Kconfig and Meson entries and list it under the PolarFire SoC
maintainer section.
Reset the device to its documented hardware values, with the binary
counter stopped at zero.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- Reset the RTC to the documented hardware values
- Use the Resettable API instead of a legacy reset handler
MAINTAINERS | 2 +
include/hw/rtc/mchp_pfsoc_rtc.h | 46 +++
hw/rtc/mchp_pfsoc_rtc.c | 477 ++++++++++++++++++++++++++++++++
hw/rtc/Kconfig | 3 +
hw/rtc/meson.build | 1 +
5 files changed, 529 insertions(+)
create mode 100644 include/hw/rtc/mchp_pfsoc_rtc.h
create mode 100644 hw/rtc/mchp_pfsoc_rtc.c
diff --git a/MAINTAINERS b/MAINTAINERS
index 58425dcad4..adc4a41266 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1797,12 +1797,14 @@ F: hw/misc/mchp_pfsoc_dmc.c
F: hw/misc/mchp_pfsoc_ioscb.c
F: hw/misc/mchp_pfsoc_l2cc.c
F: hw/misc/mchp_pfsoc_sysreg.c
+F: hw/rtc/mchp_pfsoc_rtc.c
F: include/hw/riscv/microchip_pfsoc.h
F: include/hw/char/mchp_pfsoc_mmuart.h
F: include/hw/misc/mchp_pfsoc_dmc.h
F: include/hw/misc/mchp_pfsoc_ioscb.h
F: include/hw/misc/mchp_pfsoc_l2cc.h
F: include/hw/misc/mchp_pfsoc_sysreg.h
+F: include/hw/rtc/mchp_pfsoc_rtc.h
F: tests/qtest/mchp_pfsoc_l2cc_test.c
Shakti C class SoC
diff --git a/include/hw/rtc/mchp_pfsoc_rtc.h b/include/hw/rtc/mchp_pfsoc_rtc.h
new file mode 100644
index 0000000000..17bc6ddcdc
--- /dev/null
+++ b/include/hw/rtc/mchp_pfsoc_rtc.h
@@ -0,0 +1,46 @@
+/*
+ * Microchip PolarFire SoC RTC
+ *
+ * Copyright (c) 2026 Process Mission
+ *
+ * Author:
+ * Bin Meng <bin.meng@processmission.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_RTC_MCHP_PFSOC_RTC_H
+#define HW_RTC_MCHP_PFSOC_RTC_H
+
+#include "hw/core/sysbus.h"
+#include "qemu/timer.h"
+#include "qom/object.h"
+
+#define TYPE_MCHP_PFSOC_RTC "mchp.pfsoc.rtc"
+OBJECT_DECLARE_SIMPLE_TYPE(MchpPfSoCRtcState, MCHP_PFSOC_RTC)
+
+#define MCHP_PFSOC_RTC_REGS 28
+
+struct MchpPfSoCRtcState {
+ SysBusDevice parent_obj;
+
+ MemoryRegion iomem;
+ qemu_irq irq_wakeup;
+ qemu_irq irq_match;
+ QEMUTimer *alarm_timer;
+
+ int64_t tick_offset;
+ int64_t tick_offset_vmstate;
+ uint64_t frozen_count;
+ uint64_t read_latch;
+ bool running;
+ bool alarm_enabled;
+ bool wakeup_pending;
+ bool match_pending;
+ bool updated;
+ bool read_latch_valid;
+
+ uint32_t regs[MCHP_PFSOC_RTC_REGS];
+};
+
+#endif /* HW_RTC_MCHP_PFSOC_RTC_H */
diff --git a/hw/rtc/mchp_pfsoc_rtc.c b/hw/rtc/mchp_pfsoc_rtc.c
new file mode 100644
index 0000000000..f5068b15ef
--- /dev/null
+++ b/hw/rtc/mchp_pfsoc_rtc.c
@@ -0,0 +1,477 @@
+/*
+ * Microchip PolarFire SoC RTC
+ *
+ * Copyright (c) 2026 Process Mission
+ *
+ * Author:
+ * Bin Meng <bin.meng@processmission.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/rtc/mchp_pfsoc_rtc.h"
+#include "hw/core/irq.h"
+#include "migration/vmstate.h"
+#include "qemu/cutils.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "system/rtc.h"
+#include "system/system.h"
+
+#define RTC_MMIO_SIZE 0x1000
+#define RTC_CONTROL_MASK 0x000007ff
+#define RTC_MODE_MASK 0x0000000f
+#define RTC_PRESCALER_MASK 0x03ffffff
+#define RTC_ALARM_UPPER_MASK 0x000007ff
+#define RTC_UPPER_MASK 0x3fffffff
+#define RTC_CALENDAR_MASK 0x000000ff
+
+#define RTC_CONTROL 0x00
+#define RTC_CONTROL_START_RUNNING BIT(0)
+#define RTC_CONTROL_STOP BIT(1)
+#define RTC_CONTROL_ALARM_ON BIT(2)
+#define RTC_CONTROL_ALARM_OFF BIT(3)
+#define RTC_CONTROL_RESET BIT(4)
+#define RTC_CONTROL_UPLOAD BIT(5)
+#define RTC_CONTROL_DOWNLOAD BIT(6)
+#define RTC_CONTROL_MATCH BIT(7)
+#define RTC_CONTROL_WAKEUP_CLEAR BIT(8)
+#define RTC_CONTROL_WAKEUP_SET BIT(9)
+#define RTC_CONTROL_UPDATED BIT(10)
+
+#define RTC_MODE 0x04
+#define RTC_MODE_CLOCK_CALENDAR BIT(0)
+#define RTC_MODE_WAKEUP_ENABLE BIT(1)
+#define RTC_MODE_WAKEUP_RESET BIT(2)
+#define RTC_MODE_WAKEUP_CONTINUE BIT(3)
+
+#define RTC_PRESCALER 0x08
+#define RTC_ALARM_LOWER 0x0c
+#define RTC_ALARM_UPPER 0x10
+#define RTC_COMPARE_LOWER 0x14
+#define RTC_COMPARE_UPPER 0x18
+#define RTC_DATETIME_LOWER 0x20
+#define RTC_DATETIME_UPPER 0x24
+#define RTC_SECONDS 0x30
+#define RTC_MINUTES 0x34
+#define RTC_HOURS 0x38
+#define RTC_DAY 0x3c
+#define RTC_MONTH 0x40
+#define RTC_YEAR 0x44
+#define RTC_WEEKDAY 0x48
+#define RTC_WEEK 0x4c
+#define RTC_SECONDS_COUNT 0x50
+#define RTC_MINUTES_COUNT 0x54
+#define RTC_HOURS_COUNT 0x58
+#define RTC_DAY_COUNT 0x5c
+#define RTC_MONTH_COUNT 0x60
+#define RTC_YEAR_COUNT 0x64
+#define RTC_WEEKDAY_COUNT 0x68
+#define RTC_WEEK_COUNT 0x6c
+
+#define RTC_REG(offset) ((offset) / sizeof(uint32_t))
+
+static uint64_t mchp_pfsoc_rtc_get_count(MchpPfSoCRtcState *s)
+{
+ if (!s->running) {
+ return s->frozen_count;
+ }
+
+ return s->tick_offset +
+ qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+}
+
+static void mchp_pfsoc_rtc_set_count(MchpPfSoCRtcState *s, uint64_t count)
+{
+ if (s->running) {
+ s->tick_offset = (int64_t)count -
+ qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+ } else {
+ s->frozen_count = count;
+ }
+}
+
+static void mchp_pfsoc_rtc_update_irq(MchpPfSoCRtcState *s)
+{
+ qemu_set_irq(s->irq_wakeup, s->wakeup_pending);
+ qemu_set_irq(s->irq_match, s->match_pending);
+}
+
+static void mchp_pfsoc_rtc_schedule_alarm(MchpPfSoCRtcState *s);
+
+static void mchp_pfsoc_rtc_alarm(void *opaque)
+{
+ MchpPfSoCRtcState *s = opaque;
+ bool periodic = s->regs[RTC_REG(RTC_MODE)] & RTC_MODE_WAKEUP_RESET;
+
+ s->alarm_enabled = periodic;
+ s->match_pending = true;
+ if (s->regs[RTC_REG(RTC_MODE)] & RTC_MODE_WAKEUP_ENABLE) {
+ s->wakeup_pending = true;
+ }
+ if (s->regs[RTC_REG(RTC_MODE)] & RTC_MODE_WAKEUP_RESET) {
+ mchp_pfsoc_rtc_set_count(s, 0);
+ }
+ if (!(s->regs[RTC_REG(RTC_MODE)] & RTC_MODE_WAKEUP_CONTINUE)) {
+ s->frozen_count = mchp_pfsoc_rtc_get_count(s);
+ s->running = false;
+ }
+ mchp_pfsoc_rtc_update_irq(s);
+ if (periodic) {
+ mchp_pfsoc_rtc_schedule_alarm(s);
+ }
+}
+
+static void mchp_pfsoc_rtc_schedule_alarm(MchpPfSoCRtcState *s)
+{
+ uint64_t compare_mask;
+ uint64_t target;
+ uint64_t now;
+ uint64_t delta;
+
+ timer_del(s->alarm_timer);
+ if (!s->alarm_enabled || !s->running ||
+ (s->regs[RTC_REG(RTC_MODE)] & RTC_MODE_CLOCK_CALENDAR)) {
+ return;
+ }
+
+ compare_mask = s->regs[RTC_REG(RTC_COMPARE_LOWER)] |
+ ((uint64_t)(s->regs[RTC_REG(RTC_COMPARE_UPPER)] &
+ RTC_UPPER_MASK) << 32);
+ if (compare_mask != MAKE_64BIT_MASK(0, 62)) {
+ return;
+ }
+
+ target = s->regs[RTC_REG(RTC_ALARM_LOWER)] |
+ ((uint64_t)(s->regs[RTC_REG(RTC_ALARM_UPPER)] &
+ RTC_ALARM_UPPER_MASK) << 32);
+ now = mchp_pfsoc_rtc_get_count(s);
+ if (target <= now) {
+ mchp_pfsoc_rtc_alarm(s);
+ return;
+ }
+
+ delta = target - now;
+ if (delta > INT64_MAX / NANOSECONDS_PER_SECOND) {
+ return;
+ }
+ timer_mod(s->alarm_timer,
+ qemu_clock_get_ns(rtc_clock) + delta * NANOSECONDS_PER_SECOND);
+}
+
+static void mchp_pfsoc_rtc_control_write(MchpPfSoCRtcState *s,
+ uint32_t value)
+{
+ uint64_t count;
+
+ value &= RTC_CONTROL_MASK;
+ if (value & RTC_CONTROL_UPDATED) {
+ s->updated = false;
+ }
+ if (value & RTC_CONTROL_RESET) {
+ mchp_pfsoc_rtc_set_count(s, 0);
+ s->updated = true;
+ }
+ if (value & RTC_CONTROL_UPLOAD) {
+ count = s->regs[RTC_REG(RTC_DATETIME_LOWER)] |
+ ((uint64_t)(s->regs[RTC_REG(RTC_DATETIME_UPPER)] &
+ RTC_UPPER_MASK) << 32);
+ mchp_pfsoc_rtc_set_count(s, count);
+ s->updated = true;
+ }
+ if (value & RTC_CONTROL_DOWNLOAD) {
+ count = mchp_pfsoc_rtc_get_count(s);
+ s->regs[RTC_REG(RTC_DATETIME_LOWER)] = count;
+ s->regs[RTC_REG(RTC_DATETIME_UPPER)] = count >> 32;
+ }
+ if ((value & RTC_CONTROL_START_RUNNING) && !s->running) {
+ s->tick_offset = (int64_t)s->frozen_count -
+ qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
+ s->running = true;
+ }
+ if ((value & RTC_CONTROL_STOP) && s->running) {
+ s->frozen_count = mchp_pfsoc_rtc_get_count(s);
+ s->running = false;
+ }
+ if (value & RTC_CONTROL_ALARM_OFF) {
+ s->alarm_enabled = false;
+ s->wakeup_pending = false;
+ s->match_pending = false;
+ timer_del(s->alarm_timer);
+ } else if (value & RTC_CONTROL_ALARM_ON) {
+ s->alarm_enabled = true;
+ }
+ if (value & RTC_CONTROL_WAKEUP_CLEAR) {
+ s->wakeup_pending = false;
+ s->match_pending = false;
+ }
+ if (value & RTC_CONTROL_WAKEUP_SET) {
+ s->wakeup_pending = true;
+ }
+
+ mchp_pfsoc_rtc_update_irq(s);
+ mchp_pfsoc_rtc_schedule_alarm(s);
+}
+
+static uint32_t mchp_pfsoc_rtc_control_read(MchpPfSoCRtcState *s)
+{
+ uint32_t value;
+
+ value = s->running ? RTC_CONTROL_START_RUNNING : 0;
+ if (s->alarm_enabled) {
+ value |= RTC_CONTROL_ALARM_ON;
+ }
+ if (s->match_pending) {
+ value |= RTC_CONTROL_MATCH;
+ }
+ if (s->updated) {
+ value |= RTC_CONTROL_UPDATED;
+ }
+ return value;
+}
+
+static uint32_t mchp_pfsoc_rtc_datetime_lower_read(MchpPfSoCRtcState *s)
+{
+ s->read_latch = mchp_pfsoc_rtc_get_count(s);
+ s->read_latch_valid = true;
+ return (uint32_t)s->read_latch;
+}
+
+static uint32_t mchp_pfsoc_rtc_datetime_upper_read(MchpPfSoCRtcState *s)
+{
+ uint64_t count = s->read_latch_valid ? s->read_latch :
+ mchp_pfsoc_rtc_get_count(s);
+
+ s->read_latch_valid = false;
+ return (count >> 32) & RTC_UPPER_MASK;
+}
+
+static uint64_t mchp_pfsoc_rtc_read(void *opaque, hwaddr offset,
+ unsigned size)
+{
+ MchpPfSoCRtcState *s = opaque;
+
+ switch (offset) {
+ case RTC_CONTROL:
+ return mchp_pfsoc_rtc_control_read(s);
+ case RTC_DATETIME_LOWER:
+ return mchp_pfsoc_rtc_datetime_lower_read(s);
+ case RTC_DATETIME_UPPER:
+ return mchp_pfsoc_rtc_datetime_upper_read(s);
+ case RTC_MODE:
+ case RTC_PRESCALER:
+ case RTC_ALARM_LOWER:
+ case RTC_ALARM_UPPER:
+ case RTC_COMPARE_LOWER:
+ case RTC_COMPARE_UPPER:
+ case RTC_SECONDS:
+ case RTC_MINUTES:
+ case RTC_HOURS:
+ case RTC_DAY:
+ case RTC_MONTH:
+ case RTC_YEAR:
+ case RTC_WEEKDAY:
+ case RTC_WEEK:
+ case RTC_SECONDS_COUNT:
+ case RTC_MINUTES_COUNT:
+ case RTC_HOURS_COUNT:
+ case RTC_DAY_COUNT:
+ case RTC_MONTH_COUNT:
+ case RTC_YEAR_COUNT:
+ case RTC_WEEKDAY_COUNT:
+ case RTC_WEEK_COUNT:
+ return s->regs[RTC_REG(offset)];
+ default:
+ qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
+ "(size %d, offset 0x%" HWADDR_PRIx ")\n",
+ __func__, size, offset);
+ return 0;
+ }
+}
+
+static void mchp_pfsoc_rtc_write(void *opaque, hwaddr offset,
+ uint64_t value, unsigned size)
+{
+ MchpPfSoCRtcState *s = opaque;
+ bool update_alarm = false;
+
+ switch (offset) {
+ case RTC_CONTROL:
+ mchp_pfsoc_rtc_control_write(s, value);
+ return;
+ case RTC_MODE:
+ s->regs[RTC_REG(offset)] = value & RTC_MODE_MASK;
+ update_alarm = true;
+ break;
+ case RTC_PRESCALER:
+ s->regs[RTC_REG(offset)] = value & RTC_PRESCALER_MASK;
+ break;
+ case RTC_ALARM_LOWER:
+ case RTC_COMPARE_LOWER:
+ s->regs[RTC_REG(offset)] = value;
+ update_alarm = true;
+ break;
+ case RTC_ALARM_UPPER:
+ s->regs[RTC_REG(offset)] = value & RTC_ALARM_UPPER_MASK;
+ update_alarm = true;
+ break;
+ case RTC_COMPARE_UPPER:
+ s->regs[RTC_REG(offset)] = value & RTC_UPPER_MASK;
+ update_alarm = true;
+ break;
+ case RTC_DATETIME_LOWER:
+ s->regs[RTC_REG(offset)] = value;
+ break;
+ case RTC_DATETIME_UPPER:
+ s->regs[RTC_REG(offset)] = value & RTC_UPPER_MASK;
+ break;
+ case RTC_SECONDS:
+ case RTC_MINUTES:
+ case RTC_HOURS:
+ case RTC_DAY:
+ case RTC_MONTH:
+ case RTC_YEAR:
+ case RTC_WEEKDAY:
+ case RTC_WEEK:
+ s->regs[RTC_REG(offset)] = value & RTC_CALENDAR_MASK;
+ break;
+ case RTC_SECONDS_COUNT:
+ case RTC_MINUTES_COUNT:
+ case RTC_HOURS_COUNT:
+ case RTC_DAY_COUNT:
+ case RTC_MONTH_COUNT:
+ case RTC_YEAR_COUNT:
+ case RTC_WEEKDAY_COUNT:
+ case RTC_WEEK_COUNT:
+ break;
+ default:
+ qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
+ "(size %d, value 0x%" PRIx64
+ ", offset 0x%" HWADDR_PRIx ")\n",
+ __func__, size, value, offset);
+ return;
+ }
+
+ if (update_alarm) {
+ mchp_pfsoc_rtc_schedule_alarm(s);
+ }
+}
+
+static const MemoryRegionOps mchp_pfsoc_rtc_ops = {
+ .read = mchp_pfsoc_rtc_read,
+ .write = mchp_pfsoc_rtc_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = { .min_access_size = 4, .max_access_size = 4 },
+};
+
+static void mchp_pfsoc_rtc_reset_hold(Object *obj, ResetType type)
+{
+ MchpPfSoCRtcState *s = MCHP_PFSOC_RTC(obj);
+
+ timer_del(s->alarm_timer);
+ s->running = false;
+ s->alarm_enabled = false;
+ s->wakeup_pending = false;
+ s->match_pending = false;
+ s->updated = false;
+ s->read_latch_valid = false;
+ memset(s->regs, 0, sizeof(s->regs));
+
+ s->tick_offset = 0;
+ s->frozen_count = 0;
+ s->read_latch = 0;
+ mchp_pfsoc_rtc_update_irq(s);
+}
+
+static int mchp_pfsoc_rtc_pre_save(void *opaque)
+{
+ MchpPfSoCRtcState *s = opaque;
+ int64_t delta = qemu_clock_get_ns(rtc_clock) /
+ NANOSECONDS_PER_SECOND -
+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
+ NANOSECONDS_PER_SECOND;
+
+ s->tick_offset_vmstate = s->tick_offset + delta;
+ return 0;
+}
+
+static int mchp_pfsoc_rtc_post_load(void *opaque, int version_id)
+{
+ MchpPfSoCRtcState *s = opaque;
+ int64_t delta = qemu_clock_get_ns(rtc_clock) /
+ NANOSECONDS_PER_SECOND -
+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
+ NANOSECONDS_PER_SECOND;
+
+ s->tick_offset = s->tick_offset_vmstate - delta;
+ s->read_latch_valid = false;
+ mchp_pfsoc_rtc_update_irq(s);
+ mchp_pfsoc_rtc_schedule_alarm(s);
+ return 0;
+}
+
+static const VMStateDescription vmstate_mchp_pfsoc_rtc = {
+ .name = TYPE_MCHP_PFSOC_RTC,
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .pre_save = mchp_pfsoc_rtc_pre_save,
+ .post_load = mchp_pfsoc_rtc_post_load,
+ .fields = (const VMStateField[]) {
+ VMSTATE_UINT32_ARRAY(regs, MchpPfSoCRtcState,
+ MCHP_PFSOC_RTC_REGS),
+ VMSTATE_INT64(tick_offset_vmstate, MchpPfSoCRtcState),
+ VMSTATE_UINT64(frozen_count, MchpPfSoCRtcState),
+ VMSTATE_BOOL(running, MchpPfSoCRtcState),
+ VMSTATE_BOOL(alarm_enabled, MchpPfSoCRtcState),
+ VMSTATE_BOOL(wakeup_pending, MchpPfSoCRtcState),
+ VMSTATE_BOOL(match_pending, MchpPfSoCRtcState),
+ VMSTATE_BOOL(updated, MchpPfSoCRtcState),
+ VMSTATE_END_OF_LIST()
+ },
+};
+
+static void mchp_pfsoc_rtc_init(Object *obj)
+{
+ MchpPfSoCRtcState *s = MCHP_PFSOC_RTC(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+ memory_region_init_io(&s->iomem, obj, &mchp_pfsoc_rtc_ops, s,
+ TYPE_MCHP_PFSOC_RTC, RTC_MMIO_SIZE);
+ sysbus_init_mmio(sbd, &s->iomem);
+ sysbus_init_irq(sbd, &s->irq_wakeup);
+ sysbus_init_irq(sbd, &s->irq_match);
+ s->alarm_timer = timer_new_ns(rtc_clock, mchp_pfsoc_rtc_alarm, s);
+}
+
+static void mchp_pfsoc_rtc_finalize(Object *obj)
+{
+ MchpPfSoCRtcState *s = MCHP_PFSOC_RTC(obj);
+
+ timer_free(s->alarm_timer);
+}
+
+static void mchp_pfsoc_rtc_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+ rc->phases.hold = mchp_pfsoc_rtc_reset_hold;
+ dc->vmsd = &vmstate_mchp_pfsoc_rtc;
+}
+
+static const TypeInfo mchp_pfsoc_rtc_info = {
+ .name = TYPE_MCHP_PFSOC_RTC,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(MchpPfSoCRtcState),
+ .instance_init = mchp_pfsoc_rtc_init,
+ .instance_finalize = mchp_pfsoc_rtc_finalize,
+ .class_init = mchp_pfsoc_rtc_class_init,
+};
+
+static void mchp_pfsoc_rtc_register_types(void)
+{
+ type_register_static(&mchp_pfsoc_rtc_info);
+}
+
+type_init(mchp_pfsoc_rtc_register_types)
diff --git a/hw/rtc/Kconfig b/hw/rtc/Kconfig
index 315b0e4ecc..0d53546adc 100644
--- a/hw/rtc/Kconfig
+++ b/hw/rtc/Kconfig
@@ -14,6 +14,9 @@ config M48T59
config PL031
bool
+config MCHP_PFSOC_RTC
+ bool
+
config MC146818RTC
depends on ISA_BUS
bool
diff --git a/hw/rtc/meson.build b/hw/rtc/meson.build
index 6c87864dc0..4a666bfc94 100644
--- a/hw/rtc/meson.build
+++ b/hw/rtc/meson.build
@@ -3,6 +3,7 @@ system_ss.add(when: 'CONFIG_DS1338', if_true: files('ds1338.c'))
system_ss.add(when: 'CONFIG_M41T80', if_true: files('m41t80.c'))
system_ss.add(when: 'CONFIG_M48T59', if_true: files('m48t59.c'))
system_ss.add(when: 'CONFIG_PL031', if_true: files('pl031.c'))
+system_ss.add(when: 'CONFIG_MCHP_PFSOC_RTC', if_true: files('mchp_pfsoc_rtc.c'))
system_ss.add(when: ['CONFIG_ISA_BUS', 'CONFIG_M48T59'], if_true: files('m48t59-isa.c'))
system_ss.add(when: 'CONFIG_XLNX_ZYNQMP', if_true: files('xlnx-zynqmp-rtc.c'))
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 14/24] hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (12 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 13/24] hw/rtc: Add PolarFire SoC RTC model Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 15/24] tests/qtest: Add PolarFire SoC RTC coverage Bin Meng
` (11 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Paolo Bonzini, Sebastian Huber,
Weiwei Li, qemu-riscv
The Icicle Kit memory map advertises the PolarFire RTC, but the
machine leaves its MMIO range unmapped. Linux faults when it
programs the RTC prescaler during boot.
Select and instantiate the RTC, map it at the documented address,
and wire its wakeup and match outputs to PLIC interrupts 80 and 81.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
include/hw/riscv/microchip_pfsoc.h | 4 ++++
hw/riscv/microchip_pfsoc.c | 11 +++++++++++
hw/riscv/Kconfig | 1 +
3 files changed, 16 insertions(+)
diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
index 0aeccedf77..26d28252ea 100644
--- a/include/hw/riscv/microchip_pfsoc.h
+++ b/include/hw/riscv/microchip_pfsoc.h
@@ -31,6 +31,7 @@
#include "hw/misc/mchp_pfsoc_ioscb.h"
#include "hw/misc/mchp_pfsoc_sysreg.h"
#include "hw/net/cadence_gem.h"
+#include "hw/rtc/mchp_pfsoc_rtc.h"
#include "hw/sd/cadence_sdhci.h"
#include "hw/riscv/riscv_hart.h"
@@ -53,6 +54,7 @@ typedef struct MicrochipPFSoCState {
MchpPfSoCMMUartState *serial2;
MchpPfSoCMMUartState *serial3;
MchpPfSoCMMUartState *serial4;
+ MchpPfSoCRtcState rtc;
MchpPfSoCSysregState sysreg;
SiFivePDMAState dma;
CadenceGEMState gem0;
@@ -148,6 +150,8 @@ enum {
MICROCHIP_PFSOC_DMA_IRQ7 = 12,
MICROCHIP_PFSOC_GEM0_IRQ = 64,
MICROCHIP_PFSOC_GEM1_IRQ = 70,
+ MICROCHIP_PFSOC_RTC_WAKEUP_IRQ = 80,
+ MICROCHIP_PFSOC_RTC_MATCH_IRQ = 81,
MICROCHIP_PFSOC_EMMC_SD_IRQ = 88,
MICROCHIP_PFSOC_MMUART0_IRQ = 90,
MICROCHIP_PFSOC_MMUART1_IRQ = 91,
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index b1df852ddd..fb0e18edba 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -180,6 +180,8 @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
object_initialize_child(obj, "sysreg", &s->sysreg,
TYPE_MCHP_PFSOC_SYSREG);
+ object_initialize_child(obj, "rtc", &s->rtc, TYPE_MCHP_PFSOC_RTC);
+
object_initialize_child(obj, "ddr-sgmii-phy", &s->ddr_sgmii_phy,
TYPE_MCHP_PFSOC_DDR_SGMII_PHY);
object_initialize_child(obj, "ddr-cfg", &s->ddr_cfg,
@@ -311,6 +313,15 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
memmap[MICROCHIP_PFSOC_PLIC].size);
g_free(plic_hart_config);
+ /* RTC */
+ sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp);
+ sysbus_mmio_map(SYS_BUS_DEVICE(&s->rtc), 0,
+ memmap[MICROCHIP_PFSOC_RTC].base);
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
+ qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_RTC_WAKEUP_IRQ));
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 1,
+ qdev_get_gpio_in(DEVICE(s->plic), MICROCHIP_PFSOC_RTC_MATCH_IRQ));
+
/* DMA */
sysbus_realize(SYS_BUS_DEVICE(&s->dma), errp);
sysbus_mmio_map(SYS_BUS_DEVICE(&s->dma), 0,
diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
index 85b535c7cb..de1da02761 100644
--- a/hw/riscv/Kconfig
+++ b/hw/riscv/Kconfig
@@ -20,6 +20,7 @@ config MICROCHIP_PFSOC
select MCHP_PFSOC_IOSCB
select MCHP_PFSOC_L2CC
select MCHP_PFSOC_MMUART
+ select MCHP_PFSOC_RTC
select MCHP_PFSOC_SYSREG
select RISCV_ACLINT
select SIFIVE_PDMA
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 15/24] tests/qtest: Add PolarFire SoC RTC coverage
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (13 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 14/24] hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests Bin Meng
` (10 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Conor Dooley, Fabiano Rosas, Laurent Vivier, Paolo Bonzini,
Sebastian Huber, qemu-riscv
Exercise RTC register masks, binary counter, upload and stop controls,
alarm and wakeup interrupt behavior, reset state, and PLIC wiring on
the Icicle Kit.
Also verify RTC state and pending interrupt migration, including streams
from QEMU versions that predate the RTC device.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- Expect the documented hardware state after RTC reset
MAINTAINERS | 1 +
tests/qtest/mchp_pfsoc_rtc_test.c | 315 ++++++++++++++++++++++++++++++
tests/qtest/meson.build | 5 +-
3 files changed, 320 insertions(+), 1 deletion(-)
create mode 100644 tests/qtest/mchp_pfsoc_rtc_test.c
diff --git a/MAINTAINERS b/MAINTAINERS
index adc4a41266..1856c67feb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1806,6 +1806,7 @@ F: include/hw/misc/mchp_pfsoc_l2cc.h
F: include/hw/misc/mchp_pfsoc_sysreg.h
F: include/hw/rtc/mchp_pfsoc_rtc.h
F: tests/qtest/mchp_pfsoc_l2cc_test.c
+F: tests/qtest/mchp_pfsoc_rtc_test.c
Shakti C class SoC
L: qemu-riscv@nongnu.org
diff --git a/tests/qtest/mchp_pfsoc_rtc_test.c b/tests/qtest/mchp_pfsoc_rtc_test.c
new file mode 100644
index 0000000000..ed96c15faa
--- /dev/null
+++ b/tests/qtest/mchp_pfsoc_rtc_test.c
@@ -0,0 +1,315 @@
+/*
+ * QTest testcase for the Microchip PolarFire SoC RTC
+ *
+ * Copyright (c) 2026 Process Mission
+ *
+ * Author:
+ * Bin Meng <bin.meng@processmission.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/bitops.h"
+#include "qemu/bswap.h"
+#include "qemu/timer.h"
+#include "libqtest.h"
+#include "migration/migration-qmp.h"
+#include "migration/migration-util.h"
+
+#define RTC_BASE 0x20124000
+#define RTC_CONTROL 0x00
+#define RTC_MODE 0x04
+#define RTC_PRESCALER 0x08
+#define RTC_ALARM_LOWER 0x0c
+#define RTC_ALARM_UPPER 0x10
+#define RTC_COMPARE_LOWER 0x14
+#define RTC_COMPARE_UPPER 0x18
+#define RTC_DATETIME_LOWER 0x20
+#define RTC_DATETIME_UPPER 0x24
+#define RTC_RUNNING BIT(0)
+#define RTC_STOP BIT(1)
+#define RTC_ALARM_ON BIT(2)
+#define RTC_ALARM_OFF BIT(3)
+#define RTC_UPLOAD BIT(5)
+#define RTC_MATCH BIT(7)
+#define RTC_WAKEUP_CLEAR BIT(8)
+#define RTC_WAKEUP_SET BIT(9)
+#define RTC_UPDATED BIT(10)
+#define RTC_WAKEUP_ENABLE BIT(1)
+#define RTC_WAKEUP_RESET BIT(2)
+#define RTC_WAKEUP_CONTINUE BIT(3)
+#define RTC_PRESCALER_MASK 0x03ffffff
+#define RTC_UPPER_MASK 0x3fffffff
+#define PLIC_BASE 0x0c000000
+#define PLIC_PENDING 0x1000
+#define PLIC_RTC_PENDING (BIT(16) | BIT(17))
+#define ENVM_BASE 0x20220000
+#define HSS_HEADER_SIZE 0x100
+#define HSS_HEADER_JUMP 0x1000006f
+#define HSS_PAYLOAD_BASE (ENVM_BASE + HSS_HEADER_SIZE)
+#define HSS_PAYLOAD_SIZE 8
+
+static QTestState *microchip_icicle_kit_start_rtc(const char *firmware)
+{
+ return qtest_initf(
+ "-machine microchip-icicle-kit -smp 5 -m 2G -bios \"%s\" "
+ "-rtc clock=vm", firmware);
+}
+
+static QTestState *microchip_icicle_kit_start_ext(const char *qemu_var,
+ const char *firmware)
+{
+ g_autofree char *args = g_strdup_printf(
+ "-machine microchip-icicle-kit -smp 5 -m 2G -bios \"%s\"",
+ firmware);
+
+ return qtest_init_ext(qemu_var, args, NULL, true);
+}
+
+static char *create_firmware(void)
+{
+ uint8_t firmware[HSS_HEADER_SIZE + HSS_PAYLOAD_SIZE] = { 0 };
+ static const uint8_t payload[] = {
+ 0x13, 0x00, 0x00, 0x00,
+ 0x6f, 0x00, 0x00, 0x00,
+ };
+ char *path;
+ int fd;
+ ssize_t written;
+ unsigned int i;
+
+ stl_le_p(&firmware[0], HSS_HEADER_JUMP);
+ stl_le_p(&firmware[4], HSS_PAYLOAD_SIZE);
+ for (i = 0; i < 5; i++) {
+ stl_le_p(&firmware[8 + i * sizeof(uint32_t)], HSS_PAYLOAD_BASE);
+ }
+ memcpy(&firmware[HSS_HEADER_SIZE], payload, sizeof(payload));
+
+ fd = g_file_open_tmp("microchip-icicle-kit-XXXXXX", &path, NULL);
+ g_assert_cmpint(fd, >=, 0);
+
+ written = write(fd, firmware, sizeof(firmware));
+ g_assert_cmpint(written, ==, sizeof(firmware));
+ close(fd);
+
+ return path;
+}
+
+static uint64_t rtc_read_binary_count(QTestState *qts)
+{
+ uint64_t count = qtest_readl(qts, RTC_BASE + RTC_DATETIME_LOWER);
+
+ count |= (uint64_t)qtest_readl(qts,
+ RTC_BASE + RTC_DATETIME_UPPER) << 32;
+ return count;
+}
+
+static void test_rtc(void)
+{
+ g_autofree char *firmware = create_firmware();
+ QTestState *qts = microchip_icicle_kit_start_rtc(firmware);
+ uint32_t control;
+
+ unlink(firmware);
+ qtest_irq_intercept_out_named(qts, "/machine/soc/rtc", "sysbus-irq");
+
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL), ==, 0);
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 0);
+ qtest_clock_step(qts, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 0);
+
+ qtest_writel(qts, RTC_BASE + RTC_MODE, UINT32_MAX);
+ qtest_writel(qts, RTC_BASE + RTC_PRESCALER, UINT32_MAX);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_MODE), ==, 0xf);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_PRESCALER), ==,
+ RTC_PRESCALER_MASK);
+ qtest_writel(qts, RTC_BASE + RTC_MODE, 0);
+
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_STOP);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL) &
+ RTC_RUNNING, ==, 0);
+ qtest_clock_step(qts, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 0);
+
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_LOWER, 42);
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_UPPER, 0);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_UPLOAD);
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 42);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL) &
+ (RTC_UPLOAD | RTC_UPDATED), ==, RTC_UPDATED);
+
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_RUNNING);
+ qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 43);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_WAKEUP_SET);
+ g_assert_true(qtest_get_irq(qts, 0));
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_WAKEUP_CLEAR);
+ g_assert_false(qtest_get_irq(qts, 0));
+
+ qtest_writel(qts, RTC_BASE + RTC_ALARM_LOWER, 45);
+ qtest_writel(qts, RTC_BASE + RTC_ALARM_UPPER, 0);
+ qtest_writel(qts, RTC_BASE + RTC_COMPARE_LOWER, UINT32_MAX);
+ qtest_writel(qts, RTC_BASE + RTC_COMPARE_UPPER, RTC_UPPER_MASK);
+ qtest_writel(qts, RTC_BASE + RTC_MODE,
+ RTC_WAKEUP_ENABLE | RTC_WAKEUP_CONTINUE);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_ALARM_ON);
+ g_assert_false(qtest_get_irq(qts, 0));
+ g_assert_false(qtest_get_irq(qts, 1));
+ control = qtest_readl(qts, RTC_BASE + RTC_CONTROL);
+ g_assert_cmphex(control & RTC_ALARM_ON, ==, RTC_ALARM_ON);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, control | RTC_ALARM_OFF);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL) &
+ RTC_ALARM_ON, ==, 0);
+ qtest_clock_step(qts, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_false(qtest_get_irq(qts, 0));
+ g_assert_false(qtest_get_irq(qts, 1));
+
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_LOWER, 43);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_UPLOAD);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_ALARM_ON);
+ qtest_clock_step(qts, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_true(qtest_get_irq(qts, 0));
+ g_assert_true(qtest_get_irq(qts, 1));
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL) & RTC_MATCH,
+ ==, RTC_MATCH);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_ALARM_OFF);
+ g_assert_false(qtest_get_irq(qts, 0));
+ g_assert_false(qtest_get_irq(qts, 1));
+
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_LOWER, 0);
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_UPPER, 0);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_UPLOAD);
+ qtest_writel(qts, RTC_BASE + RTC_ALARM_LOWER, 2);
+ qtest_writel(qts, RTC_BASE + RTC_MODE,
+ RTC_WAKEUP_ENABLE | RTC_WAKEUP_RESET |
+ RTC_WAKEUP_CONTINUE);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_ALARM_ON);
+ qtest_clock_step(qts, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_true(qtest_get_irq(qts, 0));
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 0);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL) &
+ RTC_ALARM_ON, ==, RTC_ALARM_ON);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_WAKEUP_CLEAR);
+ qtest_clock_step(qts, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_true(qtest_get_irq(qts, 0));
+ g_assert_cmphex(rtc_read_binary_count(qts), ==, 0);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_ALARM_OFF);
+ g_assert_false(qtest_get_irq(qts, 0));
+ g_assert_false(qtest_get_irq(qts, 1));
+
+ qtest_system_reset(qts);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_CONTROL), ==, 0);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_MODE), ==, 0);
+ g_assert_cmphex(qtest_readl(qts, RTC_BASE + RTC_PRESCALER), ==, 0);
+ g_assert_false(qtest_get_irq(qts, 0));
+ g_assert_false(qtest_get_irq(qts, 1));
+
+ qtest_quit(qts);
+}
+
+static void test_rtc_plic(void)
+{
+ g_autofree char *firmware = create_firmware();
+ QTestState *qts = microchip_icicle_kit_start_rtc(firmware);
+
+ unlink(firmware);
+
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_LOWER, 42);
+ qtest_writel(qts, RTC_BASE + RTC_DATETIME_UPPER, 0);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_UPLOAD);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_RUNNING);
+ qtest_writel(qts, RTC_BASE + RTC_ALARM_LOWER, 43);
+ qtest_writel(qts, RTC_BASE + RTC_ALARM_UPPER, 0);
+ qtest_writel(qts, RTC_BASE + RTC_COMPARE_LOWER, UINT32_MAX);
+ qtest_writel(qts, RTC_BASE + RTC_COMPARE_UPPER, RTC_UPPER_MASK);
+ qtest_writel(qts, RTC_BASE + RTC_MODE,
+ RTC_WAKEUP_ENABLE | RTC_WAKEUP_CONTINUE);
+ qtest_writel(qts, RTC_BASE + RTC_CONTROL, RTC_ALARM_ON);
+ qtest_clock_step(qts, NANOSECONDS_PER_SECOND);
+
+ g_assert_cmphex(qtest_readl(qts, PLIC_BASE + PLIC_PENDING + 8) &
+ PLIC_RTC_PENDING, ==, PLIC_RTC_PENDING);
+
+ qtest_quit(qts);
+}
+
+static void test_machine_migration(void)
+{
+ g_autofree char *firmware = create_firmware();
+ const char *old_qemu = g_getenv("QTEST_QEMU_BINARY_OLD");
+ QTestState *from;
+ QTestState *to = qtest_initf(
+ "-machine microchip-icicle-kit -smp 5 -m 2G "
+ "-bios \"%s\" -incoming defer "
+ "-rtc clock=vm", firmware);
+
+ qtest_irq_intercept_out_named(to, "/machine/soc/rtc", "sysbus-irq");
+
+ /* Allow an older QEMU source to exercise migration compatibility */
+ if (old_qemu) {
+ from = microchip_icicle_kit_start_ext("QTEST_QEMU_BINARY_OLD",
+ firmware);
+ } else {
+ from = microchip_icicle_kit_start_rtc(firmware);
+ qtest_writel(from, RTC_BASE + RTC_DATETIME_LOWER, 0x23456789);
+ qtest_writel(from, RTC_BASE + RTC_DATETIME_UPPER, 1);
+ qtest_writel(from, RTC_BASE + RTC_CONTROL, RTC_UPLOAD);
+ qtest_writel(from, RTC_BASE + RTC_CONTROL, RTC_RUNNING);
+ qtest_writel(from, RTC_BASE + RTC_ALARM_LOWER, 0x2345678b);
+ qtest_writel(from, RTC_BASE + RTC_ALARM_UPPER, 1);
+ qtest_writel(from, RTC_BASE + RTC_COMPARE_LOWER, UINT32_MAX);
+ qtest_writel(from, RTC_BASE + RTC_COMPARE_UPPER, RTC_UPPER_MASK);
+ qtest_writel(from, RTC_BASE + RTC_MODE,
+ RTC_WAKEUP_ENABLE | RTC_WAKEUP_CONTINUE);
+ qtest_writel(from, RTC_BASE + RTC_CONTROL, RTC_ALARM_ON);
+ qtest_writel(from, RTC_BASE + RTC_CONTROL, RTC_WAKEUP_SET);
+ qtest_writel(from, RTC_BASE + RTC_PRESCALER, 999999);
+ }
+
+ unlink(firmware);
+
+ migrate_incoming_qmp(to, "tcp:127.0.0.1:0", NULL, "{}");
+ migrate_qmp(from, to, NULL, NULL, "{}");
+ wait_for_migration_complete(from);
+
+ if (old_qemu) {
+ g_assert_cmphex(qtest_readl(to, RTC_BASE + RTC_CONTROL), ==, 0);
+ g_assert_cmphex(qtest_readl(to, RTC_BASE + RTC_PRESCALER), ==, 0);
+ g_assert_false(qtest_get_irq(to, 0));
+ g_assert_false(qtest_get_irq(to, 1));
+ } else {
+ g_assert_cmphex(rtc_read_binary_count(to), ==, 0x123456789);
+ g_assert_cmphex(qtest_readl(to, RTC_BASE + RTC_CONTROL) &
+ (RTC_RUNNING | RTC_ALARM_ON), ==,
+ RTC_RUNNING | RTC_ALARM_ON);
+ g_assert_cmphex(qtest_readl(to, RTC_BASE + RTC_PRESCALER), ==,
+ 999999);
+ g_assert_true(qtest_get_irq(to, 0));
+ g_assert_false(qtest_get_irq(to, 1));
+ qtest_writel(to, RTC_BASE + RTC_CONTROL, RTC_WAKEUP_CLEAR);
+ g_assert_false(qtest_get_irq(to, 0));
+ qtest_clock_step(to, 2 * NANOSECONDS_PER_SECOND);
+ g_assert_cmphex(rtc_read_binary_count(to), ==, 0x12345678b);
+ g_assert_true(qtest_get_irq(to, 0));
+ g_assert_true(qtest_get_irq(to, 1));
+ qtest_writel(to, RTC_BASE + RTC_CONTROL, RTC_ALARM_OFF);
+ g_assert_false(qtest_get_irq(to, 0));
+ g_assert_false(qtest_get_irq(to, 1));
+ }
+
+ qtest_quit(from);
+ qtest_quit(to);
+}
+
+int main(int argc, char **argv)
+{
+ g_test_init(&argc, &argv, NULL);
+
+ qtest_add_func("/mchp_pfsoc_rtc/registers", test_rtc);
+ qtest_add_func("/mchp_pfsoc_rtc/plic", test_rtc_plic);
+ qtest_add_func("/mchp_pfsoc_rtc/migration",
+ test_machine_migration);
+
+ return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index abe73370b6..3f7ecbdde7 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -305,7 +305,8 @@ qtests_riscv64 = ['riscv-csr-test'] + \
(unpack_edk2_blobs ? ['bios-tables-test'] : []) + \
(config_all_devices.has_key('CONFIG_MICROCHIP_PFSOC') ?
['cadence-sdhci-test',
- 'mchp_pfsoc_l2cc_test'] : []) + \
+ 'mchp_pfsoc_l2cc_test',
+ 'mchp_pfsoc_rtc_test'] : []) + \
(config_all_devices.has_key('CONFIG_IOMMU_TESTDEV') and
config_all_devices.has_key('CONFIG_RISCV_IOMMU') ?
['iommu-riscv-test'] : []) + \
@@ -419,6 +420,8 @@ qtests = {
'erst-test': files('erst-test.c'),
'ivshmem-test': [rt, '../../contrib/ivshmem-server/ivshmem-server.c'],
'migration-test': test_migration_files + migration_tls_files + migration_colo_files,
+ 'mchp_pfsoc_rtc_test': files('migration/migration-qmp.c',
+ 'migration/migration-util.c'),
'pxe-test': files('boot-sector.c'),
'pnv-xive2-test': files('pnv-xive2-common.c', 'pnv-xive2-flush-sync.c',
'pnv-xive2-nvpg_bar.c'),
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (14 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 15/24] tests/qtest: Add PolarFire SoC RTC coverage Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:20 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases Bin Meng
` (9 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Sebastian Huber, Weiwei Li,
qemu-riscv
Polling firmware requests system services without requesting an
interrupt. The old model ignored this distinction:
1. HSS requests the serial number with REQUEST set and NOTIFY clear.
2. QEMU synchronously fills the mailbox and clears REQUEST.
3. QEMU incorrectly asserts PLIC source 96.
4. HSS polls REQUEST and neither waits for nor handles the interrupt.
5. PLIC source 96 remains pending.
6. Linux registers the MPFS mailbox driver.
7. The stale interrupt immediately enters mpfs_mbox_inbox_isr().
8. Linux has not submitted a request or installed its response pointer.
9. The ISR dereferences that null pointer and faults near address 0x10.
Honor SERVICES_CR.NOTIFY, let IOSCB own the pending interrupt state,
and route the SYSREG acknowledgement through an IOSCB clear input.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
include/hw/misc/mchp_pfsoc_ioscb.h | 2 ++
hw/misc/mchp_pfsoc_ioscb.c | 39 +++++++++++++++++++++++++++---
hw/misc/mchp_pfsoc_sysreg.c | 9 ++++++-
hw/riscv/microchip_pfsoc.c | 6 ++---
4 files changed, 49 insertions(+), 7 deletions(-)
diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
index fd31427304..e39d995b64 100644
--- a/include/hw/misc/mchp_pfsoc_ioscb.h
+++ b/include/hw/misc/mchp_pfsoc_ioscb.h
@@ -26,6 +26,7 @@
#include "hw/core/sysbus.h"
#define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
+#define MCHP_PFSOC_IOSCB_IRQ_CLEAR "irq-clear"
typedef struct MchpPfSoCIoscbState {
SysBusDevice parent;
@@ -53,6 +54,7 @@ typedef struct MchpPfSoCIoscbState {
uint32_t services_sr;
uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
char *serial_number;
+ bool irq_pending;
qemu_irq irq;
} MchpPfSoCIoscbState;
diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
index 7c82b55986..ccc2201b7a 100644
--- a/hw/misc/mchp_pfsoc_ioscb.c
+++ b/hw/misc/mchp_pfsoc_ioscb.c
@@ -192,12 +192,13 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
#define SERVICES_CR 0x50
#define SERVICES_CR_REQUEST BIT(0)
+#define SERVICES_CR_NOTIFY BIT(3)
#define SERVICES_CR_COMMAND_SHIFT 16
#define SERVICES_CR_COMMAND_WIDTH 8
#define SERVICES_CR_COMMAND_MASK \
MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
#define SERVICES_CR_MASK \
- (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
+ (SERVICES_CR_REQUEST | SERVICES_CR_NOTIFY | SERVICES_CR_COMMAND_MASK)
#define SERVICES_SR 0x54
#define SERVICES_SR_STATUS_SHIFT 16
#define SERVICES_COMMAND_SERIAL_NUMBER 0
@@ -205,6 +206,21 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
#define SERVICES_STATUS_FAILED 1
#define SERVICES_MAILBOX_RESPONSE_OFFSET 0
+static void mchp_pfsoc_ioscb_update_irq(MchpPfSoCIoscbState *s)
+{
+ qemu_set_irq(s->irq, s->irq_pending);
+}
+
+static void mchp_pfsoc_ioscb_clear_irq(void *opaque, int n, int level)
+{
+ MchpPfSoCIoscbState *s = opaque;
+
+ if (level) {
+ s->irq_pending = false;
+ mchp_pfsoc_ioscb_update_irq(s);
+ }
+}
+
static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
{
uint32_t command;
@@ -236,7 +252,15 @@ static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
}
s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
- qemu_irq_raise(s->irq);
+ /*
+ * HSS and U-Boot submit polling requests with REQUEST set and NOTIFY
+ * clear, then poll REQUEST/BUSY for completion. Linux sets both bits
+ * and expects completion through PLIC source 96.
+ */
+ if (value & SERVICES_CR_NOTIFY) {
+ s->irq_pending = true;
+ mchp_pfsoc_ioscb_update_irq(s);
+ }
}
static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
@@ -325,7 +349,8 @@ static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
s->services_cr = 0;
s->services_sr = 0;
memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
- qemu_irq_lower(s->irq);
+ s->irq_pending = false;
+ mchp_pfsoc_ioscb_update_irq(s);
}
static const Property mchp_pfsoc_ioscb_properties[] = {
@@ -333,6 +358,13 @@ static const Property mchp_pfsoc_ioscb_properties[] = {
MchpPfSoCIoscbState, serial_number),
};
+static void mchp_pfsoc_ioscb_init(Object *obj)
+{
+ /* Accept service interrupt acknowledgements from SYSREG MESSAGE_INT */
+ qdev_init_gpio_in_named(DEVICE(obj), mchp_pfsoc_ioscb_clear_irq,
+ MCHP_PFSOC_IOSCB_IRQ_CLEAR, 1);
+}
+
static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
{
MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
@@ -456,6 +488,7 @@ static const TypeInfo mchp_pfsoc_ioscb_info = {
.name = TYPE_MCHP_PFSOC_IOSCB,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(MchpPfSoCIoscbState),
+ .instance_init = mchp_pfsoc_ioscb_init,
.class_init = mchp_pfsoc_ioscb_class_init,
};
diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
index 1d9154280a..899b485da6 100644
--- a/hw/misc/mchp_pfsoc_sysreg.c
+++ b/hw/misc/mchp_pfsoc_sysreg.c
@@ -77,7 +77,14 @@ static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
}
break;
case MESSAGE_INT:
- qemu_irq_lower(s->irq);
+ /*
+ * A MESSAGE_INT write is an acknowledgement event, not a level that
+ * remains asserted. Model it as an active-high pulse. The rising edge
+ * invokes IOSCB's irq-clear input with level 1, which clears
+ * irq_pending and lowers PLIC source 96. The falling edge invokes the
+ * input with level 0 and is ignored.
+ */
+ qemu_irq_pulse(s->irq);
break;
default:
qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index fb0e18edba..87c9c89cb0 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -336,9 +336,6 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
sysbus_realize(SYS_BUS_DEVICE(&s->sysreg), errp);
sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
memmap[MICROCHIP_PFSOC_SYSREG].base);
- sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
- qdev_get_gpio_in(DEVICE(s->plic),
- MICROCHIP_PFSOC_MAILBOX_IRQ));
/* AXISW */
create_unimplemented_device("microchip.pfsoc.axisw",
@@ -492,6 +489,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
sysbus_connect_irq(SYS_BUS_DEVICE(&s->ioscb), 0,
qdev_get_gpio_in(DEVICE(s->plic),
MICROCHIP_PFSOC_MAILBOX_IRQ));
+ sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
+ qdev_get_gpio_in_named(DEVICE(&s->ioscb),
+ MCHP_PFSOC_IOSCB_IRQ_CLEAR, 0));
/* FPGA Fabric */
create_unimplemented_device("microchip.pfsoc.fabricfic3",
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (15 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:28 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 18/24] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB Bin Meng
` (8 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Sebastian Huber, Weiwei Li,
qemu-riscv
The 64-bit cached and non-cached windows alias the complete physical
DDR from offset zero. Treating them as only the portion above 1 GiB
leaves valid Icicle Kit memory nodes unbacked with the board's 2 GiB.
Map both high windows over the full machine RAM.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
hw/riscv/microchip_pfsoc.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 87c9c89cb0..83ac352c1e 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -573,15 +573,27 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
TYPE_MICROCHIP_PFSOC);
qdev_realize(DEVICE(&s->soc), NULL, &error_fatal);
- /* Split RAM into low and high regions using aliases to machine->ram */
+ /*
+ * The four CPU-visible windows alias the same physical DDR from offset
+ * zero. For the Icicle Kit's 2 GiB of DDR, they map as follows:
+ *
+ * CPU address Attribute Visible size DDR range
+ * 0x0080000000 32-bit cached 1 GiB [0, 1 GiB)
+ * 0x00c0000000 32-bit non-cached 1 GiB [0, 1 GiB)
+ * 0x1000000000 64-bit cached 2 GiB [0, 2 GiB)
+ * 0x1400000000 64-bit non-cached 2 GiB [0, 2 GiB)
+ *
+ * "Low" and "high" describe the CPU address windows, not the lower and
+ * upper portions of physical DDR.
+ */
mem_low_size = memmap[MICROCHIP_PFSOC_DRAM_LO].size;
- mem_high_size = machine->ram_size - mem_low_size;
+ mem_high_size = machine->ram_size;
memory_region_init_alias(mem_low, NULL,
"microchip.icicle.kit.ram_low", machine->ram,
0, mem_low_size);
memory_region_init_alias(mem_high, NULL,
"microchip.icicle.kit.ram_high", machine->ram,
- mem_low_size, mem_high_size);
+ 0, mem_high_size);
/* Register RAM */
memory_region_add_subregion(system_memory,
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 18/24] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (16 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:29 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five Bin Meng
` (7 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Pierrick Bouvier, Sebastian Huber,
Weiwei Li, qemu-riscv
The Icicle Kit has 2 GiB of RAM, and its firmware device tree
describes that fixed capacity. The model currently defaults to
1537 MiB and accepts any larger size, allowing configurations
that do not match the board.
Set the default to 2 GiB and reject every other size. Update the
documentation and L2CC qtest command line accordingly.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
docs/system/riscv/microchip-icicle-kit.rst | 4 +---
hw/riscv/microchip_pfsoc.c | 15 ++++-----------
2 files changed, 5 insertions(+), 14 deletions(-)
diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
index 9809e94b84..3db2b3c7e3 100644
--- a/docs/system/riscv/microchip-icicle-kit.rst
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -26,9 +26,7 @@ The ``microchip-icicle-kit`` machine supports the following devices:
* 2 GEM Ethernet controllers
* 1 SDHC storage controller
-The memory is set to 1537 MiB by default. A sanity check on RAM size is
-performed in the machine init routine to prompt user to increase the RAM size
-to > 1537 MiB when less than 1537 MiB RAM is detected.
+The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
Boot options
------------
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 83ac352c1e..11403a6087 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -560,10 +560,10 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
DriveInfo *dinfo = drive_get(IF_SD, 0, 0);
RISCVBootInfo boot_info;
- /* Sanity check on RAM size */
- if (machine->ram_size < mc->default_ram_size) {
+ /* The board has a fixed RAM size */
+ if (machine->ram_size != mc->default_ram_size) {
char *sz = size_to_str(mc->default_ram_size);
- error_report("Invalid RAM size, should be bigger than %s", sz);
+ error_report("Invalid RAM size, should be %s", sz);
g_free(sz);
exit(EXIT_FAILURE);
}
@@ -773,14 +773,7 @@ static void microchip_icicle_kit_machine_class_init(ObjectClass *oc,
mc->default_ram_id = "microchip.icicle.kit.ram";
mc->auto_create_sdcard = true;
- /*
- * Map 513 MiB high memory, the minimum required high memory size, because
- * HSS will do memory test against the high memory address range regardless
- * of physical memory installed.
- *
- * See memory_tests() in mss_ddr.c in the HSS source code.
- */
- mc->default_ram_size = 1537 * MiB;
+ mc->default_ram_size = 2 * GiB;
object_class_property_add(oc, "clint-timebase-frequency", "uint32_t",
microchip_icicle_kit_get_clint_timebase_freq,
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (17 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 18/24] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:33 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot Bin Meng
` (6 subsequent siblings)
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Pierrick Bouvier, Sebastian Huber,
Weiwei Li, qemu-riscv
The Icicle Kit always contains one E51 management hart and four U54
application harts. The model currently accepts two to five harts and
defaults to two, allowing configurations that cannot match the board.
Set the minimum and default CPU counts to the five-hart maximum.
Update the documentation to state that other hart counts are rejected.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
docs/system/riscv/microchip-icicle-kit.rst | 1 +
hw/riscv/microchip_pfsoc.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
index 3db2b3c7e3..38352cc62b 100644
--- a/docs/system/riscv/microchip-icicle-kit.rst
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -27,6 +27,7 @@ The ``microchip-icicle-kit`` machine supports the following devices:
* 1 SDHC storage controller
The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
+The machine always exposes all five harts. Other CPU counts are rejected.
Boot options
------------
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 11403a6087..1238811ed8 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -768,8 +768,8 @@ static void microchip_icicle_kit_machine_class_init(ObjectClass *oc,
mc->init = microchip_icicle_kit_machine_init;
mc->max_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT +
MICROCHIP_PFSOC_COMPUTE_CPU_COUNT;
- mc->min_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT + 1;
- mc->default_cpus = mc->min_cpus;
+ mc->min_cpus = mc->max_cpus;
+ mc->default_cpus = mc->max_cpus;
mc->default_ram_id = "microchip.icicle.kit.ram";
mc->auto_create_sdcard = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (18 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:43 ` Conor Dooley
2026-09-30 10:15 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 21/24] docs/system/riscv: pfsoc: Document CLINT topology for direct Linux boot Bin Meng
` (5 subsequent siblings)
25 siblings, 2 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Conor Dooley, Pierrick Bouvier, Sebastian Huber, qemu-riscv
With all previous changes, the Icicle Kit model is now able to boot
HSS v2024.06 through a Buildroot 2026.05 SD image to U-Boot and Linux.
Document the tested source versions and exact commands to build HSS
and Buildroot. Include the sparse resize and GPT relocation steps
needed to make the generated SD image usable by QEMU.
Also describe the RAM and serial setup, boot stages, and remaining
model limitations.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
(no changes since v1)
docs/system/riscv/microchip-icicle-kit.rst | 101 +++++++++++++++++++--
1 file changed, 95 insertions(+), 6 deletions(-)
diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
index 38352cc62b..eeb4ff938c 100644
--- a/docs/system/riscv/microchip-icicle-kit.rst
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -19,12 +19,15 @@ The ``microchip-icicle-kit`` machine supports the following devices:
* 4 U54 cores
* Core Level Interruptor (CLINT)
* Platform-Level Interrupt Controller (PLIC)
-* L2 Loosely Integrated Memory (L2-LIM)
+* Loosely Integrated Memory (L2-LIM)
+* L2 cache controller (L2CC)
* DDR memory controller
+* System controller and system services mailbox
* 5 MMUARTs
* 1 DMA controller
* 2 GEM Ethernet controllers
* 1 SDHC storage controller
+* 1 Real-Time Clock
The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
The machine always exposes all five harts. Other CPU counts are rejected.
@@ -101,10 +104,96 @@ CAVEATS:
Running HSS
-----------
-The machine ``microchip-icicle-kit`` used to run the Hart Software Services
-(HSS_), however, the HSS development progressed and the QEMU machine
-implementation lacks behind. Currently, running the HSS no longer works.
-There is missing support in the clock and memory controller devices. In
-particular, reading from the SD card does not work.
+The ``microchip-icicle-kit`` machine can boot the Hart Software Services
+(HSS_), which then loads an HSS payload containing U-Boot from an SD card.
+The following flow was tested with HSS v2024.06 and Buildroot 2026.05.
+
+Configure HSS for the ``mpfs-icicle-kit-es`` board using its default
+configuration. QEMU provides the software-visible registers and deterministic
+status consumed by the HSS v2024.06 DDR initialization and training flow;
+it does not model the electrical properties of DDR training. HSS requires
+the RISC-V bare-metal toolchain supplied by Microchip SoftConsole to be
+available in ``PATH``. Build the tested HSS version with:
+
+.. code-block:: bash
+
+ $ git clone https://github.com/polarfire-soc/hart-software-services.git
+ $ cd hart-software-services
+ $ git checkout v2024.06
+ $ make BOARD=mpfs-icicle-kit-es defconfig
+ $ make -j$(nproc) BOARD=mpfs-icicle-kit-es
+
+The HSS build creates both the raw wrapper and an eNVM programming image. QEMU
+needs the complete eNVM image, including the 256-byte boot header added by the
+Microchip boot mode programmer. Convert the generated Intel HEX file to a raw
+binary image, for example:
+
+.. code-block:: bash
+
+ $ riscv64-unknown-elf-objcopy -I ihex -O binary \
+ build/hss-envm-wrapper.mpfs-icicle-kit-es.hex build/hss.bin
+
+Do not pass ``build/hss-envm-wrapper.bin`` directly to QEMU. That file starts
+at eNVM offset 0x100 and does not contain the boot header with the image size
+and per-hart reset vectors.
+
+Build the SD card image with the tested Buildroot version:
+
+.. code-block:: bash
+
+ $ git clone https://gitlab.com/buildroot.org/buildroot.git
+ $ cd buildroot
+ $ git checkout 2026.05
+ $ make microchip_mpfs_icicle_defconfig
+ $ make
+
+This produces ``output/images/sdcard.img`` with three GPT partitions:
+
+* An HSS ``payload.bin`` containing U-Boot.
+* A FAT partition containing ``boot.scr`` and the kernel FIT image.
+* An ext4 Linux root filesystem.
+
+The QEMU SD card model requires a power-of-two image size. Make a sparse
+4 GiB working copy and relocate its backup GPT to the new end of the image:
+
+.. code-block:: bash
+
+ $ cp --reflink=auto output/images/sdcard.img sdcard.img
+ $ truncate -s 4G sdcard.img
+ $ sgdisk -e sdcard.img
+ $ sgdisk -v sdcard.img
+
+The Icicle Kit firmware device tree in the FIT image describes 2 GiB of RAM,
+matching the machine's fixed RAM size. The command below keeps ``-m 2G``
+explicit. Attach the image as an SD card and route both board serial ports:
+
+.. code-block:: bash
+
+ $ qemu-system-riscv64 \
+ -M microchip-icicle-kit -smp 5 -m 2G \
+ -bios path/to/hss/build/hss.bin \
+ -drive if=sd,file=path/to/sdcard.img,format=raw \
+ -display none \
+ -serial file:hss.log \
+ -serial stdio \
+ -no-reboot
+
+HSS writes to MMUART0, which the command records in ``hss.log``. U-Boot and
+Linux use MMUART1, which remains connected to the terminal. A successful
+boot proceeds through HSS payload loading, U-Boot, the Linux kernel, and the
+login prompt from the root filesystem on the third partition.
+
+Known limitations
+-----------------
+
+* The tested HSS v2024.06 flow contains 2 separate multi-hart startup races
+ issues which is still not fixed as of the latest v2026.04 release. A boot
+ may therefore stall at the very beginning or after successful DDR training
+ during the OpenSBI/U-Boot handoff.
+* The SD card model requires the raw image size to be a power of two. Keep
+ the backup GPT header at the end when resizing the image.
+* The machine does not generate an Icicle Kit device tree. Firmware boot must
+ provide one in its payload or FIT image; direct kernel boot must use
+ ``-dtb`` as described above.
.. _HSS: https://github.com/polarfire-soc/hart-software-services
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 21/24] docs/system/riscv: pfsoc: Document CLINT topology for direct Linux boot
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (19 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 22/24] tests/functional/riscv64: Add Icicle Kit firmware boot test Bin Meng
` (4 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU; +Cc: Conor Dooley, Pierrick Bouvier, Sebastian Huber, qemu-riscv
The generic OpenSBI platform derives the CLINT first hart and register
slot count from interrupts-extended. Some S-mode-only MPFS device trees
mask the E51 M-mode interrupt entries with 0xffffffff, which shifts the
MSIP and MTIMECMP slots when the same DTB is used for direct boot.
Document the complete five-hart CLINT node. Require interrupts 3 and 7
for hart 0 as well as the U54 harts.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
(no changes since v1)
docs/system/riscv/microchip-icicle-kit.rst | 23 +++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
index eeb4ff938c..af8e984df7 100644
--- a/docs/system/riscv/microchip-icicle-kit.rst
+++ b/docs/system/riscv/microchip-icicle-kit.rst
@@ -65,7 +65,28 @@ should meet the following requirements:
option.
* It should contain a node for the CLINT device with a compatible string
- "riscv,clint0".
+ "riscv,clint0" or "sifive,clint0". Its ``interrupts-extended`` property
+ must describe the M-mode software interrupt (3) and timer interrupt (7) for
+ every hart, including the E51 hart 0.
+
+For example, the five-hart Icicle Kit CLINT node can be described as:
+
+.. code-block:: none
+
+ clint: clint@2000000 {
+ compatible = "sifive,fu540-c000-clint", "sifive,clint0";
+ reg = <0x0 0x2000000 0x0 0xc000>;
+ interrupts-extended = <&cpu0_intc 3>, <&cpu0_intc 7>,
+ <&cpu1_intc 3>, <&cpu1_intc 7>,
+ <&cpu2_intc 3>, <&cpu2_intc 7>,
+ <&cpu3_intc 3>, <&cpu3_intc 7>,
+ <&cpu4_intc 3>, <&cpu4_intc 7>;
+ };
+
+Do not replace the hart 0 interrupt numbers with ``0xffffffff`` when the same
+DTB is used to initialize the generic OpenSBI platform. OpenSBI derives the
+first hart and the number of CLINT register slots from these interrupt tuples;
+masking hart 0 would shift the per-hart MSIP and MTIMECMP register mappings.
When ``-bios`` is not specified or set to ``default``, the OpenSBI
``fw_dynamic`` BIOS image for the ``generic`` platform is used to boot an
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 22/24] tests/functional/riscv64: Add Icicle Kit firmware boot test
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (20 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 21/24] docs/system/riscv: pfsoc: Document CLINT topology for direct Linux boot Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 23/24] MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer Bin Meng
` (3 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Sebastian Huber, Weiwei Li,
qemu-riscv
Add functional coverage using prebuilt HSS and SD card images.
Boot HSS and U-Boot with five harts and 2 GiB of RAM. Connect
the test console to MMUART1 and let U-Boot start Linux.
The complete boot exercises the SDHCI controller in the DMA modes
used at each stage. HSS uses Version 4 64-bit SDMA to load U-Boot.
U-Boot uses ADMA2-64 to read the boot script and the large FIT
image. Linux then selects 64-bit ADMA for SD card and rootfs I/O.
Check the machine identity, kernel ADMA initialization, root
filesystem mount, and login prompt.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
---
(no changes since v1)
MAINTAINERS | 1 +
tests/functional/riscv64/meson.build | 2 +
.../riscv64/test_microchip_icicle_kit.py | 56 +++++++++++++++++++
3 files changed, 59 insertions(+)
create mode 100644 tests/functional/riscv64/test_microchip_icicle_kit.py
diff --git a/MAINTAINERS b/MAINTAINERS
index 1856c67feb..319b436480 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1805,6 +1805,7 @@ F: include/hw/misc/mchp_pfsoc_ioscb.h
F: include/hw/misc/mchp_pfsoc_l2cc.h
F: include/hw/misc/mchp_pfsoc_sysreg.h
F: include/hw/rtc/mchp_pfsoc_rtc.h
+F: tests/functional/riscv64/test_microchip_icicle_kit.py
F: tests/qtest/mchp_pfsoc_l2cc_test.c
F: tests/qtest/mchp_pfsoc_rtc_test.c
diff --git a/tests/functional/riscv64/meson.build b/tests/functional/riscv64/meson.build
index d1a3e6c2bf..cbf61d9535 100644
--- a/tests/functional/riscv64/meson.build
+++ b/tests/functional/riscv64/meson.build
@@ -3,6 +3,7 @@
test_riscv64_timeouts = {
'boston' : 120,
'k230' : 120,
+ 'microchip_icicle_kit' : 180,
'tuxrun' : 120,
}
@@ -15,6 +16,7 @@ tests_riscv64_system_thorough = [
'endianness',
'boston',
'k230',
+ 'microchip_icicle_kit',
'sifive_u',
'tt_atlantis',
'tuxrun',
diff --git a/tests/functional/riscv64/test_microchip_icicle_kit.py b/tests/functional/riscv64/test_microchip_icicle_kit.py
new file mode 100644
index 0000000000..559ae1f651
--- /dev/null
+++ b/tests/functional/riscv64/test_microchip_icicle_kit.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots HSS, U-Boot, and Linux on an Icicle Kit.
+#
+# Copyright (c) 2026 Process Mission
+#
+# Author:
+# Bin Meng <bin.meng@processmission.com>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import Asset, LinuxKernelTest, skipIfMissingCommands
+
+
+class MicrochipIcicleKitMachine(LinuxKernelTest):
+
+ ASSET_IMAGES = Asset(
+ ('https://github.com/processmission/qemu-machine-images/releases/'
+ 'download/v1.0.0/'
+ 'riscv64-microchip-icicle-kit-v1.0.0.tar.zst'),
+ 'fe7eb3ee737fd15d6d5a8480822b070923ae4d611b19ed03983e11f35b6aac04')
+
+ @skipIfMissingCommands('zstd')
+ def test_microchip_icicle_kit_boot(self):
+ self.set_machine('microchip-icicle-kit')
+
+ archive_path = self.uncompress(
+ self.ASSET_IMAGES,
+ target='microchip_icicle_kit_images.tar',
+ format='zstd')
+ self.archive_extract(archive_path, format='tar')
+ firmware_path = self.scratch_file('images', 'hss.bin')
+ sdcard_path = self.scratch_file('images', 'sdcard.img')
+
+ self.vm.set_console(console_index=1)
+ self.vm.add_args(
+ '-smp', '5',
+ '-m', '2G',
+ '-display', 'none',
+ '-bios', firmware_path,
+ '-snapshot',
+ '-drive', f'file={sdcard_path},format=raw,if=sd,index=0',
+ '-no-reboot')
+ self.vm.launch()
+
+ self.wait_for_console_pattern('U-Boot ')
+ self.wait_for_console_pattern('Starting kernel ...')
+ self.wait_for_console_pattern(
+ 'Machine model: Microchip PolarFire-SoC Icicle Kit')
+ self.wait_for_console_pattern('using ADMA 64-bit')
+ self.wait_for_console_pattern('VFS: Mounted root')
+ self.wait_for_console_pattern('mpfs_icicle login:')
+
+
+if __name__ == '__main__':
+ LinuxKernelTest.main()
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 23/24] MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (21 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 22/24] tests/functional/riscv64: Add Icicle Kit firmware boot test Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 24/24] MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer Bin Meng
` (2 subsequent siblings)
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Conor Dooley, Markus Armbruster, Peter Maydell,
Philippe Mathieu-Daudé, Pierrick Bouvier, Thomas Huth
The preceding Icicle Kit updates restore HSS, U-Boot, and Linux
boot. Functional test coverage is also added.
Restore myself as a maintainer and mark the machine as 'Supported'
to reflect its active maintenance.
Signed-off-by: Bin Meng <bin.meng@processmission.com>
Acked-by: Conor Dooley <conor@kernel.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
---
(no changes since v1)
MAINTAINERS | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index 319b436480..e68e7eb12e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1786,10 +1786,11 @@ F: target/riscv/xlrbr.decode
F: tests/tcg/riscv64/test-crc32.S
Microchip PolarFire SoC Icicle Kit
+M: Bin Meng <bin.meng@processmission.com>
M: Conor Dooley <conor@kernel.org>
M: Sebastian Huber <sebastian.huber@embedded-brains.de>
L: qemu-riscv@nongnu.org
-S: Odd Fixes
+S: Supported
F: docs/system/riscv/microchip-icicle-kit.rst
F: hw/riscv/microchip_pfsoc.c
F: hw/char/mchp_pfsoc_mmuart.c
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* [PATCH v2 24/24] MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (22 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 23/24] MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer Bin Meng
@ 2026-09-04 15:57 ` Bin Meng
2026-09-30 9:51 ` Conor Dooley
2026-09-04 16:11 ` [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Philippe Mathieu-Daudé
2026-09-26 3:14 ` Bin Meng
25 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-09-04 15:57 UTC (permalink / raw)
To: QEMU
Cc: Conor Dooley, Markus Armbruster, Peter Maydell,
Philippe Mathieu-Daudé, Pierrick Bouvier, Thomas Huth
Conor asked not to be listed as a maintainer, since that could imply
that Microchip sponsors his work on the platform.
Keep him listed as a reviewer so he continues to receive relevant
patches without suggesting an active maintenance commitment.
Suggested-by: Conor Dooley <conor@kernel.org>
Signed-off-by: Bin Meng <bin.meng@processmission.com>
---
Changes in v2:
- New patch
MAINTAINERS | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index e68e7eb12e..9590de2509 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1787,7 +1787,7 @@ F: tests/tcg/riscv64/test-crc32.S
Microchip PolarFire SoC Icicle Kit
M: Bin Meng <bin.meng@processmission.com>
-M: Conor Dooley <conor@kernel.org>
+R: Conor Dooley <conor@kernel.org>
M: Sebastian Huber <sebastian.huber@embedded-brains.de>
L: qemu-riscv@nongnu.org
S: Supported
--
2.53.0
^ permalink raw reply related [flat|nested] 48+ messages in thread
* Re: [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (23 preceding siblings ...)
2026-09-04 15:57 ` [PATCH v2 24/24] MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer Bin Meng
@ 2026-09-04 16:11 ` Philippe Mathieu-Daudé
2026-09-07 13:29 ` Conor Dooley
2026-09-26 3:14 ` Bin Meng
25 siblings, 1 reply; 48+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-09-04 16:11 UTC (permalink / raw)
To: Bin Meng, QEMU
Cc: Alistair Francis, Alistair Francis, Bin Meng, Chao Liu,
Conor Dooley, Daniel Henrique Barboza, Edgar E. Iglesias,
Fabiano Rosas, Laurent Vivier, Liu Zhiwei, Markus Armbruster,
Palmer Dabbelt, Paolo Bonzini, Peter Maydell, Pierrick Bouvier,
Sebastian Huber, Thomas Huth, Weiwei Li, qemu-arm, qemu-block,
qemu-riscv
On 4/9/26 17:57, Bin Meng wrote:
> Bin Meng (23):
> hw/riscv: pfsoc: Correct the L2LIM maximum mapped size
> hw/riscv: pfsoc: Map the L2 zero device window
> hw/misc: pfsoc: Support DDR training with newer HSS
> hw/misc: pfsoc: Model L2 cache controller registers
> hw/riscv: pfsoc: Couple L2CC to L2-LIM
> tests/qtest: Add PolarFire SoC L2CC coverage
> hw/sd: sdhci: Run ADMA independently of MMIO
> hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
> hw/sd: cadence: Add 64-bit system bus property
FYI I tagged this series (in particular the SD/HCI patches)
to review but won't be able to until Sept 21. Not a blocker
although if Alistair think the series is ready.
> hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
> hw/misc: pfsoc: Model PolarFire SoC serial number service
> hw/rtc: Add PolarFire SoC RTC model
> hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit
> tests/qtest: Add PolarFire SoC RTC coverage
> hw/misc: pfsoc: Honor PolarFire service notification requests
> hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
> hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
> hw/riscv: pfsoc: Fix Icicle Kit hart count at five
> docs/system/riscv: Document Icicle Kit HSS boot
> docs/system/riscv: pfsoc: Document CLINT topology for direct Linux
> boot
> tests/functional/riscv64: Add Icicle Kit firmware boot test
> MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer
> MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot
2026-09-04 16:11 ` [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Philippe Mathieu-Daudé
@ 2026-09-07 13:29 ` Conor Dooley
0 siblings, 0 replies; 48+ messages in thread
From: Conor Dooley @ 2026-09-07 13:29 UTC (permalink / raw)
To: Philippe Mathieu-Daudé
Cc: Bin Meng, QEMU, Alistair Francis, Alistair Francis, Bin Meng,
Chao Liu, Daniel Henrique Barboza, Edgar E. Iglesias,
Fabiano Rosas, Laurent Vivier, Liu Zhiwei, Markus Armbruster,
Palmer Dabbelt, Paolo Bonzini, Peter Maydell, Pierrick Bouvier,
Sebastian Huber, Thomas Huth, Weiwei Li, qemu-arm, qemu-block,
qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 1799 bytes --]
On Fri, Sep 04, 2026 at 06:11:38PM +0200, Philippe Mathieu-Daudé wrote:
> On 4/9/26 17:57, Bin Meng wrote:
>
> > Bin Meng (23):
> > hw/riscv: pfsoc: Correct the L2LIM maximum mapped size
> > hw/riscv: pfsoc: Map the L2 zero device window
> > hw/misc: pfsoc: Support DDR training with newer HSS
> > hw/misc: pfsoc: Model L2 cache controller registers
> > hw/riscv: pfsoc: Couple L2CC to L2-LIM
> > tests/qtest: Add PolarFire SoC L2CC coverage
> > hw/sd: sdhci: Run ADMA independently of MMIO
> > hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
> > hw/sd: cadence: Add 64-bit system bus property
>
> FYI I tagged this series (in particular the SD/HCI patches)
> to review but won't be able to until Sept 21. Not a blocker
> although if Alistair think the series is ready.
FWIW, I'd like to look at the pfsoc parts but I am also indisposed
until the 21st.
>
> > hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
> > hw/misc: pfsoc: Model PolarFire SoC serial number service
> > hw/rtc: Add PolarFire SoC RTC model
> > hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit
> > tests/qtest: Add PolarFire SoC RTC coverage
> > hw/misc: pfsoc: Honor PolarFire service notification requests
> > hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
> > hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
> > hw/riscv: pfsoc: Fix Icicle Kit hart count at five
> > docs/system/riscv: Document Icicle Kit HSS boot
> > docs/system/riscv: pfsoc: Document CLINT topology for direct Linux
> > boot
> > tests/functional/riscv64: Add Icicle Kit firmware boot test
> > MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer
> > MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
` (24 preceding siblings ...)
2026-09-04 16:11 ` [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Philippe Mathieu-Daudé
@ 2026-09-26 3:14 ` Bin Meng
25 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-09-26 3:14 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Alistair Francis, Alistair Francis, Chao Liu, Conor Dooley,
Daniel Henrique Barboza, Edgar E. Iglesias, Fabiano Rosas,
Laurent Vivier, Liu Zhiwei, Markus Armbruster, Palmer Dabbelt,
Paolo Bonzini, Peter Maydell, Philippe Mathieu-Daudé,
Pierrick Bouvier, Sebastian Huber, Thomas Huth, Weiwei Li,
qemu-arm, qemu-block, qemu-riscv
On Fri, Sep 4, 2026 at 11:58 PM Bin Meng <bin.meng@processmission.com> wrote:
>
>
> The microchip-icicle-kit machine was originally validated with an older
> Hart Software Services (HSS) firmware stack. HSS v2024.06 cannot boot
> through U-Boot to Linux because several firmware-visible parts of the
> PolarFire SoC are missing or incomplete.
>
> The first failure occurs before the UART is initialized because the L2
> zero window is not mapped. HSS then needs additional L2 cache controller
> and DDR training behavior. Later boot stages exercise system services,
> the RTC, SDHC version 4 DMA, and high-capacity SD card block sizing,
> along with the complete DDR aliases. The existing models ither reject
> these accesses or expose behavior that does not match the hardware
> specifications.
>
> This series restores the complete firmware boot flow. With these
> changes, QEMU boots the HSS v2024.06 eNVM image, loads its U-Boot
> payload from an SD card, and reaches the Buildroot 2026.05 Linux
> login prompt.
>
> The changes are organized around the firmware boot sequence:
>
> * Correct the L2-LIM size, map the L2 zero window, and provide the DMC
> status transitions required by HSS DDR initialization.
> * Model the documented L2CC Config, WayEnable, and WayMask registers,
> and resize L2-LIM as cache ways are enabled.
> * Complete SDHCI version 4 support used by the Cadence controller,
> including Host Control 2, SDMA system addressing, 64-bit ADMA2
> descriptors, and SDMA boundary continuation.
> * Run ADMA from a bounded timer-driven engine instead of performing work
> from command or unrelated MMIO accesses. This keeps DMA progress
> independent of guest register traffic and avoids consuming a polling
> deadline inside the command write.
> * Keep SDHC and SDXC memory transfers at their fixed 512-byte block
> size, and advertise the Cadence controller's 64-bit system bus
> support.
> * Add the PolarFire SoC serial-number system service and RTC, and honor
> the system-service notification control bit.
> * Correct the DDR aliases and fix the board topology at its physical
> configuration of 2 GiB of RAM and five harts.
> * Document direct and HSS boot, add focused qtests and a full firmware
> functional test, and restore the machine's Supported maintainer
> status.
>
> Testing performed:
>
> * Built qemu-system-riscv64 and the documentation.
> * Passed various newly added qtests.
> * Booted HSS v2024.06, U-Boot, and Buildroot 2026.05 Linux to the login
> prompt using the functional-test image.
>
> The functional test downloads this versioned image archive:
>
> https://github.com/processmission/qemu-machine-images/releases/download/
> v1.0.0/riscv64-microchip-icicle-kit-v1.0.0.tar.zst
>
> When restoring the HSS boot support, 3 potential bugs were identified in
> the upstream HSS source codes that either blocks the DDR training from
> succeed or traps in a multi-core race at the very beginning or after
> a succesfully DDR training but stuck at OpenSBI/U-Boot hand-off. There
> are already bug reports filed aginst various upstream projects.
>
> Changes in v2:
> - Use the Resettable API instead of a legacy reset handler
> - tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer
> - Assert bounded ADMA pacing and MMIO-independent progress
> - Reuse existing SDHCI definitions and command helpers
> - Verify transferred data against a known image pattern
> - Make 64-bit system bus support a device property
> - hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
> - Reset the RTC to the documented hardware values
> - Expect the documented hardware state after RTC reset
> - MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
> - Drop sdhci patches that are already merged
>
> Bin Meng (23):
> hw/riscv: pfsoc: Correct the L2LIM maximum mapped size
> hw/riscv: pfsoc: Map the L2 zero device window
> hw/misc: pfsoc: Support DDR training with newer HSS
> hw/misc: pfsoc: Model L2 cache controller registers
> hw/riscv: pfsoc: Couple L2CC to L2-LIM
> tests/qtest: Add PolarFire SoC L2CC coverage
> hw/sd: sdhci: Run ADMA independently of MMIO
> hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
> hw/sd: cadence: Add 64-bit system bus property
> hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
> hw/misc: pfsoc: Model PolarFire SoC serial number service
> hw/rtc: Add PolarFire SoC RTC model
> hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit
> tests/qtest: Add PolarFire SoC RTC coverage
> hw/misc: pfsoc: Honor PolarFire service notification requests
> hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
> hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
> hw/riscv: pfsoc: Fix Icicle Kit hart count at five
> docs/system/riscv: Document Icicle Kit HSS boot
> docs/system/riscv: pfsoc: Document CLINT topology for direct Linux
> boot
> tests/functional/riscv64: Add Icicle Kit firmware boot test
> MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer
> MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
>
> Wadim Mueller (1):
> tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer
>
> MAINTAINERS | 13 +-
> docs/system/riscv/microchip-icicle-kit.rst | 129 ++++-
> include/hw/misc/mchp_pfsoc_dmc.h | 6 +
> include/hw/misc/mchp_pfsoc_ioscb.h | 8 +
> include/hw/misc/mchp_pfsoc_l2cc.h | 31 ++
> include/hw/riscv/microchip_pfsoc.h | 7 +
> include/hw/rtc/mchp_pfsoc_rtc.h | 46 ++
> include/hw/sd/cadence_sdhci.h | 1 +
> hw/misc/mchp_pfsoc_dmc.c | 273 +++++++++-
> hw/misc/mchp_pfsoc_ioscb.c | 174 ++++++-
> hw/misc/mchp_pfsoc_l2cc.c | 231 +++++++++
> hw/misc/mchp_pfsoc_sysreg.c | 9 +-
> hw/riscv/microchip_pfsoc.c | 94 ++--
> hw/rtc/mchp_pfsoc_rtc.c | 477 ++++++++++++++++++
> hw/sd/cadence_sdhci.c | 11 +
> hw/sd/sd.c | 43 +-
> hw/sd/sdhci.c | 143 ++++--
> tests/qtest/cadence-sdhci-test.c | 282 +++++++++++
> tests/qtest/mchp_pfsoc_l2cc_test.c | 221 ++++++++
> tests/qtest/mchp_pfsoc_rtc_test.c | 315 ++++++++++++
> hw/misc/Kconfig | 3 +
> hw/misc/meson.build | 1 +
> hw/riscv/Kconfig | 2 +
> hw/rtc/Kconfig | 3 +
> hw/rtc/meson.build | 1 +
> tests/functional/riscv64/meson.build | 2 +
> .../riscv64/test_microchip_icicle_kit.py | 56 ++
> tests/qtest/meson.build | 6 +
> 28 files changed, 2429 insertions(+), 159 deletions(-)
> create mode 100644 include/hw/misc/mchp_pfsoc_l2cc.h
> create mode 100644 include/hw/rtc/mchp_pfsoc_rtc.h
> create mode 100644 hw/misc/mchp_pfsoc_l2cc.c
> create mode 100644 hw/rtc/mchp_pfsoc_rtc.c
> create mode 100644 tests/qtest/cadence-sdhci-test.c
> create mode 100644 tests/qtest/mchp_pfsoc_l2cc_test.c
> create mode 100644 tests/qtest/mchp_pfsoc_rtc_test.c
> create mode 100644 tests/functional/riscv64/test_microchip_icicle_kit.py
>
> ---
> base-commit: d2843fbf80260e4346c856819e8cea11768c9d0e
> branch: icicle-kit
>
> --
Ping for review?
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service
2026-09-04 15:57 ` [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service Bin Meng
@ 2026-09-30 8:34 ` Conor Dooley
2026-10-03 15:10 ` Bin Meng
0 siblings, 1 reply; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 8:34 UTC (permalink / raw)
To: Bin Meng; +Cc: QEMU, Conor Dooley, Sebastian Huber, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 11160 bytes --]
On Fri, Sep 04, 2026 at 11:57:31PM +0800, Bin Meng wrote:
> U-Boot requests the PolarFire SoC device serial number during board
> late initialization. The IOSCB previously rejected every request, so
This is kinda crazy actually, we probably should change u-boot to not do
this since the reason for acquiring the serial number is populating the
mac address.
I guess it just never actually ever is problematic in hardware, but it
does seem a bit mad to reject boot over.
> board setup could not complete.
>
> Model the System Services control registers and byte-addressable
> mailbox. Obtain the 128-bit serial number from an optional device
> property, using a deterministic value when it is not configured.
> Return an explicit failure for unsupported services and reset the new
> runtime state with the rest of the device.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> ---
>
> (no changes since v1)
>
> include/hw/misc/mchp_pfsoc_ioscb.h | 6 ++
> hw/misc/mchp_pfsoc_ioscb.c | 141 +++++++++++++++++++++++++----
> 2 files changed, 130 insertions(+), 17 deletions(-)
>
> diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
> index 9687ea25b1..fd31427304 100644
> --- a/include/hw/misc/mchp_pfsoc_ioscb.h
> +++ b/include/hw/misc/mchp_pfsoc_ioscb.h
> @@ -25,6 +25,8 @@
>
> #include "hw/core/sysbus.h"
>
> +#define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
> +
> typedef struct MchpPfSoCIoscbState {
> SysBusDevice parent;
> MemoryRegion container;
> @@ -47,6 +49,10 @@ typedef struct MchpPfSoCIoscbState {
> MemoryRegion cfm_sgmii;
> MemoryRegion bc_sgmii;
> MemoryRegion io_calib_sgmii;
> + uint32_t services_cr;
> + uint32_t services_sr;
> + uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
> + char *serial_number;
> qemu_irq irq;
> } MchpPfSoCIoscbState;
>
> diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
> index 09b702e520..7c82b55986 100644
> --- a/hw/misc/mchp_pfsoc_ioscb.c
> +++ b/hw/misc/mchp_pfsoc_ioscb.c
> @@ -25,6 +25,7 @@
> #include "qemu/log.h"
> #include "qapi/error.h"
> #include "hw/core/irq.h"
> +#include "hw/core/qdev-properties.h"
> #include "hw/core/sysbus.h"
> #include "hw/misc/mchp_pfsoc_ioscb.h"
>
> @@ -37,6 +38,9 @@
> #define IOSCB_CCC_REG_SIZE 0x2000000
> #define IOSCB_CTRL_REG_SIZE 0x800
> #define IOSCB_QSPIXIP_REG_SIZE 0x200
> +#define IOSCB_SERIAL_NUMBER_SIZE 16U
> +#define IOSCB_DEFAULT_SERIAL_NUMBER "0123456789abcdef"
> +#define IOSCB_PROP_SERIAL_NUMBER "serial-number"
>
>
> /*
> @@ -186,33 +190,71 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
> .endianness = DEVICE_LITTLE_ENDIAN,
> };
>
> -#define SERVICES_CR 0x50
> -#define SERVICES_SR 0x54
> -#define SERVICES_STATUS_SHIFT 16
> +#define SERVICES_CR 0x50
> +#define SERVICES_CR_REQUEST BIT(0)
> +#define SERVICES_CR_COMMAND_SHIFT 16
> +#define SERVICES_CR_COMMAND_WIDTH 8
This I think should actually be 7.
> +#define SERVICES_CR_COMMAND_MASK \
> + MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
> +#define SERVICES_CR_MASK \
> + (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
> +#define SERVICES_SR 0x54
> +#define SERVICES_SR_STATUS_SHIFT 16
> +#define SERVICES_COMMAND_SERIAL_NUMBER 0
> +#define SERVICES_STATUS_SUCCESS 0
> +#define SERVICES_STATUS_FAILED 1
> +#define SERVICES_MAILBOX_RESPONSE_OFFSET 0
> +
> +static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> +{
> + uint32_t command;
> + uint32_t status = SERVICES_STATUS_FAILED;
> +
> + if (device_is_in_reset(DEVICE(s)) ||
> + !(value & SERVICES_CR_REQUEST)) {
> + return;
> + }
> +
> + /*
> + * System services complete synchronously in this model, so clear the
> + * request bit before exposing the response to the guest.
> + */
> + s->services_cr &= ~SERVICES_CR_REQUEST;
> +
> + command = (value & SERVICES_CR_COMMAND_MASK) >>
> + SERVICES_CR_COMMAND_SHIFT;
> + if (command == SERVICES_COMMAND_SERIAL_NUMBER) {
> + /*
> + * The serial-number service returns a 128-bit response starting at
> + * the beginning of the mailbox.
That's not actually strictly true, bits 15:7 of the command actually
determine the location in the mailbox. I'm not actually aware of any users
of this feature, Linux and U-Boot both leave this at 0, so it doesn't really
matter for functionality, but the comment is wrong.
See section 3 of the document in the comment you're removing below for
how this works.
> + */
> + memset(&s->mailbox_data[SERVICES_MAILBOX_RESPONSE_OFFSET], 0,
> + IOSCB_SERIAL_NUMBER_SIZE);
> + memcpy(&s->mailbox_data[SERVICES_MAILBOX_RESPONSE_OFFSET],
> + s->serial_number, strlen(s->serial_number));
> + status = SERVICES_STATUS_SUCCESS;
> + }
> +
> + s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
> + qemu_irq_raise(s->irq);
> +}
>
> static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
> unsigned size)
> {
> - uint32_t val = 0;
> + MchpPfSoCIoscbState *s = opaque;
>
> switch (offset) {
> + case SERVICES_CR:
> + return s->services_cr;
> case SERVICES_SR:
> - /*
> - * Although some services have no error codes, most do. All services
> - * that do implement errors, begin their error codes at 1. Treat all
> - * service requests as failures & return 1.
> - * See the "PolarFire® FPGA and PolarFire SoC FPGA System Services"
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> - * user guide for more information on service error codes.
> - */
> - val = 1u << SERVICES_STATUS_SHIFT;
> - break;
> + return s->services_sr;
> default:
> qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
> "(size %d, offset 0x%" HWADDR_PRIx ")\n",
> __func__, size, offset);
> + return 0;
> }
> -
> - return val;
> }
>
> static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
> @@ -222,13 +264,17 @@ static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
>
> switch (offset) {
> case SERVICES_CR:
> - qemu_irq_raise(s->irq);
> + s->services_cr = value & SERVICES_CR_MASK;
> + services_cr_write(s, value);
> + break;
> + case SERVICES_SR:
> break;
> default:
> qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
> "(size %d, value 0x%" PRIx64
> ", offset 0x%" HWADDR_PRIx ")\n",
> __func__, size, value, offset);
> + break;
> }
> }
>
> @@ -236,6 +282,55 @@ static const MemoryRegionOps mchp_pfsoc_ctrl_ops = {
> .read = mchp_pfsoc_ctrl_read,
> .write = mchp_pfsoc_ctrl_write,
> .endianness = DEVICE_LITTLE_ENDIAN,
> + .valid = {
> + .min_access_size = sizeof(uint32_t),
I'm not au fait enough with qemu to know, but does this mean that
accessing these registers with an 8 or 16 bit accessor will fail
somehow?
If so, that's not how the hardware behaves, and below...
> + .max_access_size = sizeof(uint32_t),
> + },
> +};
> +
> +/*
> + * The System Controller uses the mailbox as a byte-addressable shared buffer
> + * for service command payloads and responses.
> + */
> +static uint64_t mchp_pfsoc_mailbox_read(void *opaque, hwaddr offset,
> + unsigned size)
> +{
> + MchpPfSoCIoscbState *s = opaque;
> +
> + return ldn_le_p(&s->mailbox_data[offset], size);
> +}
> +
> +static void mchp_pfsoc_mailbox_write(void *opaque, hwaddr offset,
> + uint64_t value, unsigned size)
> +{
> + MchpPfSoCIoscbState *s = opaque;
> +
> + stn_le_p(&s->mailbox_data[offset], size, value);
> +}
> +
> +static const MemoryRegionOps mchp_pfsoc_mailbox_ops = {
> + .read = mchp_pfsoc_mailbox_read,
> + .write = mchp_pfsoc_mailbox_write,
> + .endianness = DEVICE_LITTLE_ENDIAN,
> + .valid = {
> + .min_access_size = sizeof(uint8_t),
...you have the more expected 8.
> + .max_access_size = sizeof(uint32_t),
> + },
> +};
> +
> +static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
> +{
> + MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> +
> + s->services_cr = 0;
> + s->services_sr = 0;
> + memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
> + qemu_irq_lower(s->irq);
> +}
> +
> +static const Property mchp_pfsoc_ioscb_properties[] = {
> + DEFINE_PROP_STRING(IOSCB_PROP_SERIAL_NUMBER,
> + MchpPfSoCIoscbState, serial_number),
> };
>
> static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> @@ -243,6 +338,16 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
>
> + /* Use a deterministic identity when no serial number is configured */
> + if (!s->serial_number) {
> + s->serial_number = g_strdup(IOSCB_DEFAULT_SERIAL_NUMBER);
> + }
> + if (strlen(s->serial_number) > IOSCB_SERIAL_NUMBER_SIZE) {
> + error_setg(errp, "The serial number can't be longer than %u bytes",
> + IOSCB_SERIAL_NUMBER_SIZE);
> + return;
> + }
> +
> memory_region_init(&s->container, OBJECT(s),
> "mchp.pfsoc.ioscb", IOSCB_WHOLE_REG_SIZE);
> sysbus_init_mmio(sbd, &s->container);
> @@ -265,7 +370,7 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> "mchp.pfsoc.ioscb.qspixip", IOSCB_QSPIXIP_REG_SIZE);
> memory_region_add_subregion(&s->container, IOSCB_QSPIXIP_BASE, &s->qspixip);
>
> - memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
> + memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_mailbox_ops, s,
> "mchp.pfsoc.ioscb.mailbox", IOSCB_SUBMOD_REG_SIZE);
> memory_region_add_subregion(&s->container, IOSCB_MAILBOX_BASE, &s->mailbox);
>
> @@ -343,6 +448,8 @@ static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, const void *data)
>
> dc->desc = "Microchip PolarFire SoC IOSCB modules";
> dc->realize = mchp_pfsoc_ioscb_realize;
> + device_class_set_legacy_reset(dc, mchp_pfsoc_ioscb_reset);
> + device_class_set_props(dc, mchp_pfsoc_ioscb_properties);
> }
>
> static const TypeInfo mchp_pfsoc_ioscb_info = {
> --
> 2.53.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests
2026-09-04 15:57 ` [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests Bin Meng
@ 2026-09-30 9:20 ` Conor Dooley
2026-10-03 15:53 ` Bin Meng
0 siblings, 1 reply; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 9:20 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Sebastian Huber, Weiwei Li, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 8912 bytes --]
On Fri, Sep 04, 2026 at 11:57:35PM +0800, Bin Meng wrote:
> Polling firmware requests system services without requesting an
> interrupt. The old model ignored this distinction:
>
> 1. HSS requests the serial number with REQUEST set and NOTIFY clear.
> 2. QEMU synchronously fills the mailbox and clears REQUEST.
> 3. QEMU incorrectly asserts PLIC source 96.
> 4. HSS polls REQUEST and neither waits for nor handles the interrupt.
> 5. PLIC source 96 remains pending.
> 6. Linux registers the MPFS mailbox driver.
> 7. The stale interrupt immediately enters mpfs_mbox_inbox_isr().
> 8. Linux has not submitted a request or installed its response pointer.
> 9. The ISR dereferences that null pointer and faults near address 0x10.
This makes sense, and should probably have a fixes tag pointing to my
2022 commit? Since I was direct kernel booting, I would never had
noticed anything of this nature.
> Honor SERVICES_CR.NOTIFY, let IOSCB own the pending interrupt state,
> and route the SYSREG acknowledgement through an IOSCB clear input.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> Reviewed-by: Chao Liu <chao.liu@processmission.com>
> ---
>
> (no changes since v1)
>
> include/hw/misc/mchp_pfsoc_ioscb.h | 2 ++
> hw/misc/mchp_pfsoc_ioscb.c | 39 +++++++++++++++++++++++++++---
> hw/misc/mchp_pfsoc_sysreg.c | 9 ++++++-
> hw/riscv/microchip_pfsoc.c | 6 ++---
> 4 files changed, 49 insertions(+), 7 deletions(-)
>
> diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
> index fd31427304..e39d995b64 100644
> --- a/include/hw/misc/mchp_pfsoc_ioscb.h
> +++ b/include/hw/misc/mchp_pfsoc_ioscb.h
> @@ -26,6 +26,7 @@
> #include "hw/core/sysbus.h"
>
> #define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
> +#define MCHP_PFSOC_IOSCB_IRQ_CLEAR "irq-clear"
>
> typedef struct MchpPfSoCIoscbState {
> SysBusDevice parent;
> @@ -53,6 +54,7 @@ typedef struct MchpPfSoCIoscbState {
> uint32_t services_sr;
> uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
> char *serial_number;
> + bool irq_pending;
> qemu_irq irq;
> } MchpPfSoCIoscbState;
>
> diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
> index 7c82b55986..ccc2201b7a 100644
> --- a/hw/misc/mchp_pfsoc_ioscb.c
> +++ b/hw/misc/mchp_pfsoc_ioscb.c
> @@ -192,12 +192,13 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
>
> #define SERVICES_CR 0x50
> #define SERVICES_CR_REQUEST BIT(0)
> +#define SERVICES_CR_NOTIFY BIT(3)
> #define SERVICES_CR_COMMAND_SHIFT 16
> #define SERVICES_CR_COMMAND_WIDTH 8
> #define SERVICES_CR_COMMAND_MASK \
> MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
> #define SERVICES_CR_MASK \
> - (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
> + (SERVICES_CR_REQUEST | SERVICES_CR_NOTIFY | SERVICES_CR_COMMAND_MASK)
> #define SERVICES_SR 0x54
> #define SERVICES_SR_STATUS_SHIFT 16
> #define SERVICES_COMMAND_SERIAL_NUMBER 0
> @@ -205,6 +206,21 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
> #define SERVICES_STATUS_FAILED 1
> #define SERVICES_MAILBOX_RESPONSE_OFFSET 0
>
> +static void mchp_pfsoc_ioscb_update_irq(MchpPfSoCIoscbState *s)
> +{
> + qemu_set_irq(s->irq, s->irq_pending);
> +}
> +
> +static void mchp_pfsoc_ioscb_clear_irq(void *opaque, int n, int level)
> +{
> + MchpPfSoCIoscbState *s = opaque;
> +
> + if (level) {
> + s->irq_pending = false;
> + mchp_pfsoc_ioscb_update_irq(s);
> + }
> +}
> +
> static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> {
> uint32_t command;
> @@ -236,7 +252,15 @@ static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> }
>
> s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
> - qemu_irq_raise(s->irq);
> + /*
> + * HSS and U-Boot submit polling requests with REQUEST set and NOTIFY
> + * clear, then poll REQUEST/BUSY for completion. Linux sets both bits
> + * and expects completion through PLIC source 96.
> + */
> + if (value & SERVICES_CR_NOTIFY) {
> + s->irq_pending = true;
> + mchp_pfsoc_ioscb_update_irq(s);
> + }
> }
>
> static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
> @@ -325,7 +349,8 @@ static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
> s->services_cr = 0;
> s->services_sr = 0;
> memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
> - qemu_irq_lower(s->irq);
> + s->irq_pending = false;
> + mchp_pfsoc_ioscb_update_irq(s);
> }
>
> static const Property mchp_pfsoc_ioscb_properties[] = {
> @@ -333,6 +358,13 @@ static const Property mchp_pfsoc_ioscb_properties[] = {
> MchpPfSoCIoscbState, serial_number),
> };
>
> +static void mchp_pfsoc_ioscb_init(Object *obj)
> +{
> + /* Accept service interrupt acknowledgements from SYSREG MESSAGE_INT */
> + qdev_init_gpio_in_named(DEVICE(obj), mchp_pfsoc_ioscb_clear_irq,
> + MCHP_PFSOC_IOSCB_IRQ_CLEAR, 1);
> +}
> +
> static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> {
> MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> @@ -456,6 +488,7 @@ static const TypeInfo mchp_pfsoc_ioscb_info = {
> .name = TYPE_MCHP_PFSOC_IOSCB,
> .parent = TYPE_SYS_BUS_DEVICE,
> .instance_size = sizeof(MchpPfSoCIoscbState),
> + .instance_init = mchp_pfsoc_ioscb_init,
> .class_init = mchp_pfsoc_ioscb_class_init,
> };
>
> diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
> index 1d9154280a..899b485da6 100644
> --- a/hw/misc/mchp_pfsoc_sysreg.c
> +++ b/hw/misc/mchp_pfsoc_sysreg.c
> @@ -77,7 +77,14 @@ static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
> }
> break;
> case MESSAGE_INT:
> - qemu_irq_lower(s->irq);
> + /*
> + * A MESSAGE_INT write is an acknowledgement event, not a level that
> + * remains asserted. Model it as an active-high pulse. The rising edge
I found this comment to be really confusing. Why would someone expect
that a write-zero-clear bit is an asserted level? Mentioning modelling
it as a pulse further makes it seem like software writing will generate an
interrupt, which it doesn't - it writes here to clear the interrupt. I
think this needs to be very clear that modelling this as an interrupt at
all is just being done for QEMU's sake.
I think this needs to be split in two, with the fix for the problem
(which I think is limited to only raising the interrupt) kept apart from
this change. Part of that is because I don't actually understand the
reason for adding this "fake" interrupt and the commit message is
currently focused around the bug and doesn't actually provide
justification for it. Maybe it's obvious to people more familiar with
Qemu than I, but this complication makes no sense to me!
> + * invokes IOSCB's irq-clear input with level 1, which clears
> + * irq_pending and lowers PLIC source 96. The falling edge invokes the
> + * input with level 0 and is ignored.
> + */
> + qemu_irq_pulse(s->irq);
> break;
> default:
> qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
> diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> index fb0e18edba..87c9c89cb0 100644
> --- a/hw/riscv/microchip_pfsoc.c
> +++ b/hw/riscv/microchip_pfsoc.c
> @@ -336,9 +336,6 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> sysbus_realize(SYS_BUS_DEVICE(&s->sysreg), errp);
> sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
> memmap[MICROCHIP_PFSOC_SYSREG].base);
> - sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
> - qdev_get_gpio_in(DEVICE(s->plic),
> - MICROCHIP_PFSOC_MAILBOX_IRQ));
>
> /* AXISW */
> create_unimplemented_device("microchip.pfsoc.axisw",
> @@ -492,6 +489,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> sysbus_connect_irq(SYS_BUS_DEVICE(&s->ioscb), 0,
> qdev_get_gpio_in(DEVICE(s->plic),
> MICROCHIP_PFSOC_MAILBOX_IRQ));
> + sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
> + qdev_get_gpio_in_named(DEVICE(&s->ioscb),
> + MCHP_PFSOC_IOSCB_IRQ_CLEAR, 0));
>
> /* FPGA Fabric */
> create_unimplemented_device("microchip.pfsoc.fabricfic3",
> --
> 2.53.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 09/24] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
2026-09-04 15:57 ` [PATCH v2 09/24] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes Bin Meng
@ 2026-09-30 9:25 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 48+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-09-30 9:25 UTC (permalink / raw)
To: Bin Meng, QEMU; +Cc: qemu-stable, Bin Meng, qemu-block
On 4/9/26 17:57, Bin Meng wrote:
> SDHC and SDXC memory commands always transfer 512-byte blocks regardless
> of the length selected by CMD16. QEMU stores that selected length for
> LOCK_UNLOCK but also used it directly for several memory command paths.
>
> Route single- and multi-block memory sizing through the existing helper
> that distinguishes high-capacity cards from SDSC.
>
> This lets PolarFire SoC HSS validate the complete GPT header and locate
> its boot partition instead of receiving only the eight-byte signature.
>
> Fixes: 2d7adea4fe57 ("hw/sd: Support SDHC size cards")
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> ---
>
> (no changes since v1)
>
> hw/sd/sd.c | 43 +++++++++++++++++++++++++------------------
> 1 file changed, 25 insertions(+), 18 deletions(-)
Wow, old one.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
2026-09-04 15:57 ` [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases Bin Meng
@ 2026-09-30 9:28 ` Conor Dooley
2026-10-03 15:10 ` Bin Meng
0 siblings, 1 reply; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 9:28 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Sebastian Huber, Weiwei Li, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 2966 bytes --]
On Fri, Sep 04, 2026 at 11:57:36PM +0800, Bin Meng wrote:
> The 64-bit cached and non-cached windows alias the complete physical
> DDR from offset zero. Treating them as only the portion above 1 GiB
This is not strictly true, how these regions overlap depends on how the
FPGA itself is configured. In the past, the regions were set up
sequentially and someone may choose to set their device up that way if
they want to, provided they change their devicetree to match.
I think the change is worth making, but the commit doing so should cite
reality and explain that this aliasing is the case in the reference
designs provided by microchip, not present it as the whole truth.
Ditto for the comment.
> leaves valid Icicle Kit memory nodes unbacked with the board's 2 GiB.
>
> Map both high windows over the full machine RAM.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> Reviewed-by: Chao Liu <chao.liu@processmission.com>
> ---
>
> (no changes since v1)
>
> hw/riscv/microchip_pfsoc.c | 18 +++++++++++++++---
> 1 file changed, 15 insertions(+), 3 deletions(-)
>
> diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> index 87c9c89cb0..83ac352c1e 100644
> --- a/hw/riscv/microchip_pfsoc.c
> +++ b/hw/riscv/microchip_pfsoc.c
> @@ -573,15 +573,27 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
> TYPE_MICROCHIP_PFSOC);
> qdev_realize(DEVICE(&s->soc), NULL, &error_fatal);
>
> - /* Split RAM into low and high regions using aliases to machine->ram */
> + /*
> + * The four CPU-visible windows alias the same physical DDR from offset
> + * zero. For the Icicle Kit's 2 GiB of DDR, they map as follows:
> + *
> + * CPU address Attribute Visible size DDR range
> + * 0x0080000000 32-bit cached 1 GiB [0, 1 GiB)
> + * 0x00c0000000 32-bit non-cached 1 GiB [0, 1 GiB)
> + * 0x1000000000 64-bit cached 2 GiB [0, 2 GiB)
> + * 0x1400000000 64-bit non-cached 2 GiB [0, 2 GiB)
> + *
> + * "Low" and "high" describe the CPU address windows, not the lower and
> + * upper portions of physical DDR.
> + */
> mem_low_size = memmap[MICROCHIP_PFSOC_DRAM_LO].size;
> - mem_high_size = machine->ram_size - mem_low_size;
> + mem_high_size = machine->ram_size;
> memory_region_init_alias(mem_low, NULL,
> "microchip.icicle.kit.ram_low", machine->ram,
> 0, mem_low_size);
> memory_region_init_alias(mem_high, NULL,
> "microchip.icicle.kit.ram_high", machine->ram,
> - mem_low_size, mem_high_size);
> + 0, mem_high_size);
>
> /* Register RAM */
> memory_region_add_subregion(system_memory,
> --
> 2.53.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 18/24] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
2026-09-04 15:57 ` [PATCH v2 18/24] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB Bin Meng
@ 2026-09-30 9:29 ` Conor Dooley
0 siblings, 0 replies; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 9:29 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Pierrick Bouvier, Sebastian Huber, Weiwei Li, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 55 bytes --]
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five
2026-09-04 15:57 ` [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five Bin Meng
@ 2026-09-30 9:33 ` Conor Dooley
2026-10-03 15:10 ` Bin Meng
0 siblings, 1 reply; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 9:33 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Pierrick Bouvier, Sebastian Huber, Weiwei Li, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 2300 bytes --]
On Fri, Sep 04, 2026 at 11:57:38PM +0800, Bin Meng wrote:
> The Icicle Kit always contains one E51 management hart and four U54
> application harts. The model currently accepts two to five harts and
> defaults to two, allowing configurations that cannot match the board.
Updating the default to 5 makes sense, stops accidentally trying to boot
something expecting 5 CPUs and getting only 2. But why the change to the
minimum? If someone intentionally wants to have only 1 u54, why prevent
that?
>
> Set the minimum and default CPU counts to the five-hart maximum.
> Update the documentation to state that other hart counts are rejected.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> Reviewed-by: Chao Liu <chao.liu@processmission.com>
> ---
>
> (no changes since v1)
>
> docs/system/riscv/microchip-icicle-kit.rst | 1 +
> hw/riscv/microchip_pfsoc.c | 4 ++--
> 2 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
> index 3db2b3c7e3..38352cc62b 100644
> --- a/docs/system/riscv/microchip-icicle-kit.rst
> +++ b/docs/system/riscv/microchip-icicle-kit.rst
> @@ -27,6 +27,7 @@ The ``microchip-icicle-kit`` machine supports the following devices:
> * 1 SDHC storage controller
>
> The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
> +The machine always exposes all five harts. Other CPU counts are rejected.
>
> Boot options
> ------------
> diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> index 11403a6087..1238811ed8 100644
> --- a/hw/riscv/microchip_pfsoc.c
> +++ b/hw/riscv/microchip_pfsoc.c
> @@ -768,8 +768,8 @@ static void microchip_icicle_kit_machine_class_init(ObjectClass *oc,
> mc->init = microchip_icicle_kit_machine_init;
> mc->max_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT +
> MICROCHIP_PFSOC_COMPUTE_CPU_COUNT;
> - mc->min_cpus = MICROCHIP_PFSOC_MANAGEMENT_CPU_COUNT + 1;
> - mc->default_cpus = mc->min_cpus;
> + mc->min_cpus = mc->max_cpus;
> + mc->default_cpus = mc->max_cpus;
> mc->default_ram_id = "microchip.icicle.kit.ram";
> mc->auto_create_sdcard = true;
>
> --
> 2.53.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM
2026-09-04 15:57 ` [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM Bin Meng
@ 2026-09-30 9:38 ` Philippe Mathieu-Daudé
2026-10-03 15:10 ` Bin Meng
0 siblings, 1 reply; 48+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-09-30 9:38 UTC (permalink / raw)
To: Bin Meng, QEMU
Cc: Chao Liu, Alistair Francis, Conor Dooley, Daniel Henrique Barboza,
Liu Zhiwei, Palmer Dabbelt, Paolo Bonzini, Sebastian Huber,
Weiwei Li, qemu-riscv
Hi,
On 4/9/26 17:57, Bin Meng wrote:
> Instantiate the L2CC in the PolarFire SoC machine and connect its
> WayEnable register to the L2-LIM MemoryRegion. Back the complete 2 MiB
> aperture and shrink it by 128 KiB for each cache way enabled.
>
> Keep L2 Zero at its fixed aperture because it represents a cache
> allocation window rather than the remaining L2-LIM capacity.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> Reviewed-by: Chao Liu <chao.liu@processmission.com>
> ---
>
> (no changes since v1)
>
> include/hw/misc/mchp_pfsoc_l2cc.h | 1 +
> include/hw/riscv/microchip_pfsoc.h | 2 ++
> hw/misc/mchp_pfsoc_l2cc.c | 51 ++++++++++++++++++++++++++++++
> hw/riscv/microchip_pfsoc.c | 23 +++++++-------
> hw/riscv/Kconfig | 1 +
> 5 files changed, 67 insertions(+), 11 deletions(-)
>
> diff --git a/include/hw/misc/mchp_pfsoc_l2cc.h b/include/hw/misc/mchp_pfsoc_l2cc.h
> index 1b5b3888d5..3a175a6340 100644
> --- a/include/hw/misc/mchp_pfsoc_l2cc.h
> +++ b/include/hw/misc/mchp_pfsoc_l2cc.h
> @@ -22,6 +22,7 @@ typedef struct MchpPfSoCL2ccState {
> SysBusDevice parent;
> uint64_t regs[MCHP_PFSOC_L2CC_REG_NUM];
> RegisterInfo regs_info[MCHP_PFSOC_L2CC_REG_NUM];
> + MemoryRegion *l2lim;
> } MchpPfSoCL2ccState;
>
> #define TYPE_MCHP_PFSOC_L2CC "mchp.pfsoc.l2cc"
> diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
> index 612fd2b69c..0aeccedf77 100644
> --- a/include/hw/riscv/microchip_pfsoc.h
> +++ b/include/hw/riscv/microchip_pfsoc.h
> @@ -27,6 +27,7 @@
> #include "hw/cpu/cluster.h"
> #include "hw/dma/sifive_pdma.h"
> #include "hw/misc/mchp_pfsoc_dmc.h"
> +#include "hw/misc/mchp_pfsoc_l2cc.h"
> #include "hw/misc/mchp_pfsoc_ioscb.h"
> #include "hw/misc/mchp_pfsoc_sysreg.h"
> #include "hw/net/cadence_gem.h"
> @@ -43,6 +44,7 @@ typedef struct MicrochipPFSoCState {
> RISCVHartArrayState e_cpus;
> RISCVHartArrayState u_cpus;
> DeviceState *plic;
> + MchpPfSoCL2ccState l2cc;
> MchpPfSoCDdrSgmiiPhyState ddr_sgmii_phy;
> MchpPfSoCDdrCfgState ddr_cfg;
> MchpPfSoCIoscbState ioscb;
> diff --git a/hw/misc/mchp_pfsoc_l2cc.c b/hw/misc/mchp_pfsoc_l2cc.c
> index 979d904676..4b87c963fc 100644
> --- a/hw/misc/mchp_pfsoc_l2cc.c
> +++ b/hw/misc/mchp_pfsoc_l2cc.c
> @@ -11,6 +11,9 @@
>
> #include "qemu/osdep.h"
> #include "qemu/log.h"
> +#include "qemu/units.h"
> +#include "qapi/error.h"
> +#include "hw/core/qdev-properties.h"
> #include "hw/core/register.h"
> #include "hw/core/registerfields.h"
> #include "hw/misc/mchp_pfsoc_l2cc.h"
> @@ -39,6 +42,25 @@ REG64(L2_WAY_MASK_HART4_DCACHE, 0x868)
> REG64(L2_WAY_MASK_HART4_ICACHE, 0x870)
>
> #define L2_CONFIG_RESET 0x06091004
> +#define L2_LIM_WAY_COUNT 15
> +#define L2_WAY_SIZE (128 * KiB)
> +
> +static void mchp_pfsoc_l2cc_update_l2lim(MchpPfSoCL2ccState *s,
> + uint64_t way_enable)
> +{
> + uint64_t l2lim_size;
> +
> + if (way_enable >= L2_LIM_WAY_COUNT) {
> + l2lim_size = 0;
> + } else {
> + l2lim_size = (L2_LIM_WAY_COUNT - way_enable) * L2_WAY_SIZE;
> + }
> +
> + memory_region_transaction_begin();
> + memory_region_set_size(s->l2lim, l2lim_size);
> + memory_region_set_enabled(s->l2lim, l2lim_size != 0);
> + memory_region_transaction_commit();
> +}
>
> static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
> uint64_t value)
> @@ -48,6 +70,14 @@ static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
> return MAX(current, value);
> }
>
> +static void mchp_pfsoc_l2cc_way_enable_post_write(RegisterInfo *reg,
> + uint64_t value)
> +{
> + MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(reg->opaque);
> +
> + mchp_pfsoc_l2cc_update_l2lim(s, value);
> +}
> +
> #define WAY_MASK_REGISTER(_name) \
> { \
> .name = "WAY_MASK_" #_name, \
> @@ -66,6 +96,7 @@ static const RegisterAccessInfo mchp_pfsoc_l2cc_regs_info[] = {
> .addr = A_L2_WAY_ENABLE,
> .rsvd = ~R_L2_WAY_ENABLE_VALUE_MASK,
> .pre_write = mchp_pfsoc_l2cc_way_enable_pre_write,
> + .post_write = mchp_pfsoc_l2cc_way_enable_post_write,
> },
> WAY_MASK_REGISTER(DMA),
> WAY_MASK_REGISTER(AXI4_PORT_0),
> @@ -157,11 +188,31 @@ static void mchp_pfsoc_l2cc_init(Object *obj)
> sysbus_init_mmio(SYS_BUS_DEVICE(obj), ®_array->mem);
> }
>
> +static void mchp_pfsoc_l2cc_realize(DeviceState *dev, Error **errp)
> +{
> + MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(dev);
> +
> + if (!s->l2lim) {
> + error_setg(errp, TYPE_MCHP_PFSOC_L2CC ": 'l2-lim' link not set");
> + return;
> + }
> +
> + mchp_pfsoc_l2cc_update_l2lim(s, s->regs[R_L2_WAY_ENABLE]);
> +}
> +
> +static const Property mchp_pfsoc_l2cc_properties[] = {
> + DEFINE_PROP_LINK("l2-lim", MchpPfSoCL2ccState, l2lim,
> + TYPE_MEMORY_REGION, MemoryRegion *),
> +};
> +
> static void mchp_pfsoc_l2cc_class_init(ObjectClass *klass, const void *data)
> {
> + DeviceClass *dc = DEVICE_CLASS(klass);
> ResettableClass *rc = RESETTABLE_CLASS(klass);
>
> rc->phases.hold = mchp_pfsoc_l2cc_reset_hold;
> + device_class_set_props(dc, mchp_pfsoc_l2cc_properties);
> + dc->realize = mchp_pfsoc_l2cc_realize;
> }
>
> static const TypeInfo mchp_pfsoc_l2cc_info = {
> diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> index 8106dbb3ad..114567867b 100644
> --- a/hw/riscv/microchip_pfsoc.c
> +++ b/hw/riscv/microchip_pfsoc.c
> @@ -174,6 +174,9 @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
> object_initialize_child(obj, "dma-controller", &s->dma,
> TYPE_SIFIVE_PDMA);
>
> + object_initialize_child(obj, "l2-cache-controller", &s->l2cc,
> + TYPE_MCHP_PFSOC_L2CC);
Is this the same model used by hw/riscv/sifive_u.c?
> object_initialize_child(obj, "sysreg", &s->sysreg,
> TYPE_MCHP_PFSOC_SYSREG);
>
> @@ -260,18 +263,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
> iks->clint_timebase_freq, false);
>
> - /* L2 cache controller */
> - create_unimplemented_device("microchip.pfsoc.l2cc",
> - memmap[MICROCHIP_PFSOC_L2CC].base, memmap[MICROCHIP_PFSOC_L2CC].size);
> -
> /*
> - * Add L2-LIM at reset size.
> - * This should be reduced in size as the L2 Cache Controller WayEnable
> - * register is incremented. Unfortunately I don't see a nice (or any) way
> - * to handle reducing or blocking out the L2 LIM while still allowing it
> - * be re returned to all enabled after a reset. For the time being, just
> - * leave it enabled all the time. This won't break anything, but will be
> - * too generous to misbehaving guests.
> + * Back the complete L2-LIM aperture. The L2 cache controller resizes
> + * this MemoryRegion to 128 KiB for every way assigned to L2-LIM.
> */
> memory_region_init_ram(l2lim_mem, NULL, "microchip.pfsoc.l2lim",
> memmap[MICROCHIP_PFSOC_L2LIM].size, &error_fatal);
> @@ -279,6 +273,13 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> memmap[MICROCHIP_PFSOC_L2LIM].base,
> l2lim_mem);
>
> + /* L2 cache controller */
> + object_property_set_link(OBJECT(&s->l2cc), "l2-lim",
> + OBJECT(l2lim_mem), &error_abort);
Modelling question (I have no clue with this particular SoC): does
'l2-lim' belong to the SoC layer, consumed by the L2CC or is it
internal to the L2CC and exposed to the SoC?
> + sysbus_realize(SYS_BUS_DEVICE(&s->l2cc), errp);
> + sysbus_mmio_map(SYS_BUS_DEVICE(&s->l2cc), 0,
> + memmap[MICROCHIP_PFSOC_L2CC].base);
> +
> /*
> * HSS decompresses into the L2 zero-device window and executes there.
> * Model it as RAM because QEMU does not model the backing L2 cache.
> diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
> index d06ac26648..85b535c7cb 100644
> --- a/hw/riscv/Kconfig
> +++ b/hw/riscv/Kconfig
> @@ -18,6 +18,7 @@ config MICROCHIP_PFSOC
> select DEVICE_TREE
> select MCHP_PFSOC_DMC
> select MCHP_PFSOC_IOSCB
> + select MCHP_PFSOC_L2CC
> select MCHP_PFSOC_MMUART
> select MCHP_PFSOC_SYSREG
> select RISCV_ACLINT
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 04/24] hw/misc: pfsoc: Model L2 cache controller registers
2026-09-04 15:57 ` [PATCH v2 04/24] hw/misc: pfsoc: Model L2 cache controller registers Bin Meng
@ 2026-09-30 9:38 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 48+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-09-30 9:38 UTC (permalink / raw)
To: Bin Meng, QEMU
Cc: Alistair Francis, Conor Dooley, Paolo Bonzini, Sebastian Huber,
qemu-riscv
On 4/9/26 17:57, Bin Meng wrote:
> Implement the Config, WayEnable, and per-master WayMask registers
> described by the PolarFire SoC MSS reference manual. Make WayEnable
> monotonic and report the remaining register space as unimplemented.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> Acked-by: Alistair Francis <alistair.francis@wdc.com>
>
> ---
>
> Changes in v2:
> - Use the Resettable API instead of a legacy reset handler
>
> MAINTAINERS | 2 +
> include/hw/misc/mchp_pfsoc_l2cc.h | 30 +++++
> hw/misc/mchp_pfsoc_l2cc.c | 180 ++++++++++++++++++++++++++++++
> hw/misc/Kconfig | 3 +
> hw/misc/meson.build | 1 +
> 5 files changed, 216 insertions(+)
> create mode 100644 include/hw/misc/mchp_pfsoc_l2cc.h
> create mode 100644 hw/misc/mchp_pfsoc_l2cc.c
> diff --git a/include/hw/misc/mchp_pfsoc_l2cc.h b/include/hw/misc/mchp_pfsoc_l2cc.h
> new file mode 100644
> index 0000000000..1b5b3888d5
> --- /dev/null
> +++ b/include/hw/misc/mchp_pfsoc_l2cc.h
> @@ -0,0 +1,30 @@
> +/*
> + * Microchip PolarFire SoC L2 cache controller
> + *
> + * Copyright (c) 2026 Process Mission
> + *
> + * Author:
> + * Bin Meng <bin.meng@processmission.com>
> + *
> + * SPDX-License-Identifier: GPL-2.0-or-later
> + */
> +
> +#ifndef MCHP_PFSOC_L2CC_H
> +#define MCHP_PFSOC_L2CC_H
> +
> +#include "hw/core/register.h"
> +#include "hw/core/sysbus.h"
> +
> +#define MCHP_PFSOC_L2CC_REG_SIZE 0x1000
> +#define MCHP_PFSOC_L2CC_REG_NUM (MCHP_PFSOC_L2CC_REG_SIZE / 8)
> +
> +typedef struct MchpPfSoCL2ccState {
> + SysBusDevice parent;
Nitpicking, 'parent_obj'.
> + uint64_t regs[MCHP_PFSOC_L2CC_REG_NUM];
> + RegisterInfo regs_info[MCHP_PFSOC_L2CC_REG_NUM];
> +} MchpPfSoCL2ccState;
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot
2026-09-04 15:57 ` [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot Bin Meng
@ 2026-09-30 9:43 ` Conor Dooley
2026-10-03 15:20 ` Bin Meng
2026-09-30 10:15 ` Conor Dooley
1 sibling, 1 reply; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 9:43 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Conor Dooley, Pierrick Bouvier, Sebastian Huber, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 6512 bytes --]
On Fri, Sep 04, 2026 at 11:57:39PM +0800, Bin Meng wrote:
> With all previous changes, the Icicle Kit model is now able to boot
> HSS v2024.06 through a Buildroot 2026.05 SD image to U-Boot and Linux.
>
> Document the tested source versions and exact commands to build HSS
> and Buildroot. Include the sparse resize and GPT relocation steps
> needed to make the generated SD image usable by QEMU.
>
> Also describe the RAM and serial setup, boot stages, and remaining
> model limitations.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> ---
>
> (no changes since v1)
>
> docs/system/riscv/microchip-icicle-kit.rst | 101 +++++++++++++++++++--
> 1 file changed, 95 insertions(+), 6 deletions(-)
>
> diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
> index 38352cc62b..eeb4ff938c 100644
> --- a/docs/system/riscv/microchip-icicle-kit.rst
> +++ b/docs/system/riscv/microchip-icicle-kit.rst
> @@ -19,12 +19,15 @@ The ``microchip-icicle-kit`` machine supports the following devices:
> * 4 U54 cores
> * Core Level Interruptor (CLINT)
> * Platform-Level Interrupt Controller (PLIC)
> -* L2 Loosely Integrated Memory (L2-LIM)
> +* Loosely Integrated Memory (L2-LIM)
> +* L2 cache controller (L2CC)
> * DDR memory controller
> +* System controller and system services mailbox
> * 5 MMUARTs
> * 1 DMA controller
> * 2 GEM Ethernet controllers
> * 1 SDHC storage controller
> +* 1 Real-Time Clock
>
> The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
> The machine always exposes all five harts. Other CPU counts are rejected.
> @@ -101,10 +104,96 @@ CAVEATS:
> Running HSS
> -----------
>
> -The machine ``microchip-icicle-kit`` used to run the Hart Software Services
> -(HSS_), however, the HSS development progressed and the QEMU machine
> -implementation lacks behind. Currently, running the HSS no longer works.
> -There is missing support in the clock and memory controller devices. In
> -particular, reading from the SD card does not work.
> +The ``microchip-icicle-kit`` machine can boot the Hart Software Services
> +(HSS_), which then loads an HSS payload containing U-Boot from an SD card.
> +The following flow was tested with HSS v2024.06 and Buildroot 2026.05.
> +
> +Configure HSS for the ``mpfs-icicle-kit-es`` board using its default
> +configuration. QEMU provides the software-visible registers and deterministic
> +status consumed by the HSS v2024.06 DDR initialization and training flow;
> +it does not model the electrical properties of DDR training. HSS requires
> +the RISC-V bare-metal toolchain supplied by Microchip SoftConsole to be
> +available in ``PATH``. Build the tested HSS version with:
> +
> +.. code-block:: bash
> +
> + $ git clone https://github.com/polarfire-soc/hart-software-services.git
> + $ cd hart-software-services
> + $ git checkout v2024.06
> + $ make BOARD=mpfs-icicle-kit-es defconfig
> + $ make -j$(nproc) BOARD=mpfs-icicle-kit-es
> +
> +The HSS build creates both the raw wrapper and an eNVM programming image. QEMU
> +needs the complete eNVM image, including the 256-byte boot header added by the
> +Microchip boot mode programmer. Convert the generated Intel HEX file to a raw
> +binary image, for example:
> +
> +.. code-block:: bash
> +
> + $ riscv64-unknown-elf-objcopy -I ihex -O binary \
> + build/hss-envm-wrapper.mpfs-icicle-kit-es.hex build/hss.bin
> +
> +Do not pass ``build/hss-envm-wrapper.bin`` directly to QEMU. That file starts
> +at eNVM offset 0x100 and does not contain the boot header with the image size
> +and per-hart reset vectors.
> +
> +Build the SD card image with the tested Buildroot version:
> +
> +.. code-block:: bash
> +
> + $ git clone https://gitlab.com/buildroot.org/buildroot.git
> + $ cd buildroot
> + $ git checkout 2026.05
> + $ make microchip_mpfs_icicle_defconfig
> + $ make
> +
> +This produces ``output/images/sdcard.img`` with three GPT partitions:
> +
> +* An HSS ``payload.bin`` containing U-Boot.
> +* A FAT partition containing ``boot.scr`` and the kernel FIT image.
> +* An ext4 Linux root filesystem.
> +
> +The QEMU SD card model requires a power-of-two image size. Make a sparse
> +4 GiB working copy and relocate its backup GPT to the new end of the image:
> +
> +.. code-block:: bash
> +
> + $ cp --reflink=auto output/images/sdcard.img sdcard.img
> + $ truncate -s 4G sdcard.img
> + $ sgdisk -e sdcard.img
> + $ sgdisk -v sdcard.img
> +
> +The Icicle Kit firmware device tree in the FIT image describes 2 GiB of RAM,
> +matching the machine's fixed RAM size. The command below keeps ``-m 2G``
> +explicit. Attach the image as an SD card and route both board serial ports:
> +
> +.. code-block:: bash
> +
> + $ qemu-system-riscv64 \
> + -M microchip-icicle-kit -smp 5 -m 2G \
> + -bios path/to/hss/build/hss.bin \
> + -drive if=sd,file=path/to/sdcard.img,format=raw \
> + -display none \
> + -serial file:hss.log \
> + -serial stdio \
> + -no-reboot
> +
> +HSS writes to MMUART0, which the command records in ``hss.log``. U-Boot and
> +Linux use MMUART1, which remains connected to the terminal. A successful
> +boot proceeds through HSS payload loading, U-Boot, the Linux kernel, and the
> +login prompt from the root filesystem on the third partition.
> +
> +Known limitations
> +-----------------
> +
> +* The tested HSS v2024.06 flow contains 2 separate multi-hart startup races
> + issues which is still not fixed as of the latest v2026.04 release. A boot
> + may therefore stall at the very beginning or after successful DDR training
> + during the OpenSBI/U-Boot handoff.
Some symptoms would be nice, so as to differentiate between the known
issues and other potential problems.
> +* The SD card model requires the raw image size to be a power of two. Keep
> + the backup GPT header at the end when resizing the image.
> +* The machine does not generate an Icicle Kit device tree. Firmware boot must
> + provide one in its payload or FIT image;
There's 3 options actually. Either the HSS has one itself, there's one
in the HSS payload or the software brings it - be that in a fit
image or part of a U-Boot binary.
> direct kernel boot must use
> + ``-dtb`` as described above.
>
> .. _HSS: https://github.com/polarfire-soc/hart-software-services
> --
> 2.53.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 24/24] MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer
2026-09-04 15:57 ` [PATCH v2 24/24] MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer Bin Meng
@ 2026-09-30 9:51 ` Conor Dooley
0 siblings, 0 replies; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 9:51 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Conor Dooley, Markus Armbruster, Peter Maydell,
Philippe Mathieu-Daudé, Pierrick Bouvier, Thomas Huth
[-- Attachment #1: Type: text/plain, Size: 1221 bytes --]
On Fri, Sep 04, 2026 at 11:57:43PM +0800, Bin Meng wrote:
> Conor asked not to be listed as a maintainer, since that could imply
> that Microchip sponsors his work on the platform.
Not an unreasonable assumption for people to make, given the status has
been changed in the previous patch to supported.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
>
> Keep him listed as a reviewer so he continues to receive relevant
> patches without suggesting an active maintenance commitment.
>
> Suggested-by: Conor Dooley <conor@kernel.org>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
>
> ---
>
> Changes in v2:
> - New patch
>
> MAINTAINERS | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index e68e7eb12e..9590de2509 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -1787,7 +1787,7 @@ F: tests/tcg/riscv64/test-crc32.S
>
> Microchip PolarFire SoC Icicle Kit
> M: Bin Meng <bin.meng@processmission.com>
> -M: Conor Dooley <conor@kernel.org>
> +R: Conor Dooley <conor@kernel.org>
> M: Sebastian Huber <sebastian.huber@embedded-brains.de>
> L: qemu-riscv@nongnu.org
> S: Supported
> --
> 2.53.0
>
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot
2026-09-04 15:57 ` [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot Bin Meng
2026-09-30 9:43 ` Conor Dooley
@ 2026-09-30 10:15 ` Conor Dooley
2026-10-03 15:16 ` Bin Meng
1 sibling, 1 reply; 48+ messages in thread
From: Conor Dooley @ 2026-09-30 10:15 UTC (permalink / raw)
To: Bin Meng
Cc: QEMU, Conor Dooley, Pierrick Bouvier, Sebastian Huber, qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 3814 bytes --]
On Fri, Sep 04, 2026 at 11:57:39PM +0800, Bin Meng wrote:
> With all previous changes, the Icicle Kit model is now able to boot
> HSS v2024.06 through a Buildroot 2026.05 SD image to U-Boot and Linux.
>
> Document the tested source versions and exact commands to build HSS
> and Buildroot. Include the sparse resize and GPT relocation steps
> needed to make the generated SD image usable by QEMU.
>
> Also describe the RAM and serial setup, boot stages, and remaining
> model limitations.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
> ---
>
> (no changes since v1)
>
> docs/system/riscv/microchip-icicle-kit.rst | 101 +++++++++++++++++++--
> 1 file changed, 95 insertions(+), 6 deletions(-)
>
> diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
> index 38352cc62b..eeb4ff938c 100644
> --- a/docs/system/riscv/microchip-icicle-kit.rst
> +++ b/docs/system/riscv/microchip-icicle-kit.rst
> @@ -19,12 +19,15 @@ The ``microchip-icicle-kit`` machine supports the following devices:
> * 4 U54 cores
> * Core Level Interruptor (CLINT)
> * Platform-Level Interrupt Controller (PLIC)
> -* L2 Loosely Integrated Memory (L2-LIM)
> +* Loosely Integrated Memory (L2-LIM)
> +* L2 cache controller (L2CC)
> * DDR memory controller
> +* System controller and system services mailbox
> * 5 MMUARTs
> * 1 DMA controller
> * 2 GEM Ethernet controllers
> * 1 SDHC storage controller
> +* 1 Real-Time Clock
>
> The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
> The machine always exposes all five harts. Other CPU counts are rejected.
> @@ -101,10 +104,96 @@ CAVEATS:
> Running HSS
> -----------
>
> -The machine ``microchip-icicle-kit`` used to run the Hart Software Services
> -(HSS_), however, the HSS development progressed and the QEMU machine
> -implementation lacks behind. Currently, running the HSS no longer works.
> -There is missing support in the clock and memory controller devices. In
> -particular, reading from the SD card does not work.
> +The ``microchip-icicle-kit`` machine can boot the Hart Software Services
> +(HSS_), which then loads an HSS payload containing U-Boot from an SD card.
> +The following flow was tested with HSS v2024.06 and Buildroot 2026.05.
> +
> +Configure HSS for the ``mpfs-icicle-kit-es`` board using its default
> +configuration. QEMU provides the software-visible registers and deterministic
> +status consumed by the HSS v2024.06 DDR initialization and training flow;
> +it does not model the electrical properties of DDR training. HSS requires
> +the RISC-V bare-metal toolchain supplied by Microchip SoftConsole to be
> +available in ``PATH``. Build the tested HSS version with:
What's the reason that this is using 2024.06 by the way? Why not use the
most recent release of the HSS?
> +
> +.. code-block:: bash
> +
> + $ git clone https://github.com/polarfire-soc/hart-software-services.git
> + $ cd hart-software-services
> + $ git checkout v2024.06
> + $ make BOARD=mpfs-icicle-kit-es defconfig
> + $ make -j$(nproc) BOARD=mpfs-icicle-kit-es
> +
> +The HSS build creates both the raw wrapper and an eNVM programming image. QEMU
> +needs the complete eNVM image, including the 256-byte boot header added by the
> +Microchip boot mode programmer. Convert the generated Intel HEX file to a raw
> +binary image, for example:
> +
> +.. code-block:: bash
> +
> + $ riscv64-unknown-elf-objcopy -I ihex -O binary \
> + build/hss-envm-wrapper.mpfs-icicle-kit-es.hex build/hss.bin
> +
> +Do not pass ``build/hss-envm-wrapper.bin`` directly to QEMU. That file starts
> +at eNVM offset 0x100 and does not contain the boot header with the image size
> +and per-hart reset vectors.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM
2026-09-30 9:38 ` Philippe Mathieu-Daudé
@ 2026-10-03 15:10 ` Bin Meng
0 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:10 UTC (permalink / raw)
To: Philippe Mathieu-Daudé
Cc: Bin Meng, QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Paolo Bonzini, Sebastian Huber, Weiwei Li, qemu-riscv
Hi Philippe,
On Wed, Sep 30, 2026 at 5:39 PM Philippe Mathieu-Daudé
<philmd@oss.qualcomm.com> wrote:
>
> Hi,
>
> On 4/9/26 17:57, Bin Meng wrote:
> > Instantiate the L2CC in the PolarFire SoC machine and connect its
> > WayEnable register to the L2-LIM MemoryRegion. Back the complete 2 MiB
> > aperture and shrink it by 128 KiB for each cache way enabled.
> >
> > Keep L2 Zero at its fixed aperture because it represents a cache
> > allocation window rather than the remaining L2-LIM capacity.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > Reviewed-by: Chao Liu <chao.liu@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > include/hw/misc/mchp_pfsoc_l2cc.h | 1 +
> > include/hw/riscv/microchip_pfsoc.h | 2 ++
> > hw/misc/mchp_pfsoc_l2cc.c | 51 ++++++++++++++++++++++++++++++
> > hw/riscv/microchip_pfsoc.c | 23 +++++++-------
> > hw/riscv/Kconfig | 1 +
> > 5 files changed, 67 insertions(+), 11 deletions(-)
> >
> > diff --git a/include/hw/misc/mchp_pfsoc_l2cc.h b/include/hw/misc/mchp_pfsoc_l2cc.h
> > index 1b5b3888d5..3a175a6340 100644
> > --- a/include/hw/misc/mchp_pfsoc_l2cc.h
> > +++ b/include/hw/misc/mchp_pfsoc_l2cc.h
> > @@ -22,6 +22,7 @@ typedef struct MchpPfSoCL2ccState {
> > SysBusDevice parent;
> > uint64_t regs[MCHP_PFSOC_L2CC_REG_NUM];
> > RegisterInfo regs_info[MCHP_PFSOC_L2CC_REG_NUM];
> > + MemoryRegion *l2lim;
> > } MchpPfSoCL2ccState;
> >
> > #define TYPE_MCHP_PFSOC_L2CC "mchp.pfsoc.l2cc"
> > diff --git a/include/hw/riscv/microchip_pfsoc.h b/include/hw/riscv/microchip_pfsoc.h
> > index 612fd2b69c..0aeccedf77 100644
> > --- a/include/hw/riscv/microchip_pfsoc.h
> > +++ b/include/hw/riscv/microchip_pfsoc.h
> > @@ -27,6 +27,7 @@
> > #include "hw/cpu/cluster.h"
> > #include "hw/dma/sifive_pdma.h"
> > #include "hw/misc/mchp_pfsoc_dmc.h"
> > +#include "hw/misc/mchp_pfsoc_l2cc.h"
> > #include "hw/misc/mchp_pfsoc_ioscb.h"
> > #include "hw/misc/mchp_pfsoc_sysreg.h"
> > #include "hw/net/cadence_gem.h"
> > @@ -43,6 +44,7 @@ typedef struct MicrochipPFSoCState {
> > RISCVHartArrayState e_cpus;
> > RISCVHartArrayState u_cpus;
> > DeviceState *plic;
> > + MchpPfSoCL2ccState l2cc;
> > MchpPfSoCDdrSgmiiPhyState ddr_sgmii_phy;
> > MchpPfSoCDdrCfgState ddr_cfg;
> > MchpPfSoCIoscbState ioscb;
> > diff --git a/hw/misc/mchp_pfsoc_l2cc.c b/hw/misc/mchp_pfsoc_l2cc.c
> > index 979d904676..4b87c963fc 100644
> > --- a/hw/misc/mchp_pfsoc_l2cc.c
> > +++ b/hw/misc/mchp_pfsoc_l2cc.c
> > @@ -11,6 +11,9 @@
> >
> > #include "qemu/osdep.h"
> > #include "qemu/log.h"
> > +#include "qemu/units.h"
> > +#include "qapi/error.h"
> > +#include "hw/core/qdev-properties.h"
> > #include "hw/core/register.h"
> > #include "hw/core/registerfields.h"
> > #include "hw/misc/mchp_pfsoc_l2cc.h"
> > @@ -39,6 +42,25 @@ REG64(L2_WAY_MASK_HART4_DCACHE, 0x868)
> > REG64(L2_WAY_MASK_HART4_ICACHE, 0x870)
> >
> > #define L2_CONFIG_RESET 0x06091004
> > +#define L2_LIM_WAY_COUNT 15
> > +#define L2_WAY_SIZE (128 * KiB)
> > +
> > +static void mchp_pfsoc_l2cc_update_l2lim(MchpPfSoCL2ccState *s,
> > + uint64_t way_enable)
> > +{
> > + uint64_t l2lim_size;
> > +
> > + if (way_enable >= L2_LIM_WAY_COUNT) {
> > + l2lim_size = 0;
> > + } else {
> > + l2lim_size = (L2_LIM_WAY_COUNT - way_enable) * L2_WAY_SIZE;
> > + }
> > +
> > + memory_region_transaction_begin();
> > + memory_region_set_size(s->l2lim, l2lim_size);
> > + memory_region_set_enabled(s->l2lim, l2lim_size != 0);
> > + memory_region_transaction_commit();
> > +}
> >
> > static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
> > uint64_t value)
> > @@ -48,6 +70,14 @@ static uint64_t mchp_pfsoc_l2cc_way_enable_pre_write(RegisterInfo *reg,
> > return MAX(current, value);
> > }
> >
> > +static void mchp_pfsoc_l2cc_way_enable_post_write(RegisterInfo *reg,
> > + uint64_t value)
> > +{
> > + MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(reg->opaque);
> > +
> > + mchp_pfsoc_l2cc_update_l2lim(s, value);
> > +}
> > +
> > #define WAY_MASK_REGISTER(_name) \
> > { \
> > .name = "WAY_MASK_" #_name, \
> > @@ -66,6 +96,7 @@ static const RegisterAccessInfo mchp_pfsoc_l2cc_regs_info[] = {
> > .addr = A_L2_WAY_ENABLE,
> > .rsvd = ~R_L2_WAY_ENABLE_VALUE_MASK,
> > .pre_write = mchp_pfsoc_l2cc_way_enable_pre_write,
> > + .post_write = mchp_pfsoc_l2cc_way_enable_post_write,
> > },
> > WAY_MASK_REGISTER(DMA),
> > WAY_MASK_REGISTER(AXI4_PORT_0),
> > @@ -157,11 +188,31 @@ static void mchp_pfsoc_l2cc_init(Object *obj)
> > sysbus_init_mmio(SYS_BUS_DEVICE(obj), ®_array->mem);
> > }
> >
> > +static void mchp_pfsoc_l2cc_realize(DeviceState *dev, Error **errp)
> > +{
> > + MchpPfSoCL2ccState *s = MCHP_PFSOC_L2CC(dev);
> > +
> > + if (!s->l2lim) {
> > + error_setg(errp, TYPE_MCHP_PFSOC_L2CC ": 'l2-lim' link not set");
> > + return;
> > + }
> > +
> > + mchp_pfsoc_l2cc_update_l2lim(s, s->regs[R_L2_WAY_ENABLE]);
> > +}
> > +
> > +static const Property mchp_pfsoc_l2cc_properties[] = {
> > + DEFINE_PROP_LINK("l2-lim", MchpPfSoCL2ccState, l2lim,
> > + TYPE_MEMORY_REGION, MemoryRegion *),
> > +};
> > +
> > static void mchp_pfsoc_l2cc_class_init(ObjectClass *klass, const void *data)
> > {
> > + DeviceClass *dc = DEVICE_CLASS(klass);
> > ResettableClass *rc = RESETTABLE_CLASS(klass);
> >
> > rc->phases.hold = mchp_pfsoc_l2cc_reset_hold;
> > + device_class_set_props(dc, mchp_pfsoc_l2cc_properties);
> > + dc->realize = mchp_pfsoc_l2cc_realize;
> > }
> >
> > static const TypeInfo mchp_pfsoc_l2cc_info = {
> > diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> > index 8106dbb3ad..114567867b 100644
> > --- a/hw/riscv/microchip_pfsoc.c
> > +++ b/hw/riscv/microchip_pfsoc.c
> > @@ -174,6 +174,9 @@ static void microchip_pfsoc_soc_instance_init(Object *obj)
> > object_initialize_child(obj, "dma-controller", &s->dma,
> > TYPE_SIFIVE_PDMA);
> >
> > + object_initialize_child(obj, "l2-cache-controller", &s->l2cc,
> > + TYPE_MCHP_PFSOC_L2CC);
>
> Is this the same model used by hw/riscv/sifive_u.c?
From technical reference manual they seem to use the same IP (the IP
should be from SiFive). The Linux kernel dts file compatible string of
both machines also supports this. Current QEMU `sifive_u` machine does
not integrate the L2CC block yet.
>
> > object_initialize_child(obj, "sysreg", &s->sysreg,
> > TYPE_MCHP_PFSOC_SYSREG);
> >
> > @@ -260,18 +263,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> > RISCV_ACLINT_DEFAULT_MTIMECMP, RISCV_ACLINT_DEFAULT_MTIME,
> > iks->clint_timebase_freq, false);
> >
> > - /* L2 cache controller */
> > - create_unimplemented_device("microchip.pfsoc.l2cc",
> > - memmap[MICROCHIP_PFSOC_L2CC].base, memmap[MICROCHIP_PFSOC_L2CC].size);
> > -
> > /*
> > - * Add L2-LIM at reset size.
> > - * This should be reduced in size as the L2 Cache Controller WayEnable
> > - * register is incremented. Unfortunately I don't see a nice (or any) way
> > - * to handle reducing or blocking out the L2 LIM while still allowing it
> > - * be re returned to all enabled after a reset. For the time being, just
> > - * leave it enabled all the time. This won't break anything, but will be
> > - * too generous to misbehaving guests.
> > + * Back the complete L2-LIM aperture. The L2 cache controller resizes
> > + * this MemoryRegion to 128 KiB for every way assigned to L2-LIM.
> > */
> > memory_region_init_ram(l2lim_mem, NULL, "microchip.pfsoc.l2lim",
> > memmap[MICROCHIP_PFSOC_L2LIM].size, &error_fatal);
> > @@ -279,6 +273,13 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> > memmap[MICROCHIP_PFSOC_L2LIM].base,
> > l2lim_mem);
> >
> > + /* L2 cache controller */
> > + object_property_set_link(OBJECT(&s->l2cc), "l2-lim",
> > + OBJECT(l2lim_mem), &error_abort);
>
> Modelling question (I have no clue with this particular SoC): does
> 'l2-lim' belong to the SoC layer, consumed by the L2CC or is it
> internal to the L2CC and exposed to the SoC?
I understand your point. Yeah it's better to model 'l2-lim' and
'l2-zero' devices under L2CC. Will do it in v3.
>
> > + sysbus_realize(SYS_BUS_DEVICE(&s->l2cc), errp);
> > + sysbus_mmio_map(SYS_BUS_DEVICE(&s->l2cc), 0,
> > + memmap[MICROCHIP_PFSOC_L2CC].base);
> > +
> > /*
> > * HSS decompresses into the L2 zero-device window and executes there.
> > * Model it as RAM because QEMU does not model the backing L2 cache.
> > diff --git a/hw/riscv/Kconfig b/hw/riscv/Kconfig
> > index d06ac26648..85b535c7cb 100644
> > --- a/hw/riscv/Kconfig
> > +++ b/hw/riscv/Kconfig
> > @@ -18,6 +18,7 @@ config MICROCHIP_PFSOC
> > select DEVICE_TREE
> > select MCHP_PFSOC_DMC
> > select MCHP_PFSOC_IOSCB
> > + select MCHP_PFSOC_L2CC
> > select MCHP_PFSOC_MMUART
> > select MCHP_PFSOC_SYSREG
> > select RISCV_ACLINT
>
>
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service
2026-09-30 8:34 ` Conor Dooley
@ 2026-10-03 15:10 ` Bin Meng
0 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:10 UTC (permalink / raw)
To: Conor Dooley; +Cc: Bin Meng, QEMU, Conor Dooley, Sebastian Huber, qemu-riscv
Hi Conor,
On Wed, Sep 30, 2026 at 4:37 PM Conor Dooley <conor.dooley@microchip.com> wrote:
>
> On Fri, Sep 04, 2026 at 11:57:31PM +0800, Bin Meng wrote:
> > U-Boot requests the PolarFire SoC device serial number during board
> > late initialization. The IOSCB previously rejected every request, so
>
> This is kinda crazy actually, we probably should change u-boot to not do
> this since the reason for acquiring the serial number is populating the
> mac address.
> I guess it just never actually ever is problematic in hardware, but it
> does seem a bit mad to reject boot over.
Will prepare a U-Boot patch to correct this upstream.
>
> > board setup could not complete.
> >
> > Model the System Services control registers and byte-addressable
> > mailbox. Obtain the 128-bit serial number from an optional device
> > property, using a deterministic value when it is not configured.
> > Return an explicit failure for unsupported services and reset the new
> > runtime state with the rest of the device.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > include/hw/misc/mchp_pfsoc_ioscb.h | 6 ++
> > hw/misc/mchp_pfsoc_ioscb.c | 141 +++++++++++++++++++++++++----
> > 2 files changed, 130 insertions(+), 17 deletions(-)
> >
> > diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
> > index 9687ea25b1..fd31427304 100644
> > --- a/include/hw/misc/mchp_pfsoc_ioscb.h
> > +++ b/include/hw/misc/mchp_pfsoc_ioscb.h
> > @@ -25,6 +25,8 @@
> >
> > #include "hw/core/sysbus.h"
> >
> > +#define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
> > +
> > typedef struct MchpPfSoCIoscbState {
> > SysBusDevice parent;
> > MemoryRegion container;
> > @@ -47,6 +49,10 @@ typedef struct MchpPfSoCIoscbState {
> > MemoryRegion cfm_sgmii;
> > MemoryRegion bc_sgmii;
> > MemoryRegion io_calib_sgmii;
> > + uint32_t services_cr;
> > + uint32_t services_sr;
> > + uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
> > + char *serial_number;
> > qemu_irq irq;
> > } MchpPfSoCIoscbState;
> >
> > diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
> > index 09b702e520..7c82b55986 100644
> > --- a/hw/misc/mchp_pfsoc_ioscb.c
> > +++ b/hw/misc/mchp_pfsoc_ioscb.c
> > @@ -25,6 +25,7 @@
> > #include "qemu/log.h"
> > #include "qapi/error.h"
> > #include "hw/core/irq.h"
> > +#include "hw/core/qdev-properties.h"
> > #include "hw/core/sysbus.h"
> > #include "hw/misc/mchp_pfsoc_ioscb.h"
> >
> > @@ -37,6 +38,9 @@
> > #define IOSCB_CCC_REG_SIZE 0x2000000
> > #define IOSCB_CTRL_REG_SIZE 0x800
> > #define IOSCB_QSPIXIP_REG_SIZE 0x200
> > +#define IOSCB_SERIAL_NUMBER_SIZE 16U
> > +#define IOSCB_DEFAULT_SERIAL_NUMBER "0123456789abcdef"
> > +#define IOSCB_PROP_SERIAL_NUMBER "serial-number"
> >
> >
> > /*
> > @@ -186,33 +190,71 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
> > .endianness = DEVICE_LITTLE_ENDIAN,
> > };
> >
> > -#define SERVICES_CR 0x50
> > -#define SERVICES_SR 0x54
> > -#define SERVICES_STATUS_SHIFT 16
> > +#define SERVICES_CR 0x50
> > +#define SERVICES_CR_REQUEST BIT(0)
> > +#define SERVICES_CR_COMMAND_SHIFT 16
> > +#define SERVICES_CR_COMMAND_WIDTH 8
>
> This I think should actually be 7.
Will fix in v3.
>
> > +#define SERVICES_CR_COMMAND_MASK \
> > + MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
> > +#define SERVICES_CR_MASK \
> > + (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
> > +#define SERVICES_SR 0x54
> > +#define SERVICES_SR_STATUS_SHIFT 16
> > +#define SERVICES_COMMAND_SERIAL_NUMBER 0
> > +#define SERVICES_STATUS_SUCCESS 0
> > +#define SERVICES_STATUS_FAILED 1
> > +#define SERVICES_MAILBOX_RESPONSE_OFFSET 0
> > +
> > +static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> > +{
> > + uint32_t command;
> > + uint32_t status = SERVICES_STATUS_FAILED;
> > +
> > + if (device_is_in_reset(DEVICE(s)) ||
> > + !(value & SERVICES_CR_REQUEST)) {
> > + return;
> > + }
> > +
> > + /*
> > + * System services complete synchronously in this model, so clear the
> > + * request bit before exposing the response to the guest.
> > + */
> > + s->services_cr &= ~SERVICES_CR_REQUEST;
> > +
> > + command = (value & SERVICES_CR_COMMAND_MASK) >>
> > + SERVICES_CR_COMMAND_SHIFT;
> > + if (command == SERVICES_COMMAND_SERIAL_NUMBER) {
> > + /*
> > + * The serial-number service returns a 128-bit response starting at
> > + * the beginning of the mailbox.
>
> That's not actually strictly true, bits 15:7 of the command actually
> determine the location in the mailbox. I'm not actually aware of any users
> of this feature, Linux and U-Boot both leave this at 0, so it doesn't really
> matter for functionality, but the comment is wrong.
> See section 3 of the document in the comment you're removing below for
> how this works.
Will fix the comment in v3.
>
> > + */
> > + memset(&s->mailbox_data[SERVICES_MAILBOX_RESPONSE_OFFSET], 0,
> > + IOSCB_SERIAL_NUMBER_SIZE);
> > + memcpy(&s->mailbox_data[SERVICES_MAILBOX_RESPONSE_OFFSET],
> > + s->serial_number, strlen(s->serial_number));
> > + status = SERVICES_STATUS_SUCCESS;
> > + }
> > +
> > + s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
> > + qemu_irq_raise(s->irq);
> > +}
> >
> > static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
> > unsigned size)
> > {
> > - uint32_t val = 0;
> > + MchpPfSoCIoscbState *s = opaque;
> >
> > switch (offset) {
> > + case SERVICES_CR:
> > + return s->services_cr;
> > case SERVICES_SR:
> > - /*
> > - * Although some services have no error codes, most do. All services
> > - * that do implement errors, begin their error codes at 1. Treat all
> > - * service requests as failures & return 1.
> > - * See the "PolarFire® FPGA and PolarFire SoC FPGA System Services"
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> > - * user guide for more information on service error codes.
> > - */
> > - val = 1u << SERVICES_STATUS_SHIFT;
> > - break;
> > + return s->services_sr;
> > default:
> > qemu_log_mask(LOG_UNIMP, "%s: unimplemented device read "
> > "(size %d, offset 0x%" HWADDR_PRIx ")\n",
> > __func__, size, offset);
> > + return 0;
> > }
> > -
> > - return val;
> > }
> >
> > static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
> > @@ -222,13 +264,17 @@ static void mchp_pfsoc_ctrl_write(void *opaque, hwaddr offset,
> >
> > switch (offset) {
> > case SERVICES_CR:
> > - qemu_irq_raise(s->irq);
> > + s->services_cr = value & SERVICES_CR_MASK;
> > + services_cr_write(s, value);
> > + break;
> > + case SERVICES_SR:
> > break;
> > default:
> > qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
> > "(size %d, value 0x%" PRIx64
> > ", offset 0x%" HWADDR_PRIx ")\n",
> > __func__, size, value, offset);
> > + break;
> > }
> > }
> >
> > @@ -236,6 +282,55 @@ static const MemoryRegionOps mchp_pfsoc_ctrl_ops = {
> > .read = mchp_pfsoc_ctrl_read,
> > .write = mchp_pfsoc_ctrl_write,
> > .endianness = DEVICE_LITTLE_ENDIAN,
> > + .valid = {
> > + .min_access_size = sizeof(uint32_t),
>
> I'm not au fait enough with qemu to know, but does this mean that
> accessing these registers with an 8 or 16 bit accessor will fail
> somehow?
> If so, that's not how the hardware behaves, and below...
This was added during debugging. Checked the doc and found no clear
clue about the access limitation. Testing showed that dropping these
does not prevent the firmware from booting. Will drop this in v3.
>
> > + .max_access_size = sizeof(uint32_t),
> > + },
> > +};
> > +
> > +/*
> > + * The System Controller uses the mailbox as a byte-addressable shared buffer
> > + * for service command payloads and responses.
> > + */
> > +static uint64_t mchp_pfsoc_mailbox_read(void *opaque, hwaddr offset,
> > + unsigned size)
> > +{
> > + MchpPfSoCIoscbState *s = opaque;
> > +
> > + return ldn_le_p(&s->mailbox_data[offset], size);
> > +}
> > +
> > +static void mchp_pfsoc_mailbox_write(void *opaque, hwaddr offset,
> > + uint64_t value, unsigned size)
> > +{
> > + MchpPfSoCIoscbState *s = opaque;
> > +
> > + stn_le_p(&s->mailbox_data[offset], size, value);
> > +}
> > +
> > +static const MemoryRegionOps mchp_pfsoc_mailbox_ops = {
> > + .read = mchp_pfsoc_mailbox_read,
> > + .write = mchp_pfsoc_mailbox_write,
> > + .endianness = DEVICE_LITTLE_ENDIAN,
> > + .valid = {
> > + .min_access_size = sizeof(uint8_t),
>
> ...you have the more expected 8.
>
> > + .max_access_size = sizeof(uint32_t),
> > + },
> > +};
> > +
> > +static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
> > +{
> > + MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> > +
> > + s->services_cr = 0;
> > + s->services_sr = 0;
> > + memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
> > + qemu_irq_lower(s->irq);
> > +}
> > +
> > +static const Property mchp_pfsoc_ioscb_properties[] = {
> > + DEFINE_PROP_STRING(IOSCB_PROP_SERIAL_NUMBER,
> > + MchpPfSoCIoscbState, serial_number),
> > };
> >
> > static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> > @@ -243,6 +338,16 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> > MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> > SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
> >
> > + /* Use a deterministic identity when no serial number is configured */
> > + if (!s->serial_number) {
> > + s->serial_number = g_strdup(IOSCB_DEFAULT_SERIAL_NUMBER);
> > + }
> > + if (strlen(s->serial_number) > IOSCB_SERIAL_NUMBER_SIZE) {
> > + error_setg(errp, "The serial number can't be longer than %u bytes",
> > + IOSCB_SERIAL_NUMBER_SIZE);
> > + return;
> > + }
> > +
> > memory_region_init(&s->container, OBJECT(s),
> > "mchp.pfsoc.ioscb", IOSCB_WHOLE_REG_SIZE);
> > sysbus_init_mmio(sbd, &s->container);
> > @@ -265,7 +370,7 @@ static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> > "mchp.pfsoc.ioscb.qspixip", IOSCB_QSPIXIP_REG_SIZE);
> > memory_region_add_subregion(&s->container, IOSCB_QSPIXIP_BASE, &s->qspixip);
> >
> > - memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_dummy_ops, s,
> > + memory_region_init_io(&s->mailbox, OBJECT(s), &mchp_pfsoc_mailbox_ops, s,
> > "mchp.pfsoc.ioscb.mailbox", IOSCB_SUBMOD_REG_SIZE);
> > memory_region_add_subregion(&s->container, IOSCB_MAILBOX_BASE, &s->mailbox);
> >
> > @@ -343,6 +448,8 @@ static void mchp_pfsoc_ioscb_class_init(ObjectClass *klass, const void *data)
> >
> > dc->desc = "Microchip PolarFire SoC IOSCB modules";
> > dc->realize = mchp_pfsoc_ioscb_realize;
> > + device_class_set_legacy_reset(dc, mchp_pfsoc_ioscb_reset);
> > + device_class_set_props(dc, mchp_pfsoc_ioscb_properties);
> > }
> >
> > static const TypeInfo mchp_pfsoc_ioscb_info = {
> > --
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
2026-09-30 9:28 ` Conor Dooley
@ 2026-10-03 15:10 ` Bin Meng
0 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:10 UTC (permalink / raw)
To: Conor Dooley
Cc: Bin Meng, QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Sebastian Huber, Weiwei Li, qemu-riscv
On Wed, Sep 30, 2026 at 5:31 PM Conor Dooley <conor.dooley@microchip.com> wrote:
>
> On Fri, Sep 04, 2026 at 11:57:36PM +0800, Bin Meng wrote:
> > The 64-bit cached and non-cached windows alias the complete physical
> > DDR from offset zero. Treating them as only the portion above 1 GiB
>
> This is not strictly true, how these regions overlap depends on how the
> FPGA itself is configured. In the past, the regions were set up
> sequentially and someone may choose to set their device up that way if
> they want to, provided they change their devicetree to match.
>
> I think the change is worth making, but the commit doing so should cite
> reality and explain that this aliasing is the case in the reference
> designs provided by microchip, not present it as the whole truth.
>
> Ditto for the comment.
Will update the commit message and comment in v3.
>
> > leaves valid Icicle Kit memory nodes unbacked with the board's 2 GiB.
> >
> > Map both high windows over the full machine RAM.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > Reviewed-by: Chao Liu <chao.liu@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > hw/riscv/microchip_pfsoc.c | 18 +++++++++++++++---
> > 1 file changed, 15 insertions(+), 3 deletions(-)
> >
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five
2026-09-30 9:33 ` Conor Dooley
@ 2026-10-03 15:10 ` Bin Meng
0 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:10 UTC (permalink / raw)
To: Conor Dooley
Cc: Bin Meng, QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Pierrick Bouvier, Sebastian Huber, Weiwei Li, qemu-riscv
On Wed, Sep 30, 2026 at 5:35 PM Conor Dooley <conor.dooley@microchip.com> wrote:
>
> On Fri, Sep 04, 2026 at 11:57:38PM +0800, Bin Meng wrote:
> > The Icicle Kit always contains one E51 management hart and four U54
> > application harts. The model currently accepts two to five harts and
> > defaults to two, allowing configurations that cannot match the board.
>
> Updating the default to 5 makes sense, stops accidentally trying to boot
> something expecting 5 CPUs and getting only 2. But why the change to the
> minimum? If someone intentionally wants to have only 1 u54, why prevent
> that?
>
Will drop the minimum change in v3.
> >
> > Set the minimum and default CPU counts to the five-hart maximum.
> > Update the documentation to state that other hart counts are rejected.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > Reviewed-by: Chao Liu <chao.liu@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > docs/system/riscv/microchip-icicle-kit.rst | 1 +
> > hw/riscv/microchip_pfsoc.c | 4 ++--
> > 2 files changed, 3 insertions(+), 2 deletions(-)
> >
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot
2026-09-30 10:15 ` Conor Dooley
@ 2026-10-03 15:16 ` Bin Meng
2026-10-04 0:32 ` Conor Dooley
0 siblings, 1 reply; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:16 UTC (permalink / raw)
To: Conor Dooley
Cc: Bin Meng, QEMU, Conor Dooley, Pierrick Bouvier, Sebastian Huber,
qemu-riscv
Hi Conor,
On Wed, Sep 30, 2026 at 6:17 PM Conor Dooley <conor.dooley@microchip.com> wrote:
>
> On Fri, Sep 04, 2026 at 11:57:39PM +0800, Bin Meng wrote:
> > With all previous changes, the Icicle Kit model is now able to boot
> > HSS v2024.06 through a Buildroot 2026.05 SD image to U-Boot and Linux.
> >
> > Document the tested source versions and exact commands to build HSS
> > and Buildroot. Include the sparse resize and GPT relocation steps
> > needed to make the generated SD image usable by QEMU.
> >
> > Also describe the RAM and serial setup, boot stages, and remaining
> > model limitations.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > docs/system/riscv/microchip-icicle-kit.rst | 101 +++++++++++++++++++--
> > 1 file changed, 95 insertions(+), 6 deletions(-)
> >
> > diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
> > index 38352cc62b..eeb4ff938c 100644
> > --- a/docs/system/riscv/microchip-icicle-kit.rst
> > +++ b/docs/system/riscv/microchip-icicle-kit.rst
> > @@ -19,12 +19,15 @@ The ``microchip-icicle-kit`` machine supports the following devices:
> > * 4 U54 cores
> > * Core Level Interruptor (CLINT)
> > * Platform-Level Interrupt Controller (PLIC)
> > -* L2 Loosely Integrated Memory (L2-LIM)
> > +* Loosely Integrated Memory (L2-LIM)
> > +* L2 cache controller (L2CC)
> > * DDR memory controller
> > +* System controller and system services mailbox
> > * 5 MMUARTs
> > * 1 DMA controller
> > * 2 GEM Ethernet controllers
> > * 1 SDHC storage controller
> > +* 1 Real-Time Clock
> >
> > The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
> > The machine always exposes all five harts. Other CPU counts are rejected.
> > @@ -101,10 +104,96 @@ CAVEATS:
> > Running HSS
> > -----------
> >
> > -The machine ``microchip-icicle-kit`` used to run the Hart Software Services
> > -(HSS_), however, the HSS development progressed and the QEMU machine
> > -implementation lacks behind. Currently, running the HSS no longer works.
> > -There is missing support in the clock and memory controller devices. In
> > -particular, reading from the SD card does not work.
> > +The ``microchip-icicle-kit`` machine can boot the Hart Software Services
> > +(HSS_), which then loads an HSS payload containing U-Boot from an SD card.
> > +The following flow was tested with HSS v2024.06 and Buildroot 2026.05.
> > +
> > +Configure HSS for the ``mpfs-icicle-kit-es`` board using its default
> > +configuration. QEMU provides the software-visible registers and deterministic
> > +status consumed by the HSS v2024.06 DDR initialization and training flow;
> > +it does not model the electrical properties of DDR training. HSS requires
> > +the RISC-V bare-metal toolchain supplied by Microchip SoftConsole to be
> > +available in ``PATH``. Build the tested HSS version with:
>
> What's the reason that this is using 2024.06 by the way? Why not use the
> most recent release of the HSS?
This is because the Buildroot v2026.05 release's defconfig for Icicle
Kit board refers to v2024.06 version of
'microchip-hss-payload-generator' which is a tool from HSS, so I chose
to use the same HSS source version to build the HSS to match the tools
version.
>
> > +
> > +.. code-block:: bash
> > +
> > + $ git clone https://github.com/polarfire-soc/hart-software-services.git
> > + $ cd hart-software-services
> > + $ git checkout v2024.06
> > + $ make BOARD=mpfs-icicle-kit-es defconfig
> > + $ make -j$(nproc) BOARD=mpfs-icicle-kit-es
> > +
> > +The HSS build creates both the raw wrapper and an eNVM programming image. QEMU
> > +needs the complete eNVM image, including the 256-byte boot header added by the
> > +Microchip boot mode programmer. Convert the generated Intel HEX file to a raw
> > +binary image, for example:
> > +
> > +.. code-block:: bash
> > +
> > + $ riscv64-unknown-elf-objcopy -I ihex -O binary \
> > + build/hss-envm-wrapper.mpfs-icicle-kit-es.hex build/hss.bin
> > +
> > +Do not pass ``build/hss-envm-wrapper.bin`` directly to QEMU. That file starts
> > +at eNVM offset 0x100 and does not contain the boot header with the image size
> > +and per-hart reset vectors.
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot
2026-09-30 9:43 ` Conor Dooley
@ 2026-10-03 15:20 ` Bin Meng
0 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:20 UTC (permalink / raw)
To: Conor Dooley
Cc: Bin Meng, QEMU, Conor Dooley, Pierrick Bouvier, Sebastian Huber,
qemu-riscv
On Wed, Sep 30, 2026 at 5:46 PM Conor Dooley <conor.dooley@microchip.com> wrote:
>
> On Fri, Sep 04, 2026 at 11:57:39PM +0800, Bin Meng wrote:
> > With all previous changes, the Icicle Kit model is now able to boot
> > HSS v2024.06 through a Buildroot 2026.05 SD image to U-Boot and Linux.
> >
> > Document the tested source versions and exact commands to build HSS
> > and Buildroot. Include the sparse resize and GPT relocation steps
> > needed to make the generated SD image usable by QEMU.
> >
> > Also describe the RAM and serial setup, boot stages, and remaining
> > model limitations.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > docs/system/riscv/microchip-icicle-kit.rst | 101 +++++++++++++++++++--
> > 1 file changed, 95 insertions(+), 6 deletions(-)
> >
> > diff --git a/docs/system/riscv/microchip-icicle-kit.rst b/docs/system/riscv/microchip-icicle-kit.rst
> > index 38352cc62b..eeb4ff938c 100644
> > --- a/docs/system/riscv/microchip-icicle-kit.rst
> > +++ b/docs/system/riscv/microchip-icicle-kit.rst
> > @@ -19,12 +19,15 @@ The ``microchip-icicle-kit`` machine supports the following devices:
> > * 4 U54 cores
> > * Core Level Interruptor (CLINT)
> > * Platform-Level Interrupt Controller (PLIC)
> > -* L2 Loosely Integrated Memory (L2-LIM)
> > +* Loosely Integrated Memory (L2-LIM)
> > +* L2 cache controller (L2CC)
> > * DDR memory controller
> > +* System controller and system services mailbox
> > * 5 MMUARTs
> > * 1 DMA controller
> > * 2 GEM Ethernet controllers
> > * 1 SDHC storage controller
> > +* 1 Real-Time Clock
> >
> > The machine has a fixed 2 GiB of RAM. Other memory sizes are rejected.
> > The machine always exposes all five harts. Other CPU counts are rejected.
> > @@ -101,10 +104,96 @@ CAVEATS:
> > Running HSS
> > -----------
> >
> > -The machine ``microchip-icicle-kit`` used to run the Hart Software Services
> > -(HSS_), however, the HSS development progressed and the QEMU machine
> > -implementation lacks behind. Currently, running the HSS no longer works.
> > -There is missing support in the clock and memory controller devices. In
> > -particular, reading from the SD card does not work.
> > +The ``microchip-icicle-kit`` machine can boot the Hart Software Services
> > +(HSS_), which then loads an HSS payload containing U-Boot from an SD card.
> > +The following flow was tested with HSS v2024.06 and Buildroot 2026.05.
> > +
> > +Configure HSS for the ``mpfs-icicle-kit-es`` board using its default
> > +configuration. QEMU provides the software-visible registers and deterministic
> > +status consumed by the HSS v2024.06 DDR initialization and training flow;
> > +it does not model the electrical properties of DDR training. HSS requires
> > +the RISC-V bare-metal toolchain supplied by Microchip SoftConsole to be
> > +available in ``PATH``. Build the tested HSS version with:
> > +
> > +.. code-block:: bash
> > +
> > + $ git clone https://github.com/polarfire-soc/hart-software-services.git
> > + $ cd hart-software-services
> > + $ git checkout v2024.06
> > + $ make BOARD=mpfs-icicle-kit-es defconfig
> > + $ make -j$(nproc) BOARD=mpfs-icicle-kit-es
> > +
> > +The HSS build creates both the raw wrapper and an eNVM programming image. QEMU
> > +needs the complete eNVM image, including the 256-byte boot header added by the
> > +Microchip boot mode programmer. Convert the generated Intel HEX file to a raw
> > +binary image, for example:
> > +
> > +.. code-block:: bash
> > +
> > + $ riscv64-unknown-elf-objcopy -I ihex -O binary \
> > + build/hss-envm-wrapper.mpfs-icicle-kit-es.hex build/hss.bin
> > +
> > +Do not pass ``build/hss-envm-wrapper.bin`` directly to QEMU. That file starts
> > +at eNVM offset 0x100 and does not contain the boot header with the image size
> > +and per-hart reset vectors.
> > +
> > +Build the SD card image with the tested Buildroot version:
> > +
> > +.. code-block:: bash
> > +
> > + $ git clone https://gitlab.com/buildroot.org/buildroot.git
> > + $ cd buildroot
> > + $ git checkout 2026.05
> > + $ make microchip_mpfs_icicle_defconfig
> > + $ make
> > +
> > +This produces ``output/images/sdcard.img`` with three GPT partitions:
> > +
> > +* An HSS ``payload.bin`` containing U-Boot.
> > +* A FAT partition containing ``boot.scr`` and the kernel FIT image.
> > +* An ext4 Linux root filesystem.
> > +
> > +The QEMU SD card model requires a power-of-two image size. Make a sparse
> > +4 GiB working copy and relocate its backup GPT to the new end of the image:
> > +
> > +.. code-block:: bash
> > +
> > + $ cp --reflink=auto output/images/sdcard.img sdcard.img
> > + $ truncate -s 4G sdcard.img
> > + $ sgdisk -e sdcard.img
> > + $ sgdisk -v sdcard.img
> > +
> > +The Icicle Kit firmware device tree in the FIT image describes 2 GiB of RAM,
> > +matching the machine's fixed RAM size. The command below keeps ``-m 2G``
> > +explicit. Attach the image as an SD card and route both board serial ports:
> > +
> > +.. code-block:: bash
> > +
> > + $ qemu-system-riscv64 \
> > + -M microchip-icicle-kit -smp 5 -m 2G \
> > + -bios path/to/hss/build/hss.bin \
> > + -drive if=sd,file=path/to/sdcard.img,format=raw \
> > + -display none \
> > + -serial file:hss.log \
> > + -serial stdio \
> > + -no-reboot
> > +
> > +HSS writes to MMUART0, which the command records in ``hss.log``. U-Boot and
> > +Linux use MMUART1, which remains connected to the terminal. A successful
> > +boot proceeds through HSS payload loading, U-Boot, the Linux kernel, and the
> > +login prompt from the root filesystem on the third partition.
> > +
> > +Known limitations
> > +-----------------
> > +
> > +* The tested HSS v2024.06 flow contains 2 separate multi-hart startup races
> > + issues which is still not fixed as of the latest v2026.04 release. A boot
> > + may therefore stall at the very beginning or after successful DDR training
> > + during the OpenSBI/U-Boot handoff.
>
> Some symptoms would be nice, so as to differentiate between the known
> issues and other potential problems.
>
Sure, will add in v3.
> > +* The SD card model requires the raw image size to be a power of two. Keep
> > + the backup GPT header at the end when resizing the image.
> > +* The machine does not generate an Icicle Kit device tree. Firmware boot must
> > + provide one in its payload or FIT image;
>
> There's 3 options actually. Either the HSS has one itself, there's one
> in the HSS payload or the software brings it - be that in a fit
> image or part of a U-Boot binary.
>
ditto
>
> > direct kernel boot must use
> > + ``-dtb`` as described above.
> >
> > .. _HSS: https://github.com/polarfire-soc/hart-software-services
> > --
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests
2026-09-30 9:20 ` Conor Dooley
@ 2026-10-03 15:53 ` Bin Meng
0 siblings, 0 replies; 48+ messages in thread
From: Bin Meng @ 2026-10-03 15:53 UTC (permalink / raw)
To: Conor Dooley
Cc: Bin Meng, QEMU, Chao Liu, Alistair Francis, Conor Dooley,
Daniel Henrique Barboza, Liu Zhiwei, Palmer Dabbelt,
Sebastian Huber, Weiwei Li, qemu-riscv
Hi Conor,
On Wed, Sep 30, 2026 at 5:23 PM Conor Dooley <conor.dooley@microchip.com> wrote:
>
> On Fri, Sep 04, 2026 at 11:57:35PM +0800, Bin Meng wrote:
> > Polling firmware requests system services without requesting an
> > interrupt. The old model ignored this distinction:
> >
> > 1. HSS requests the serial number with REQUEST set and NOTIFY clear.
> > 2. QEMU synchronously fills the mailbox and clears REQUEST.
> > 3. QEMU incorrectly asserts PLIC source 96.
> > 4. HSS polls REQUEST and neither waits for nor handles the interrupt.
> > 5. PLIC source 96 remains pending.
> > 6. Linux registers the MPFS mailbox driver.
> > 7. The stale interrupt immediately enters mpfs_mbox_inbox_isr().
> > 8. Linux has not submitted a request or installed its response pointer.
> > 9. The ISR dereferences that null pointer and faults near address 0x10.
>
> This makes sense, and should probably have a fixes tag pointing to my
> 2022 commit? Since I was direct kernel booting, I would never had
> noticed anything of this nature.
Agreed. I've split the NOTIFY fix into a separate patch, limited to
filtering completion interrupts.
>
> > Honor SERVICES_CR.NOTIFY, let IOSCB own the pending interrupt state,
> > and route the SYSREG acknowledgement through an IOSCB clear input.
> >
> > Signed-off-by: Bin Meng <bin.meng@processmission.com>
> > Reviewed-by: Chao Liu <chao.liu@processmission.com>
> > ---
> >
> > (no changes since v1)
> >
> > include/hw/misc/mchp_pfsoc_ioscb.h | 2 ++
> > hw/misc/mchp_pfsoc_ioscb.c | 39 +++++++++++++++++++++++++++---
> > hw/misc/mchp_pfsoc_sysreg.c | 9 ++++++-
> > hw/riscv/microchip_pfsoc.c | 6 ++---
> > 4 files changed, 49 insertions(+), 7 deletions(-)
> >
> > diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
> > index fd31427304..e39d995b64 100644
> > --- a/include/hw/misc/mchp_pfsoc_ioscb.h
> > +++ b/include/hw/misc/mchp_pfsoc_ioscb.h
> > @@ -26,6 +26,7 @@
> > #include "hw/core/sysbus.h"
> >
> > #define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
> > +#define MCHP_PFSOC_IOSCB_IRQ_CLEAR "irq-clear"
> >
> > typedef struct MchpPfSoCIoscbState {
> > SysBusDevice parent;
> > @@ -53,6 +54,7 @@ typedef struct MchpPfSoCIoscbState {
> > uint32_t services_sr;
> > uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
> > char *serial_number;
> > + bool irq_pending;
> > qemu_irq irq;
> > } MchpPfSoCIoscbState;
> >
> > diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
> > index 7c82b55986..ccc2201b7a 100644
> > --- a/hw/misc/mchp_pfsoc_ioscb.c
> > +++ b/hw/misc/mchp_pfsoc_ioscb.c
> > @@ -192,12 +192,13 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
> >
> > #define SERVICES_CR 0x50
> > #define SERVICES_CR_REQUEST BIT(0)
> > +#define SERVICES_CR_NOTIFY BIT(3)
> > #define SERVICES_CR_COMMAND_SHIFT 16
> > #define SERVICES_CR_COMMAND_WIDTH 8
> > #define SERVICES_CR_COMMAND_MASK \
> > MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
> > #define SERVICES_CR_MASK \
> > - (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
> > + (SERVICES_CR_REQUEST | SERVICES_CR_NOTIFY | SERVICES_CR_COMMAND_MASK)
> > #define SERVICES_SR 0x54
> > #define SERVICES_SR_STATUS_SHIFT 16
> > #define SERVICES_COMMAND_SERIAL_NUMBER 0
> > @@ -205,6 +206,21 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
> > #define SERVICES_STATUS_FAILED 1
> > #define SERVICES_MAILBOX_RESPONSE_OFFSET 0
> >
> > +static void mchp_pfsoc_ioscb_update_irq(MchpPfSoCIoscbState *s)
> > +{
> > + qemu_set_irq(s->irq, s->irq_pending);
> > +}
> > +
> > +static void mchp_pfsoc_ioscb_clear_irq(void *opaque, int n, int level)
> > +{
> > + MchpPfSoCIoscbState *s = opaque;
> > +
> > + if (level) {
> > + s->irq_pending = false;
> > + mchp_pfsoc_ioscb_update_irq(s);
> > + }
> > +}
> > +
> > static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> > {
> > uint32_t command;
> > @@ -236,7 +252,15 @@ static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> > }
> >
> > s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
> > - qemu_irq_raise(s->irq);
> > + /*
> > + * HSS and U-Boot submit polling requests with REQUEST set and NOTIFY
> > + * clear, then poll REQUEST/BUSY for completion. Linux sets both bits
> > + * and expects completion through PLIC source 96.
> > + */
> > + if (value & SERVICES_CR_NOTIFY) {
> > + s->irq_pending = true;
> > + mchp_pfsoc_ioscb_update_irq(s);
> > + }
> > }
> >
> > static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
> > @@ -325,7 +349,8 @@ static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
> > s->services_cr = 0;
> > s->services_sr = 0;
> > memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
> > - qemu_irq_lower(s->irq);
> > + s->irq_pending = false;
> > + mchp_pfsoc_ioscb_update_irq(s);
> > }
> >
> > static const Property mchp_pfsoc_ioscb_properties[] = {
> > @@ -333,6 +358,13 @@ static const Property mchp_pfsoc_ioscb_properties[] = {
> > MchpPfSoCIoscbState, serial_number),
> > };
> >
> > +static void mchp_pfsoc_ioscb_init(Object *obj)
> > +{
> > + /* Accept service interrupt acknowledgements from SYSREG MESSAGE_INT */
> > + qdev_init_gpio_in_named(DEVICE(obj), mchp_pfsoc_ioscb_clear_irq,
> > + MCHP_PFSOC_IOSCB_IRQ_CLEAR, 1);
> > +}
> > +
> > static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> > {
> > MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> > @@ -456,6 +488,7 @@ static const TypeInfo mchp_pfsoc_ioscb_info = {
> > .name = TYPE_MCHP_PFSOC_IOSCB,
> > .parent = TYPE_SYS_BUS_DEVICE,
> > .instance_size = sizeof(MchpPfSoCIoscbState),
> > + .instance_init = mchp_pfsoc_ioscb_init,
> > .class_init = mchp_pfsoc_ioscb_class_init,
> > };
> >
> > diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
> > index 1d9154280a..899b485da6 100644
> > --- a/hw/misc/mchp_pfsoc_sysreg.c
> > +++ b/hw/misc/mchp_pfsoc_sysreg.c
> > @@ -77,7 +77,14 @@ static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
> > }
> > break;
> > case MESSAGE_INT:
> > - qemu_irq_lower(s->irq);
> > + /*
> > + * A MESSAGE_INT write is an acknowledgement event, not a level that
> > + * remains asserted. Model it as an active-high pulse. The rising edge
>
> I found this comment to be really confusing. Why would someone expect
> that a write-zero-clear bit is an asserted level? Mentioning modelling
> it as a pulse further makes it seem like software writing will generate an
> interrupt, which it doesn't - it writes here to clear the interrupt. I
> think this needs to be very clear that modelling this as an interrupt at
> all is just being done for QEMU's sake.
>
> I think this needs to be split in two, with the fix for the problem
> (which I think is limited to only raising the interrupt) kept apart from
> this change. Part of that is because I don't actually understand the
> reason for adding this "fake" interrupt and the commit message is
> currently focused around the bug and doesn't actually provide
> justification for it. Maybe it's obvious to people more familiar with
> Qemu than I, but this complication makes no sense to me!
I used another way to implement this in v3. I dropped the
acknowledgement pulse and irq-clear GPIO. SYSREG now links to IOSCB
and calls its pending-bit getter/setter. IOSCB owns the pending state
and the PLIC output, so a write of zero directly clears the state and
lowers the real interrupt input. There is no extra interrupt for the
acknowledgement.
>
> > + * invokes IOSCB's irq-clear input with level 1, which clears
> > + * irq_pending and lowers PLIC source 96. The falling edge invokes the
> > + * input with level 0 and is ignored.
> > + */
> > + qemu_irq_pulse(s->irq);
> > break;
> > default:
> > qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
> > diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> > index fb0e18edba..87c9c89cb0 100644
> > --- a/hw/riscv/microchip_pfsoc.c
> > +++ b/hw/riscv/microchip_pfsoc.c
> > @@ -336,9 +336,6 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> > sysbus_realize(SYS_BUS_DEVICE(&s->sysreg), errp);
> > sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
> > memmap[MICROCHIP_PFSOC_SYSREG].base);
> > - sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
> > - qdev_get_gpio_in(DEVICE(s->plic),
> > - MICROCHIP_PFSOC_MAILBOX_IRQ));
> >
> > /* AXISW */
> > create_unimplemented_device("microchip.pfsoc.axisw",
> > @@ -492,6 +489,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> > sysbus_connect_irq(SYS_BUS_DEVICE(&s->ioscb), 0,
> > qdev_get_gpio_in(DEVICE(s->plic),
> > MICROCHIP_PFSOC_MAILBOX_IRQ));
> > + sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
> > + qdev_get_gpio_in_named(DEVICE(&s->ioscb),
> > + MCHP_PFSOC_IOSCB_IRQ_CLEAR, 0));
> >
> > /* FPGA Fabric */
> > create_unimplemented_device("microchip.pfsoc.fabricfic3",
> > --
Regards,
Bin
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot
2026-10-03 15:16 ` Bin Meng
@ 2026-10-04 0:32 ` Conor Dooley
0 siblings, 0 replies; 48+ messages in thread
From: Conor Dooley @ 2026-10-04 0:32 UTC (permalink / raw)
To: Bin Meng
Cc: Conor Dooley, Bin Meng, QEMU, Pierrick Bouvier, Sebastian Huber,
qemu-riscv
[-- Attachment #1: Type: text/plain, Size: 1174 bytes --]
On Sat, Oct 03, 2026 at 11:16:27PM +0800, Bin Meng wrote:
> > > +Configure HSS for the ``mpfs-icicle-kit-es`` board using its default
> > > +configuration. QEMU provides the software-visible registers and deterministic
> > > +status consumed by the HSS v2024.06 DDR initialization and training flow;
> > > +it does not model the electrical properties of DDR training. HSS requires
> > > +the RISC-V bare-metal toolchain supplied by Microchip SoftConsole to be
> > > +available in ``PATH``. Build the tested HSS version with:
> >
> > What's the reason that this is using 2024.06 by the way? Why not use the
> > most recent release of the HSS?
>
> This is because the Buildroot v2026.05 release's defconfig for Icicle
> Kit board refers to v2024.06 version of
> 'microchip-hss-payload-generator' which is a tool from HSS, so I chose
> to use the same HSS source version to build the HSS to match the tools
> version.
If that's the rationale, I think this should be moved to using hte most
recent HSS release. The payload generator version is lagging because
there's not been any changes to the format of the input or output file
in the last two years.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 48+ messages in thread
* Re: [PATCH v2 07/24] hw/sd: sdhci: Run ADMA independently of MMIO
2026-09-04 15:57 ` [PATCH v2 07/24] hw/sd: sdhci: Run ADMA independently of MMIO Bin Meng
@ 2026-10-04 11:14 ` Bernhard Beschow
0 siblings, 0 replies; 48+ messages in thread
From: Bernhard Beschow @ 2026-10-04 11:14 UTC (permalink / raw)
To: qemu-devel, Bin Meng, QEMU
Cc: Bin Meng, Philippe Mathieu-Daudé, qemu-block
Am 4. September 2026 15:57:26 UTC schrieb Bin Meng <bin.meng@processmission.com>:
>The SDHCI model processes the first ADMA descriptor batch inside the
>command MMIO write, then resumes pending batches before every later
>SDHCI MMIO read or write. This makes register access perform bulk DMA
>work and can delay a status read even when completion bits are set.
>
>On the Icicle Kit, U-Boot uses ADMA2-64 and CMD18 to load a roughly
>19 MiB FIT image from SD. It can report:
>
> Timeout for status update: 00000001 00000001
> Timeout for status update: 00000003 00000001
>
>The status already contains the requested Command Complete bit, and may
>also contain Transfer Complete. However, reading the interrupt status
>first executes a pending ADMA batch. The MMIO read can therefore return
>after U-Boot has reached its one-second polling deadline.
>
>Turn the existing transfer timer into an ADMA-only engine. Starting an
>ADMA command arms the engine directly, and each timer callback runs one
>bounded batch before yielding. MMIO reads and writes no longer perform
>or schedule ADMA work. Keep PIO and SDMA synchronous.
>
>Cancel the engine and clear ADMA activity and error state on DATA or ALL
>reset.
>
>Signed-off-by: Bin Meng <bin.meng@processmission.com>
>---
>
>(no changes since v1)
>
> hw/sd/sdhci.c | 143 ++++++++++++++++++++++++++++++--------------------
> 1 file changed, 87 insertions(+), 56 deletions(-)
>
>diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
>index bd74c60f72..14c312a691 100644
>--- a/hw/sd/sdhci.c
>+++ b/hw/sd/sdhci.c
>@@ -277,6 +277,7 @@ static void sdhci_set_inserted(DeviceState *dev, bool level)
> }
> } else {
> s->prnsts = 0x1fa0000;
>+ timer_del(s->transfer_timer);
> s->pwrcon &= ~SDHC_POWER_ON;
> s->clkcon &= ~SDHC_CLOCK_SDCLK_EN;
> if (s->norintstsen & SDHC_NISEN_REMOVE) {
>@@ -348,7 +349,34 @@ static void sdhci_poweron_reset(DeviceState *dev)
> }
> }
>
>-static void sdhci_data_transfer(void *opaque);
>+static void sdhci_data_transfer(SDHCIState *s);
>+static void sdhci_adma_engine(void *opaque);
The second forward declaration isn't needed.
>+
>+static void sdhci_set_transfer_active(SDHCIState *s)
>+{
>+ s->prnsts |= SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE;
>+ if (s->trnmod & SDHC_TRNS_READ) {
>+ s->prnsts |= SDHC_DOING_READ;
>+ } else {
>+ s->prnsts |= SDHC_DOING_WRITE;
>+ }
>+}
>+
>+static void sdhci_schedule_adma(SDHCIState *s)
>+{
>+ timer_mod(s->transfer_timer,
>+ qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_TRANSFER_DELAY);
>+}
>+
>+static bool sdhci_adma_transfer_active(SDHCIState *s)
>+{
>+ return TRANSFERRING_DATA(s->prnsts) &&
>+ (s->trnmod & SDHC_TRNS_DMA) &&
>+ (s->cmdreg & SDHC_CMD_DATA_PRESENT) &&
>+ sdhci_get_dma_type(s) != SDHC_CTRL_SDMA &&
>+ !(s->admaerr & SDHC_ADMAERR_STATE_MASK) &&
>+ !(s->errintsts & SDHC_EIS_ADMAERR);
>+}
I'd implement the new functions just before the first forward declaration above. This preserves the position of the forward declaration to stay just in front of the code where it is first used.
N.B.: Ideally, no forward declarations were needed and the functions were implemented in topological order.
>
> #define BLOCK_SIZE_MASK (4 * KiB - 1)
>
>@@ -405,7 +433,13 @@ static void sdhci_send_command(SDHCIState *s)
> if (!timeout && (s->blksize & BLOCK_SIZE_MASK) &&
> (s->cmdreg & SDHC_CMD_DATA_PRESENT)) {
> s->data_count = 0;
>- sdhci_data_transfer(s);
>+ if ((s->trnmod & SDHC_TRNS_DMA) &&
>+ sdhci_get_dma_type(s) != SDHC_CTRL_SDMA) {
>+ sdhci_set_transfer_active(s);
>+ sdhci_schedule_adma(s);
>+ } else {
>+ sdhci_data_transfer(s);
>+ }
> }
> }
>
>@@ -850,7 +884,7 @@ static void get_adma_description(SDHCIState *s, ADMADescr *dscr)
>
> /* Advanced DMA data transfer */
>
>-static void sdhci_do_adma(SDHCIState *s)
>+static void sdhci_adma_run_batch(SDHCIState *s)
> {
> unsigned int begin, length;
> const uint16_t block_size = s->blksize & BLOCK_SIZE_MASK;
>@@ -956,15 +990,17 @@ static void sdhci_do_adma(SDHCIState *s)
> }
> if (res != MEMTX_OK) {
> s->data_count = 0;
>+ s->admaerr &= ~SDHC_ADMAERR_STATE_MASK;
>+ s->admaerr |= SDHC_ADMAERR_STATE_ST_TFR;
> if (s->errintstsen & SDHC_EISEN_ADMAERR) {
> trace_sdhci_error("Set ADMA error flag");
> s->errintsts |= SDHC_EIS_ADMAERR;
> s->norintsts |= SDHC_NIS_ERR;
> }
> sdhci_update_irq(s);
>- } else {
>- s->admasysaddr += dscr.incr;
>+ return;
> }
>+ s->admasysaddr += dscr.incr;
> break;
> case SDHC_ADMA_ATTR_ACT_LINK: /* link to next descriptor table */
> s->admasysaddr = dscr.addr;
>@@ -1012,50 +1048,52 @@ static void sdhci_do_adma(SDHCIState *s)
> }
>
> /* we have unfinished business - reschedule to continue ADMA */
>- timer_mod(s->transfer_timer,
>- qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + SDHC_TRANSFER_DELAY);
>+ sdhci_schedule_adma(s);
> }
>
>-/* Perform data transfer according to controller configuration */
>-
>-static void sdhci_data_transfer(void *opaque)
>+/* Run one independently scheduled, quota-bounded ADMA batch */
>+static void sdhci_adma_engine(void *opaque)
> {
> SDHCIState *s = (SDHCIState *)opaque;
>
>- if (s->trnmod & SDHC_TRNS_DMA) {
>- switch (sdhci_get_dma_type(s)) {
>- case SDHC_CTRL_SDMA:
>- sdhci_sdma_transfer(s);
>- break;
>- case SDHC_CTRL_ADMA1_32:
>- if (!(s->capareg & R_SDHC_CAPAB_ADMA1_MASK)) {
>- trace_sdhci_error("ADMA1 not supported");
>- break;
>- }
>+ if (!sdhci_adma_transfer_active(s)) {
>+ return;
>+ }
>
>- sdhci_do_adma(s);
>- break;
>- case SDHC_CTRL_ADMA2_32:
>- if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK)) {
>- trace_sdhci_error("ADMA2 not supported");
>- break;
>- }
>+ switch (sdhci_get_dma_type(s)) {
>+ case SDHC_CTRL_ADMA1_32:
>+ if (!(s->capareg & R_SDHC_CAPAB_ADMA1_MASK)) {
>+ trace_sdhci_error("ADMA1 not supported");
>+ return;
>+ }
>+ break;
>+ case SDHC_CTRL_ADMA2_32:
>+ if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK)) {
>+ trace_sdhci_error("ADMA2 not supported");
>+ return;
>+ }
>+ break;
>+ case SDHC_CTRL_ADMA2_64:
>+ if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK) ||
>+ !(s->capareg & R_SDHC_CAPAB_BUS64BIT_MASK)) {
>+ trace_sdhci_error("64 bit ADMA not supported");
>+ return;
>+ }
>+ break;
>+ default:
>+ trace_sdhci_error("Unsupported ADMA type");
>+ return;
>+ }
>
>- sdhci_do_adma(s);
>- break;
>- case SDHC_CTRL_ADMA2_64:
>- if (!(s->capareg & R_SDHC_CAPAB_ADMA2_MASK) ||
>- !(s->capareg & R_SDHC_CAPAB_BUS64BIT_MASK)) {
>- trace_sdhci_error("64 bit ADMA not supported");
>- break;
>- }
>+ sdhci_adma_run_batch(s);
This is the only place where sdhci_adma_run_batch() is called, so sdhci_adma_engine() could be merged into sdhci_adma_run_batch(). That way, the logic stays together and we don't have to come up with a better name for `sdhci_adma_engine` which somehow misses a verb.
Best regards,
Bernhard
>+}
>
>- sdhci_do_adma(s);
>- break;
>- default:
>- trace_sdhci_error("Unsupported DMA type");
>- break;
>- }
>+/* Perform synchronous PIO or SDMA data transfer */
>+static void sdhci_data_transfer(SDHCIState *s)
>+{
>+ if (s->trnmod & SDHC_TRNS_DMA) {
>+ assert(sdhci_get_dma_type(s) == SDHC_CTRL_SDMA);
>+ sdhci_sdma_transfer(s);
> } else {
> if ((s->trnmod & SDHC_TRNS_READ) && sdbus_data_ready(&s->sdbus)) {
> s->prnsts |= SDHC_DOING_READ | SDHC_DATA_INHIBIT |
>@@ -1098,21 +1136,11 @@ sdhci_buff_access_is_sequential(SDHCIState *s, unsigned byte_num)
> return true;
> }
>
>-static void sdhci_resume_pending_transfer(SDHCIState *s)
>-{
>- timer_del(s->transfer_timer);
>- sdhci_data_transfer(s);
>-}
>-
> static uint64_t sdhci_read(void *opaque, hwaddr offset, unsigned size)
> {
> SDHCIState *s = (SDHCIState *)opaque;
> uint32_t ret = 0;
>
>- if (timer_pending(s->transfer_timer)) {
>- sdhci_resume_pending_transfer(s);
>- }
>-
> switch (offset & ~0x3) {
> case SDHC_SYSAD:
> ret = s->sdmasysad;
>@@ -1235,7 +1263,10 @@ static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)
> s->norintsts &= ~SDHC_NIS_CMDCMP;
> break;
> case SDHC_RESET_DATA:
>+ timer_del(s->transfer_timer);
> s->data_count = 0;
>+ s->admaerr = 0;
>+ s->errintsts &= ~SDHC_EIS_ADMAERR;
> s->prnsts &= ~(SDHC_SPACE_AVAILABLE | SDHC_DATA_AVAILABLE |
> SDHC_DOING_READ | SDHC_DOING_WRITE |
> SDHC_DATA_INHIBIT | SDHC_DAT_LINE_ACTIVE);
>@@ -1244,6 +1275,10 @@ static inline void sdhci_reset_write(SDHCIState *s, uint8_t value)
> s->sdma_boundary_paused = false;
> s->norintsts &= ~(SDHC_NIS_WBUFRDY | SDHC_NIS_RBUFRDY |
> SDHC_NIS_DMA | SDHC_NIS_TRSCMP | SDHC_NIS_BLKGAP);
>+ if (!s->errintsts) {
>+ s->norintsts &= ~SDHC_NIS_ERR;
>+ }
>+ sdhci_update_irq(s);
> break;
> }
> }
>@@ -1257,10 +1292,6 @@ sdhci_write(void *opaque, hwaddr offset, uint64_t val, unsigned size)
> uint32_t value = val;
> value <<= shift;
>
>- if (timer_pending(s->transfer_timer)) {
>- sdhci_resume_pending_transfer(s);
>- }
>-
> switch (offset & ~0x3) {
> case SDHC_SYSAD:
> if (!TRANSFERRING_DATA(s->prnsts) ||
>@@ -1521,7 +1552,7 @@ void sdhci_initfn(SDHCIState *s)
> s->insert_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
> sdhci_raise_insertion_irq, s);
> s->transfer_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
>- sdhci_data_transfer, s);
>+ sdhci_adma_engine, s);
>
> s->io_ops = &sdhci_mmio_ops;
> }
^ permalink raw reply [flat|nested] 48+ messages in thread
end of thread, other threads:[~2026-10-04 11:15 UTC | newest]
Thread overview: 48+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-04 15:57 [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
2026-09-04 15:57 ` [PATCH v2 01/24] hw/riscv: pfsoc: Correct the L2LIM maximum mapped size Bin Meng
2026-09-04 15:57 ` [PATCH v2 02/24] hw/riscv: pfsoc: Map the L2 zero device window Bin Meng
2026-09-04 15:57 ` [PATCH v2 03/24] hw/misc: pfsoc: Support DDR training with newer HSS Bin Meng
2026-09-04 15:57 ` [PATCH v2 04/24] hw/misc: pfsoc: Model L2 cache controller registers Bin Meng
2026-09-30 9:38 ` Philippe Mathieu-Daudé
2026-09-04 15:57 ` [PATCH v2 05/24] hw/riscv: pfsoc: Couple L2CC to L2-LIM Bin Meng
2026-09-30 9:38 ` Philippe Mathieu-Daudé
2026-10-03 15:10 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 06/24] tests/qtest: Add PolarFire SoC L2CC coverage Bin Meng
2026-09-04 15:57 ` [PATCH v2 07/24] hw/sd: sdhci: Run ADMA independently of MMIO Bin Meng
2026-10-04 11:14 ` Bernhard Beschow
2026-09-04 15:57 ` [PATCH v2 08/24] tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer Bin Meng
2026-09-04 15:57 ` [PATCH v2 09/24] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes Bin Meng
2026-09-30 9:25 ` Philippe Mathieu-Daudé
2026-09-04 15:57 ` [PATCH v2 10/24] hw/sd: cadence: Add 64-bit system bus property Bin Meng
2026-09-04 15:57 ` [PATCH v2 11/24] hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support Bin Meng
2026-09-04 15:57 ` [PATCH v2 12/24] hw/misc: pfsoc: Model PolarFire SoC serial number service Bin Meng
2026-09-30 8:34 ` Conor Dooley
2026-10-03 15:10 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 13/24] hw/rtc: Add PolarFire SoC RTC model Bin Meng
2026-09-04 15:57 ` [PATCH v2 14/24] hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit Bin Meng
2026-09-04 15:57 ` [PATCH v2 15/24] tests/qtest: Add PolarFire SoC RTC coverage Bin Meng
2026-09-04 15:57 ` [PATCH v2 16/24] hw/misc: pfsoc: Honor PolarFire service notification requests Bin Meng
2026-09-30 9:20 ` Conor Dooley
2026-10-03 15:53 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 17/24] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases Bin Meng
2026-09-30 9:28 ` Conor Dooley
2026-10-03 15:10 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 18/24] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB Bin Meng
2026-09-30 9:29 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 19/24] hw/riscv: pfsoc: Fix Icicle Kit hart count at five Bin Meng
2026-09-30 9:33 ` Conor Dooley
2026-10-03 15:10 ` Bin Meng
2026-09-04 15:57 ` [PATCH v2 20/24] docs/system/riscv: Document Icicle Kit HSS boot Bin Meng
2026-09-30 9:43 ` Conor Dooley
2026-10-03 15:20 ` Bin Meng
2026-09-30 10:15 ` Conor Dooley
2026-10-03 15:16 ` Bin Meng
2026-10-04 0:32 ` Conor Dooley
2026-09-04 15:57 ` [PATCH v2 21/24] docs/system/riscv: pfsoc: Document CLINT topology for direct Linux boot Bin Meng
2026-09-04 15:57 ` [PATCH v2 22/24] tests/functional/riscv64: Add Icicle Kit firmware boot test Bin Meng
2026-09-04 15:57 ` [PATCH v2 23/24] MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer Bin Meng
2026-09-04 15:57 ` [PATCH v2 24/24] MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer Bin Meng
2026-09-30 9:51 ` Conor Dooley
2026-09-04 16:11 ` [PATCH v2 00/24] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Philippe Mathieu-Daudé
2026-09-07 13:29 ` Conor Dooley
2026-09-26 3:14 ` Bin Meng
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.