summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAmaury Pouly <amaury.pouly@gmail.com>2017-01-23 22:48:42 +0100
committerAmaury Pouly <amaury.pouly@gmail.com>2017-01-24 15:25:14 +0100
commit8e07d6845277efb96e067306f1ec9bc378c58bc0 (patch)
tree579e455a36e85f09cfe542fc45128b53a77dbc96
parent50eaa2d9ac3e23c5212ba2d0cd1dba4a995ab2c1 (diff)
downloadrockbox-8e07d6845277efb96e067306f1ec9bc378c58bc0.tar.gz
rockbox-8e07d6845277efb96e067306f1ec9bc378c58bc0.zip
hwstub: add various jz stuff and xburst tests
The JZ misc allows to enable and test SRAM. The XBurst code uses the coprocessor interface to analyse the cpu. It also provides a test platform for various features like EBASE and exceptions. I was able to test and confirm that on jz4760b (thus xburst), EBASE works (but top 2 bits are not controllable and always 01). The processor claims to support vector interrupts but this is untested. The values in ConfigX are not to be trusted blindly, clearly some are wrong. I tried to use the JZ4780 Config7 "ebase gate" to change bit 30 of EBASE but it does not work, which suggests that JZ480 uses a newer version of XBurst. Detailled log below: > ./hwstub_shell -q -f lua/xburst.lua -e "XBURST.init()" [...] XBurst: PRId: 0x2ed0024f CPU: JZ4760(B) Config: 0x80000483 Architecture Type: MIPS32 Architecture Level: Release 2 (or more) MMU Type: Standard TLB Config1: 0x3e63318a MMU Size: 32 ICache Sets per way: 128 Ways: 4 Line size: 32 DCache Sets per way: 128 Ways: 4 Line size: 32 FPU: no Config2: 0x80000000 Config3: 0x20 Vectored interrupt: yes Config7: 0x0 > ./hwstub_shell -q -e 'require("jz/misc"); JZ.misc.enable_sram()' \ -f lua/xburst.lua -e "XBURST.test_ebase(0x80000000);XBURST.test_ebase(0xb32d0000) [...] Testing EBASE... Disable BEV SR value: 0x2000fc00 EBASE value: 0x80000000 Value after writing 0x80000000: 0x80000000 Value after writing 0x80040000: 0x80040000 Test result: EBase seems to work Disable config7 gate: write 0x0 to Config7 Value after writing 0xfffff000: 0xbffff000 Enable config7 gate: write 0x80 to Config7 Value after writing 0xc0000000: 0x80000000 Config7 result: Config7 gate does not work Exception test with EBASE at 0x80000000... Writing instructions to memory Old SR: 0x2000fc00 New SR: 0xfc00 EBASE: 80000000 Before: cafebabe After: deadbeef Exception result: Exception and EBASE are working Testing EBASE... Disable BEV SR value: 0x2000fc00 EBASE value: 0x80000000 Value after writing 0x80000000: 0x80000000 Value after writing 0x80040000: 0x80040000 Test result: EBase seems to work Disable config7 gate: write 0x0 to Config7 Value after writing 0xfffff000: 0xbffff000 Enable config7 gate: write 0x80 to Config7 Value after writing 0xc0000000: 0x80000000 Config7 result: Config7 gate does not work Exception test with EBASE at 0xb32d0000... Writing instructions to memory Old SR: 0x2000fc00 New SR: 0xfc00 EBASE: b32d0000 Before: cafebabe After: deadbeef Exception result: Exception and EBASE are working Change-Id: I894227981a141a8c14419b36ed9f519baf145ad1
-rw-r--r--utils/hwstub/tools/lua/jz/misc.lua43
-rw-r--r--utils/hwstub/tools/lua/xburst.lua238
2 files changed, 281 insertions, 0 deletions
diff --git a/utils/hwstub/tools/lua/jz/misc.lua b/utils/hwstub/tools/lua/jz/misc.lua
new file mode 100644
index 0000000000..fb4185de33
--- /dev/null
+++ b/utils/hwstub/tools/lua/jz/misc.lua
@@ -0,0 +1,43 @@
+----------
+-- MISC --
+----------
+
+JZ.misc = {}
+
+function JZ.misc.enable_sram()
+ HW.CPM.CLKGATE1.SRAM.clr()
+ HW.CPM.CLKGATE1.AHB1.clr()
+end
+
+function JZ.misc.test_sram()
+ DEV.write32(0xb32d0000, 0xaaaa5555)
+ if DEV.read32(0xb32d0000) ~= 0xaaaa5555 then
+ error("SRAM is not working")
+ end
+ DEV.write32(0xb32d0000, 0xdeadbeef)
+ if DEV.read32(0xb32d0000) ~= 0xdeadbeef then
+ error("SRAM is not working")
+ end
+ print("SRAM seems to be working")
+ size = 0
+ for i=4,64*1024,4 do
+ DEV.write32(0xb32d0000, 0xdeadbeef)
+ DEV.write32(0xb32d0000 + i, 0xcafebabe)
+ if DEV.read32(0xb32d0000 + i) ~= 0xcafebabe or DEV.read32(0xb32d0000) == 0xcafebabe then
+ size = i
+ break
+ end
+ end
+ print(string.format("SRAM size: 0x%x (%d KiB)", size, size / 1024))
+ -- double check
+ for i=0,size-1,2 do
+ DEV.write16(0xb32d0000 + i, i)
+ end
+ for i=0,size-1,2 do
+ if DEV.read16(0xb32d0000 + i) ~= i then
+ error(string.format("SRAM size is not confirmed: read @%x gives %d instead of %d",
+ 0xb32d0000 + i, DEV.read16(0xb32d0000 + i), i))
+ end
+ end
+ print("SRAM size confirmed and working")
+end
diff --git a/utils/hwstub/tools/lua/xburst.lua b/utils/hwstub/tools/lua/xburst.lua
new file mode 100644
index 0000000000..ddaf7fbc66
--- /dev/null
+++ b/utils/hwstub/tools/lua/xburst.lua
@@ -0,0 +1,238 @@
+XBURST = {}
+
+function XBURST.read_cp0(reg, sel)
+ return DEV.read32_cop({0, reg, sel})
+end
+
+function XBURST.write_cp0(reg, sel, val)
+ DEV.write32_cop({0, reg, sel}, val)
+end
+
+XBURST.prid_table = {
+ [0x0ad0024f] = "JZ4740",
+ [0x1ed0024f] = "JZ4755",
+ [0x2ed0024f] = "JZ4760(B)",
+ [0x3ee1024f] = "JZ4780"
+}
+
+XBURST.at_table = {
+ [0] = "MIPS32",
+ [1] = "MIPS64 with 32-bit segments",
+ [2] = "MIPS64"
+}
+
+XBURST.ar_table = {
+ [0] = "Release 1",
+ [1] = "Release 2 (or more)"
+}
+
+XBURST.mt_table = {
+ [0] = "None",
+ [1] = "Standard TLB",
+ [2] = "BAT",
+ [3] = "Fixed Mapping",
+ [4] = "Dual VTLB and FTLB"
+}
+
+XBURST.is_table = {
+ [0] = 64,
+ [1] = 128,
+ [2] = 256,
+ [3] = 512,
+ [4] = 1024,
+ [5] = 2048,
+ [6] = 4096,
+ [7] = 32
+}
+
+XBURST.il_table = {
+ [0] = 0,
+ [1] = 4,
+ [2] = 8,
+ [3] = 16,
+ [4] = 32,
+ [5] = 64,
+ [6] = 128
+}
+
+function XBURST.get_table_or(tbl, index, dflt)
+ if tbl[index] ~= nil then
+ return tbl[index]
+ else
+ return dflt
+ end
+end
+
+function XBURST.do_ebase_test()
+ XBURST.write_cp0(15, 1, 0x80000000)
+ print(string.format(" Value after writing 0x80000000: 0x%x", XBURST.read_cp0(15, 1)))
+ if XBURST.read_cp0(15, 1) ~= 0x80000000 then
+ return "Value 0x8000000 does not stick, EBASE is probably not working"
+ end
+ XBURST.write_cp0(15, 1, 0x80040000)
+ print(string.format(" Value after writing 0x80040000: 0x%x", XBURST.read_cp0(15, 1)))
+ if XBURST.read_cp0(15, 1) ~= 0x80040000 then
+ return "Value 0x80040000 does not stick, EBASE is probably not working"
+ end
+ return "EBase seems to work"
+end
+
+function XBURST.do_ebase_cfg7gate_test()
+ -- test gate in config7
+ config7_old = XBURST.read_cp0(16, 7)
+ XBURST.write_cp0(16, 7, bit32.replace(config7_old, 0, 7)) -- disable EBASE[30] modification
+ print(string.format(" Disable config7 gate: write 0x%x to Config7", bit32.replace(config7_old, 0, 7)))
+ XBURST.write_cp0(15, 1, 0xfffff000)
+ print(string.format(" Value after writing 0xfffff000: 0x%x", XBURST.read_cp0(15, 1)))
+ if XBURST.read_cp0(15, 1) == 0xfffff000 then
+ return "Config7 gate has no effect but modifications are allowed anyway"
+ end
+ XBURST.write_cp0(16, 7, bit32.replace(config7_old, 1, 7)) -- enable EBASE[30] modification
+ print(string.format(" Enable config7 gate: write 0x%x to Config7", bit32.replace(config7_old, 1, 7)))
+ XBURST.write_cp0(15, 1, 0xc0000000)
+ print(string.format(" Value after writing 0xc0000000: 0x%x", XBURST.read_cp0(15, 1)))
+ if XBURST.read_cp0(15, 1) ~= 0xc0000000 then
+ return "Config7 gate does not work"
+ end
+ XBURST.write_cp0(16, 7, config7_old)
+ return "Config7 gate seems to work"
+end
+
+function XBURST.do_ebase_exc_test(mem_addr)
+ if (mem_addr % 0x1000) ~= 0 then
+ return " memory address for exception test must aligned on a 0x1000 boundary";
+ end
+ print(string.format("Exception test with EBASE at 0x%x...", mem_addr))
+ print(" Writing instructions to memory")
+ -- create instructions in memory
+ exc_addr = mem_addr + 0x180 -- general exception vector
+ data_addr = mem_addr + 0x300
+ -- lui k0,<low part of data_addr>
+ -- ori k0,k0,<high part>
+ DEV.write32(exc_addr + 0, 0x3c1a0000 + bit32.rshift(data_addr, 16))
+ DEV.write32(exc_addr + 4, 0x375a0000 + bit32.band(data_addr, 0xffff))
+ -- lui k1,0xdead
+ -- ori k1,k1,0xbeef
+ DEV.write32(exc_addr + 8, 0x3c1bdead)
+ DEV.write32(exc_addr + 12, 0x377bbeef)
+ -- sw k1,0(k0)
+ DEV.write32(exc_addr + 16, 0xaf5b0000)
+ -- mfc0 k0,c0_epc
+ -- addi k0,k0,4
+ -- mtc0 k0,c0_epc
+ DEV.write32(exc_addr + 20, 0x401a7000)
+ DEV.write32(exc_addr + 24, 0x235a0004)
+ DEV.write32(exc_addr + 28, 0x409a7000)
+ -- eret
+ -- nop
+ DEV.write32(exc_addr + 32, 0x42000018)
+ DEV.write32(exc_addr + 36, 0)
+ -- fill data with some initial value
+ DEV.write32(data_addr, 0xcafebabe)
+ -- write instructions to trigger an interrupt
+ bug_addr = mem_addr
+ -- syscall
+ DEV.write32(bug_addr + 0, 0x0000000c)
+ -- jr ra
+ -- nop
+ DEV.write32(bug_addr + 4, 0x03e00008)
+ DEV.write32(bug_addr + 8, 0)
+
+ -- make sure we are the right shape for the test: SR should have BEV cleared,
+ -- mask all interrupts, enable interrupts
+ old_sr = XBURST.read_cp0(12, 0)
+ print(string.format(" Old SR: 0x%x", old_sr))
+ XBURST.write_cp0(12, 0, 0xfc00) -- BEV set to 0, all interrupts masked and interrupt disabled
+ print(string.format(" New SR: 0x%x", XBURST.read_cp0(12, 0)))
+ -- change EBASE
+ old_ebase = XBURST.read_cp0(15, 1)
+ XBURST.write_cp0(15, 1, mem_addr)
+ print(string.format(" EBASE: %x", XBURST.read_cp0(15, 1)))
+ -- test
+ print(string.format(" Before: %x", DEV.read32(data_addr)))
+ DEV.call(bug_addr)
+ print(string.format(" After: %x", DEV.read32(data_addr)))
+ success = DEV.read32(data_addr) == 0xdeadbeef
+ -- restore SR and EBASE
+ XBURST.write_cp0(12, 0, old_sr)
+ XBURST.write_cp0(15, 1, ebase_old)
+
+ return success and "Exception and EBASE are working" or "Exception and EBASE are NOT working"
+end
+
+function XBURST.test_ebase(mem_addr)
+ -- EBase
+ ebase_old = XBURST.read_cp0(15, 1)
+ sr_old = XBURST.read_cp0(12, 0)
+ print("Testing EBASE...")
+ print(" Disable BEV")
+ XBURST.write_cp0(12, 0, bit32.replace(sr_old, 0, 22)) -- clear BEV
+ print(string.format(" SR value: 0x%x", XBURST.read_cp0(12, 0)))
+ print(string.format(" EBASE value: 0x%x", ebase_old))
+ print(" Test result: " .. XBURST.do_ebase_test())
+ print(" Config7 result: " .. XBURST.do_ebase_cfg7gate_test())
+ XBURST.write_cp0(12, 0, sr_old)
+ XBURST.write_cp0(15, 1, ebase_old)
+ -- now try with actual exceptions
+ if mem_addr == nil then
+ print(" Not doing exception test, please specify memory to use: sram, ram")
+ return
+ end
+ print(" Exception result: " .. XBURST.do_ebase_exc_test(mem_addr))
+end
+
+function XBURST.init()
+ -- enable CP1 in SR
+ sr_old = XBURST.read_cp0(12, 0)
+ XBURST.write_cp0(12, 0, bit32.replace(sr_old, 1, 29)) -- set CU1
+ print("XBurst:")
+ -- PRId
+ XBURST.prid = XBURST.read_cp0(15, 0)
+ print(string.format(" PRId: 0x%x", XBURST.prid))
+ print(" CPU: " .. XBURST.get_table_or(XBURST.prid_table, XBURST.prid, "unknown"))
+ -- Config
+ XBURST.config = XBURST.read_cp0(16, 0)
+ print(string.format(" Config: 0x%x", XBURST.config))
+ print(" Architecture Type: " .. XBURST.get_table_or(XBURST.at_table,
+ bit32.extract(XBURST.config, 13, 2), "unknown"))
+ print(" Architecture Level: " .. XBURST.get_table_or(XBURST.ar_table,
+ bit32.extract(XBURST.config, 10, 3), "unknown"))
+ print(" MMU Type: " .. XBURST.get_table_or(XBURST.mt_table,
+ bit32.extract(XBURST.config, 7, 3), "unknown"))
+ -- Config1
+ XBURST.config1 = XBURST.read_cp0(16, 1)
+ print(string.format(" Config1: 0x%x", XBURST.config1))
+ -- don't print of no MMU
+ if bit32.extract(XBURST.config, 7, 3) ~= 0 then
+ print(string.format(" MMU Size: %d", bit32.extract(XBURST.config1, 25, 6) + 1))
+ end
+ print(" ICache")
+ print(" Sets per way: " .. XBURST.get_table_or(XBURST.is_table,
+ bit32.extract(XBURST.config1, 22, 3), "unknown"))
+ print(" Ways: " .. (1 + bit32.extract(XBURST.config1, 16, 3)))
+ print(" Line size: " .. XBURST.get_table_or(XBURST.il_table,
+ bit32.extract(XBURST.config1, 19, 3), "unknown"))
+ print(" DCache")
+ print(" Sets per way: " .. XBURST.get_table_or(XBURST.is_table,
+ bit32.extract(XBURST.config1, 13, 3), "unknown"))
+ print(" Ways: " .. (1 + bit32.extract(XBURST.config1, 7, 3)))
+ print(" Line size: " .. XBURST.get_table_or(XBURST.il_table,
+ bit32.extract(XBURST.config1, 10, 3), "unknown"))
+ print(" FPU: " .. (bit32.extract(XBURST.config1, 0) == 1 and "yes" or "no"))
+
+ -- Config 2
+ XBURST.config2 = XBURST.read_cp0(16, 2)
+ print(string.format(" Config2: 0x%x", XBURST.config2))
+
+ -- Config 3
+ XBURST.config3 = XBURST.read_cp0(16, 3)
+ print(string.format(" Config3: 0x%x", XBURST.config3))
+ print(" Vectored interrupt: " .. (bit32.extract(XBURST.config2, 5) and "yes" or "no"))
+
+ -- Config 7
+ XBURST.config7 = XBURST.read_cp0(16, 7)
+ print(string.format(" Config7: 0x%x", XBURST.config7))
+
+ -- restore SR
+ XBURST.write_cp0(12, 0, sr_old)
+end