* [PATCH v5 01/15] hw/timer: Make frequency configurable
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 02/15] hw/timer: Make PERIPHCLK divider configurable Corvin Köhne
` (14 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
The a9 global timer and arm mp timers rely on the PERIPHCLK as
their clock source. The current implementation does not take
that into account. That causes problems for applications assuming
other frequencies than 1 GHz.
We can now configure frequencies for the a9 global timer and
arm mp timer. By allowing these values to be set according to
the application's needs, we ensure that the timers behave
consistently with the expected system configuration. The SoC
configures the device correctly.
Information can be found in the Zynq 7000 SoC Technical
Reference Manual under Timers.
https://docs.amd.com/r/en-US/ug585-zynq-7000-SoC-TRM
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/timer/a9gtimer.c | 9 ++++++---
hw/timer/arm_mptimer.c | 15 +++++++++++----
include/hw/timer/a9gtimer.h | 1 +
include/hw/timer/arm_mptimer.h | 2 ++
4 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/hw/timer/a9gtimer.c b/hw/timer/a9gtimer.c
index 690140f5a6..ad9abcb4bb 100644
--- a/hw/timer/a9gtimer.c
+++ b/hw/timer/a9gtimer.c
@@ -63,9 +63,9 @@ static inline int a9_gtimer_get_current_cpu(A9GTimerState *s)
static inline uint64_t a9_gtimer_get_conv(A9GTimerState *s)
{
uint64_t prescale = extract32(s->control, R_CONTROL_PRESCALER_SHIFT,
- R_CONTROL_PRESCALER_LEN);
-
- return (prescale + 1) * 10;
+ R_CONTROL_PRESCALER_LEN) + 1;
+ uint64_t scaled_prescaler = prescale * 10;
+ return muldiv64(scaled_prescaler, NANOSECONDS_PER_SECOND, s->freq_hz);
}
static A9GTimerUpdate a9_gtimer_get_update(A9GTimerState *s)
@@ -374,6 +374,9 @@ static const VMStateDescription vmstate_a9_gtimer = {
};
static const Property a9_gtimer_properties[] = {
+ /* Default clock-frequency is 1GHz (NANOSECONDS_PER_SECOND) */
+ DEFINE_PROP_UINT64("clock-frequency", A9GTimerState, freq_hz,
+ NANOSECONDS_PER_SECOND),
DEFINE_PROP_UINT32("num-cpu", A9GTimerState, num_cpu, 0),
};
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 7cc5915e9e..342ca1276a 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -59,9 +59,11 @@ static inline void timerblock_update_irq(TimerBlock *tb)
}
/* Return conversion factor from mpcore timer ticks to qemu timer ticks. */
-static inline uint32_t timerblock_scale(uint32_t control)
+static inline uint32_t timerblock_scale(TimerBlock *tb, uint32_t control)
{
- return (((control >> 8) & 0xff) + 1) * 10;
+ uint64_t prescale = (((control >> 8) & 0xff) + 1);
+ uint64_t scaled_prescaler = prescale * 10;
+ return muldiv64(scaled_prescaler, NANOSECONDS_PER_SECOND, tb->freq_hz);
}
/* Must be called within a ptimer transaction block */
@@ -155,7 +157,7 @@ static void timerblock_write(void *opaque, hwaddr addr,
ptimer_stop(tb->timer);
}
if ((control & 0xff00) != (value & 0xff00)) {
- ptimer_set_period(tb->timer, timerblock_scale(value));
+ ptimer_set_period(tb->timer, timerblock_scale(tb, value));
}
if (value & 1) {
uint64_t count = ptimer_get_count(tb->timer);
@@ -222,7 +224,8 @@ static void timerblock_reset(TimerBlock *tb)
ptimer_transaction_begin(tb->timer);
ptimer_stop(tb->timer);
ptimer_set_limit(tb->timer, 0, 1);
- ptimer_set_period(tb->timer, timerblock_scale(0));
+ ptimer_set_period(tb->timer,
+ timerblock_scale(tb, tb->control));
ptimer_transaction_commit(tb->timer);
}
}
@@ -269,6 +272,7 @@ static void arm_mptimer_realize(DeviceState *dev, Error **errp)
*/
for (i = 0; i < s->num_cpu; i++) {
TimerBlock *tb = &s->timerblock[i];
+ tb->freq_hz = s->freq_hz;
tb->timer = ptimer_init(timerblock_tick, tb, PTIMER_POLICY);
sysbus_init_irq(sbd, &tb->irq);
memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
@@ -301,6 +305,9 @@ static const VMStateDescription vmstate_arm_mptimer = {
};
static const Property arm_mptimer_properties[] = {
+ /* Default clock-frequency is 1GHz (NANOSECONDS_PER_SECOND) */
+ DEFINE_PROP_UINT64("clock-frequency", ARMMPTimerState, freq_hz,
+ NANOSECONDS_PER_SECOND),
DEFINE_PROP_UINT32("num-cpu", ARMMPTimerState, num_cpu, 0),
};
diff --git a/include/hw/timer/a9gtimer.h b/include/hw/timer/a9gtimer.h
index 6ae9122e4b..3b63d14927 100644
--- a/include/hw/timer/a9gtimer.h
+++ b/include/hw/timer/a9gtimer.h
@@ -76,6 +76,7 @@ struct A9GTimerState {
MemoryRegion iomem;
/* static props */
+ uint64_t freq_hz;
uint32_t num_cpu;
QEMUTimer *timer;
diff --git a/include/hw/timer/arm_mptimer.h b/include/hw/timer/arm_mptimer.h
index 65a96e2a0d..da43a3d351 100644
--- a/include/hw/timer/arm_mptimer.h
+++ b/include/hw/timer/arm_mptimer.h
@@ -31,6 +31,7 @@ typedef struct {
uint32_t control;
uint32_t status;
struct ptimer_state *timer;
+ uint64_t freq_hz;
qemu_irq irq;
MemoryRegion iomem;
} TimerBlock;
@@ -43,6 +44,7 @@ struct ARMMPTimerState {
SysBusDevice parent_obj;
/*< public >*/
+ uint64_t freq_hz;
uint32_t num_cpu;
TimerBlock timerblock[ARM_MPTIMER_MAX_CPUS];
MemoryRegion iomem;
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 02/15] hw/timer: Make PERIPHCLK divider configurable
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 01/15] hw/timer: Make frequency configurable Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 03/15] hw/dma/zynq-devcfg: Handle bitstream loading via DMA to 0xffffffff Corvin Köhne
` (13 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV,
Philippe Mathieu-Daudé
From: YannickV <Y.Vossen@beckhoff.com>
The A9 global timer and ARM MP timer use PERIPHCLK as
their clock source. The frequency of PERIPHCLK is derived
by dividing the main clock (CLK) by a configurable
divider (must be at least 2). Previously, the PERIPHCLK
divider was not configurable, which could lead to
unexspected behavior if the application exspected a
different PERIPHCLK rate.
The property periphclk-divider specifies by which value
the main clock is divided to generate PERIPHCLK. This
allows flexible configuration of the timer clocks to
match application requirements.
Information can be found in the Zynq 7000 Soc Technical
Reference Manual under Timers.
https://docs.amd.com/r/en-US/ug585-zynq-7000-SoC-TRM
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
hw/timer/a9gtimer.c | 19 ++++++++++++++++++-
hw/timer/arm_mptimer.c | 19 ++++++++++++++++++-
include/hw/timer/a9gtimer.h | 1 +
include/hw/timer/arm_mptimer.h | 2 ++
4 files changed, 39 insertions(+), 2 deletions(-)
diff --git a/hw/timer/a9gtimer.c b/hw/timer/a9gtimer.c
index ad9abcb4bb..8b4c6d7e6a 100644
--- a/hw/timer/a9gtimer.c
+++ b/hw/timer/a9gtimer.c
@@ -27,6 +27,7 @@
#include "hw/timer/a9gtimer.h"
#include "migration/vmstate.h"
#include "qapi/error.h"
+#include "qemu/error-report.h"
#include "qemu/timer.h"
#include "qemu/bitops.h"
#include "qemu/log.h"
@@ -62,9 +63,17 @@ static inline int a9_gtimer_get_current_cpu(A9GTimerState *s)
static inline uint64_t a9_gtimer_get_conv(A9GTimerState *s)
{
+ /*
+ * Referring to the ARM-Cortex-A9 MPCore TRM
+ *
+ * The a9 global timer relies on the PERIPHCLK as its clock source.
+ * The PERIPHCLK clock period must be configured as a multiple of the
+ * main clock CLK. The conversion from the qemu clock (1GHz) to a9
+ * gtimer ticks can be calculated like this:
+ */
uint64_t prescale = extract32(s->control, R_CONTROL_PRESCALER_SHIFT,
R_CONTROL_PRESCALER_LEN) + 1;
- uint64_t scaled_prescaler = prescale * 10;
+ uint64_t scaled_prescaler = prescale * s->periphclk_divider;
return muldiv64(scaled_prescaler, NANOSECONDS_PER_SECOND, s->freq_hz);
}
@@ -312,6 +321,12 @@ static void a9_gtimer_realize(DeviceState *dev, Error **errp)
sysbus_init_mmio(sbd, &s->iomem);
s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, a9_gtimer_update_no_sync, s);
+ if (s->periphclk_divider < 2) {
+ error_setg(errp, "Invalid periphclk-divider (%lu), must be >= 2",
+ s->periphclk_divider);
+ return;
+ }
+
for (i = 0; i < s->num_cpu; i++) {
A9GTimerPerCPU *gtb = &s->per_cpu[i];
@@ -378,6 +393,8 @@ static const Property a9_gtimer_properties[] = {
DEFINE_PROP_UINT64("clock-frequency", A9GTimerState, freq_hz,
NANOSECONDS_PER_SECOND),
DEFINE_PROP_UINT32("num-cpu", A9GTimerState, num_cpu, 0),
+ DEFINE_PROP_UINT64("periphclk-divider", A9GTimerState,
+ periphclk_divider, 10),
};
static void a9_gtimer_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/timer/arm_mptimer.c b/hw/timer/arm_mptimer.c
index 342ca1276a..cf434ca2f4 100644
--- a/hw/timer/arm_mptimer.c
+++ b/hw/timer/arm_mptimer.c
@@ -27,6 +27,7 @@
#include "hw/timer/arm_mptimer.h"
#include "migration/vmstate.h"
#include "qapi/error.h"
+#include "qemu/error-report.h"
#include "qemu/module.h"
#include "hw/core/cpu.h"
@@ -61,8 +62,16 @@ static inline void timerblock_update_irq(TimerBlock *tb)
/* Return conversion factor from mpcore timer ticks to qemu timer ticks. */
static inline uint32_t timerblock_scale(TimerBlock *tb, uint32_t control)
{
+ /*
+ * Referring to the ARM-Cortex-A9 MPCore TRM
+ *
+ * The arm mp timer relies on the PERIPHCLK as its clock source.
+ * The PERIPHCLK clock period must be configured as a multiple of the
+ * main clock CLK. The conversion from the qemu clock (1GHz) to arm mp
+ * timer ticks can be calculated like this:
+ */
uint64_t prescale = (((control >> 8) & 0xff) + 1);
- uint64_t scaled_prescaler = prescale * 10;
+ uint64_t scaled_prescaler = prescale * tb->periphclk_divider;
return muldiv64(scaled_prescaler, NANOSECONDS_PER_SECOND, tb->freq_hz);
}
@@ -273,6 +282,12 @@ static void arm_mptimer_realize(DeviceState *dev, Error **errp)
for (i = 0; i < s->num_cpu; i++) {
TimerBlock *tb = &s->timerblock[i];
tb->freq_hz = s->freq_hz;
+ if (s->periphclk_divider < 2) {
+ error_setg(errp, "Invalid periphclk-divider (%lu), must be >= 2",
+ s->periphclk_divider);
+ return;
+ }
+ tb->periphclk_divider = s->periphclk_divider;
tb->timer = ptimer_init(timerblock_tick, tb, PTIMER_POLICY);
sysbus_init_irq(sbd, &tb->irq);
memory_region_init_io(&tb->iomem, OBJECT(s), &timerblock_ops, tb,
@@ -309,6 +324,8 @@ static const Property arm_mptimer_properties[] = {
DEFINE_PROP_UINT64("clock-frequency", ARMMPTimerState, freq_hz,
NANOSECONDS_PER_SECOND),
DEFINE_PROP_UINT32("num-cpu", ARMMPTimerState, num_cpu, 0),
+ DEFINE_PROP_UINT64("periphclk-divider", ARMMPTimerState,
+ periphclk_divider, 10),
};
static void arm_mptimer_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/timer/a9gtimer.h b/include/hw/timer/a9gtimer.h
index 3b63d14927..ff9baf1c77 100644
--- a/include/hw/timer/a9gtimer.h
+++ b/include/hw/timer/a9gtimer.h
@@ -77,6 +77,7 @@ struct A9GTimerState {
MemoryRegion iomem;
/* static props */
uint64_t freq_hz;
+ uint64_t periphclk_divider;
uint32_t num_cpu;
QEMUTimer *timer;
diff --git a/include/hw/timer/arm_mptimer.h b/include/hw/timer/arm_mptimer.h
index da43a3d351..061934e4b5 100644
--- a/include/hw/timer/arm_mptimer.h
+++ b/include/hw/timer/arm_mptimer.h
@@ -32,6 +32,7 @@ typedef struct {
uint32_t status;
struct ptimer_state *timer;
uint64_t freq_hz;
+ uint64_t periphclk_divider;
qemu_irq irq;
MemoryRegion iomem;
} TimerBlock;
@@ -45,6 +46,7 @@ struct ARMMPTimerState {
/*< public >*/
uint64_t freq_hz;
+ uint64_t periphclk_divider;
uint32_t num_cpu;
TimerBlock timerblock[ARM_MPTIMER_MAX_CPUS];
MemoryRegion iomem;
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 03/15] hw/dma/zynq-devcfg: Handle bitstream loading via DMA to 0xffffffff
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 01/15] hw/timer: Make frequency configurable Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 02/15] hw/timer: Make PERIPHCLK divider configurable Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 04/15] hw/arm/zynq-devcfg: Prevent unintended unlock during initialization Corvin Köhne
` (12 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV, Edgar E. Iglesias
From: YannickV <Y.Vossen@beckhoff.com>
A DMA transfer to destination address `0xffffffff` should trigger a
bitstream load via the PCAP interface. Currently, this case is not
intercepted, causing loaders to enter an infinite loop when polling
the status register.
This commit adds a check for `0xffffffff` as the destination address.
If detected, the relevant status register bits (`DMA_DONE`,
`DMA_P_DONE`, and `PCFG_DONE`) are set to indicate a successful
bitstream load. If the address is different, the DMA transfer proceeds
as usual. A successful load is indicated but nothing is actually
done. Guests relying on FPGA functions are still known to fail.
This feature is required for the integration of the Beckhoff
CX7200 model.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
hw/dma/xlnx-zynq-devcfg.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 8141d46033..2430d70bf7 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -247,7 +247,14 @@ static uint64_t r_lock_pre_write(RegisterInfo *reg, uint64_t val)
static void r_dma_dst_len_post_write(RegisterInfo *reg, uint64_t val)
{
XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
-
+ if ((s->regs[R_DMA_DST_ADDR]) == 0xffffffff) {
+ DB_PRINT("bitstream loading detected\n");
+ s->regs[R_INT_STS] |= R_INT_STS_DMA_DONE_MASK |
+ R_INT_STS_DMA_P_DONE_MASK |
+ R_INT_STS_PCFG_DONE_MASK;
+ xlnx_zynq_devcfg_update_ixr(s);
+ return;
+ }
s->dma_cmd_fifo[s->dma_cmd_fifo_num] = (XlnxZynqDevcfgDMACmd) {
.src_addr = s->regs[R_DMA_SRC_ADDR] & ~0x3UL,
.dest_addr = s->regs[R_DMA_DST_ADDR] & ~0x3UL,
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 04/15] hw/arm/zynq-devcfg: Prevent unintended unlock during initialization
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (2 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 03/15] hw/dma/zynq-devcfg: Handle bitstream loading via DMA to 0xffffffff Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 05/15] hw/dma/zynq: Ensure PCFG_DONE bit remains set to indicate PL is in user mode Corvin Köhne
` (11 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV, Edgar E. Iglesias
From: YannickV <Y.Vossen@beckhoff.com>
During the emulation startup, all registers are reset, which triggers the
`r_unlock_post_write` function with a value of 0. This led to an
unintended memory access disable, making the devcfg unusable.
During startup, the memory space no longer gets locked.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
hw/dma/xlnx-zynq-devcfg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 2430d70bf7..0c06daa6b9 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -221,7 +221,9 @@ static void r_unlock_post_write(RegisterInfo *reg, uint64_t val)
{
XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
const char *device_prefix = object_get_typename(OBJECT(s));
-
+ if (device_is_in_reset(DEVICE(s))) {
+ return;
+ }
if (val == R_UNLOCK_MAGIC) {
DB_PRINT("successful unlock\n");
s->regs[R_CTRL] |= R_CTRL_PCAP_PR_MASK;
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 05/15] hw/dma/zynq: Ensure PCFG_DONE bit remains set to indicate PL is in user mode
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (3 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 04/15] hw/arm/zynq-devcfg: Prevent unintended unlock during initialization Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 06/15] hw/dma/zynq-devcfg: Simulate dummy PL reset Corvin Köhne
` (10 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV, Edgar E. Iglesias
From: YannickV <Y.Vossen@beckhoff.com>
All register bits are clear on write by writing 1s to those bits, however
the register bits will only be cleared if the condition that sets the
interrupt flag is no longer true. Since we can assume that programming
is always done, the `PCFG_DONE` flag is always set to 1, so it will not
never be cleared.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
hw/dma/xlnx-zynq-devcfg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 0c06daa6b9..72f7b1f170 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -188,6 +188,8 @@ static void r_ixr_post_write(RegisterInfo *reg, uint64_t val)
{
XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
+ s->regs[R_INT_STS] |= R_INT_STS_PCFG_DONE_MASK;
+
xlnx_zynq_devcfg_update_ixr(s);
}
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 06/15] hw/dma/zynq-devcfg: Simulate dummy PL reset
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (4 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 05/15] hw/dma/zynq: Ensure PCFG_DONE bit remains set to indicate PL is in user mode Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 07/15] hw/dma/zynq-devcfg: Indicate power-up status of PL Corvin Köhne
` (9 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV, Edgar E. Iglesias
From: YannickV <Y.Vossen@beckhoff.com>
Setting PCFG_PROG_B should reset the PL. After a reset PCFG_INIT
should indicate that the reset is finished successfully.
In order to add a MMIO-Device as part of the PL in the Zynq, the
reset logic must succeed. The PCFG_INIT flag is now set when the
PL reset is triggered by PCFG_PROG_B. Indicating the reset was
successful.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
hw/dma/xlnx-zynq-devcfg.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 72f7b1f170..722d68a568 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -49,6 +49,7 @@
REG32(CTRL, 0x00)
FIELD(CTRL, FORCE_RST, 31, 1) /* Not supported, wr ignored */
+ FIELD(CTRL, PCFG_PROG_B, 30, 1)
FIELD(CTRL, PCAP_PR, 27, 1) /* Forced to 0 on bad unlock */
FIELD(CTRL, PCAP_MODE, 26, 1)
FIELD(CTRL, MULTIBOOT_EN, 24, 1)
@@ -116,6 +117,7 @@ REG32(STATUS, 0x14)
FIELD(STATUS, PSS_GTS_USR_B, 11, 1)
FIELD(STATUS, PSS_FST_CFG_B, 10, 1)
FIELD(STATUS, PSS_CFG_RESET_B, 5, 1)
+ FIELD(STATUS, PCFG_INIT, 4, 1)
REG32(DMA_SRC_ADDR, 0x18)
REG32(DMA_DST_ADDR, 0x1C)
@@ -204,6 +206,13 @@ static uint64_t r_ctrl_pre_write(RegisterInfo *reg, uint64_t val)
val |= lock_ctrl_map[i] & s->regs[R_CTRL];
}
}
+
+ if (FIELD_EX32(val, CTRL, PCFG_PROG_B)) {
+ s->regs[R_STATUS] |= R_STATUS_PCFG_INIT_MASK;
+ } else {
+ s->regs[R_STATUS] &= ~R_STATUS_PCFG_INIT_MASK;
+ }
+
return val;
}
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 07/15] hw/dma/zynq-devcfg: Indicate power-up status of PL
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (5 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 06/15] hw/dma/zynq-devcfg: Simulate dummy PL reset Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 08/15] hw/misc: Add dummy ZYNQ DDR controller Corvin Köhne
` (8 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV, Edgar E. Iglesias
From: YannickV <Y.Vossen@beckhoff.com>
It is assumed, that the programmable logic (PL) is always powered
during emulation. Therefor the PCFG_POR_B bit in the MCTRL register
is set.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
hw/dma/xlnx-zynq-devcfg.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 722d68a568..bd8057caa9 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -333,7 +333,8 @@ static const RegisterAccessInfo xlnx_zynq_devcfg_regs_info[] = {
/* Silicon 3.0 for version field, the mysterious reserved bit 23
* and QEMU platform identifier.
*/
- .reset = 0x2 << R_MCTRL_PS_VERSION_SHIFT | 1 << 23 | R_MCTRL_QEMU_MASK,
+ .reset = 0x2 << R_MCTRL_PS_VERSION_SHIFT | 1 << 23 |
+ R_MCTRL_PCFG_POR_B_MASK | R_MCTRL_QEMU_MASK,
.ro = ~R_MCTRL_INT_PCAP_LPBK_MASK,
.rsvd = 0x00f00303,
},
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 08/15] hw/misc: Add dummy ZYNQ DDR controller
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (6 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 07/15] hw/dma/zynq-devcfg: Indicate power-up status of PL Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 09/15] hw/misc/zynq_slcr: Add logic for DCI configuration Corvin Köhne
` (7 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
A dummy DDR controller for ZYNQ has been added. While all registers are present,
not all are functional. Read and write access is validated, and the user mode
can be set. This provides a basic DDR controller initialization, preventing
system hangs due to endless polling or similar issues.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/arm/xilinx_zynq.c | 16 +-
hw/misc/Kconfig | 3 +
hw/misc/meson.build | 1 +
hw/misc/xlnx-zynq-ddrc.c | 413 +++++++++++++++++++++++++++++++
include/hw/misc/xlnx-zynq-ddrc.h | 148 +++++++++++
5 files changed, 578 insertions(+), 3 deletions(-)
create mode 100644 hw/misc/xlnx-zynq-ddrc.c
create mode 100644 include/hw/misc/xlnx-zynq-ddrc.h
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index c82edd3bed..c03ed09a67 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -201,6 +201,17 @@ static void zynq_set_boot_mode(Object *obj, const char *str,
m->boot_mode = mode;
}
+static void ddr_ctrl_init(uint32_t base)
+{
+ DeviceState *dev;
+ SysBusDevice *busdev;
+
+ dev = qdev_new("zynq.ddr-ctlr");
+ busdev = SYS_BUS_DEVICE(dev);
+ sysbus_realize_and_unref(busdev, &error_fatal);
+ sysbus_mmio_map(busdev, 0, base);
+}
+
static void zynq_init(MachineState *machine)
{
ZynqMachineState *zynq_machine = ZYNQ_MACHINE(machine);
@@ -312,6 +323,8 @@ static void zynq_init(MachineState *machine)
sysbus_create_varargs("cadence_ttc", 0xF8002000,
pic[69-GIC_INTERNAL], pic[70-GIC_INTERNAL], pic[71-GIC_INTERNAL], NULL);
+ ddr_ctrl_init(0xF8006000);
+
gem_init(0xE000B000, pic[54 - GIC_INTERNAL]);
gem_init(0xE000C000, pic[77 - GIC_INTERNAL]);
@@ -393,9 +406,6 @@ static void zynq_init(MachineState *machine)
/* System Watchdog Timer Registers */
create_unimplemented_device("zynq.swdt", 0xF8005000, 4 * KiB);
- /* DDR memory controller */
- create_unimplemented_device("zynq.ddrc", 0xF8006000, 4 * KiB);
-
/* AXI_HP Interface (AFI) */
create_unimplemented_device("zynq.axi_hp0", 0xF8008000, 0x28);
create_unimplemented_device("zynq.axi_hp1", 0xF8009000, 0x28);
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index fccd735c24..3de37c9e1d 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -240,4 +240,7 @@ config IOSB
config XLNX_VERSAL_TRNG
bool
+config XLNX_ZYNQ_DDRC
+ bool
+
source macio/Kconfig
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index b1d8d8e5d2..ffbcca9796 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -95,6 +95,7 @@ system_ss.add(when: 'CONFIG_RASPI', if_true: files(
))
system_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
system_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
+system_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xlnx-zynq-ddrc.c'))
system_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
system_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
system_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
diff --git a/hw/misc/xlnx-zynq-ddrc.c b/hw/misc/xlnx-zynq-ddrc.c
new file mode 100644
index 0000000000..0403be8189
--- /dev/null
+++ b/hw/misc/xlnx-zynq-ddrc.c
@@ -0,0 +1,413 @@
+/*
+ * QEMU model of the Xilinx Zynq Double Data Rate Controller
+ *
+ * Copyright (c) Beckhoff Automation GmbH. & Co. KG
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "hw/registerfields.h"
+#include "system/block-backend.h"
+#include "system/address-spaces.h"
+#include "system/memory.h"
+#include "system/dma.h"
+#include "hw/misc/xlnx-zynq-ddrc.h"
+#include "migration/vmstate.h"
+
+#ifndef DDRCTRL_ERR_DEBUG
+#define DDRCTRL_ERR_DEBUG 0
+#endif
+
+static void zynq_ddrctrl_post_write(RegisterInfo *reg, uint64_t val)
+{
+ DDRCTRLState *s = DDRCTRL(reg->opaque);
+ if (reg->access->addr == A_DDRC_CTRL) {
+ if (val & 0x1) {
+ s->reg[R_MODE_STS_REG] |=
+ (R_MODE_STS_REG_DDR_REG_OPERATING_MODE_MASK & 0x1);
+ } else {
+ s->reg[R_MODE_STS_REG] &=
+ ~R_MODE_STS_REG_DDR_REG_OPERATING_MODE_MASK;
+ }
+ }
+}
+
+static const RegisterAccessInfo xlnx_zynq_ddrc_regs_info[] = {
+ /* 0x00 - 0x3C: Basic DDRC control and config */
+ { .name = "DDRC_CTRL",
+ .addr = A_DDRC_CTRL,
+ .reset = 0x00000200,
+ .post_write = zynq_ddrctrl_post_write },
+ { .name = "TWO_RANK_CFG",
+ .addr = A_TWO_RANK_CFG,
+ .reset = 0x000C1076 },
+ { .name = "HPR_REG",
+ .addr = A_HPR_REG,
+ .reset = 0x03C0780F },
+ { .name = "LPR_REG",
+ .addr = A_LPR_REG,
+ .reset = 0x03C0780F },
+ { .name = "WR_REG",
+ .addr = A_WR_REG,
+ .reset = 0x0007F80F },
+ { .name = "DRAM_PARAM_REG0",
+ .addr = A_DRAM_PARAM_REG0,
+ .reset = 0x00041016 },
+ { .name = "DRAM_PARAM_REG1",
+ .addr = A_DRAM_PARAM_REG1,
+ .reset = 0x351B48D9 },
+ { .name = "DRAM_PARAM_REG2",
+ .addr = A_DRAM_PARAM_REG2,
+ .reset = 0x83015904 },
+ { .name = "DRAM_PARAM_REG3",
+ .addr = A_DRAM_PARAM_REG3,
+ .reset = 0x250882D0 },
+ { .name = "DRAM_PARAM_REG4",
+ .addr = A_DRAM_PARAM_REG4,
+ .reset = 0x0000003C },
+ { .name = "DRAM_INIT_PARAM",
+ .addr = A_DRAM_INIT_PARAM,
+ .reset = 0x00002007 },
+ { .name = "DRAM_EMR_REG",
+ .addr = A_DRAM_EMR_REG,
+ .reset = 0x00000008 },
+ { .name = "DRAM_EMR_MR_REG",
+ .addr = A_DRAM_EMR_MR_REG,
+ .reset = 0x00000940 },
+ { .name = "DRAM_BURST8_RDWR",
+ .addr = A_DRAM_BURST8_RDWR,
+ .reset = 0x00020034 },
+ { .name = "DRAM_DISABLE_DQ",
+ .addr = A_DRAM_DISABLE_DQ },
+ { .name = "DRAM_ADDR_MAP_BANK",
+ .addr = A_DRAM_ADDR_MAP_BANK,
+ .reset = 0x00000F77 },
+ { .name = "DRAM_ADDR_MAP_COL",
+ .addr = A_DRAM_ADDR_MAP_COL,
+ .reset = 0xFFF00000 },
+ { .name = "DRAM_ADDR_MAP_ROW",
+ .addr = A_DRAM_ADDR_MAP_ROW,
+ .reset = 0x0FF55555 },
+ { .name = "DRAM_ODT_REG",
+ .addr = A_DRAM_ODT_REG,
+ .reset = 0x00000249 },
+
+ /* 0x4C - 0x5C: PHY and DLL */
+ { .name = "PHY_DBG_REG",
+ .addr = A_PHY_DBG_REG },
+ { .name = "PHY_CMD_TIMEOUT_RDDATA_CPT",
+ .addr = A_PHY_CMD_TIMEOUT_RDDATA_CPT,
+ .reset = 0x00010200 },
+ { .name = "MODE_STS_REG",
+ .addr = A_MODE_STS_REG },
+ { .name = "DLL_CALIB",
+ .addr = A_DLL_CALIB,
+ .reset = 0x00000101 },
+ { .name = "ODT_DELAY_HOLD",
+ .addr = A_ODT_DELAY_HOLD,
+ .reset = 0x00000023 },
+
+ /* 0x60 - 0x7C: Control registers */
+ { .name = "CTRL_REG1",
+ .addr = A_CTRL_REG1,
+ .reset = 0x0000003E },
+ { .name = "CTRL_REG2",
+ .addr = A_CTRL_REG2,
+ .reset = 0x00020000 },
+ { .name = "CTRL_REG3",
+ .addr = A_CTRL_REG3,
+ .reset = 0x00284027 },
+ { .name = "CTRL_REG4",
+ .addr = A_CTRL_REG4,
+ .reset = 0x00001610 },
+ { .name = "CTRL_REG5",
+ .addr = A_CTRL_REG5,
+ .reset = 0x00455111 },
+ { .name = "CTRL_REG6",
+ .addr = A_CTRL_REG6,
+ .reset = 0x00032222 },
+
+ /* 0xA0 - 0xB4: Refresh, ZQ, powerdown, misc */
+ { .name = "CHE_REFRESH_TIMER0",
+ .addr = A_CHE_REFRESH_TIMER0,
+ .reset = 0x00008000 },
+ { .name = "CHE_T_ZQ",
+ .addr = A_CHE_T_ZQ,
+ .reset = 0x10300802 },
+ { .name = "CHE_T_ZQ_SHORT_INTERVAL_REG",
+ .addr = A_CHE_T_ZQ_SHORT_INTERVAL_REG,
+ .reset = 0x0020003A },
+ { .name = "DEEP_PWRDWN_REG",
+ .addr = A_DEEP_PWRDWN_REG },
+ { .name = "REG_2C",
+ .addr = A_REG_2C },
+ { .name = "REG_2D",
+ .addr = A_REG_2D,
+ .reset = 0x00000200 },
+
+ /* 0xB8 - 0xF8: ECC, DFI, etc. */
+ { .name = "DFI_TIMING",
+ .addr = A_DFI_TIMING,
+ .reset = 0x00200067 },
+ { .name = "CHE_ECC_CONTROL_REG_OFFSET",
+ .addr = A_CHE_ECC_CONTROL_REG_OFFSET },
+ { .name = "CHE_CORR_ECC_LOG_REG_OFFSET",
+ .addr = A_CHE_CORR_ECC_LOG_REG_OFFSET },
+ { .name = "CHE_CORR_ECC_ADDR_REG_OFFSET",
+ .addr = A_CHE_CORR_ECC_ADDR_REG_OFFSET },
+ { .name = "CHE_CORR_ECC_DATA_31_0_REG_OFFSET",
+ .addr = A_CHE_CORR_ECC_DATA_31_0_REG_OFFSET },
+ { .name = "CHE_CORR_ECC_DATA_63_32_REG_OFFSET",
+ .addr = A_CHE_CORR_ECC_DATA_63_32_REG_OFFSET },
+ { .name = "CHE_CORR_ECC_DATA_71_64_REG_OFFSET",
+ .addr = A_CHE_CORR_ECC_DATA_71_64_REG_OFFSET },
+ { .name = "CHE_UNCORR_ECC_LOG_REG_OFFSET",
+ .addr = A_CHE_UNCORR_ECC_LOG_REG_OFFSET },
+ { .name = "CHE_UNCORR_ECC_ADDR_REG_OFFSET",
+ .addr = A_CHE_UNCORR_ECC_ADDR_REG_OFFSET },
+ { .name = "CHE_UNCORR_ECC_DATA_31_0_REG_OFFSET",
+ .addr = A_CHE_UNCORR_ECC_DATA_31_0_REG_OFFSET },
+ { .name = "CHE_UNCORR_ECC_DATA_63_32_REG_OFFSET",
+ .addr = A_CHE_UNCORR_ECC_DATA_63_32_REG_OFFSET },
+ { .name = "CHE_UNCORR_ECC_DATA_71_64_REG_OFFSET",
+ .addr = A_CHE_UNCORR_ECC_DATA_71_64_REG_OFFSET },
+ { .name = "CHE_ECC_STATS_REG_OFFSET",
+ .addr = A_CHE_ECC_STATS_REG_OFFSET },
+ { .name = "ECC_SCRUB",
+ .addr = A_ECC_SCRUB,
+ .reset = 0x00000008 },
+ { .name = "CHE_ECC_CORR_BIT_MASK_31_0_REG_OFFSET",
+ .addr = A_CHE_ECC_CORR_BIT_MASK_31_0_REG_OFFSET },
+ { .name = "CHE_ECC_CORR_BIT_MASK_63_32_REG_OFFSET",
+ .addr = A_CHE_ECC_CORR_BIT_MASK_63_32_REG_OFFSET },
+
+ /* 0x114 - 0x174: PHY config, ratios, DQS, WE */
+ { .name = "PHY_RCVER_ENABLE",
+ .addr = A_PHY_RCVER_ENABLE },
+ { .name = "PHY_CONFIG0",
+ .addr = A_PHY_CONFIG0,
+ .reset = 0x40000001 },
+ { .name = "PHY_CONFIG1",
+ .addr = A_PHY_CONFIG1,
+ .reset = 0x40000001 },
+ { .name = "PHY_CONFIG2",
+ .addr = A_PHY_CONFIG2,
+ .reset = 0x40000001 },
+ { .name = "PHY_CONFIG3",
+ .addr = A_PHY_CONFIG3,
+ .reset = 0x40000001 },
+ { .name = "PHY_INIT_RATIO0",
+ .addr = A_PHY_INIT_RATIO0 },
+ { .name = "PHY_INIT_RATIO1",
+ .addr = A_PHY_INIT_RATIO1 },
+ { .name = "PHY_INIT_RATIO2",
+ .addr = A_PHY_INIT_RATIO2 },
+ { .name = "PHY_INIT_RATIO3",
+ .addr = A_PHY_INIT_RATIO3 },
+ { .name = "PHY_RD_DQS_CFG0",
+ .addr = A_PHY_RD_DQS_CFG0,
+ .reset = 0x00000040 },
+ { .name = "PHY_RD_DQS_CFG1",
+ .addr = A_PHY_RD_DQS_CFG1,
+ .reset = 0x00000040 },
+ { .name = "PHY_RD_DQS_CFG2",
+ .addr = A_PHY_RD_DQS_CFG2,
+ .reset = 0x00000040 },
+ { .name = "PHY_RD_DQS_CFG3",
+ .addr = A_PHY_RD_DQS_CFG3,
+ .reset = 0x00000040 },
+ { .name = "PHY_WR_DQS_CFG0",
+ .addr = A_PHY_WR_DQS_CFG0 },
+ { .name = "PHY_WR_DQS_CFG1",
+ .addr = A_PHY_WR_DQS_CFG1 },
+ { .name = "PHY_WR_DQS_CFG2",
+ .addr = A_PHY_WR_DQS_CFG2 },
+ { .name = "PHY_WR_DQS_CFG3",
+ .addr = A_PHY_WR_DQS_CFG3 },
+ { .name = "PHY_WE_CFG0",
+ .addr = A_PHY_WE_CFG0,
+ .reset = 0x00000040 },
+ { .name = "PHY_WE_CFG1",
+ .addr = A_PHY_WE_CFG1,
+ .reset = 0x00000040 },
+ { .name = "PHY_WE_CFG2",
+ .addr = A_PHY_WE_CFG2,
+ .reset = 0x00000040 },
+ { .name = "PHY_WE_CFG3",
+ .addr = A_PHY_WE_CFG3,
+ .reset = 0x00000040 },
+
+ /* 0x17C - 0x194: Write data slaves, misc */
+ { .name = "WR_DATA_SLV0",
+ .addr = A_WR_DATA_SLV0,
+ .reset = 0x00000080 },
+ { .name = "WR_DATA_SLV1",
+ .addr = A_WR_DATA_SLV1,
+ .reset = 0x00000080 },
+ { .name = "WR_DATA_SLV2",
+ .addr = A_WR_DATA_SLV2,
+ .reset = 0x00000080 },
+ { .name = "WR_DATA_SLV3",
+ .addr = A_WR_DATA_SLV3,
+ .reset = 0x00000080 },
+ { .name = "REG_64",
+ .addr = A_REG_64,
+ .reset = 0x10020000 },
+ { .name = "REG_65",
+ .addr = A_REG_65 },
+
+ /* 0x1A4 - 0x1C4: Misc registers */
+ { .name = "REG69_6A0",
+ .addr = A_REG69_6A0 },
+ { .name = "REG69_6A1",
+ .addr = A_REG69_6A1 },
+ { .name = "REG6C_6D2",
+ .addr = A_REG6C_6D2 },
+ { .name = "REG6C_6D3",
+ .addr = A_REG6C_6D3 },
+ { .name = "REG6E_710",
+ .addr = A_REG6E_710 },
+ { .name = "REG6E_711",
+ .addr = A_REG6E_711 },
+ { .name = "REG6E_712",
+ .addr = A_REG6E_712 },
+ { .name = "REG6E_713",
+ .addr = A_REG6E_713 },
+
+ /* 0x1CC - 0x1E8: DLL, PHY status */
+ { .name = "PHY_DLL_STS0",
+ .addr = A_PHY_DLL_STS0 },
+ { .name = "PHY_DLL_STS1",
+ .addr = A_PHY_DLL_STS1 },
+ { .name = "PHY_DLL_STS2",
+ .addr = A_PHY_DLL_STS2 },
+ { .name = "PHY_DLL_STS3",
+ .addr = A_PHY_DLL_STS3 },
+ { .name = "DLL_LOCK_STS",
+ .addr = A_DLL_LOCK_STS },
+ { .name = "PHY_CTRL_STS",
+ .addr = A_PHY_CTRL_STS },
+ { .name = "PHY_CTRL_STS_REG2",
+ .addr = A_PHY_CTRL_STS_REG2 },
+
+ /* 0x200 - 0x2B4: AXI, LPDDR, misc */
+ { .name = "AXI_ID",
+ .addr = A_AXI_ID },
+ { .name = "PAGE_MASK",
+ .addr = A_PAGE_MASK },
+ { .name = "AXI_PRIORITY_WR_PORT0",
+ .addr = A_AXI_PRIORITY_WR_PORT0,
+ .reset = 0x000803FF },
+ { .name = "AXI_PRIORITY_WR_PORT1",
+ .addr = A_AXI_PRIORITY_WR_PORT1,
+ .reset = 0x000803FF },
+ { .name = "AXI_PRIORITY_WR_PORT2",
+ .addr = A_AXI_PRIORITY_WR_PORT2,
+ .reset = 0x000803FF },
+ { .name = "AXI_PRIORITY_WR_PORT3",
+ .addr = A_AXI_PRIORITY_WR_PORT3,
+ .reset = 0x000803FF },
+ { .name = "AXI_PRIORITY_RD_PORT0",
+ .addr = A_AXI_PRIORITY_RD_PORT0,
+ .reset = 0x000003FF },
+ { .name = "AXI_PRIORITY_RD_PORT1",
+ .addr = A_AXI_PRIORITY_RD_PORT1,
+ .reset = 0x000003FF },
+ { .name = "AXI_PRIORITY_RD_PORT2",
+ .addr = A_AXI_PRIORITY_RD_PORT2,
+ .reset = 0x000003FF },
+ { .name = "AXI_PRIORITY_RD_PORT3",
+ .addr = A_AXI_PRIORITY_RD_PORT3,
+ .reset = 0x000003FF },
+ { .name = "EXCL_ACCESS_CFG0",
+ .addr = A_EXCL_ACCESS_CFG0 },
+ { .name = "EXCL_ACCESS_CFG1",
+ .addr = A_EXCL_ACCESS_CFG1 },
+ { .name = "EXCL_ACCESS_CFG2",
+ .addr = A_EXCL_ACCESS_CFG2 },
+ { .name = "EXCL_ACCESS_CFG3",
+ .addr = A_EXCL_ACCESS_CFG3 },
+ { .name = "MODE_REG_READ",
+ .addr = A_MODE_REG_READ },
+ { .name = "LPDDR_CTRL0",
+ .addr = A_LPDDR_CTRL0 },
+ { .name = "LPDDR_CTRL1",
+ .addr = A_LPDDR_CTRL1 },
+ { .name = "LPDDR_CTRL2",
+ .addr = A_LPDDR_CTRL2,
+ .reset = 0x003C0015 },
+ { .name = "LPDDR_CTRL3",
+ .addr = A_LPDDR_CTRL3,
+ .reset = 0x00000601 },
+};
+
+static void zynq_ddrctrl_reset(DeviceState *dev)
+{
+ DDRCTRLState *s = DDRCTRL(dev);
+ int i;
+
+ for (i = 0; i < ZYNQ_DDRCTRL_NUM_REG; ++i) {
+ register_reset(&s->regs_info[i]);
+ }
+}
+
+static const MemoryRegionOps ddrctrl_ops = {
+ .read = register_read_memory,
+ .write = register_write_memory,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static const VMStateDescription vmstate_zynq_ddrctrl = {
+ .name = "zynq_ddrc",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (const VMStateField[]) {
+ VMSTATE_UINT32_ARRAY(reg, DDRCTRLState, ZYNQ_DDRCTRL_NUM_REG),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static void zynq_ddrctrl_init(Object *obj)
+{
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+ DDRCTRLState *s = DDRCTRL(obj);
+
+ s->reg_array =
+ register_init_block32(DEVICE(obj), xlnx_zynq_ddrc_regs_info,
+ ARRAY_SIZE(xlnx_zynq_ddrc_regs_info),
+ s->regs_info, s->reg,
+ &ddrctrl_ops,
+ DDRCTRL_ERR_DEBUG,
+ ZYNQ_DDRCTRL_MMIO_SIZE);
+
+ sysbus_init_mmio(sbd, &s->reg_array->mem);
+}
+
+static void zynq_ddrctrl_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+
+ device_class_set_legacy_reset(dc, zynq_ddrctrl_reset);
+ dc->vmsd = &vmstate_zynq_ddrctrl;
+}
+
+static const TypeInfo ddrctrl_info = {
+ .name = TYPE_DDRCTRL,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(DDRCTRLState),
+ .instance_init = zynq_ddrctrl_init,
+ .class_init = zynq_ddrctrl_class_init,
+};
+
+static void ddrctrl_register_types(void)
+{
+ type_register_static(&ddrctrl_info);
+}
+
+type_init(ddrctrl_register_types)
diff --git a/include/hw/misc/xlnx-zynq-ddrc.h b/include/hw/misc/xlnx-zynq-ddrc.h
new file mode 100644
index 0000000000..3d45a02176
--- /dev/null
+++ b/include/hw/misc/xlnx-zynq-ddrc.h
@@ -0,0 +1,148 @@
+/*
+ * QEMU model of the Xilinx Zynq Double Data Rate Controller
+ *
+ * Copyright (c) Beckhoff Automation GmbH. & Co. KG
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef XLNX_ZYNQ_DDRC_H
+#define XLNX_ZYNQ_DDRC_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+
+#define TYPE_DDRCTRL "zynq.ddr-ctlr"
+#define DDRCTRL(obj) \
+ OBJECT_CHECK(DDRCTRLState, (obj), TYPE_DDRCTRL)
+
+REG32(DDRC_CTRL, 0x00)
+REG32(TWO_RANK_CFG, 0x04)
+REG32(HPR_REG, 0x08)
+REG32(LPR_REG, 0x0C)
+REG32(WR_REG, 0x10)
+REG32(DRAM_PARAM_REG0, 0x14)
+REG32(DRAM_PARAM_REG1, 0x18)
+REG32(DRAM_PARAM_REG2, 0x1C)
+REG32(DRAM_PARAM_REG3, 0x20)
+REG32(DRAM_PARAM_REG4, 0x24)
+REG32(DRAM_INIT_PARAM, 0x28)
+REG32(DRAM_EMR_REG, 0x2C)
+REG32(DRAM_EMR_MR_REG, 0x30)
+REG32(DRAM_BURST8_RDWR, 0x34)
+REG32(DRAM_DISABLE_DQ, 0x38)
+REG32(DRAM_ADDR_MAP_BANK, 0x3C)
+REG32(DRAM_ADDR_MAP_COL, 0x40)
+REG32(DRAM_ADDR_MAP_ROW, 0x44)
+REG32(DRAM_ODT_REG, 0x48)
+REG32(PHY_DBG_REG, 0x4C)
+REG32(PHY_CMD_TIMEOUT_RDDATA_CPT, 0x50)
+REG32(MODE_STS_REG, 0x54)
+ FIELD(MODE_STS_REG, DDR_REG_DBG_STALL, 3, 3)
+ FIELD(MODE_STS_REG, DDR_REG_OPERATING_MODE, 0, 2)
+REG32(DLL_CALIB, 0x58)
+REG32(ODT_DELAY_HOLD, 0x5C)
+REG32(CTRL_REG1, 0x60)
+REG32(CTRL_REG2, 0x64)
+REG32(CTRL_REG3, 0x68)
+REG32(CTRL_REG4, 0x6C)
+REG32(CTRL_REG5, 0x78)
+REG32(CTRL_REG6, 0x7C)
+REG32(CHE_REFRESH_TIMER0, 0xA0)
+REG32(CHE_T_ZQ, 0xA4)
+REG32(CHE_T_ZQ_SHORT_INTERVAL_REG, 0xA8)
+REG32(DEEP_PWRDWN_REG, 0xAC)
+REG32(REG_2C, 0xB0)
+REG32(REG_2D, 0xB4)
+REG32(DFI_TIMING, 0xB8)
+REG32(CHE_ECC_CONTROL_REG_OFFSET, 0xC4)
+REG32(CHE_CORR_ECC_LOG_REG_OFFSET, 0xC8)
+REG32(CHE_CORR_ECC_ADDR_REG_OFFSET, 0xCC)
+REG32(CHE_CORR_ECC_DATA_31_0_REG_OFFSET, 0xD0)
+REG32(CHE_CORR_ECC_DATA_63_32_REG_OFFSET, 0xD4)
+REG32(CHE_CORR_ECC_DATA_71_64_REG_OFFSET, 0xD8)
+REG32(CHE_UNCORR_ECC_LOG_REG_OFFSET, 0xDC)
+REG32(CHE_UNCORR_ECC_ADDR_REG_OFFSET, 0xE0)
+REG32(CHE_UNCORR_ECC_DATA_31_0_REG_OFFSET, 0xE4)
+REG32(CHE_UNCORR_ECC_DATA_63_32_REG_OFFSET, 0xE8)
+REG32(CHE_UNCORR_ECC_DATA_71_64_REG_OFFSET, 0xEC)
+REG32(CHE_ECC_STATS_REG_OFFSET, 0xF0)
+REG32(ECC_SCRUB, 0xF4)
+REG32(CHE_ECC_CORR_BIT_MASK_31_0_REG_OFFSET, 0xF8)
+REG32(CHE_ECC_CORR_BIT_MASK_63_32_REG_OFFSET, 0xFC)
+REG32(PHY_RCVER_ENABLE, 0x114)
+REG32(PHY_CONFIG0, 0x118)
+REG32(PHY_CONFIG1, 0x11C)
+REG32(PHY_CONFIG2, 0x120)
+REG32(PHY_CONFIG3, 0x124)
+REG32(PHY_INIT_RATIO0, 0x12C)
+REG32(PHY_INIT_RATIO1, 0x130)
+REG32(PHY_INIT_RATIO2, 0x134)
+REG32(PHY_INIT_RATIO3, 0x138)
+REG32(PHY_RD_DQS_CFG0, 0x140)
+REG32(PHY_RD_DQS_CFG1, 0x144)
+REG32(PHY_RD_DQS_CFG2, 0x148)
+REG32(PHY_RD_DQS_CFG3, 0x14C)
+REG32(PHY_WR_DQS_CFG0, 0x154)
+REG32(PHY_WR_DQS_CFG1, 0x158)
+REG32(PHY_WR_DQS_CFG2, 0x15C)
+REG32(PHY_WR_DQS_CFG3, 0x160)
+REG32(PHY_WE_CFG0, 0x168)
+REG32(PHY_WE_CFG1, 0x16C)
+REG32(PHY_WE_CFG2, 0x170)
+REG32(PHY_WE_CFG3, 0x174)
+REG32(WR_DATA_SLV0, 0x17C)
+REG32(WR_DATA_SLV1, 0x180)
+REG32(WR_DATA_SLV2, 0x184)
+REG32(WR_DATA_SLV3, 0x188)
+REG32(REG_64, 0x190)
+REG32(REG_65, 0x194)
+REG32(REG69_6A0, 0x1A4)
+REG32(REG69_6A1, 0x1A8)
+REG32(REG6C_6D2, 0x1B0)
+REG32(REG6C_6D3, 0x1B4)
+REG32(REG6E_710, 0x1B8)
+REG32(REG6E_711, 0x1BC)
+REG32(REG6E_712, 0x1C0)
+REG32(REG6E_713, 0x1C4)
+REG32(PHY_DLL_STS0, 0x1CC)
+REG32(PHY_DLL_STS1, 0x1D0)
+REG32(PHY_DLL_STS2, 0x1D4)
+REG32(PHY_DLL_STS3, 0x1D8)
+REG32(DLL_LOCK_STS, 0x1E0)
+REG32(PHY_CTRL_STS, 0x1E4)
+REG32(PHY_CTRL_STS_REG2, 0x1E8)
+REG32(AXI_ID, 0x200)
+REG32(PAGE_MASK, 0x204)
+REG32(AXI_PRIORITY_WR_PORT0, 0x208)
+REG32(AXI_PRIORITY_WR_PORT1, 0x20C)
+REG32(AXI_PRIORITY_WR_PORT2, 0x210)
+REG32(AXI_PRIORITY_WR_PORT3, 0x214)
+REG32(AXI_PRIORITY_RD_PORT0, 0x218)
+REG32(AXI_PRIORITY_RD_PORT1, 0x21C)
+REG32(AXI_PRIORITY_RD_PORT2, 0x220)
+REG32(AXI_PRIORITY_RD_PORT3, 0x224)
+REG32(EXCL_ACCESS_CFG0, 0x294)
+REG32(EXCL_ACCESS_CFG1, 0x298)
+REG32(EXCL_ACCESS_CFG2, 0x29C)
+REG32(EXCL_ACCESS_CFG3, 0x2A0)
+REG32(MODE_REG_READ, 0x2A4)
+REG32(LPDDR_CTRL0, 0x2A8)
+REG32(LPDDR_CTRL1, 0x2AC)
+REG32(LPDDR_CTRL2, 0x2B0)
+REG32(LPDDR_CTRL3, 0x2B4)
+
+
+#define ZYNQ_DDRCTRL_MMIO_SIZE 0x400
+#define ZYNQ_DDRCTRL_NUM_REG (ZYNQ_DDRCTRL_MMIO_SIZE / 4)
+
+typedef struct DDRCTRLState {
+ SysBusDevice parent_obj;
+
+ MemoryRegion iomem;
+
+ RegisterInfoArray *reg_array;
+ uint32_t reg[ZYNQ_DDRCTRL_NUM_REG];
+ RegisterInfo regs_info[ZYNQ_DDRCTRL_NUM_REG];
+} DDRCTRLState;
+#endif
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 09/15] hw/misc/zynq_slcr: Add logic for DCI configuration
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (7 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 08/15] hw/misc: Add dummy ZYNQ DDR controller Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 10/15] hw/misc: Add Beckhoff CCAT device Corvin Köhne
` (6 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV, Edgar E. Iglesias
From: YannickV <Y.Vossen@beckhoff.com>
The registers for the digitally controlled impedance (DCI) clock are
part of the system level control registers (SLCR). The DONE bit in
the status register indicates a successfull DCI calibration. An
description of the calibration process can be found here:
https://docs.amd.com/r/en-US/ug585-zynq-7000-SoC-TRM/DDR-IOB-Impedance-Calibration
The DCI control register and status register have been added. As soon
as the ENABLE and RESET bit are set, the RESET bit has also been toggled
to 0 before and the UPDATE_CONTROL is not set, the DONE bit in the status
register is set. If these bits change the DONE bit is reset. Note that the
option bits are not taken into consideration.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
---
hw/misc/zynq_slcr.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index 010387beec..d8702da4ce 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -180,6 +180,12 @@ REG32(GPIOB_CFG_HSTL, 0xb14)
REG32(GPIOB_DRVR_BIAS_CTRL, 0xb18)
REG32(DDRIOB, 0xb40)
+REG32(DDRIOB_DCI_CTRL, 0xb70)
+ FIELD(DDRIOB_DCI_CTRL, RESET, 0, 1)
+ FIELD(DDRIOB_DCI_CTRL, ENABLE, 1, 1)
+ FIELD(DDRIOB_DCI_CTRL, UPDATE_CONTROL, 20, 1)
+REG32(DDRIOB_DCI_STATUS, 0xb74)
+ FIELD(DDRIOB_DCI_STATUS, DONE, 13, 1)
#define DDRIOB_LENGTH 14
#define ZYNQ_SLCR_MMIO_SIZE 0x1000
@@ -193,6 +199,8 @@ struct ZynqSLCRState {
MemoryRegion iomem;
+ bool ddriob_dci_ctrl_reset_toggled;
+
uint32_t regs[ZYNQ_SLCR_NUM_REGS];
Clock *ps_clk;
@@ -331,6 +339,8 @@ static void zynq_slcr_reset_init(Object *obj, ResetType type)
DB_PRINT("RESET\n");
+ s->ddriob_dci_ctrl_reset_toggled = false;
+
s->regs[R_LOCKSTA] = 1;
/* 0x100 - 0x11C */
s->regs[R_ARM_PLL_CTRL] = 0x0001A008;
@@ -418,6 +428,8 @@ static void zynq_slcr_reset_init(Object *obj, ResetType type)
s->regs[R_DDRIOB + 4] = s->regs[R_DDRIOB + 5] = s->regs[R_DDRIOB + 6]
= 0x00000e00;
s->regs[R_DDRIOB + 12] = 0x00000021;
+
+ s->regs[R_DDRIOB_DCI_CTRL] = 0x00000020;
}
static void zynq_slcr_reset_hold(Object *obj, ResetType type)
@@ -554,6 +566,25 @@ static void zynq_slcr_write(void *opaque, hwaddr offset,
(int)offset, (unsigned)val & 0xFFFF);
}
return;
+
+ case R_DDRIOB_DCI_CTRL:
+ if (!FIELD_EX32(val, DDRIOB_DCI_CTRL, RESET) &&
+ FIELD_EX32(s->regs[R_DDRIOB_DCI_CTRL], DDRIOB_DCI_CTRL, RESET)) {
+
+ s->ddriob_dci_ctrl_reset_toggled = true;
+ DB_PRINT("DDRIOB DCI CTRL RESET was toggled\n");
+ }
+
+ if (FIELD_EX32(val, DDRIOB_DCI_CTRL, ENABLE) &&
+ FIELD_EX32(val, DDRIOB_DCI_CTRL, RESET) &&
+ !FIELD_EX32(val, DDRIOB_DCI_CTRL, UPDATE_CONTROL) &&
+ s->ddriob_dci_ctrl_reset_toggled) {
+
+ s->regs[R_DDRIOB_DCI_STATUS] |= R_DDRIOB_DCI_STATUS_DONE_MASK;
+ } else {
+ s->regs[R_DDRIOB_DCI_STATUS] &= ~R_DDRIOB_DCI_STATUS_DONE_MASK;
+ }
+ break;
}
if (s->regs[R_LOCKSTA]) {
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 10/15] hw/misc: Add Beckhoff CCAT device
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (8 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 09/15] hw/misc/zynq_slcr: Add logic for DCI configuration Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 11/15] hw/block/m25p80: Add HAS_SR_TB flag for is25lp016d Corvin Köhne
` (5 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
This adds the Beckhoff Communication Controller (CCAT). The information
block, EEPROM interface and DMA controller are currently implemented.
The EEPROM provides production information for Beckhoff Devices.
An EEPORM binary must therefor be handed over. It should be aligned to
a power of two. If no EEPROM binary is handed over an empty EEPROM of
size 4096 is initialized.
This device is needed for the Beckhoff CX7200 board emulation.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/misc/Kconfig | 3 +
hw/misc/beckhoff_ccat.c | 339 ++++++++++++++++++++++++++++++++++++++++
hw/misc/meson.build | 1 +
3 files changed, 343 insertions(+)
create mode 100644 hw/misc/beckhoff_ccat.c
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 3de37c9e1d..1eb57b421f 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -243,4 +243,7 @@ config XLNX_VERSAL_TRNG
config XLNX_ZYNQ_DDRC
bool
+config BECKHOFF_CCAT
+ bool
+
source macio/Kconfig
diff --git a/hw/misc/beckhoff_ccat.c b/hw/misc/beckhoff_ccat.c
new file mode 100644
index 0000000000..afc7a9e338
--- /dev/null
+++ b/hw/misc/beckhoff_ccat.c
@@ -0,0 +1,339 @@
+/*
+ * Beckhoff Communication Controller Emulation
+ *
+ * Copyright (c) Beckhoff Automation GmbH. & Co. KG
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "qemu/units.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "system/block-backend.h"
+#include "system/address-spaces.h"
+#include "system/memory.h"
+#include "system/dma.h"
+#include "qemu/error-report.h"
+#include "block/block.h"
+#include "block/block_int.h"
+#include "block/qdict.h"
+#include "hw/block/block.h"
+#include "migration/vmstate.h"
+#include "qemu/bswap.h"
+
+#ifndef CCAT_ERR_DEBUG
+#define CCAT_ERR_DEBUG 0
+#endif
+
+#define TYPE_BECKHOFF_CCAT "beckhoff-ccat"
+OBJECT_DECLARE_SIMPLE_TYPE(BeckhoffCcat, BECKHOFF_CCAT)
+
+#define MAX_NUM_SLOTS 32
+#define CCAT_FUNCTION_BLOCK_SIZE 16
+
+#define CCAT_EEPROM_OFFSET 0x100
+#define CCAT_DMA_OFFSET 0x8000
+
+#define CCAT_MEM_SIZE (64 * KiB)
+#define CCAT_DMA_SIZE 0x800
+#define CCAT_EEPROM_SIZE 0x20
+
+#define EEPROM_MEMORY_SIZE 0x1000
+
+#define EEPROM_CMD_OFFSET (CCAT_EEPROM_OFFSET + 0x00)
+ #define EEPROM_CMD_WRITE_MASK 0x2
+ #define EEPROM_CMD_READ_MASK 0x1
+#define EEPROM_ADR_OFFSET (CCAT_EEPROM_OFFSET + 0x04)
+#define EEPROM_DATA_OFFSET (CCAT_EEPROM_OFFSET + 0x08)
+
+#define DMA_BUFFER_OFFSET (CCAT_DMA_OFFSET + 0x00)
+#define DMA_DIRECTION_OFFSET (CCAT_DMA_OFFSET + 0x7c0)
+ #define DMA_DIRECTION_MASK 1
+#define DMA_TRANSFER_OFFSET (CCAT_DMA_OFFSET + 0x7c4)
+#define DMA_HOST_ADR_OFFSET (CCAT_DMA_OFFSET + 0x7c8)
+#define DMA_TRANSFER_LENGTH_OFFSET (CCAT_DMA_OFFSET + 0x7cc)
+
+/*
+ * The informationblock is always located at address 0x0.
+ * Address and size are therefor replaced by two identifiers.
+ * The Parameter give information about the maximal number of
+ * function slots and the creation date (in this case 01.01.2001)
+ */
+#define CCAT_ID_1 0x88a4
+#define CCAT_ID_2 0x54414343
+#define CCAT_INFO_BLOCK_PARAMS ((MAX_NUM_SLOTS << 0) | (0x1 << 8) | \
+ (0x1 << 16) | (0x1 << 24))
+
+#define CCAT_FUN_TYPE_ENTRY 0x0001
+#define CCAT_FUN_TYPE_EEPROM 0x0012
+#define CCAT_FUN_TYPE_DMA 0x0013
+
+typedef struct BeckhoffCcat {
+ SysBusDevice parent_obj;
+
+ MemoryRegion iomem;
+
+ uint8_t mem[CCAT_MEM_SIZE];
+
+ BlockBackend *eeprom_blk;
+ uint8_t *eeprom_storage;
+ uint32_t eeprom_size;
+} BeckhoffCcat;
+
+static void sync_eeprom(BeckhoffCcat *s)
+{
+ if (!s->eeprom_blk) {
+ return;
+ }
+ blk_pwrite(s->eeprom_blk, 0, s->eeprom_size, s->eeprom_storage, 0);
+}
+
+static uint64_t beckhoff_ccat_eeprom_read(void *opaque, hwaddr addr,
+ unsigned size)
+{
+ BeckhoffCcat *s = opaque;
+ return ldn_le_p(&s->mem[addr], size);
+}
+
+static void beckhoff_ccat_eeprom_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned size)
+{
+ BeckhoffCcat *s = opaque;
+ uint64_t eeprom_adr;
+ uint64_t buf;
+ uint32_t bytes_to_read;
+
+ switch (addr) {
+ case EEPROM_CMD_OFFSET:
+ eeprom_adr = ldl_le_p(&s->mem[EEPROM_ADR_OFFSET]);
+ eeprom_adr = (eeprom_adr * 2) % s->eeprom_size;
+ if (val & EEPROM_CMD_READ_MASK) {
+ buf = 0;
+ bytes_to_read = 8;
+ if (eeprom_adr > s->eeprom_size - 8) {
+ bytes_to_read = s->eeprom_size - eeprom_adr;
+ }
+ buf = ldn_le_p(s->eeprom_storage + eeprom_adr, bytes_to_read);
+ stq_le_p(&s->mem[EEPROM_DATA_OFFSET], buf);
+ } else if (val & EEPROM_CMD_WRITE_MASK) {
+ buf = ldl_le_p(&s->mem[EEPROM_DATA_OFFSET]);
+ stw_le_p((uint16_t *)(s->eeprom_storage + eeprom_adr), buf);
+ sync_eeprom(s);
+ }
+ break;
+ default:
+ stn_le_p(&s->mem[addr], size, val);
+ }
+}
+
+static uint64_t beckhoff_ccat_dma_read(void *opaque, hwaddr addr, unsigned size)
+{
+ BeckhoffCcat *s = opaque;
+
+ switch (addr) {
+ case DMA_TRANSFER_OFFSET:
+ if (s->mem[DMA_TRANSFER_OFFSET] & 0x1) {
+ s->mem[DMA_TRANSFER_OFFSET] = 0;
+ }
+ break;
+ }
+ return ldn_le_p(&s->mem[addr], size);
+}
+
+static void beckhoff_ccat_dma_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned size)
+{
+ BeckhoffCcat *s = opaque;
+ dma_addr_t dmaAddr;
+ uint8_t len;
+ uint8_t *mem_buf;
+
+ switch (addr) {
+ case DMA_TRANSFER_OFFSET:
+ len = s->mem[DMA_TRANSFER_LENGTH_OFFSET];
+ mem_buf = &s->mem[DMA_BUFFER_OFFSET];
+ dmaAddr = ldl_le_p(&s->mem[DMA_HOST_ADR_OFFSET]);
+ if (s->mem[DMA_DIRECTION_OFFSET] & DMA_DIRECTION_MASK) {
+ dma_memory_read(&address_space_memory, dmaAddr,
+ mem_buf, len * 8, MEMTXATTRS_UNSPECIFIED);
+ } else {
+ /*
+ * The write transfer uses Host DMA Address + 8 as the target
+ * offset, as described in the CCAT manual Version 0.0.41
+ * section 20.2.
+ */
+ dma_memory_write(&address_space_memory, dmaAddr + 8,
+ mem_buf, len * 8, MEMTXATTRS_UNSPECIFIED);
+ }
+ break;
+ }
+ stn_le_p(&s->mem[addr], size, val);
+}
+
+static uint64_t beckhoff_ccat_read(void *opaque, hwaddr addr, unsigned size)
+{
+ BeckhoffCcat *s = opaque;
+ uint64_t val = 0;
+
+ assert(addr <= CCAT_MEM_SIZE - size);
+
+ if (addr >= CCAT_EEPROM_OFFSET &&
+ addr <= CCAT_EEPROM_OFFSET + s->eeprom_size) {
+ return beckhoff_ccat_eeprom_read(opaque, addr, size);
+ } else if (addr >= CCAT_DMA_OFFSET &&
+ addr <= CCAT_DMA_OFFSET + CCAT_DMA_SIZE) {
+ return beckhoff_ccat_dma_read(opaque, addr, size);
+ } else {
+ val = ldn_le_p(&s->mem[addr], size);
+ }
+
+ return val;
+}
+
+static void beckhoff_ccat_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned size)
+{
+ BeckhoffCcat *s = opaque;
+
+ assert(addr <= CCAT_MEM_SIZE - size);
+
+ if (addr >= CCAT_EEPROM_OFFSET &&
+ addr <= CCAT_EEPROM_OFFSET + s->eeprom_size) {
+ beckhoff_ccat_eeprom_write(opaque, addr, val, size);
+ } else if (addr >= CCAT_DMA_OFFSET &&
+ addr <= CCAT_DMA_OFFSET + CCAT_DMA_SIZE) {
+ beckhoff_ccat_dma_write(opaque, addr, val, size);
+ } else {
+ stn_le_p(&s->mem[addr], size, val);
+ }
+}
+
+static const MemoryRegionOps beckhoff_ccat_ops = {
+ .read = beckhoff_ccat_read,
+ .write = beckhoff_ccat_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid = {
+ .min_access_size = 1,
+ .max_access_size = 8,
+ },
+};
+
+static void beckhoff_ccat_reset(DeviceState *dev)
+{
+ BeckhoffCcat *s = BECKHOFF_CCAT(dev);
+
+ memset(&s->mem[0], 0, MAX_NUM_SLOTS * CCAT_FUNCTION_BLOCK_SIZE);
+
+ size_t offset = 0 * CCAT_FUNCTION_BLOCK_SIZE;
+ stw_le_p(&s->mem[offset + 0], CCAT_FUN_TYPE_ENTRY);
+ stw_le_p(&s->mem[offset + 2], 0x0001);
+ stl_le_p(&s->mem[offset + 4], CCAT_INFO_BLOCK_PARAMS);
+ stl_le_p(&s->mem[offset + 8], CCAT_ID_1);
+ stl_le_p(&s->mem[offset + 12], CCAT_ID_2);
+
+ offset = 11 * CCAT_FUNCTION_BLOCK_SIZE;
+ stw_le_p(&s->mem[offset + 0], CCAT_FUN_TYPE_EEPROM);
+ stw_le_p(&s->mem[offset + 2], 0x0001);
+ stl_le_p(&s->mem[offset + 4], 0);
+ stl_le_p(&s->mem[offset + 8], CCAT_EEPROM_OFFSET);
+ stl_le_p(&s->mem[offset + 12], CCAT_EEPROM_SIZE);
+
+ offset = 15 * CCAT_FUNCTION_BLOCK_SIZE;
+ stw_le_p(&s->mem[offset + 0], CCAT_FUN_TYPE_DMA);
+ stw_le_p(&s->mem[offset + 2], 0x0000);
+ stl_le_p(&s->mem[offset + 4], 0);
+ stl_le_p(&s->mem[offset + 8], CCAT_DMA_OFFSET);
+ stl_le_p(&s->mem[offset + 12], CCAT_DMA_SIZE);
+}
+
+static void beckhoff_ccat_realize(DeviceState *dev, Error **errp)
+{
+ BeckhoffCcat *s = BECKHOFF_CCAT(dev);
+ BlockBackend *blk;
+
+ blk = s->eeprom_blk;
+
+ if (blk) {
+ uint64_t blk_size = blk_getlength(blk);
+ if (!is_power_of_2(blk_size)) {
+ error_setg(errp, "Blockend size is not a power of two.");
+ return;
+ }
+
+ if (blk_size < 512) {
+ error_setg(errp, "Blockend size is too small.");
+ return;
+ } else {
+ blk_set_perm(blk, BLK_PERM_WRITE, BLK_PERM_ALL, errp);
+
+ s->eeprom_size = blk_size;
+ s->eeprom_blk = blk;
+ s->eeprom_storage = blk_blockalign(s->eeprom_blk, s->eeprom_size);
+
+ if (!blk_check_size_and_read_all(s->eeprom_blk, DEVICE(s),
+ s->eeprom_storage, s->eeprom_size,
+ errp)) {
+ return;
+ }
+ }
+ } else {
+ s->eeprom_size = EEPROM_MEMORY_SIZE;
+ s->eeprom_storage = blk_blockalign(NULL, s->eeprom_size);
+ memset(s->eeprom_storage, 0x00, s->eeprom_size);
+ }
+}
+
+static void beckhoff_ccat_init(Object *obj)
+{
+ BeckhoffCcat *s = BECKHOFF_CCAT(obj);
+ SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+ memory_region_init_io(&s->iomem, obj, &beckhoff_ccat_ops, s,
+ TYPE_BECKHOFF_CCAT, CCAT_MEM_SIZE);
+ sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static const VMStateDescription vmstate_beckhoff_ccat = {
+ .name = "beckhoff-ccat",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .fields = (const VMStateField[]) {
+ VMSTATE_UINT8_ARRAY(mem, BeckhoffCcat, CCAT_MEM_SIZE),
+ VMSTATE_UINT32(eeprom_size, BeckhoffCcat),
+ VMSTATE_VBUFFER_UINT32(eeprom_storage, BeckhoffCcat, 1, NULL,
+ eeprom_size),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static const Property beckhoff_ccat_properties[] = {
+ DEFINE_PROP_DRIVE("eeprom", BeckhoffCcat, eeprom_blk),
+};
+
+static void beckhoff_ccat_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ dc->realize = beckhoff_ccat_realize;
+ device_class_set_legacy_reset(dc, beckhoff_ccat_reset);
+ dc->vmsd = &vmstate_beckhoff_ccat;
+ device_class_set_props(dc, beckhoff_ccat_properties);
+}
+
+static const TypeInfo beckhoff_ccat_info = {
+ .name = TYPE_BECKHOFF_CCAT,
+ .parent = TYPE_SYS_BUS_DEVICE,
+ .instance_size = sizeof(BeckhoffCcat),
+ .instance_init = beckhoff_ccat_init,
+ .class_init = beckhoff_ccat_class_init,
+};
+
+static void beckhoff_ccat_register_types(void)
+{
+ type_register_static(&beckhoff_ccat_info);
+}
+
+type_init(beckhoff_ccat_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index ffbcca9796..cd76e04a33 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -14,6 +14,7 @@ system_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
system_ss.add(when: 'CONFIG_INTEGRATOR_DEBUG', if_true: files('arm_integrator_debug.c'))
system_ss.add(when: 'CONFIG_A9SCU', if_true: files('a9scu.c'))
system_ss.add(when: 'CONFIG_ARM11SCU', if_true: files('arm11scu.c'))
+system_ss.add(when: 'CONFIG_BECKHOFF_CCAT', if_true: files('beckhoff_ccat.c'))
system_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_ras.c'))
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 11/15] hw/block/m25p80: Add HAS_SR_TB flag for is25lp016d
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (9 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 10/15] hw/misc: Add Beckhoff CCAT device Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:34 ` [PATCH v5 12/15] hw/arm/xilinx_zynq: Split xilinx_zynq into header and implementation files Corvin Köhne
` (4 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
The is25lp016d has 4 Block Write Protect Bits. BP3 specifies
whether the upper or lower range should be protected. Therefore,
we add the HAS_SR_TB flag to the is25lp016d flags.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/block/m25p80.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index a5336d92ff..1df223ee81 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -217,7 +217,8 @@ static const FlashPartInfo known_devices[] = {
/* ISSI */
{ INFO("is25lq040b", 0x9d4013, 0, 64 << 10, 8, ER_4K) },
{ INFO("is25lp080d", 0x9d6014, 0, 64 << 10, 16, ER_4K) },
- { INFO("is25lp016d", 0x9d6015, 0, 64 << 10, 32, ER_4K) },
+ { INFO("is25lp016d", 0x9d6015, 0, 64 << 10, 32,
+ ER_4K | HAS_SR_TB) },
{ INFO("is25lp032", 0x9d6016, 0, 64 << 10, 64, ER_4K) },
{ INFO("is25lp064", 0x9d6017, 0, 64 << 10, 128, ER_4K) },
{ INFO("is25lp128", 0x9d6018, 0, 64 << 10, 256, ER_4K) },
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 12/15] hw/arm/xilinx_zynq: Split xilinx_zynq into header and implementation files
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (10 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 11/15] hw/block/m25p80: Add HAS_SR_TB flag for is25lp016d Corvin Köhne
@ 2025-12-04 9:34 ` Corvin Köhne
2025-12-04 9:35 ` [PATCH v5 13/15] hw/arm/xilinx_zynq: Add flash-type property Corvin Köhne
` (3 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:34 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
Create xilinx_zynq.h header file to expose ZynqMachineState and
related definitions for machine inheritance. This enables creation
of derived machines based on the Zynq platform.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/arm/xilinx_zynq.c | 13 +------------
include/hw/arm/xilinx_zynq.h | 36 ++++++++++++++++++++++++++++++++++++
2 files changed, 37 insertions(+), 12 deletions(-)
create mode 100644 include/hw/arm/xilinx_zynq.h
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index c03ed09a67..4d095ab6f3 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -41,9 +41,7 @@
#include "exec/tswap.h"
#include "target/arm/cpu-qom.h"
#include "qapi/visitor.h"
-
-#define TYPE_ZYNQ_MACHINE MACHINE_TYPE_NAME("xilinx-zynq-a9")
-OBJECT_DECLARE_SIMPLE_TYPE(ZynqMachineState, ZYNQ_MACHINE)
+#include "hw/arm/xilinx_zynq.h"
/* board base frequency: 33.333333 MHz */
#define PS_CLK_FREQUENCY (100 * 1000 * 1000 / 3)
@@ -87,15 +85,6 @@ static const int dma_irqs[8] = {
0xe3401000 + ARMV7_IMM16(extract32((val), 16, 16)), /* movt r1 ... */ \
0xe5801000 + (addr)
-#define ZYNQ_MAX_CPUS 2
-
-struct ZynqMachineState {
- MachineState parent;
- Clock *ps_clk;
- ARMCPU *cpu[ZYNQ_MAX_CPUS];
- uint8_t boot_mode;
-};
-
static void zynq_write_board_setup(ARMCPU *cpu,
const struct arm_boot_info *info)
{
diff --git a/include/hw/arm/xilinx_zynq.h b/include/hw/arm/xilinx_zynq.h
new file mode 100644
index 0000000000..ec80441e7c
--- /dev/null
+++ b/include/hw/arm/xilinx_zynq.h
@@ -0,0 +1,36 @@
+/*
+ * Xilinx Zynq Baseboard System emulation.
+ *
+ * Copyright (c) 2010 Xilinx.
+ * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.croshtwaite@petalogix.com)
+ * Copyright (c) 2012 Petalogix Pty Ltd.
+ * Written by Haibing Ma
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef QEMU_ARM_ZYNQ_H
+#define QEMU_ARM_ZYNQ_H
+
+#include "target/arm/cpu-qom.h"
+#include "hw/qdev-clock.h"
+
+#define TYPE_ZYNQ_MACHINE MACHINE_TYPE_NAME("xilinx-zynq-a9")
+OBJECT_DECLARE_SIMPLE_TYPE(ZynqMachineState, ZYNQ_MACHINE)
+
+#define ZYNQ_MAX_CPUS 2
+
+struct ZynqMachineState {
+ MachineState parent;
+ Clock *ps_clk;
+ ARMCPU *cpu[ZYNQ_MAX_CPUS];
+ uint8_t boot_mode;
+};
+
+#endif /* QEMU_ARM_ZYNQ_H */
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 13/15] hw/arm/xilinx_zynq: Add flash-type property
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (11 preceding siblings ...)
2025-12-04 9:34 ` [PATCH v5 12/15] hw/arm/xilinx_zynq: Split xilinx_zynq into header and implementation files Corvin Köhne
@ 2025-12-04 9:35 ` Corvin Köhne
2025-12-04 9:35 ` [PATCH v5 14/15] hw/arm: Add new machine based on xilinx-zynq-a9 for Beckhoff CX7200 Corvin Köhne
` (2 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:35 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
Read flash-type value as machine property and set the flash type
accordingly.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/arm/xilinx_zynq.c | 25 ++++++++++++++++++++-----
include/hw/arm/xilinx_zynq.h | 1 +
2 files changed, 21 insertions(+), 5 deletions(-)
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 4d095ab6f3..db4fac17c8 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -120,7 +120,8 @@ static void gem_init(uint32_t base, qemu_irq irq)
}
static inline int zynq_init_spi_flashes(uint32_t base_addr, qemu_irq irq,
- bool is_qspi, int unit0)
+ bool is_qspi, int unit0,
+ const char *flash_type)
{
int unit = unit0;
DeviceState *dev;
@@ -152,7 +153,7 @@ static inline int zynq_init_spi_flashes(uint32_t base_addr, qemu_irq irq,
for (j = 0; j < num_ss; ++j) {
DriveInfo *dinfo = drive_get(IF_MTD, 0, unit++);
- flash_dev = qdev_new("n25q128");
+ flash_dev = qdev_new(flash_type);
if (dinfo) {
qdev_prop_set_drive_err(flash_dev, "drive",
blk_by_legacy_dinfo(dinfo),
@@ -190,6 +191,14 @@ static void zynq_set_boot_mode(Object *obj, const char *str,
m->boot_mode = mode;
}
+static void zynq_set_flash_type(Object *obj, const char *str,
+ Error **errp)
+{
+ ZynqMachineState *m = ZYNQ_MACHINE(obj);
+ g_free(m->flash_type);
+ m->flash_type = g_strdup(str);
+}
+
static void ddr_ctrl_init(uint32_t base)
{
DeviceState *dev;
@@ -283,9 +292,12 @@ static void zynq_init(MachineState *machine)
pic[n] = qdev_get_gpio_in(dev, n);
}
- n = zynq_init_spi_flashes(0xE0006000, pic[58 - GIC_INTERNAL], false, 0);
- n = zynq_init_spi_flashes(0xE0007000, pic[81 - GIC_INTERNAL], false, n);
- n = zynq_init_spi_flashes(0xE000D000, pic[51 - GIC_INTERNAL], true, n);
+ n = zynq_init_spi_flashes(0xE0006000, pic[58 - GIC_INTERNAL], false, 0,
+ zynq_machine->flash_type);
+ n = zynq_init_spi_flashes(0xE0007000, pic[81 - GIC_INTERNAL], false, n,
+ zynq_machine->flash_type);
+ n = zynq_init_spi_flashes(0xE000D000, pic[51 - GIC_INTERNAL], true, n,
+ zynq_machine->flash_type);
sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - GIC_INTERNAL]);
sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - GIC_INTERNAL]);
@@ -473,6 +485,9 @@ static void zynq_machine_class_init(ObjectClass *oc, const void *data)
"Supported boot modes:"
" jtag qspi sd nor");
object_property_set_default_str(prop, "qspi");
+
+ prop = object_class_property_add_str(oc, "flash-type", NULL, zynq_set_flash_type);
+ object_property_set_default_str(prop, "n25q128");
}
static const TypeInfo zynq_machine_type = {
diff --git a/include/hw/arm/xilinx_zynq.h b/include/hw/arm/xilinx_zynq.h
index ec80441e7c..7379fe3988 100644
--- a/include/hw/arm/xilinx_zynq.h
+++ b/include/hw/arm/xilinx_zynq.h
@@ -31,6 +31,7 @@ struct ZynqMachineState {
Clock *ps_clk;
ARMCPU *cpu[ZYNQ_MAX_CPUS];
uint8_t boot_mode;
+ char *flash_type;
};
#endif /* QEMU_ARM_ZYNQ_H */
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 14/15] hw/arm: Add new machine based on xilinx-zynq-a9 for Beckhoff CX7200
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (12 preceding siblings ...)
2025-12-04 9:35 ` [PATCH v5 13/15] hw/arm/xilinx_zynq: Add flash-type property Corvin Köhne
@ 2025-12-04 9:35 ` Corvin Köhne
2025-12-04 9:35 ` [PATCH v5 15/15] docs/system/arm: Add support " Corvin Köhne
2025-12-04 10:47 ` [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Thomas Huth
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:35 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
Introduce a new machine type 'beckhoff-cx7200' that inherits from the
xilinx-zynq-a9 machine. The CX7200 is an industrial PC based on the
Xilinx Zynq-7000 SoC.
The machine preserves all standard Zynq features (boot-mode selection,
SPI, UART, Ethernet, etc.) while adding CX7200-specific hardware
components.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
hw/arm/Kconfig | 7 +++
hw/arm/beckhoff_CX7200.c | 104 +++++++++++++++++++++++++++++++++++++++
hw/arm/meson.build | 1 +
3 files changed, 112 insertions(+)
create mode 100644 hw/arm/beckhoff_CX7200.c
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 7877506384..00810634d2 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -307,6 +307,13 @@ config ZYNQ
select XILINX_SPIPS
select ZYNQ_DEVCFG
+config BECKHOFF_CX7200
+ bool
+ default y
+ depends on TCG && ARM
+ select ZYNQ
+ select BECKHOFF_CCAT
+
config ARM_V7M
bool
# currently v7M must be included in a TCG build due to translate.c
diff --git a/hw/arm/beckhoff_CX7200.c b/hw/arm/beckhoff_CX7200.c
new file mode 100644
index 0000000000..85e2fd0fd6
--- /dev/null
+++ b/hw/arm/beckhoff_CX7200.c
@@ -0,0 +1,104 @@
+
+/*
+ * Modified Xilinx Zynq Baseboard System emulation for Beckhoff CX7200.
+ *
+ * Copyright (c) 2024 Beckhoff Automation GmbH & Co. KG
+ *
+ * Based on /hw/arm/xilinx_zynq.c:
+ * Copyright (c) 2010 Xilinx.
+ * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.croshtwaite@petalogix.com)
+ * Copyright (c) 2012 Petalogix Pty Ltd.
+ * Original code by Haibing Ma.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/block/block.h"
+#include "hw/loader.h"
+#include "qemu/error-report.h"
+#include "hw/arm/xilinx_zynq.h" /* For ZynqMachineState */
+#include "hw/cpu/a9mpcore.h"
+#include "qom/object.h"
+
+#define TYPE_CX7200_MACHINE MACHINE_TYPE_NAME("beckhoff-cx7200")
+
+#define CX7200_PERIPHCLK_DIVIDER 2
+#define CX7200_PS7_CPU_CLK_FREQUENCY 720000000
+
+static void ccat_init(uint32_t base, BlockBackend *eeprom_blk)
+{
+ DeviceState *dev;
+ SysBusDevice *busdev;
+
+ dev = qdev_new("beckhoff-ccat");
+ if (eeprom_blk) {
+ qdev_prop_set_drive_err(dev, "eeprom", eeprom_blk, &error_fatal);
+ }
+ busdev = SYS_BUS_DEVICE(dev);
+ sysbus_realize_and_unref(busdev, &error_fatal);
+ sysbus_mmio_map(busdev, 0, base);
+}
+
+static void beckhoff_cx7200_init(MachineState *machine)
+{
+ DriveInfo *di;
+ BlockBackend *blk;
+ MachineClass *parent_mc;
+ DeviceState *a9mpcore_dev;
+ A9MPPrivState *a9mp_priv_state;
+
+ object_property_set_str(OBJECT(machine), "flash-type", "is25lp016d",
+ &error_fatal);
+
+ parent_mc = MACHINE_CLASS(object_class_get_parent(
+ object_get_class(OBJECT(machine))));
+ parent_mc->init(machine);
+
+ /* Find A9MPCore and set timer frequencies directly */
+ a9mpcore_dev = DEVICE(object_resolve_path_type("", TYPE_A9MPCORE_PRIV,
+ NULL));
+ if (a9mpcore_dev) {
+ a9mp_priv_state = A9MPCORE_PRIV(a9mpcore_dev);
+
+ /* Direct struct access - devices are already realized */
+ a9mp_priv_state->gtimer.freq_hz = CX7200_PS7_CPU_CLK_FREQUENCY;
+ a9mp_priv_state->gtimer.periphclk_divider = CX7200_PERIPHCLK_DIVIDER;
+ a9mp_priv_state->mptimer.freq_hz = CX7200_PS7_CPU_CLK_FREQUENCY;
+ a9mp_priv_state->mptimer.periphclk_divider = CX7200_PERIPHCLK_DIVIDER;
+ a9mp_priv_state->wdt.freq_hz = CX7200_PS7_CPU_CLK_FREQUENCY;
+ a9mp_priv_state->wdt.periphclk_divider = CX7200_PERIPHCLK_DIVIDER;
+ } else {
+ error_setg(&error_fatal, "Could not find A9MPCore device "
+ "for CX7200 timer configuration");
+ }
+
+ di = drive_get(IF_NONE, 0, 0);
+ blk = di ? blk_by_legacy_dinfo(di) : NULL;
+ ccat_init(0x40000000, blk);
+}
+
+static void beckhoff_cx7200_machine_class_init(ObjectClass *oc,
+ const void *data)
+{
+ MachineClass *mc = MACHINE_CLASS(oc);
+
+ mc->desc = "Beckhoff CX7200 Industrial PC (Zynq-based)";
+ mc->init = beckhoff_cx7200_init;
+}
+
+static const TypeInfo beckhoff_cx7200_machine_type = {
+ .name = TYPE_CX7200_MACHINE,
+ .parent = TYPE_ZYNQ_MACHINE,
+ .class_init = beckhoff_cx7200_machine_class_init,
+ .instance_size = sizeof(ZynqMachineState),
+};
+
+static void beckhoff_cx7200_machine_register_types(void)
+{
+ type_register_static(&beckhoff_cx7200_machine_type);
+}
+
+type_init(beckhoff_cx7200_machine_register_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index aeaf654790..4ea5d2648c 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -2,6 +2,7 @@ arm_ss = ss.source_set()
arm_common_ss = ss.source_set()
arm_common_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
arm_common_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
+arm_common_ss.add(when: 'CONFIG_BECKHOFF_CX7200', if_true: files('beckhoff_CX7200.c'))
arm_common_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
arm_common_ss.add(when: 'CONFIG_EMCRAFT_SF2', if_true: files('msf2-som.c'))
arm_common_ss.add(when: 'CONFIG_HIGHBANK', if_true: files('highbank.c'))
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v5 15/15] docs/system/arm: Add support for Beckhoff CX7200
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (13 preceding siblings ...)
2025-12-04 9:35 ` [PATCH v5 14/15] hw/arm: Add new machine based on xilinx-zynq-a9 for Beckhoff CX7200 Corvin Köhne
@ 2025-12-04 9:35 ` Corvin Köhne
2025-12-04 10:47 ` [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Thomas Huth
15 siblings, 0 replies; 17+ messages in thread
From: Corvin Köhne @ 2025-12-04 9:35 UTC (permalink / raw)
To: qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen, YannickV
From: YannickV <Y.Vossen@beckhoff.com>
This commit offers some documentation on the Beckhoff CX7200
qemu emulation.
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
---
docs/system/arm/beckhoff-cx7200.rst | 57 +++++++++++++++++++++++++++++
docs/system/target-arm.rst | 1 +
2 files changed, 58 insertions(+)
create mode 100644 docs/system/arm/beckhoff-cx7200.rst
diff --git a/docs/system/arm/beckhoff-cx7200.rst b/docs/system/arm/beckhoff-cx7200.rst
new file mode 100644
index 0000000000..f060319b0f
--- /dev/null
+++ b/docs/system/arm/beckhoff-cx7200.rst
@@ -0,0 +1,57 @@
+Beckhoff CX7200 (``beckhoff-cx7200``)
+======================================
+The Beckhoff CX7200 is based on the same architecture as the Xilinx Zynq A9.
+The Zynq 7000 family is based on the AMD SoC architecture. These products
+integrate a feature-rich dual or single-core Arm Cortex-A9 MPCore based
+processing system (PS) and AMD programmable logic (PL) in a single device.
+The Beckhoff Communication Controller (CCAT) can be found in the PL of Zynq.
+
+More details here:
+https://docs.amd.com/r/en-US/ug585-zynq-7000-SoC-TRM/Zynq-7000-SoC-Technical-Reference-Manual
+https://www.beckhoff.com/de-de/produkte/ipc/embedded-pcs/cx7000-arm-r-cortex-r/cx7293.html
+
+The CX7200 supports following devices:
+ - A9 MPCORE
+ - cortex-a9
+ - GIC v1
+ - Generic timer
+ - wdt
+ - OCM 256KB
+ - SMC SRAM@0xe2000000 64MB
+ - Zynq SLCR
+ - SPI x2
+ - QSPI
+ - UART
+ - TTC x2
+ - Gigabit Ethernet Controller
+ - SD Controller
+ - XADC
+ - Arm PrimeCell DMA Controller
+ - DDR Memory
+ - DDR Controller
+ - Beckhoff Communication Controller (CCAT)
+ - EEPROM Interface
+ - DMA Controller
+
+Following devices are not supported:
+ - I2C
+
+Running
+"""""""
+Directly loading an ELF file to the CPU of the CX7200 to run f.e. TC/RTOS (based on FreeRTOS):
+
+.. code-block:: bash
+
+ $ qemu-system-arm -M beckhoff-cx7200 \
+ -device loader,file=CX7200_Zynq_Fsbl.elf \
+ -display none \
+ -icount shift=auto \
+
+
+For setting the EEPROM content of the CCAT provide the following on the command line:
+
+.. code-block:: bash
+
+ -drive file=eeprom.bin,format=raw,id=ccat-eeprom
+
+The size of eeprom.bin must be aligned to a power of 2 and bigger than 256 bytes.
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index a96d1867df..e634872b97 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -82,6 +82,7 @@ Board-specific documentation
arm/aspeed
arm/bananapi_m2u.rst
arm/b-l475e-iot01a.rst
+ arm/beckhoff-cx7200
arm/sabrelite
arm/highbank
arm/digic
--
2.47.3
^ permalink raw reply related [flat|nested] 17+ messages in thread* Re: [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board
2025-12-04 9:34 [PATCH v5 00/15] hw/arm: add Beckhoff CX7200 board Corvin Köhne
` (14 preceding siblings ...)
2025-12-04 9:35 ` [PATCH v5 15/15] docs/system/arm: Add support " Corvin Köhne
@ 2025-12-04 10:47 ` Thomas Huth
15 siblings, 0 replies; 17+ messages in thread
From: Thomas Huth @ 2025-12-04 10:47 UTC (permalink / raw)
To: Corvin Köhne, qemu-devel
Cc: Edgar E. Iglesias, Paolo Bonzini, Alistair Francis, qemu-arm,
Peter Maydell, Kevin Wolf, qemu-block, Corvin Köhne,
Hanna Reitz, Yannick Voßen
On 04/12/2025 10.34, Corvin Köhne wrote:
> From: Corvin Köhne <c.koehne@beckhoff.com>
>
> Hi,
>
> Beckhoff has build a board, called CX7200, based on the Xilinx Zynq A9
> platform. This commit series adds the Beckhoff CX7200 as new board variant to
> QEMU.
>
> The emulation is able to successfully boot an CX7200 image. The image includes
> some self tests executed on every boot. Only the cache self test fails due to
> QEMU emulating the cache as always being coherent. The self tests include f.e.:
>
> * Network
> * Flash
> * CCAT DMA + EEPROM [1]
> * TwinCAT (Beckhoff's automation control software [2])
>
> [1] https://github.com/beckhoff/ccat
> [2] https://www.beckhoff.com/en-us/products/automation/
>
> YannickV (15):
> hw/timer: Make frequency configurable
> hw/timer: Make PERIPHCLK divider configurable
> hw/dma/zynq-devcfg: Handle bitstream loading via DMA to 0xffffffff
> hw/arm/zynq-devcfg: Prevent unintended unlock during initialization
> hw/dma/zynq: Ensure PCFG_DONE bit remains set to indicate PL is in
> user mode
> hw/dma/zynq-devcfg: Simulate dummy PL reset
> hw/dma/zynq-devcfg: Indicate power-up status of PL
> hw/misc: Add dummy ZYNQ DDR controller
> hw/misc/zynq_slcr: Add logic for DCI configuration
> hw/misc: Add Beckhoff CCAT device
> hw/block/m25p80: Add HAS_SR_TB flag for is25lp016d
> hw/arm/xilinx_zynq: Split xilinx_zynq into header and implementation
> files
> hw/arm/xilinx_zynq: Add flash-type property
> hw/arm: Add new machine based on xilinx-zynq-a9 for Beckhoff CX7200
> docs/system/arm: Add support for Beckhoff CX7200
>
> docs/system/arm/beckhoff-cx7200.rst | 57 ++++
> docs/system/target-arm.rst | 1 +
> hw/arm/Kconfig | 7 +
> hw/arm/beckhoff_CX7200.c | 104 +++++++
> hw/arm/meson.build | 1 +
> hw/arm/xilinx_zynq.c | 54 ++--
> hw/block/m25p80.c | 3 +-
> hw/dma/xlnx-zynq-devcfg.c | 27 +-
> hw/misc/Kconfig | 6 +
> hw/misc/beckhoff_ccat.c | 339 +++++++++++++++++++++++
> hw/misc/meson.build | 2 +
> hw/misc/xlnx-zynq-ddrc.c | 413 ++++++++++++++++++++++++++++
> hw/misc/zynq_slcr.c | 31 +++
> hw/timer/a9gtimer.c | 26 +-
> hw/timer/arm_mptimer.c | 32 ++-
> include/hw/arm/xilinx_zynq.h | 37 +++
> include/hw/misc/xlnx-zynq-ddrc.h | 148 ++++++++++
> include/hw/timer/a9gtimer.h | 2 +
> include/hw/timer/arm_mptimer.h | 4 +
Hi!
Looking at the list of changed files, I think this series misses an update
to MAINTAINERS to add the new board there. Could you please add such a patch?
Also, are there any binaries for this board publically available somewhere
on the internet? If so, please also add a functional test for this board to
tests/functional/ - thanks!
Thomas
^ permalink raw reply [flat|nested] 17+ messages in thread