xref: /qemu/hw/arm/virt.c (revision 33848cee)
1 /*
2  * ARM mach-virt emulation
3  *
4  * Copyright (c) 2013 Linaro Limited
5  *
6  * This program is free software; you can redistribute it and/or modify it
7  * under the terms and conditions of the GNU General Public License,
8  * version 2 or later, as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope it will be useful, but WITHOUT
11  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
12  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
13  * more details.
14  *
15  * You should have received a copy of the GNU General Public License along with
16  * this program.  If not, see <http://www.gnu.org/licenses/>.
17  *
18  * Emulate a virtual board which works by passing Linux all the information
19  * it needs about what devices are present via the device tree.
20  * There are some restrictions about what we can do here:
21  *  + we can only present devices whose Linux drivers will work based
22  *    purely on the device tree with no platform data at all
23  *  + we want to present a very stripped-down minimalist platform,
24  *    both because this reduces the security attack surface from the guest
25  *    and also because it reduces our exposure to being broken when
26  *    the kernel updates its device tree bindings and requires further
27  *    information in a device binding that we aren't providing.
28  * This is essentially the same approach kvmtool uses.
29  */
30 
31 #include "qemu/osdep.h"
32 #include "qapi/error.h"
33 #include "hw/sysbus.h"
34 #include "hw/arm/arm.h"
35 #include "hw/arm/primecell.h"
36 #include "hw/arm/virt.h"
37 #include "hw/devices.h"
38 #include "net/net.h"
39 #include "sysemu/block-backend.h"
40 #include "sysemu/device_tree.h"
41 #include "sysemu/numa.h"
42 #include "sysemu/sysemu.h"
43 #include "sysemu/kvm.h"
44 #include "hw/compat.h"
45 #include "hw/loader.h"
46 #include "exec/address-spaces.h"
47 #include "qemu/bitops.h"
48 #include "qemu/error-report.h"
49 #include "hw/pci-host/gpex.h"
50 #include "hw/arm/sysbus-fdt.h"
51 #include "hw/platform-bus.h"
52 #include "hw/arm/fdt.h"
53 #include "hw/intc/arm_gic.h"
54 #include "hw/intc/arm_gicv3_common.h"
55 #include "kvm_arm.h"
56 #include "hw/smbios/smbios.h"
57 #include "qapi/visitor.h"
58 #include "standard-headers/linux/input.h"
59 
60 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
61     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
62                                                     void *data) \
63     { \
64         MachineClass *mc = MACHINE_CLASS(oc); \
65         virt_machine_##major##_##minor##_options(mc); \
66         mc->desc = "QEMU " # major "." # minor " ARM Virtual Machine"; \
67         if (latest) { \
68             mc->alias = "virt"; \
69         } \
70     } \
71     static const TypeInfo machvirt_##major##_##minor##_info = { \
72         .name = MACHINE_TYPE_NAME("virt-" # major "." # minor), \
73         .parent = TYPE_VIRT_MACHINE, \
74         .instance_init = virt_##major##_##minor##_instance_init, \
75         .class_init = virt_##major##_##minor##_class_init, \
76     }; \
77     static void machvirt_machine_##major##_##minor##_init(void) \
78     { \
79         type_register_static(&machvirt_##major##_##minor##_info); \
80     } \
81     type_init(machvirt_machine_##major##_##minor##_init);
82 
83 #define DEFINE_VIRT_MACHINE_AS_LATEST(major, minor) \
84     DEFINE_VIRT_MACHINE_LATEST(major, minor, true)
85 #define DEFINE_VIRT_MACHINE(major, minor) \
86     DEFINE_VIRT_MACHINE_LATEST(major, minor, false)
87 
88 
89 /* Number of external interrupt lines to configure the GIC with */
90 #define NUM_IRQS 256
91 
92 #define PLATFORM_BUS_NUM_IRQS 64
93 
94 static ARMPlatformBusSystemParams platform_bus_params;
95 
96 /* RAM limit in GB. Since VIRT_MEM starts at the 1GB mark, this means
97  * RAM can go up to the 256GB mark, leaving 256GB of the physical
98  * address space unallocated and free for future use between 256G and 512G.
99  * If we need to provide more RAM to VMs in the future then we need to:
100  *  * allocate a second bank of RAM starting at 2TB and working up
101  *  * fix the DT and ACPI table generation code in QEMU to correctly
102  *    report two split lumps of RAM to the guest
103  *  * fix KVM in the host kernel to allow guests with >40 bit address spaces
104  * (We don't want to fill all the way up to 512GB with RAM because
105  * we might want it for non-RAM purposes later. Conversely it seems
106  * reasonable to assume that anybody configuring a VM with a quarter
107  * of a terabyte of RAM will be doing it on a host with more than a
108  * terabyte of physical address space.)
109  */
110 #define RAMLIMIT_GB 255
111 #define RAMLIMIT_BYTES (RAMLIMIT_GB * 1024ULL * 1024 * 1024)
112 
113 /* Addresses and sizes of our components.
114  * 0..128MB is space for a flash device so we can run bootrom code such as UEFI.
115  * 128MB..256MB is used for miscellaneous device I/O.
116  * 256MB..1GB is reserved for possible future PCI support (ie where the
117  * PCI memory window will go if we add a PCI host controller).
118  * 1GB and up is RAM (which may happily spill over into the
119  * high memory region beyond 4GB).
120  * This represents a compromise between how much RAM can be given to
121  * a 32 bit VM and leaving space for expansion and in particular for PCI.
122  * Note that devices should generally be placed at multiples of 0x10000,
123  * to accommodate guests using 64K pages.
124  */
125 static const MemMapEntry a15memmap[] = {
126     /* Space up to 0x8000000 is reserved for a boot ROM */
127     [VIRT_FLASH] =              {          0, 0x08000000 },
128     [VIRT_CPUPERIPHS] =         { 0x08000000, 0x00020000 },
129     /* GIC distributor and CPU interfaces sit inside the CPU peripheral space */
130     [VIRT_GIC_DIST] =           { 0x08000000, 0x00010000 },
131     [VIRT_GIC_CPU] =            { 0x08010000, 0x00010000 },
132     [VIRT_GIC_V2M] =            { 0x08020000, 0x00001000 },
133     /* The space in between here is reserved for GICv3 CPU/vCPU/HYP */
134     [VIRT_GIC_ITS] =            { 0x08080000, 0x00020000 },
135     /* This redistributor space allows up to 2*64kB*123 CPUs */
136     [VIRT_GIC_REDIST] =         { 0x080A0000, 0x00F60000 },
137     [VIRT_UART] =               { 0x09000000, 0x00001000 },
138     [VIRT_RTC] =                { 0x09010000, 0x00001000 },
139     [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
140     [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
141     [VIRT_SECURE_UART] =        { 0x09040000, 0x00001000 },
142     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
143     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
144     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
145     [VIRT_SECURE_MEM] =         { 0x0e000000, 0x01000000 },
146     [VIRT_PCIE_MMIO] =          { 0x10000000, 0x2eff0000 },
147     [VIRT_PCIE_PIO] =           { 0x3eff0000, 0x00010000 },
148     [VIRT_PCIE_ECAM] =          { 0x3f000000, 0x01000000 },
149     [VIRT_MEM] =                { 0x40000000, RAMLIMIT_BYTES },
150     /* Second PCIe window, 512GB wide at the 512GB boundary */
151     [VIRT_PCIE_MMIO_HIGH] =   { 0x8000000000ULL, 0x8000000000ULL },
152 };
153 
154 static const int a15irqmap[] = {
155     [VIRT_UART] = 1,
156     [VIRT_RTC] = 2,
157     [VIRT_PCIE] = 3, /* ... to 6 */
158     [VIRT_GPIO] = 7,
159     [VIRT_SECURE_UART] = 8,
160     [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */
161     [VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */
162     [VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */
163 };
164 
165 static const char *valid_cpus[] = {
166     "cortex-a15",
167     "cortex-a53",
168     "cortex-a57",
169     "host",
170     NULL
171 };
172 
173 static bool cpuname_valid(const char *cpu)
174 {
175     int i;
176 
177     for (i = 0; i < ARRAY_SIZE(valid_cpus); i++) {
178         if (strcmp(cpu, valid_cpus[i]) == 0) {
179             return true;
180         }
181     }
182     return false;
183 }
184 
185 static void create_fdt(VirtMachineState *vms)
186 {
187     void *fdt = create_device_tree(&vms->fdt_size);
188 
189     if (!fdt) {
190         error_report("create_device_tree() failed");
191         exit(1);
192     }
193 
194     vms->fdt = fdt;
195 
196     /* Header */
197     qemu_fdt_setprop_string(fdt, "/", "compatible", "linux,dummy-virt");
198     qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2);
199     qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
200 
201     /*
202      * /chosen and /memory nodes must exist for load_dtb
203      * to fill in necessary properties later
204      */
205     qemu_fdt_add_subnode(fdt, "/chosen");
206     qemu_fdt_add_subnode(fdt, "/memory");
207     qemu_fdt_setprop_string(fdt, "/memory", "device_type", "memory");
208 
209     /* Clock node, for the benefit of the UART. The kernel device tree
210      * binding documentation claims the PL011 node clock properties are
211      * optional but in practice if you omit them the kernel refuses to
212      * probe for the device.
213      */
214     vms->clock_phandle = qemu_fdt_alloc_phandle(fdt);
215     qemu_fdt_add_subnode(fdt, "/apb-pclk");
216     qemu_fdt_setprop_string(fdt, "/apb-pclk", "compatible", "fixed-clock");
217     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "#clock-cells", 0x0);
218     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "clock-frequency", 24000000);
219     qemu_fdt_setprop_string(fdt, "/apb-pclk", "clock-output-names",
220                                 "clk24mhz");
221     qemu_fdt_setprop_cell(fdt, "/apb-pclk", "phandle", vms->clock_phandle);
222 
223 }
224 
225 static void fdt_add_psci_node(const VirtMachineState *vms)
226 {
227     uint32_t cpu_suspend_fn;
228     uint32_t cpu_off_fn;
229     uint32_t cpu_on_fn;
230     uint32_t migrate_fn;
231     void *fdt = vms->fdt;
232     ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(0));
233 
234     if (!vms->using_psci) {
235         return;
236     }
237 
238     qemu_fdt_add_subnode(fdt, "/psci");
239     if (armcpu->psci_version == 2) {
240         const char comp[] = "arm,psci-0.2\0arm,psci";
241         qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
242 
243         cpu_off_fn = QEMU_PSCI_0_2_FN_CPU_OFF;
244         if (arm_feature(&armcpu->env, ARM_FEATURE_AARCH64)) {
245             cpu_suspend_fn = QEMU_PSCI_0_2_FN64_CPU_SUSPEND;
246             cpu_on_fn = QEMU_PSCI_0_2_FN64_CPU_ON;
247             migrate_fn = QEMU_PSCI_0_2_FN64_MIGRATE;
248         } else {
249             cpu_suspend_fn = QEMU_PSCI_0_2_FN_CPU_SUSPEND;
250             cpu_on_fn = QEMU_PSCI_0_2_FN_CPU_ON;
251             migrate_fn = QEMU_PSCI_0_2_FN_MIGRATE;
252         }
253     } else {
254         qemu_fdt_setprop_string(fdt, "/psci", "compatible", "arm,psci");
255 
256         cpu_suspend_fn = QEMU_PSCI_0_1_FN_CPU_SUSPEND;
257         cpu_off_fn = QEMU_PSCI_0_1_FN_CPU_OFF;
258         cpu_on_fn = QEMU_PSCI_0_1_FN_CPU_ON;
259         migrate_fn = QEMU_PSCI_0_1_FN_MIGRATE;
260     }
261 
262     /* We adopt the PSCI spec's nomenclature, and use 'conduit' to refer
263      * to the instruction that should be used to invoke PSCI functions.
264      * However, the device tree binding uses 'method' instead, so that is
265      * what we should use here.
266      */
267     qemu_fdt_setprop_string(fdt, "/psci", "method", "hvc");
268 
269     qemu_fdt_setprop_cell(fdt, "/psci", "cpu_suspend", cpu_suspend_fn);
270     qemu_fdt_setprop_cell(fdt, "/psci", "cpu_off", cpu_off_fn);
271     qemu_fdt_setprop_cell(fdt, "/psci", "cpu_on", cpu_on_fn);
272     qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
273 }
274 
275 static void fdt_add_timer_nodes(const VirtMachineState *vms)
276 {
277     /* On real hardware these interrupts are level-triggered.
278      * On KVM they were edge-triggered before host kernel version 4.4,
279      * and level-triggered afterwards.
280      * On emulated QEMU they are level-triggered.
281      *
282      * Getting the DTB info about them wrong is awkward for some
283      * guest kernels:
284      *  pre-4.8 ignore the DT and leave the interrupt configured
285      *   with whatever the GIC reset value (or the bootloader) left it at
286      *  4.8 before rc6 honour the incorrect data by programming it back
287      *   into the GIC, causing problems
288      *  4.8rc6 and later ignore the DT and always write "level triggered"
289      *   into the GIC
290      *
291      * For backwards-compatibility, virt-2.8 and earlier will continue
292      * to say these are edge-triggered, but later machines will report
293      * the correct information.
294      */
295     ARMCPU *armcpu;
296     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
297     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
298 
299     if (vmc->claim_edge_triggered_timers) {
300         irqflags = GIC_FDT_IRQ_FLAGS_EDGE_LO_HI;
301     }
302 
303     if (vms->gic_version == 2) {
304         irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
305                              GIC_FDT_IRQ_PPI_CPU_WIDTH,
306                              (1 << vms->smp_cpus) - 1);
307     }
308 
309     qemu_fdt_add_subnode(vms->fdt, "/timer");
310 
311     armcpu = ARM_CPU(qemu_get_cpu(0));
312     if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) {
313         const char compat[] = "arm,armv8-timer\0arm,armv7-timer";
314         qemu_fdt_setprop(vms->fdt, "/timer", "compatible",
315                          compat, sizeof(compat));
316     } else {
317         qemu_fdt_setprop_string(vms->fdt, "/timer", "compatible",
318                                 "arm,armv7-timer");
319     }
320     qemu_fdt_setprop(vms->fdt, "/timer", "always-on", NULL, 0);
321     qemu_fdt_setprop_cells(vms->fdt, "/timer", "interrupts",
322                        GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_S_EL1_IRQ, irqflags,
323                        GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL1_IRQ, irqflags,
324                        GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_VIRT_IRQ, irqflags,
325                        GIC_FDT_IRQ_TYPE_PPI, ARCH_TIMER_NS_EL2_IRQ, irqflags);
326 }
327 
328 static void fdt_add_cpu_nodes(const VirtMachineState *vms)
329 {
330     int cpu;
331     int addr_cells = 1;
332     unsigned int i;
333 
334     /*
335      * From Documentation/devicetree/bindings/arm/cpus.txt
336      *  On ARM v8 64-bit systems value should be set to 2,
337      *  that corresponds to the MPIDR_EL1 register size.
338      *  If MPIDR_EL1[63:32] value is equal to 0 on all CPUs
339      *  in the system, #address-cells can be set to 1, since
340      *  MPIDR_EL1[63:32] bits are not used for CPUs
341      *  identification.
342      *
343      *  Here we actually don't know whether our system is 32- or 64-bit one.
344      *  The simplest way to go is to examine affinity IDs of all our CPUs. If
345      *  at least one of them has Aff3 populated, we set #address-cells to 2.
346      */
347     for (cpu = 0; cpu < vms->smp_cpus; cpu++) {
348         ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
349 
350         if (armcpu->mp_affinity & ARM_AFF3_MASK) {
351             addr_cells = 2;
352             break;
353         }
354     }
355 
356     qemu_fdt_add_subnode(vms->fdt, "/cpus");
357     qemu_fdt_setprop_cell(vms->fdt, "/cpus", "#address-cells", addr_cells);
358     qemu_fdt_setprop_cell(vms->fdt, "/cpus", "#size-cells", 0x0);
359 
360     for (cpu = vms->smp_cpus - 1; cpu >= 0; cpu--) {
361         char *nodename = g_strdup_printf("/cpus/cpu@%d", cpu);
362         ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(cpu));
363 
364         qemu_fdt_add_subnode(vms->fdt, nodename);
365         qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "cpu");
366         qemu_fdt_setprop_string(vms->fdt, nodename, "compatible",
367                                     armcpu->dtb_compatible);
368 
369         if (vms->using_psci && vms->smp_cpus > 1) {
370             qemu_fdt_setprop_string(vms->fdt, nodename,
371                                         "enable-method", "psci");
372         }
373 
374         if (addr_cells == 2) {
375             qemu_fdt_setprop_u64(vms->fdt, nodename, "reg",
376                                  armcpu->mp_affinity);
377         } else {
378             qemu_fdt_setprop_cell(vms->fdt, nodename, "reg",
379                                   armcpu->mp_affinity);
380         }
381 
382         i = numa_get_node_for_cpu(cpu);
383         if (i < nb_numa_nodes) {
384             qemu_fdt_setprop_cell(vms->fdt, nodename, "numa-node-id", i);
385         }
386 
387         g_free(nodename);
388     }
389 }
390 
391 static void fdt_add_its_gic_node(VirtMachineState *vms)
392 {
393     vms->msi_phandle = qemu_fdt_alloc_phandle(vms->fdt);
394     qemu_fdt_add_subnode(vms->fdt, "/intc/its");
395     qemu_fdt_setprop_string(vms->fdt, "/intc/its", "compatible",
396                             "arm,gic-v3-its");
397     qemu_fdt_setprop(vms->fdt, "/intc/its", "msi-controller", NULL, 0);
398     qemu_fdt_setprop_sized_cells(vms->fdt, "/intc/its", "reg",
399                                  2, vms->memmap[VIRT_GIC_ITS].base,
400                                  2, vms->memmap[VIRT_GIC_ITS].size);
401     qemu_fdt_setprop_cell(vms->fdt, "/intc/its", "phandle", vms->msi_phandle);
402 }
403 
404 static void fdt_add_v2m_gic_node(VirtMachineState *vms)
405 {
406     vms->msi_phandle = qemu_fdt_alloc_phandle(vms->fdt);
407     qemu_fdt_add_subnode(vms->fdt, "/intc/v2m");
408     qemu_fdt_setprop_string(vms->fdt, "/intc/v2m", "compatible",
409                             "arm,gic-v2m-frame");
410     qemu_fdt_setprop(vms->fdt, "/intc/v2m", "msi-controller", NULL, 0);
411     qemu_fdt_setprop_sized_cells(vms->fdt, "/intc/v2m", "reg",
412                                  2, vms->memmap[VIRT_GIC_V2M].base,
413                                  2, vms->memmap[VIRT_GIC_V2M].size);
414     qemu_fdt_setprop_cell(vms->fdt, "/intc/v2m", "phandle", vms->msi_phandle);
415 }
416 
417 static void fdt_add_gic_node(VirtMachineState *vms)
418 {
419     vms->gic_phandle = qemu_fdt_alloc_phandle(vms->fdt);
420     qemu_fdt_setprop_cell(vms->fdt, "/", "interrupt-parent", vms->gic_phandle);
421 
422     qemu_fdt_add_subnode(vms->fdt, "/intc");
423     qemu_fdt_setprop_cell(vms->fdt, "/intc", "#interrupt-cells", 3);
424     qemu_fdt_setprop(vms->fdt, "/intc", "interrupt-controller", NULL, 0);
425     qemu_fdt_setprop_cell(vms->fdt, "/intc", "#address-cells", 0x2);
426     qemu_fdt_setprop_cell(vms->fdt, "/intc", "#size-cells", 0x2);
427     qemu_fdt_setprop(vms->fdt, "/intc", "ranges", NULL, 0);
428     if (vms->gic_version == 3) {
429         qemu_fdt_setprop_string(vms->fdt, "/intc", "compatible",
430                                 "arm,gic-v3");
431         qemu_fdt_setprop_sized_cells(vms->fdt, "/intc", "reg",
432                                      2, vms->memmap[VIRT_GIC_DIST].base,
433                                      2, vms->memmap[VIRT_GIC_DIST].size,
434                                      2, vms->memmap[VIRT_GIC_REDIST].base,
435                                      2, vms->memmap[VIRT_GIC_REDIST].size);
436     } else {
437         /* 'cortex-a15-gic' means 'GIC v2' */
438         qemu_fdt_setprop_string(vms->fdt, "/intc", "compatible",
439                                 "arm,cortex-a15-gic");
440         qemu_fdt_setprop_sized_cells(vms->fdt, "/intc", "reg",
441                                       2, vms->memmap[VIRT_GIC_DIST].base,
442                                       2, vms->memmap[VIRT_GIC_DIST].size,
443                                       2, vms->memmap[VIRT_GIC_CPU].base,
444                                       2, vms->memmap[VIRT_GIC_CPU].size);
445     }
446 
447     qemu_fdt_setprop_cell(vms->fdt, "/intc", "phandle", vms->gic_phandle);
448 }
449 
450 static void fdt_add_pmu_nodes(const VirtMachineState *vms)
451 {
452     CPUState *cpu;
453     ARMCPU *armcpu;
454     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
455 
456     CPU_FOREACH(cpu) {
457         armcpu = ARM_CPU(cpu);
458         if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU) ||
459             !kvm_arm_pmu_create(cpu, PPI(VIRTUAL_PMU_IRQ))) {
460             return;
461         }
462     }
463 
464     if (vms->gic_version == 2) {
465         irqflags = deposit32(irqflags, GIC_FDT_IRQ_PPI_CPU_START,
466                              GIC_FDT_IRQ_PPI_CPU_WIDTH,
467                              (1 << vms->smp_cpus) - 1);
468     }
469 
470     armcpu = ARM_CPU(qemu_get_cpu(0));
471     qemu_fdt_add_subnode(vms->fdt, "/pmu");
472     if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) {
473         const char compat[] = "arm,armv8-pmuv3";
474         qemu_fdt_setprop(vms->fdt, "/pmu", "compatible",
475                          compat, sizeof(compat));
476         qemu_fdt_setprop_cells(vms->fdt, "/pmu", "interrupts",
477                                GIC_FDT_IRQ_TYPE_PPI, VIRTUAL_PMU_IRQ, irqflags);
478     }
479 }
480 
481 static void create_its(VirtMachineState *vms, DeviceState *gicdev)
482 {
483     const char *itsclass = its_class_name();
484     DeviceState *dev;
485 
486     if (!itsclass) {
487         /* Do nothing if not supported */
488         return;
489     }
490 
491     dev = qdev_create(NULL, itsclass);
492 
493     object_property_set_link(OBJECT(dev), OBJECT(gicdev), "parent-gicv3",
494                              &error_abort);
495     qdev_init_nofail(dev);
496     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_GIC_ITS].base);
497 
498     fdt_add_its_gic_node(vms);
499 }
500 
501 static void create_v2m(VirtMachineState *vms, qemu_irq *pic)
502 {
503     int i;
504     int irq = vms->irqmap[VIRT_GIC_V2M];
505     DeviceState *dev;
506 
507     dev = qdev_create(NULL, "arm-gicv2m");
508     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_GIC_V2M].base);
509     qdev_prop_set_uint32(dev, "base-spi", irq);
510     qdev_prop_set_uint32(dev, "num-spi", NUM_GICV2M_SPIS);
511     qdev_init_nofail(dev);
512 
513     for (i = 0; i < NUM_GICV2M_SPIS; i++) {
514         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
515     }
516 
517     fdt_add_v2m_gic_node(vms);
518 }
519 
520 static void create_gic(VirtMachineState *vms, qemu_irq *pic)
521 {
522     /* We create a standalone GIC */
523     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
524     DeviceState *gicdev;
525     SysBusDevice *gicbusdev;
526     const char *gictype;
527     int type = vms->gic_version, i;
528 
529     gictype = (type == 3) ? gicv3_class_name() : gic_class_name();
530 
531     gicdev = qdev_create(NULL, gictype);
532     qdev_prop_set_uint32(gicdev, "revision", type);
533     qdev_prop_set_uint32(gicdev, "num-cpu", smp_cpus);
534     /* Note that the num-irq property counts both internal and external
535      * interrupts; there are always 32 of the former (mandated by GIC spec).
536      */
537     qdev_prop_set_uint32(gicdev, "num-irq", NUM_IRQS + 32);
538     if (!kvm_irqchip_in_kernel()) {
539         qdev_prop_set_bit(gicdev, "has-security-extensions", vms->secure);
540     }
541     qdev_init_nofail(gicdev);
542     gicbusdev = SYS_BUS_DEVICE(gicdev);
543     sysbus_mmio_map(gicbusdev, 0, vms->memmap[VIRT_GIC_DIST].base);
544     if (type == 3) {
545         sysbus_mmio_map(gicbusdev, 1, vms->memmap[VIRT_GIC_REDIST].base);
546     } else {
547         sysbus_mmio_map(gicbusdev, 1, vms->memmap[VIRT_GIC_CPU].base);
548     }
549 
550     /* Wire the outputs from each CPU's generic timer to the
551      * appropriate GIC PPI inputs, and the GIC's IRQ output to
552      * the CPU's IRQ input.
553      */
554     for (i = 0; i < smp_cpus; i++) {
555         DeviceState *cpudev = DEVICE(qemu_get_cpu(i));
556         int ppibase = NUM_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
557         int irq;
558         /* Mapping from the output timer irq lines from the CPU to the
559          * GIC PPI inputs we use for the virt board.
560          */
561         const int timer_irq[] = {
562             [GTIMER_PHYS] = ARCH_TIMER_NS_EL1_IRQ,
563             [GTIMER_VIRT] = ARCH_TIMER_VIRT_IRQ,
564             [GTIMER_HYP]  = ARCH_TIMER_NS_EL2_IRQ,
565             [GTIMER_SEC]  = ARCH_TIMER_S_EL1_IRQ,
566         };
567 
568         for (irq = 0; irq < ARRAY_SIZE(timer_irq); irq++) {
569             qdev_connect_gpio_out(cpudev, irq,
570                                   qdev_get_gpio_in(gicdev,
571                                                    ppibase + timer_irq[irq]));
572         }
573 
574         sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
575         sysbus_connect_irq(gicbusdev, i + smp_cpus,
576                            qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
577     }
578 
579     for (i = 0; i < NUM_IRQS; i++) {
580         pic[i] = qdev_get_gpio_in(gicdev, i);
581     }
582 
583     fdt_add_gic_node(vms);
584 
585     if (type == 3 && !vmc->no_its) {
586         create_its(vms, gicdev);
587     } else if (type == 2) {
588         create_v2m(vms, pic);
589     }
590 }
591 
592 static void create_uart(const VirtMachineState *vms, qemu_irq *pic, int uart,
593                         MemoryRegion *mem, CharDriverState *chr)
594 {
595     char *nodename;
596     hwaddr base = vms->memmap[uart].base;
597     hwaddr size = vms->memmap[uart].size;
598     int irq = vms->irqmap[uart];
599     const char compat[] = "arm,pl011\0arm,primecell";
600     const char clocknames[] = "uartclk\0apb_pclk";
601     DeviceState *dev = qdev_create(NULL, "pl011");
602     SysBusDevice *s = SYS_BUS_DEVICE(dev);
603 
604     qdev_prop_set_chr(dev, "chardev", chr);
605     qdev_init_nofail(dev);
606     memory_region_add_subregion(mem, base,
607                                 sysbus_mmio_get_region(s, 0));
608     sysbus_connect_irq(s, 0, pic[irq]);
609 
610     nodename = g_strdup_printf("/pl011@%" PRIx64, base);
611     qemu_fdt_add_subnode(vms->fdt, nodename);
612     /* Note that we can't use setprop_string because of the embedded NUL */
613     qemu_fdt_setprop(vms->fdt, nodename, "compatible",
614                          compat, sizeof(compat));
615     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
616                                      2, base, 2, size);
617     qemu_fdt_setprop_cells(vms->fdt, nodename, "interrupts",
618                                GIC_FDT_IRQ_TYPE_SPI, irq,
619                                GIC_FDT_IRQ_FLAGS_LEVEL_HI);
620     qemu_fdt_setprop_cells(vms->fdt, nodename, "clocks",
621                                vms->clock_phandle, vms->clock_phandle);
622     qemu_fdt_setprop(vms->fdt, nodename, "clock-names",
623                          clocknames, sizeof(clocknames));
624 
625     if (uart == VIRT_UART) {
626         qemu_fdt_setprop_string(vms->fdt, "/chosen", "stdout-path", nodename);
627     } else {
628         /* Mark as not usable by the normal world */
629         qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
630         qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
631     }
632 
633     g_free(nodename);
634 }
635 
636 static void create_rtc(const VirtMachineState *vms, qemu_irq *pic)
637 {
638     char *nodename;
639     hwaddr base = vms->memmap[VIRT_RTC].base;
640     hwaddr size = vms->memmap[VIRT_RTC].size;
641     int irq = vms->irqmap[VIRT_RTC];
642     const char compat[] = "arm,pl031\0arm,primecell";
643 
644     sysbus_create_simple("pl031", base, pic[irq]);
645 
646     nodename = g_strdup_printf("/pl031@%" PRIx64, base);
647     qemu_fdt_add_subnode(vms->fdt, nodename);
648     qemu_fdt_setprop(vms->fdt, nodename, "compatible", compat, sizeof(compat));
649     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
650                                  2, base, 2, size);
651     qemu_fdt_setprop_cells(vms->fdt, nodename, "interrupts",
652                            GIC_FDT_IRQ_TYPE_SPI, irq,
653                            GIC_FDT_IRQ_FLAGS_LEVEL_HI);
654     qemu_fdt_setprop_cell(vms->fdt, nodename, "clocks", vms->clock_phandle);
655     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
656     g_free(nodename);
657 }
658 
659 static DeviceState *gpio_key_dev;
660 static void virt_powerdown_req(Notifier *n, void *opaque)
661 {
662     /* use gpio Pin 3 for power button event */
663     qemu_set_irq(qdev_get_gpio_in(gpio_key_dev, 0), 1);
664 }
665 
666 static Notifier virt_system_powerdown_notifier = {
667     .notify = virt_powerdown_req
668 };
669 
670 static void create_gpio(const VirtMachineState *vms, qemu_irq *pic)
671 {
672     char *nodename;
673     DeviceState *pl061_dev;
674     hwaddr base = vms->memmap[VIRT_GPIO].base;
675     hwaddr size = vms->memmap[VIRT_GPIO].size;
676     int irq = vms->irqmap[VIRT_GPIO];
677     const char compat[] = "arm,pl061\0arm,primecell";
678 
679     pl061_dev = sysbus_create_simple("pl061", base, pic[irq]);
680 
681     uint32_t phandle = qemu_fdt_alloc_phandle(vms->fdt);
682     nodename = g_strdup_printf("/pl061@%" PRIx64, base);
683     qemu_fdt_add_subnode(vms->fdt, nodename);
684     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
685                                  2, base, 2, size);
686     qemu_fdt_setprop(vms->fdt, nodename, "compatible", compat, sizeof(compat));
687     qemu_fdt_setprop_cell(vms->fdt, nodename, "#gpio-cells", 2);
688     qemu_fdt_setprop(vms->fdt, nodename, "gpio-controller", NULL, 0);
689     qemu_fdt_setprop_cells(vms->fdt, nodename, "interrupts",
690                            GIC_FDT_IRQ_TYPE_SPI, irq,
691                            GIC_FDT_IRQ_FLAGS_LEVEL_HI);
692     qemu_fdt_setprop_cell(vms->fdt, nodename, "clocks", vms->clock_phandle);
693     qemu_fdt_setprop_string(vms->fdt, nodename, "clock-names", "apb_pclk");
694     qemu_fdt_setprop_cell(vms->fdt, nodename, "phandle", phandle);
695 
696     gpio_key_dev = sysbus_create_simple("gpio-key", -1,
697                                         qdev_get_gpio_in(pl061_dev, 3));
698     qemu_fdt_add_subnode(vms->fdt, "/gpio-keys");
699     qemu_fdt_setprop_string(vms->fdt, "/gpio-keys", "compatible", "gpio-keys");
700     qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#size-cells", 0);
701     qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys", "#address-cells", 1);
702 
703     qemu_fdt_add_subnode(vms->fdt, "/gpio-keys/poweroff");
704     qemu_fdt_setprop_string(vms->fdt, "/gpio-keys/poweroff",
705                             "label", "GPIO Key Poweroff");
706     qemu_fdt_setprop_cell(vms->fdt, "/gpio-keys/poweroff", "linux,code",
707                           KEY_POWER);
708     qemu_fdt_setprop_cells(vms->fdt, "/gpio-keys/poweroff",
709                            "gpios", phandle, 3, 0);
710 
711     /* connect powerdown request */
712     qemu_register_powerdown_notifier(&virt_system_powerdown_notifier);
713 
714     g_free(nodename);
715 }
716 
717 static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
718 {
719     int i;
720     hwaddr size = vms->memmap[VIRT_MMIO].size;
721 
722     /* We create the transports in forwards order. Since qbus_realize()
723      * prepends (not appends) new child buses, the incrementing loop below will
724      * create a list of virtio-mmio buses with decreasing base addresses.
725      *
726      * When a -device option is processed from the command line,
727      * qbus_find_recursive() picks the next free virtio-mmio bus in forwards
728      * order. The upshot is that -device options in increasing command line
729      * order are mapped to virtio-mmio buses with decreasing base addresses.
730      *
731      * When this code was originally written, that arrangement ensured that the
732      * guest Linux kernel would give the lowest "name" (/dev/vda, eth0, etc) to
733      * the first -device on the command line. (The end-to-end order is a
734      * function of this loop, qbus_realize(), qbus_find_recursive(), and the
735      * guest kernel's name-to-address assignment strategy.)
736      *
737      * Meanwhile, the kernel's traversal seems to have been reversed; see eg.
738      * the message, if not necessarily the code, of commit 70161ff336.
739      * Therefore the loop now establishes the inverse of the original intent.
740      *
741      * Unfortunately, we can't counteract the kernel change by reversing the
742      * loop; it would break existing command lines.
743      *
744      * In any case, the kernel makes no guarantee about the stability of
745      * enumeration order of virtio devices (as demonstrated by it changing
746      * between kernel versions). For reliable and stable identification
747      * of disks users must use UUIDs or similar mechanisms.
748      */
749     for (i = 0; i < NUM_VIRTIO_TRANSPORTS; i++) {
750         int irq = vms->irqmap[VIRT_MMIO] + i;
751         hwaddr base = vms->memmap[VIRT_MMIO].base + i * size;
752 
753         sysbus_create_simple("virtio-mmio", base, pic[irq]);
754     }
755 
756     /* We add dtb nodes in reverse order so that they appear in the finished
757      * device tree lowest address first.
758      *
759      * Note that this mapping is independent of the loop above. The previous
760      * loop influences virtio device to virtio transport assignment, whereas
761      * this loop controls how virtio transports are laid out in the dtb.
762      */
763     for (i = NUM_VIRTIO_TRANSPORTS - 1; i >= 0; i--) {
764         char *nodename;
765         int irq = vms->irqmap[VIRT_MMIO] + i;
766         hwaddr base = vms->memmap[VIRT_MMIO].base + i * size;
767 
768         nodename = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
769         qemu_fdt_add_subnode(vms->fdt, nodename);
770         qemu_fdt_setprop_string(vms->fdt, nodename,
771                                 "compatible", "virtio,mmio");
772         qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
773                                      2, base, 2, size);
774         qemu_fdt_setprop_cells(vms->fdt, nodename, "interrupts",
775                                GIC_FDT_IRQ_TYPE_SPI, irq,
776                                GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
777         g_free(nodename);
778     }
779 }
780 
781 static void create_one_flash(const char *name, hwaddr flashbase,
782                              hwaddr flashsize, const char *file,
783                              MemoryRegion *sysmem)
784 {
785     /* Create and map a single flash device. We use the same
786      * parameters as the flash devices on the Versatile Express board.
787      */
788     DriveInfo *dinfo = drive_get_next(IF_PFLASH);
789     DeviceState *dev = qdev_create(NULL, "cfi.pflash01");
790     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
791     const uint64_t sectorlength = 256 * 1024;
792 
793     if (dinfo) {
794         qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo),
795                             &error_abort);
796     }
797 
798     qdev_prop_set_uint32(dev, "num-blocks", flashsize / sectorlength);
799     qdev_prop_set_uint64(dev, "sector-length", sectorlength);
800     qdev_prop_set_uint8(dev, "width", 4);
801     qdev_prop_set_uint8(dev, "device-width", 2);
802     qdev_prop_set_bit(dev, "big-endian", false);
803     qdev_prop_set_uint16(dev, "id0", 0x89);
804     qdev_prop_set_uint16(dev, "id1", 0x18);
805     qdev_prop_set_uint16(dev, "id2", 0x00);
806     qdev_prop_set_uint16(dev, "id3", 0x00);
807     qdev_prop_set_string(dev, "name", name);
808     qdev_init_nofail(dev);
809 
810     memory_region_add_subregion(sysmem, flashbase,
811                                 sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
812 
813     if (file) {
814         char *fn;
815         int image_size;
816 
817         if (drive_get(IF_PFLASH, 0, 0)) {
818             error_report("The contents of the first flash device may be "
819                          "specified with -bios or with -drive if=pflash... "
820                          "but you cannot use both options at once");
821             exit(1);
822         }
823         fn = qemu_find_file(QEMU_FILE_TYPE_BIOS, file);
824         if (!fn) {
825             error_report("Could not find ROM image '%s'", file);
826             exit(1);
827         }
828         image_size = load_image_mr(fn, sysbus_mmio_get_region(sbd, 0));
829         g_free(fn);
830         if (image_size < 0) {
831             error_report("Could not load ROM image '%s'", file);
832             exit(1);
833         }
834     }
835 }
836 
837 static void create_flash(const VirtMachineState *vms,
838                          MemoryRegion *sysmem,
839                          MemoryRegion *secure_sysmem)
840 {
841     /* Create two flash devices to fill the VIRT_FLASH space in the memmap.
842      * Any file passed via -bios goes in the first of these.
843      * sysmem is the system memory space. secure_sysmem is the secure view
844      * of the system, and the first flash device should be made visible only
845      * there. The second flash device is visible to both secure and nonsecure.
846      * If sysmem == secure_sysmem this means there is no separate Secure
847      * address space and both flash devices are generally visible.
848      */
849     hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
850     hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
851     char *nodename;
852 
853     create_one_flash("virt.flash0", flashbase, flashsize,
854                      bios_name, secure_sysmem);
855     create_one_flash("virt.flash1", flashbase + flashsize, flashsize,
856                      NULL, sysmem);
857 
858     if (sysmem == secure_sysmem) {
859         /* Report both flash devices as a single node in the DT */
860         nodename = g_strdup_printf("/flash@%" PRIx64, flashbase);
861         qemu_fdt_add_subnode(vms->fdt, nodename);
862         qemu_fdt_setprop_string(vms->fdt, nodename, "compatible", "cfi-flash");
863         qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
864                                      2, flashbase, 2, flashsize,
865                                      2, flashbase + flashsize, 2, flashsize);
866         qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
867         g_free(nodename);
868     } else {
869         /* Report the devices as separate nodes so we can mark one as
870          * only visible to the secure world.
871          */
872         nodename = g_strdup_printf("/secflash@%" PRIx64, flashbase);
873         qemu_fdt_add_subnode(vms->fdt, nodename);
874         qemu_fdt_setprop_string(vms->fdt, nodename, "compatible", "cfi-flash");
875         qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
876                                      2, flashbase, 2, flashsize);
877         qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
878         qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
879         qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
880         g_free(nodename);
881 
882         nodename = g_strdup_printf("/flash@%" PRIx64, flashbase);
883         qemu_fdt_add_subnode(vms->fdt, nodename);
884         qemu_fdt_setprop_string(vms->fdt, nodename, "compatible", "cfi-flash");
885         qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
886                                      2, flashbase + flashsize, 2, flashsize);
887         qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
888         g_free(nodename);
889     }
890 }
891 
892 static FWCfgState *create_fw_cfg(const VirtMachineState *vms, AddressSpace *as)
893 {
894     hwaddr base = vms->memmap[VIRT_FW_CFG].base;
895     hwaddr size = vms->memmap[VIRT_FW_CFG].size;
896     FWCfgState *fw_cfg;
897     char *nodename;
898 
899     fw_cfg = fw_cfg_init_mem_wide(base + 8, base, 8, base + 16, as);
900     fw_cfg_add_i16(fw_cfg, FW_CFG_NB_CPUS, (uint16_t)smp_cpus);
901 
902     nodename = g_strdup_printf("/fw-cfg@%" PRIx64, base);
903     qemu_fdt_add_subnode(vms->fdt, nodename);
904     qemu_fdt_setprop_string(vms->fdt, nodename,
905                             "compatible", "qemu,fw-cfg-mmio");
906     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
907                                  2, base, 2, size);
908     g_free(nodename);
909     return fw_cfg;
910 }
911 
912 static void create_pcie_irq_map(const VirtMachineState *vms,
913                                 uint32_t gic_phandle,
914                                 int first_irq, const char *nodename)
915 {
916     int devfn, pin;
917     uint32_t full_irq_map[4 * 4 * 10] = { 0 };
918     uint32_t *irq_map = full_irq_map;
919 
920     for (devfn = 0; devfn <= 0x18; devfn += 0x8) {
921         for (pin = 0; pin < 4; pin++) {
922             int irq_type = GIC_FDT_IRQ_TYPE_SPI;
923             int irq_nr = first_irq + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
924             int irq_level = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
925             int i;
926 
927             uint32_t map[] = {
928                 devfn << 8, 0, 0,                           /* devfn */
929                 pin + 1,                                    /* PCI pin */
930                 gic_phandle, 0, 0, irq_type, irq_nr, irq_level }; /* GIC irq */
931 
932             /* Convert map to big endian */
933             for (i = 0; i < 10; i++) {
934                 irq_map[i] = cpu_to_be32(map[i]);
935             }
936             irq_map += 10;
937         }
938     }
939 
940     qemu_fdt_setprop(vms->fdt, nodename, "interrupt-map",
941                      full_irq_map, sizeof(full_irq_map));
942 
943     qemu_fdt_setprop_cells(vms->fdt, nodename, "interrupt-map-mask",
944                            0x1800, 0, 0, /* devfn (PCI_SLOT(3)) */
945                            0x7           /* PCI irq */);
946 }
947 
948 static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
949 {
950     hwaddr base_mmio = vms->memmap[VIRT_PCIE_MMIO].base;
951     hwaddr size_mmio = vms->memmap[VIRT_PCIE_MMIO].size;
952     hwaddr base_mmio_high = vms->memmap[VIRT_PCIE_MMIO_HIGH].base;
953     hwaddr size_mmio_high = vms->memmap[VIRT_PCIE_MMIO_HIGH].size;
954     hwaddr base_pio = vms->memmap[VIRT_PCIE_PIO].base;
955     hwaddr size_pio = vms->memmap[VIRT_PCIE_PIO].size;
956     hwaddr base_ecam = vms->memmap[VIRT_PCIE_ECAM].base;
957     hwaddr size_ecam = vms->memmap[VIRT_PCIE_ECAM].size;
958     hwaddr base = base_mmio;
959     int nr_pcie_buses = size_ecam / PCIE_MMCFG_SIZE_MIN;
960     int irq = vms->irqmap[VIRT_PCIE];
961     MemoryRegion *mmio_alias;
962     MemoryRegion *mmio_reg;
963     MemoryRegion *ecam_alias;
964     MemoryRegion *ecam_reg;
965     DeviceState *dev;
966     char *nodename;
967     int i;
968     PCIHostState *pci;
969 
970     dev = qdev_create(NULL, TYPE_GPEX_HOST);
971     qdev_init_nofail(dev);
972 
973     /* Map only the first size_ecam bytes of ECAM space */
974     ecam_alias = g_new0(MemoryRegion, 1);
975     ecam_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
976     memory_region_init_alias(ecam_alias, OBJECT(dev), "pcie-ecam",
977                              ecam_reg, 0, size_ecam);
978     memory_region_add_subregion(get_system_memory(), base_ecam, ecam_alias);
979 
980     /* Map the MMIO window into system address space so as to expose
981      * the section of PCI MMIO space which starts at the same base address
982      * (ie 1:1 mapping for that part of PCI MMIO space visible through
983      * the window).
984      */
985     mmio_alias = g_new0(MemoryRegion, 1);
986     mmio_reg = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 1);
987     memory_region_init_alias(mmio_alias, OBJECT(dev), "pcie-mmio",
988                              mmio_reg, base_mmio, size_mmio);
989     memory_region_add_subregion(get_system_memory(), base_mmio, mmio_alias);
990 
991     if (vms->highmem) {
992         /* Map high MMIO space */
993         MemoryRegion *high_mmio_alias = g_new0(MemoryRegion, 1);
994 
995         memory_region_init_alias(high_mmio_alias, OBJECT(dev), "pcie-mmio-high",
996                                  mmio_reg, base_mmio_high, size_mmio_high);
997         memory_region_add_subregion(get_system_memory(), base_mmio_high,
998                                     high_mmio_alias);
999     }
1000 
1001     /* Map IO port space */
1002     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 2, base_pio);
1003 
1004     for (i = 0; i < GPEX_NUM_IRQS; i++) {
1005         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
1006     }
1007 
1008     pci = PCI_HOST_BRIDGE(dev);
1009     if (pci->bus) {
1010         for (i = 0; i < nb_nics; i++) {
1011             NICInfo *nd = &nd_table[i];
1012 
1013             if (!nd->model) {
1014                 nd->model = g_strdup("virtio");
1015             }
1016 
1017             pci_nic_init_nofail(nd, pci->bus, nd->model, NULL);
1018         }
1019     }
1020 
1021     nodename = g_strdup_printf("/pcie@%" PRIx64, base);
1022     qemu_fdt_add_subnode(vms->fdt, nodename);
1023     qemu_fdt_setprop_string(vms->fdt, nodename,
1024                             "compatible", "pci-host-ecam-generic");
1025     qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "pci");
1026     qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 3);
1027     qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 2);
1028     qemu_fdt_setprop_cells(vms->fdt, nodename, "bus-range", 0,
1029                            nr_pcie_buses - 1);
1030     qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
1031 
1032     if (vms->msi_phandle) {
1033         qemu_fdt_setprop_cells(vms->fdt, nodename, "msi-parent",
1034                                vms->msi_phandle);
1035     }
1036 
1037     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg",
1038                                  2, base_ecam, 2, size_ecam);
1039 
1040     if (vms->highmem) {
1041         qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "ranges",
1042                                      1, FDT_PCI_RANGE_IOPORT, 2, 0,
1043                                      2, base_pio, 2, size_pio,
1044                                      1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
1045                                      2, base_mmio, 2, size_mmio,
1046                                      1, FDT_PCI_RANGE_MMIO_64BIT,
1047                                      2, base_mmio_high,
1048                                      2, base_mmio_high, 2, size_mmio_high);
1049     } else {
1050         qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "ranges",
1051                                      1, FDT_PCI_RANGE_IOPORT, 2, 0,
1052                                      2, base_pio, 2, size_pio,
1053                                      1, FDT_PCI_RANGE_MMIO, 2, base_mmio,
1054                                      2, base_mmio, 2, size_mmio);
1055     }
1056 
1057     qemu_fdt_setprop_cell(vms->fdt, nodename, "#interrupt-cells", 1);
1058     create_pcie_irq_map(vms, vms->gic_phandle, irq, nodename);
1059 
1060     g_free(nodename);
1061 }
1062 
1063 static void create_platform_bus(VirtMachineState *vms, qemu_irq *pic)
1064 {
1065     DeviceState *dev;
1066     SysBusDevice *s;
1067     int i;
1068     ARMPlatformBusFDTParams *fdt_params = g_new(ARMPlatformBusFDTParams, 1);
1069     MemoryRegion *sysmem = get_system_memory();
1070 
1071     platform_bus_params.platform_bus_base = vms->memmap[VIRT_PLATFORM_BUS].base;
1072     platform_bus_params.platform_bus_size = vms->memmap[VIRT_PLATFORM_BUS].size;
1073     platform_bus_params.platform_bus_first_irq = vms->irqmap[VIRT_PLATFORM_BUS];
1074     platform_bus_params.platform_bus_num_irqs = PLATFORM_BUS_NUM_IRQS;
1075 
1076     fdt_params->system_params = &platform_bus_params;
1077     fdt_params->binfo = &vms->bootinfo;
1078     fdt_params->intc = "/intc";
1079     /*
1080      * register a machine init done notifier that creates the device tree
1081      * nodes of the platform bus and its children dynamic sysbus devices
1082      */
1083     arm_register_platform_bus_fdt_creator(fdt_params);
1084 
1085     dev = qdev_create(NULL, TYPE_PLATFORM_BUS_DEVICE);
1086     dev->id = TYPE_PLATFORM_BUS_DEVICE;
1087     qdev_prop_set_uint32(dev, "num_irqs",
1088         platform_bus_params.platform_bus_num_irqs);
1089     qdev_prop_set_uint32(dev, "mmio_size",
1090         platform_bus_params.platform_bus_size);
1091     qdev_init_nofail(dev);
1092     s = SYS_BUS_DEVICE(dev);
1093 
1094     for (i = 0; i < platform_bus_params.platform_bus_num_irqs; i++) {
1095         int irqn = platform_bus_params.platform_bus_first_irq + i;
1096         sysbus_connect_irq(s, i, pic[irqn]);
1097     }
1098 
1099     memory_region_add_subregion(sysmem,
1100                                 platform_bus_params.platform_bus_base,
1101                                 sysbus_mmio_get_region(s, 0));
1102 }
1103 
1104 static void create_secure_ram(VirtMachineState *vms,
1105                               MemoryRegion *secure_sysmem)
1106 {
1107     MemoryRegion *secram = g_new(MemoryRegion, 1);
1108     char *nodename;
1109     hwaddr base = vms->memmap[VIRT_SECURE_MEM].base;
1110     hwaddr size = vms->memmap[VIRT_SECURE_MEM].size;
1111 
1112     memory_region_init_ram(secram, NULL, "virt.secure-ram", size, &error_fatal);
1113     vmstate_register_ram_global(secram);
1114     memory_region_add_subregion(secure_sysmem, base, secram);
1115 
1116     nodename = g_strdup_printf("/secram@%" PRIx64, base);
1117     qemu_fdt_add_subnode(vms->fdt, nodename);
1118     qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "memory");
1119     qemu_fdt_setprop_sized_cells(vms->fdt, nodename, "reg", 2, base, 2, size);
1120     qemu_fdt_setprop_string(vms->fdt, nodename, "status", "disabled");
1121     qemu_fdt_setprop_string(vms->fdt, nodename, "secure-status", "okay");
1122 
1123     g_free(nodename);
1124 }
1125 
1126 static void *machvirt_dtb(const struct arm_boot_info *binfo, int *fdt_size)
1127 {
1128     const VirtMachineState *board = container_of(binfo, VirtMachineState,
1129                                                  bootinfo);
1130 
1131     *fdt_size = board->fdt_size;
1132     return board->fdt;
1133 }
1134 
1135 static void virt_build_smbios(VirtMachineState *vms)
1136 {
1137     uint8_t *smbios_tables, *smbios_anchor;
1138     size_t smbios_tables_len, smbios_anchor_len;
1139     const char *product = "QEMU Virtual Machine";
1140 
1141     if (!vms->fw_cfg) {
1142         return;
1143     }
1144 
1145     if (kvm_enabled()) {
1146         product = "KVM Virtual Machine";
1147     }
1148 
1149     smbios_set_defaults("QEMU", product,
1150                         "1.0", false, true, SMBIOS_ENTRY_POINT_30);
1151 
1152     smbios_get_tables(NULL, 0, &smbios_tables, &smbios_tables_len,
1153                       &smbios_anchor, &smbios_anchor_len);
1154 
1155     if (smbios_anchor) {
1156         fw_cfg_add_file(vms->fw_cfg, "etc/smbios/smbios-tables",
1157                         smbios_tables, smbios_tables_len);
1158         fw_cfg_add_file(vms->fw_cfg, "etc/smbios/smbios-anchor",
1159                         smbios_anchor, smbios_anchor_len);
1160     }
1161 }
1162 
1163 static
1164 void virt_machine_done(Notifier *notifier, void *data)
1165 {
1166     VirtMachineState *vms = container_of(notifier, VirtMachineState,
1167                                          machine_done);
1168 
1169     virt_acpi_setup(vms);
1170     virt_build_smbios(vms);
1171 }
1172 
1173 static void machvirt_init(MachineState *machine)
1174 {
1175     VirtMachineState *vms = VIRT_MACHINE(machine);
1176     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(machine);
1177     qemu_irq pic[NUM_IRQS];
1178     MemoryRegion *sysmem = get_system_memory();
1179     MemoryRegion *secure_sysmem = NULL;
1180     int n, virt_max_cpus;
1181     MemoryRegion *ram = g_new(MemoryRegion, 1);
1182     const char *cpu_model = machine->cpu_model;
1183     char **cpustr;
1184     ObjectClass *oc;
1185     const char *typename;
1186     CPUClass *cc;
1187     Error *err = NULL;
1188     bool firmware_loaded = bios_name || drive_get(IF_PFLASH, 0, 0);
1189     uint8_t clustersz;
1190 
1191     if (!cpu_model) {
1192         cpu_model = "cortex-a15";
1193     }
1194 
1195     /* We can probe only here because during property set
1196      * KVM is not available yet
1197      */
1198     if (!vms->gic_version) {
1199         if (!kvm_enabled()) {
1200             error_report("gic-version=host requires KVM");
1201             exit(1);
1202         }
1203 
1204         vms->gic_version = kvm_arm_vgic_probe();
1205         if (!vms->gic_version) {
1206             error_report("Unable to determine GIC version supported by host");
1207             exit(1);
1208         }
1209     }
1210 
1211     /* Separate the actual CPU model name from any appended features */
1212     cpustr = g_strsplit(cpu_model, ",", 2);
1213 
1214     if (!cpuname_valid(cpustr[0])) {
1215         error_report("mach-virt: CPU %s not supported", cpustr[0]);
1216         exit(1);
1217     }
1218 
1219     /* If we have an EL3 boot ROM then the assumption is that it will
1220      * implement PSCI itself, so disable QEMU's internal implementation
1221      * so it doesn't get in the way. Instead of starting secondary
1222      * CPUs in PSCI powerdown state we will start them all running and
1223      * let the boot ROM sort them out.
1224      * The usual case is that we do use QEMU's PSCI implementation.
1225      */
1226     vms->using_psci = !(vms->secure && firmware_loaded);
1227 
1228     /* The maximum number of CPUs depends on the GIC version, or on how
1229      * many redistributors we can fit into the memory map.
1230      */
1231     if (vms->gic_version == 3) {
1232         virt_max_cpus = vms->memmap[VIRT_GIC_REDIST].size / 0x20000;
1233         clustersz = GICV3_TARGETLIST_BITS;
1234     } else {
1235         virt_max_cpus = GIC_NCPU;
1236         clustersz = GIC_TARGETLIST_BITS;
1237     }
1238 
1239     if (max_cpus > virt_max_cpus) {
1240         error_report("Number of SMP CPUs requested (%d) exceeds max CPUs "
1241                      "supported by machine 'mach-virt' (%d)",
1242                      max_cpus, virt_max_cpus);
1243         exit(1);
1244     }
1245 
1246     vms->smp_cpus = smp_cpus;
1247 
1248     if (machine->ram_size > vms->memmap[VIRT_MEM].size) {
1249         error_report("mach-virt: cannot model more than %dGB RAM", RAMLIMIT_GB);
1250         exit(1);
1251     }
1252 
1253     if (vms->secure) {
1254         if (kvm_enabled()) {
1255             error_report("mach-virt: KVM does not support Security extensions");
1256             exit(1);
1257         }
1258 
1259         /* The Secure view of the world is the same as the NonSecure,
1260          * but with a few extra devices. Create it as a container region
1261          * containing the system memory at low priority; any secure-only
1262          * devices go in at higher priority and take precedence.
1263          */
1264         secure_sysmem = g_new(MemoryRegion, 1);
1265         memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
1266                            UINT64_MAX);
1267         memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
1268     }
1269 
1270     create_fdt(vms);
1271 
1272     oc = cpu_class_by_name(TYPE_ARM_CPU, cpustr[0]);
1273     if (!oc) {
1274         error_report("Unable to find CPU definition");
1275         exit(1);
1276     }
1277     typename = object_class_get_name(oc);
1278 
1279     /* convert -smp CPU options specified by the user into global props */
1280     cc = CPU_CLASS(oc);
1281     cc->parse_features(typename, cpustr[1], &err);
1282     g_strfreev(cpustr);
1283     if (err) {
1284         error_report_err(err);
1285         exit(1);
1286     }
1287 
1288     for (n = 0; n < smp_cpus; n++) {
1289         Object *cpuobj = object_new(typename);
1290         if (!vmc->disallow_affinity_adjustment) {
1291             /* Adjust MPIDR like 64-bit KVM hosts, which incorporate the
1292              * GIC's target-list limitations. 32-bit KVM hosts currently
1293              * always create clusters of 4 CPUs, but that is expected to
1294              * change when they gain support for gicv3. When KVM is enabled
1295              * it will override the changes we make here, therefore our
1296              * purposes are to make TCG consistent (with 64-bit KVM hosts)
1297              * and to improve SGI efficiency.
1298              */
1299             uint8_t aff1 = n / clustersz;
1300             uint8_t aff0 = n % clustersz;
1301             object_property_set_int(cpuobj, (aff1 << ARM_AFF1_SHIFT) | aff0,
1302                                     "mp-affinity", NULL);
1303         }
1304 
1305         if (!vms->secure) {
1306             object_property_set_bool(cpuobj, false, "has_el3", NULL);
1307         }
1308 
1309         if (vms->using_psci) {
1310             object_property_set_int(cpuobj, QEMU_PSCI_CONDUIT_HVC,
1311                                     "psci-conduit", NULL);
1312 
1313             /* Secondary CPUs start in PSCI powered-down state */
1314             if (n > 0) {
1315                 object_property_set_bool(cpuobj, true,
1316                                          "start-powered-off", NULL);
1317             }
1318         }
1319 
1320         if (vmc->no_pmu && object_property_find(cpuobj, "pmu", NULL)) {
1321             object_property_set_bool(cpuobj, false, "pmu", NULL);
1322         }
1323 
1324         if (object_property_find(cpuobj, "reset-cbar", NULL)) {
1325             object_property_set_int(cpuobj, vms->memmap[VIRT_CPUPERIPHS].base,
1326                                     "reset-cbar", &error_abort);
1327         }
1328 
1329         object_property_set_link(cpuobj, OBJECT(sysmem), "memory",
1330                                  &error_abort);
1331         if (vms->secure) {
1332             object_property_set_link(cpuobj, OBJECT(secure_sysmem),
1333                                      "secure-memory", &error_abort);
1334         }
1335 
1336         object_property_set_bool(cpuobj, true, "realized", NULL);
1337     }
1338     fdt_add_timer_nodes(vms);
1339     fdt_add_cpu_nodes(vms);
1340     fdt_add_psci_node(vms);
1341 
1342     memory_region_allocate_system_memory(ram, NULL, "mach-virt.ram",
1343                                          machine->ram_size);
1344     memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base, ram);
1345 
1346     create_flash(vms, sysmem, secure_sysmem ? secure_sysmem : sysmem);
1347 
1348     create_gic(vms, pic);
1349 
1350     fdt_add_pmu_nodes(vms);
1351 
1352     create_uart(vms, pic, VIRT_UART, sysmem, serial_hds[0]);
1353 
1354     if (vms->secure) {
1355         create_secure_ram(vms, secure_sysmem);
1356         create_uart(vms, pic, VIRT_SECURE_UART, secure_sysmem, serial_hds[1]);
1357     }
1358 
1359     create_rtc(vms, pic);
1360 
1361     create_pcie(vms, pic);
1362 
1363     create_gpio(vms, pic);
1364 
1365     /* Create mmio transports, so the user can create virtio backends
1366      * (which will be automatically plugged in to the transports). If
1367      * no backend is created the transport will just sit harmlessly idle.
1368      */
1369     create_virtio_devices(vms, pic);
1370 
1371     vms->fw_cfg = create_fw_cfg(vms, &address_space_memory);
1372     rom_set_fw(vms->fw_cfg);
1373 
1374     vms->machine_done.notify = virt_machine_done;
1375     qemu_add_machine_init_done_notifier(&vms->machine_done);
1376 
1377     vms->bootinfo.ram_size = machine->ram_size;
1378     vms->bootinfo.kernel_filename = machine->kernel_filename;
1379     vms->bootinfo.kernel_cmdline = machine->kernel_cmdline;
1380     vms->bootinfo.initrd_filename = machine->initrd_filename;
1381     vms->bootinfo.nb_cpus = smp_cpus;
1382     vms->bootinfo.board_id = -1;
1383     vms->bootinfo.loader_start = vms->memmap[VIRT_MEM].base;
1384     vms->bootinfo.get_dtb = machvirt_dtb;
1385     vms->bootinfo.firmware_loaded = firmware_loaded;
1386     arm_load_kernel(ARM_CPU(first_cpu), &vms->bootinfo);
1387 
1388     /*
1389      * arm_load_kernel machine init done notifier registration must
1390      * happen before the platform_bus_create call. In this latter,
1391      * another notifier is registered which adds platform bus nodes.
1392      * Notifiers are executed in registration reverse order.
1393      */
1394     create_platform_bus(vms, pic);
1395 }
1396 
1397 static bool virt_get_secure(Object *obj, Error **errp)
1398 {
1399     VirtMachineState *vms = VIRT_MACHINE(obj);
1400 
1401     return vms->secure;
1402 }
1403 
1404 static void virt_set_secure(Object *obj, bool value, Error **errp)
1405 {
1406     VirtMachineState *vms = VIRT_MACHINE(obj);
1407 
1408     vms->secure = value;
1409 }
1410 
1411 static bool virt_get_highmem(Object *obj, Error **errp)
1412 {
1413     VirtMachineState *vms = VIRT_MACHINE(obj);
1414 
1415     return vms->highmem;
1416 }
1417 
1418 static void virt_set_highmem(Object *obj, bool value, Error **errp)
1419 {
1420     VirtMachineState *vms = VIRT_MACHINE(obj);
1421 
1422     vms->highmem = value;
1423 }
1424 
1425 static char *virt_get_gic_version(Object *obj, Error **errp)
1426 {
1427     VirtMachineState *vms = VIRT_MACHINE(obj);
1428     const char *val = vms->gic_version == 3 ? "3" : "2";
1429 
1430     return g_strdup(val);
1431 }
1432 
1433 static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
1434 {
1435     VirtMachineState *vms = VIRT_MACHINE(obj);
1436 
1437     if (!strcmp(value, "3")) {
1438         vms->gic_version = 3;
1439     } else if (!strcmp(value, "2")) {
1440         vms->gic_version = 2;
1441     } else if (!strcmp(value, "host")) {
1442         vms->gic_version = 0; /* Will probe later */
1443     } else {
1444         error_setg(errp, "Invalid gic-version value");
1445         error_append_hint(errp, "Valid values are 3, 2, host.\n");
1446     }
1447 }
1448 
1449 static void virt_machine_class_init(ObjectClass *oc, void *data)
1450 {
1451     MachineClass *mc = MACHINE_CLASS(oc);
1452 
1453     mc->init = machvirt_init;
1454     /* Start max_cpus at the maximum QEMU supports. We'll further restrict
1455      * it later in machvirt_init, where we have more information about the
1456      * configuration of the particular instance.
1457      */
1458     mc->max_cpus = 255;
1459     mc->has_dynamic_sysbus = true;
1460     mc->block_default_type = IF_VIRTIO;
1461     mc->no_cdrom = 1;
1462     mc->pci_allow_0_address = true;
1463     /* We know we will never create a pre-ARMv7 CPU which needs 1K pages */
1464     mc->minimum_page_bits = 12;
1465 }
1466 
1467 static const TypeInfo virt_machine_info = {
1468     .name          = TYPE_VIRT_MACHINE,
1469     .parent        = TYPE_MACHINE,
1470     .abstract      = true,
1471     .instance_size = sizeof(VirtMachineState),
1472     .class_size    = sizeof(VirtMachineClass),
1473     .class_init    = virt_machine_class_init,
1474 };
1475 
1476 static void machvirt_machine_init(void)
1477 {
1478     type_register_static(&virt_machine_info);
1479 }
1480 type_init(machvirt_machine_init);
1481 
1482 static void virt_2_9_instance_init(Object *obj)
1483 {
1484     VirtMachineState *vms = VIRT_MACHINE(obj);
1485 
1486     /* EL3 is disabled by default on virt: this makes us consistent
1487      * between KVM and TCG for this board, and it also allows us to
1488      * boot UEFI blobs which assume no TrustZone support.
1489      */
1490     vms->secure = false;
1491     object_property_add_bool(obj, "secure", virt_get_secure,
1492                              virt_set_secure, NULL);
1493     object_property_set_description(obj, "secure",
1494                                     "Set on/off to enable/disable the ARM "
1495                                     "Security Extensions (TrustZone)",
1496                                     NULL);
1497 
1498     /* High memory is enabled by default */
1499     vms->highmem = true;
1500     object_property_add_bool(obj, "highmem", virt_get_highmem,
1501                              virt_set_highmem, NULL);
1502     object_property_set_description(obj, "highmem",
1503                                     "Set on/off to enable/disable using "
1504                                     "physical address space above 32 bits",
1505                                     NULL);
1506     /* Default GIC type is v2 */
1507     vms->gic_version = 2;
1508     object_property_add_str(obj, "gic-version", virt_get_gic_version,
1509                         virt_set_gic_version, NULL);
1510     object_property_set_description(obj, "gic-version",
1511                                     "Set GIC version. "
1512                                     "Valid values are 2, 3 and host", NULL);
1513 
1514     vms->memmap = a15memmap;
1515     vms->irqmap = a15irqmap;
1516 }
1517 
1518 static void virt_machine_2_9_options(MachineClass *mc)
1519 {
1520 }
1521 DEFINE_VIRT_MACHINE_AS_LATEST(2, 9)
1522 
1523 #define VIRT_COMPAT_2_8 \
1524     HW_COMPAT_2_8
1525 
1526 static void virt_2_8_instance_init(Object *obj)
1527 {
1528     virt_2_9_instance_init(obj);
1529 }
1530 
1531 static void virt_machine_2_8_options(MachineClass *mc)
1532 {
1533     VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
1534 
1535     virt_machine_2_9_options(mc);
1536     SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_8);
1537     /* For 2.8 and earlier we falsely claimed in the DT that
1538      * our timers were edge-triggered, not level-triggered.
1539      */
1540     vmc->claim_edge_triggered_timers = true;
1541 }
1542 DEFINE_VIRT_MACHINE(2, 8)
1543 
1544 #define VIRT_COMPAT_2_7 \
1545     HW_COMPAT_2_7
1546 
1547 static void virt_2_7_instance_init(Object *obj)
1548 {
1549     virt_2_8_instance_init(obj);
1550 }
1551 
1552 static void virt_machine_2_7_options(MachineClass *mc)
1553 {
1554     VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
1555 
1556     virt_machine_2_8_options(mc);
1557     SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_7);
1558     /* ITS was introduced with 2.8 */
1559     vmc->no_its = true;
1560     /* Stick with 1K pages for migration compatibility */
1561     mc->minimum_page_bits = 0;
1562 }
1563 DEFINE_VIRT_MACHINE(2, 7)
1564 
1565 #define VIRT_COMPAT_2_6 \
1566     HW_COMPAT_2_6
1567 
1568 static void virt_2_6_instance_init(Object *obj)
1569 {
1570     virt_2_7_instance_init(obj);
1571 }
1572 
1573 static void virt_machine_2_6_options(MachineClass *mc)
1574 {
1575     VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
1576 
1577     virt_machine_2_7_options(mc);
1578     SET_MACHINE_COMPAT(mc, VIRT_COMPAT_2_6);
1579     vmc->disallow_affinity_adjustment = true;
1580     /* Disable PMU for 2.6 as PMU support was first introduced in 2.7 */
1581     vmc->no_pmu = true;
1582 }
1583 DEFINE_VIRT_MACHINE(2, 6)
1584