From: Chao Liu <chao.liu@processmission.com>
To: Bin Meng <bin.meng@processmission.com>
Cc: QEMU <qemu-devel@nongnu.org>,
Alistair Francis <alistair.francis@wdc.com>,
Conor Dooley <conor@kernel.org>,
Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>,
Liu Zhiwei <zhiwei_liu@linux.alibaba.com>,
Palmer Dabbelt <palmer@dabbelt.com>,
Sebastian Huber <sebastian.huber@embedded-brains.de>,
Weiwei Li <liwei1518@gmail.com>,
qemu-riscv@nongnu.org
Subject: Re: [PATCH 19/26] hw/misc: pfsoc: Honor PolarFire service notification requests
Date: Mon, 27 Jul 2026 13:32:05 +0800 [thread overview]
Message-ID: <ambtS-BDWLw2g3Wt@ChaodeMacBook-Pro.local> (raw)
In-Reply-To: <20260723151853.2143177-20-bin.meng@processmission.com>
On Thu, Jul 23, 2026 at 11:18:46PM +0800, Bin Meng wrote:
> Polling firmware requests system services without requesting an
> interrupt. The old model ignored this distinction:
>
> 1. HSS requests the serial number with REQUEST set and NOTIFY clear.
> 2. QEMU synchronously fills the mailbox and clears REQUEST.
> 3. QEMU incorrectly asserts PLIC source 96.
> 4. HSS polls REQUEST and neither waits for nor handles the interrupt.
> 5. PLIC source 96 remains pending.
> 6. Linux registers the MPFS mailbox driver.
> 7. The stale interrupt immediately enters mpfs_mbox_inbox_isr().
> 8. Linux has not submitted a request or installed its response pointer.
> 9. The ISR dereferences that null pointer and faults near address 0x10.
>
> Honor SERVICES_CR.NOTIFY, let IOSCB own the pending interrupt state,
> and route the SYSREG acknowledgement through an IOSCB clear input.
>
> Signed-off-by: Bin Meng <bin.meng@processmission.com>
Reviewed-by: Chao Liu <chao.liu@processmission.com>
Thanks,
Chao
> ---
>
> include/hw/misc/mchp_pfsoc_ioscb.h | 2 ++
> hw/misc/mchp_pfsoc_ioscb.c | 39 +++++++++++++++++++++++++++---
> hw/misc/mchp_pfsoc_sysreg.c | 9 ++++++-
> hw/riscv/microchip_pfsoc.c | 6 ++---
> 4 files changed, 49 insertions(+), 7 deletions(-)
>
> diff --git a/include/hw/misc/mchp_pfsoc_ioscb.h b/include/hw/misc/mchp_pfsoc_ioscb.h
> index fd31427304..e39d995b64 100644
> --- a/include/hw/misc/mchp_pfsoc_ioscb.h
> +++ b/include/hw/misc/mchp_pfsoc_ioscb.h
> @@ -26,6 +26,7 @@
> #include "hw/core/sysbus.h"
>
> #define MCHP_PFSOC_IOSCB_MAILBOX_SIZE 0x1000
> +#define MCHP_PFSOC_IOSCB_IRQ_CLEAR "irq-clear"
>
> typedef struct MchpPfSoCIoscbState {
> SysBusDevice parent;
> @@ -53,6 +54,7 @@ typedef struct MchpPfSoCIoscbState {
> uint32_t services_sr;
> uint8_t mailbox_data[MCHP_PFSOC_IOSCB_MAILBOX_SIZE];
> char *serial_number;
> + bool irq_pending;
> qemu_irq irq;
> } MchpPfSoCIoscbState;
>
> diff --git a/hw/misc/mchp_pfsoc_ioscb.c b/hw/misc/mchp_pfsoc_ioscb.c
> index 7c82b55986..ccc2201b7a 100644
> --- a/hw/misc/mchp_pfsoc_ioscb.c
> +++ b/hw/misc/mchp_pfsoc_ioscb.c
> @@ -192,12 +192,13 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
>
> #define SERVICES_CR 0x50
> #define SERVICES_CR_REQUEST BIT(0)
> +#define SERVICES_CR_NOTIFY BIT(3)
> #define SERVICES_CR_COMMAND_SHIFT 16
> #define SERVICES_CR_COMMAND_WIDTH 8
> #define SERVICES_CR_COMMAND_MASK \
> MAKE_64BIT_MASK(SERVICES_CR_COMMAND_SHIFT, SERVICES_CR_COMMAND_WIDTH)
> #define SERVICES_CR_MASK \
> - (SERVICES_CR_REQUEST | SERVICES_CR_COMMAND_MASK)
> + (SERVICES_CR_REQUEST | SERVICES_CR_NOTIFY | SERVICES_CR_COMMAND_MASK)
> #define SERVICES_SR 0x54
> #define SERVICES_SR_STATUS_SHIFT 16
> #define SERVICES_COMMAND_SERIAL_NUMBER 0
> @@ -205,6 +206,21 @@ static const MemoryRegionOps mchp_pfsoc_io_calib_ddr_ops = {
> #define SERVICES_STATUS_FAILED 1
> #define SERVICES_MAILBOX_RESPONSE_OFFSET 0
>
> +static void mchp_pfsoc_ioscb_update_irq(MchpPfSoCIoscbState *s)
> +{
> + qemu_set_irq(s->irq, s->irq_pending);
> +}
> +
> +static void mchp_pfsoc_ioscb_clear_irq(void *opaque, int n, int level)
> +{
> + MchpPfSoCIoscbState *s = opaque;
> +
> + if (level) {
> + s->irq_pending = false;
> + mchp_pfsoc_ioscb_update_irq(s);
> + }
> +}
> +
> static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> {
> uint32_t command;
> @@ -236,7 +252,15 @@ static void services_cr_write(MchpPfSoCIoscbState *s, uint32_t value)
> }
>
> s->services_sr = status << SERVICES_SR_STATUS_SHIFT;
> - qemu_irq_raise(s->irq);
> + /*
> + * HSS and U-Boot submit polling requests with REQUEST set and NOTIFY
> + * clear, then poll REQUEST/BUSY for completion. Linux sets both bits
> + * and expects completion through PLIC source 96.
> + */
> + if (value & SERVICES_CR_NOTIFY) {
> + s->irq_pending = true;
> + mchp_pfsoc_ioscb_update_irq(s);
> + }
> }
>
> static uint64_t mchp_pfsoc_ctrl_read(void *opaque, hwaddr offset,
> @@ -325,7 +349,8 @@ static void mchp_pfsoc_ioscb_reset(DeviceState *dev)
> s->services_cr = 0;
> s->services_sr = 0;
> memset(s->mailbox_data, 0, sizeof(s->mailbox_data));
> - qemu_irq_lower(s->irq);
> + s->irq_pending = false;
> + mchp_pfsoc_ioscb_update_irq(s);
> }
>
> static const Property mchp_pfsoc_ioscb_properties[] = {
> @@ -333,6 +358,13 @@ static const Property mchp_pfsoc_ioscb_properties[] = {
> MchpPfSoCIoscbState, serial_number),
> };
>
> +static void mchp_pfsoc_ioscb_init(Object *obj)
> +{
> + /* Accept service interrupt acknowledgements from SYSREG MESSAGE_INT */
> + qdev_init_gpio_in_named(DEVICE(obj), mchp_pfsoc_ioscb_clear_irq,
> + MCHP_PFSOC_IOSCB_IRQ_CLEAR, 1);
> +}
> +
> static void mchp_pfsoc_ioscb_realize(DeviceState *dev, Error **errp)
> {
> MchpPfSoCIoscbState *s = MCHP_PFSOC_IOSCB(dev);
> @@ -456,6 +488,7 @@ static const TypeInfo mchp_pfsoc_ioscb_info = {
> .name = TYPE_MCHP_PFSOC_IOSCB,
> .parent = TYPE_SYS_BUS_DEVICE,
> .instance_size = sizeof(MchpPfSoCIoscbState),
> + .instance_init = mchp_pfsoc_ioscb_init,
> .class_init = mchp_pfsoc_ioscb_class_init,
> };
>
> diff --git a/hw/misc/mchp_pfsoc_sysreg.c b/hw/misc/mchp_pfsoc_sysreg.c
> index 1d9154280a..899b485da6 100644
> --- a/hw/misc/mchp_pfsoc_sysreg.c
> +++ b/hw/misc/mchp_pfsoc_sysreg.c
> @@ -77,7 +77,14 @@ static void mchp_pfsoc_sysreg_write(void *opaque, hwaddr offset,
> }
> break;
> case MESSAGE_INT:
> - qemu_irq_lower(s->irq);
> + /*
> + * A MESSAGE_INT write is an acknowledgement event, not a level that
> + * remains asserted. Model it as an active-high pulse. The rising edge
> + * invokes IOSCB's irq-clear input with level 1, which clears
> + * irq_pending and lowers PLIC source 96. The falling edge invokes the
> + * input with level 0 and is ignored.
> + */
> + qemu_irq_pulse(s->irq);
> break;
> default:
> qemu_log_mask(LOG_UNIMP, "%s: unimplemented device write "
> diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
> index 63658fbeb0..f348de6fd4 100644
> --- a/hw/riscv/microchip_pfsoc.c
> +++ b/hw/riscv/microchip_pfsoc.c
> @@ -333,9 +333,6 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> sysbus_realize(SYS_BUS_DEVICE(&s->sysreg), errp);
> sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysreg), 0,
> memmap[MICROCHIP_PFSOC_SYSREG].base);
> - sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
> - qdev_get_gpio_in(DEVICE(s->plic),
> - MICROCHIP_PFSOC_MAILBOX_IRQ));
>
> /* AXISW */
> create_unimplemented_device("microchip.pfsoc.axisw",
> @@ -489,6 +486,9 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
> sysbus_connect_irq(SYS_BUS_DEVICE(&s->ioscb), 0,
> qdev_get_gpio_in(DEVICE(s->plic),
> MICROCHIP_PFSOC_MAILBOX_IRQ));
> + sysbus_connect_irq(SYS_BUS_DEVICE(&s->sysreg), 0,
> + qdev_get_gpio_in_named(DEVICE(&s->ioscb),
> + MCHP_PFSOC_IOSCB_IRQ_CLEAR, 0));
>
> /* FPGA Fabric */
> create_unimplemented_device("microchip.pfsoc.fabricfic3",
> --
> 2.34.1
>
next prev parent reply other threads:[~2026-07-27 5:32 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-23 15:18 [PATCH 00/26] hw/riscv: Restore Microchip PolarFire SoC Icicle Kit firmware boot Bin Meng
2026-07-23 15:18 ` [PATCH 01/26] hw/riscv: pfsoc: Correct the L2LIM maximum mapped size Bin Meng
2026-07-27 5:23 ` Chao Liu
2026-07-23 15:18 ` [PATCH 02/26] hw/riscv: pfsoc: Map the L2 zero device window Bin Meng
2026-07-27 5:24 ` Chao Liu
2026-07-23 15:18 ` [PATCH 03/26] hw/misc: pfsoc: Support PolarFire SoC DDR training with newer version HSS Bin Meng
2026-07-23 15:18 ` [PATCH 04/26] hw/misc: pfsoc: Model L2 cache controller registers Bin Meng
2026-07-23 15:18 ` [PATCH 05/26] hw/riscv: pfsoc: Couple L2CC to L2-LIM Bin Meng
2026-07-27 5:30 ` Chao Liu
2026-07-23 15:18 ` [PATCH 06/26] tests/qtest: Add PolarFire SoC L2CC coverage Bin Meng
2026-07-23 15:18 ` [PATCH 07/26] hw/sd: sdhci: Migrate the Host Control 2 register Bin Meng
2026-07-23 15:18 ` [PATCH 08/26] hw/sd: sdhci: Accept version 4 enable without UHS-I Bin Meng
2026-07-23 15:18 ` [PATCH 09/26] hw/sd: sdhci: Use version 4 system address for SDMA Bin Meng
2026-07-23 15:18 ` [PATCH 10/26] hw/sd: sdhci: Support version 4 ADMA 64-bit addressing Bin Meng
2026-07-23 15:18 ` [PATCH 11/26] hw/sd: sdhci: Resume version 4 SDMA at buffer boundaries Bin Meng
2026-07-23 15:18 ` [PATCH 12/26] hw/sd: sdhci: Run ADMA independently of MMIO Bin Meng
2026-07-23 15:18 ` [PATCH 13/26] hw/sd: sd: Keep high-capacity memory blocks at 512 bytes Bin Meng
2026-07-23 15:18 ` [PATCH 14/26] hw/sd: cadence: Advertise 64-bit system bus support Bin Meng
2026-07-23 15:18 ` [PATCH 15/26] hw/misc: pfsoc: Model PolarFire SoC serial number service Bin Meng
2026-07-23 15:18 ` [PATCH 16/26] hw/rtc: Add PolarFire SoC RTC model Bin Meng
2026-07-23 15:28 ` Conor Dooley
2026-07-23 15:55 ` Bin Meng
2026-07-23 15:58 ` Conor Dooley
2026-07-23 16:07 ` Bin Meng
2026-07-23 15:18 ` [PATCH 17/26] hw/riscv: pfsoc: Add PolarFire SoC RTC to Icicle Kit Bin Meng
2026-07-27 5:31 ` Chao Liu
2026-07-23 15:18 ` [PATCH 18/26] tests/qtest: Add PolarFire SoC RTC coverage Bin Meng
2026-07-23 15:18 ` [PATCH 19/26] hw/misc: pfsoc: Honor PolarFire service notification requests Bin Meng
2026-07-27 5:32 ` Chao Liu [this message]
2026-07-23 15:18 ` [PATCH 20/26] hw/riscv: pfsoc: Correct PolarFire SoC DDR aliases Bin Meng
2026-07-27 5:33 ` Chao Liu
2026-07-23 15:18 ` [PATCH 21/26] hw/riscv: pfsoc: Fix Icicle Kit RAM size at 2 GiB Bin Meng
2026-07-27 5:33 ` Chao Liu
2026-07-23 15:18 ` [PATCH 22/26] hw/riscv: pfsoc: Fix Icicle Kit hart count at five Bin Meng
2026-07-27 5:37 ` Chao Liu
2026-07-23 15:18 ` [PATCH 23/26] docs/system/riscv: Document Icicle Kit HSS boot Bin Meng
2026-07-23 15:18 ` [PATCH 24/26] docs/system/riscv: pfsoc: Document CLINT topology for direct Linux boot Bin Meng
2026-07-23 15:18 ` [PATCH 25/26] tests/functional/riscv64: Add Icicle Kit firmware boot test Bin Meng
2026-07-27 5:38 ` Chao Liu
2026-07-23 15:18 ` [PATCH 26/26] MAINTAINERS: Add PolarFire SoC Icicle Kit maintainer Bin Meng
2026-07-23 15:29 ` Conor Dooley via qemu development
2026-07-23 16:51 ` Markus Armbruster
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ambtS-BDWLw2g3Wt@ChaodeMacBook-Pro.local \
--to=chao.liu@processmission.com \
--cc=alistair.francis@wdc.com \
--cc=bin.meng@processmission.com \
--cc=conor@kernel.org \
--cc=daniel.barboza@oss.qualcomm.com \
--cc=liwei1518@gmail.com \
--cc=palmer@dabbelt.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=sebastian.huber@embedded-brains.de \
--cc=zhiwei_liu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.