Update QEMU implementation

.github/workflows/build_test.yaml

@@ -18,9 +18,9 @@ jobs:
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
             sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
-          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-19 main" &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" &&
           sudo apt-get update &&
-          sudo apt-get install -y git make pkg-config clang-19 cmake ninja-build python3 rust-all \
+          sudo apt-get install -y git make pkg-config clang-20 cmake ninja-build python3 rust-all \
             libpixman-1-dev libglib2.0-dev
       - name: Check out QEMU
         uses: actions/checkout@v4
@@ -30,7 +30,7 @@ jobs:
           git clean -dffx subprojects
           mkdir build-clang
           (cd build-clang &&
-           ../configure --cc=clang-19 --disable-werror --disable-install-blobs \
+           ../configure --cc=clang-20 --disable-werror --disable-install-blobs \
              --target-list=riscv32-softmmu,riscv64-softmmu)
       - name: Build
         run: |
@@ -73,9 +73,9 @@ jobs:
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
             sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
-          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-19 main" &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" &&
           sudo apt-get update &&
-          sudo apt-get install -y clang-format-19
+          sudo apt-get install -y clang-format-20
       - name: Check out QEMU
         uses: actions/checkout@v4
       - name: Check C code format
@@ -106,9 +106,9 @@ jobs:
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
             sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
-          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-19 main" &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" &&
           sudo apt-get update &&
-          sudo apt-get install -y clang-tidy-19 libglib2.0-dev
+          sudo apt-get install -y clang-tidy-20 libglib2.0-dev
       - name: Check out QEMU
         uses: actions/checkout@v4
       - name: Download QEMU source artifacts
@@ -166,7 +166,7 @@ jobs:
         run: |
           wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
           sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
-          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-19 main" &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-20 main" &&
           sudo apt-get update &&
           sudo apt-get install -y git make pkg-config gcc cmake ninja-build python3 rust-all \
             libpixman-1-dev libglib2.0-dev

.gitlab-ci.d/opentitan/qemu-ot.yml

@@ -1,5 +1,5 @@
 variables:
-  BAREMETAL_REF: "b0-250325-1"
+  BAREMETAL_REF: "b0-250722-1"
   QEMU_BUILD_OPTS: "--disable-install-blobs"
 
 include:

accel/tcg/cpu-exec.c

@@ -677,7 +677,7 @@ static inline void tb_add_jump(TranslationBlock *tb, int n,
 static inline bool cpu_handle_halt(CPUState *cpu)
 {
 #ifndef CONFIG_USER_ONLY
-    if (unlikely(cpu->held_in_reset)) {
+    if (unlikely(cpu->disabled)) {
         return true;
     }
 

docs/opentitan/cfggen.md

@@ -12,7 +12,8 @@ the QEMU binary.
 
 ````text
 usage: cfggen.py [-h] [-T {darjeeling,earlgrey}] [-o CFG] [-c SV] [-l SV]
-                 [-t HJSON] [-s SOCID] [-C COUNT] [-v] [-d]
+                 [-t HJSON] [-s SOCID] [-C COUNT] [-a {config,clock}] [-v]
+                 [-d]
                  [OTDIR]
 
 OpenTitan QEMU configuration file generator.
@@ -33,6 +34,10 @@ Modifiers:
   -s, --socid SOCID     SoC identifier, if any
   -C, --count COUNT     SoC count (default: 1)
 
+Actions:
+  -a, --action {config,clock}
+                        Action(s) to perform, default: config
+
 Extras:
   -v, --verbose         increase verbosity
   -d, --debug           enable debug mode
@@ -44,6 +49,9 @@ Extras:
 repository to analyze. It is used to generate the path towards the required files to parse, each of
 which can be overidden with options `-c`, `-l` and `-t`.
 
+* `-a` specify one or more actions to execute. Default is to generate a configuration file. It is
+  also possible to emit the list of module input clocks in a plain text format.
+
 * `-C` specify how many SoCs are used on the platform
 
 * `-c` alternative path to the `otp_ctrl_part_pkg.sv` file

docs/opentitan/darjeeling.md

@@ -44,6 +44,11 @@ Please check out `hw/opentitan/ot_ref.log`
 
 Devices in this group implement subset(s) of the real HW.
 
+* Clock Manager
+  * Runtime-configurable device, through properties
+  * Manage clock dividers, groups, hints, software configurable clocks
+  * Propagate clock signals from source (AST, ...) to devices
+  * Hint management and measurement are not implemented
 * DMA
   * Only memory-to-memory transfers (inc. hashing) are supported, Handshake modes are not supported
 * Flash controller
@@ -54,6 +59,9 @@ Devices in this group implement subset(s) of the real HW.
    * A CharDev backend can be used to get GPIO outputs and update GPIO inputs,
 * KMAC
   * Side loading is not supported
+* Ibex wrapper
+  * random source (connected to CSR), FPGA version, virtual remapper, fetch enable can be controlled
+    from Power Manager
 * Lifecycle controller
   * [LC controller](lc_ctrl_dmi.md) can be accessed through JTAG using a DM-TL bridge
   * Escalation is not supported
@@ -73,11 +81,7 @@ features are implemented.
 
 * AST
   * entropy source only (from host source)
-* Clock Manager
-  * Clock hints only
-* Ibex wrapper
-  * random source (connected to CSR), FPGA version, virtual remapper, fetch enable can be controlled
-    from Power Manager
+  * configurable clock sources
 * Reset Manager
   * HW and SW reset requests are supported
 * Pinmux
@@ -221,8 +225,12 @@ There are two modes to handle address remapping, with different limitations:
 
 ### OTBN
 
-* `-global ot-otbn.logfile=<filename>` dumps executed instructions on OTBN core into the specified
-  filename. Beware that is even further slows down execution speed, which could likely result into
+* `-global ot-otbn.logfile=<filename>` output OTBN execution message to the specified logfile. When
+  _logasm_ option (see below) is not enabled, only execution termination and error messages are
+  logged. `stderr` can be used to log the messages to the standard error stream instead of a file.
+
+* `-global ot-otbn.logasm=<true|false>` dumps executed instructions on OTBN core into the _logfile_
+  filename. Beware that this further slows down execution speed, which could likely result in the
   guest application on the Ibex core to time out.
 
 ### OTP
@@ -231,6 +239,9 @@ There are two modes to handle address remapping, with different limitations:
   file used as the OpenTitan OTP image. This _RAW_ file should have been generated with the
   [`otptool.py`](otptool.md) tool.
 
+* on LC escalate reception, it is possible to early abort VM execution. Specify
+  `-global ot-otp-dj.fatal_escalate=true` to enable this feature.
+
 ### SoC Debug controller
 
 SoC debug controller manages SoC debug policies based on external signals - such as GPIO, Power

docs/opentitan/dtm.md

@@ -6,8 +6,9 @@ Module to access the Ibex core.
 ## Usage
 
 ````text
-usage: dtm.py [-h] [-S SOCKET] [-t] [-l IR_LENGTH] [-b BASE] [-I] [-c CSR]
-              [-C CSR_CHECK] [-x] [-X] [-a ADDRESS] [-m {read,write}]
+usage: dtm.py [-h] [-S SOCKET] [-t] [-w DELAY] [-l IR_LENGTH]
+              [--idcode IDCODE] [--dtmcs DTMCS] [--dmi DMI] [-b BASE] [-I]
+              [-c CSR] [-C CSR_CHECK] [-x] [-X] [-a ADDRESS] [-m {read,write}]
               [-s SIZE] [-f FILE] [-D DATA] [-e ELF] [-F] [-v] [-d]
 
 Debug Transport Module tiny demo
@@ -16,13 +17,16 @@ options:
   -h, --help            show this help message and exit
 
 Virtual machine:
-  -S, --socket SOCKET   unix:path/to/socket or tcp:host:port (default
-                        tcp:localhost:3335)
+  -S, --socket SOCKET   connection (default tcp:localhost:3335)
   -t, --terminate       terminate QEMU when done
+  -w, --idle DELAY      stay idle before interacting with DTM
 
 DMI:
   -l, --ir-length IR_LENGTH
                         bit length of the IR register (default: 5)
+  --idcode IDCODE       define the ID code (default: 1)
+  --dtmcs DTMCS         define an alternative DTMCS register (default: 0x10)
+  --dmi DMI             define an alternative DMI register (default: 0x11)
   -b, --base BASE       define DMI base address (default: 0x0)
 
 Info:
@@ -107,6 +111,10 @@ Extras:
 
 * `-v` can be repeated to increase verbosity of the script, mostly for debug purpose.
 
+* `-w` pause execution on start up before communication with the remote DTM. This enables QEMU VM
+  to initialize and boot the guest SW before attempting a communication. It can be repeated once,
+  the second value being used to delay the termination of the VM when the `-t` option is used.
+
 * `-X` do not attempt to resume normal execution of the hart once DTM operation have been completed.
   This can be useful for example when the QEMU VM is started with `-S` and no application code has
   been loaded in memory: once the DTM operations are completed, the default behavior is to resume
@@ -117,6 +125,12 @@ Extras:
 * `-x` execute the loaded ELF application from its entry point. Requires the `--elf` option.
   Application is executed even with `-X` defined.
 
+* `--idcode` specify an alternate IDCODE value
+
+* `--dmi` specify an alternate address for the DMI register
+
+* `--dtmcs` specify an alternate address for the DTMCS register
+
 ### Examples
 
 Running QEMU VM with the `-chardev socket,id=taprbb,host=localhost,port=3335,server=on,wait=off`

docs/opentitan/earlgrey.md

@@ -15,6 +15,8 @@ EarlGrey 2.5.2-RC0
 
 * AES
   * missing side-loading
+* Alert controller
+  * ping mechanism is not supported
 * AON Timer
 * CSRNG
 * EDN
@@ -32,6 +34,11 @@ EarlGrey 2.5.2-RC0
 
 Devices in this group implement subset(s) of the real HW.
 
+* Clock Manager
+  * Runtime-configurable device, through properties
+  * Manage clock dividers, groups, hints, software configurable clocks
+  * Propagate clock signals from source (AST, ...) to devices
+  * Hint management and measurement are not implemented
 * Flash controller
   * read-only features only
 * OTP controller
@@ -41,6 +48,9 @@ Devices in this group implement subset(s) of the real HW.
    * AES CTR not supported (uses xoroshiro128++ reseeded from entropy src)
 * [GPIO](gpio.md)
    * A CharDev backend can be used to get GPIO outputs and update GPIO inputs,
+* Ibex wrapper
+  * random source (connected to CSR), FPGA version, virtual remapper, fetch enable can be controlled
+    from Power Manager
 * KMAC
   * Side loading is not supported
 * [ROM controller](rom_ctrl.md)
@@ -54,13 +64,11 @@ In this group, device CSRs are supported (w/ partial or full access control & ma
 features are implemented.
 
 * AST
-  * entropy source only (from host source)
-* Clock Manager
-  * Clock hints only
-* Ibex wrapper
-  * random source (connected to CSR), FPGA version, virtual remapper
+  * configurable clock sources
+* GPIO
+  * Connections with pinmux not implemented (need to be ported from [Darjeeling](darjeeling.md) version)
 * Lifecycle controller
-  * only forwards LC state from OTP
+  * only forwards LC state from OTP (need to be ported from [Darjeeling](darjeeling.md) version)
 * Power Manager
   * Fast FSM is partially supported, Slow FSM is bypassed
   * Interactions with other devices (such as the Reset Manager) are limited
@@ -70,12 +78,8 @@ features are implemented.
 Devices in this group are mostly implemented with a RAM backend or real CSRs but do not implement
 any useful feature (only allow guest test code to execute as expected).
 
-* Alert controller
 * Key manager
-* KMAC (in development)
-* GPIO
 * Pinmux
-* Power Manager
 * Sensor
 
 ## Running the virtual machine