[PATCH v3 5/5] [NOT-FOR-UPSTREAM] platform: virt: add QEMU WorldGuard overlay

[Raymond Mao]

From: Raymond Mao <raymond.mao at riscstar.com>

Add a QEMU virt device-tree overlay that describes OpenSBI domain
WorldGuard metadata and checker permission policy for the current
test and demo flow.

Signed-off-by: Raymond Mao <raymond.mao at riscstar.com>
---
 .../generic/virt/qemu-virt-wg-overlay.dts     | 198 ++++++++++++++++++
 1 file changed, 198 insertions(+)
 create mode 100644 platform/generic/virt/qemu-virt-wg-overlay.dts

diff --git a/platform/generic/virt/qemu-virt-wg-overlay.dts b/platform/generic/virt/qemu-virt-wg-overlay.dts
new file mode 100644
index 00000000..e629df89
--- /dev/null
+++ b/platform/generic/virt/qemu-virt-wg-overlay.dts
@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/dts-v1/;
+/plugin/;
+
+/*
+ * Test-only overlay for exercising WorldGuard domain metadata and
+ * WorldGuard checker access-controller rules.
+ *
+ * This overlay adds:
+ * 1. OpenSBI domain metadata for domain-local WID policy
+ * 2. access-controllers partition metadata and consumer references
+ *
+ * The base DTB is expected to already provide:
+ * - WorldGuard checker nodes
+ * - /cpus worlds properties
+ * - per-hart worlds properties
+ *
+ * Usage:
+ * Domain hart phandles are filled in after merge because fdtoverlay does not
+ * reliably resolve CPU-node references against QEMU dumpdtb output here.
+ * See below steps for filling the domain hart phandles (assume the dumped dtb
+ * and merged dtb are represented by 'qemu.dtb' and 'qemu-merged.dtb'
+ * respectively):
+ *   cpu0_phandle=$(fdtget -t x qemu.dtb /cpus/cpu at 0 phandle)
+ *   cpu1_phandle=$(fdtget -t x qemu.dtb /cpus/cpu at 1 phandle)
+ *   fdtput -t x qemu-merged.dtb /chosen/opensbi-domains/domain at 0 \
+ *     possible-harts "$cpu0_phandle" "$cpu1_phandle"
+ *   fdtput -t x qemu-merged.dtb /chosen/opensbi-domains/domain at 0 \
+ *     boot-hart "$cpu0_phandle"
+ *   fdtput -t x qemu-merged.dtb /chosen/opensbi-domains/domain at 1 \
+ *     possible-harts "$cpu1_phandle"
+ *   fdtput -t x qemu-merged.dtb /chosen/opensbi-domains/domain at 1 \
+ *     boot-hart "$cpu1_phandle"
+ */
+/ {
+	fragment at 0 {
+		target-path = "/chosen";
+		__overlay__ {
+			opensbi,worldguard-sbiunit;
+			opensbi-domains {
+				compatible = "opensbi,domain,config";
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				memregion0: memregion at 0 {
+					compatible = "opensbi,domain,memregion";
+					base = <0x00000000 0x80000000>;
+					order = <0x1f>;
+				};
+
+				guest0: domain at 0 {
+					compatible = "opensbi,domain,instance";
+					regions = <&memregion0 0x3f>;
+					next-addr = <0x00000000 0x80200000>;
+					next-arg1 = <0x00000000 0x82200000>;
+					next-mode = <0x1>;
+
+					hw-isolation {
+						worldguard {
+							compatible = "sifive,wgchecker2";
+							worldguard,wid = <0>;
+							worldguard,widlist = <0 1 3>;
+						};
+					};
+				};
+
+				guest1: domain at 1 {
+					compatible = "opensbi,domain,instance";
+					regions = <&memregion0 0x3f>;
+					next-addr = <0x00000000 0x80200000>;
+					next-mode = <0x1>;
+
+					hw-isolation {
+						worldguard {
+							compatible = "sifive,wgchecker2";
+							worldguard,wid = <1>;
+							worldguard,widlist = <1 3>;
+						};
+					};
+				};
+			};
+		};
+	};
+
+	fragment at 1 {
+		target-path = "/cpus/cpu at 0";
+		__overlay__ {
+			opensbi-domain = <&guest0>;
+		};
+	};
+
+	fragment at 2 {
+		target-path = "/cpus/cpu at 1";
+		__overlay__ {
+			opensbi-domain = <&guest0>;
+		};
+	};
+
+	fragment at 3 {
+		target-path = "/memory at 80000000";
+		__overlay__ {
+			access-controllers =
+				<0x100 0x0>,
+				<0x100 0x1>,
+				<0x100 0x2>;
+		};
+	};
+
+	fragment at 4 {
+		target-path = "/flash at 20000000";
+		__overlay__ {
+			access-controllers = <0x101 0x0>;
+		};
+	};
+
+	fragment at 5 {
+		target-path = "/soc/serial at 10000000";
+		__overlay__ {
+			access-controllers = <0x102 0x0>;
+		};
+	};
+
+	fragment at 6 {
+		target-path = "/soc/wgchecker at 6000000";
+		__overlay__ {
+			compatible = "qemu,wgchecker2", "sifive,wgchecker2";
+			#access-controller-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			phandle = <0x100>;
+			linux,phandle = <0x100>;
+
+			partition at 0 {
+				reg = <0>;
+				sifive,wg-region =
+					<0x00000000 0x80000000 0x00000000 0x40000000>;
+				sifive,slot-permissions = <0x00000000 0x000000cf>;
+				sifive,slot-config = <0x0f>;
+			};
+
+			partition at 1 {
+				reg = <1>;
+				sifive,wg-region =
+					<0x00000000 0xc0000000 0x00000000 0x01000000>;
+				sifive,slot-permissions = <0x00000000 0x000000cc>;
+				sifive,slot-config = <0x0f>;
+			};
+
+			partition at 2 {
+				reg = <2>;
+				sifive,wg-region =
+					<0x00000000 0xc1000000 0x00000000 0x3f000000>;
+				sifive,slot-permissions = <0x00000000 0x000000cf>;
+				sifive,slot-config = <0x0f>;
+			};
+		};
+	};
+
+	fragment at 7 {
+		target-path = "/soc/wgchecker at 6001000";
+		__overlay__ {
+			compatible = "qemu,wgchecker2", "sifive,wgchecker2";
+			#access-controller-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			phandle = <0x101>;
+			linux,phandle = <0x101>;
+
+			partition at 0 {
+				reg = <0>;
+				sifive,wg-region =
+					<0x00000000 0x20000000 0x00000000 0x04000000>;
+				sifive,slot-permissions = <0x00000000 0x000000c3>;
+				sifive,slot-config = <0x0f>;
+			};
+		};
+	};
+
+	fragment at 8 {
+		target-path = "/soc/wgchecker at 6002000";
+		__overlay__ {
+			compatible = "qemu,wgchecker2", "sifive,wgchecker2";
+			#access-controller-cells = <1>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+			phandle = <0x102>;
+			linux,phandle = <0x102>;
+
+			partition at 0 {
+				reg = <0>;
+				sifive,wg-region =
+					<0x00000000 0x10000000 0x00000000 0x00001000>;
+				sifive,slot-permissions = <0x00000000 0x000000c0>;
+				sifive,slot-config = <0x0f>;
+			};
+		};
+	};
+};
-- 
2.25.1