diff mbox series

[v27,6/8] target/avr: Add example board configuration

Message ID 20190719082647.18113-7-mrolnik@gmail.com (mailing list archive)
State New, archived
Headers show
Series QEMU AVR 8 bit cores | expand

Commit Message

Michael Rolnik July 19, 2019, 8:26 a.m. UTC
From: Sarah Harris <S.E.Harris@kent.ac.uk>

A simple board setup that configures an AVR CPU to run a given firmware image.
This is all that's useful to implement without peripheral emulation as AVR CPUs include a lot of on-board peripherals.

Signed-off-by: Michael Rolnik <mrolnik@gmail.com>
---
 hw/Kconfig           |   1 +
 hw/avr/Kconfig       |   5 +
 hw/avr/Makefile.objs |   1 +
 hw/avr/sample.c      | 237 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 244 insertions(+)
 create mode 100644 hw/avr/Kconfig
 create mode 100644 hw/avr/Makefile.objs
 create mode 100644 hw/avr/sample.c

Comments

Philippe Mathieu-Daudé July 19, 2019, 2:02 p.m. UTC | #1
Hi Michael,

On 7/19/19 10:26 AM, Michael Rolnik wrote:
> From: Sarah Harris <S.E.Harris@kent.ac.uk>
> 
> A simple board setup that configures an AVR CPU to run a given firmware image.
> This is all that's useful to implement without peripheral emulation as AVR CPUs include a lot of on-board peripherals.
> 
> Signed-off-by: Michael Rolnik <mrolnik@gmail.com>
> ---
>  hw/Kconfig           |   1 +
>  hw/avr/Kconfig       |   5 +
>  hw/avr/Makefile.objs |   1 +
>  hw/avr/sample.c      | 237 +++++++++++++++++++++++++++++++++++++++++++
>  4 files changed, 244 insertions(+)
>  create mode 100644 hw/avr/Kconfig
>  create mode 100644 hw/avr/Makefile.objs
>  create mode 100644 hw/avr/sample.c
> 
> diff --git a/hw/Kconfig b/hw/Kconfig
> index 195f541e50..1f25636855 100644
> --- a/hw/Kconfig
> +++ b/hw/Kconfig
> @@ -42,6 +42,7 @@ source watchdog/Kconfig
>  # arch Kconfig
>  source arm/Kconfig
>  source alpha/Kconfig
> +source avr/Kconfig
>  source cris/Kconfig
>  source hppa/Kconfig
>  source i386/Kconfig
> diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
> new file mode 100644
> index 0000000000..dd02a4c37a
> --- /dev/null
> +++ b/hw/avr/Kconfig
> @@ -0,0 +1,5 @@
> +config AVR_SAMPLE
> +    bool
> +    select AVR_TIMER16
> +    select AVR_USART
> +    select AVR_MASK
> diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
> new file mode 100644
> index 0000000000..626b7064b3
> --- /dev/null
> +++ b/hw/avr/Makefile.objs
> @@ -0,0 +1 @@
> +obj-y += sample.o
> diff --git a/hw/avr/sample.c b/hw/avr/sample.c
> new file mode 100644
> index 0000000000..563edbd417
> --- /dev/null
> +++ b/hw/avr/sample.c
> @@ -0,0 +1,237 @@
> +/*
> + * QEMU AVR CPU
> + *
> + * Copyright (c) 2019 Michael Rolnik
> + *
> + * This library is free software; you can redistribute it and/or
> + * modify it under the terms of the GNU Lesser General Public
> + * License as published by the Free Software Foundation; either
> + * version 2.1 of the License, or (at your option) any later version.
> + *
> + * This library is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> + * Lesser General Public License for more details.
> + *
> + * You should have received a copy of the GNU Lesser General Public
> + * License along with this library; if not, see
> + * <http://www.gnu.org/licenses/lgpl-2.1.html>
> + */
> +
> +/*
> + *  NOTE:
> + *      This is not a real AVR board, this is an example!
> + *      The CPU is an approximation of an ATmega2560, but is missing various
> + *      built-in peripherals.
> + *
> + *      This example board loads provided binary file into flash memory and
> + *      executes it from 0x00000000 address in the code memory space.
> + *
> + *      Currently used for AVR CPU validation
> + *
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "qemu-common.h"
> +#include "cpu.h"
> +#include "hw/hw.h"
> +#include "sysemu/sysemu.h"
> +#include "sysemu/qtest.h"
> +#include "ui/console.h"
> +#include "hw/boards.h"
> +#include "hw/loader.h"
> +#include "qemu/error-report.h"
> +#include "exec/address-spaces.h"
> +#include "include/hw/sysbus.h"
> +#include "include/hw/char/avr_usart.h"
> +#include "include/hw/timer/avr_timer16.h"
> +#include "include/hw/misc/avr_mask.h"
> +#include "elf.h"
> +
> +#define SIZE_FLASH 0x00040000
> +#define SIZE_SRAM 0x00002200
> +/*
> + * Size of additional "external" memory, as if the AVR were configured to use
> + * an external RAM chip.
> + * Note that the configuration registers that normally enable this feature are
> + * unimplemented.
> + */
> +#define SIZE_EXMEM 0x00000000
> +
> +/* Offsets of periphals in emulated memory space (i.e. not host addresses)  */
> +#define PRR0_BASE 0x64
> +#define PRR1_BASE 0x65
> +#define USART_BASE 0xc0
> +#define TIMER1_BASE 0x80
> +#define TIMER1_IMSK_BASE 0x6f
> +#define TIMER1_IFR_BASE 0x36
> +
> +/* Interrupt numbers used by peripherals */
> +#define USART_RXC_IRQ 24
> +#define USART_DRE_IRQ 25
> +#define USART_TXC_IRQ 26
> +
> +#define TIMER1_CAPT_IRQ 15
> +#define TIMER1_COMPA_IRQ 16
> +#define TIMER1_COMPB_IRQ 17
> +#define TIMER1_COMPC_IRQ 18
> +#define TIMER1_OVF_IRQ 19
> +
> +/*  Power reduction     */
> +#define PRR1_BIT_PRTIM5     0x05    /*  Timer/Counter5  */
> +#define PRR1_BIT_PRTIM4     0x04    /*  Timer/Counter4  */
> +#define PRR1_BIT_PRTIM3     0x03    /*  Timer/Counter3  */
> +#define PRR1_BIT_PRUSART3   0x02    /*  USART3  */
> +#define PRR1_BIT_PRUSART2   0x01    /*  USART2  */
> +#define PRR1_BIT_PRUSART1   0x00    /*  USART1  */
> +
> +#define PRR0_BIT_PRTWI      0x06    /*  TWI */
> +#define PRR0_BIT_PRTIM2     0x05    /*  Timer/Counter2  */
> +#define PRR0_BIT_PRTIM0     0x04    /*  Timer/Counter0  */
> +#define PRR0_BIT_PRTIM1     0x03    /*  Timer/Counter1  */
> +#define PRR0_BIT_PRSPI      0x02    /*  Serial Peripheral Interface */
> +#define PRR0_BIT_PRUSART0   0x01    /*  USART0  */
> +#define PRR0_BIT_PRADC      0x00    /*  ADC */
> +
> +typedef struct {
> +    MachineClass parent;
> +} SampleMachineClass;
> +
> +typedef struct {
> +    MachineState parent;
> +    MemoryRegion *ram;
> +    MemoryRegion *flash;
> +    AVRUsartState *usart0;
> +    AVRTimer16State *timer1;
> +    AVRMaskState *prr[2];
> +} SampleMachineState;
> +
> +#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
> +
> +#define SAMPLE_MACHINE(obj) \
> +    OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
> +#define SAMPLE_MACHINE_GET_CLASS(obj) \
> +    OBJECT_GET_CLASS(SampleMachineClass, obj, TYPE_SAMPLE_MACHINE)
> +#define SAMPLE_MACHINE_CLASS(klass) \
> +    OBJECT_CLASS_CHECK(SampleMachineClass, klass, TYPE_SAMPLE_MACHINE)
> +
> +static void sample_init(MachineState *machine)
> +{
> +    SampleMachineState *sms = SAMPLE_MACHINE(machine);
> +    MemoryRegion *system_memory = get_system_memory();
> +    AVRCPU *cpu;
> +    const char *firmware = NULL;
> +    const char *filename;
> +    int bytes_loaded;
> +    SysBusDevice *busdev;
> +    DeviceState *cpudev;
> +
> +    system_memory = get_system_memory();
> +    sms->ram = g_new(MemoryRegion, 1);
> +    sms->flash = g_new(MemoryRegion, 1);
> +
> +    cpu = AVR_CPU(cpu_create(machine->cpu_type));
> +    cpudev = DEVICE(cpu);
> +
> +    memory_region_allocate_system_memory(
> +        sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
> +    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);

Not sure this is correct, you are filling an area of 0x1e0 I/O registers
with RAM...

So you use system_memory to model the first registers, I wonder if QEMU
supports a such small area. Well, I won't test it, I'll try a quicker hack:

-- >8 --
diff --git a/hw/avr/sample.c b/hw/avr/sample.c
index 563edbd417..cc60a6ca8d 100644
--- a/hw/avr/sample.c
+++ b/hw/avr/sample.c
@@ -48,6 +48,7 @@
 #include "include/hw/timer/avr_timer16.h"
 #include "include/hw/misc/avr_mask.h"
 #include "elf.h"
+#include "hw/misc/unimp.h"

 #define SIZE_FLASH 0x00040000
 #define SIZE_SRAM 0x00002200
@@ -136,12 +137,29 @@ static void sample_init(MachineState *machine)

     memory_region_allocate_system_memory(
         sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
-    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
+    memory_region_add_subregion_overlap(system_memory, OFFSET_DATA,
sms->ram,
+                                        -2000);

     memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
             &error_fatal);
     memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);

+    create_unimplemented_device("io", 0x800000 + 0x20, 0x40);
+    create_unimplemented_device("data", 0x800000 + 0x20 + 0x40, 0x1a0);
+
+    create_unimplemented_device("gpio", 0x800000 + 0x20 + 0, 0x14);
+    create_unimplemented_device("intc", 0x800000 + 0x20 + 0x1c, 0x2);
+    create_unimplemented_device("tmr0", 0x800000 + 0x20 + 0x26, 0x3);
+    create_unimplemented_device("adc", 0x800000 + 0x20 + 0x78, 0x8);
+    create_unimplemented_device("tmr2", 0x800000 + 0x20 + 0x84, 0xa);
+    create_unimplemented_device("tmr3", 0x800000 + 0x20 + 0x94, 0xa);
+    create_unimplemented_device("tmr4", 0x800000 + 0x20 + 0xa4, 0xa);
+    create_unimplemented_device("uart0", 0x800000 + 0x20 + 0xc0, 0x8);
+    create_unimplemented_device("uart1", 0x800000 + 0x20 + 0xc8, 0x8);
+    create_unimplemented_device("uart2", 0x800000 + 0x20 + 0xd0, 0x8);
+    create_unimplemented_device("tmr5", 0x800000 + 0x20 + 0x124, 0xa);
+    create_unimplemented_device("uart3", 0x800000 + 0x20 + 0x130, 0x8);
+
     /* Power Reduction built-in peripheral */
     sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
                     OFFSET_DATA + PRR0_BASE, NULL));
---

So instead of using a small RAM region for registers, I use the same
amount you used, but with lower priority (-2000). Then I create
'UnimplementedDevice' for the most common blocks and map them (they'll
be mapped at prio -1000).

Now we have this memory map:

(qemu) info mtree
address-space: memory
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    0000000000000000-000000000003ffff (prio 0, rom): avr.flash
    0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
    0000000000800020-0000000000800033 (prio -1000, i/o): gpio
    0000000000800020-000000000080005f (prio -1000, i/o): io
    0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
    000000000080003c-000000000080003d (prio -1000, i/o): intc
    0000000000800046-0000000000800048 (prio -1000, i/o): tmr0
    0000000000800060-00000000008001ff (prio -1000, i/o): data
    0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
    0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
    000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
    0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
    0000000000800098-000000000080009f (prio -1000, i/o): adc
    00000000008000a4-00000000008000ad (prio -1000, i/o): tmr2
    00000000008000b4-00000000008000bd (prio -1000, i/o): tmr3
    00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart
    00000000008000c4-00000000008000cd (prio -1000, i/o): tmr4
    00000000008000e0-00000000008000e7 (prio -1000, i/o): uart0
    00000000008000e8-00000000008000ef (prio -1000, i/o): uart1
    00000000008000f0-00000000008000f7 (prio -1000, i/o): uart2
    0000000000800144-000000000080014d (prio -1000, i/o): tmr5
    0000000000800150-0000000000800157 (prio -1000, i/o): uart3

The UnimplementedDevice is useful to quickly trace accesses from
firmware, you can see:

$ avr-softmmu/qemu-system-avr -bios demo.elf -d unimp
gpio: unimplemented device write (size 1, value 0xff, offset 0x1)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
gpio: unimplemented device write (size 1, value 0xff, offset 0x2)

So the Demo code first initialize the GPIO direction, then toggle it
(LED blink).

> +
> +    memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
> +            &error_fatal);
> +    memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
> +
> +    /* Power Reduction built-in peripheral */
> +    sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> +                    OFFSET_DATA + PRR0_BASE, NULL));
> +    sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> +                    OFFSET_DATA + PRR1_BASE, NULL));
> +
> +    /* USART 0 built-in peripheral */
> +    sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
> +    busdev = SYS_BUS_DEVICE(sms->usart0);
> +    qdev_prop_set_chr(DEVICE(sms->usart0), "chardev", serial_hd(0));
> +    object_property_set_bool(OBJECT(sms->usart0), true, "realized",
> +            &error_fatal);
> +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);

This OFFSET_DATA makes me wonder... These are I/O devices, it would be
cleaner to map them on the I/O bus, and remap the I/O bus to OFFSET_DATA.

Something like this I guess:

(qemu) info mtree
address-space: memory
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    0000000000000000-000000000003ffff (prio 0, rom): avr.flash
    0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
    0000000000800020-00000000008001ff (prio -1000, i/o): avr.io

address-space: I/O
  0000000000000000-00000000000001ff (prio 0, i/o): avr.io
    0000000000000000-0000000000000033 (prio -1000, i/o): gpio
    0000000000000016-0000000000000016 (prio 0, i/o): avr-timer16
    000000000000001c-000000000000001d (prio -1000, i/o): intc
    0000000000000026-0000000000000028 (prio -1000, i/o): tmr0
    0000000000000044-0000000000000044 (prio 0, i/o): avr-mask
    0000000000000045-0000000000000045 (prio 0, i/o): avr-mask
    000000000000004f-000000000000004f (prio 0, i/o): avr-timer16
    0000000000000060-000000000000006d (prio 0, i/o): avr-timer16
    0000000000000078-000000000000007f (prio -1000, i/o): adc
    0000000000000084-000000000000008d (prio -1000, i/o): tmr2
    0000000000000094-000000000000009d (prio -1000, i/o): tmr3
    00000000000000a0-00000000000000a7 (prio 0, i/o): avr-usart
    00000000000000a4-00000000000000ad (prio -1000, i/o): tmr4
    00000000000000c0-00000000000000c7 (prio -1000, i/o): uart0
    00000000000000c8-00000000000000cf (prio -1000, i/o): uart1
    00000000000000d0-00000000000000d7 (prio -1000, i/o): uart2
    0000000000000124-000000000000012d (prio -1000, i/o): tmr5
    0000000000000130-0000000000000127 (prio -1000, i/o): uart3

> +    /*
> +     * These IRQ numbers don't match the datasheet because we're counting from
> +     * zero and not including reset.
> +     */
> +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, USART_RXC_IRQ));
> +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, USART_DRE_IRQ));
> +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, USART_TXC_IRQ));
> +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]), PRR1_BIT_PRUSART1,
> +            qdev_get_gpio_in(DEVICE(sms->usart0), 0));
> +
> +    /* Timer 1 built-in periphal */
> +    sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
> +    object_property_set_bool(OBJECT(sms->timer1), true, "realized",
> +            &error_fatal);
> +    busdev = SYS_BUS_DEVICE(sms->timer1);
> +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
> +    sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
> +    sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
> +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, TIMER1_CAPT_IRQ));
> +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, TIMER1_COMPA_IRQ));
> +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, TIMER1_COMPB_IRQ));
> +    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev, TIMER1_COMPC_IRQ));
> +    sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev, TIMER1_OVF_IRQ));
> +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]), PRR0_BIT_PRTIM1,
> +            qdev_get_gpio_in(DEVICE(sms->timer1), 0));
> +
> +    /* Load firmware (contents of flash) trying to auto-detect format */
> +    firmware = machine->firmware;
> +    if (firmware != NULL) {
> +        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
> +        if (filename == NULL) {
> +            error_report("Unable to find %s", firmware);
> +            exit(1);
> +        }
> +
> +        bytes_loaded = load_elf(
> +            filename, NULL, NULL, NULL, NULL, NULL, NULL, 0, EM_NONE, 0, 0);
> +        if (bytes_loaded < 0) {
> +            error_report(
> +                "Unable to load %s as ELF, trying again as raw binary",
> +                firmware);
> +            bytes_loaded = load_image_targphys(
> +                filename, OFFSET_CODE, SIZE_FLASH);
> +        }
> +        if (bytes_loaded < 0) {
> +            error_report(
> +                "Unable to load firmware image %s as ELF or raw binary",
> +                firmware);
> +            exit(1);
> +        }
> +    }
> +}
> +
> +static void sample_class_init(ObjectClass *oc, void *data)
> +{
> +    MachineClass *mc = MACHINE_CLASS(oc);
> +
> +    mc->desc = "AVR sample/example board (ATmega2560)";
> +    mc->init = sample_init;
> +    mc->default_cpus = 1;
> +    mc->min_cpus = mc->default_cpus;
> +    mc->max_cpus = mc->default_cpus;
> +    mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
> +    mc->is_default = 1;
> +}
> +
> +static const TypeInfo sample_info = {
> +    .name = TYPE_SAMPLE_MACHINE,
> +    .parent = TYPE_MACHINE,
> +    .instance_size = sizeof(SampleMachineState),
> +    .class_size = sizeof(SampleMachineClass),
> +    .class_init = sample_class_init,
> +};
> +
> +static void sample_machine_init(void)
> +{
> +    type_register_static(&sample_info);
> +}
> +
> +type_init(sample_machine_init);
>
Michael Rolnik July 19, 2019, 3:04 p.m. UTC | #2
On Fri, Jul 19, 2019 at 5:02 PM Philippe Mathieu-Daudé <philmd@redhat.com>
wrote:

> Hi Michael,
>
> On 7/19/19 10:26 AM, Michael Rolnik wrote:
> > From: Sarah Harris <S.E.Harris@kent.ac.uk>
> >
> > A simple board setup that configures an AVR CPU to run a given firmware
> image.
> > This is all that's useful to implement without peripheral emulation as
> AVR CPUs include a lot of on-board peripherals.
> >
> > Signed-off-by: Michael Rolnik <mrolnik@gmail.com>
> > ---
> >  hw/Kconfig           |   1 +
> >  hw/avr/Kconfig       |   5 +
> >  hw/avr/Makefile.objs |   1 +
> >  hw/avr/sample.c      | 237 +++++++++++++++++++++++++++++++++++++++++++
> >  4 files changed, 244 insertions(+)
> >  create mode 100644 hw/avr/Kconfig
> >  create mode 100644 hw/avr/Makefile.objs
> >  create mode 100644 hw/avr/sample.c
> >
> > diff --git a/hw/Kconfig b/hw/Kconfig
> > index 195f541e50..1f25636855 100644
> > --- a/hw/Kconfig
> > +++ b/hw/Kconfig
> > @@ -42,6 +42,7 @@ source watchdog/Kconfig
> >  # arch Kconfig
> >  source arm/Kconfig
> >  source alpha/Kconfig
> > +source avr/Kconfig
> >  source cris/Kconfig
> >  source hppa/Kconfig
> >  source i386/Kconfig
> > diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
> > new file mode 100644
> > index 0000000000..dd02a4c37a
> > --- /dev/null
> > +++ b/hw/avr/Kconfig
> > @@ -0,0 +1,5 @@
> > +config AVR_SAMPLE
> > +    bool
> > +    select AVR_TIMER16
> > +    select AVR_USART
> > +    select AVR_MASK
> > diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
> > new file mode 100644
> > index 0000000000..626b7064b3
> > --- /dev/null
> > +++ b/hw/avr/Makefile.objs
> > @@ -0,0 +1 @@
> > +obj-y += sample.o
> > diff --git a/hw/avr/sample.c b/hw/avr/sample.c
> > new file mode 100644
> > index 0000000000..563edbd417
> > --- /dev/null
> > +++ b/hw/avr/sample.c
> > @@ -0,0 +1,237 @@
> > +/*
> > + * QEMU AVR CPU
> > + *
> > + * Copyright (c) 2019 Michael Rolnik
> > + *
> > + * This library is free software; you can redistribute it and/or
> > + * modify it under the terms of the GNU Lesser General Public
> > + * License as published by the Free Software Foundation; either
> > + * version 2.1 of the License, or (at your option) any later version.
> > + *
> > + * This library is distributed in the hope that it will be useful,
> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> > + * Lesser General Public License for more details.
> > + *
> > + * You should have received a copy of the GNU Lesser General Public
> > + * License along with this library; if not, see
> > + * <http://www.gnu.org/licenses/lgpl-2.1.html>
> > + */
> > +
> > +/*
> > + *  NOTE:
> > + *      This is not a real AVR board, this is an example!
> > + *      The CPU is an approximation of an ATmega2560, but is missing
> various
> > + *      built-in peripherals.
> > + *
> > + *      This example board loads provided binary file into flash memory
> and
> > + *      executes it from 0x00000000 address in the code memory space.
> > + *
> > + *      Currently used for AVR CPU validation
> > + *
> > + */
> > +
> > +#include "qemu/osdep.h"
> > +#include "qapi/error.h"
> > +#include "qemu-common.h"
> > +#include "cpu.h"
> > +#include "hw/hw.h"
> > +#include "sysemu/sysemu.h"
> > +#include "sysemu/qtest.h"
> > +#include "ui/console.h"
> > +#include "hw/boards.h"
> > +#include "hw/loader.h"
> > +#include "qemu/error-report.h"
> > +#include "exec/address-spaces.h"
> > +#include "include/hw/sysbus.h"
> > +#include "include/hw/char/avr_usart.h"
> > +#include "include/hw/timer/avr_timer16.h"
> > +#include "include/hw/misc/avr_mask.h"
> > +#include "elf.h"
> > +
> > +#define SIZE_FLASH 0x00040000
> > +#define SIZE_SRAM 0x00002200
> > +/*
> > + * Size of additional "external" memory, as if the AVR were configured
> to use
> > + * an external RAM chip.
> > + * Note that the configuration registers that normally enable this
> feature are
> > + * unimplemented.
> > + */
> > +#define SIZE_EXMEM 0x00000000
> > +
> > +/* Offsets of periphals in emulated memory space (i.e. not host
> addresses)  */
> > +#define PRR0_BASE 0x64
> > +#define PRR1_BASE 0x65
> > +#define USART_BASE 0xc0
> > +#define TIMER1_BASE 0x80
> > +#define TIMER1_IMSK_BASE 0x6f
> > +#define TIMER1_IFR_BASE 0x36
> > +
> > +/* Interrupt numbers used by peripherals */
> > +#define USART_RXC_IRQ 24
> > +#define USART_DRE_IRQ 25
> > +#define USART_TXC_IRQ 26
> > +
> > +#define TIMER1_CAPT_IRQ 15
> > +#define TIMER1_COMPA_IRQ 16
> > +#define TIMER1_COMPB_IRQ 17
> > +#define TIMER1_COMPC_IRQ 18
> > +#define TIMER1_OVF_IRQ 19
> > +
> > +/*  Power reduction     */
> > +#define PRR1_BIT_PRTIM5     0x05    /*  Timer/Counter5  */
> > +#define PRR1_BIT_PRTIM4     0x04    /*  Timer/Counter4  */
> > +#define PRR1_BIT_PRTIM3     0x03    /*  Timer/Counter3  */
> > +#define PRR1_BIT_PRUSART3   0x02    /*  USART3  */
> > +#define PRR1_BIT_PRUSART2   0x01    /*  USART2  */
> > +#define PRR1_BIT_PRUSART1   0x00    /*  USART1  */
> > +
> > +#define PRR0_BIT_PRTWI      0x06    /*  TWI */
> > +#define PRR0_BIT_PRTIM2     0x05    /*  Timer/Counter2  */
> > +#define PRR0_BIT_PRTIM0     0x04    /*  Timer/Counter0  */
> > +#define PRR0_BIT_PRTIM1     0x03    /*  Timer/Counter1  */
> > +#define PRR0_BIT_PRSPI      0x02    /*  Serial Peripheral Interface */
> > +#define PRR0_BIT_PRUSART0   0x01    /*  USART0  */
> > +#define PRR0_BIT_PRADC      0x00    /*  ADC */
> > +
> > +typedef struct {
> > +    MachineClass parent;
> > +} SampleMachineClass;
> > +
> > +typedef struct {
> > +    MachineState parent;
> > +    MemoryRegion *ram;
> > +    MemoryRegion *flash;
> > +    AVRUsartState *usart0;
> > +    AVRTimer16State *timer1;
> > +    AVRMaskState *prr[2];
> > +} SampleMachineState;
> > +
> > +#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
> > +
> > +#define SAMPLE_MACHINE(obj) \
> > +    OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
> > +#define SAMPLE_MACHINE_GET_CLASS(obj) \
> > +    OBJECT_GET_CLASS(SampleMachineClass, obj, TYPE_SAMPLE_MACHINE)
> > +#define SAMPLE_MACHINE_CLASS(klass) \
> > +    OBJECT_CLASS_CHECK(SampleMachineClass, klass, TYPE_SAMPLE_MACHINE)
> > +
> > +static void sample_init(MachineState *machine)
> > +{
> > +    SampleMachineState *sms = SAMPLE_MACHINE(machine);
> > +    MemoryRegion *system_memory = get_system_memory();
> > +    AVRCPU *cpu;
> > +    const char *firmware = NULL;
> > +    const char *filename;
> > +    int bytes_loaded;
> > +    SysBusDevice *busdev;
> > +    DeviceState *cpudev;
> > +
> > +    system_memory = get_system_memory();
> > +    sms->ram = g_new(MemoryRegion, 1);
> > +    sms->flash = g_new(MemoryRegion, 1);
> > +
> > +    cpu = AVR_CPU(cpu_create(machine->cpu_type));
> > +    cpudev = DEVICE(cpu);
> > +
> > +    memory_region_allocate_system_memory(
> > +        sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
> > +    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
>
> Not sure this is correct, you are filling an area of 0x1e0 I/O registers
> with RAM...
>
Please explain.


>
> So you use system_memory to model the first registers, I wonder if QEMU
> supports a such small area. Well, I won't test it, I'll try a quicker hack:
>
> -- >8 --
> diff --git a/hw/avr/sample.c b/hw/avr/sample.c
> index 563edbd417..cc60a6ca8d 100644
> --- a/hw/avr/sample.c
> +++ b/hw/avr/sample.c
> @@ -48,6 +48,7 @@
>  #include "include/hw/timer/avr_timer16.h"
>  #include "include/hw/misc/avr_mask.h"
>  #include "elf.h"
> +#include "hw/misc/unimp.h"
>
>  #define SIZE_FLASH 0x00040000
>  #define SIZE_SRAM 0x00002200
> @@ -136,12 +137,29 @@ static void sample_init(MachineState *machine)
>
>      memory_region_allocate_system_memory(
>          sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
> -    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
> +    memory_region_add_subregion_overlap(system_memory, OFFSET_DATA,
> sms->ram,
> +                                        -2000);
>
>      memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
>              &error_fatal);
>      memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
>
> +    create_unimplemented_device("io", 0x800000 + 0x20, 0x40);
> +    create_unimplemented_device("data", 0x800000 + 0x20 + 0x40, 0x1a0);
> +
> +    create_unimplemented_device("gpio", 0x800000 + 0x20 + 0, 0x14);
> +    create_unimplemented_device("intc", 0x800000 + 0x20 + 0x1c, 0x2);
> +    create_unimplemented_device("tmr0", 0x800000 + 0x20 + 0x26, 0x3);
> +    create_unimplemented_device("adc", 0x800000 + 0x20 + 0x78, 0x8);
> +    create_unimplemented_device("tmr2", 0x800000 + 0x20 + 0x84, 0xa);
> +    create_unimplemented_device("tmr3", 0x800000 + 0x20 + 0x94, 0xa);
> +    create_unimplemented_device("tmr4", 0x800000 + 0x20 + 0xa4, 0xa);
> +    create_unimplemented_device("uart0", 0x800000 + 0x20 + 0xc0, 0x8);
> +    create_unimplemented_device("uart1", 0x800000 + 0x20 + 0xc8, 0x8);
> +    create_unimplemented_device("uart2", 0x800000 + 0x20 + 0xd0, 0x8);
> +    create_unimplemented_device("tmr5", 0x800000 + 0x20 + 0x124, 0xa);
> +    create_unimplemented_device("uart3", 0x800000 + 0x20 + 0x130, 0x8);
> +
>      /* Power Reduction built-in peripheral */
>      sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>                      OFFSET_DATA + PRR0_BASE, NULL));
> ---
>
> So instead of using a small RAM region for registers, I use the same
> amount you used, but with lower priority (-2000). Then I create
> 'UnimplementedDevice' for the most common blocks and map them (they'll
> be mapped at prio -1000).
>
> Now we have this memory map:
>
> (qemu) info mtree
> address-space: memory
>   0000000000000000-ffffffffffffffff (prio 0, i/o): system
>     0000000000000000-000000000003ffff (prio 0, rom): avr.flash
>     0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
>     0000000000800020-0000000000800033 (prio -1000, i/o): gpio
>     0000000000800020-000000000080005f (prio -1000, i/o): io
>     0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
>     000000000080003c-000000000080003d (prio -1000, i/o): intc
>     0000000000800046-0000000000800048 (prio -1000, i/o): tmr0
>     0000000000800060-00000000008001ff (prio -1000, i/o): data
>     0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
>     0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
>     000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
>     0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
>     0000000000800098-000000000080009f (prio -1000, i/o): adc
>     00000000008000a4-00000000008000ad (prio -1000, i/o): tmr2
>     00000000008000b4-00000000008000bd (prio -1000, i/o): tmr3
>     00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart
>     00000000008000c4-00000000008000cd (prio -1000, i/o): tmr4
>     00000000008000e0-00000000008000e7 (prio -1000, i/o): uart0
>     00000000008000e8-00000000008000ef (prio -1000, i/o): uart1
>     00000000008000f0-00000000008000f7 (prio -1000, i/o): uart2
>     0000000000800144-000000000080014d (prio -1000, i/o): tmr5
>     0000000000800150-0000000000800157 (prio -1000, i/o): uart3
>
> The UnimplementedDevice is useful to quickly trace accesses from
> firmware, you can see:
>
> $ avr-softmmu/qemu-system-avr -bios demo.elf -d unimp
> gpio: unimplemented device write (size 1, value 0xff, offset 0x1)
> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>
> So the Demo code first initialize the GPIO direction, then toggle it
> (LED blink).
>
> > +
> > +    memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
> > +            &error_fatal);
> > +    memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
> > +
> > +    /* Power Reduction built-in peripheral */
> > +    sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> > +                    OFFSET_DATA + PRR0_BASE, NULL));
> > +    sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
> > +                    OFFSET_DATA + PRR1_BASE, NULL));
> > +
> > +    /* USART 0 built-in peripheral */
> > +    sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
> > +    busdev = SYS_BUS_DEVICE(sms->usart0);
> > +    qdev_prop_set_chr(DEVICE(sms->usart0), "chardev", serial_hd(0));
> > +    object_property_set_bool(OBJECT(sms->usart0), true, "realized",
> > +            &error_fatal);
> > +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);
>
> This OFFSET_DATA makes me wonder... These are I/O devices, it would be
> cleaner to map them on the I/O bus, and remap the I/O bus to OFFSET_DATA.
>
Please look here (https://www.avr-tutorials.com/general/avr-memory-map)
some io registers are accessible as if they are memory.

>
> Something like this I guess:
>
> (qemu) info mtree
> address-space: memory
>   0000000000000000-ffffffffffffffff (prio 0, i/o): system
>     0000000000000000-000000000003ffff (prio 0, rom): avr.flash
>     0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
>     0000000000800020-00000000008001ff (prio -1000, i/o): avr.io
>
> address-space: I/O
>   0000000000000000-00000000000001ff (prio 0, i/o): avr.io
>     0000000000000000-0000000000000033 (prio -1000, i/o): gpio
>     0000000000000016-0000000000000016 (prio 0, i/o): avr-timer16
>     000000000000001c-000000000000001d (prio -1000, i/o): intc
>     0000000000000026-0000000000000028 (prio -1000, i/o): tmr0
>     0000000000000044-0000000000000044 (prio 0, i/o): avr-mask
>     0000000000000045-0000000000000045 (prio 0, i/o): avr-mask
>     000000000000004f-000000000000004f (prio 0, i/o): avr-timer16
>     0000000000000060-000000000000006d (prio 0, i/o): avr-timer16
>     0000000000000078-000000000000007f (prio -1000, i/o): adc
>     0000000000000084-000000000000008d (prio -1000, i/o): tmr2
>     0000000000000094-000000000000009d (prio -1000, i/o): tmr3
>     00000000000000a0-00000000000000a7 (prio 0, i/o): avr-usart
>     00000000000000a4-00000000000000ad (prio -1000, i/o): tmr4
>     00000000000000c0-00000000000000c7 (prio -1000, i/o): uart0
>     00000000000000c8-00000000000000cf (prio -1000, i/o): uart1
>     00000000000000d0-00000000000000d7 (prio -1000, i/o): uart2
>     0000000000000124-000000000000012d (prio -1000, i/o): tmr5
>     0000000000000130-0000000000000127 (prio -1000, i/o): uart3
>
> > +    /*
> > +     * These IRQ numbers don't match the datasheet because we're
> counting from
> > +     * zero and not including reset.
> > +     */
> > +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev,
> USART_RXC_IRQ));
> > +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
> USART_DRE_IRQ));
> > +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
> USART_TXC_IRQ));
> > +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]), PRR1_BIT_PRUSART1,
> > +            qdev_get_gpio_in(DEVICE(sms->usart0), 0));
> > +
> > +    /* Timer 1 built-in periphal */
> > +    sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
> > +    object_property_set_bool(OBJECT(sms->timer1), true, "realized",
> > +            &error_fatal);
> > +    busdev = SYS_BUS_DEVICE(sms->timer1);
> > +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
> > +    sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
> > +    sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
> > +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev,
> TIMER1_CAPT_IRQ));
> > +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
> TIMER1_COMPA_IRQ));
> > +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
> TIMER1_COMPB_IRQ));
> > +    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev,
> TIMER1_COMPC_IRQ));
> > +    sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev,
> TIMER1_OVF_IRQ));
> > +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]), PRR0_BIT_PRTIM1,
> > +            qdev_get_gpio_in(DEVICE(sms->timer1), 0));
> > +
> > +    /* Load firmware (contents of flash) trying to auto-detect format */
> > +    firmware = machine->firmware;
> > +    if (firmware != NULL) {
> > +        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
> > +        if (filename == NULL) {
> > +            error_report("Unable to find %s", firmware);
> > +            exit(1);
> > +        }
> > +
> > +        bytes_loaded = load_elf(
> > +            filename, NULL, NULL, NULL, NULL, NULL, NULL, 0, EM_NONE,
> 0, 0);
> > +        if (bytes_loaded < 0) {
> > +            error_report(
> > +                "Unable to load %s as ELF, trying again as raw binary",
> > +                firmware);
> > +            bytes_loaded = load_image_targphys(
> > +                filename, OFFSET_CODE, SIZE_FLASH);
> > +        }
> > +        if (bytes_loaded < 0) {
> > +            error_report(
> > +                "Unable to load firmware image %s as ELF or raw binary",
> > +                firmware);
> > +            exit(1);
> > +        }
> > +    }
> > +}
> > +
> > +static void sample_class_init(ObjectClass *oc, void *data)
> > +{
> > +    MachineClass *mc = MACHINE_CLASS(oc);
> > +
> > +    mc->desc = "AVR sample/example board (ATmega2560)";
> > +    mc->init = sample_init;
> > +    mc->default_cpus = 1;
> > +    mc->min_cpus = mc->default_cpus;
> > +    mc->max_cpus = mc->default_cpus;
> > +    mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
> > +    mc->is_default = 1;
> > +}
> > +
> > +static const TypeInfo sample_info = {
> > +    .name = TYPE_SAMPLE_MACHINE,
> > +    .parent = TYPE_MACHINE,
> > +    .instance_size = sizeof(SampleMachineState),
> > +    .class_size = sizeof(SampleMachineClass),
> > +    .class_init = sample_class_init,
> > +};
> > +
> > +static void sample_machine_init(void)
> > +{
> > +    type_register_static(&sample_info);
> > +}
> > +
> > +type_init(sample_machine_init);
> >
>
Michael Rolnik July 19, 2019, 3:14 p.m. UTC | #3
I should have started the RAM at 0x200 (instead of 0) and make it of size
0x2000. right?

On Fri, Jul 19, 2019 at 6:04 PM Michael Rolnik <mrolnik@gmail.com> wrote:

>
>
> On Fri, Jul 19, 2019 at 5:02 PM Philippe Mathieu-Daudé <philmd@redhat.com>
> wrote:
>
>> Hi Michael,
>>
>> On 7/19/19 10:26 AM, Michael Rolnik wrote:
>> > From: Sarah Harris <S.E.Harris@kent.ac.uk>
>> >
>> > A simple board setup that configures an AVR CPU to run a given firmware
>> image.
>> > This is all that's useful to implement without peripheral emulation as
>> AVR CPUs include a lot of on-board peripherals.
>> >
>> > Signed-off-by: Michael Rolnik <mrolnik@gmail.com>
>> > ---
>> >  hw/Kconfig           |   1 +
>> >  hw/avr/Kconfig       |   5 +
>> >  hw/avr/Makefile.objs |   1 +
>> >  hw/avr/sample.c      | 237 +++++++++++++++++++++++++++++++++++++++++++
>> >  4 files changed, 244 insertions(+)
>> >  create mode 100644 hw/avr/Kconfig
>> >  create mode 100644 hw/avr/Makefile.objs
>> >  create mode 100644 hw/avr/sample.c
>> >
>> > diff --git a/hw/Kconfig b/hw/Kconfig
>> > index 195f541e50..1f25636855 100644
>> > --- a/hw/Kconfig
>> > +++ b/hw/Kconfig
>> > @@ -42,6 +42,7 @@ source watchdog/Kconfig
>> >  # arch Kconfig
>> >  source arm/Kconfig
>> >  source alpha/Kconfig
>> > +source avr/Kconfig
>> >  source cris/Kconfig
>> >  source hppa/Kconfig
>> >  source i386/Kconfig
>> > diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
>> > new file mode 100644
>> > index 0000000000..dd02a4c37a
>> > --- /dev/null
>> > +++ b/hw/avr/Kconfig
>> > @@ -0,0 +1,5 @@
>> > +config AVR_SAMPLE
>> > +    bool
>> > +    select AVR_TIMER16
>> > +    select AVR_USART
>> > +    select AVR_MASK
>> > diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
>> > new file mode 100644
>> > index 0000000000..626b7064b3
>> > --- /dev/null
>> > +++ b/hw/avr/Makefile.objs
>> > @@ -0,0 +1 @@
>> > +obj-y += sample.o
>> > diff --git a/hw/avr/sample.c b/hw/avr/sample.c
>> > new file mode 100644
>> > index 0000000000..563edbd417
>> > --- /dev/null
>> > +++ b/hw/avr/sample.c
>> > @@ -0,0 +1,237 @@
>> > +/*
>> > + * QEMU AVR CPU
>> > + *
>> > + * Copyright (c) 2019 Michael Rolnik
>> > + *
>> > + * This library is free software; you can redistribute it and/or
>> > + * modify it under the terms of the GNU Lesser General Public
>> > + * License as published by the Free Software Foundation; either
>> > + * version 2.1 of the License, or (at your option) any later version.
>> > + *
>> > + * This library is distributed in the hope that it will be useful,
>> > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>> > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
>> > + * Lesser General Public License for more details.
>> > + *
>> > + * You should have received a copy of the GNU Lesser General Public
>> > + * License along with this library; if not, see
>> > + * <http://www.gnu.org/licenses/lgpl-2.1.html>
>> > + */
>> > +
>> > +/*
>> > + *  NOTE:
>> > + *      This is not a real AVR board, this is an example!
>> > + *      The CPU is an approximation of an ATmega2560, but is missing
>> various
>> > + *      built-in peripherals.
>> > + *
>> > + *      This example board loads provided binary file into flash
>> memory and
>> > + *      executes it from 0x00000000 address in the code memory space.
>> > + *
>> > + *      Currently used for AVR CPU validation
>> > + *
>> > + */
>> > +
>> > +#include "qemu/osdep.h"
>> > +#include "qapi/error.h"
>> > +#include "qemu-common.h"
>> > +#include "cpu.h"
>> > +#include "hw/hw.h"
>> > +#include "sysemu/sysemu.h"
>> > +#include "sysemu/qtest.h"
>> > +#include "ui/console.h"
>> > +#include "hw/boards.h"
>> > +#include "hw/loader.h"
>> > +#include "qemu/error-report.h"
>> > +#include "exec/address-spaces.h"
>> > +#include "include/hw/sysbus.h"
>> > +#include "include/hw/char/avr_usart.h"
>> > +#include "include/hw/timer/avr_timer16.h"
>> > +#include "include/hw/misc/avr_mask.h"
>> > +#include "elf.h"
>> > +
>> > +#define SIZE_FLASH 0x00040000
>> > +#define SIZE_SRAM 0x00002200
>> > +/*
>> > + * Size of additional "external" memory, as if the AVR were configured
>> to use
>> > + * an external RAM chip.
>> > + * Note that the configuration registers that normally enable this
>> feature are
>> > + * unimplemented.
>> > + */
>> > +#define SIZE_EXMEM 0x00000000
>> > +
>> > +/* Offsets of periphals in emulated memory space (i.e. not host
>> addresses)  */
>> > +#define PRR0_BASE 0x64
>> > +#define PRR1_BASE 0x65
>> > +#define USART_BASE 0xc0
>> > +#define TIMER1_BASE 0x80
>> > +#define TIMER1_IMSK_BASE 0x6f
>> > +#define TIMER1_IFR_BASE 0x36
>> > +
>> > +/* Interrupt numbers used by peripherals */
>> > +#define USART_RXC_IRQ 24
>> > +#define USART_DRE_IRQ 25
>> > +#define USART_TXC_IRQ 26
>> > +
>> > +#define TIMER1_CAPT_IRQ 15
>> > +#define TIMER1_COMPA_IRQ 16
>> > +#define TIMER1_COMPB_IRQ 17
>> > +#define TIMER1_COMPC_IRQ 18
>> > +#define TIMER1_OVF_IRQ 19
>> > +
>> > +/*  Power reduction     */
>> > +#define PRR1_BIT_PRTIM5     0x05    /*  Timer/Counter5  */
>> > +#define PRR1_BIT_PRTIM4     0x04    /*  Timer/Counter4  */
>> > +#define PRR1_BIT_PRTIM3     0x03    /*  Timer/Counter3  */
>> > +#define PRR1_BIT_PRUSART3   0x02    /*  USART3  */
>> > +#define PRR1_BIT_PRUSART2   0x01    /*  USART2  */
>> > +#define PRR1_BIT_PRUSART1   0x00    /*  USART1  */
>> > +
>> > +#define PRR0_BIT_PRTWI      0x06    /*  TWI */
>> > +#define PRR0_BIT_PRTIM2     0x05    /*  Timer/Counter2  */
>> > +#define PRR0_BIT_PRTIM0     0x04    /*  Timer/Counter0  */
>> > +#define PRR0_BIT_PRTIM1     0x03    /*  Timer/Counter1  */
>> > +#define PRR0_BIT_PRSPI      0x02    /*  Serial Peripheral Interface */
>> > +#define PRR0_BIT_PRUSART0   0x01    /*  USART0  */
>> > +#define PRR0_BIT_PRADC      0x00    /*  ADC */
>> > +
>> > +typedef struct {
>> > +    MachineClass parent;
>> > +} SampleMachineClass;
>> > +
>> > +typedef struct {
>> > +    MachineState parent;
>> > +    MemoryRegion *ram;
>> > +    MemoryRegion *flash;
>> > +    AVRUsartState *usart0;
>> > +    AVRTimer16State *timer1;
>> > +    AVRMaskState *prr[2];
>> > +} SampleMachineState;
>> > +
>> > +#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
>> > +
>> > +#define SAMPLE_MACHINE(obj) \
>> > +    OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
>> > +#define SAMPLE_MACHINE_GET_CLASS(obj) \
>> > +    OBJECT_GET_CLASS(SampleMachineClass, obj, TYPE_SAMPLE_MACHINE)
>> > +#define SAMPLE_MACHINE_CLASS(klass) \
>> > +    OBJECT_CLASS_CHECK(SampleMachineClass, klass, TYPE_SAMPLE_MACHINE)
>> > +
>> > +static void sample_init(MachineState *machine)
>> > +{
>> > +    SampleMachineState *sms = SAMPLE_MACHINE(machine);
>> > +    MemoryRegion *system_memory = get_system_memory();
>> > +    AVRCPU *cpu;
>> > +    const char *firmware = NULL;
>> > +    const char *filename;
>> > +    int bytes_loaded;
>> > +    SysBusDevice *busdev;
>> > +    DeviceState *cpudev;
>> > +
>> > +    system_memory = get_system_memory();
>> > +    sms->ram = g_new(MemoryRegion, 1);
>> > +    sms->flash = g_new(MemoryRegion, 1);
>> > +
>> > +    cpu = AVR_CPU(cpu_create(machine->cpu_type));
>> > +    cpudev = DEVICE(cpu);
>> > +
>> > +    memory_region_allocate_system_memory(
>> > +        sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
>> > +    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
>>
>> Not sure this is correct, you are filling an area of 0x1e0 I/O registers
>> with RAM...
>>
> Please explain.
>
>
>>
>> So you use system_memory to model the first registers, I wonder if QEMU
>> supports a such small area. Well, I won't test it, I'll try a quicker
>> hack:
>>
>> -- >8 --
>> diff --git a/hw/avr/sample.c b/hw/avr/sample.c
>> index 563edbd417..cc60a6ca8d 100644
>> --- a/hw/avr/sample.c
>> +++ b/hw/avr/sample.c
>> @@ -48,6 +48,7 @@
>>  #include "include/hw/timer/avr_timer16.h"
>>  #include "include/hw/misc/avr_mask.h"
>>  #include "elf.h"
>> +#include "hw/misc/unimp.h"
>>
>>  #define SIZE_FLASH 0x00040000
>>  #define SIZE_SRAM 0x00002200
>> @@ -136,12 +137,29 @@ static void sample_init(MachineState *machine)
>>
>>      memory_region_allocate_system_memory(
>>          sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
>> -    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
>> +    memory_region_add_subregion_overlap(system_memory, OFFSET_DATA,
>> sms->ram,
>> +                                        -2000);
>>
>>      memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
>>              &error_fatal);
>>      memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
>>
>> +    create_unimplemented_device("io", 0x800000 + 0x20, 0x40);
>> +    create_unimplemented_device("data", 0x800000 + 0x20 + 0x40, 0x1a0);
>> +
>> +    create_unimplemented_device("gpio", 0x800000 + 0x20 + 0, 0x14);
>> +    create_unimplemented_device("intc", 0x800000 + 0x20 + 0x1c, 0x2);
>> +    create_unimplemented_device("tmr0", 0x800000 + 0x20 + 0x26, 0x3);
>> +    create_unimplemented_device("adc", 0x800000 + 0x20 + 0x78, 0x8);
>> +    create_unimplemented_device("tmr2", 0x800000 + 0x20 + 0x84, 0xa);
>> +    create_unimplemented_device("tmr3", 0x800000 + 0x20 + 0x94, 0xa);
>> +    create_unimplemented_device("tmr4", 0x800000 + 0x20 + 0xa4, 0xa);
>> +    create_unimplemented_device("uart0", 0x800000 + 0x20 + 0xc0, 0x8);
>> +    create_unimplemented_device("uart1", 0x800000 + 0x20 + 0xc8, 0x8);
>> +    create_unimplemented_device("uart2", 0x800000 + 0x20 + 0xd0, 0x8);
>> +    create_unimplemented_device("tmr5", 0x800000 + 0x20 + 0x124, 0xa);
>> +    create_unimplemented_device("uart3", 0x800000 + 0x20 + 0x130, 0x8);
>> +
>>      /* Power Reduction built-in peripheral */
>>      sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>>                      OFFSET_DATA + PRR0_BASE, NULL));
>> ---
>>
>> So instead of using a small RAM region for registers, I use the same
>> amount you used, but with lower priority (-2000). Then I create
>> 'UnimplementedDevice' for the most common blocks and map them (they'll
>> be mapped at prio -1000).
>>
>> Now we have this memory map:
>>
>> (qemu) info mtree
>> address-space: memory
>>   0000000000000000-ffffffffffffffff (prio 0, i/o): system
>>     0000000000000000-000000000003ffff (prio 0, rom): avr.flash
>>     0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
>>     0000000000800020-0000000000800033 (prio -1000, i/o): gpio
>>     0000000000800020-000000000080005f (prio -1000, i/o): io
>>     0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
>>     000000000080003c-000000000080003d (prio -1000, i/o): intc
>>     0000000000800046-0000000000800048 (prio -1000, i/o): tmr0
>>     0000000000800060-00000000008001ff (prio -1000, i/o): data
>>     0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
>>     0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
>>     000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
>>     0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
>>     0000000000800098-000000000080009f (prio -1000, i/o): adc
>>     00000000008000a4-00000000008000ad (prio -1000, i/o): tmr2
>>     00000000008000b4-00000000008000bd (prio -1000, i/o): tmr3
>>     00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart
>>     00000000008000c4-00000000008000cd (prio -1000, i/o): tmr4
>>     00000000008000e0-00000000008000e7 (prio -1000, i/o): uart0
>>     00000000008000e8-00000000008000ef (prio -1000, i/o): uart1
>>     00000000008000f0-00000000008000f7 (prio -1000, i/o): uart2
>>     0000000000800144-000000000080014d (prio -1000, i/o): tmr5
>>     0000000000800150-0000000000800157 (prio -1000, i/o): uart3
>>
>> The UnimplementedDevice is useful to quickly trace accesses from
>> firmware, you can see:
>>
>> $ avr-softmmu/qemu-system-avr -bios demo.elf -d unimp
>> gpio: unimplemented device write (size 1, value 0xff, offset 0x1)
>> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>> gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>>
>> So the Demo code first initialize the GPIO direction, then toggle it
>> (LED blink).
>>
>> > +
>> > +    memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
>> > +            &error_fatal);
>> > +    memory_region_add_subregion(system_memory, OFFSET_CODE,
>> sms->flash);
>> > +
>> > +    /* Power Reduction built-in peripheral */
>> > +    sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>> > +                    OFFSET_DATA + PRR0_BASE, NULL));
>> > +    sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>> > +                    OFFSET_DATA + PRR1_BASE, NULL));
>> > +
>> > +    /* USART 0 built-in peripheral */
>> > +    sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
>> > +    busdev = SYS_BUS_DEVICE(sms->usart0);
>> > +    qdev_prop_set_chr(DEVICE(sms->usart0), "chardev", serial_hd(0));
>> > +    object_property_set_bool(OBJECT(sms->usart0), true, "realized",
>> > +            &error_fatal);
>> > +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);
>>
>> This OFFSET_DATA makes me wonder... These are I/O devices, it would be
>> cleaner to map them on the I/O bus, and remap the I/O bus to OFFSET_DATA.
>>
> Please look here (https://www.avr-tutorials.com/general/avr-memory-map)
> some io registers are accessible as if they are memory.
>
>>
>> Something like this I guess:
>>
>> (qemu) info mtree
>> address-space: memory
>>   0000000000000000-ffffffffffffffff (prio 0, i/o): system
>>     0000000000000000-000000000003ffff (prio 0, rom): avr.flash
>>     0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
>>     0000000000800020-00000000008001ff (prio -1000, i/o): avr.io
>>
>> address-space: I/O
>>   0000000000000000-00000000000001ff (prio 0, i/o): avr.io
>>     0000000000000000-0000000000000033 (prio -1000, i/o): gpio
>>     0000000000000016-0000000000000016 (prio 0, i/o): avr-timer16
>>     000000000000001c-000000000000001d (prio -1000, i/o): intc
>>     0000000000000026-0000000000000028 (prio -1000, i/o): tmr0
>>     0000000000000044-0000000000000044 (prio 0, i/o): avr-mask
>>     0000000000000045-0000000000000045 (prio 0, i/o): avr-mask
>>     000000000000004f-000000000000004f (prio 0, i/o): avr-timer16
>>     0000000000000060-000000000000006d (prio 0, i/o): avr-timer16
>>     0000000000000078-000000000000007f (prio -1000, i/o): adc
>>     0000000000000084-000000000000008d (prio -1000, i/o): tmr2
>>     0000000000000094-000000000000009d (prio -1000, i/o): tmr3
>>     00000000000000a0-00000000000000a7 (prio 0, i/o): avr-usart
>>     00000000000000a4-00000000000000ad (prio -1000, i/o): tmr4
>>     00000000000000c0-00000000000000c7 (prio -1000, i/o): uart0
>>     00000000000000c8-00000000000000cf (prio -1000, i/o): uart1
>>     00000000000000d0-00000000000000d7 (prio -1000, i/o): uart2
>>     0000000000000124-000000000000012d (prio -1000, i/o): tmr5
>>     0000000000000130-0000000000000127 (prio -1000, i/o): uart3
>>
>> > +    /*
>> > +     * These IRQ numbers don't match the datasheet because we're
>> counting from
>> > +     * zero and not including reset.
>> > +     */
>> > +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev,
>> USART_RXC_IRQ));
>> > +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
>> USART_DRE_IRQ));
>> > +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
>> USART_TXC_IRQ));
>> > +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]), PRR1_BIT_PRUSART1,
>> > +            qdev_get_gpio_in(DEVICE(sms->usart0), 0));
>> > +
>> > +    /* Timer 1 built-in periphal */
>> > +    sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
>> > +    object_property_set_bool(OBJECT(sms->timer1), true, "realized",
>> > +            &error_fatal);
>> > +    busdev = SYS_BUS_DEVICE(sms->timer1);
>> > +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
>> > +    sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
>> > +    sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
>> > +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev,
>> TIMER1_CAPT_IRQ));
>> > +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
>> TIMER1_COMPA_IRQ));
>> > +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
>> TIMER1_COMPB_IRQ));
>> > +    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev,
>> TIMER1_COMPC_IRQ));
>> > +    sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev,
>> TIMER1_OVF_IRQ));
>> > +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]), PRR0_BIT_PRTIM1,
>> > +            qdev_get_gpio_in(DEVICE(sms->timer1), 0));
>> > +
>> > +    /* Load firmware (contents of flash) trying to auto-detect format
>> */
>> > +    firmware = machine->firmware;
>> > +    if (firmware != NULL) {
>> > +        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
>> > +        if (filename == NULL) {
>> > +            error_report("Unable to find %s", firmware);
>> > +            exit(1);
>> > +        }
>> > +
>> > +        bytes_loaded = load_elf(
>> > +            filename, NULL, NULL, NULL, NULL, NULL, NULL, 0, EM_NONE,
>> 0, 0);
>> > +        if (bytes_loaded < 0) {
>> > +            error_report(
>> > +                "Unable to load %s as ELF, trying again as raw binary",
>> > +                firmware);
>> > +            bytes_loaded = load_image_targphys(
>> > +                filename, OFFSET_CODE, SIZE_FLASH);
>> > +        }
>> > +        if (bytes_loaded < 0) {
>> > +            error_report(
>> > +                "Unable to load firmware image %s as ELF or raw
>> binary",
>> > +                firmware);
>> > +            exit(1);
>> > +        }
>> > +    }
>> > +}
>> > +
>> > +static void sample_class_init(ObjectClass *oc, void *data)
>> > +{
>> > +    MachineClass *mc = MACHINE_CLASS(oc);
>> > +
>> > +    mc->desc = "AVR sample/example board (ATmega2560)";
>> > +    mc->init = sample_init;
>> > +    mc->default_cpus = 1;
>> > +    mc->min_cpus = mc->default_cpus;
>> > +    mc->max_cpus = mc->default_cpus;
>> > +    mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
>> > +    mc->is_default = 1;
>> > +}
>> > +
>> > +static const TypeInfo sample_info = {
>> > +    .name = TYPE_SAMPLE_MACHINE,
>> > +    .parent = TYPE_MACHINE,
>> > +    .instance_size = sizeof(SampleMachineState),
>> > +    .class_size = sizeof(SampleMachineClass),
>> > +    .class_init = sample_class_init,
>> > +};
>> > +
>> > +static void sample_machine_init(void)
>> > +{
>> > +    type_register_static(&sample_info);
>> > +}
>> > +
>> > +type_init(sample_machine_init);
>> >
>>
>
>
> --
> Best Regards,
> Michael Rolnik
>
Philippe Mathieu-Daudé July 19, 2019, 3:29 p.m. UTC | #4
On 7/19/19 5:14 PM, Michael Rolnik wrote:
> I should have started the RAM at 0x200 (instead of 0) and make it of
> size 0x2000. right?
> 
> On Fri, Jul 19, 2019 at 6:04 PM Michael Rolnik <mrolnik@gmail.com
> <mailto:mrolnik@gmail.com>> wrote:
> 
> 
> 
>     On Fri, Jul 19, 2019 at 5:02 PM Philippe Mathieu-Daudé
>     <philmd@redhat.com <mailto:philmd@redhat.com>> wrote:
> 
>         Hi Michael,
> 
>         On 7/19/19 10:26 AM, Michael Rolnik wrote:
>         > From: Sarah Harris <S.E.Harris@kent.ac.uk
>         <mailto:S.E.Harris@kent.ac.uk>>
>         >
>         > A simple board setup that configures an AVR CPU to run a given
>         firmware image.
>         > This is all that's useful to implement without peripheral
>         emulation as AVR CPUs include a lot of on-board peripherals.
>         >
>         > Signed-off-by: Michael Rolnik <mrolnik@gmail.com
>         <mailto:mrolnik@gmail.com>>
>         > ---
>         >  hw/Kconfig           |   1 +
>         >  hw/avr/Kconfig       |   5 +
>         >  hw/avr/Makefile.objs |   1 +
>         >  hw/avr/sample.c      | 237
>         +++++++++++++++++++++++++++++++++++++++++++
>         >  4 files changed, 244 insertions(+)
>         >  create mode 100644 hw/avr/Kconfig
>         >  create mode 100644 hw/avr/Makefile.objs
>         >  create mode 100644 hw/avr/sample.c
>         >
>         > diff --git a/hw/Kconfig b/hw/Kconfig
>         > index 195f541e50..1f25636855 100644
>         > --- a/hw/Kconfig
>         > +++ b/hw/Kconfig
>         > @@ -42,6 +42,7 @@ source watchdog/Kconfig
>         >  # arch Kconfig
>         >  source arm/Kconfig
>         >  source alpha/Kconfig
>         > +source avr/Kconfig
>         >  source cris/Kconfig
>         >  source hppa/Kconfig
>         >  source i386/Kconfig
>         > diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
>         > new file mode 100644
>         > index 0000000000..dd02a4c37a
>         > --- /dev/null
>         > +++ b/hw/avr/Kconfig
>         > @@ -0,0 +1,5 @@
>         > +config AVR_SAMPLE
>         > +    bool
>         > +    select AVR_TIMER16
>         > +    select AVR_USART
>         > +    select AVR_MASK
>         > diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
>         > new file mode 100644
>         > index 0000000000..626b7064b3
>         > --- /dev/null
>         > +++ b/hw/avr/Makefile.objs
>         > @@ -0,0 +1 @@
>         > +obj-y += sample.o
>         > diff --git a/hw/avr/sample.c b/hw/avr/sample.c
>         > new file mode 100644
>         > index 0000000000..563edbd417
>         > --- /dev/null
>         > +++ b/hw/avr/sample.c
>         > @@ -0,0 +1,237 @@
>         > +/*
>         > + * QEMU AVR CPU
>         > + *
>         > + * Copyright (c) 2019 Michael Rolnik
>         > + *
>         > + * This library is free software; you can redistribute it and/or
>         > + * modify it under the terms of the GNU Lesser General Public
>         > + * License as published by the Free Software Foundation; either
>         > + * version 2.1 of the License, or (at your option) any later
>         version.
>         > + *
>         > + * This library is distributed in the hope that it will be
>         useful,
>         > + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>         > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
>         the GNU
>         > + * Lesser General Public License for more details.
>         > + *
>         > + * You should have received a copy of the GNU Lesser General
>         Public
>         > + * License along with this library; if not, see
>         > + * <http://www.gnu.org/licenses/lgpl-2.1.html>
>         > + */
>         > +
>         > +/*
>         > + *  NOTE:
>         > + *      This is not a real AVR board, this is an example!
>         > + *      The CPU is an approximation of an ATmega2560, but is
>         missing various
>         > + *      built-in peripherals.
>         > + *
>         > + *      This example board loads provided binary file into
>         flash memory and
>         > + *      executes it from 0x00000000 address in the code
>         memory space.
>         > + *
>         > + *      Currently used for AVR CPU validation
>         > + *
>         > + */
>         > +
>         > +#include "qemu/osdep.h"
>         > +#include "qapi/error.h"
>         > +#include "qemu-common.h"
>         > +#include "cpu.h"
>         > +#include "hw/hw.h"
>         > +#include "sysemu/sysemu.h"
>         > +#include "sysemu/qtest.h"
>         > +#include "ui/console.h"
>         > +#include "hw/boards.h"
>         > +#include "hw/loader.h"
>         > +#include "qemu/error-report.h"
>         > +#include "exec/address-spaces.h"
>         > +#include "include/hw/sysbus.h"
>         > +#include "include/hw/char/avr_usart.h"
>         > +#include "include/hw/timer/avr_timer16.h"
>         > +#include "include/hw/misc/avr_mask.h"
>         > +#include "elf.h"
>         > +
>         > +#define SIZE_FLASH 0x00040000
>         > +#define SIZE_SRAM 0x00002200
>         > +/*
>         > + * Size of additional "external" memory, as if the AVR were
>         configured to use
>         > + * an external RAM chip.
>         > + * Note that the configuration registers that normally enable
>         this feature are
>         > + * unimplemented.
>         > + */
>         > +#define SIZE_EXMEM 0x00000000
>         > +
>         > +/* Offsets of periphals in emulated memory space (i.e. not
>         host addresses)  */
>         > +#define PRR0_BASE 0x64
>         > +#define PRR1_BASE 0x65
>         > +#define USART_BASE 0xc0
>         > +#define TIMER1_BASE 0x80
>         > +#define TIMER1_IMSK_BASE 0x6f
>         > +#define TIMER1_IFR_BASE 0x36
>         > +
>         > +/* Interrupt numbers used by peripherals */
>         > +#define USART_RXC_IRQ 24
>         > +#define USART_DRE_IRQ 25
>         > +#define USART_TXC_IRQ 26
>         > +
>         > +#define TIMER1_CAPT_IRQ 15
>         > +#define TIMER1_COMPA_IRQ 16
>         > +#define TIMER1_COMPB_IRQ 17
>         > +#define TIMER1_COMPC_IRQ 18
>         > +#define TIMER1_OVF_IRQ 19
>         > +
>         > +/*  Power reduction     */
>         > +#define PRR1_BIT_PRTIM5     0x05    /*  Timer/Counter5  */
>         > +#define PRR1_BIT_PRTIM4     0x04    /*  Timer/Counter4  */
>         > +#define PRR1_BIT_PRTIM3     0x03    /*  Timer/Counter3  */
>         > +#define PRR1_BIT_PRUSART3   0x02    /*  USART3  */
>         > +#define PRR1_BIT_PRUSART2   0x01    /*  USART2  */
>         > +#define PRR1_BIT_PRUSART1   0x00    /*  USART1  */
>         > +
>         > +#define PRR0_BIT_PRTWI      0x06    /*  TWI */
>         > +#define PRR0_BIT_PRTIM2     0x05    /*  Timer/Counter2  */
>         > +#define PRR0_BIT_PRTIM0     0x04    /*  Timer/Counter0  */
>         > +#define PRR0_BIT_PRTIM1     0x03    /*  Timer/Counter1  */
>         > +#define PRR0_BIT_PRSPI      0x02    /*  Serial Peripheral
>         Interface */
>         > +#define PRR0_BIT_PRUSART0   0x01    /*  USART0  */
>         > +#define PRR0_BIT_PRADC      0x00    /*  ADC */
>         > +
>         > +typedef struct {
>         > +    MachineClass parent;
>         > +} SampleMachineClass;
>         > +
>         > +typedef struct {
>         > +    MachineState parent;
>         > +    MemoryRegion *ram;
>         > +    MemoryRegion *flash;
>         > +    AVRUsartState *usart0;
>         > +    AVRTimer16State *timer1;
>         > +    AVRMaskState *prr[2];
>         > +} SampleMachineState;
>         > +
>         > +#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
>         > +
>         > +#define SAMPLE_MACHINE(obj) \
>         > +    OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
>         > +#define SAMPLE_MACHINE_GET_CLASS(obj) \
>         > +    OBJECT_GET_CLASS(SampleMachineClass, obj,
>         TYPE_SAMPLE_MACHINE)
>         > +#define SAMPLE_MACHINE_CLASS(klass) \
>         > +    OBJECT_CLASS_CHECK(SampleMachineClass, klass,
>         TYPE_SAMPLE_MACHINE)
>         > +
>         > +static void sample_init(MachineState *machine)
>         > +{
>         > +    SampleMachineState *sms = SAMPLE_MACHINE(machine);
>         > +    MemoryRegion *system_memory = get_system_memory();
>         > +    AVRCPU *cpu;
>         > +    const char *firmware = NULL;
>         > +    const char *filename;
>         > +    int bytes_loaded;
>         > +    SysBusDevice *busdev;
>         > +    DeviceState *cpudev;
>         > +
>         > +    system_memory = get_system_memory();
>         > +    sms->ram = g_new(MemoryRegion, 1);
>         > +    sms->flash = g_new(MemoryRegion, 1);
>         > +
>         > +    cpu = AVR_CPU(cpu_create(machine->cpu_type));
>         > +    cpudev = DEVICE(cpu);
>         > +
>         > +    memory_region_allocate_system_memory(
>         > +        sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
>         > +    memory_region_add_subregion(system_memory, OFFSET_DATA,
>         sms->ram);
> 
>         Not sure this is correct, you are filling an area of 0x1e0 I/O
>         registers
>         with RAM...
> 
>     Please explain. 

The DATA range 0x000..0x1ff is an I/O range.
The DATA range 0x200..0x2200 is the SRAM range. (8K * 8-bit)

You mapped the sms->ram over:

(qemu) info mtree
address-space: memory
  0000000000000000-ffffffffffffffff (prio 0, i/o): system
    0000000000000000-000000000003ffff (prio 0, rom): avr.flash
    0000000000800000-00000000008021ff (prio 0, ram): avr.ram
    0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
    0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
    0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
    000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
    0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
    00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart

>      
> 
> 
>         So you use system_memory to model the first registers, I wonder
>         if QEMU
>         supports a such small area. Well, I won't test it, I'll try a
>         quicker hack:
> 
>         -- >8 --
>         diff --git a/hw/avr/sample.c b/hw/avr/sample.c
>         index 563edbd417..cc60a6ca8d 100644
>         --- a/hw/avr/sample.c
>         +++ b/hw/avr/sample.c
>         @@ -48,6 +48,7 @@
>          #include "include/hw/timer/avr_timer16.h"
>          #include "include/hw/misc/avr_mask.h"
>          #include "elf.h"
>         +#include "hw/misc/unimp.h"
> 
>          #define SIZE_FLASH 0x00040000
>          #define SIZE_SRAM 0x00002200
>         @@ -136,12 +137,29 @@ static void sample_init(MachineState *machine)
> 
>              memory_region_allocate_system_memory(
>                  sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
>         -    memory_region_add_subregion(system_memory, OFFSET_DATA,
>         sms->ram);
>         +    memory_region_add_subregion_overlap(system_memory, OFFSET_DATA,
>         sms->ram,
>         +                                        -2000);
> 
>              memory_region_init_rom(sms->flash, NULL, "avr.flash",
>         SIZE_FLASH,
>                      &error_fatal);
>              memory_region_add_subregion(system_memory, OFFSET_CODE,
>         sms->flash);
> 
>         +    create_unimplemented_device("io", 0x800000 + 0x20, 0x40);
>         +    create_unimplemented_device("data", 0x800000 + 0x20 + 0x40,
>         0x1a0);
>         +
>         +    create_unimplemented_device("gpio", 0x800000 + 0x20 + 0, 0x14);
>         +    create_unimplemented_device("intc", 0x800000 + 0x20 + 0x1c,
>         0x2);
>         +    create_unimplemented_device("tmr0", 0x800000 + 0x20 + 0x26,
>         0x3);
>         +    create_unimplemented_device("adc", 0x800000 + 0x20 + 0x78,
>         0x8);
>         +    create_unimplemented_device("tmr2", 0x800000 + 0x20 + 0x84,
>         0xa);
>         +    create_unimplemented_device("tmr3", 0x800000 + 0x20 + 0x94,
>         0xa);
>         +    create_unimplemented_device("tmr4", 0x800000 + 0x20 + 0xa4,
>         0xa);
>         +    create_unimplemented_device("uart0", 0x800000 + 0x20 +
>         0xc0, 0x8);
>         +    create_unimplemented_device("uart1", 0x800000 + 0x20 +
>         0xc8, 0x8);
>         +    create_unimplemented_device("uart2", 0x800000 + 0x20 +
>         0xd0, 0x8);
>         +    create_unimplemented_device("tmr5", 0x800000 + 0x20 +
>         0x124, 0xa);
>         +    create_unimplemented_device("uart3", 0x800000 + 0x20 +
>         0x130, 0x8);
>         +
>              /* Power Reduction built-in peripheral */
>              sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>                              OFFSET_DATA + PRR0_BASE, NULL));
>         ---
> 
>         So instead of using a small RAM region for registers, I use the same
>         amount you used, but with lower priority (-2000). Then I create
>         'UnimplementedDevice' for the most common blocks and map them
>         (they'll
>         be mapped at prio -1000).
> 
>         Now we have this memory map:
> 
>         (qemu) info mtree
>         address-space: memory
>           0000000000000000-ffffffffffffffff (prio 0, i/o): system
>             0000000000000000-000000000003ffff (prio 0, rom): avr.flash
>             0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
>             0000000000800020-0000000000800033 (prio -1000, i/o): gpio
>             0000000000800020-000000000080005f (prio -1000, i/o): io
>             0000000000800036-0000000000800036 (prio 0, i/o): avr-timer16
>             000000000080003c-000000000080003d (prio -1000, i/o): intc
>             0000000000800046-0000000000800048 (prio -1000, i/o): tmr0
>             0000000000800060-00000000008001ff (prio -1000, i/o): data
>             0000000000800064-0000000000800064 (prio 0, i/o): avr-mask
>             0000000000800065-0000000000800065 (prio 0, i/o): avr-mask
>             000000000080006f-000000000080006f (prio 0, i/o): avr-timer16
>             0000000000800080-000000000080008d (prio 0, i/o): avr-timer16
>             0000000000800098-000000000080009f (prio -1000, i/o): adc
>             00000000008000a4-00000000008000ad (prio -1000, i/o): tmr2
>             00000000008000b4-00000000008000bd (prio -1000, i/o): tmr3
>             00000000008000c0-00000000008000c7 (prio 0, i/o): avr-usart
>             00000000008000c4-00000000008000cd (prio -1000, i/o): tmr4
>             00000000008000e0-00000000008000e7 (prio -1000, i/o): uart0
>             00000000008000e8-00000000008000ef (prio -1000, i/o): uart1
>             00000000008000f0-00000000008000f7 (prio -1000, i/o): uart2
>             0000000000800144-000000000080014d (prio -1000, i/o): tmr5
>             0000000000800150-0000000000800157 (prio -1000, i/o): uart3
> 
>         The UnimplementedDevice is useful to quickly trace accesses from
>         firmware, you can see:
> 
>         $ avr-softmmu/qemu-system-avr -bios demo.elf -d unimp
>         gpio: unimplemented device write (size 1, value 0xff, offset 0x1)
>         gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xef, offset 0x2)
>         gpio: unimplemented device write (size 1, value 0xff, offset 0x2)
> 
>         So the Demo code first initialize the GPIO direction, then toggle it
>         (LED blink).
> 
>         > +
>         > +    memory_region_init_rom(sms->flash, NULL, "avr.flash",
>         SIZE_FLASH,
>         > +            &error_fatal);
>         > +    memory_region_add_subregion(system_memory, OFFSET_CODE,
>         sms->flash);
>         > +
>         > +    /* Power Reduction built-in peripheral */
>         > +    sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>         > +                    OFFSET_DATA + PRR0_BASE, NULL));
>         > +    sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
>         > +                    OFFSET_DATA + PRR1_BASE, NULL));
>         > +
>         > +    /* USART 0 built-in peripheral */
>         > +    sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
>         > +    busdev = SYS_BUS_DEVICE(sms->usart0);
>         > +    qdev_prop_set_chr(DEVICE(sms->usart0), "chardev",
>         serial_hd(0));
>         > +    object_property_set_bool(OBJECT(sms->usart0), true,
>         "realized",
>         > +            &error_fatal);
>         > +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);
> 
>         This OFFSET_DATA makes me wonder... These are I/O devices, it
>         would be
>         cleaner to map them on the I/O bus, and remap the I/O bus to
>         OFFSET_DATA.
> 
>     Please look here
>     (https://www.avr-tutorials.com/general/avr-memory-map) some io
>     registers are accessible as if they are memory.  

This show the ATMega8515 memory map, you choosed to model the ATmega2560
which is more complex.

I'm reading the 2549Q–AVR–02/2014 datasheet
"ATmega640/V-1280/V-1281/V-2560/V-2561/V [DATASHEET]".

Please have a look at Figure 8-2, "Data Memory Map"

> 
> 
>         Something like this I guess:
> 
>         (qemu) info mtree
>         address-space: memory
>           0000000000000000-ffffffffffffffff (prio 0, i/o): system
>             0000000000000000-000000000003ffff (prio 0, rom): avr.flash
>             0000000000800000-00000000008021ff (prio -2000, ram): avr.ram
>             0000000000800020-00000000008001ff (prio -1000, i/o): avr.io
>         <http://avr.io>
> 
>         address-space: I/O
>           0000000000000000-00000000000001ff (prio 0, i/o): avr.io
>         <http://avr.io>


This part ...

>             0000000000000000-0000000000000033 (prio -1000, i/o): gpio
>             0000000000000016-0000000000000016 (prio 0, i/o): avr-timer16
>             000000000000001c-000000000000001d (prio -1000, i/o): intc
>             0000000000000026-0000000000000028 (prio -1000, i/o): tmr0

are the 64 base I/O register, mapped in 0x20..0x5f.

---

This part ...

>             0000000000000044-0000000000000044 (prio 0, i/o): avr-mask
>             0000000000000045-0000000000000045 (prio 0, i/o): avr-mask
>             000000000000004f-000000000000004f (prio 0, i/o): avr-timer16
>             0000000000000060-000000000000006d (prio 0, i/o): avr-timer16
>             0000000000000078-000000000000007f (prio -1000, i/o): adc
>             0000000000000084-000000000000008d (prio -1000, i/o): tmr2
>             0000000000000094-000000000000009d (prio -1000, i/o): tmr3
>             00000000000000a0-00000000000000a7 (prio 0, i/o): avr-usart
>             00000000000000a4-00000000000000ad (prio -1000, i/o): tmr4
>             00000000000000c0-00000000000000c7 (prio -1000, i/o): uart0
>             00000000000000c8-00000000000000cf (prio -1000, i/o): uart1
>             00000000000000d0-00000000000000d7 (prio -1000, i/o): uart2
>             0000000000000124-000000000000012d (prio -1000, i/o): tmr5
>             0000000000000130-0000000000000127 (prio -1000, i/o): uart3

... are the 416 External I/O registers, mapped in 0x60..0x1ff

> 
>         > +    /*
>         > +     * These IRQ numbers don't match the datasheet because
>         we're counting from
>         > +     * zero and not including reset.
>         > +     */
>         > +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev,
>         USART_RXC_IRQ));
>         > +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
>         USART_DRE_IRQ));
>         > +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
>         USART_TXC_IRQ));
>         > +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]),
>         PRR1_BIT_PRUSART1,
>         > +            qdev_get_gpio_in(DEVICE(sms->usart0), 0));
>         > +
>         > +    /* Timer 1 built-in periphal */
>         > +    sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
>         > +    object_property_set_bool(OBJECT(sms->timer1), true,
>         "realized",
>         > +            &error_fatal);
>         > +    busdev = SYS_BUS_DEVICE(sms->timer1);
>         > +    sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
>         > +    sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
>         > +    sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
>         > +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev,
>         TIMER1_CAPT_IRQ));
>         > +    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev,
>         TIMER1_COMPA_IRQ));
>         > +    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev,
>         TIMER1_COMPB_IRQ));
>         > +    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev,
>         TIMER1_COMPC_IRQ));
>         > +    sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev,
>         TIMER1_OVF_IRQ));
>         > +    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]),
>         PRR0_BIT_PRTIM1,
>         > +            qdev_get_gpio_in(DEVICE(sms->timer1), 0));
>         > +
>         > +    /* Load firmware (contents of flash) trying to
>         auto-detect format */
>         > +    firmware = machine->firmware;
>         > +    if (firmware != NULL) {
>         > +        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
>         > +        if (filename == NULL) {
>         > +            error_report("Unable to find %s", firmware);
>         > +            exit(1);
>         > +        }
>         > +
>         > +        bytes_loaded = load_elf(
>         > +            filename, NULL, NULL, NULL, NULL, NULL, NULL, 0,
>         EM_NONE, 0, 0);
>         > +        if (bytes_loaded < 0) {
>         > +            error_report(
>         > +                "Unable to load %s as ELF, trying again as
>         raw binary",
>         > +                firmware);
>         > +            bytes_loaded = load_image_targphys(
>         > +                filename, OFFSET_CODE, SIZE_FLASH);
>         > +        }
>         > +        if (bytes_loaded < 0) {
>         > +            error_report(
>         > +                "Unable to load firmware image %s as ELF or
>         raw binary",
>         > +                firmware);
>         > +            exit(1);
>         > +        }
>         > +    }
>         > +}
>         > +
>         > +static void sample_class_init(ObjectClass *oc, void *data)
>         > +{
>         > +    MachineClass *mc = MACHINE_CLASS(oc);
>         > +
>         > +    mc->desc = "AVR sample/example board (ATmega2560)";
>         > +    mc->init = sample_init;
>         > +    mc->default_cpus = 1;
>         > +    mc->min_cpus = mc->default_cpus;
>         > +    mc->max_cpus = mc->default_cpus;
>         > +    mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
>         > +    mc->is_default = 1;
>         > +}
>         > +
>         > +static const TypeInfo sample_info = {
>         > +    .name = TYPE_SAMPLE_MACHINE,
>         > +    .parent = TYPE_MACHINE,
>         > +    .instance_size = sizeof(SampleMachineState),
>         > +    .class_size = sizeof(SampleMachineClass),
>         > +    .class_init = sample_class_init,
>         > +};
>         > +
>         > +static void sample_machine_init(void)
>         > +{
>         > +    type_register_static(&sample_info);
>         > +}
>         > +
>         > +type_init(sample_machine_init);
>         >
> 
> 
> 
>     -- 
>     Best Regards,
>     Michael Rolnik
> 
> 
> 
> -- 
> Best Regards,
> Michael Rolnik
diff mbox series

Patch

diff --git a/hw/Kconfig b/hw/Kconfig
index 195f541e50..1f25636855 100644
--- a/hw/Kconfig
+++ b/hw/Kconfig
@@ -42,6 +42,7 @@  source watchdog/Kconfig
 # arch Kconfig
 source arm/Kconfig
 source alpha/Kconfig
+source avr/Kconfig
 source cris/Kconfig
 source hppa/Kconfig
 source i386/Kconfig
diff --git a/hw/avr/Kconfig b/hw/avr/Kconfig
new file mode 100644
index 0000000000..dd02a4c37a
--- /dev/null
+++ b/hw/avr/Kconfig
@@ -0,0 +1,5 @@ 
+config AVR_SAMPLE
+    bool
+    select AVR_TIMER16
+    select AVR_USART
+    select AVR_MASK
diff --git a/hw/avr/Makefile.objs b/hw/avr/Makefile.objs
new file mode 100644
index 0000000000..626b7064b3
--- /dev/null
+++ b/hw/avr/Makefile.objs
@@ -0,0 +1 @@ 
+obj-y += sample.o
diff --git a/hw/avr/sample.c b/hw/avr/sample.c
new file mode 100644
index 0000000000..563edbd417
--- /dev/null
+++ b/hw/avr/sample.c
@@ -0,0 +1,237 @@ 
+/*
+ * QEMU AVR CPU
+ *
+ * Copyright (c) 2019 Michael Rolnik
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see
+ * <http://www.gnu.org/licenses/lgpl-2.1.html>
+ */
+
+/*
+ *  NOTE:
+ *      This is not a real AVR board, this is an example!
+ *      The CPU is an approximation of an ATmega2560, but is missing various
+ *      built-in peripherals.
+ *
+ *      This example board loads provided binary file into flash memory and
+ *      executes it from 0x00000000 address in the code memory space.
+ *
+ *      Currently used for AVR CPU validation
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu-common.h"
+#include "cpu.h"
+#include "hw/hw.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/qtest.h"
+#include "ui/console.h"
+#include "hw/boards.h"
+#include "hw/loader.h"
+#include "qemu/error-report.h"
+#include "exec/address-spaces.h"
+#include "include/hw/sysbus.h"
+#include "include/hw/char/avr_usart.h"
+#include "include/hw/timer/avr_timer16.h"
+#include "include/hw/misc/avr_mask.h"
+#include "elf.h"
+
+#define SIZE_FLASH 0x00040000
+#define SIZE_SRAM 0x00002200
+/*
+ * Size of additional "external" memory, as if the AVR were configured to use
+ * an external RAM chip.
+ * Note that the configuration registers that normally enable this feature are
+ * unimplemented.
+ */
+#define SIZE_EXMEM 0x00000000
+
+/* Offsets of periphals in emulated memory space (i.e. not host addresses)  */
+#define PRR0_BASE 0x64
+#define PRR1_BASE 0x65
+#define USART_BASE 0xc0
+#define TIMER1_BASE 0x80
+#define TIMER1_IMSK_BASE 0x6f
+#define TIMER1_IFR_BASE 0x36
+
+/* Interrupt numbers used by peripherals */
+#define USART_RXC_IRQ 24
+#define USART_DRE_IRQ 25
+#define USART_TXC_IRQ 26
+
+#define TIMER1_CAPT_IRQ 15
+#define TIMER1_COMPA_IRQ 16
+#define TIMER1_COMPB_IRQ 17
+#define TIMER1_COMPC_IRQ 18
+#define TIMER1_OVF_IRQ 19
+
+/*  Power reduction     */
+#define PRR1_BIT_PRTIM5     0x05    /*  Timer/Counter5  */
+#define PRR1_BIT_PRTIM4     0x04    /*  Timer/Counter4  */
+#define PRR1_BIT_PRTIM3     0x03    /*  Timer/Counter3  */
+#define PRR1_BIT_PRUSART3   0x02    /*  USART3  */
+#define PRR1_BIT_PRUSART2   0x01    /*  USART2  */
+#define PRR1_BIT_PRUSART1   0x00    /*  USART1  */
+
+#define PRR0_BIT_PRTWI      0x06    /*  TWI */
+#define PRR0_BIT_PRTIM2     0x05    /*  Timer/Counter2  */
+#define PRR0_BIT_PRTIM0     0x04    /*  Timer/Counter0  */
+#define PRR0_BIT_PRTIM1     0x03    /*  Timer/Counter1  */
+#define PRR0_BIT_PRSPI      0x02    /*  Serial Peripheral Interface */
+#define PRR0_BIT_PRUSART0   0x01    /*  USART0  */
+#define PRR0_BIT_PRADC      0x00    /*  ADC */
+
+typedef struct {
+    MachineClass parent;
+} SampleMachineClass;
+
+typedef struct {
+    MachineState parent;
+    MemoryRegion *ram;
+    MemoryRegion *flash;
+    AVRUsartState *usart0;
+    AVRTimer16State *timer1;
+    AVRMaskState *prr[2];
+} SampleMachineState;
+
+#define TYPE_SAMPLE_MACHINE MACHINE_TYPE_NAME("sample")
+
+#define SAMPLE_MACHINE(obj) \
+    OBJECT_CHECK(SampleMachineState, obj, TYPE_SAMPLE_MACHINE)
+#define SAMPLE_MACHINE_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(SampleMachineClass, obj, TYPE_SAMPLE_MACHINE)
+#define SAMPLE_MACHINE_CLASS(klass) \
+    OBJECT_CLASS_CHECK(SampleMachineClass, klass, TYPE_SAMPLE_MACHINE)
+
+static void sample_init(MachineState *machine)
+{
+    SampleMachineState *sms = SAMPLE_MACHINE(machine);
+    MemoryRegion *system_memory = get_system_memory();
+    AVRCPU *cpu;
+    const char *firmware = NULL;
+    const char *filename;
+    int bytes_loaded;
+    SysBusDevice *busdev;
+    DeviceState *cpudev;
+
+    system_memory = get_system_memory();
+    sms->ram = g_new(MemoryRegion, 1);
+    sms->flash = g_new(MemoryRegion, 1);
+
+    cpu = AVR_CPU(cpu_create(machine->cpu_type));
+    cpudev = DEVICE(cpu);
+
+    memory_region_allocate_system_memory(
+        sms->ram, NULL, "avr.ram", SIZE_SRAM + SIZE_EXMEM);
+    memory_region_add_subregion(system_memory, OFFSET_DATA, sms->ram);
+
+    memory_region_init_rom(sms->flash, NULL, "avr.flash", SIZE_FLASH,
+            &error_fatal);
+    memory_region_add_subregion(system_memory, OFFSET_CODE, sms->flash);
+
+    /* Power Reduction built-in peripheral */
+    sms->prr[0] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
+                    OFFSET_DATA + PRR0_BASE, NULL));
+    sms->prr[1] = AVR_MASK(sysbus_create_simple(TYPE_AVR_MASK,
+                    OFFSET_DATA + PRR1_BASE, NULL));
+
+    /* USART 0 built-in peripheral */
+    sms->usart0 = AVR_USART(object_new(TYPE_AVR_USART));
+    busdev = SYS_BUS_DEVICE(sms->usart0);
+    qdev_prop_set_chr(DEVICE(sms->usart0), "chardev", serial_hd(0));
+    object_property_set_bool(OBJECT(sms->usart0), true, "realized",
+            &error_fatal);
+    sysbus_mmio_map(busdev, 0, OFFSET_DATA + USART_BASE);
+    /*
+     * These IRQ numbers don't match the datasheet because we're counting from
+     * zero and not including reset.
+     */
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, USART_RXC_IRQ));
+    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, USART_DRE_IRQ));
+    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, USART_TXC_IRQ));
+    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[1]), PRR1_BIT_PRUSART1,
+            qdev_get_gpio_in(DEVICE(sms->usart0), 0));
+
+    /* Timer 1 built-in periphal */
+    sms->timer1 = AVR_TIMER16(object_new(TYPE_AVR_TIMER16));
+    object_property_set_bool(OBJECT(sms->timer1), true, "realized",
+            &error_fatal);
+    busdev = SYS_BUS_DEVICE(sms->timer1);
+    sysbus_mmio_map(busdev, 0, OFFSET_DATA + TIMER1_BASE);
+    sysbus_mmio_map(busdev, 1, OFFSET_DATA + TIMER1_IMSK_BASE);
+    sysbus_mmio_map(busdev, 2, OFFSET_DATA + TIMER1_IFR_BASE);
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(cpudev, TIMER1_CAPT_IRQ));
+    sysbus_connect_irq(busdev, 1, qdev_get_gpio_in(cpudev, TIMER1_COMPA_IRQ));
+    sysbus_connect_irq(busdev, 2, qdev_get_gpio_in(cpudev, TIMER1_COMPB_IRQ));
+    sysbus_connect_irq(busdev, 3, qdev_get_gpio_in(cpudev, TIMER1_COMPC_IRQ));
+    sysbus_connect_irq(busdev, 4, qdev_get_gpio_in(cpudev, TIMER1_OVF_IRQ));
+    sysbus_connect_irq(SYS_BUS_DEVICE(sms->prr[0]), PRR0_BIT_PRTIM1,
+            qdev_get_gpio_in(DEVICE(sms->timer1), 0));
+
+    /* Load firmware (contents of flash) trying to auto-detect format */
+    firmware = machine->firmware;
+    if (firmware != NULL) {
+        filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, firmware);
+        if (filename == NULL) {
+            error_report("Unable to find %s", firmware);
+            exit(1);
+        }
+
+        bytes_loaded = load_elf(
+            filename, NULL, NULL, NULL, NULL, NULL, NULL, 0, EM_NONE, 0, 0);
+        if (bytes_loaded < 0) {
+            error_report(
+                "Unable to load %s as ELF, trying again as raw binary",
+                firmware);
+            bytes_loaded = load_image_targphys(
+                filename, OFFSET_CODE, SIZE_FLASH);
+        }
+        if (bytes_loaded < 0) {
+            error_report(
+                "Unable to load firmware image %s as ELF or raw binary",
+                firmware);
+            exit(1);
+        }
+    }
+}
+
+static void sample_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "AVR sample/example board (ATmega2560)";
+    mc->init = sample_init;
+    mc->default_cpus = 1;
+    mc->min_cpus = mc->default_cpus;
+    mc->max_cpus = mc->default_cpus;
+    mc->default_cpu_type = "avr6-avr-cpu"; /* ATmega2560. */
+    mc->is_default = 1;
+}
+
+static const TypeInfo sample_info = {
+    .name = TYPE_SAMPLE_MACHINE,
+    .parent = TYPE_MACHINE,
+    .instance_size = sizeof(SampleMachineState),
+    .class_size = sizeof(SampleMachineClass),
+    .class_init = sample_class_init,
+};
+
+static void sample_machine_init(void)
+{
+    type_register_static(&sample_info);
+}
+
+type_init(sample_machine_init);