展讯SC8810平台虚拟机分析&在QEMU中模拟运行

前言

早在2017年，因为酷爱刷机，把玩了很久的三星手机(GT-S7568)刷成了黑砖，bootloader无法启动，很是头疼。那时候没有现在流行的高通方案方便（可以9008），一旦固件底层损坏，通常维修店只能通过ISP（emmc飞线）重写底层固件。那时的我刚上初二，对这些只有浅薄的理解。我发现展讯也有一个USB下载模式，但三星没有在软件(u-boot-SPL)中实现，于是我只能通过自制一根工程线来进入。之后我尝试了多个工具，直接读写emmc，结果没有一个工具支持。原因是当时展讯出了多个版本的sc8810, 市面工具只支持sc8810g,使用NAND,而三星使用了sc8810es,使用emmc。后来我又找来emmc版本的其他手机的rom，将pac包内文件换成s7568的，用ResearchDownload写进去，还是无法亮屏。

2019年，我在github上翻到了展讯和FirefoxOS合作时开源的u-boot仓库，从提交历史里找到了展讯为三星做s7568的bringup的部分源码。编译下载，依然没有反应。我找到s7568的电路图，它的uart TX和下载模式gpio共用一根线接到了USB的ID端上。好不容易接出uart，却没有任何输出。这种情况下，由于我当时满天满地找8810的资料，对其启动流程有了一定的了解，我决定硬着头皮，把三星的SPL放进IDA,对照u-boot源码看看。

最终发现，三星的SPL除了比展讯简洁以外，最大的区别是它加载三星S-Boot的地址和展讯bringup里的不同。三星选择这个地址一定有其原因，于是我把uboot-spl的地址改成三星的，u-boot正常启动，直接点亮屏幕。有了uboot环境，后面的路就好走多了，不仅解决了问题，还能用开源的uboot换掉三星的SPL和S-Boot底层，支持fastboot。

底层启动流程

展讯默认：

IROM ----(emmc boot0 to IRAM)----> SPL-----(emmc boot1 to SDRAM)---->u-boot----(emmc GPT logical to SDRAM)----> vmjaluna(VLX) + Modem ThreadX + Android Kernel

三星定制：

IROM ----(emmc boot0 to IRAM)----> SPL-----(emmc GPT logical to SDRAM)---->S-Boot----(emmc GPT logical to SDRAM)----> vmjaluna(VLX) + Modem ThreadX + Android Kernel

IROM：展讯SoC内的ROM,Cortex-A5从这里启动，负责从外部flash加载SPL，也负责USB下载模式

SPL：u-boot前的loader,负责解决SDRAM初始化等问题，自身运行在片上IRAM里

u-boot或S-Boot:主要bootloader，负责各种初始化，显示第一屏，从flash读取固件和内核，之前就是把这个刷没了。

虚拟机

在后来修复u-boot支持的过程中，因为遇到不少问题，我才发现这个平台很是有意思：

展讯8810片上自带一个单核Cortex-A5(AP)和一个Ceva-X1622(DSP)，性价比超高，CP都省了。他们之前的功能机方案采用ThreadX RTOS,上面既运行了基带协议层，也运行了MMI（手机的用户界面），而基带底层运行在DSP上。8810的基带沿用了之前的ThreadX，几乎就是把SC8800G的拿过来，删掉了MMI部分。于是问题来了，既要运行modem,又要运行安卓，CPU只有一个核，他们又不可能把基带搬进Linux内核（那不是家底都被看光了）。出于成本考虑，展讯采用了虚拟机方案，找到了当时做虚拟化方案的公司Red Bend(前VirtualLogix，再前Jaluna)，以便同时运行两个OS。这就有了启动流程中的vmjaluna虚拟机。（以上观点均为臆测，如有差错欢迎指正）

图源：https://www.docin.com/p-1326014066.html

此时又出现了一个问题，Cortex-A5作为A9的精简版，没有ARM Virtuallization Extensions，不支持硬件虚拟化，Red Bend 便采用了半虚拟化方案。从内核源码可以看到半虚拟化用的一个巨大patch:https://github.com/himeno-hamster/sprd-kernel-common/commit/6b455af8469f7b86e09f2a838ede389a4d810d90

VMJALUNA

互联网上能找到的信息基本上就只到这里了。我当时对ARM和虚拟化比较感兴趣，2020年时间较多，便想反汇编这个vmjaluna binary。我找到了一份vmjaluna的debug版，其中保留了一些uart logging。同时我也找到了SC6820的datasheet，（sc6820是sc8810砍掉了 移动3G支持 的版本，pdf可以通用）。

u-boot源码中可以看到，其从emmc上加载了几个镜像：

#define DSP_ADR          0x00020000 //DSP image
#define VMJALUNA_ADR     0x00400000 //VLX 虚拟机
#define FIXNV_ADR        0x00480000 //基带NV，固定数据，IMEI等
#define RUNTIMENV_ADR    0x004a0000 //基带NV，非固定数据
#define MODEM_ADR        0x00500000 //基带RTOS，guestOS 1
#define RAMDISK_ADR      0x05500000 //安卓ramdisk
#define KERNEL_ADR       0x04508000 //安卓内核，guestOS 2

u-boot加载完后设置Linux ATAGs，然后就直接通过vlx_entry()跳转进vmjaluna。

VLX进去之后首先来到图上的Virtuallizer，进行MMU配置，整个0-0x0FFFFFFF(前256M SDRAM)被映射到0xC0000000，然后映射uart等VLX本身要用的设备。

接着进行一些内存置零操作，准备nanokernel环境（虚拟机本身也是个微内核）

void *__fastcall vmjaluna_bconf(int a1)
{
  char *v1; // r4
  int v2; // r5

  v1 = &byte_C043B000;                          
  v2 = 0x2000;
  do
  {
    *v1++ = 0;
    --v2;
  }
  while ( v2 );
  return sub_C043A090(a1);
}

在内置的description table里找到nanokernel入口并跳转：

void *__cdecl sub_C043A090(int a1)
{
  int v1; // r5
  int i; // r4
  char **v3; // r2
  void *result; // r0

  v1 = 0;
  dword_C043A734 = (int)&loc_C043A008;
  bconf_init_sections(16);
  for ( i = 0; ; i += 6 )
  {
    result = &banks_param;
    if ( v1++ >= 6 )
      break;
    v3 = &(&vmjaluna_entries_desc)[i];
    if ( *((_BYTE *)v3 + 16) == 0x11 )
      ((void (*)(void))v3[3])();                // find the type 0x11(nkernel_start)
  }
  return result;
}

终于来到main：

void __fastcall __noreturn nkernel_start(void *a1, int a2)
{
  off_C042BE28 = &unk_C0438740;
  dword_C042BE38 = 0xC04380A0;
  main(dword_C04380A0, a1, a2);
}

void __fastcall __noreturn main(int *a1, void *a2, int atags)
{
//...
  serial_init();
  console_init(0);
  printf("\n%s MH 4.1\n", "Red Bend VLX");
  printf("%s\n\n", "Copyright (c) 2002-2011, Red Bend Software. All rights reserved.");
  if ( *a1 )
  {
    print_nk();
    printf("assertion failed at file main.c line #%d\n", 5804);
    while ( 1 )
      ;
  }
  a1[1] = 1;
  cpu_init();
  dword_C0421628 = atags;
  if ( *(_DWORD *)(atags + 4) != 0x54410001 )   // 0x54410001 ATAG_CORE
  {
//...
}

main函数会初始化串口和NK控制台，CPU，中断控制器, 解析bootloader传来的ATAGs，初始化Timer（但是展讯没做），对各个guestOS进行映射（只有一个物理MMU），初始化nk的OS context，这个context将传给guestOS中的OS Plugin，提供一些半虚拟化的API。

          {
            nk_os_ctx->ready = (NkReady)nkcall_ready;
            nk_os_ctx->hgetc = (NkHistGetc)nkcall_cons_hist_getchar;
            nk_os_ctx->commit = nullsub_6;
            nk_os_ctx->stop = (NkStop)nkcall_stop;
            nk_os_ctx->wakeup = (NkWakeUp)nullsub_7;
            nk_os_ctx->resume = (NkResume)nkcall_resume;
            nk_os_ctx->xpost = (NkXIrqPost)sub_C0409940;
            nk_os_ctx->restart = (NkRestart)nkcall_restart;
            nk_os_ctx->upgrade = nullsub_6;
            nk_os_ctx->binfo = (NkGetBinfo)nkcall_binfo;
            nk_os_ctx->osctx_get = (NkOsCtxGet)nkcall_vcpu_get;
            nk_os_ctx->wsync_all = *(NkWSyncAll *)(MEMORY[0xC] + 4);
            nk_os_ctx->wsync_entry = *(NkWSyncEntry *)(MEMORY[0xC] + 8);
            nk_os_ctx->flush_all = *(NkFlushAll *)(MEMORY[0xC] + 12);
            nk_os_ctx->vfp_get = (NkVfpGet)nkcall_vfp_get;
            nk_os_ctx->vfp_owned = 0;
            nk_os_ctx->dev_alloc = (NkDevAlloc)nkcall_legacy_dev_alloc;
            nk_os_ctx->pmem_alloc = (NkPmemAlloc)nkcall_legacy_pmem_alloc;
            nk_os_ctx->smp_xirq_alloc = (NkSmpXIrqAlloc)nkcall_smp_xirq_alloc;
            nk_os_ctx->smp_dev_add = (NkSmpDevAdd)nkcall_smp_dev_add;
            nk_os_ctx->smp_pdev_alloc = (NkSmpPdevAlloc)nkcall_smp_pdev_alloc;
            nk_os_ctx->smp_pmem_alloc = (NkSmpPmemAlloc)nkcall_smp_pmem_alloc;
            nk_os_ctx->smp_pxirq_alloc = (NkSmpPxirqAlloc)nkcall_smp_pxirq_alloc;
            nk_os_ctx->smp_time = (NkSmpTime)nkcall_smp_time;
            nk_os_ctx->smp_time_hz = (NkSmpTimeHz)nkcall_smp_time_hz;
            nk_os_ctx->os_vectors[6] = (NkVector)sub_C0408794;
            nk_os_ctx->smp_cpu_start = (NkSmpCpuStart)nkcall_smp_cpu_start;
            nk_os_ctx->smp_cpu_stop = (NkSmpCpuStop)nkcall_smp_cpu_stop;
            nk_os_ctx->smp_yield = nkcall_smp_yield;
            nk_os_ctx->smp_relax = (NkSmpRelax)nkcall_smp_relax;
            nk_os_ctx->pad_ops[0] = (nku32_f)nkcall_smp_dxirq_alloc;
            nk_os_ctx->smp_irq_connect = (NkSmpIrqConnect)nkcall_smp_irq_connect;
            nk_os_ctx->smp_irq_disconnect = (NkSmpIrqDisconnect)nkcall_smp_irq_disconnect;
            nk_os_ctx->smp_irq_mask = (NkSmpIrqMask)nkcall_smp_irq_mask;
            nk_os_ctx->smp_irq_unmask = (NkSmpIrqUnmask)nkcall_smp_irq_unmask;
            nk_os_ctx->smp_irq_eoi = (NkSmpIrqEoi)nkcall_smp_irq_eoi;
            nk_os_ctx->smp_irq_affinity = (NkSmpIrqAffinity)nkcall_smp_irq_affinity;
            nk_os_ctx->smp_irq_post = (NkSmpIrqPost)nkcall_smp_irq_post;
            nk_os_ctx->smp_timer_alloc = (NkSmpTimerAlloc)nkcall_smp_timer_alloc;
            nk_os_ctx->smp_timer_free = (NkSmpTimerFree)nkcall_smp_timer_free;
            nk_os_ctx->smp_timer_info = (NkSmpTimerInfo)nkcall_smp_timer_info;
            nk_os_ctx->smp_timer_start_periodic = (NkSmpTimerStartPeriodic)nkcall_smp_timer_start_periodic;
            nk_os_ctx->smp_timer_start_oneshot = (NkSmpTimerStartOneShot)nkcall_smp_timer_start_oneshot;
            nk_os_ctx->smp_timer_stop = (NkSmpTimerStop)nkcall_smp_timer_stop;
          }

还要初始化各种虚拟设备，例如基带与安卓间的通信和网络共享,veth,vbpipe等。最后创建Boot CPU实例。各个虚拟设备（包括虚拟CPU）都有对应的descriptor进行描述，例如一个虚拟CPU里会描述各registers的值，操作系统设定的异常向量表地址等。

再接下来是两个函数，分别初始化CBSP，在BootCPU执行CBSP。CBSP全称Core BSP，是VLX中的Primary guest OS，类似于传统虚拟机如HyperV中的root partition,Xen中的Dom0一样，提供硬件驱动(IRQ,TImer,etc.)，实现中断分发，内存映射，虚拟机启动等功能。展讯使用了Embedded CBSP，和VLX编译到同一个binary里。

prepare_vm((int)a1);
start_cbsp(a1);

signed int __fastcall nkcbsp_misc_init(NkOsCtx *a1)
{
  sub_C0415C70(a1);
  if ( !vpic_init() || !timer_init() || !vtick_init() )
    return 0;
  console_irq_init();
  return 1;
}

int __fastcall prepare_vm(int result)
{

//......
  while ( 1 )
  {
//......
      v7 = v6->vm;
      v6->regs[13] = (nku32_f)&v6->stack[254];
      v6->sp_svc = (nku32_f)&v6->stack[254];
      result = 0xC0408B38;
      v8 = v6->vcpuid;
      v6->vcpu_flags = 1;
      v6->pc_svc = 0xC0408B38;//设置SVC模式下的PC寄存器
      v6->regs[0] = (nku32_f)v6;//R0寄存器保存了VCPU结构体,会传进CBSP
      v6->regs[15] = (nku32_f)sub_C040C590;
      v7[6] |= 1 << v8;
      if ( v3[16] == 1 )
      {
        v6->vcpu_flags = 0;
        result = 0xC0408BD8;
        v3[13] = 0xC0408BD8;
      }
    }
  }
}

void __fastcall __noreturn start_cbsp(_DWORD *a1)
{
//......
  if ( v1 )
  {
    if ( MEMORY[0x2C] )
    {
      print_nk();
      printf("assertion failed at file main.c line #%d\n", 3560);
      while ( 1 )
        ;
    }
    if ( !sub_C0417D2C() )
    {
      print_nk();
      printf("assertion failed at file main.c line #%d\n", 3561);
      while ( 1 )
        ;
    }
    if ( !sub_C0417D44((int)v2) )
    {
      print_nk();
      printf("panic at file main.c line #%d: ", 3564);
      printf("Unable to initialize NK CBSP\n");
      while ( 1 )
        ;
    }
  }
  else
  {
    if ( MEMORY[0x2C] )
    {
      v3 = (void (__fastcall *)(int))MEMORY[0x34];
      goto LABEL_20;
    }
    if ( !sub_C0417D2C() )
    {
      print_nk();
      printf("panic at file main.c line #%d: ", 3569);
      printf("No primary VM found\n");
      while ( 1 )
        ;
    }
    print_nk();
    printf("Embedded Core BSP used\n"); //展讯
    if ( !nkcbsp_init(v2) )
    {
      print_nk();
      printf("panic at file main.c line #%d: ", 3573);
      printf("Unable to initialize NK CBSP\n");
      while ( 1 )
        ;
    }
  }
  v3 = (void (__fastcall *)(int))nkcbsp_entry_point;
LABEL_20:
  v4 = v2->cpu;
  if ( !v4 )
  {
    print_nk();
    printf("assertion failed at file main.c line #%d\n", 2909);
    while ( 1 )
      ;
  }
//......
  printf("(%d,%d) starting VCPU 0x%x (pc 0x%x arch 0x%x) [%d]\n", v2->id, v2->vcpuid, v2, v3, 0, LODWORD(v2->ttime));
  v3((int)v2);
}

CBSP里是个大循环，不断在两个虚拟机之间切换，同时不断的开关中断，既保证正常虚拟机调度不被打断，也能及时分发处理guest IRQs。

void __fastcall __noreturn nkcbsp_entry_point(int a1)
{
  j__nkcall_ready((_DWORD *)a1);
  while ( 1 )
  {
    while ( sub_C040844C((NkOsCtx *)a1, *(_DWORD *)(a1 + 2648)) )
      ;
    flip_irq();
  }
}

int __fastcall sub_C040844C(NkOsCtx *a1, int a2)
{
  nku32_f v2; // lr
  NkOsCtx *v4; // r0
  int v5; // r1
  NkOsCtx *v6; // r10

  a1->cur_prio = a2;
  a1->regs[14] = v2;
  v4 = (NkOsCtx *)sub_C0409488(a1);
  v6 = v4;
  if ( v4 == a1 )
    return ((int (__fastcall *)(_DWORD))a1->regs[14])(0); //guest2 R14(LR)
  sub_C0408334((int)v4, v5);
  return ((int (__fastcall *)(_DWORD))v6->regs[14])(0); //guest3 R14(LR)
}

静态分析到这里，就很难进行下去了，估计因为vmjaluna的编译器优化开的很高，IDA出现了很多反编译错误：

    if ( MEMORY[0x2C] )//显然不是访问0x2C，而应该是指针被弄掉了
    {
      v3 = (void (__fastcall *)(int))MEMORY[0x34];

QEMU

IDA是支持动态调试的，动态调试状态下往往能看到很多静态看不到的东西。动态调试有多种方式，比如ARM可以用jtag，sc8810的pdf写着有jtag(ARM or DSP)，并且三星也给引出了测试点，但是飞起线来相当麻烦，况且调试起来VLX，modem,Linux要一起上，得有个好jtag仿真器速度才够。于是我选择了另一种方式，通过QEMU模拟SC8810。

要注意的是,QEMU官方并没有对展讯的模拟支持，需要自己实现对sc8810 SoC外设的模拟。我们要模拟运行VLX虚拟机，要模拟CPU,地址空间，中断控制器,定时器,uart。

QEMU官方并不支持模拟Cortex-A5，好在A5/A8/A9软件上差异不大，并且VLX默认带了A5,A8和高通scropion核心的支持，于是我暂时用A8模拟代替一下A5

QEMU自从引入qdev框架以后，采用了面向对象的编程模式，每个虚拟机都有一个“设备树”，由bus和device组成。每个device都会连在它的parent bus上，而一个device也可以提供bus给下级device连接(例如实现I2C,SPI控制器的时候)。

QEMU-machine

QEMU ARM模拟通常是板级模拟，例如模拟S7568这个主板/设备，首先要在hw/arm里建一个samsung-s7568.c，qemu初始化时会实例化这个machine,调用init方法，因此要把主板上各设备的实例化写在里面。

初始化过程除了要给machine添加SoC,内存，还要做好程序的加载。我实现了sc8810 bootrom的加载（但还不支持irom remap，不知道qemu怎么remap）和linux内核的加载（非VLX模式)

static void s7568_init(MachineState *machine)
{
    SC8810State *sc8810;
    Error *err = NULL;

    int irom_size;
    char *filename;

    if (machine->ram_size != 768 * MiB) {
        error_report("This machine can only be used with 768MiB RAM");
        exit(1);
    }
//其实CPU应该放在SoC类初始化里面的，但是还没有A5支持就暂时放这吧
    /* Only allow Cortex-A8 for now before Cortex-A5 support is added */
    if (strcmp(machine->cpu_type, ARM_CPU_TYPE_NAME("cortex-a8")) != 0) {
        error_report("This board only supports cortex-a8 CPU");
        exit(1);
    }

    sc8810 = SPRD_SC8810(object_new(TYPE_SPRD_SC8810));
    object_property_add_child(OBJECT(machine), "soc", OBJECT(sc8810));
    object_unref(OBJECT(sc8810));

    if (!qdev_realize(DEVICE(sc8810), NULL, &err)) {
        error_reportf_err(err, "Couldn't realize Spreadtrum SC8810: ");
        exit(1);
    }

    /*  Does not support IRAM/IROM remap at present  */
    memory_region_init_ram(&sc8810->sdram_0, NULL, "sdram 0",
                            256 * MiB, &error_abort);
    memory_region_init_ram(&sc8810->sdram_1, NULL, "sdram 1",
                            256 * MiB, &error_abort);
    memory_region_init_ram(&sc8810->sdram_2, NULL, "sdram 2",
                            256 * MiB, &error_abort);
    memory_region_add_subregion(get_system_memory(), memmap[SDRAM_0].base,
                                &sc8810->sdram_0);
    memory_region_add_subregion(get_system_memory(), memmap[SDRAM_1].base,
                                &sc8810->sdram_1);
    memory_region_add_subregion(get_system_memory(), memmap[SDRAM_2].base,
                                &sc8810->sdram_2);

    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, machine->firmware);
    if (filename) {
        irom_size = load_image_targphys(filename, memmap[IROM_0].base,
                                        memmap[IROM_0].size);
        g_free(filename);
    } else {
        irom_size = -1;
    }
    if (machine->firmware) {
        if (irom_size < 0 || irom_size > memmap[IROM_0].size) {
            error_report("Could not load sc8810 irom '%s'", machine->firmware);
            exit(1);
        } else {
            CPUState *cs = CPU(&sc8810->cpu);    
            cpu_reset(cs);
            cpu_set_pc(cs, memmap[IROM_0].base); 
        }
    }
    else {
        s7568_binfo.ram_size = machine->ram_size;
        arm_load_kernel(&sc8810->cpu, machine, &s7568_binfo);
    }
}

接下来就要实现SoC类了，我目前实现了sc8810的数字中断控制器（yes,还有个模拟的），3个通用（倒计时）定时器，一个系统计时器（正计时），串口暂时用PL011代替，ADI master没怎么写，但是能过VLX/modem/Linux里的数据校验，不会卡死/panic。

sprd-sc8810.c

static void sc8810_init(Object *obj) //创建8810 SoC里的各个Object
{
    SC8810State *s = SPRD_SC8810(obj);

    object_initialize_child(obj, "cpu", &s->cpu,
                            ARM_CPU_TYPE_NAME("cortex-a8"));
    object_initialize_child(obj, "intc", &s->intc, TYPE_SPRD_SC8810_INTC);

    object_initialize_child(obj, "gptimer", &s->gptimer, TYPE_SPRD_SC8810_GP_TIMER);

    object_initialize_child(obj, "systimer", &s->systimer, TYPE_SPRD_SC8810_SYS_TIMER);

    object_initialize_child(obj, "adi", &s->adi, TYPE_SPRD_SC8810_ADI);

    pl011_create(memmap[UART_0].base, 0, serial_hd(0));
}

static void sc8810_realize(DeviceState *dev, Error **errp) 
//实例化，qdev_realize和sysbus_realize会调用对应对象的实例化方法，作用是，如有些Timer设备需要
//Qemu的ptimer对象，创建ptimer操作在它的realize方法完成
{
    SC8810State *s = SPRD_SC8810(dev);
    SysBusDevice *sysbusdev;
    MemoryRegion *irom = g_new(MemoryRegion, 1);

    if (!qdev_realize(DEVICE(&s->cpu), NULL, errp)) {
        return;
    }
    if (!sysbus_realize(SYS_BUS_DEVICE(&s->intc), errp)) {
        return;
    }
    sysbusdev = SYS_BUS_DEVICE(&s->intc);
    sysbus_mmio_map(sysbusdev, 0, memmap[INTC].base);
    sysbus_connect_irq(sysbusdev, 0,
                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_IRQ));//把INTC的IRQ输出连到ARM核的IRQ输入引脚
    sysbus_connect_irq(sysbusdev, 1,
                       qdev_get_gpio_in(DEVICE(&s->cpu), ARM_CPU_FIQ));
    qdev_pass_gpios(DEVICE(&s->intc), dev, NULL);//把SoC中断控制器的中断输入传给主板的dev
//以便于后面的中断源直接连到板上，避免连中断控制器的麻烦

    if (!sysbus_realize(SYS_BUS_DEVICE(&s->gptimer), errp)) {
        return;
    }
    sysbusdev = SYS_BUS_DEVICE(&s->gptimer);
    sysbus_mmio_map(sysbusdev, 0, memmap[GPT].base);
    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 5));
    sysbus_connect_irq(sysbusdev, 1, qdev_get_gpio_in(dev, 6));
    sysbus_connect_irq(sysbusdev, 2, qdev_get_gpio_in(dev, 7));

    if (!sysbus_realize(SYS_BUS_DEVICE(&s->systimer), errp)) {
        return;
    }
    sysbusdev = SYS_BUS_DEVICE(&s->systimer);
    sysbus_mmio_map(sysbusdev, 0, memmap[SYST].base);
    sysbus_connect_irq(sysbusdev, 0, qdev_get_gpio_in(dev, 17));

    sysbus_create_simple("l2x0", memmap[PL310].base, NULL);
//...
}

在QEMU中，中断以QEMU GPIO的形式实现，一个设备可以提供gpio in（中断输入） 和 gpio out（中断输出）。SoC realize中要设置各设备的中断输出分别连到中断控制器的哪个输入上

注意：QEMU的中断号（gpio号）是从0开始的

QEMU-devices

实现一个设备的模拟支持便是要模拟软件对其MMIO寄存器的读写，同时模拟硬件的行为，做出对应的响应。

sprd-sc8810-intc.c

static void sprd_sc8810_intc_update(SC8810INTCState *s)
{
    int irq, fiq;

    irq = s->irq_raw_sts & s->irq_enable;
    fiq = s->fiq_raw_sts & s->fiq_enable;

    qemu_set_irq(s->parent_irq, !!irq); //设置 连接ARM IRQ的qemu gpio 状态
    qemu_set_irq(s->parent_fiq, !!fiq); 
}

static void sprd_sc8810_intc_set_irq(void *opaque, int irq, int level)
{
    SC8810INTCState *s = opaque;

    if (level) {
        set_bit(irq, (void *)&s->irq_raw_sts);
        set_bit(irq, (void *)&s->fiq_raw_sts);
    } else {
        clear_bit(irq, (void *)&s->irq_raw_sts);
        clear_bit(irq, (void *)&s->fiq_raw_sts);
    }
    sprd_sc8810_intc_update(s);
}

static uint64_t sprd_sc8810_intc_read(void *opaque, hwaddr offset, unsigned size)
{
    SC8810INTCState *s = opaque;

    switch (offset) {
    case INT_IRQ_MASK_STS:
        return s->irq_raw_sts & s->irq_enable;
    case INT_IRQ_RAW_STS:
        return s->irq_raw_sts;
    case INT_IRQ_ENABLE:
        return s->irq_enable;
    case INT_IRQ_DISABLE:
        break;
    case INT_IRQ_SOFT:
        break;
    case INT_IRQ_TEST_SRC:
    /*   Unimplemented   */
        break;
    case INT_IRQ_TEST_SEL:
    /*   Unimplemented   */
        break;
    case INT_FIQ_MASK_STS:
        return s->fiq_raw_sts & s->fiq_enable;
    case INT_FIQ_RAW_STS:
        return s->fiq_raw_sts;
    case INT_FIQ_ENABLE:
        return s->fiq_enable;
    case INT_FIQ_DISABLE:
        break;
    case INT_FIQ_SOFT:
        break;
    case INT_FIQ_TEST_SRC:
    /*   Unimplemented   */
        break;
    case INT_FIQ_TEST_SEL:
    /*   Unimplemented   */
        break;
    default:
        qemu_log_mask(LOG_GUEST_ERROR,
                      "%s: Bad offset 0x%x\n",  __func__, (int)offset);
        break;
    }

    return 0;
}

static void sprd_sc8810_intc_write(void *opaque, hwaddr offset, uint64_t value,
                             unsigned size)
{
    SC8810INTCState *s = opaque;

    switch (offset) {
    case INT_IRQ_MASK_STS:
        break;
    case INT_IRQ_RAW_STS:
        break;
    case INT_IRQ_ENABLE:
        s->irq_enable |= value;
        break;
    case INT_IRQ_DISABLE:
        s->irq_enable &= ~value;
        break;
    case INT_IRQ_SOFT:
        s->irq_raw_sts = (s->irq_raw_sts & 0xFFFFFFFD) | (value & 2);
        break;
    case INT_IRQ_TEST_SRC:
    /*   Unimplemented   */
        break;
    case INT_IRQ_TEST_SEL:
    /*   Unimplemented   */
        break;
    case INT_FIQ_MASK_STS:
        break;
    case INT_FIQ_RAW_STS:
        break;
    case INT_FIQ_ENABLE:
        s->fiq_enable |= value;
        break;
    case INT_FIQ_DISABLE:
        s->fiq_enable &= ~value;
        break;
    case INT_FIQ_SOFT:
        s->fiq_raw_sts = (s->fiq_raw_sts & 0xFFFFFFFD) | (value & 2);
        break;
    case INT_FIQ_TEST_SRC:
    /*   Unimplemented   */
        break;
    case INT_FIQ_TEST_SEL:
    /*   Unimplemented   */
        break;
    default:
        qemu_log_mask(LOG_GUEST_ERROR,
                      "%s: Bad offset 0x%x\n",  __func__, (int)offset);
        break;
    }

    sprd_sc8810_intc_update(s);
}

static const MemoryRegionOps sprd_sc8810_intc_ops = {
    .read = sprd_sc8810_intc_read,
    .write = sprd_sc8810_intc_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
};

实现IRQ控制器时，对应sc8810的datasheet，软件读写时返回对应的值，保存中断mask状态，并适时更新IRQ状态，触发ARM中断。

同时为了实现虚拟机的挂起/恢复，迁移（虚拟机不关机，搬到另一个物理机上），需要实现设备的VMState

将你设备里需要保存、恢复的状态变量放在VMStateDescription 里就可以了，（有些类型，如qemu_irq,不需要放，也不能放）

static const VMStateDescription vmstate_sprd_sc8810_intc = {
    .name = "sc8810.intc",
    .version_id = 1,
    .minimum_version_id = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(irq_raw_sts, SC8810INTCState),
        VMSTATE_UINT32(irq_enable, SC8810INTCState),
        VMSTATE_UINT32(fiq_raw_sts, SC8810INTCState),
        VMSTATE_UINT32(fiq_enable, SC8810INTCState),
        VMSTATE_END_OF_LIST()
    }
};

关于TImer

QEMU实现了一个ptimer API，但是ptimer只支持倒计时，也就只适用于倒计时的Timers。sc8810的generic timers是用ptimer模拟的，但是system timer因为没有正计时API，只能自己实现了。自己实现timer，需要用到qemu的几个clock API，有取虚拟时间的（定时），还有取真实时间（RTC）,可以到qemu的include里看看.

static void sprd_sc8810_systimer_reset(DeviceState *dev)
{
    SC8810SYSTState *s = SPRD_SC8810_SYS_TIMER(dev);
    s->alarm = 0xFFFF;
    s->raw_irq_status = 0;
    s->irq_enable = 0;
    s->offset = qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL);

    timer_mod(s->timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + s->alarm);
}

static void sprd_sc8810_systimer_realize(DeviceState *dev, Error **errp)
{
    SC8810SYSTState *s = SPRD_SC8810_SYS_TIMER(dev);
    s->timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, sprd_sc8810_systimer_interrupt, s);
}

到此，QEMU上的sc8810模拟支持基本可以用来启动VLX和guests,并连接IDA 调试了

IDA动态调试

首先编译运行qemu，将VLX,modem，Linux加载到对应的地址，设置PC寄存器为VLX入口。

-S  打开qemu自带的gdbstub,IDA可以连接上去，默认端口1234

-s 开机时暂停虚拟机

qemu-system-arm -M samsung-s7568 -vnc :0 -serial stdio -device loader,file=vmjaluna.bin,addr=0x400000,cpu-num=0 -device loader,file=modem.bin,addr=0x500000 -device loader,file=Image,addr=0x04508000 -monitor tcp::3333,server,nowait -S -s

可不加-S -s 调试器看看效果：

Red Bend VLX MH 4.1
Copyright (c) 2002-2011, Red Bend Software. All rights reserved.

NK: Processor revision r0p0 (ARMv7)
NK: Cache is VIPT dcache line size 64  icache line size 64
NK: VFP is present
NK: CRTX-A8 processor found
NK:  === dump tag list at 0xc040012c ===
NK:  tag = 0x54410001  size = 0x00000005
NK:    core tag:      0x00000000 0x00001000 0x00000000
//......
//......
NK: VM#4 command line: <>
NK: VM#3 command line: < vram=512M show-guest-banks=0x4 no_console_suspend console=ttyNK vdev=(veth,0) vdev=(veth,1) vdev=(veth,2) viomem=* vdev=(vbpipe,0|a;256K) vdev=(vbpipe,2|a;32K)vdev=(vbpipe,3|a;4K) vdev=(vbpipe,4|a;1K) vdev=(vbpipe,5|a;1K) vdev=(vbpipe,6|a;32K) vdev=(vbpipe,7|a;32K) vdev=(vcons,>6|3) vdev=(vcons,6>|xlink=5) linux-timer=virtual vdev=(vclock_framework,>100) vdev=(vaudio,0>|1) root=/dev/ram0 rw init=/init >
NK: VM#2 command line: < vram=21520K vdev=(vcons,5>|xlink=6) guest-reboot vdev=(vcons,>5) vdev=(vcons,>15) vdev=(veth,0) vdev=(veth,1) vdev=(veth,2) vdev=(vcons,15>)  vdev=(vtimer,0>) vdev=(vbpipe,0|a;8K) vdev=(vbpipe,2|a;32K) vdev=(vbpipe,3|a;4K) vdev=(vbpipe,4|a;1K) vdev=(vbpipe,5|a;1K) vdev=(vbpipe,6|a;32K) vdev=(vbpipe,7|a;32K) vdev=(vtimer,>0) vdev=(vclock_framework,100>) vdev=(vaudio,>0)>
NK: VM#1 command line: <>
NK: NK command line: < vpark=(3) pmem=4M>

NK: nk_pmem_alloc initialized at [0xc1600000-0xc1a00000)
NK: VM#3 uses only 0x0e63b000 < vram=0x20000000
0:  0x00000000  0xc0000000      N  [0x00000010]
2:  0xc0000000  0x00400000   A     [0x00020002]
//......
NK: VLINK name <vcons> link 5 s_id 2 c_id 2 s_info <> c_info <xlink=6>
NK: VLINK name <vcons> link 15 s_id 2 c_id 2 s_info <> c_info <>
//......
NK: DEV   class 0 id 4e4b494f
NK: DEV * class 0 id 564c4e4b
//......
NK: Embedded Core BSP used
NK: SC8810G: hardware interrupt controller initialized
NK: VPIC: config xirq=513
NK: SC8810G: no timer initialized
NK: vevent_init: no vtimer vlinks found
CBSP: console runs in polling mode
NK: (1,0) starting VCPU 0xc0441040 (pc 0xc0408bb4 arch 0x7dd) [256] //启动CBSP guest
NK: (2,0) starting VCPU 0xc0441ea0 (pc 0xc04ff000) [256] //启动modem OS guest
NK: nk_pmem_alloc(0x1000) [0xc1600000-0xc1a00000)
NK: nk_pmem_alloc(0x1000) [0xc1601000-0xc1a00000)
####: sc8800g_clock_nodes_init() passed!
NKDDI: VPIC-FE initialized
INT:unmask(10) failure : irq not connected
NK: nk_pmem_alloc(0x40000) [0xc1602000-0xc1a00000)
NK: nk_pmem_alloc(0x2000) [0xc1642000-0xc1a00000)
VBPIPE: device vbpipe0 is created for OS#3 link=0
NK: nk_pmem_alloc(0x8000) [0xc1644000-0xc1a00000)
NK: nk_pmem_alloc(0x8000) [0xc164c000-0xc1a00000)
//......
VBPIPE: initialized
NK: VPIC: -> intr_attach(5)
NK: VPIC: -> intr_attach(7)
Booting for the 0 time 
runtime_nv_mem: 0,0,0,0,0,0,0,0,0,0
[_get_dynNV]fixed_nv_info.map_size:16 
[_get_dynNV]ram_nv_table[0].mem:0xc0480000 
[_get_dynNV]ram_nv_table[0].nr_sects:0x80 
[_get_dynNV]runtime_nv_info.map_size:64 
[_get_dynNV]ram_nv_table[1].mem:0xc04a0000 
[_get_dynNV]ram_nv_table[1].nr_sects:0x200 
[_get_dynNV]prod_param_info.map_size:1 
[_get_dynNV]ram_nv_table[2].mem:0xc0490000 
[_get_dynNV]ram_nv_table[2].nr_sects:0x3 
Assert in file nvitem_dummy.c at line 32 info=[] //没加载NV,modem panic,调用AP Linux的modem dump
vbpipe for assert open, waiting for peer open
vbpipe for assert open, waiting for peer open
NK: (3,0) starting VCPU 0xc0442d00 (pc 0xc4500000) [254]// 开始启动Linux guest
[    0.000000] console [ttyNK0] enabled
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 58435
[    0.000000] Kernel command line:  show-guest-banks=0x4 no_console_suspend Oonsole=ttyNK viomem=* linux-timer=virtual root=/dev/ram0 rw init=/init console=ttyS1,115200n8 loglevel=8
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Memory: 0MB 0MB 230MB = 230MB total
[    0.000000] Memory: 170412k/170412k available, 65344k reserved, 0K highmem
[    0.000000] Virtual kernel memory layout:
[    0.000000]     vector  : 0xffff0000 - 0xffff1000   (   4 kB)
[    0.000000]     fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
[    0.000000]     DMA     : 0xffc00000 - 0xffe00000   (   2 MB)
[    0.000000]     vmalloc : 0xd0800000 - 0xe0000000   ( 248 MB)
[    0.000000]     lowmem  : 0xc0000000 - 0xd0000000   ( 256 MB)
[    0.000000]     pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
[    0.000000]     modules : 0xbf000000 - 0xbfe00000   (  14 MB)
[    0.000000]       .init : 0xc4508000 - 0xc452e000   ( 152 kB)
[    0.000000]       .text : 0xc452e000 - 0xc4b1a0f8   (6065 kB)
[    0.000000]       .data : 0xc4b1c000 - 0xc4b7b2d0   ( 381 kB)
[    0.000000]        .bss : 0xc4b7b2f4 - 0xc4db7810   (2290 kB)
[    0.000000] Preemptible hierarchical RCU implementation.
[    0.000000]  Verbose stalled-CPUs detection is disabled.
[    0.000000] NR_IRQS:1024
NK: Using virtual PIC
[    0.000000] sched_clock: 32 bits at 26MHz, resolution 38ns, wraps every 165191ms
NK: VPIC: -> intr_attach(6)
[    0.000000] Console: colour dummy device 80x30
[    0.007681] Calibrating delay loop... 695.50 BogoMIPS (lpj=3477504)
[    0.284053] pid_max: default: 32768 minimum: 301
[    0.285764] Mount-cache hash table entries: 512
[    0.295286] CPU: Testing write buffer coherency: ok
[    0.303002] hw perfevents: enabled with ARMv7 Cortex-A8 PMU driver, 5 counters available
[    0.308849] L310 cache controller enabled
[    0.311247] l2x0: 8 ways, CACHE_ID 0x410000c8, AUX_CTRL 0x1e560800, Cache size: 524288 B
[    0.355362] print_constraints: dummy: 
[    0.357845] NET: Registered protocol family 16
[    0.361950] sc8810_init_machine 
[    0.370240] sc8810_add_misc_devices 
[    0.371147] hw-breakpoint: debug architecture 0x4 unsupported.
NK: VPIC: -> intr_attach(21)
[    0.375434] request dma irq ok
NK: VPIC: -> intr_attach(8)
NK: VPIC: -> intr_attach(37)
NK: VPIC: -> intr_attach(33)
[    0.381447] print_constraints: LDO_VDDARM: 650 <--> 1300 mV at 650 mV normal standby
[    0.382439] print_constraints: LDO_VDD25: 2500 <--> 3000 mV at 2500 mV normal standby
[    0.383252] print_constraints: LDO_VDD18: 1200 <--> 2800 mV at 1800 mV normal standby
[    0.384041] print_constraints: LDO_VDD28: 1800 <--> 3000 mV at 2800 mV normal standby
[    0.384690] print_constraints: LDO_AVDDBB: 2800 <--> 3100 mV at 3000 mV normal standby
[    0.385429] print_constraints: LDO_VDDRF0: 1800 <--> 2950 mV at 2850 mV normal standby
[    0.386163] print_constraints: LDO_VDDRF1: 1800 <--> 2950 mV at 2850 mV normal standby
[    0.386871] print_constraints: LDO_VDDMEM: 1800 mV normal 
[    0.387422] print_constraints: LDO_VDDCORE: 650 <--> 1300 mV at 650 mV normal 
[    0.388094] print_constraints: LDO_LDO_BG: 650 <--> 1300 mV at 650 mV normal 
[    0.388702] print_constraints: LDO_AVDDVB: 2900 <--> 3400 mV at 3300 mV normal standby
[    0.389408] print_constraints: LDO_VDDCAMDA: 1800 <--> 3000 mV at 2800 mV normal standby
[    0.390124] print_constraints: LDO_VDDCAMD1: 1200 <--> 3300 mV at 2800 mV normal standby
//......

接下来连接IDA

Debugger-Process options，配置好QEMU运行的主机ip和port，本机就填127.0.0.1

可以愉快的动态调试了