| Message ID | 20230603233612.125879-5-npiggin@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | ppc/pnv: Add chiptod and core timebase state machine models | expand |
On 6/4/23 01:36, Nicholas Piggin wrote: > This implements the core timebase state machine, which is the core side > of the time-of-day system in POWER processors. This facility is operated > by control fields in the TFMR register, which also contains status > fields. > > The core timebase interacts with the chiptod hardware, primarily to > receive TOD updates, to synchronise timebase with other cores. This > model does not actually update TB values with TOD or updates received > from the chiptod, as timebases are always synchronised. It does step > through the states required to perform the update. > > There are several asynchronous state transitions. These are modelled > using using mfTFMR to drive state changes, because it is expected that > firmware poll the register to wait for those states. This is good enough > to test basic firmware behaviour without adding real timers. The values > chosen are arbitrary. > > Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Looks correct, Acked-by: Cédric Le Goater <clg@kaod.org> Thanks, C. > --- > target/ppc/cpu.h | 34 ++++++++ > target/ppc/timebase_helper.c | 147 ++++++++++++++++++++++++++++++++++- > 2 files changed, 179 insertions(+), 2 deletions(-) > > diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h > index d73cce8474..b1520ea4db 100644 > --- a/target/ppc/cpu.h > +++ b/target/ppc/cpu.h > @@ -1177,6 +1177,13 @@ struct CPUArchState { > /* PowerNV chiptod / timebase facility state. */ > int tb_ready_for_tod; /* core TB ready to receive TOD from chiptod */ > int tod_sent_to_tb; /* chiptod sent TOD to the core TB */ > + > + /* > + * Timers for async events are simulated by mfTFAC because TFAC is to be > + * polled for event. > + */ > + int tb_state_timer; > + int tb_sync_pulse_timer; > #endif > #endif > > @@ -2527,6 +2534,33 @@ enum { > HMER_XSCOM_STATUS_MASK = PPC_BITMASK(21, 23), > }; > > +/* TFMR */ > +enum { > + TFMR_CONTROL_MASK = PPC_BITMASK(0, 24), > + TFMR_MASK_HMI = PPC_BIT(10), > + TFMR_TB_ECLIPZ = PPC_BIT(14), > + TFMR_LOAD_TOD_MOD = PPC_BIT(16), > + TFMR_MOVE_CHIP_TOD_TO_TB = PPC_BIT(18), > + TFMR_CLEAR_TB_ERRORS = PPC_BIT(24), > + TFMR_STATUS_MASK = PPC_BITMASK(25, 63), > + TFMR_TBST_ENCODED = PPC_BITMASK(28, 31), /* TBST = TB State */ > + TFMR_TBST_LAST = PPC_BITMASK(32, 35), /* Previous TBST */ > + TFMR_TB_ENABLED = PPC_BIT(40), > + TFMR_TB_VALID = PPC_BIT(41), > + TFMR_TB_SYNC_OCCURED = PPC_BIT(42), > +}; > + > +/* TFMR TBST */ > +enum { > + TBST_RESET = 0x0, > + TBST_SEND_TOD_MOD = 0x1, > + TBST_NOT_SET = 0x2, > + TBST_SYNC_WAIT = 0x6, > + TBST_GET_TOD = 0x7, > + TBST_TB_RUNNING = 0x8, > + TBST_TB_ERROR = 0x9, > +}; > + > /*****************************************************************************/ > > #define is_isa300(ctx) (!!(ctx->insns_flags2 & PPC2_ISA300)) > diff --git a/target/ppc/timebase_helper.c b/target/ppc/timebase_helper.c > index 34b1d5ad05..11a06fafe6 100644 > --- a/target/ppc/timebase_helper.c > +++ b/target/ppc/timebase_helper.c > @@ -272,14 +272,157 @@ void helper_store_booke_tsr(CPUPPCState *env, target_ulong val) > > #if defined(TARGET_PPC64) > /* POWER processor Timebase Facility */ > +static unsigned int tfmr_get_tb_state(uint64_t tfmr) > +{ > + return (tfmr & TFMR_TBST_ENCODED) >> (63 - 31); > +} > + > +static uint64_t tfmr_new_tb_state(uint64_t tfmr, unsigned int tbst) > +{ > + tfmr &= ~TFMR_TBST_LAST; > + tfmr |= (tfmr & TFMR_TBST_ENCODED) >> 4; /* move state to last state */ > + tfmr &= ~TFMR_TBST_ENCODED; > + tfmr |= (uint64_t)tbst << (63 - 31); /* move new state to state */ > + > + if (tbst == TBST_TB_RUNNING) { > + tfmr |= TFMR_TB_VALID; > + } else { > + tfmr &= ~TFMR_TB_VALID; > + } > + > + return tfmr; > +} > + > +static void tb_state_machine_step(CPUPPCState *env) > +{ > + uint64_t tfmr = env->spr[SPR_TFMR]; > + unsigned int tbst = tfmr_get_tb_state(tfmr); > + > + if (!(tfmr & TFMR_TB_ECLIPZ) || tbst == TBST_TB_ERROR) { > + return; > + } > + > + if (env->tb_sync_pulse_timer) { > + env->tb_sync_pulse_timer--; > + } else { > + tfmr |= TFMR_TB_SYNC_OCCURED; > + env->spr[SPR_TFMR] = tfmr; > + } > + > + if (env->tb_state_timer) { > + env->tb_state_timer--; > + return; > + } > + > + if (tfmr & TFMR_LOAD_TOD_MOD) { > + tfmr &= ~TFMR_LOAD_TOD_MOD; > + if (tbst == TBST_GET_TOD) { > + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); > + } else { > + tfmr = tfmr_new_tb_state(tfmr, TBST_SEND_TOD_MOD); > + /* State seems to transition immediately */ > + tfmr = tfmr_new_tb_state(tfmr, TBST_NOT_SET); > + } > + } else if (tfmr & TFMR_MOVE_CHIP_TOD_TO_TB) { > + if (tbst == TBST_SYNC_WAIT) { > + tfmr = tfmr_new_tb_state(tfmr, TBST_GET_TOD); > + env->tb_state_timer = 3; > + } else if (tbst == TBST_GET_TOD) { > + if (env->tod_sent_to_tb) { > + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_RUNNING); > + tfmr &= ~TFMR_MOVE_CHIP_TOD_TO_TB; > + env->tb_ready_for_tod = 0; > + env->tod_sent_to_tb = 0; > + } > + } else { > + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: MOVE_CHIP_TOD_TO_TB " > + "state machine in invalid state 0x%x\n", tbst); > + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); > + env->tb_ready_for_tod = 0; > + } > + } > + > + env->spr[SPR_TFMR] = tfmr; > +} > + > target_ulong helper_load_tfmr(CPUPPCState *env) > { > - return env->spr[SPR_TFMR]; > + tb_state_machine_step(env); > + > + return env->spr[SPR_TFMR] | TFMR_TB_ECLIPZ; > } > > void helper_store_tfmr(CPUPPCState *env, target_ulong val) > { > - env->spr[SPR_TFMR] = val; > + uint64_t tfmr = env->spr[SPR_TFMR]; > + unsigned int tbst = tfmr_get_tb_state(tfmr); > + > + if (!(val & TFMR_TB_ECLIPZ)) { > + qemu_log_mask(LOG_UNIMP, "TFMR non-ECLIPZ mode not implemented\n"); > + tfmr &= ~TFMR_TBST_ENCODED; > + tfmr &= ~TFMR_TBST_LAST; > + goto out; > + } > + > + /* Update control bits */ > + tfmr = (tfmr & ~TFMR_CONTROL_MASK) | (val & TFMR_CONTROL_MASK); > + > + /* mtspr always clears this */ > + tfmr &= ~TFMR_TB_SYNC_OCCURED; > + env->tb_sync_pulse_timer = 1; > + > + /* > + * We don't implement any of the error status bits that can be > + * cleared by writing 1 to them. TB error injection / simulation > + * would have to implement some. > + * > + * Also don't implement mfTB failing when the TB state machine is > + * not running. > + */ > + > + if (((tfmr | val) & (TFMR_LOAD_TOD_MOD | TFMR_MOVE_CHIP_TOD_TO_TB)) == > + (TFMR_LOAD_TOD_MOD | TFMR_MOVE_CHIP_TOD_TO_TB)) { > + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: LOAD_TOD_MOD and " > + "MOVE_CHIP_TOD_TO_TB both set\n"); > + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); > + env->tb_ready_for_tod = 0; > + goto out; > + } > + > + if (tfmr & TFMR_CLEAR_TB_ERRORS) { > + tfmr = tfmr_new_tb_state(tfmr, TBST_RESET); > + tfmr &= ~TFMR_CLEAR_TB_ERRORS; > + tfmr &= ~TFMR_LOAD_TOD_MOD; > + tfmr &= ~TFMR_MOVE_CHIP_TOD_TO_TB; > + env->tb_ready_for_tod = 0; > + env->tod_sent_to_tb = 0; > + goto out; > + } > + > + if (tbst == TBST_TB_ERROR) { > + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: mtspr TFMR in TB_ERROR" > + " state\n"); > + return; > + } > + > + if (tfmr & TFMR_LOAD_TOD_MOD) { > + env->tb_state_timer = 3; > + } else if (tfmr & TFMR_MOVE_CHIP_TOD_TO_TB) { > + if (tbst == TBST_NOT_SET) { > + tfmr = tfmr_new_tb_state(tfmr, TBST_SYNC_WAIT); > + env->tb_ready_for_tod = 1; > + env->tb_state_timer = 3; > + } else { > + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: MOVE_CHIP_TOD_TO_TB " > + "not in TB not set state 0x%x\n", > + tbst); > + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); > + env->tb_ready_for_tod = 0; > + } > + } > + > +out: > + env->spr[SPR_TFMR] = tfmr; > } > #endif >
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h index d73cce8474..b1520ea4db 100644 --- a/target/ppc/cpu.h +++ b/target/ppc/cpu.h @@ -1177,6 +1177,13 @@ struct CPUArchState { /* PowerNV chiptod / timebase facility state. */ int tb_ready_for_tod; /* core TB ready to receive TOD from chiptod */ int tod_sent_to_tb; /* chiptod sent TOD to the core TB */ + + /* + * Timers for async events are simulated by mfTFAC because TFAC is to be + * polled for event. + */ + int tb_state_timer; + int tb_sync_pulse_timer; #endif #endif @@ -2527,6 +2534,33 @@ enum { HMER_XSCOM_STATUS_MASK = PPC_BITMASK(21, 23), }; +/* TFMR */ +enum { + TFMR_CONTROL_MASK = PPC_BITMASK(0, 24), + TFMR_MASK_HMI = PPC_BIT(10), + TFMR_TB_ECLIPZ = PPC_BIT(14), + TFMR_LOAD_TOD_MOD = PPC_BIT(16), + TFMR_MOVE_CHIP_TOD_TO_TB = PPC_BIT(18), + TFMR_CLEAR_TB_ERRORS = PPC_BIT(24), + TFMR_STATUS_MASK = PPC_BITMASK(25, 63), + TFMR_TBST_ENCODED = PPC_BITMASK(28, 31), /* TBST = TB State */ + TFMR_TBST_LAST = PPC_BITMASK(32, 35), /* Previous TBST */ + TFMR_TB_ENABLED = PPC_BIT(40), + TFMR_TB_VALID = PPC_BIT(41), + TFMR_TB_SYNC_OCCURED = PPC_BIT(42), +}; + +/* TFMR TBST */ +enum { + TBST_RESET = 0x0, + TBST_SEND_TOD_MOD = 0x1, + TBST_NOT_SET = 0x2, + TBST_SYNC_WAIT = 0x6, + TBST_GET_TOD = 0x7, + TBST_TB_RUNNING = 0x8, + TBST_TB_ERROR = 0x9, +}; + /*****************************************************************************/ #define is_isa300(ctx) (!!(ctx->insns_flags2 & PPC2_ISA300)) diff --git a/target/ppc/timebase_helper.c b/target/ppc/timebase_helper.c index 34b1d5ad05..11a06fafe6 100644 --- a/target/ppc/timebase_helper.c +++ b/target/ppc/timebase_helper.c @@ -272,14 +272,157 @@ void helper_store_booke_tsr(CPUPPCState *env, target_ulong val) #if defined(TARGET_PPC64) /* POWER processor Timebase Facility */ +static unsigned int tfmr_get_tb_state(uint64_t tfmr) +{ + return (tfmr & TFMR_TBST_ENCODED) >> (63 - 31); +} + +static uint64_t tfmr_new_tb_state(uint64_t tfmr, unsigned int tbst) +{ + tfmr &= ~TFMR_TBST_LAST; + tfmr |= (tfmr & TFMR_TBST_ENCODED) >> 4; /* move state to last state */ + tfmr &= ~TFMR_TBST_ENCODED; + tfmr |= (uint64_t)tbst << (63 - 31); /* move new state to state */ + + if (tbst == TBST_TB_RUNNING) { + tfmr |= TFMR_TB_VALID; + } else { + tfmr &= ~TFMR_TB_VALID; + } + + return tfmr; +} + +static void tb_state_machine_step(CPUPPCState *env) +{ + uint64_t tfmr = env->spr[SPR_TFMR]; + unsigned int tbst = tfmr_get_tb_state(tfmr); + + if (!(tfmr & TFMR_TB_ECLIPZ) || tbst == TBST_TB_ERROR) { + return; + } + + if (env->tb_sync_pulse_timer) { + env->tb_sync_pulse_timer--; + } else { + tfmr |= TFMR_TB_SYNC_OCCURED; + env->spr[SPR_TFMR] = tfmr; + } + + if (env->tb_state_timer) { + env->tb_state_timer--; + return; + } + + if (tfmr & TFMR_LOAD_TOD_MOD) { + tfmr &= ~TFMR_LOAD_TOD_MOD; + if (tbst == TBST_GET_TOD) { + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); + } else { + tfmr = tfmr_new_tb_state(tfmr, TBST_SEND_TOD_MOD); + /* State seems to transition immediately */ + tfmr = tfmr_new_tb_state(tfmr, TBST_NOT_SET); + } + } else if (tfmr & TFMR_MOVE_CHIP_TOD_TO_TB) { + if (tbst == TBST_SYNC_WAIT) { + tfmr = tfmr_new_tb_state(tfmr, TBST_GET_TOD); + env->tb_state_timer = 3; + } else if (tbst == TBST_GET_TOD) { + if (env->tod_sent_to_tb) { + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_RUNNING); + tfmr &= ~TFMR_MOVE_CHIP_TOD_TO_TB; + env->tb_ready_for_tod = 0; + env->tod_sent_to_tb = 0; + } + } else { + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: MOVE_CHIP_TOD_TO_TB " + "state machine in invalid state 0x%x\n", tbst); + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); + env->tb_ready_for_tod = 0; + } + } + + env->spr[SPR_TFMR] = tfmr; +} + target_ulong helper_load_tfmr(CPUPPCState *env) { - return env->spr[SPR_TFMR]; + tb_state_machine_step(env); + + return env->spr[SPR_TFMR] | TFMR_TB_ECLIPZ; } void helper_store_tfmr(CPUPPCState *env, target_ulong val) { - env->spr[SPR_TFMR] = val; + uint64_t tfmr = env->spr[SPR_TFMR]; + unsigned int tbst = tfmr_get_tb_state(tfmr); + + if (!(val & TFMR_TB_ECLIPZ)) { + qemu_log_mask(LOG_UNIMP, "TFMR non-ECLIPZ mode not implemented\n"); + tfmr &= ~TFMR_TBST_ENCODED; + tfmr &= ~TFMR_TBST_LAST; + goto out; + } + + /* Update control bits */ + tfmr = (tfmr & ~TFMR_CONTROL_MASK) | (val & TFMR_CONTROL_MASK); + + /* mtspr always clears this */ + tfmr &= ~TFMR_TB_SYNC_OCCURED; + env->tb_sync_pulse_timer = 1; + + /* + * We don't implement any of the error status bits that can be + * cleared by writing 1 to them. TB error injection / simulation + * would have to implement some. + * + * Also don't implement mfTB failing when the TB state machine is + * not running. + */ + + if (((tfmr | val) & (TFMR_LOAD_TOD_MOD | TFMR_MOVE_CHIP_TOD_TO_TB)) == + (TFMR_LOAD_TOD_MOD | TFMR_MOVE_CHIP_TOD_TO_TB)) { + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: LOAD_TOD_MOD and " + "MOVE_CHIP_TOD_TO_TB both set\n"); + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); + env->tb_ready_for_tod = 0; + goto out; + } + + if (tfmr & TFMR_CLEAR_TB_ERRORS) { + tfmr = tfmr_new_tb_state(tfmr, TBST_RESET); + tfmr &= ~TFMR_CLEAR_TB_ERRORS; + tfmr &= ~TFMR_LOAD_TOD_MOD; + tfmr &= ~TFMR_MOVE_CHIP_TOD_TO_TB; + env->tb_ready_for_tod = 0; + env->tod_sent_to_tb = 0; + goto out; + } + + if (tbst == TBST_TB_ERROR) { + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: mtspr TFMR in TB_ERROR" + " state\n"); + return; + } + + if (tfmr & TFMR_LOAD_TOD_MOD) { + env->tb_state_timer = 3; + } else if (tfmr & TFMR_MOVE_CHIP_TOD_TO_TB) { + if (tbst == TBST_NOT_SET) { + tfmr = tfmr_new_tb_state(tfmr, TBST_SYNC_WAIT); + env->tb_ready_for_tod = 1; + env->tb_state_timer = 3; + } else { + qemu_log_mask(LOG_GUEST_ERROR, "TFMR error: MOVE_CHIP_TOD_TO_TB " + "not in TB not set state 0x%x\n", + tbst); + tfmr = tfmr_new_tb_state(tfmr, TBST_TB_ERROR); + env->tb_ready_for_tod = 0; + } + } + +out: + env->spr[SPR_TFMR] = tfmr; } #endif
This implements the core timebase state machine, which is the core side of the time-of-day system in POWER processors. This facility is operated by control fields in the TFMR register, which also contains status fields. The core timebase interacts with the chiptod hardware, primarily to receive TOD updates, to synchronise timebase with other cores. This model does not actually update TB values with TOD or updates received from the chiptod, as timebases are always synchronised. It does step through the states required to perform the update. There are several asynchronous state transitions. These are modelled using using mfTFMR to drive state changes, because it is expected that firmware poll the register to wait for those states. This is good enough to test basic firmware behaviour without adding real timers. The values chosen are arbitrary. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> --- target/ppc/cpu.h | 34 ++++++++ target/ppc/timebase_helper.c | 147 ++++++++++++++++++++++++++++++++++- 2 files changed, 179 insertions(+), 2 deletions(-)