xref: /openbmc/qemu/hw/arm/sbsa-ref.c (revision ebe15582)
1 /*
2  * ARM SBSA Reference Platform emulation
3  *
4  * Copyright (c) 2018 Linaro Limited
5  * Written by Hongbo Zhang <hongbo.zhang@linaro.org>
6  *
7  * This program is free software; you can redistribute it and/or modify it
8  * under the terms and conditions of the GNU General Public License,
9  * version 2 or later, as published by the Free Software Foundation.
10  *
11  * This program is distributed in the hope it will be useful, but WITHOUT
12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
14  * more details.
15  *
16  * You should have received a copy of the GNU General Public License along with
17  * this program.  If not, see <http://www.gnu.org/licenses/>.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu-common.h"
22 #include "qapi/error.h"
23 #include "qemu/error-report.h"
24 #include "qemu/units.h"
25 #include "sysemu/device_tree.h"
26 #include "sysemu/numa.h"
27 #include "sysemu/runstate.h"
28 #include "sysemu/sysemu.h"
29 #include "exec/address-spaces.h"
30 #include "exec/hwaddr.h"
31 #include "kvm_arm.h"
32 #include "hw/arm/boot.h"
33 #include "hw/block/flash.h"
34 #include "hw/boards.h"
35 #include "hw/ide/internal.h"
36 #include "hw/ide/ahci_internal.h"
37 #include "hw/intc/arm_gicv3_common.h"
38 #include "hw/loader.h"
39 #include "hw/pci-host/gpex.h"
40 #include "hw/qdev-properties.h"
41 #include "hw/usb.h"
42 #include "net/net.h"
43 
44 #define RAMLIMIT_GB 8192
45 #define RAMLIMIT_BYTES (RAMLIMIT_GB * GiB)
46 
47 #define NUM_IRQS        256
48 #define NUM_SMMU_IRQS   4
49 #define NUM_SATA_PORTS  6
50 
51 #define VIRTUAL_PMU_IRQ        7
52 #define ARCH_GIC_MAINT_IRQ     9
53 #define ARCH_TIMER_VIRT_IRQ    11
54 #define ARCH_TIMER_S_EL1_IRQ   13
55 #define ARCH_TIMER_NS_EL1_IRQ  14
56 #define ARCH_TIMER_NS_EL2_IRQ  10
57 
58 enum {
59     SBSA_FLASH,
60     SBSA_MEM,
61     SBSA_CPUPERIPHS,
62     SBSA_GIC_DIST,
63     SBSA_GIC_REDIST,
64     SBSA_SMMU,
65     SBSA_UART,
66     SBSA_RTC,
67     SBSA_PCIE,
68     SBSA_PCIE_MMIO,
69     SBSA_PCIE_MMIO_HIGH,
70     SBSA_PCIE_PIO,
71     SBSA_PCIE_ECAM,
72     SBSA_GPIO,
73     SBSA_SECURE_UART,
74     SBSA_SECURE_UART_MM,
75     SBSA_SECURE_MEM,
76     SBSA_AHCI,
77     SBSA_EHCI,
78 };
79 
80 typedef struct MemMapEntry {
81     hwaddr base;
82     hwaddr size;
83 } MemMapEntry;
84 
85 typedef struct {
86     MachineState parent;
87     struct arm_boot_info bootinfo;
88     int smp_cpus;
89     void *fdt;
90     int fdt_size;
91     int psci_conduit;
92     PFlashCFI01 *flash[2];
93 } SBSAMachineState;
94 
95 #define TYPE_SBSA_MACHINE   MACHINE_TYPE_NAME("sbsa-ref")
96 #define SBSA_MACHINE(obj) \
97     OBJECT_CHECK(SBSAMachineState, (obj), TYPE_SBSA_MACHINE)
98 
99 static const MemMapEntry sbsa_ref_memmap[] = {
100     /* 512M boot ROM */
101     [SBSA_FLASH] =              {          0, 0x20000000 },
102     /* 512M secure memory */
103     [SBSA_SECURE_MEM] =         { 0x20000000, 0x20000000 },
104     /* Space reserved for CPU peripheral devices */
105     [SBSA_CPUPERIPHS] =         { 0x40000000, 0x00040000 },
106     [SBSA_GIC_DIST] =           { 0x40060000, 0x00010000 },
107     [SBSA_GIC_REDIST] =         { 0x40080000, 0x04000000 },
108     [SBSA_UART] =               { 0x60000000, 0x00001000 },
109     [SBSA_RTC] =                { 0x60010000, 0x00001000 },
110     [SBSA_GPIO] =               { 0x60020000, 0x00001000 },
111     [SBSA_SECURE_UART] =        { 0x60030000, 0x00001000 },
112     [SBSA_SECURE_UART_MM] =     { 0x60040000, 0x00001000 },
113     [SBSA_SMMU] =               { 0x60050000, 0x00020000 },
114     /* Space here reserved for more SMMUs */
115     [SBSA_AHCI] =               { 0x60100000, 0x00010000 },
116     [SBSA_EHCI] =               { 0x60110000, 0x00010000 },
117     /* Space here reserved for other devices */
118     [SBSA_PCIE_PIO] =           { 0x7fff0000, 0x00010000 },
119     /* 32-bit address PCIE MMIO space */
120     [SBSA_PCIE_MMIO] =          { 0x80000000, 0x70000000 },
121     /* 256M PCIE ECAM space */
122     [SBSA_PCIE_ECAM] =          { 0xf0000000, 0x10000000 },
123     /* ~1TB PCIE MMIO space (4GB to 1024GB boundary) */
124     [SBSA_PCIE_MMIO_HIGH] =     { 0x100000000ULL, 0xFF00000000ULL },
125     [SBSA_MEM] =                { 0x10000000000ULL, RAMLIMIT_BYTES },
126 };
127 
128 static const int sbsa_ref_irqmap[] = {
129     [SBSA_UART] = 1,
130     [SBSA_RTC] = 2,
131     [SBSA_PCIE] = 3, /* ... to 6 */
132     [SBSA_GPIO] = 7,
133     [SBSA_SECURE_UART] = 8,
134     [SBSA_SECURE_UART_MM] = 9,
135     [SBSA_AHCI] = 10,
136     [SBSA_EHCI] = 11,
137 };
138 
139 /*
140  * Firmware on this machine only uses ACPI table to load OS, these limited
141  * device tree nodes are just to let firmware know the info which varies from
142  * command line parameters, so it is not necessary to be fully compatible
143  * with the kernel CPU and NUMA binding rules.
144  */
145 static void create_fdt(SBSAMachineState *sms)
146 {
147     void *fdt = create_device_tree(&sms->fdt_size);
148     const MachineState *ms = MACHINE(sms);
149     int nb_numa_nodes = ms->numa_state->num_nodes;
150     int cpu;
151 
152     if (!fdt) {
153         error_report("create_device_tree() failed");
154         exit(1);
155     }
156 
157     sms->fdt = fdt;
158 
159     qemu_fdt_setprop_string(fdt, "/", "compatible", "linux,sbsa-ref");
160     qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2);
161     qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
162 
163     if (ms->numa_state->have_numa_distance) {
164         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
165         uint32_t *matrix = g_malloc0(size);
166         int idx, i, j;
167 
168         for (i = 0; i < nb_numa_nodes; i++) {
169             for (j = 0; j < nb_numa_nodes; j++) {
170                 idx = (i * nb_numa_nodes + j) * 3;
171                 matrix[idx + 0] = cpu_to_be32(i);
172                 matrix[idx + 1] = cpu_to_be32(j);
173                 matrix[idx + 2] =
174                     cpu_to_be32(ms->numa_state->nodes[i].distance[j]);
175             }
176         }
177 
178         qemu_fdt_add_subnode(fdt, "/distance-map");
179         qemu_fdt_setprop(fdt, "/distance-map", "distance-matrix",
180                          matrix, size);
181         g_free(matrix);
182     }
183 
184     qemu_fdt_add_subnode(sms->fdt, "/cpus");
185 
186     for (cpu = sms->smp_cpus - 1; cpu >= 0; cpu--) {
187         char *nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
188         ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
189         CPUState *cs = CPU(armcpu);
190 
191         qemu_fdt_add_subnode(sms->fdt, nodename);
192 
193         if (ms->possible_cpus->cpus[cs->cpu_index].props.has_node_id) {
194             qemu_fdt_setprop_cell(sms->fdt, nodename, "numa-node-id",
195                 ms->possible_cpus->cpus[cs->cpu_index].props.node_id);
196         }
197 
198         g_free(nodename);
199     }
200 }
201 
202 #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
203 
204 static PFlashCFI01 *sbsa_flash_create1(SBSAMachineState *sms,
205                                         const char *name,
206                                         const char *alias_prop_name)
207 {
208     /*
209      * Create a single flash device.  We use the same parameters as
210      * the flash devices on the Versatile Express board.
211      */
212     DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI01);
213 
214     qdev_prop_set_uint64(dev, "sector-length", SBSA_FLASH_SECTOR_SIZE);
215     qdev_prop_set_uint8(dev, "width", 4);
216     qdev_prop_set_uint8(dev, "device-width", 2);
217     qdev_prop_set_bit(dev, "big-endian", false);
218     qdev_prop_set_uint16(dev, "id0", 0x89);
219     qdev_prop_set_uint16(dev, "id1", 0x18);
220     qdev_prop_set_uint16(dev, "id2", 0x00);
221     qdev_prop_set_uint16(dev, "id3", 0x00);
222     qdev_prop_set_string(dev, "name", name);
223     object_property_add_child(OBJECT(sms), name, OBJECT(dev),
224                               &error_abort);
225     object_property_add_alias(OBJECT(sms), alias_prop_name,
226                               OBJECT(dev), "drive", &error_abort);
227     return PFLASH_CFI01(dev);
228 }
229 
230 static void sbsa_flash_create(SBSAMachineState *sms)
231 {
232     sms->flash[0] = sbsa_flash_create1(sms, "sbsa.flash0", "pflash0");
233     sms->flash[1] = sbsa_flash_create1(sms, "sbsa.flash1", "pflash1");
234 }
235 
236 static void sbsa_flash_map1(PFlashCFI01 *flash,
237                             hwaddr base, hwaddr size,
238                             MemoryRegion *sysmem)
239 {
240     DeviceState *dev = DEVICE(flash);
241 
242     assert(size % SBSA_FLASH_SECTOR_SIZE == 0);
243     assert(size / SBSA_FLASH_SECTOR_SIZE <= UINT32_MAX);
244     qdev_prop_set_uint32(dev, "num-blocks", size / SBSA_FLASH_SECTOR_SIZE);
245     qdev_init_nofail(dev);
246 
247     memory_region_add_subregion(sysmem, base,
248                                 sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
249                                                        0));
250 }
251 
252 static void sbsa_flash_map(SBSAMachineState *sms,
253                            MemoryRegion *sysmem,
254                            MemoryRegion *secure_sysmem)
255 {
256     /*
257      * Map two flash devices to fill the SBSA_FLASH space in the memmap.
258      * sysmem is the system memory space. secure_sysmem is the secure view
259      * of the system, and the first flash device should be made visible only
260      * there. The second flash device is visible to both secure and nonsecure.
261      */
262     hwaddr flashsize = sbsa_ref_memmap[SBSA_FLASH].size / 2;
263     hwaddr flashbase = sbsa_ref_memmap[SBSA_FLASH].base;
264 
265     sbsa_flash_map1(sms->flash[0], flashbase, flashsize,
266                     secure_sysmem);
267     sbsa_flash_map1(sms->flash[1], flashbase + flashsize, flashsize,
268                     sysmem);
269 }
270 
271 static bool sbsa_firmware_init(SBSAMachineState *sms,
272                                MemoryRegion *sysmem,
273                                MemoryRegion *secure_sysmem)
274 {
275     int i;
276     BlockBackend *pflash_blk0;
277 
278     /* Map legacy -drive if=pflash to machine properties */
279     for (i = 0; i < ARRAY_SIZE(sms->flash); i++) {
280         pflash_cfi01_legacy_drive(sms->flash[i],
281                                   drive_get(IF_PFLASH, 0, i));
282     }
283 
284     sbsa_flash_map(sms, sysmem, secure_sysmem);
285 
286     pflash_blk0 = pflash_cfi01_get_blk(sms->flash[0]);
287 
288     if (bios_name) {
289         char *fname;
290         MemoryRegion *mr;
291         int image_size;
292 
293         if (pflash_blk0) {
294             error_report("The contents of the first flash device may be "
295                          "specified with -bios or with -drive if=pflash... "
296                          "but you cannot use both options at once");
297             exit(1);
298         }
299 
300         /* Fall back to -bios */
301 
302         fname = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
303         if (!fname) {
304             error_report("Could not find ROM image '%s'", bios_name);
305             exit(1);
306         }
307         mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(sms->flash[0]), 0);
308         image_size = load_image_mr(fname, mr);
309         g_free(fname);
310         if (image_size < 0) {
311             error_report("Could not load ROM image '%s'", bios_name);
312             exit(1);
313         }
314     }
315 
316     return pflash_blk0 || bios_name;
317 }
318 
319 static void create_secure_ram(SBSAMachineState *sms,
320                               MemoryRegion *secure_sysmem)
321 {
322     MemoryRegion *secram = g_new(MemoryRegion, 1);
323     hwaddr base = sbsa_ref_memmap[SBSA_SECURE_MEM].base;
324     hwaddr size = sbsa_ref_memmap[SBSA_SECURE_MEM].size;
325 
326     memory_region_init_ram(secram, NULL, "sbsa-ref.secure-ram", size,
327                            &error_fatal);
328     memory_region_add_subregion(secure_sysmem, base, secram);
329 }
330 
331 static void create_gic(SBSAMachineState *sms, qemu_irq *pic)
332 {
333     unsigned int smp_cpus = MACHINE(sms)->smp.cpus;
334     DeviceState *gicdev;
335     SysBusDevice *gicbusdev;
336     const char *gictype;
337     uint32_t redist0_capacity, redist0_count;
338     int i;
339 
340     gictype = gicv3_class_name();
341 
342     gicdev = qdev_create(NULL, gictype);
343     qdev_prop_set_uint32(gicdev, "revision", 3);
344     qdev_prop_set_uint32(gicdev, "num-cpu", smp_cpus);
345     /*
346      * Note that the num-irq property counts both internal and external
347      * interrupts; there are always 32 of the former (mandated by GIC spec).
348      */
349     qdev_prop_set_uint32(gicdev, "num-irq", NUM_IRQS + 32);
350     qdev_prop_set_bit(gicdev, "has-security-extensions", true);
351 
352     redist0_capacity =
353                 sbsa_ref_memmap[SBSA_GIC_REDIST].size / GICV3_REDIST_SIZE;
354     redist0_count = MIN(smp_cpus, redist0_capacity);
355 
356     qdev_prop_set_uint32(gicdev, "len-redist-region-count", 1);
357     qdev_prop_set_uint32(gicdev, "redist-region-count[0]", redist0_count);
358 
359     qdev_init_nofail(gicdev);
360     gicbusdev = SYS_BUS_DEVICE(gicdev);
361     sysbus_mmio_map(gicbusdev, 0, sbsa_ref_memmap[SBSA_GIC_DIST].base);
362     sysbus_mmio_map(gicbusdev, 1, sbsa_ref_memmap[SBSA_GIC_REDIST].base);
363 
364     /*
365      * Wire the outputs from each CPU's generic timer and the GICv3
366      * maintenance interrupt signal to the appropriate GIC PPI inputs,
367      * and the GIC's IRQ/FIQ/VIRQ/VFIQ interrupt outputs to the CPU's inputs.
368      */
369     for (i = 0; i < smp_cpus; i++) {
370         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
371         int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
372         int irq;
373         /*
374          * Mapping from the output timer irq lines from the CPU to the
375          * GIC PPI inputs used for this board.
376          */
377         const int timer_irq[] = {
378             [GTIMER_PHYS] = ARCH_TIMER_NS_EL1_IRQ,
379             [GTIMER_VIRT] = ARCH_TIMER_VIRT_IRQ,
380             [GTIMER_HYP]  = ARCH_TIMER_NS_EL2_IRQ,
381             [GTIMER_SEC]  = ARCH_TIMER_S_EL1_IRQ,
382         };
383 
384         for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
385             qdev_connect_gpio_out(cpudev, irq,
386                                   qdev_get_gpio_in(gicdev,
387                                                    ppibase + timer_irq[irq]));
388         }
389 
390         qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt", 0,
391                                     qdev_get_gpio_in(gicdev, ppibase
392                                                      + ARCH_GIC_MAINT_IRQ));
393         qdev_connect_gpio_out_named(cpudev, "pmu-interrupt", 0,
394                                     qdev_get_gpio_in(gicdev, ppibase
395                                                      + VIRTUAL_PMU_IRQ));
396 
397         sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
398         sysbus_connect_irq(gicbusdev, i + smp_cpus,
399                            qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
400         sysbus_connect_irq(gicbusdev, i + 2 * smp_cpus,
401                            qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
402         sysbus_connect_irq(gicbusdev, i + 3 * smp_cpus,
403                            qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
404     }
405 
406     for (i = 0; i < NUM_IRQS; i++) {
407         pic[i] = qdev_get_gpio_in(gicdev, i);
408     }
409 }
410 
411 static void create_uart(const SBSAMachineState *sms, qemu_irq *pic, int uart,
412                         MemoryRegion *mem, Chardev *chr)
413 {
414     hwaddr base = sbsa_ref_memmap[uart].base;
415     int irq = sbsa_ref_irqmap[uart];
416     DeviceState *dev = qdev_create(NULL, "pl011");
417     SysBusDevice *s = SYS_BUS_DEVICE(dev);
418 
419     qdev_prop_set_chr(dev, "chardev", chr);
420     qdev_init_nofail(dev);
421     memory_region_add_subregion(mem, base,
422                                 sysbus_mmio_get_region(s, 0));
423     sysbus_connect_irq(s, 0, pic[irq]);
424 }
425 
426 static void create_rtc(const SBSAMachineState *sms, qemu_irq *pic)
427 {
428     hwaddr base = sbsa_ref_memmap[SBSA_RTC].base;
429     int irq = sbsa_ref_irqmap[SBSA_RTC];
430 
431     sysbus_create_simple("pl031", base, pic[irq]);
432 }
433 
434 static DeviceState *gpio_key_dev;
435 static void sbsa_ref_powerdown_req(Notifier *n, void *opaque)
436 {
437     /* use gpio Pin 3 for power button event */
438     qemu_set_irq(qdev_get_gpio_in(gpio_key_dev, 0), 1);
439 }
440 
441 static Notifier sbsa_ref_powerdown_notifier = {
442     .notify = sbsa_ref_powerdown_req
443 };
444 
445 static void create_gpio(const SBSAMachineState *sms, qemu_irq *pic)
446 {
447     DeviceState *pl061_dev;
448     hwaddr base = sbsa_ref_memmap[SBSA_GPIO].base;
449     int irq = sbsa_ref_irqmap[SBSA_GPIO];
450 
451     pl061_dev = sysbus_create_simple("pl061", base, pic[irq]);
452 
453     gpio_key_dev = sysbus_create_simple("gpio-key", -1,
454                                         qdev_get_gpio_in(pl061_dev, 3));
455 
456     /* connect powerdown request */
457     qemu_register_powerdown_notifier(&sbsa_ref_powerdown_notifier);
458 }
459 
460 static void create_ahci(const SBSAMachineState *sms, qemu_irq *pic)
461 {
462     hwaddr base = sbsa_ref_memmap[SBSA_AHCI].base;
463     int irq = sbsa_ref_irqmap[SBSA_AHCI];
464     DeviceState *dev;
465     DriveInfo *hd[NUM_SATA_PORTS];
466     SysbusAHCIState *sysahci;
467     AHCIState *ahci;
468     int i;
469 
470     dev = qdev_create(NULL, "sysbus-ahci");
471     qdev_prop_set_uint32(dev, "num-ports", NUM_SATA_PORTS);
472     qdev_init_nofail(dev);
473     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
474     sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irq]);
475 
476     sysahci = SYSBUS_AHCI(dev);
477     ahci = &sysahci->ahci;
478     ide_drive_get(hd, ARRAY_SIZE(hd));
479     for (i = 0; i < ahci->ports; i++) {
480         if (hd[i] == NULL) {
481             continue;
482         }
483         ide_create_drive(&ahci->dev[i].port, 0, hd[i]);
484     }
485 }
486 
487 static void create_ehci(const SBSAMachineState *sms, qemu_irq *pic)
488 {
489     hwaddr base = sbsa_ref_memmap[SBSA_EHCI].base;
490     int irq = sbsa_ref_irqmap[SBSA_EHCI];
491 
492     sysbus_create_simple("platform-ehci-usb", base, pic[irq]);
493 }
494 
495 static void create_smmu(const SBSAMachineState *sms, qemu_irq *pic,
496                         PCIBus *bus)
497 {
498     hwaddr base = sbsa_ref_memmap[SBSA_SMMU].base;
499     int irq =  sbsa_ref_irqmap[SBSA_SMMU];
500     DeviceState *dev;
501     int i;
502 
503     dev = qdev_create(NULL, "arm-smmuv3");
504 
505     object_property_set_link(OBJECT(dev), OBJECT(bus), "primary-bus",
506                              &error_abort);
507     qdev_init_nofail(dev);
508     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
509     for (i = 0; i < NUM_SMMU_IRQS; i++) {
510         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
511     }
512 }
513 
514 static void create_pcie(SBSAMachineState *sms, qemu_irq *pic)
515 {
516     hwaddr base_ecam = sbsa_ref_memmap[SBSA_PCIE_ECAM].base;
517     hwaddr size_ecam = sbsa_ref_memmap[SBSA_PCIE_ECAM].size;
518     hwaddr base_mmio = sbsa_ref_memmap[SBSA_PCIE_MMIO].base;
519     hwaddr size_mmio = sbsa_ref_memmap[SBSA_PCIE_MMIO].size;
520     hwaddr base_mmio_high = sbsa_ref_memmap[SBSA_PCIE_MMIO_HIGH].base;
521     hwaddr size_mmio_high = sbsa_ref_memmap[SBSA_PCIE_MMIO_HIGH].size;
522     hwaddr base_pio = sbsa_ref_memmap[SBSA_PCIE_PIO].base;
523     int irq = sbsa_ref_irqmap[SBSA_PCIE];
524     MemoryRegion *mmio_alias, *mmio_alias_high, *mmio_reg;
525     MemoryRegion *ecam_alias, *ecam_reg;
526     DeviceState *dev;
527     PCIHostState *pci;
528     int i;
529 
530     dev = qdev_create(NULL, TYPE_GPEX_HOST);
531     qdev_init_nofail(dev);
532 
533     /* Map ECAM space */
534     ecam_alias = g_new0(MemoryRegion, 1);
535     ecam_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
536     memory_region_init_alias(ecam_alias, OBJECT(dev), "pcie-ecam",
537                              ecam_reg, 0, size_ecam);
538     memory_region_add_subregion(get_system_memory(), base_ecam, ecam_alias);
539 
540     /* Map the MMIO space */
541     mmio_alias = g_new0(MemoryRegion, 1);
542     mmio_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 1);
543     memory_region_init_alias(mmio_alias, OBJECT(dev), "pcie-mmio",
544                              mmio_reg, base_mmio, size_mmio);
545     memory_region_add_subregion(get_system_memory(), base_mmio, mmio_alias);
546 
547     /* Map the MMIO_HIGH space */
548     mmio_alias_high = g_new0(MemoryRegion, 1);
549     memory_region_init_alias(mmio_alias_high, OBJECT(dev), "pcie-mmio-high",
550                              mmio_reg, base_mmio_high, size_mmio_high);
551     memory_region_add_subregion(get_system_memory(), base_mmio_high,
552                                 mmio_alias_high);
553 
554     /* Map IO port space */
555     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 2, base_pio);
556 
557     for (i = 0; i < GPEX_NUM_IRQS; i++) {
558         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
559         gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
560     }
561 
562     pci = PCI_HOST_BRIDGE(dev);
563     if (pci->bus) {
564         for (i = 0; i < nb_nics; i++) {
565             NICInfo *nd = &nd_table[i];
566 
567             if (!nd->model) {
568                 nd->model = g_strdup("e1000e");
569             }
570 
571             pci_nic_init_nofail(nd, pci->bus, nd->model, NULL);
572         }
573     }
574 
575     pci_create_simple(pci->bus, -1, "VGA");
576 
577     create_smmu(sms, pic, pci->bus);
578 }
579 
580 static void *sbsa_ref_dtb(const struct arm_boot_info *binfo, int *fdt_size)
581 {
582     const SBSAMachineState *board = container_of(binfo, SBSAMachineState,
583                                                  bootinfo);
584 
585     *fdt_size = board->fdt_size;
586     return board->fdt;
587 }
588 
589 static void sbsa_ref_init(MachineState *machine)
590 {
591     unsigned int smp_cpus = machine->smp.cpus;
592     unsigned int max_cpus = machine->smp.max_cpus;
593     SBSAMachineState *sms = SBSA_MACHINE(machine);
594     MachineClass *mc = MACHINE_GET_CLASS(machine);
595     MemoryRegion *sysmem = get_system_memory();
596     MemoryRegion *secure_sysmem = g_new(MemoryRegion, 1);
597     MemoryRegion *ram = g_new(MemoryRegion, 1);
598     bool firmware_loaded;
599     const CPUArchIdList *possible_cpus;
600     int n, sbsa_max_cpus;
601     qemu_irq pic[NUM_IRQS];
602 
603     if (strcmp(machine->cpu_type, ARM_CPU_TYPE_NAME("cortex-a57"))) {
604         error_report("sbsa-ref: CPU type other than the built-in "
605                      "cortex-a57 not supported");
606         exit(1);
607     }
608 
609     if (kvm_enabled()) {
610         error_report("sbsa-ref: KVM is not supported for this machine");
611         exit(1);
612     }
613 
614     /*
615      * The Secure view of the world is the same as the NonSecure,
616      * but with a few extra devices. Create it as a container region
617      * containing the system memory at low priority; any secure-only
618      * devices go in at higher priority and take precedence.
619      */
620     memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
621                        UINT64_MAX);
622     memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
623 
624     firmware_loaded = sbsa_firmware_init(sms, sysmem, secure_sysmem);
625 
626     if (machine->kernel_filename && firmware_loaded) {
627         error_report("sbsa-ref: No fw_cfg device on this machine, "
628                      "so -kernel option is not supported when firmware loaded, "
629                      "please load OS from hard disk instead");
630         exit(1);
631     }
632 
633     /*
634      * This machine has EL3 enabled, external firmware should supply PSCI
635      * implementation, so the QEMU's internal PSCI is disabled.
636      */
637     sms->psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
638 
639     sbsa_max_cpus = sbsa_ref_memmap[SBSA_GIC_REDIST].size / GICV3_REDIST_SIZE;
640 
641     if (max_cpus > sbsa_max_cpus) {
642         error_report("Number of SMP CPUs requested (%d) exceeds max CPUs "
643                      "supported by machine 'sbsa-ref' (%d)",
644                      max_cpus, sbsa_max_cpus);
645         exit(1);
646     }
647 
648     sms->smp_cpus = smp_cpus;
649 
650     if (machine->ram_size > sbsa_ref_memmap[SBSA_MEM].size) {
651         error_report("sbsa-ref: cannot model more than %dGB RAM", RAMLIMIT_GB);
652         exit(1);
653     }
654 
655     possible_cpus = mc->possible_cpu_arch_ids(machine);
656     for (n = 0; n < possible_cpus->len; n++) {
657         Object *cpuobj;
658         CPUState *cs;
659 
660         if (n >= smp_cpus) {
661             break;
662         }
663 
664         cpuobj = object_new(possible_cpus->cpus[n].type);
665         object_property_set_int(cpuobj, possible_cpus->cpus[n].arch_id,
666                                 "mp-affinity", NULL);
667 
668         cs = CPU(cpuobj);
669         cs->cpu_index = n;
670 
671         numa_cpu_pre_plug(&possible_cpus->cpus[cs->cpu_index], DEVICE(cpuobj),
672                           &error_fatal);
673 
674         if (object_property_find(cpuobj, "reset-cbar", NULL)) {
675             object_property_set_int(cpuobj,
676                                     sbsa_ref_memmap[SBSA_CPUPERIPHS].base,
677                                     "reset-cbar", &error_abort);
678         }
679 
680         object_property_set_link(cpuobj, OBJECT(sysmem), "memory",
681                                  &error_abort);
682 
683         object_property_set_link(cpuobj, OBJECT(secure_sysmem),
684                                  "secure-memory", &error_abort);
685 
686         object_property_set_bool(cpuobj, true, "realized", &error_fatal);
687         object_unref(cpuobj);
688     }
689 
690     memory_region_allocate_system_memory(ram, NULL, "sbsa-ref.ram",
691                                          machine->ram_size);
692     memory_region_add_subregion(sysmem, sbsa_ref_memmap[SBSA_MEM].base, ram);
693 
694     create_fdt(sms);
695 
696     create_secure_ram(sms, secure_sysmem);
697 
698     create_gic(sms, pic);
699 
700     create_uart(sms, pic, SBSA_UART, sysmem, serial_hd(0));
701     create_uart(sms, pic, SBSA_SECURE_UART, secure_sysmem, serial_hd(1));
702     /* Second secure UART for RAS and MM from EL0 */
703     create_uart(sms, pic, SBSA_SECURE_UART_MM, secure_sysmem, serial_hd(2));
704 
705     create_rtc(sms, pic);
706 
707     create_gpio(sms, pic);
708 
709     create_ahci(sms, pic);
710 
711     create_ehci(sms, pic);
712 
713     create_pcie(sms, pic);
714 
715     sms->bootinfo.ram_size = machine->ram_size;
716     sms->bootinfo.nb_cpus = smp_cpus;
717     sms->bootinfo.board_id = -1;
718     sms->bootinfo.loader_start = sbsa_ref_memmap[SBSA_MEM].base;
719     sms->bootinfo.get_dtb = sbsa_ref_dtb;
720     sms->bootinfo.firmware_loaded = firmware_loaded;
721     arm_load_kernel(ARM_CPU(first_cpu), machine, &sms->bootinfo);
722 }
723 
724 static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
725 {
726     uint8_t clustersz = ARM_DEFAULT_CPUS_PER_CLUSTER;
727     return arm_cpu_mp_affinity(idx, clustersz);
728 }
729 
730 static const CPUArchIdList *sbsa_ref_possible_cpu_arch_ids(MachineState *ms)
731 {
732     unsigned int max_cpus = ms->smp.max_cpus;
733     SBSAMachineState *sms = SBSA_MACHINE(ms);
734     int n;
735 
736     if (ms->possible_cpus) {
737         assert(ms->possible_cpus->len == max_cpus);
738         return ms->possible_cpus;
739     }
740 
741     ms->possible_cpus = g_malloc0(sizeof(CPUArchIdList) +
742                                   sizeof(CPUArchId) * max_cpus);
743     ms->possible_cpus->len = max_cpus;
744     for (n = 0; n < ms->possible_cpus->len; n++) {
745         ms->possible_cpus->cpus[n].type = ms->cpu_type;
746         ms->possible_cpus->cpus[n].arch_id =
747             sbsa_ref_cpu_mp_affinity(sms, n);
748         ms->possible_cpus->cpus[n].props.has_thread_id = true;
749         ms->possible_cpus->cpus[n].props.thread_id = n;
750     }
751     return ms->possible_cpus;
752 }
753 
754 static CpuInstanceProperties
755 sbsa_ref_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
756 {
757     MachineClass *mc = MACHINE_GET_CLASS(ms);
758     const CPUArchIdList *possible_cpus = mc->possible_cpu_arch_ids(ms);
759 
760     assert(cpu_index < possible_cpus->len);
761     return possible_cpus->cpus[cpu_index].props;
762 }
763 
764 static int64_t
765 sbsa_ref_get_default_cpu_node_id(const MachineState *ms, int idx)
766 {
767     return idx % ms->numa_state->num_nodes;
768 }
769 
770 static void sbsa_ref_instance_init(Object *obj)
771 {
772     SBSAMachineState *sms = SBSA_MACHINE(obj);
773 
774     sbsa_flash_create(sms);
775 }
776 
777 static void sbsa_ref_class_init(ObjectClass *oc, void *data)
778 {
779     MachineClass *mc = MACHINE_CLASS(oc);
780 
781     mc->init = sbsa_ref_init;
782     mc->desc = "QEMU 'SBSA Reference' ARM Virtual Machine";
783     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a57");
784     mc->max_cpus = 512;
785     mc->pci_allow_0_address = true;
786     mc->minimum_page_bits = 12;
787     mc->block_default_type = IF_IDE;
788     mc->no_cdrom = 1;
789     mc->default_ram_size = 1 * GiB;
790     mc->default_cpus = 4;
791     mc->possible_cpu_arch_ids = sbsa_ref_possible_cpu_arch_ids;
792     mc->cpu_index_to_instance_props = sbsa_ref_cpu_index_to_props;
793     mc->get_default_cpu_node_id = sbsa_ref_get_default_cpu_node_id;
794     mc->numa_mem_supported = true;
795 }
796 
797 static const TypeInfo sbsa_ref_info = {
798     .name          = TYPE_SBSA_MACHINE,
799     .parent        = TYPE_MACHINE,
800     .instance_init = sbsa_ref_instance_init,
801     .class_init    = sbsa_ref_class_init,
802     .instance_size = sizeof(SBSAMachineState),
803 };
804 
805 static void sbsa_ref_machine_init(void)
806 {
807     type_register_static(&sbsa_ref_info);
808 }
809 
810 type_init(sbsa_ref_machine_init);
811