QEMU 训练营 2026 专业阶段总结¶

# .cnb.yml
# 在使用云原生开发环境时，指定 docker 环境的镜像
# 匹配所有分支名
"$":
  web_trigger_build:
    - services:
        - docker
      runner:
        cpus: 64
      stages:
        - name: build-and-push-image
          script: |
            IMAGE_TAG="${tag:-latest}"
            echo "使用镜像标签: ${IMAGE_TAG}"
            docker build -f ./.ide/Dockerfile -t ${CNB_DOCKER_REGISTRY}/${CNB_REPO_SLUG_LOWERCASE}:${IMAGE_TAG} .
            docker push ${CNB_DOCKER_REGISTRY}/${CNB_REPO_SLUG_LOWERCASE}:${IMAGE_TAG}
  vscode:
    - runner:
        cpus: 12
      docker:
        image: docker.cnb.cool/gevico.online/qemu-lab:latest
      services:
        - vscode
        - docker
      stages:
        - name: clone-qemu-camp-repo
          script: |
            if [ ! -d "qemu-camp-2026-exper-lingqian-gi" ]; then
              echo ">>> 开始克隆 qemu-camp-2026 仓库..."
              git clone https://github.com/gevico/qemu-camp-2026-exper-lingqian-gi
              echo ">>> 克隆完成"
            else
              echo ">>> 仓库已存在，跳过 clone"
            fi
        - name: configure-qemu
          script: |
            cd /workspace/qemu-camp-2026-exper-lingqian-gi && make -f Makefile.camp configure
        - name: build-qemu
          script: |
            cd /workspace/qemu-camp-2026-exper-lingqian-gi && make -f Makefile.camp build

static void mydevice_realize(DeviceState *dev, Error **errp)
{
    MyDeviceState *s = MYDEVICE(dev);

    // 1. 初始化 MemoryRegion，绑定读写回调
    memory_region_init_io(&s->mmio, OBJECT(dev),
                         &mydevice_ops, s,
                         "my-device", MYDEVICE_MMIO_SIZE);

    // 2. 将 MMIO 区域添加到 SysBus
    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);

    // 3. 初始化中断线
    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);

    // 4. 初始化其他资源（定时器、GPIO 等）
    // ...
}

static const MemoryRegionOps mydevice_ops = {
    .read = mydevice_read,
    .write = mydevice_write,
    .endianness = DEVICE_LITTLE_ENDIAN,
    .valid = {
        .min_access_size = 4,
        .max_access_size = 4,
    },
    .impl = {
        .min_access_size = 4,
        .max_access_size = 4,
    },
};

// 设备侧：触发中断
static void mydevice_write(void *opaque, hwaddr addr,
                           uint64_t value, unsigned size)
{
    MyDeviceState *s = opaque;

    switch (addr) {
    case REG_INTERRUPT_ENABLE:
        s->int_enable = value;
        break;
    case REG_INTERRUPT_SET:
        s->int_status |= value;
        if (s->int_status & s->int_enable) {
            qemu_set_irq(s->irq, 1);  // 触发中断
        }
        break;
    // ...
    }
}

// 板级代码：连接中断
void my_board_init(MachineState *machine)
{
    DeviceState *dev;
    DeviceState *plic;

    // 创建中断控制器
    plic = sysbus_create_simple("riscv.plic", VIRT_PLIC_BASE,
                                CPU_IRQ_LINE);

    // 创建设备
    dev = qdev_new(TYPE_MYDEVICE);
    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);

    // 映射 MMIO 地址
    memory_region_add_subregion(get_system_memory(),
                                MYDEVICE_BASE,
                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));

    // 连接中断：设备 IRQ 0 -> PLIC 输入 N
    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
                       qdev_get_gpio_in(plic, MYDEVICE_PLIC_IRQ_NUM));
}

static void mydevice_class_init(ObjectClass *klass, void *data)
{
    DeviceClass *dc = DEVICE_CLASS(klass);

    dc->realize = mydevice_realize;
    dc->reset = mydevice_reset;  // 设置重置回调
    dc->vmsd = &mydevice_vmstate;
    dc->desc = "My Device";
}

static void mydevice_reset(DeviceState *dev)
{
    MyDeviceState *s = MYDEVICE(dev);

    // 恢复所有寄存器到默认值
    s->data = 0;
    s->status = 0x01;      // 默认状态
    s->control = 0;
    s->int_enable = 0;
    s->int_status = 0;

    // 停止定时器
    qemu_set_irq(s->irq, 0);
    timer_del(&s->timer);

    // 其他清理工作
    // ...
}

static const VMStateDescription mydevice_vmstate = {
    .name = "my-device",
    .version_id = 1,
    .minimum_version_id = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32(data, MyDeviceState),
        VMSTATE_UINT32(status, MyDeviceState),
        VMSTATE_UINT32(control, MyDeviceState),
        VMSTATE_UINT32(int_enable, MyDeviceState),
        VMSTATE_UINT32(int_status, MyDeviceState),
        VMSTATE_TIMER(timer, MyDeviceState),
        VMSTATE_END_OF_LIST()
    }
};

dc->vmsd = &mydevice_vmstate;

// 在板级初始化函数中
memory_region_add_subregion(get_system_memory(),
                            MYDEVICE_BASE_ADDR,
                            &s->mmio);

QEMU 启动
    │
    ├─ type_init(mydevice_register_types)
    │       └─ 注册 TypeInfo 到全局类型系统
    │
    ├─ 设备实例化 (命令行或板级代码)
    │       ├─ object_new(TYPE_MYDEVICE) → 分配 MyDeviceState
    │       ├─ 调用 instance_init (若有)
    │       ├─ 设置属性 (如可通过 -device 传递)
    │       └─ realize 设备
    │               ├─ 调用 mydevice_realize
    │               │     ├─ memory_region_init_io → 绑定 MemoryRegionOps
    │               │     ├─ sysbus_init_mmio → 将 MR 添加到设备的 MMIO 列表
    │               │     ├─ sysbus_init_irq → 创建中断线
    │               │     └─ 其他初始化
    │               └─ 板级代码映射 MMIO 到系统地址空间
    │
    ├─ CPU 访问 MMIO 地址
    │       ├─ 内存子系统路由 → mydevice_ops.read/write
    │       └─ 回调函数更新设备状态 / 触发中断
    │
    ├─ VM 保存/恢复
    │       └─ 通过 mydevice_vmstate 自动序列化
    │
    └─ 系统复位
            └─ 调用 mydevice_reset 恢复初始状态

QTEST_QEMU_BINARY="gdb --args ./qemu-system-riscv64" \
    ./tests/gevico/qtest/test-flash-read

(gdb) break mydevice_write
(gdb) run

static void test_mydevice(void)
{
    QTestState *qts;
    uint32_t value;

    // 启动 QEMU 并连接 QTest
    qts = qtest_init("-machine my-board -device my-device");

    // 写入寄存器
    qtest_writel(qts, MYDEVICE_BASE + REG_CONTROL, 0x01);

    // 读取寄存器
    value = qtest_readl(qts, MYDEVICE_BASE + REG_STATUS);
    g_assert_cmpuint(value, ==, 0x01);

    // 清理
    qtest_quit(qts);
}