1 /* 2 * ARM mach-virt emulation 3 * 4 * Copyright (c) 2013 Linaro Limited 5 * 6 * This program is free software; you can redistribute it and/or modify it 7 * under the terms and conditions of the GNU General Public License, 8 * version 2 or later, as published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope it will be useful, but WITHOUT 11 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 12 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 13 * more details. 14 * 15 * You should have received a copy of the GNU General Public License along with 16 * this program. If not, see <http://www.gnu.org/licenses/>. 17 * 18 * Emulate a virtual board which works by passing Linux all the information 19 * it needs about what devices are present via the device tree. 20 * There are some restrictions about what we can do here: 21 * + we can only present devices whose Linux drivers will work based 22 * purely on the device tree with no platform data at all 23 * + we want to present a very stripped-down minimalist platform, 24 * both because this reduces the security attack surface from the guest 25 * and also because it reduces our exposure to being broken when 26 * the kernel updates its device tree bindings and requires further 27 * information in a device binding that we aren't providing. 28 * This is essentially the same approach kvmtool uses. 29 */ 30 31 #include "hw/sysbus.h" 32 #include "hw/arm/arm.h" 33 #include "hw/arm/primecell.h" 34 #include "hw/devices.h" 35 #include "net/net.h" 36 #include "sysemu/device_tree.h" 37 #include "sysemu/sysemu.h" 38 #include "sysemu/kvm.h" 39 #include "hw/boards.h" 40 #include "exec/address-spaces.h" 41 #include "qemu/bitops.h" 42 #include "qemu/error-report.h" 43 44 #define NUM_VIRTIO_TRANSPORTS 32 45 46 /* Number of external interrupt lines to configure the GIC with */ 47 #define NUM_IRQS 128 48 49 #define GIC_FDT_IRQ_TYPE_SPI 0 50 #define GIC_FDT_IRQ_TYPE_PPI 1 51 52 #define GIC_FDT_IRQ_FLAGS_EDGE_LO_HI 1 53 #define GIC_FDT_IRQ_FLAGS_EDGE_HI_LO 2 54 #define GIC_FDT_IRQ_FLAGS_LEVEL_HI 4 55 #define GIC_FDT_IRQ_FLAGS_LEVEL_LO 8 56 57 #define GIC_FDT_IRQ_PPI_CPU_START 8 58 #define GIC_FDT_IRQ_PPI_CPU_WIDTH 8 59 60 enum { 61 VIRT_FLASH, 62 VIRT_MEM, 63 VIRT_CPUPERIPHS, 64 VIRT_GIC_DIST, 65 VIRT_GIC_CPU, 66 VIRT_UART, 67 VIRT_MMIO, 68 }; 69 70 typedef struct MemMapEntry { 71 hwaddr base; 72 hwaddr size; 73 } MemMapEntry; 74 75 typedef struct VirtBoardInfo { 76 struct arm_boot_info bootinfo; 77 const char *cpu_model; 78 const MemMapEntry *memmap; 79 const int *irqmap; 80 int smp_cpus; 81 void *fdt; 82 int fdt_size; 83 uint32_t clock_phandle; 84 } VirtBoardInfo; 85 86 /* Addresses and sizes of our components. 87 * 0..128MB is space for a flash device so we can run bootrom code such as UEFI. 88 * 128MB..256MB is used for miscellaneous device I/O. 89 * 256MB..1GB is reserved for possible future PCI support (ie where the 90 * PCI memory window will go if we add a PCI host controller). 91 * 1GB and up is RAM (which may happily spill over into the 92 * high memory region beyond 4GB). 93 * This represents a compromise between how much RAM can be given to 94 * a 32 bit VM and leaving space for expansion and in particular for PCI. 95 */ 96 static const MemMapEntry a15memmap[] = { 97 /* Space up to 0x8000000 is reserved for a boot ROM */ 98 [VIRT_FLASH] = { 0, 0x8000000 }, 99 [VIRT_CPUPERIPHS] = { 0x8000000, 0x20000 }, 100 /* GIC distributor and CPU interfaces sit inside the CPU peripheral space */ 101 [VIRT_GIC_DIST] = { 0x8000000, 0x10000 }, 102 [VIRT_GIC_CPU] = { 0x8010000, 0x10000 }, 103 [VIRT_UART] = { 0x9000000, 0x1000 }, 104 [VIRT_MMIO] = { 0xa000000, 0x200 }, 105 /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */ 106 /* 0x10000000 .. 0x40000000 reserved for PCI */ 107 [VIRT_MEM] = { 0x40000000, 30ULL * 1024 * 1024 * 1024 }, 108 }; 109 110 static const int a15irqmap[] = { 111 [VIRT_UART] = 1, 112 [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */ 113 }; 114 115 static VirtBoardInfo machines[] = { 116 { 117 .cpu_model = "cortex-a15", 118 .memmap = a15memmap, 119 .irqmap = a15irqmap, 120 }, 121 { 122 .cpu_model = "cortex-a57", 123 .memmap = a15memmap, 124 .irqmap = a15irqmap, 125 }, 126 { 127 .cpu_model = "host", 128 .memmap = a15memmap, 129 .irqmap = a15irqmap, 130 }, 131 }; 132 133 static VirtBoardInfo *find_machine_info(const char *cpu) 134 { 135 int i; 136 137 for (i = 0; i < ARRAY_SIZE(machines); i++) { 138 if (strcmp(cpu, machines[i].cpu_model) == 0) { 139 return &machines[i]; 140 } 141 } 142 return NULL; 143 } 144 145 static void create_fdt(VirtBoardInfo *vbi) 146 { 147 void *fdt = create_device_tree(&vbi->fdt_size); 148 149 if (!fdt) { 150 error_report("create_device_tree() failed"); 151 exit(1); 152 } 153 154 vbi->fdt = fdt; 155 156 /* Header */ 157 qemu_fdt_setprop_string(fdt, "/", "compatible", "linux,dummy-virt"); 158 qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2); 159 qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2); 160 161 /* 162 * /chosen and /memory nodes must exist for load_dtb 163 * to fill in necessary properties later 164 */ 165 qemu_fdt_add_subnode(fdt, "/chosen"); 166 qemu_fdt_add_subnode(fdt, "/memory"); 167 qemu_fdt_setprop_string(fdt, "/memory", "device_type", "memory"); 168 169 /* Clock node, for the benefit of the UART. The kernel device tree 170 * binding documentation claims the PL011 node clock properties are 171 * optional but in practice if you omit them the kernel refuses to 172 * probe for the device. 173 */ 174 vbi->clock_phandle = qemu_fdt_alloc_phandle(fdt); 175 qemu_fdt_add_subnode(fdt, "/apb-pclk"); 176 qemu_fdt_setprop_string(fdt, "/apb-pclk", "compatible", "fixed-clock"); 177 qemu_fdt_setprop_cell(fdt, "/apb-pclk", "#clock-cells", 0x0); 178 qemu_fdt_setprop_cell(fdt, "/apb-pclk", "clock-frequency", 24000000); 179 qemu_fdt_setprop_string(fdt, "/apb-pclk", "clock-output-names", 180 "clk24mhz"); 181 qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vbi->clock_phandle); 182 183 } 184 185 static void fdt_add_psci_node(const VirtBoardInfo *vbi) 186 { 187 void *fdt = vbi->fdt; 188 ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0)); 189 190 /* No PSCI for TCG yet */ 191 if (kvm_enabled()) { 192 qemu_fdt_add_subnode(fdt, "/psci"); 193 if (armcpu->psci_version == 2) { 194 const char comp[] = "arm,psci-0.2\0arm,psci"; 195 qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp)); 196 } else { 197 qemu_fdt_setprop_string(fdt, "/psci", "compatible", "arm,psci"); 198 } 199 200 qemu_fdt_setprop_string(fdt, "/psci", "method", "hvc"); 201 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_suspend", 202 PSCI_FN_CPU_SUSPEND); 203 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_off", PSCI_FN_CPU_OFF); 204 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_on", PSCI_FN_CPU_ON); 205 qemu_fdt_setprop_cell(fdt, "/psci", "migrate", PSCI_FN_MIGRATE); 206 } 207 } 208 209 static void fdt_add_timer_nodes(const VirtBoardInfo *vbi) 210 { 211 /* Note that on A15 h/w these interrupts are level-triggered, 212 * but for the GIC implementation provided by both QEMU and KVM 213 * they are edge-triggered. 214 */ 215 uint32_t irqflags = GIC_FDT_IRQ_FLAGS_EDGE_LO_HI; 216 217 irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START, 218 GIC_FDT_IRQ_PPI_CPU_WIDTH, (1 << vbi->smp_cpus) - 1); 219 220 qemu_fdt_add_subnode(vbi->fdt, "/timer"); 221 qemu_fdt_setprop_string(vbi->fdt, "/timer", 222 "compatible", "arm,armv7-timer"); 223 qemu_fdt_setprop_cells(vbi->fdt, "/timer", "interrupts", 224 GIC_FDT_IRQ_TYPE_PPI, 13, irqflags, 225 GIC_FDT_IRQ_TYPE_PPI, 14, irqflags, 226 GIC_FDT_IRQ_TYPE_PPI, 11, irqflags, 227 GIC_FDT_IRQ_TYPE_PPI, 10, irqflags); 228 } 229 230 static void fdt_add_cpu_nodes(const VirtBoardInfo *vbi) 231 { 232 int cpu; 233 234 qemu_fdt_add_subnode(vbi->fdt, "/cpus"); 235 qemu_fdt_setprop_cell(vbi->fdt, "/cpus", "#address-cells", 0x1); 236 qemu_fdt_setprop_cell(vbi->fdt, "/cpus", "#size-cells", 0x0); 237 238 for (cpu = vbi->smp_cpus - 1; cpu >= 0; cpu--) { 239 char *nodename = g_strdup_printf("/cpus/cpu@%d", cpu); 240 ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu)); 241 242 qemu_fdt_add_subnode(vbi->fdt, nodename); 243 qemu_fdt_setprop_string(vbi->fdt, nodename, "device_type", "cpu"); 244 qemu_fdt_setprop_string(vbi->fdt, nodename, "compatible", 245 armcpu->dtb_compatible); 246 247 if (vbi->smp_cpus > 1) { 248 qemu_fdt_setprop_string(vbi->fdt, nodename, 249 "enable-method", "psci"); 250 } 251 252 qemu_fdt_setprop_cell(vbi->fdt, nodename, "reg", cpu); 253 g_free(nodename); 254 } 255 } 256 257 static void fdt_add_gic_node(const VirtBoardInfo *vbi) 258 { 259 uint32_t gic_phandle; 260 261 gic_phandle = qemu_fdt_alloc_phandle(vbi->fdt); 262 qemu_fdt_setprop_cell(vbi->fdt, "/", "interrupt-parent", gic_phandle); 263 264 qemu_fdt_add_subnode(vbi->fdt, "/intc"); 265 /* 'cortex-a15-gic' means 'GIC v2' */ 266 qemu_fdt_setprop_string(vbi->fdt, "/intc", "compatible", 267 "arm,cortex-a15-gic"); 268 qemu_fdt_setprop_cell(vbi->fdt, "/intc", "#interrupt-cells", 3); 269 qemu_fdt_setprop(vbi->fdt, "/intc", "interrupt-controller", NULL, 0); 270 qemu_fdt_setprop_sized_cells(vbi->fdt, "/intc", "reg", 271 2, vbi->memmap[VIRT_GIC_DIST].base, 272 2, vbi->memmap[VIRT_GIC_DIST].size, 273 2, vbi->memmap[VIRT_GIC_CPU].base, 274 2, vbi->memmap[VIRT_GIC_CPU].size); 275 qemu_fdt_setprop_cell(vbi->fdt, "/intc", "phandle", gic_phandle); 276 } 277 278 static void create_gic(const VirtBoardInfo *vbi, qemu_irq *pic) 279 { 280 /* We create a standalone GIC v2 */ 281 DeviceState *gicdev; 282 SysBusDevice *gicbusdev; 283 const char *gictype = "arm_gic"; 284 int i; 285 286 if (kvm_irqchip_in_kernel()) { 287 gictype = "kvm-arm-gic"; 288 } 289 290 gicdev = qdev_create(NULL, gictype); 291 qdev_prop_set_uint32(gicdev, "revision", 2); 292 qdev_prop_set_uint32(gicdev, "num-cpu", smp_cpus); 293 /* Note that the num-irq property counts both internal and external 294 * interrupts; there are always 32 of the former (mandated by GIC spec). 295 */ 296 qdev_prop_set_uint32(gicdev, "num-irq", NUM_IRQS + 32); 297 qdev_init_nofail(gicdev); 298 gicbusdev = SYS_BUS_DEVICE(gicdev); 299 sysbus_mmio_map(gicbusdev, 0, vbi->memmap[VIRT_GIC_DIST].base); 300 sysbus_mmio_map(gicbusdev, 1, vbi->memmap[VIRT_GIC_CPU].base); 301 302 /* Wire the outputs from each CPU's generic timer to the 303 * appropriate GIC PPI inputs, and the GIC's IRQ output to 304 * the CPU's IRQ input. 305 */ 306 for (i = 0; i < smp_cpus; i++) { 307 DeviceState *cpudev = DEVICE(qemu_get_cpu(i)); 308 int ppibase = NUM_IRQS + i * 32; 309 /* physical timer; we wire it up to the non-secure timer's ID, 310 * since a real A15 always has TrustZone but QEMU doesn't. 311 */ 312 qdev_connect_gpio_out(cpudev, 0, 313 qdev_get_gpio_in(gicdev, ppibase + 30)); 314 /* virtual timer */ 315 qdev_connect_gpio_out(cpudev, 1, 316 qdev_get_gpio_in(gicdev, ppibase + 27)); 317 318 sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ)); 319 } 320 321 for (i = 0; i < NUM_IRQS; i++) { 322 pic[i] = qdev_get_gpio_in(gicdev, i); 323 } 324 325 fdt_add_gic_node(vbi); 326 } 327 328 static void create_uart(const VirtBoardInfo *vbi, qemu_irq *pic) 329 { 330 char *nodename; 331 hwaddr base = vbi->memmap[VIRT_UART].base; 332 hwaddr size = vbi->memmap[VIRT_UART].size; 333 int irq = vbi->irqmap[VIRT_UART]; 334 const char compat[] = "arm,pl011\0arm,primecell"; 335 const char clocknames[] = "uartclk\0apb_pclk"; 336 337 sysbus_create_simple("pl011", base, pic[irq]); 338 339 nodename = g_strdup_printf("/pl011@%" PRIx64, base); 340 qemu_fdt_add_subnode(vbi->fdt, nodename); 341 /* Note that we can't use setprop_string because of the embedded NUL */ 342 qemu_fdt_setprop(vbi->fdt, nodename, "compatible", 343 compat, sizeof(compat)); 344 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 345 2, base, 2, size); 346 qemu_fdt_setprop_cells(vbi->fdt, nodename, "interrupts", 347 GIC_FDT_IRQ_TYPE_SPI, irq, 348 GIC_FDT_IRQ_FLAGS_EDGE_LO_HI); 349 qemu_fdt_setprop_cells(vbi->fdt, nodename, "clocks", 350 vbi->clock_phandle, vbi->clock_phandle); 351 qemu_fdt_setprop(vbi->fdt, nodename, "clock-names", 352 clocknames, sizeof(clocknames)); 353 g_free(nodename); 354 } 355 356 static void create_virtio_devices(const VirtBoardInfo *vbi, qemu_irq *pic) 357 { 358 int i; 359 hwaddr size = vbi->memmap[VIRT_MMIO].size; 360 361 /* Note that we have to create the transports in forwards order 362 * so that command line devices are inserted lowest address first, 363 * and then add dtb nodes in reverse order so that they appear in 364 * the finished device tree lowest address first. 365 */ 366 for (i = 0; i < NUM_VIRTIO_TRANSPORTS; i++) { 367 int irq = vbi->irqmap[VIRT_MMIO] + i; 368 hwaddr base = vbi->memmap[VIRT_MMIO].base + i * size; 369 370 sysbus_create_simple("virtio-mmio", base, pic[irq]); 371 } 372 373 for (i = NUM_VIRTIO_TRANSPORTS - 1; i >= 0; i--) { 374 char *nodename; 375 int irq = vbi->irqmap[VIRT_MMIO] + i; 376 hwaddr base = vbi->memmap[VIRT_MMIO].base + i * size; 377 378 nodename = g_strdup_printf("/virtio_mmio@%" PRIx64, base); 379 qemu_fdt_add_subnode(vbi->fdt, nodename); 380 qemu_fdt_setprop_string(vbi->fdt, nodename, 381 "compatible", "virtio,mmio"); 382 qemu_fdt_setprop_sized_cells(vbi->fdt, nodename, "reg", 383 2, base, 2, size); 384 qemu_fdt_setprop_cells(vbi->fdt, nodename, "interrupts", 385 GIC_FDT_IRQ_TYPE_SPI, irq, 386 GIC_FDT_IRQ_FLAGS_EDGE_LO_HI); 387 g_free(nodename); 388 } 389 } 390 391 static void *machvirt_dtb(const struct arm_boot_info *binfo, int *fdt_size) 392 { 393 const VirtBoardInfo *board = (const VirtBoardInfo *)binfo; 394 395 *fdt_size = board->fdt_size; 396 return board->fdt; 397 } 398 399 static void machvirt_init(MachineState *machine) 400 { 401 qemu_irq pic[NUM_IRQS]; 402 MemoryRegion *sysmem = get_system_memory(); 403 int n; 404 MemoryRegion *ram = g_new(MemoryRegion, 1); 405 const char *cpu_model = machine->cpu_model; 406 VirtBoardInfo *vbi; 407 408 if (!cpu_model) { 409 cpu_model = "cortex-a15"; 410 } 411 412 vbi = find_machine_info(cpu_model); 413 414 if (!vbi) { 415 error_report("mach-virt: CPU %s not supported", cpu_model); 416 exit(1); 417 } 418 419 vbi->smp_cpus = smp_cpus; 420 421 /* 422 * Only supported method of starting secondary CPUs is PSCI and 423 * PSCI is not yet supported with TCG, so limit smp_cpus to 1 424 * if we're not using KVM. 425 */ 426 if (!kvm_enabled() && smp_cpus > 1) { 427 error_report("mach-virt: must enable KVM to use multiple CPUs"); 428 exit(1); 429 } 430 431 if (machine->ram_size > vbi->memmap[VIRT_MEM].size) { 432 error_report("mach-virt: cannot model more than 30GB RAM"); 433 exit(1); 434 } 435 436 create_fdt(vbi); 437 fdt_add_timer_nodes(vbi); 438 439 for (n = 0; n < smp_cpus; n++) { 440 ObjectClass *oc = cpu_class_by_name(TYPE_ARM_CPU, cpu_model); 441 Object *cpuobj; 442 443 if (!oc) { 444 fprintf(stderr, "Unable to find CPU definition\n"); 445 exit(1); 446 } 447 cpuobj = object_new(object_class_get_name(oc)); 448 449 /* Secondary CPUs start in PSCI powered-down state */ 450 if (n > 0) { 451 object_property_set_bool(cpuobj, true, "start-powered-off", NULL); 452 } 453 454 if (object_property_find(cpuobj, "reset-cbar", NULL)) { 455 object_property_set_int(cpuobj, vbi->memmap[VIRT_CPUPERIPHS].base, 456 "reset-cbar", &error_abort); 457 } 458 459 object_property_set_bool(cpuobj, true, "realized", NULL); 460 } 461 fdt_add_cpu_nodes(vbi); 462 fdt_add_psci_node(vbi); 463 464 memory_region_init_ram(ram, NULL, "mach-virt.ram", machine->ram_size); 465 vmstate_register_ram_global(ram); 466 memory_region_add_subregion(sysmem, vbi->memmap[VIRT_MEM].base, ram); 467 468 create_gic(vbi, pic); 469 470 create_uart(vbi, pic); 471 472 /* Create mmio transports, so the user can create virtio backends 473 * (which will be automatically plugged in to the transports). If 474 * no backend is created the transport will just sit harmlessly idle. 475 */ 476 create_virtio_devices(vbi, pic); 477 478 vbi->bootinfo.ram_size = machine->ram_size; 479 vbi->bootinfo.kernel_filename = machine->kernel_filename; 480 vbi->bootinfo.kernel_cmdline = machine->kernel_cmdline; 481 vbi->bootinfo.initrd_filename = machine->initrd_filename; 482 vbi->bootinfo.nb_cpus = smp_cpus; 483 vbi->bootinfo.board_id = -1; 484 vbi->bootinfo.loader_start = vbi->memmap[VIRT_MEM].base; 485 vbi->bootinfo.get_dtb = machvirt_dtb; 486 arm_load_kernel(ARM_CPU(first_cpu), &vbi->bootinfo); 487 } 488 489 static QEMUMachine machvirt_a15_machine = { 490 .name = "virt", 491 .desc = "ARM Virtual Machine", 492 .init = machvirt_init, 493 .max_cpus = 4, 494 }; 495 496 static void machvirt_machine_init(void) 497 { 498 qemu_register_machine(&machvirt_a15_machine); 499 } 500 501 machine_init(machvirt_machine_init); 502