[PATCH v4 00/27] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot

[Bin Meng <bin.meng@processmission.com>]

The microchip-icicle-kit machine was originally validated with an older
Hart Software Services (HSS) firmware stack. HSS v2026.04.1 cannot boot
through U-Boot to Linux because several firmware-visible parts of the
PolarFire SoC are missing or incomplete.

The first failure occurs before the UART is initialized because the L2
zero window is not mapped. HSS then needs additional L2 cache controller
and DDR training behavior. Later boot stages exercise system services,
the RTC, SDHC version 4 DMA, and high-capacity SD card block sizing,
along with the complete DDR aliases. The existing models ither reject
these accesses or expose behavior that does not match the hardware
specifications.

This series restores the complete firmware boot flow. With these
changes, QEMU boots the HSS v2026.04.1 eNVM image, loads its U-Boot
payload from an SD card, and reaches the Buildroot 2026.05 Linux
login prompt.

The changes are organized around the firmware boot sequence:

* Correct the L2-LIM size, map the L2 zero window, and provide the DMC
  status transitions required by HSS DDR initialization.
* Model the documented L2CC Config, WayEnable, and WayMask registers,
  and resize L2-LIM as cache ways are enabled.
* Complete SDHCI version 4 support used by the Cadence controller,
  including Host Control 2, SDMA system addressing, 64-bit ADMA2
  descriptors, and SDMA boundary continuation.
* Run ADMA from a bounded timer-driven engine instead of performing work
  from command or unrelated MMIO accesses.  This keeps DMA progress
  independent of guest register traffic and avoids consuming a polling
  deadline inside the command write.
* Keep SDHC and SDXC memory transfers at their fixed 512-byte block
  size, and advertise the Cadence controller's 64-bit system bus
  support.
* Add the PolarFire SoC serial-number system service and RTC, and honor
  the system-service notification control bit.
* Correct the DDR aliases and fix the board topology at its physical
  configuration of 2 GiB of RAM and five harts.
* Document direct and HSS boot, add focused qtests and a full firmware
  functional test, and restore the machine's Supported maintainer
  status.

Testing performed:

* Built qemu-system-riscv64 and the documentation.
* Passed various newly added qtests.
* Booted HSS v2026.04.1, U-Boot, and Buildroot 2026.05 Linux to
  the login prompt using the functional-test image.

The functional test uses the processmission/qemu-machine-images release
v1.1.1 tarball:

https://github.com/processmission/qemu-machine-images/releases/download/
v1.1.1/riscv64-microchip-icicle-kit-v1.1.1.tar.zst

When restoring the HSS boot support, 3 potential bugs were identified in
the upstream HSS source codes that either blocks the DDR training from
succeed or traps in a multi-core race at the very beginning or after
a succesfully DDR training but stuck at OpenSBI/U-Boot hand-off. There
are already bug reports filed aginst various upstream projects.

Changes in v4:
- Drop the unused ADMA callback forward declaration
- Move helper definitions before the data-transfer declaration
- Merge the ADMA timer callback and batch routine
- Use HSS v2026.04.1 and the v1.1.1 test-image recipe
- Select the SoftConsole toolchain explicitly
- Use the generated complete boot-mode-1 eNVM binary
- Use the v1.1.1 test images with HSS v2026.04.1
- Add the execution bit to the python script
- Collect Conor Dooley's Tested-by for the complete series
- Collect Bernhard Beschow's Tested-by for the ADMA patch

Changes in v3:
- Name the QOM parent field parent_obj
- Move the LIM and Zero windows into L2CC
- Use the shared SiFive name and indexed WayMask registers
- Parameterize master count and the RAM-backed Zero aperture
- Resize a LIM alias while keeping its SRAM backing fixed
- Configure and instantiate the shared SiFive L2CC
- Map the register, LIM, and Zero windows exposed by the controller
- Remove the external RAM allocations and l2-lim link
- Keep the PolarFire master count and modeled Zero aperture unchanged
- hw/riscv: sifive_u: Correct the L2LIM maximum mapped size
- hw/riscv: sifive_u: Use the shared SiFive L2 cache controller
- Rename the test for the shared SiFive L2CC model
- Exercise 15 masters on PolarFire and 21 masters on FU540
- Decode the seven-bit opcode and nine-bit mailbox word offset
- Bound serial-number responses to the documented 2 KiB mailbox
- Mirror the current control flags in the status register
- Use default access sizing for the control and mailbox windows
- Split the NOTIFY fix from interrupt acknowledgement wiring
- Separate interrupt state ownership from the NOTIFY fix
- Link SYSREG to IOSCB for MESSAGE_INT reads and writes
- Support both clearing and setting the MESSAGE_INT pending bit
- Update commit message to mention the DDR aliases is modeled following
  the Icicle Kit reference design
- Change only the default hart count and retain the minimum of two
- Document reduced topologies and matching firmware requirements
- Include the DDR pattern-test patch used by the functional-test image
- Document the image-only FPGA programming tool check
- Describe startup-race symptoms and link the firmware investigations
- Explain how reduced hart topologies change the CLINT DTB tuples

Changes in v2:
- Use the Resettable API instead of a legacy reset handler
- tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer
- Assert bounded ADMA pacing and MMIO-independent progress
- Reuse existing SDHCI definitions and command helpers
- Verify transferred data against a known image pattern
- Make 64-bit system bus support a device property
- hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
- Reset the RTC to the documented hardware values
- Expect the documented hardware state after RTC reset
- MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer

Bin Meng (26):
  hw/riscv: pfsoc: Correct the L2LIM maximum mapped size
  hw/riscv: pfsoc: Map the L2 zero device window
  hw/misc: pfsoc: Support DDR training with newer HSS
  hw/misc: Add SiFive L2 cache controller model
  hw/riscv: pfsoc: Map the SiFive L2CC memory windows
  hw/riscv: sifive_u: Correct the L2LIM maximum mapped size
  hw/riscv: sifive_u: Use the shared SiFive L2 cache controller
  tests/qtest: Add SiFive L2 cache controller coverage
  hw/sd: sdhci: Run ADMA independently of MMIO
  hw/sd: sd: Keep high-capacity memory blocks at 512 bytes
  hw/sd: cadence: Add 64-bit system bus property
  hw/riscv: pfsoc: Enable 64-bit SDHCI system bus support
  hw/rtc: Add PolarFire SoC RTC model
  hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit
  tests/qtest: Add PolarFire SoC RTC coverage
  hw/misc: pfsoc: Model PolarFire SoC serial number service
  hw/misc: pfsoc: Honor service notification requests
  hw/misc: pfsoc: Let IOSCB own service interrupt state
  hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases
  hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB
  hw/riscv: pfsoc: Default Icicle Kit to five harts
  docs/system/riscv: Document Icicle Kit HSS boot
  docs/system/riscv: pfsoc: Document CLINT topology for direct Linux
    boot
  tests/functional/riscv64: Add Icicle Kit firmware boot test
  MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer
  MAINTAINERS: Move Conor Dooley to PolarFire SoC reviewer

Wadim Mueller (1):
  tests/qtest: add Cadence SDHCI ADMA pacing/MMIO reproducer

 MAINTAINERS                                   |  11 +-
 docs/system/riscv/microchip-icicle-kit.rst    | 162 +++++-
 docs/system/riscv/sifive_u.rst                |   2 +-
 include/hw/misc/mchp_pfsoc_dmc.h              |   6 +
 include/hw/misc/mchp_pfsoc_ioscb.h            |  10 +
 include/hw/misc/mchp_pfsoc_sysreg.h           |   3 +-
 include/hw/misc/sifive_l2cc.h                 |  42 ++
 include/hw/riscv/microchip_pfsoc.h            |   7 +
 include/hw/riscv/sifive_u.h                   |   3 +
 include/hw/rtc/mchp_pfsoc_rtc.h               |  46 ++
 include/hw/sd/cadence_sdhci.h                 |   1 +
 hw/misc/mchp_pfsoc_dmc.c                      | 273 +++++++++-
 hw/misc/mchp_pfsoc_ioscb.c                    | 174 ++++++-
 hw/misc/mchp_pfsoc_sysreg.c                   |  37 +-
 hw/misc/sifive_l2cc.c                         | 282 +++++++++++
 hw/riscv/microchip_pfsoc.c                    |  91 ++--
 hw/riscv/sifive_u.c                           |  32 +-
 hw/rtc/mchp_pfsoc_rtc.c                       | 477 ++++++++++++++++++
 hw/sd/cadence_sdhci.c                         |  11 +
 hw/sd/sd.c                                    |  43 +-
 hw/sd/sdhci.c                                 | 146 +++---
 tests/qtest/cadence-sdhci-test.c              | 282 +++++++++++
 tests/qtest/mchp_pfsoc_rtc_test.c             | 315 ++++++++++++
 tests/qtest/sifive_l2cc_test.c                | 306 +++++++++++
 hw/misc/Kconfig                               |   3 +
 hw/misc/meson.build                           |   1 +
 hw/riscv/Kconfig                              |   3 +
 hw/rtc/Kconfig                                |   3 +
 hw/rtc/meson.build                            |   1 +
 tests/functional/riscv64/meson.build          |   2 +
 .../riscv64/test_microchip_icicle_kit.py      |  56 ++
 tests/qtest/meson.build                       |   8 +
 32 files changed, 2639 insertions(+), 200 deletions(-)
 create mode 100644 include/hw/misc/sifive_l2cc.h
 create mode 100644 include/hw/rtc/mchp_pfsoc_rtc.h
 create mode 100644 hw/misc/sifive_l2cc.c
 create mode 100644 hw/rtc/mchp_pfsoc_rtc.c
 create mode 100644 tests/qtest/cadence-sdhci-test.c
 create mode 100644 tests/qtest/mchp_pfsoc_rtc_test.c
 create mode 100644 tests/qtest/sifive_l2cc_test.c
 create mode 100755 tests/functional/riscv64/test_microchip_icicle_kit.py

---
base-commit: a1c27ca02bcfeea7deb6d4634c70d5b3b421a76d
branch: icicle-kit

-- 
2.53.0