1 /* 2 * ARM mach-virt emulation 3 * 4 * Copyright (c) 2013 Linaro Limited 5 * 6 * This program is free software; you can redistribute it and/or modify it 7 * under the terms and conditions of the GNU General Public License, 8 * version 2 or later, as published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope it will be useful, but WITHOUT 11 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 12 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 13 * more details. 14 * 15 * You should have received a copy of the GNU General Public License along with 16 * this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 * Emulate a virtual board which works by passing Linux all the information 19 * it needs about what devices are present via the device tree. 20 * There are some restrictions about what we can do here: 21 * + we can only present devices whose Linux drivers will work based 22 * purely on the device tree with no platform data at all 23 * + we want to present a very stripped-down minimalist platform, 24 * both because this reduces the security attack surface from the guest 25 * and also because it reduces our exposure to being broken when 26 * the kernel updates its device tree bindings and requires further 27 * information in a device binding that we aren't providing. 28 * This is essentially the same approach kvmtool uses. 29 */ 30 31 #include "hw/sysbus.h" 32 #include "hw/arm/arm.h" 33 #include "hw/arm/primecell.h" 34 #include "hw/arm/virt.h" 35 #include "hw/devices.h" 36 #include "net/net.h" 37 #include "sysemu/block-backend.h" 38 #include "sysemu/device_tree.h" 39 #include "sysemu/sysemu.h" 40 #include "sysemu/kvm.h" 41 #include "hw/boards.h" 42 #include "hw/loader.h" 43 #include "exec/address-spaces.h" 44 #include "qemu/bitops.h" 45 #include "qemu/error-report.h" 46 #include "hw/pci-host/gpex.h" 47 #include "hw/arm/virt-acpi-build.h" 48 49 /* Number of external interrupt lines to configure the GIC with */ 50 #define NUM_IRQS 128 51 52 #define GIC_FDT_IRQ_TYPE_SPI 0 53 #define GIC_FDT_IRQ_TYPE_PPI 1 54 55 #define GIC_FDT_IRQ_FLAGS_EDGE_LO_HI 1 56 #define GIC_FDT_IRQ_FLAGS_EDGE_HI_LO 2 57 #define GIC_FDT_IRQ_FLAGS_LEVEL_HI 4 58 #define GIC_FDT_IRQ_FLAGS_LEVEL_LO 8 59 60 #define GIC_FDT_IRQ_PPI_CPU_START 8 61 #define GIC_FDT_IRQ_PPI_CPU_WIDTH 8 62 63 typedef struct VirtBoardInfo { 64 struct arm_boot_info bootinfo; 65 const char *cpu_model; 66 const MemMapEntry *memmap; 67 const int *irqmap; 68 int smp_cpus; 69 void *fdt; 70 int fdt_size; 71 uint32_t clock_phandle; 72 uint32_t gic_phandle; 73 } VirtBoardInfo; 74 75 typedef struct { 76 MachineClass parent; 77 VirtBoardInfo *daughterboard; 78 } VirtMachineClass; 79 80 typedef struct { 81 MachineState parent; 82 bool secure; 83 } VirtMachineState; 84 85 #define TYPE_VIRT_MACHINE "virt" 86 #define VIRT_MACHINE(obj) \ 87 OBJECT_CHECK(VirtMachineState, (obj), TYPE_VIRT_MACHINE) 88 #define VIRT_MACHINE_GET_CLASS(obj) \ 89 OBJECT_GET_CLASS(VirtMachineClass, obj, TYPE_VIRT_MACHINE) 90 #define VIRT_MACHINE_CLASS(klass) \ 91 OBJECT_CLASS_CHECK(VirtMachineClass, klass, TYPE_VIRT_MACHINE) 92 93 /* Addresses and sizes of our components. 94 * 0..128MB is space for a flash device so we can run bootrom code such as UEFI. 95 * 128MB..256MB is used for miscellaneous device I/O. 96 * 256MB..1GB is reserved for possible future PCI support (ie where the 97 * PCI memory window will go if we add a PCI host controller). 98 * 1GB and up is RAM (which may happily spill over into the 99 * high memory region beyond 4GB). 100 * This represents a compromise between how much RAM can be given to 101 * a 32 bit VM and leaving space for expansion and in particular for PCI. 102 * Note that devices should generally be placed at multiples of 0x10000, 103 * to accommodate guests using 64K pages. 104 */ 105 static const MemMapEntry a15memmap[] = { 106 /* Space up to 0x8000000 is reserved for a boot ROM */ 107 [VIRT_FLASH] = { 0, 0x08000000 }, 108 [VIRT_CPUPERIPHS] = { 0x08000000, 0x00020000 }, 109 /* GIC distributor and CPU interfaces sit inside the CPU peripheral space */ 110 [VIRT_GIC_DIST] = { 0x08000000, 0x00010000 }, 111 [VIRT_GIC_CPU] = { 0x08010000, 0x00010000 }, 112 [VIRT_UART] = { 0x09000000, 0x00001000 }, 113 [VIRT_RTC] = { 0x09010000, 0x00001000 }, 114 [VIRT_FW_CFG] = { 0x09020000, 0x0000000a }, 115 [VIRT_MMIO] = { 0x0a000000, 0x00000200 }, 116 /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */ 117 [VIRT_PCIE_MMIO] = { 0x10000000, 0x2eff0000 }, 118 [VIRT_PCIE_PIO] = { 0x3eff0000, 0x00010000 }, 119 [VIRT_PCIE_ECAM] = { 0x3f000000, 0x01000000 }, 120 [VIRT_MEM] = { 0x40000000, 30ULL * 1024 * 1024 * 1024 }, 121 }; 122 123 static const int a15irqmap[] = { 124 [VIRT_UART] = 1, 125 [VIRT_RTC] = 2, 126 [VIRT_PCIE] = 3, /* ... to 6 */ 127 [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */ 128 }; 129 130 static VirtBoardInfo machines[] = { 131 { 132 .cpu_model = "cortex-a15", 133 .memmap = a15memmap, 134 .irqmap = a15irqmap, 135 }, 136 { 137 .cpu_model = "cortex-a57", 138 .memmap = a15memmap, 139 .irqmap = a15irqmap, 140 }, 141 { 142 .cpu_model = "host", 143 .memmap = a15memmap, 144 .irqmap = a15irqmap, 145 }, 146 }; 147 148 static VirtBoardInfo *find_machine_info(const char *cpu) 149 { 150 int i; 151 152 for (i = 0; i < ARRAY_SIZE(machines); i++) { 153 if (strcmp(cpu, machines[i].cpu_model) == 0) { 154 return &machines[i]; 155 } 156 } 157 return NULL; 158 } 159 160 static void create_fdt(VirtBoardInfo *vbi) 161 { 162 void *fdt = create_device_tree(&vbi->fdt_size); 163 164 if (!fdt) { 165 error_report("create_device_tree() failed"); 166 exit(1); 167 } 168 169 vbi->fdt = fdt; 170 171 /* Header */ 172 qemu_fdt_setprop_string(fdt, "/", "compatible", "linux,dummy-virt"); 173 qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2); 174 qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2); 175 176 /* 177 * /chosen and /memory nodes must exist for load_dtb 178 * to fill in necessary properties later 179 */ 180 qemu_fdt_add_subnode(fdt, "/chosen"); 181 qemu_fdt_add_subnode(fdt, "/memory"); 182 qemu_fdt_setprop_string(fdt, "/memory", "device_type", "memory"); 183 184 /* Clock node, for the benefit of the UART. The kernel device tree 185 * binding documentation claims the PL011 node clock properties are 186 * optional but in practice if you omit them the kernel refuses to 187 * probe for the device. 188 */ 189 vbi->clock_phandle = qemu_fdt_alloc_phandle(fdt); 190 qemu_fdt_add_subnode(fdt, "/apb-pclk"); 191 qemu_fdt_setprop_string(fdt, "/apb-pclk", "compatible", "fixed-clock"); 192 qemu_fdt_setprop_cell(fdt, "/apb-pclk", "#clock-cells", 0x0); 193 qemu_fdt_setprop_cell(fdt, "/apb-pclk", "clock-frequency", 24000000); 194 qemu_fdt_setprop_string(fdt, "/apb-pclk", "clock-output-names", 195 "clk24mhz"); 196 qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vbi->clock_phandle); 197 198 } 199 200 static void fdt_add_psci_node(const VirtBoardInfo *vbi) 201 { 202 uint32_t cpu_suspend_fn; 203 uint32_t cpu_off_fn; 204 uint32_t cpu_on_fn; 205 uint32_t migrate_fn; 206 void *fdt = vbi->fdt; 207 ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0)); 208 209 qemu_fdt_add_subnode(fdt, "/psci"); 210 if (armcpu->psci_version == 2) { 211 const char comp[] = "arm,psci-0.2\0arm,psci"; 212 qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp)); 213 214 cpu_off_fn = QEMU_PSCI_0_2_FN_CPU_OFF; 215 if (arm_feature(&armcpu->env, ARM_FEATURE_AARCH64)) { 216 cpu_suspend_fn = QEMU_PSCI_0_2_FN64_CPU_SUSPEND; 217 cpu_on_fn = QEMU_PSCI_0_2_FN64_CPU_ON; 218 migrate_fn = QEMU_PSCI_0_2_FN64_MIGRATE; 219 } else { 220 cpu_suspend_fn = QEMU_PSCI_0_2_FN_CPU_SUSPEND; 221 cpu_on_fn = QEMU_PSCI_0_2_FN_CPU_ON; 222 migrate_fn = QEMU_PSCI_0_2_FN_MIGRATE; 223 } 224 } else { 225 qemu_fdt_setprop_string(fdt, "/psci", "compatible", "arm,psci"); 226 227 cpu_suspend_fn = QEMU_PSCI_0_1_FN_CPU_SUSPEND; 228 cpu_off_fn = QEMU_PSCI_0_1_FN_CPU_OFF; 229 cpu_on_fn = QEMU_PSCI_0_1_FN_CPU_ON; 230 migrate_fn = QEMU_PSCI_0_1_FN_MIGRATE; 231 } 232 233 /* We adopt the PSCI spec's nomenclature, and use 'conduit' to refer 234 * to the instruction that should be used to invoke PSCI functions. 235 * However, the device tree binding uses 'method' instead, so that is 236 * what we should use here. 237 */ 238 qemu_fdt_setprop_string(fdt, "/psci", "method", "hvc"); 239 240 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_suspend", cpu_suspend_fn); 241 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_off", cpu_off_fn); 242 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_on", cpu_on_fn); 243 qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn); 244 } 245 246 static void fdt_add_timer_nodes(const VirtBoardInfo *vbi) 247 { 248 /* Note that on A15 h/w these interrupts are level-triggered, 249 * but for the GIC implementation provided by both QEMU and KVM 250 * they are edge-triggered. 251 */ 252 ARMCPU *armcpu; 253 uint32_t irqflags = GIC_FDT_IRQ_FLAGS_EDGE_LO_HI; 254 255 irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START, 256 GIC_FDT_IRQ_PPI_CPU_WIDTH, (1 << vbi->smp_cpus) - 1); 257 258 qemu_fdt_add_subnode(vbi->fdt, "/timer"); 259 260 armcpu = ARM_CPU(qemu_get_cpu(0)); 261 if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) { 262 const char compat[] = "arm,armv8-timer\0arm,armv7-timer"; 263 qemu_fdt_setprop(vbi->fdt, "/timer", "compatible", 264 compat, sizeof(compat)); 265 } else { 266 qemu_fdt_setprop_string(vbi->fdt, "/timer", "compatible", 267 "arm,armv7-timer"); 268 } 269 qemu_fdt_setprop_cells(vbi->fdt, "/timer", "interrupts", 270 GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_S_EL1_IRQ, irqflags, 271 GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL1_IRQ, irqflags, 272 GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_VIRT_IRQ, irqflags, 273 GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL2_IRQ, irqflags); 274 } 275 276 static void fdt_add_cpu_nodes(const VirtBoardInfo *vbi) 277 { 278 int cpu; 279 280 qemu_fdt_add_subnode(vbi->fdt, "/cpus"); 281 qemu_fdt_setprop_cell(vbi->fdt, "/cpus", "#address-cells", 0x1); 282 qemu_fdt_setprop_cell(vbi->fdt, "/cpus", "#size-cells", 0x0); 283 284 for (cpu = vbi->smp_cpus - 1; cpu >= 0; cpu--) { 285 char *nodename = g_strdup_printf("/cpus/cpu@%d", cpu); 286 ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu)); 287 288 qemu_fdt_add_subnode(vbi->fdt, nodename); 289 qemu_fdt_setprop_string(vbi->fdt, nodename, "device_type", "cpu"); 290 qemu_fdt_setprop_string(vbi->fdt, nodename, "compatible", 291 armcpu->dtb_compatible); 292 293 if (vbi->smp_cpus > 1) { 294 qemu_fdt_setprop_string(vbi->fdt, nodename, 295 "enable-method", "psci"); 296 } 297 298 qemu_fdt_setprop_cell(vbi->fdt, nodename, "reg", cpu); 299 g_free(nodename); 300 } 301 } 302 303 static void fdt_add_gic_node(VirtBoardInfo *vbi) 304 { 305 306 vbi->gic_phandle = qemu_fdt_alloc_phandle(vbi->fdt); 307 qemu_fdt_setprop_cell(vbi->fdt, "/", "interrupt-parent", vbi->gic_phandle); 308 309 qemu_fdt_add_subnode(vbi->fdt, "/intc"); 310 /* 'cortex-a15-gic' means 'GIC v2' */ 311 qemu_fdt_setprop_string(vbi->fdt, "/intc", "compatible", 312 "arm,cortex-a15-gic"); 313 qemu_fdt_setprop_cell(vbi->fdt, "/intc", "#interrupt-cells", 3); 314 qemu_fdt_setprop(vbi->fdt, "/intc", "interrupt-controller", NULL, 0); 315 qemu_fdt_setprop_sized_cells(vbi->fdt, "/intc", "reg", 316 2, vbi->memmap[VIRT_GIC_DIST].base, 317 2, vbi->memmap[VIRT_GIC_DIST].size, 318 2, vbi->memmap[VIRT_GIC_CPU].base, 319 2, vbi->memmap[VIRT_GIC_CPU].size); 320 qemu_fdt_setprop_cell(vbi->fdt, "/intc", "phandle", vbi->gic_phandle); 321 } 322 323 static void create_gic(VirtBoardInfo *vbi, qemu_irq *pic) 324 { 325 /* We create a standalone GIC v2 */ 326 DeviceState *gicdev; 327 SysBusDevice *gicbusdev; 328 const char *gictype = "arm_gic"; 329 int i; 330 331 if (kvm_irqchip_in_kernel()) { 332 gictype = "kvm-arm-gic"; 333 } 334 335 gicdev = qdev_create(NULL, gictype); 336 qdev_prop_set_uint32(gicdev, "revision", 2); 337 qdev_prop_set_uint32(gicdev, "num-cpu", smp_cpus); 338 /* Note that the num-irq property counts both internal and external 339 * interrupts; there are always 32 of the former (mandated by GIC spec). 340 */ 341 qdev_prop_set_uint32(gicdev, "num-irq", NUM_IRQS + 32); 342 qdev_init_nofail(gicdev); 343 gicbusdev = SYS_BUS_DEVICE(gicdev); 344 sysbus_mmio_map(gicbusdev, 0, vbi->memmap[VIRT_GIC_DIST].base); 345 sysbus_mmio_map(gicbusdev, 1, vbi->memmap[VIRT_GIC_CPU].base); 346 347 /* Wire the outputs from each CPU's generic timer to the 348 * appropriate GIC PPI inputs, and the GIC's IRQ output to 349 * the CPU's IRQ input. 350 */ 351 for (i = 0; i < smp_cpus; i++) { 352 DeviceState *cpudev = DEVICE(qemu_get_cpu(i)); 353 int ppibase = NUM_IRQS + i * 32; 354 /* physical timer; we wire it up to the non-secure timer's ID, 355 * since a real A15 always has TrustZone but QEMU doesn't. 356 */ 357 qdev_connect_gpio_out(cpudev, 0, 358 qdev_get_gpio_in(gicdev, ppibase + 30)); 359 /* virtual timer */ 360 qdev_connect_gpio_out(cpudev, 1, 361 qdev_get_gpio_in(gicdev, ppibase + 27)); 362 363 sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ)); 364 sysbus_connect_irq(gicbusdev, i + smp_cpus, 365 qdev_get_gpio_in(cpudev, ARM_CPU_FIQ)); 366 } 367 368 for (i = 0; i < NUM_IRQS; i++) { 369 pic[i] = qdev_get_gpio_in(gicdev, i); 370 } 371 372 fdt_add_gic_node(vbi); 373 } 374 375 static void create_uart(const VirtBoardInfo *vbi, qemu_irq *pic) 376 { 377 char *nodename; 378 hwaddr base = vbi->memmap[VIRT_UART].base; 379 hwaddr size = vbi->memmap[VIRT_UART].size; 380 int irq = vbi->irqmap[VIRT_UART]; 381 const char compat[] = "arm,pl011\0arm,primecell"; 382 const char clocknames[] = "uartclk\0apb_pclk"; 383 384 sysbus_create_simple("pl011", base, pic[irq]); 385 386 nodename = g_strdup_printf("/pl011@%" PRIx64, base); 387 qemu_fdt_add_subnode(vbi->fdt, nodename); 388 /* Note that we can't use setprop_string because of the embedded NUL */ 389 qemu_fdt_setprop(vbi->fdt, nodename, "compatible", 390 compat, sizeof(compat)); 391 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 392 2, base, 2, size); 393 qemu_fdt_setprop_cells(vbi->fdt, nodename, "interrupts", 394 GIC_FDT_IRQ_TYPE_SPI, irq, 395 GIC_FDT_IRQ_FLAGS_LEVEL_HI); 396 qemu_fdt_setprop_cells(vbi->fdt, nodename, "clocks", 397 vbi->clock_phandle, vbi->clock_phandle); 398 qemu_fdt_setprop(vbi->fdt, nodename, "clock-names", 399 clocknames, sizeof(clocknames)); 400 401 qemu_fdt_setprop_string(vbi->fdt, "/chosen", "stdout-path", nodename); 402 g_free(nodename); 403 } 404 405 static void create_rtc(const VirtBoardInfo *vbi, qemu_irq *pic) 406 { 407 char *nodename; 408 hwaddr base = vbi->memmap[VIRT_RTC].base; 409 hwaddr size = vbi->memmap[VIRT_RTC].size; 410 int irq = vbi->irqmap[VIRT_RTC]; 411 const char compat[] = "arm,pl031\0arm,primecell"; 412 413 sysbus_create_simple("pl031", base, pic[irq]); 414 415 nodename = g_strdup_printf("/pl031@%" PRIx64, base); 416 qemu_fdt_add_subnode(vbi->fdt, nodename); 417 qemu_fdt_setprop(vbi->fdt, nodename, "compatible", compat, sizeof(compat)); 418 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 419 2, base, 2, size); 420 qemu_fdt_setprop_cells(vbi->fdt, nodename, "interrupts", 421 GIC_FDT_IRQ_TYPE_SPI, irq, 422 GIC_FDT_IRQ_FLAGS_LEVEL_HI); 423 qemu_fdt_setprop_cell(vbi->fdt, nodename, "clocks", vbi->clock_phandle); 424 qemu_fdt_setprop_string(vbi->fdt, nodename, "clock-names", "apb_pclk"); 425 g_free(nodename); 426 } 427 428 static void create_virtio_devices(const VirtBoardInfo *vbi, qemu_irq *pic) 429 { 430 int i; 431 hwaddr size = vbi->memmap[VIRT_MMIO].size; 432 433 /* We create the transports in forwards order. Since qbus_realize() 434 * prepends (not appends) new child buses, the incrementing loop below will 435 * create a list of virtio-mmio buses with decreasing base addresses. 436 * 437 * When a -device option is processed from the command line, 438 * qbus_find_recursive() picks the next free virtio-mmio bus in forwards 439 * order. The upshot is that -device options in increasing command line 440 * order are mapped to virtio-mmio buses with decreasing base addresses. 441 * 442 * When this code was originally written, that arrangement ensured that the 443 * guest Linux kernel would give the lowest "name" (/dev/vda, eth0, etc) to 444 * the first -device on the command line. (The end-to-end order is a 445 * function of this loop, qbus_realize(), qbus_find_recursive(), and the 446 * guest kernel's name-to-address assignment strategy.) 447 * 448 * Meanwhile, the kernel's traversal seems to have been reversed; see eg. 449 * the message, if not necessarily the code, of commit 70161ff336. 450 * Therefore the loop now establishes the inverse of the original intent. 451 * 452 * Unfortunately, we can't counteract the kernel change by reversing the 453 * loop; it would break existing command lines. 454 * 455 * In any case, the kernel makes no guarantee about the stability of 456 * enumeration order of virtio devices (as demonstrated by it changing 457 * between kernel versions). For reliable and stable identification 458 * of disks users must use UUIDs or similar mechanisms. 459 */ 460 for (i = 0; i < NUM_VIRTIO_TRANSPORTS; i++) { 461 int irq = vbi->irqmap[VIRT_MMIO] + i; 462 hwaddr base = vbi->memmap[VIRT_MMIO].base + i * size; 463 464 sysbus_create_simple("virtio-mmio", base, pic[irq]); 465 } 466 467 /* We add dtb nodes in reverse order so that they appear in the finished 468 * device tree lowest address first. 469 * 470 * Note that this mapping is independent of the loop above. The previous 471 * loop influences virtio device to virtio transport assignment, whereas 472 * this loop controls how virtio transports are laid out in the dtb. 473 */ 474 for (i = NUM_VIRTIO_TRANSPORTS - 1; i >= 0; i--) { 475 char *nodename; 476 int irq = vbi->irqmap[VIRT_MMIO] + i; 477 hwaddr base = vbi->memmap[VIRT_MMIO].base + i * size; 478 479 nodename = g_strdup_printf("/virtio_mmio@%" PRIx64, base); 480 qemu_fdt_add_subnode(vbi->fdt, nodename); 481 qemu_fdt_setprop_string(vbi->fdt, nodename, 482 "compatible", "virtio,mmio"); 483 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 484 2, base, 2, size); 485 qemu_fdt_setprop_cells(vbi->fdt, nodename, "interrupts", 486 GIC_FDT_IRQ_TYPE_SPI, irq, 487 GIC_FDT_IRQ_FLAGS_EDGE_LO_HI); 488 g_free(nodename); 489 } 490 } 491 492 static void create_one_flash(const char *name, hwaddr flashbase, 493 hwaddr flashsize) 494 { 495 /* Create and map a single flash device. We use the same 496 * parameters as the flash devices on the Versatile Express board. 497 */ 498 DriveInfo *dinfo = drive_get_next(IF_PFLASH); 499 DeviceState *dev = qdev_create(NULL, "cfi.pflash01"); 500 const uint64_t sectorlength = 256 * 1024; 501 502 if (dinfo) { 503 qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo), 504 &error_abort); 505 } 506 507 qdev_prop_set_uint32(dev, "num-blocks", flashsize / sectorlength); 508 qdev_prop_set_uint64(dev, "sector-length", sectorlength); 509 qdev_prop_set_uint8(dev, "width", 4); 510 qdev_prop_set_uint8(dev, "device-width", 2); 511 qdev_prop_set_uint8(dev, "big-endian", 0); 512 qdev_prop_set_uint16(dev, "id0", 0x89); 513 qdev_prop_set_uint16(dev, "id1", 0x18); 514 qdev_prop_set_uint16(dev, "id2", 0x00); 515 qdev_prop_set_uint16(dev, "id3", 0x00); 516 qdev_prop_set_string(dev, "name", name); 517 qdev_init_nofail(dev); 518 519 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, flashbase); 520 } 521 522 static void create_flash(const VirtBoardInfo *vbi) 523 { 524 /* Create two flash devices to fill the VIRT_FLASH space in the memmap. 525 * Any file passed via -bios goes in the first of these. 526 */ 527 hwaddr flashsize = vbi->memmap[VIRT_FLASH].size / 2; 528 hwaddr flashbase = vbi->memmap[VIRT_FLASH].base; 529 char *nodename; 530 531 if (bios_name) { 532 char *fn; 533 int image_size; 534 535 if (drive_get(IF_PFLASH, 0, 0)) { 536 error_report("The contents of the first flash device may be " 537 "specified with -bios or with -drive if=pflash... " 538 "but you cannot use both options at once"); 539 exit(1); 540 } 541 fn = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name); 542 if (!fn) { 543 error_report("Could not find ROM image '%s'", bios_name); 544 exit(1); 545 } 546 image_size = load_image_targphys(fn, flashbase, flashsize); 547 g_free(fn); 548 if (image_size < 0) { 549 error_report("Could not load ROM image '%s'", bios_name); 550 exit(1); 551 } 552 } 553 554 create_one_flash("virt.flash0", flashbase, flashsize); 555 create_one_flash("virt.flash1", flashbase + flashsize, flashsize); 556 557 nodename = g_strdup_printf("/flash@%" PRIx64, flashbase); 558 qemu_fdt_add_subnode(vbi->fdt, nodename); 559 qemu_fdt_setprop_string(vbi->fdt, nodename, "compatible", "cfi-flash"); 560 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 561 2, flashbase, 2, flashsize, 562 2, flashbase + flashsize, 2, flashsize); 563 qemu_fdt_setprop_cell(vbi->fdt, nodename, "bank-width", 4); 564 g_free(nodename); 565 } 566 567 static void create_fw_cfg(const VirtBoardInfo *vbi) 568 { 569 hwaddr base = vbi->memmap[VIRT_FW_CFG].base; 570 hwaddr size = vbi->memmap[VIRT_FW_CFG].size; 571 char *nodename; 572 573 fw_cfg_init_mem_wide(base + 8, base, 8); 574 575 nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base); 576 qemu_fdt_add_subnode(vbi->fdt, nodename); 577 qemu_fdt_setprop_string(vbi->fdt, nodename, 578 "compatible", "qemu,fw-cfg-mmio"); 579 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 580 2, base, 2, size); 581 g_free(nodename); 582 } 583 584 static void create_pcie_irq_map(const VirtBoardInfo *vbi, uint32_t gic_phandle, 585 int first_irq, const char *nodename) 586 { 587 int devfn, pin; 588 uint32_t full_irq_map[4 * 4 * 8] = { 0 }; 589 uint32_t *irq_map = full_irq_map; 590 591 for (devfn = 0; devfn <= 0x18; devfn += 0x8) { 592 for (pin = 0; pin < 4; pin++) { 593 int irq_type = GIC_FDT_IRQ_TYPE_SPI; 594 int irq_nr = first_irq + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS); 595 int irq_level = GIC_FDT_IRQ_FLAGS_LEVEL_HI; 596 int i; 597 598 uint32_t map[] = { 599 devfn << 8, 0, 0, /* devfn */ 600 pin + 1, /* PCI pin */ 601 gic_phandle, irq_type, irq_nr, irq_level }; /* GIC irq */ 602 603 /* Convert map to big endian */ 604 for (i = 0; i < 8; i++) { 605 irq_map[i] = cpu_to_be32(map[i]); 606 } 607 irq_map += 8; 608 } 609 } 610 611 qemu_fdt_setprop(vbi->fdt, nodename, "interrupt-map", 612 full_irq_map, sizeof(full_irq_map)); 613 614 qemu_fdt_setprop_cells(vbi->fdt, nodename, "interrupt-map-mask", 615 0x1800, 0, 0, /* devfn (PCI_SLOT(3)) */ 616 0x7 /* PCI irq */); 617 } 618 619 static void create_pcie(const VirtBoardInfo *vbi, qemu_irq *pic) 620 { 621 hwaddr base_mmio = vbi->memmap[VIRT_PCIE_MMIO].base; 622 hwaddr size_mmio = vbi->memmap[VIRT_PCIE_MMIO].size; 623 hwaddr base_pio = vbi->memmap[VIRT_PCIE_PIO].base; 624 hwaddr size_pio = vbi->memmap[VIRT_PCIE_PIO].size; 625 hwaddr base_ecam = vbi->memmap[VIRT_PCIE_ECAM].base; 626 hwaddr size_ecam = vbi->memmap[VIRT_PCIE_ECAM].size; 627 hwaddr base = base_mmio; 628 int nr_pcie_buses = size_ecam / PCIE_MMCFG_SIZE_MIN; 629 int irq = vbi->irqmap[VIRT_PCIE]; 630 MemoryRegion *mmio_alias; 631 MemoryRegion *mmio_reg; 632 MemoryRegion *ecam_alias; 633 MemoryRegion *ecam_reg; 634 DeviceState *dev; 635 char *nodename; 636 int i; 637 638 dev = qdev_create(NULL, TYPE_GPEX_HOST); 639 qdev_init_nofail(dev); 640 641 /* Map only the first size_ecam bytes of ECAM space */ 642 ecam_alias = g_new0(MemoryRegion, 1); 643 ecam_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0); 644 memory_region_init_alias(ecam_alias, OBJECT(dev), "pcie-ecam", 645 ecam_reg, 0, size_ecam); 646 memory_region_add_subregion(get_system_memory(), base_ecam, ecam_alias); 647 648 /* Map the MMIO window into system address space so as to expose 649 * the section of PCI MMIO space which starts at the same base address 650 * (ie 1:1 mapping for that part of PCI MMIO space visible through 651 * the window). 652 */ 653 mmio_alias = g_new0(MemoryRegion, 1); 654 mmio_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 1); 655 memory_region_init_alias(mmio_alias, OBJECT(dev), "pcie-mmio", 656 mmio_reg, base_mmio, size_mmio); 657 memory_region_add_subregion(get_system_memory(), base_mmio, mmio_alias); 658 659 /* Map IO port space */ 660 sysbus_mmio_map(SYS_BUS_DEVICE(dev), 2, base_pio); 661 662 for (i = 0; i < GPEX_NUM_IRQS; i++) { 663 sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]); 664 } 665 666 nodename = g_strdup_printf("/pcie@%" PRIx64, base); 667 qemu_fdt_add_subnode(vbi->fdt, nodename); 668 qemu_fdt_setprop_string(vbi->fdt, nodename, 669 "compatible", "pci-host-ecam-generic"); 670 qemu_fdt_setprop_string(vbi->fdt, nodename, "device_type", "pci"); 671 qemu_fdt_setprop_cell(vbi->fdt, nodename, "#address-cells", 3); 672 qemu_fdt_setprop_cell(vbi->fdt, nodename, "#size-cells", 2); 673 qemu_fdt_setprop_cells(vbi->fdt, nodename, "bus-range", 0, 674 nr_pcie_buses - 1); 675 676 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 677 2, base_ecam, 2, size_ecam); 678 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "ranges", 679 1, FDT_PCI_RANGE_IOPORT, 2, 0, 680 2, base_pio, 2, size_pio, 681 1, FDT_PCI_RANGE_MMIO, 2, base_mmio, 682 2, base_mmio, 2, size_mmio); 683 684 qemu_fdt_setprop_cell(vbi->fdt, nodename, "#interrupt-cells", 1); 685 create_pcie_irq_map(vbi, vbi->gic_phandle, irq, nodename); 686 687 g_free(nodename); 688 } 689 690 static void *machvirt_dtb(const struct arm_boot_info *binfo, int *fdt_size) 691 { 692 const VirtBoardInfo *board = (const VirtBoardInfo *)binfo; 693 694 *fdt_size = board->fdt_size; 695 return board->fdt; 696 } 697 698 static 699 void virt_guest_info_machine_done(Notifier *notifier, void *data) 700 { 701 VirtGuestInfoState *guest_info_state = container_of(notifier, 702 VirtGuestInfoState, machine_done); 703 virt_acpi_setup(&guest_info_state->info); 704 } 705 706 static void machvirt_init(MachineState *machine) 707 { 708 VirtMachineState *vms = VIRT_MACHINE(machine); 709 qemu_irq pic[NUM_IRQS]; 710 MemoryRegion *sysmem = get_system_memory(); 711 int n; 712 MemoryRegion *ram = g_new(MemoryRegion, 1); 713 const char *cpu_model = machine->cpu_model; 714 VirtBoardInfo *vbi; 715 VirtGuestInfoState *guest_info_state = g_malloc0(sizeof *guest_info_state); 716 VirtGuestInfo *guest_info = &guest_info_state->info; 717 char **cpustr; 718 719 if (!cpu_model) { 720 cpu_model = "cortex-a15"; 721 } 722 723 /* Separate the actual CPU model name from any appended features */ 724 cpustr = g_strsplit(cpu_model, ",", 2); 725 726 vbi = find_machine_info(cpustr[0]); 727 728 if (!vbi) { 729 error_report("mach-virt: CPU %s not supported", cpustr[0]); 730 exit(1); 731 } 732 733 vbi->smp_cpus = smp_cpus; 734 735 if (machine->ram_size > vbi->memmap[VIRT_MEM].size) { 736 error_report("mach-virt: cannot model more than 30GB RAM"); 737 exit(1); 738 } 739 740 create_fdt(vbi); 741 742 for (n = 0; n < smp_cpus; n++) { 743 ObjectClass *oc = cpu_class_by_name(TYPE_ARM_CPU, cpustr[0]); 744 CPUClass *cc = CPU_CLASS(oc); 745 Object *cpuobj; 746 Error *err = NULL; 747 char *cpuopts = g_strdup(cpustr[1]); 748 749 if (!oc) { 750 fprintf(stderr, "Unable to find CPU definition\n"); 751 exit(1); 752 } 753 cpuobj = object_new(object_class_get_name(oc)); 754 755 /* Handle any CPU options specified by the user */ 756 cc->parse_features(CPU(cpuobj), cpuopts, &err); 757 g_free(cpuopts); 758 if (err) { 759 error_report_err(err); 760 exit(1); 761 } 762 763 if (!vms->secure) { 764 object_property_set_bool(cpuobj, false, "has_el3", NULL); 765 } 766 767 object_property_set_int(cpuobj, QEMU_PSCI_CONDUIT_HVC, "psci-conduit", 768 NULL); 769 770 /* Secondary CPUs start in PSCI powered-down state */ 771 if (n > 0) { 772 object_property_set_bool(cpuobj, true, "start-powered-off", NULL); 773 } 774 775 if (object_property_find(cpuobj, "reset-cbar", NULL)) { 776 object_property_set_int(cpuobj, vbi->memmap[VIRT_CPUPERIPHS].base, 777 "reset-cbar", &error_abort); 778 } 779 780 object_property_set_bool(cpuobj, true, "realized", NULL); 781 } 782 g_strfreev(cpustr); 783 fdt_add_timer_nodes(vbi); 784 fdt_add_cpu_nodes(vbi); 785 fdt_add_psci_node(vbi); 786 787 memory_region_allocate_system_memory(ram, NULL, "mach-virt.ram", 788 machine->ram_size); 789 memory_region_add_subregion(sysmem, vbi->memmap[VIRT_MEM].base, ram); 790 791 create_flash(vbi); 792 793 create_gic(vbi, pic); 794 795 create_uart(vbi, pic); 796 797 create_rtc(vbi, pic); 798 799 create_pcie(vbi, pic); 800 801 /* Create mmio transports, so the user can create virtio backends 802 * (which will be automatically plugged in to the transports). If 803 * no backend is created the transport will just sit harmlessly idle. 804 */ 805 create_virtio_devices(vbi, pic); 806 807 create_fw_cfg(vbi); 808 rom_set_fw(fw_cfg_find()); 809 810 guest_info->smp_cpus = smp_cpus; 811 guest_info->fw_cfg = fw_cfg_find(); 812 guest_info->memmap = vbi->memmap; 813 guest_info->irqmap = vbi->irqmap; 814 guest_info_state->machine_done.notify = virt_guest_info_machine_done; 815 qemu_add_machine_init_done_notifier(&guest_info_state->machine_done); 816 817 vbi->bootinfo.ram_size = machine->ram_size; 818 vbi->bootinfo.kernel_filename = machine->kernel_filename; 819 vbi->bootinfo.kernel_cmdline = machine->kernel_cmdline; 820 vbi->bootinfo.initrd_filename = machine->initrd_filename; 821 vbi->bootinfo.nb_cpus = smp_cpus; 822 vbi->bootinfo.board_id = -1; 823 vbi->bootinfo.loader_start = vbi->memmap[VIRT_MEM].base; 824 vbi->bootinfo.get_dtb = machvirt_dtb; 825 vbi->bootinfo.firmware_loaded = bios_name || drive_get(IF_PFLASH, 0, 0); 826 arm_load_kernel(ARM_CPU(first_cpu), &vbi->bootinfo); 827 } 828 829 static bool virt_get_secure(Object *obj, Error **errp) 830 { 831 VirtMachineState *vms = VIRT_MACHINE(obj); 832 833 return vms->secure; 834 } 835 836 static void virt_set_secure(Object *obj, bool value, Error **errp) 837 { 838 VirtMachineState *vms = VIRT_MACHINE(obj); 839 840 vms->secure = value; 841 } 842 843 static void virt_instance_init(Object *obj) 844 { 845 VirtMachineState *vms = VIRT_MACHINE(obj); 846 847 /* EL3 is enabled by default on virt */ 848 vms->secure = true; 849 object_property_add_bool(obj, "secure", virt_get_secure, 850 virt_set_secure, NULL); 851 object_property_set_description(obj, "secure", 852 "Set on/off to enable/disable the ARM " 853 "Security Extensions (TrustZone)", 854 NULL); 855 } 856 857 static void virt_class_init(ObjectClass *oc, void *data) 858 { 859 MachineClass *mc = MACHINE_CLASS(oc); 860 861 mc->name = TYPE_VIRT_MACHINE; 862 mc->desc = "ARM Virtual Machine", 863 mc->init = machvirt_init; 864 mc->max_cpus = 8; 865 } 866 867 static const TypeInfo machvirt_info = { 868 .name = TYPE_VIRT_MACHINE, 869 .parent = TYPE_MACHINE, 870 .instance_size = sizeof(VirtMachineState), 871 .instance_init = virt_instance_init, 872 .class_size = sizeof(VirtMachineClass), 873 .class_init = virt_class_init, 874 }; 875 876 static void machvirt_machine_init(void) 877 { 878 type_register_static(&machvirt_info); 879 } 880 881 machine_init(machvirt_machine_init); 882