Add clocks and cpubench subcommands; fix #161 PLL decode (#162)

Closes #161.

The new `clocks` subcommand exposes the running SoC's CPU PLL, DDR
clock, and per-die HPM (Hardware Performance Monitor) characterization
as YAML (default) or JSON (`--json`). Output is also wired into the
default `ipctool` survey as a top-level `clocks:` section.

The decode is table-driven (`struct pll_info`, `struct mux_info`,
`struct hpm_info`, `struct raw_reg_info`) so future SoC families can
be added as pure data next to `src/hal/hisi/clocks_v4.c`.

V4 family register map, verified register-for-register on three lab
boards (hi3516ev300 OpenIPC, gk7205v300 OpenIPC, gk7205v300 XM Sofia):

  CPU PLL (APLL)  register pair (0x12010000, 0x12010004)
                  ctrl_reg1 [23:0]  FRACDIV
                            [26:24] POSTDIV1
                            [30:28] POSTDIV2
                  ctrl_reg2 [11:0]  FBDIV
                            [17:12] REFDIV
                  f = 24 MHz * FBDIV / (REFDIV * POSTDIV1 * POSTDIV2)
  DDR cksel mux   0x12010080 bits [5:3]  (001->450 MHz, DDR3 x4)
  HPM             0x1202015c + 0x120280d8 aux fingerprint

APLL bit layout borrowed from `struct hi3516a_pll_clock` in the
HiSilicon SDK kernel patch (Hi3516EV200_SDK_V1.0.1.2 / linux-4.9.37
patch). The V4 SDK kernel patch itself defines no PLL struct -- V4's
kernel clock driver treats CPU clock as fixed-rate post-boot, so the
mask ROM is the only writer; both vendor u-boots leave the APLL
register pair untouched (only 0x12010080 DDR cksel is written by
both, confirmed via xxd of the reg_info_*.bin tables).

Issue #161 originally identified `0x12010014` as "CPU PLL FBDIV"
with `0x01770000 -> 952 MHz` (Board A) vs `0x018F0000 -> 1144 MHz`
(Board B). Bench on three boards with three different values at
`0x12010014` (`0x00000000`, `0x01770000`, `0x018F0000`) yields
identical CPU clock to within 3% noise -- the value at `0x14` is a
mask-ROM-written diagnostic that correlates with per-die HPM binning
but does NOT drive any active clock. This commit exposes `0x12010014`
and `0x1201000c` as `pll_shadow_*` raw entries (still useful for
fleet silicon-binning comparisons) with a "not a live FBDIV" note.

The multi-pattern triangulation that settled the question is now
shipped as `ipctool cpubench` -- runs three inline-asm patterns with
known Cortex-A7 throughput (dep_add 1 cyc/op, indep_add 0.5 cyc/op
dual-issue, dep_mul 3-cyc latency) and back-calculates the clock
from each, reporting median consensus and spread. Useful for future
board bring-up when a PLL register decode is suspect.

End-to-end on all three lab boards:
  hi3516ev300 OpenIPC:   cpu_pll.freq_mhz=900, cpubench median 882
  gk7205v300 OpenIPC:    cpu_pll.freq_mhz=900, cpubench median 874
  gk7205v300 XM Sofia:   cpu_pll.freq_mhz=900, cpubench median 844*

  * XM has unkillable kernel/userspace background load that drags
    bench down ~5%; dep_mul (most reliable) still hits 863 MHz.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: widgetii

CMakeLists.txt

@@ -79,13 +79,18 @@ set(COMMON_LIB_SRC
 set(IPCTOOL_SRC
     src/backup.c
     src/backup.h
+    src/clocks.c
+    src/clocks.h
+    src/cpubench.c
+    src/cpubench.h
     src/dns.c
     src/dns.h
     src/ethernet.c
     src/ethernet.h
     src/fake_symbols.c
     src/firmware.c
     src/firmware.h
+    src/hal/hisi/clocks_v4.c
     src/hal/hisi/ethernet.c
     src/hal/hisi/ethernet.h
     src/hal/hisi/ispreg.c