xref: /openbmc/qemu/hw/ppc/pegasos2.c (revision 3b3e4c28)
1 /*
2  * QEMU PowerPC CHRP (Genesi/bPlan Pegasos II) hardware System Emulator
3  *
4  * Copyright (c) 2018-2021 BALATON Zoltan
5  *
6  * This work is licensed under the GNU GPL license version 2 or later.
7  *
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/units.h"
12 #include "qapi/error.h"
13 #include "hw/ppc/ppc.h"
14 #include "hw/sysbus.h"
15 #include "hw/pci/pci_host.h"
16 #include "hw/irq.h"
17 #include "hw/pci-host/mv64361.h"
18 #include "hw/isa/vt82c686.h"
19 #include "hw/ide/pci.h"
20 #include "hw/i2c/smbus_eeprom.h"
21 #include "hw/qdev-properties.h"
22 #include "sysemu/reset.h"
23 #include "sysemu/runstate.h"
24 #include "sysemu/qtest.h"
25 #include "hw/boards.h"
26 #include "hw/loader.h"
27 #include "hw/fw-path-provider.h"
28 #include "elf.h"
29 #include "qemu/log.h"
30 #include "qemu/error-report.h"
31 #include "sysemu/kvm.h"
32 #include "kvm_ppc.h"
33 #include "exec/address-spaces.h"
34 #include "qom/qom-qobject.h"
35 #include "qapi/qmp/qdict.h"
36 #include "trace.h"
37 #include "qemu/datadir.h"
38 #include "sysemu/device_tree.h"
39 #include "hw/ppc/vof.h"
40 
41 #include <libfdt.h>
42 
43 #define PROM_FILENAME "vof.bin"
44 #define PROM_ADDR     0xfff00000
45 #define PROM_SIZE     0x80000
46 
47 #define INITRD_MIN_ADDR 0x600000
48 
49 #define KVMPPC_HCALL_BASE    0xf000
50 #define KVMPPC_H_RTAS        (KVMPPC_HCALL_BASE + 0x0)
51 #define KVMPPC_H_VOF_CLIENT  (KVMPPC_HCALL_BASE + 0x5)
52 
53 #define H_SUCCESS     0
54 #define H_PRIVILEGE  -3  /* Caller not privileged */
55 #define H_PARAMETER  -4  /* Parameter invalid, out-of-range or conflicting */
56 
57 #define BUS_FREQ_HZ 133333333
58 
59 #define PCI0_CFG_ADDR 0xcf8
60 #define PCI0_MEM_BASE 0xc0000000
61 #define PCI0_MEM_SIZE 0x20000000
62 #define PCI0_IO_BASE  0xf8000000
63 #define PCI0_IO_SIZE  0x10000
64 
65 #define PCI1_CFG_ADDR 0xc78
66 #define PCI1_MEM_BASE 0x80000000
67 #define PCI1_MEM_SIZE 0x40000000
68 #define PCI1_IO_BASE  0xfe000000
69 #define PCI1_IO_SIZE  0x10000
70 
71 #define TYPE_PEGASOS2_MACHINE  MACHINE_TYPE_NAME("pegasos2")
72 OBJECT_DECLARE_TYPE(Pegasos2MachineState, MachineClass, PEGASOS2_MACHINE)
73 
74 struct Pegasos2MachineState {
75     MachineState parent_obj;
76     PowerPCCPU *cpu;
77     DeviceState *mv;
78     qemu_irq mv_pirq[PCI_NUM_PINS];
79     qemu_irq via_pirq[PCI_NUM_PINS];
80     Vof *vof;
81     void *fdt_blob;
82     uint64_t kernel_addr;
83     uint64_t kernel_entry;
84     uint64_t kernel_size;
85     uint64_t initrd_addr;
86     uint64_t initrd_size;
87 };
88 
89 static void *build_fdt(MachineState *machine, int *fdt_size);
90 
91 static void pegasos2_cpu_reset(void *opaque)
92 {
93     PowerPCCPU *cpu = opaque;
94     Pegasos2MachineState *pm = PEGASOS2_MACHINE(current_machine);
95 
96     cpu_reset(CPU(cpu));
97     cpu->env.spr[SPR_HID1] = 7ULL << 28;
98     if (pm->vof) {
99         cpu->env.gpr[1] = 2 * VOF_STACK_SIZE - 0x20;
100         cpu->env.nip = 0x100;
101     }
102     cpu_ppc_tb_reset(&cpu->env);
103 }
104 
105 static void pegasos2_pci_irq(void *opaque, int n, int level)
106 {
107     Pegasos2MachineState *pm = opaque;
108 
109     /* PCI interrupt lines are connected to both MV64361 and VT8231 */
110     qemu_set_irq(pm->mv_pirq[n], level);
111     qemu_set_irq(pm->via_pirq[n], level);
112 }
113 
114 static void pegasos2_init(MachineState *machine)
115 {
116     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
117     CPUPPCState *env;
118     MemoryRegion *rom = g_new(MemoryRegion, 1);
119     PCIBus *pci_bus;
120     Object *via;
121     PCIDevice *dev;
122     I2CBus *i2c_bus;
123     const char *fwname = machine->firmware ?: PROM_FILENAME;
124     char *filename;
125     int i;
126     ssize_t sz;
127     uint8_t *spd_data;
128 
129     /* init CPU */
130     pm->cpu = POWERPC_CPU(cpu_create(machine->cpu_type));
131     env = &pm->cpu->env;
132     if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) {
133         error_report("Incompatible CPU, only 6xx bus supported");
134         exit(1);
135     }
136 
137     /* Set time-base frequency */
138     cpu_ppc_tb_init(env, BUS_FREQ_HZ / 4);
139     qemu_register_reset(pegasos2_cpu_reset, pm->cpu);
140 
141     /* RAM */
142     if (machine->ram_size > 2 * GiB) {
143         error_report("RAM size more than 2 GiB is not supported");
144         exit(1);
145     }
146     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
147 
148     /* allocate and load firmware */
149     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, fwname);
150     if (!filename) {
151         error_report("Could not find firmware '%s'", fwname);
152         exit(1);
153     }
154     if (!machine->firmware && !pm->vof) {
155         pm->vof = g_malloc0(sizeof(*pm->vof));
156     }
157     memory_region_init_rom(rom, NULL, "pegasos2.rom", PROM_SIZE, &error_fatal);
158     memory_region_add_subregion(get_system_memory(), PROM_ADDR, rom);
159     sz = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL, 1,
160                   PPC_ELF_MACHINE, 0, 0);
161     if (sz <= 0) {
162         sz = load_image_targphys(filename, pm->vof ? 0 : PROM_ADDR, PROM_SIZE);
163     }
164     if (sz <= 0 || sz > PROM_SIZE) {
165         error_report("Could not load firmware '%s'", filename);
166         exit(1);
167     }
168     g_free(filename);
169     if (pm->vof) {
170         pm->vof->fw_size = sz;
171     }
172 
173     /* Marvell Discovery II system controller */
174     pm->mv = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
175                           qdev_get_gpio_in(DEVICE(pm->cpu), PPC6xx_INPUT_INT)));
176     for (i = 0; i < PCI_NUM_PINS; i++) {
177         pm->mv_pirq[i] = qdev_get_gpio_in_named(pm->mv, "gpp", 12 + i);
178     }
179     pci_bus = mv64361_get_pci_bus(pm->mv, 1);
180     pci_bus_irqs(pci_bus, pegasos2_pci_irq, pm, PCI_NUM_PINS);
181 
182     /* VIA VT8231 South Bridge (multifunction PCI device) */
183     via = OBJECT(pci_new_multifunction(PCI_DEVFN(12, 0), TYPE_VT8231_ISA));
184 
185     /* Set properties on individual devices before realizing the south bridge */
186     if (machine->audiodev) {
187         dev = PCI_DEVICE(object_resolve_path_component(via, "ac97"));
188         qdev_prop_set_string(DEVICE(dev), "audiodev", machine->audiodev);
189     }
190 
191     pci_realize_and_unref(PCI_DEVICE(via), pci_bus, &error_abort);
192     for (i = 0; i < PCI_NUM_PINS; i++) {
193         pm->via_pirq[i] = qdev_get_gpio_in_named(DEVICE(via), "pirq", i);
194     }
195     object_property_add_alias(OBJECT(machine), "rtc-time",
196                               object_resolve_path_component(via, "rtc"),
197                               "date");
198     qdev_connect_gpio_out(DEVICE(via), 0,
199                           qdev_get_gpio_in_named(pm->mv, "gpp", 31));
200 
201     dev = PCI_DEVICE(object_resolve_path_component(via, "ide"));
202     pci_ide_create_devs(dev);
203 
204     dev = PCI_DEVICE(object_resolve_path_component(via, "pm"));
205     i2c_bus = I2C_BUS(qdev_get_child_bus(DEVICE(dev), "i2c"));
206     spd_data = spd_data_generate(DDR, machine->ram_size);
207     smbus_eeprom_init_one(i2c_bus, 0x57, spd_data);
208 
209     /* other PC hardware */
210     pci_vga_init(pci_bus);
211 
212     if (machine->kernel_filename) {
213         sz = load_elf(machine->kernel_filename, NULL, NULL, NULL,
214                       &pm->kernel_entry, &pm->kernel_addr, NULL, NULL, 1,
215                       PPC_ELF_MACHINE, 0, 0);
216         if (sz <= 0) {
217             error_report("Could not load kernel '%s'",
218                          machine->kernel_filename);
219             exit(1);
220         }
221         pm->kernel_size = sz;
222         if (!pm->vof) {
223             warn_report("Option -kernel may be ineffective with -bios.");
224         }
225     } else if (pm->vof && !qtest_enabled()) {
226         warn_report("Using Virtual OpenFirmware but no -kernel option.");
227     }
228 
229     if (machine->initrd_filename) {
230         pm->initrd_addr = pm->kernel_addr + pm->kernel_size + 64 * KiB;
231         pm->initrd_addr = ROUND_UP(pm->initrd_addr, 4);
232         pm->initrd_addr = MAX(pm->initrd_addr, INITRD_MIN_ADDR);
233         sz = load_image_targphys(machine->initrd_filename, pm->initrd_addr,
234                                  machine->ram_size - pm->initrd_addr);
235         if (sz <= 0) {
236             error_report("Could not load initrd '%s'",
237                          machine->initrd_filename);
238             exit(1);
239         }
240         pm->initrd_size = sz;
241     }
242 
243     if (!pm->vof && machine->kernel_cmdline && machine->kernel_cmdline[0]) {
244         warn_report("Option -append may be ineffective with -bios.");
245     }
246 }
247 
248 static uint32_t pegasos2_mv_reg_read(Pegasos2MachineState *pm,
249                                      uint32_t addr, uint32_t len)
250 {
251     MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->mv), 0);
252     uint64_t val = 0xffffffffULL;
253     memory_region_dispatch_read(r, addr, &val, size_memop(len) | MO_LE,
254                                 MEMTXATTRS_UNSPECIFIED);
255     return val;
256 }
257 
258 static void pegasos2_mv_reg_write(Pegasos2MachineState *pm, uint32_t addr,
259                                   uint32_t len, uint32_t val)
260 {
261     MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->mv), 0);
262     memory_region_dispatch_write(r, addr, val, size_memop(len) | MO_LE,
263                                  MEMTXATTRS_UNSPECIFIED);
264 }
265 
266 static uint32_t pegasos2_pci_config_read(Pegasos2MachineState *pm, int bus,
267                                          uint32_t addr, uint32_t len)
268 {
269     hwaddr pcicfg = bus ? PCI1_CFG_ADDR : PCI0_CFG_ADDR;
270     uint64_t val = 0xffffffffULL;
271 
272     if (len <= 4) {
273         pegasos2_mv_reg_write(pm, pcicfg, 4, addr | BIT(31));
274         val = pegasos2_mv_reg_read(pm, pcicfg + 4, len);
275     }
276     return val;
277 }
278 
279 static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
280                                       uint32_t addr, uint32_t len, uint32_t val)
281 {
282     hwaddr pcicfg = bus ? PCI1_CFG_ADDR : PCI0_CFG_ADDR;
283 
284     pegasos2_mv_reg_write(pm, pcicfg, 4, addr | BIT(31));
285     pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
286 }
287 
288 static void pegasos2_superio_write(uint8_t addr, uint8_t val)
289 {
290     cpu_physical_memory_write(PCI1_IO_BASE + 0x3f0, &addr, 1);
291     cpu_physical_memory_write(PCI1_IO_BASE + 0x3f1, &val, 1);
292 }
293 
294 static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
295 {
296     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
297     void *fdt;
298     uint64_t d[2];
299     int sz;
300 
301     qemu_devices_reset(reason);
302     if (!pm->vof) {
303         return; /* Firmware should set up machine so nothing to do */
304     }
305 
306     /* Otherwise, set up devices that board firmware would normally do */
307     pegasos2_mv_reg_write(pm, 0, 4, 0x28020ff);
308     pegasos2_mv_reg_write(pm, 0x278, 4, 0xa31fc);
309     pegasos2_mv_reg_write(pm, 0xf300, 4, 0x11ff0400);
310     pegasos2_mv_reg_write(pm, 0xf10c, 4, 0x80000000);
311     pegasos2_mv_reg_write(pm, 0x1c, 4, 0x8000000);
312     pegasos2_pci_config_write(pm, 0, PCI_COMMAND, 2, PCI_COMMAND_IO |
313                               PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
314     pegasos2_pci_config_write(pm, 1, PCI_COMMAND, 2, PCI_COMMAND_IO |
315                               PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
316 
317     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
318                               PCI_INTERRUPT_LINE, 2, 0x9);
319     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
320                               0x50, 1, 0x6);
321     pegasos2_superio_write(0xf4, 0xbe);
322     pegasos2_superio_write(0xf6, 0xef);
323     pegasos2_superio_write(0xf7, 0xfc);
324     pegasos2_superio_write(0xf2, 0x14);
325     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
326                               0x50, 1, 0x2);
327     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
328                               0x55, 1, 0x90);
329     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
330                               0x56, 1, 0x99);
331     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
332                               0x57, 1, 0x90);
333 
334     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
335                               PCI_INTERRUPT_LINE, 2, 0x109);
336     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
337                               PCI_CLASS_PROG, 1, 0xf);
338     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
339                               0x40, 1, 0xb);
340     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
341                               0x50, 4, 0x17171717);
342     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
343                               PCI_COMMAND, 2, 0x87);
344 
345     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 2) << 8) |
346                               PCI_INTERRUPT_LINE, 2, 0x409);
347     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 2) << 8) |
348                               PCI_COMMAND, 2, 0x7);
349 
350     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 3) << 8) |
351                               PCI_INTERRUPT_LINE, 2, 0x409);
352     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 3) << 8) |
353                               PCI_COMMAND, 2, 0x7);
354 
355     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
356                               PCI_INTERRUPT_LINE, 2, 0x9);
357     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
358                               0x48, 4, 0xf00);
359     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
360                               0x40, 4, 0x558020);
361     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
362                               0x90, 4, 0xd00);
363 
364     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 5) << 8) |
365                               PCI_INTERRUPT_LINE, 2, 0x309);
366 
367     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 6) << 8) |
368                               PCI_INTERRUPT_LINE, 2, 0x309);
369 
370     /* Device tree and VOF set up */
371     vof_init(pm->vof, machine->ram_size, &error_fatal);
372     if (vof_claim(pm->vof, 0, VOF_STACK_SIZE, VOF_STACK_SIZE) == -1) {
373         error_report("Memory allocation for stack failed");
374         exit(1);
375     }
376     if (pm->kernel_size &&
377         vof_claim(pm->vof, pm->kernel_addr, pm->kernel_size, 0) == -1) {
378         error_report("Memory for kernel is in use");
379         exit(1);
380     }
381     if (pm->initrd_size &&
382         vof_claim(pm->vof, pm->initrd_addr, pm->initrd_size, 0) == -1) {
383         error_report("Memory for initrd is in use");
384         exit(1);
385     }
386     fdt = build_fdt(machine, &sz);
387     /* FIXME: VOF assumes entry is same as load address */
388     d[0] = cpu_to_be64(pm->kernel_entry);
389     d[1] = cpu_to_be64(pm->kernel_size - (pm->kernel_entry - pm->kernel_addr));
390     qemu_fdt_setprop(fdt, "/chosen", "qemu,boot-kernel", d, sizeof(d));
391 
392     qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
393     g_free(pm->fdt_blob);
394     pm->fdt_blob = fdt;
395 
396     vof_build_dt(fdt, pm->vof);
397     vof_client_open_store(fdt, pm->vof, "/chosen", "stdout", "/failsafe");
398 
399     /* Set machine->fdt for 'dumpdtb' QMP/HMP command */
400     machine->fdt = fdt;
401 
402     pm->cpu->vhyp = PPC_VIRTUAL_HYPERVISOR(machine);
403 }
404 
405 enum pegasos2_rtas_tokens {
406     RTAS_RESTART_RTAS = 0,
407     RTAS_NVRAM_FETCH = 1,
408     RTAS_NVRAM_STORE = 2,
409     RTAS_GET_TIME_OF_DAY = 3,
410     RTAS_SET_TIME_OF_DAY = 4,
411     RTAS_EVENT_SCAN = 6,
412     RTAS_CHECK_EXCEPTION = 7,
413     RTAS_READ_PCI_CONFIG = 8,
414     RTAS_WRITE_PCI_CONFIG = 9,
415     RTAS_DISPLAY_CHARACTER = 10,
416     RTAS_SET_INDICATOR = 11,
417     RTAS_POWER_OFF = 17,
418     RTAS_SUSPEND = 18,
419     RTAS_HIBERNATE = 19,
420     RTAS_SYSTEM_REBOOT = 20,
421 };
422 
423 static target_ulong pegasos2_rtas(PowerPCCPU *cpu, Pegasos2MachineState *pm,
424                                   target_ulong args_real)
425 {
426     AddressSpace *as = CPU(cpu)->as;
427     uint32_t token = ldl_be_phys(as, args_real);
428     uint32_t nargs = ldl_be_phys(as, args_real + 4);
429     uint32_t nrets = ldl_be_phys(as, args_real + 8);
430     uint32_t args = args_real + 12;
431     uint32_t rets = args_real + 12 + nargs * 4;
432 
433     if (nrets < 1) {
434         qemu_log_mask(LOG_GUEST_ERROR, "Too few return values in RTAS call\n");
435         return H_PARAMETER;
436     }
437     switch (token) {
438     case RTAS_GET_TIME_OF_DAY:
439     {
440         QObject *qo = object_property_get_qobject(qdev_get_machine(),
441                                                   "rtc-time", &error_fatal);
442         QDict *qd = qobject_to(QDict, qo);
443 
444         if (nargs != 0 || nrets != 8 || !qd) {
445             stl_be_phys(as, rets, -1);
446             qobject_unref(qo);
447             return H_PARAMETER;
448         }
449 
450         stl_be_phys(as, rets, 0);
451         stl_be_phys(as, rets + 4, qdict_get_int(qd, "tm_year") + 1900);
452         stl_be_phys(as, rets + 8, qdict_get_int(qd, "tm_mon") + 1);
453         stl_be_phys(as, rets + 12, qdict_get_int(qd, "tm_mday"));
454         stl_be_phys(as, rets + 16, qdict_get_int(qd, "tm_hour"));
455         stl_be_phys(as, rets + 20, qdict_get_int(qd, "tm_min"));
456         stl_be_phys(as, rets + 24, qdict_get_int(qd, "tm_sec"));
457         stl_be_phys(as, rets + 28, 0);
458         qobject_unref(qo);
459         return H_SUCCESS;
460     }
461     case RTAS_READ_PCI_CONFIG:
462     {
463         uint32_t addr, len, val;
464 
465         if (nargs != 2 || nrets != 2) {
466             stl_be_phys(as, rets, -1);
467             return H_PARAMETER;
468         }
469         addr = ldl_be_phys(as, args);
470         len = ldl_be_phys(as, args + 4);
471         val = pegasos2_pci_config_read(pm, !(addr >> 24),
472                                        addr & 0x0fffffff, len);
473         stl_be_phys(as, rets, 0);
474         stl_be_phys(as, rets + 4, val);
475         return H_SUCCESS;
476     }
477     case RTAS_WRITE_PCI_CONFIG:
478     {
479         uint32_t addr, len, val;
480 
481         if (nargs != 3 || nrets != 1) {
482             stl_be_phys(as, rets, -1);
483             return H_PARAMETER;
484         }
485         addr = ldl_be_phys(as, args);
486         len = ldl_be_phys(as, args + 4);
487         val = ldl_be_phys(as, args + 8);
488         pegasos2_pci_config_write(pm, !(addr >> 24),
489                                   addr & 0x0fffffff, len, val);
490         stl_be_phys(as, rets, 0);
491         return H_SUCCESS;
492     }
493     case RTAS_DISPLAY_CHARACTER:
494         if (nargs != 1 || nrets != 1) {
495             stl_be_phys(as, rets, -1);
496             return H_PARAMETER;
497         }
498         qemu_log_mask(LOG_UNIMP, "%c", ldl_be_phys(as, args));
499         stl_be_phys(as, rets, 0);
500         return H_SUCCESS;
501     case RTAS_POWER_OFF:
502     {
503         if (nargs != 2 || nrets != 1) {
504             stl_be_phys(as, rets, -1);
505             return H_PARAMETER;
506         }
507         qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
508         stl_be_phys(as, rets, 0);
509         return H_SUCCESS;
510     }
511     default:
512         qemu_log_mask(LOG_UNIMP, "Unknown RTAS token %u (args=%u, rets=%u)\n",
513                       token, nargs, nrets);
514         stl_be_phys(as, rets, 0);
515         return H_SUCCESS;
516     }
517 }
518 
519 static bool pegasos2_cpu_in_nested(PowerPCCPU *cpu)
520 {
521     return false;
522 }
523 
524 static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
525 {
526     Pegasos2MachineState *pm = PEGASOS2_MACHINE(vhyp);
527     CPUPPCState *env = &cpu->env;
528 
529     /* The TCG path should also be holding the BQL at this point */
530     g_assert(bql_locked());
531 
532     if (FIELD_EX64(env->msr, MSR, PR)) {
533         qemu_log_mask(LOG_GUEST_ERROR, "Hypercall made with MSR[PR]=1\n");
534         env->gpr[3] = H_PRIVILEGE;
535     } else if (env->gpr[3] == KVMPPC_H_RTAS) {
536         env->gpr[3] = pegasos2_rtas(cpu, pm, env->gpr[4]);
537     } else if (env->gpr[3] == KVMPPC_H_VOF_CLIENT) {
538         int ret = vof_client_call(MACHINE(pm), pm->vof, pm->fdt_blob,
539                                   env->gpr[4]);
540         env->gpr[3] = (ret ? H_PARAMETER : H_SUCCESS);
541     } else {
542         qemu_log_mask(LOG_GUEST_ERROR, "Unsupported hypercall " TARGET_FMT_lx
543                       "\n", env->gpr[3]);
544         env->gpr[3] = -1;
545     }
546 }
547 
548 static void vhyp_nop(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
549 {
550 }
551 
552 static target_ulong vhyp_encode_hpt_for_kvm_pr(PPCVirtualHypervisor *vhyp)
553 {
554     return POWERPC_CPU(current_cpu)->env.spr[SPR_SDR1];
555 }
556 
557 static bool pegasos2_setprop(MachineState *ms, const char *path,
558                              const char *propname, void *val, int vallen)
559 {
560     return true;
561 }
562 
563 static void pegasos2_machine_class_init(ObjectClass *oc, void *data)
564 {
565     MachineClass *mc = MACHINE_CLASS(oc);
566     PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(oc);
567     VofMachineIfClass *vmc = VOF_MACHINE_CLASS(oc);
568 
569     mc->desc = "Genesi/bPlan Pegasos II";
570     mc->init = pegasos2_init;
571     mc->reset = pegasos2_machine_reset;
572     mc->block_default_type = IF_IDE;
573     mc->default_boot_order = "cd";
574     mc->default_display = "std";
575     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("7457_v1.2");
576     mc->default_ram_id = "pegasos2.ram";
577     mc->default_ram_size = 512 * MiB;
578     machine_add_audiodev_property(mc);
579 
580     vhc->cpu_in_nested = pegasos2_cpu_in_nested;
581     vhc->hypercall = pegasos2_hypercall;
582     vhc->cpu_exec_enter = vhyp_nop;
583     vhc->cpu_exec_exit = vhyp_nop;
584     vhc->encode_hpt_for_kvm_pr = vhyp_encode_hpt_for_kvm_pr;
585 
586     vmc->setprop = pegasos2_setprop;
587 }
588 
589 static const TypeInfo pegasos2_machine_info = {
590     .name          = TYPE_PEGASOS2_MACHINE,
591     .parent        = TYPE_MACHINE,
592     .class_init    = pegasos2_machine_class_init,
593     .instance_size = sizeof(Pegasos2MachineState),
594     .interfaces = (InterfaceInfo[]) {
595         { TYPE_PPC_VIRTUAL_HYPERVISOR },
596         { TYPE_VOF_MACHINE_IF },
597         { }
598     },
599 };
600 
601 static void pegasos2_machine_register_types(void)
602 {
603     type_register_static(&pegasos2_machine_info);
604 }
605 
606 type_init(pegasos2_machine_register_types)
607 
608 /* FDT creation for passing to firmware */
609 
610 typedef struct {
611     void *fdt;
612     const char *path;
613 } FDTInfo;
614 
615 /* We do everything in reverse order so it comes out right in the tree */
616 
617 static void dt_ide(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
618 {
619     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "spi");
620 }
621 
622 static void dt_usb(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
623 {
624     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#size-cells", 0);
625     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#address-cells", 1);
626     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "usb");
627 }
628 
629 static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
630 {
631     GString *name = g_string_sized_new(64);
632     uint32_t cells[3];
633 
634     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#size-cells", 1);
635     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#address-cells", 2);
636     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "isa");
637     qemu_fdt_setprop_string(fi->fdt, fi->path, "name", "isa");
638 
639     /* additional devices */
640     g_string_printf(name, "%s/lpt@i3bc", fi->path);
641     qemu_fdt_add_subnode(fi->fdt, name->str);
642     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
643     cells[0] = cpu_to_be32(7);
644     cells[1] = 0;
645     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
646                      cells, 2 * sizeof(cells[0]));
647     cells[0] = cpu_to_be32(1);
648     cells[1] = cpu_to_be32(0x3bc);
649     cells[2] = cpu_to_be32(8);
650     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
651     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "lpt");
652     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "lpt");
653 
654     g_string_printf(name, "%s/fdc@i3f0", fi->path);
655     qemu_fdt_add_subnode(fi->fdt, name->str);
656     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
657     cells[0] = cpu_to_be32(6);
658     cells[1] = 0;
659     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
660                      cells, 2 * sizeof(cells[0]));
661     cells[0] = cpu_to_be32(1);
662     cells[1] = cpu_to_be32(0x3f0);
663     cells[2] = cpu_to_be32(8);
664     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
665     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "fdc");
666     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "fdc");
667 
668     g_string_printf(name, "%s/timer@i40", fi->path);
669     qemu_fdt_add_subnode(fi->fdt, name->str);
670     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
671     cells[0] = cpu_to_be32(1);
672     cells[1] = cpu_to_be32(0x40);
673     cells[2] = cpu_to_be32(8);
674     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
675     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "timer");
676     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "timer");
677 
678     g_string_printf(name, "%s/rtc@i70", fi->path);
679     qemu_fdt_add_subnode(fi->fdt, name->str);
680     qemu_fdt_setprop_string(fi->fdt, name->str, "compatible", "ds1385-rtc");
681     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
682     cells[0] = cpu_to_be32(8);
683     cells[1] = 0;
684     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
685                      cells, 2 * sizeof(cells[0]));
686     cells[0] = cpu_to_be32(1);
687     cells[1] = cpu_to_be32(0x70);
688     cells[2] = cpu_to_be32(2);
689     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
690     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "rtc");
691     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "rtc");
692 
693     g_string_printf(name, "%s/keyboard@i60", fi->path);
694     qemu_fdt_add_subnode(fi->fdt, name->str);
695     cells[0] = cpu_to_be32(1);
696     cells[1] = 0;
697     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
698                      cells, 2 * sizeof(cells[0]));
699     cells[0] = cpu_to_be32(1);
700     cells[1] = cpu_to_be32(0x60);
701     cells[2] = cpu_to_be32(5);
702     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
703     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "keyboard");
704     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "keyboard");
705 
706     g_string_printf(name, "%s/8042@i60", fi->path);
707     qemu_fdt_add_subnode(fi->fdt, name->str);
708     qemu_fdt_setprop_cell(fi->fdt, name->str, "#interrupt-cells", 2);
709     qemu_fdt_setprop_cell(fi->fdt, name->str, "#size-cells", 0);
710     qemu_fdt_setprop_cell(fi->fdt, name->str, "#address-cells", 1);
711     qemu_fdt_setprop_string(fi->fdt, name->str, "interrupt-controller", "");
712     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
713     cells[0] = cpu_to_be32(1);
714     cells[1] = cpu_to_be32(0x60);
715     cells[2] = cpu_to_be32(5);
716     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
717     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "");
718     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "8042");
719 
720     g_string_printf(name, "%s/serial@i2f8", fi->path);
721     qemu_fdt_add_subnode(fi->fdt, name->str);
722     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
723     cells[0] = cpu_to_be32(3);
724     cells[1] = 0;
725     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
726                      cells, 2 * sizeof(cells[0]));
727     cells[0] = cpu_to_be32(1);
728     cells[1] = cpu_to_be32(0x2f8);
729     cells[2] = cpu_to_be32(8);
730     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
731     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "serial");
732     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "serial");
733 
734     g_string_free(name, TRUE);
735 }
736 
737 static struct {
738     const char *id;
739     const char *name;
740     void (*dtf)(PCIBus *bus, PCIDevice *d, FDTInfo *fi);
741 } device_map[] = {
742     { "pci11ab,6460", "host", NULL },
743     { "pci1106,8231", "isa", dt_isa },
744     { "pci1106,571", "ide", dt_ide },
745     { "pci1106,3044", "firewire", NULL },
746     { "pci1106,3038", "usb", dt_usb },
747     { "pci1106,8235", "other", NULL },
748     { "pci1106,3058", "sound", NULL },
749     { NULL, NULL }
750 };
751 
752 static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
753 {
754     FDTInfo *fi = opaque;
755     GString *node = g_string_new(NULL);
756     uint32_t cells[(PCI_NUM_REGIONS + 1) * 5];
757     int i, j;
758     const char *name = NULL;
759     g_autofree const gchar *pn = g_strdup_printf("pci%x,%x",
760                                      pci_get_word(&d->config[PCI_VENDOR_ID]),
761                                      pci_get_word(&d->config[PCI_DEVICE_ID]));
762 
763     if (pci_get_word(&d->config[PCI_CLASS_DEVICE])  ==
764         PCI_CLASS_NETWORK_ETHERNET) {
765         name = "ethernet";
766     } else if (pci_get_word(&d->config[PCI_CLASS_DEVICE]) >> 8 ==
767         PCI_BASE_CLASS_DISPLAY) {
768         name = "display";
769     }
770     for (i = 0; device_map[i].id; i++) {
771         if (!strcmp(pn, device_map[i].id)) {
772             name = device_map[i].name;
773             break;
774         }
775     }
776     g_string_printf(node, "%s/%s@%x", fi->path, (name ?: pn),
777                     PCI_SLOT(d->devfn));
778     if (PCI_FUNC(d->devfn)) {
779         g_string_append_printf(node, ",%x", PCI_FUNC(d->devfn));
780     }
781 
782     qemu_fdt_add_subnode(fi->fdt, node->str);
783     if (device_map[i].dtf) {
784         FDTInfo cfi = { fi->fdt, node->str };
785         device_map[i].dtf(bus, d, &cfi);
786     }
787     cells[0] = cpu_to_be32(d->devfn << 8);
788     cells[1] = 0;
789     cells[2] = 0;
790     cells[3] = 0;
791     cells[4] = 0;
792     j = 5;
793     for (i = 0; i < PCI_NUM_REGIONS; i++) {
794         if (!d->io_regions[i].size) {
795             continue;
796         }
797         cells[j] = PCI_BASE_ADDRESS_0 + i * 4;
798         if (cells[j] == 0x28) {
799             cells[j] = 0x30;
800         }
801         cells[j] = cpu_to_be32(d->devfn << 8 | cells[j]);
802         if (d->io_regions[i].type & PCI_BASE_ADDRESS_SPACE_IO) {
803             cells[j] |= cpu_to_be32(1 << 24);
804         } else {
805             if (d->io_regions[i].type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
806                 cells[j] |= cpu_to_be32(3 << 24);
807             } else {
808                 cells[j] |= cpu_to_be32(2 << 24);
809             }
810             if (d->io_regions[i].type & PCI_BASE_ADDRESS_MEM_PREFETCH) {
811                 cells[j] |= cpu_to_be32(4 << 28);
812             }
813         }
814         cells[j + 1] = 0;
815         cells[j + 2] = 0;
816         cells[j + 3] = cpu_to_be32(d->io_regions[i].size >> 32);
817         cells[j + 4] = cpu_to_be32(d->io_regions[i].size);
818         j += 5;
819     }
820     qemu_fdt_setprop(fi->fdt, node->str, "reg", cells, j * sizeof(cells[0]));
821     qemu_fdt_setprop_string(fi->fdt, node->str, "name", name ?: pn);
822     if (pci_get_byte(&d->config[PCI_INTERRUPT_PIN])) {
823         qemu_fdt_setprop_cell(fi->fdt, node->str, "interrupts",
824                               pci_get_byte(&d->config[PCI_INTERRUPT_PIN]));
825     }
826     /* Pegasos2 firmware has subsystem-id amd subsystem-vendor-id swapped */
827     qemu_fdt_setprop_cell(fi->fdt, node->str, "subsystem-vendor-id",
828                           pci_get_word(&d->config[PCI_SUBSYSTEM_ID]));
829     qemu_fdt_setprop_cell(fi->fdt, node->str, "subsystem-id",
830                           pci_get_word(&d->config[PCI_SUBSYSTEM_VENDOR_ID]));
831     cells[0] = pci_get_long(&d->config[PCI_CLASS_REVISION]);
832     qemu_fdt_setprop_cell(fi->fdt, node->str, "class-code", cells[0] >> 8);
833     qemu_fdt_setprop_cell(fi->fdt, node->str, "revision-id", cells[0] & 0xff);
834     qemu_fdt_setprop_cell(fi->fdt, node->str, "device-id",
835                           pci_get_word(&d->config[PCI_DEVICE_ID]));
836     qemu_fdt_setprop_cell(fi->fdt, node->str, "vendor-id",
837                           pci_get_word(&d->config[PCI_VENDOR_ID]));
838 
839     g_string_free(node, TRUE);
840 }
841 
842 static void *build_fdt(MachineState *machine, int *fdt_size)
843 {
844     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
845     PowerPCCPU *cpu = pm->cpu;
846     PCIBus *pci_bus;
847     FDTInfo fi;
848     uint32_t cells[16];
849     void *fdt = create_device_tree(fdt_size);
850 
851     fi.fdt = fdt;
852 
853     /* root node */
854     qemu_fdt_setprop_string(fdt, "/", "CODEGEN,description",
855                             "Pegasos CHRP PowerPC System");
856     qemu_fdt_setprop_string(fdt, "/", "CODEGEN,board", "Pegasos2");
857     qemu_fdt_setprop_string(fdt, "/", "CODEGEN,vendor", "bplan GmbH");
858     qemu_fdt_setprop_string(fdt, "/", "revision", "2B");
859     qemu_fdt_setprop_string(fdt, "/", "model", "Pegasos2");
860     qemu_fdt_setprop_string(fdt, "/", "device_type", "chrp");
861     qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 1);
862     qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos2");
863 
864     /* pci@c0000000 */
865     qemu_fdt_add_subnode(fdt, "/pci@c0000000");
866     cells[0] = 0;
867     cells[1] = 0;
868     qemu_fdt_setprop(fdt, "/pci@c0000000", "bus-range",
869                      cells, 2 * sizeof(cells[0]));
870     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "pci-bridge-number", 1);
871     cells[0] = cpu_to_be32(PCI0_MEM_BASE);
872     cells[1] = cpu_to_be32(PCI0_MEM_SIZE);
873     qemu_fdt_setprop(fdt, "/pci@c0000000", "reg", cells, 2 * sizeof(cells[0]));
874     cells[0] = cpu_to_be32(0x01000000);
875     cells[1] = 0;
876     cells[2] = 0;
877     cells[3] = cpu_to_be32(PCI0_IO_BASE);
878     cells[4] = 0;
879     cells[5] = cpu_to_be32(PCI0_IO_SIZE);
880     cells[6] = cpu_to_be32(0x02000000);
881     cells[7] = 0;
882     cells[8] = cpu_to_be32(PCI0_MEM_BASE);
883     cells[9] = cpu_to_be32(PCI0_MEM_BASE);
884     cells[10] = 0;
885     cells[11] = cpu_to_be32(PCI0_MEM_SIZE);
886     qemu_fdt_setprop(fdt, "/pci@c0000000", "ranges",
887                      cells, 12 * sizeof(cells[0]));
888     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#size-cells", 2);
889     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#address-cells", 3);
890     qemu_fdt_setprop_string(fdt, "/pci@c0000000", "device_type", "pci");
891     qemu_fdt_setprop_string(fdt, "/pci@c0000000", "name", "pci");
892 
893     fi.path = "/pci@c0000000";
894     pci_bus = mv64361_get_pci_bus(pm->mv, 0);
895     pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
896 
897     /* pci@80000000 */
898     qemu_fdt_add_subnode(fdt, "/pci@80000000");
899     cells[0] = 0;
900     cells[1] = 0;
901     qemu_fdt_setprop(fdt, "/pci@80000000", "bus-range",
902                      cells, 2 * sizeof(cells[0]));
903     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "pci-bridge-number", 0);
904     cells[0] = cpu_to_be32(PCI1_MEM_BASE);
905     cells[1] = cpu_to_be32(PCI1_MEM_SIZE);
906     qemu_fdt_setprop(fdt, "/pci@80000000", "reg", cells, 2 * sizeof(cells[0]));
907     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "8259-interrupt-acknowledge",
908                           0xf1000cb4);
909     cells[0] = cpu_to_be32(0x01000000);
910     cells[1] = 0;
911     cells[2] = 0;
912     cells[3] = cpu_to_be32(PCI1_IO_BASE);
913     cells[4] = 0;
914     cells[5] = cpu_to_be32(PCI1_IO_SIZE);
915     cells[6] = cpu_to_be32(0x02000000);
916     cells[7] = 0;
917     cells[8] = cpu_to_be32(PCI1_MEM_BASE);
918     cells[9] = cpu_to_be32(PCI1_MEM_BASE);
919     cells[10] = 0;
920     cells[11] = cpu_to_be32(PCI1_MEM_SIZE);
921     qemu_fdt_setprop(fdt, "/pci@80000000", "ranges",
922                      cells, 12 * sizeof(cells[0]));
923     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#size-cells", 2);
924     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#address-cells", 3);
925     qemu_fdt_setprop_string(fdt, "/pci@80000000", "device_type", "pci");
926     qemu_fdt_setprop_string(fdt, "/pci@80000000", "name", "pci");
927 
928     fi.path = "/pci@80000000";
929     pci_bus = mv64361_get_pci_bus(pm->mv, 1);
930     pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
931 
932     qemu_fdt_add_subnode(fdt, "/failsafe");
933     qemu_fdt_setprop_string(fdt, "/failsafe", "device_type", "serial");
934     qemu_fdt_setprop_string(fdt, "/failsafe", "name", "failsafe");
935 
936     qemu_fdt_add_subnode(fdt, "/rtas");
937     qemu_fdt_setprop_cell(fdt, "/rtas", "system-reboot", RTAS_SYSTEM_REBOOT);
938     qemu_fdt_setprop_cell(fdt, "/rtas", "hibernate", RTAS_HIBERNATE);
939     qemu_fdt_setprop_cell(fdt, "/rtas", "suspend", RTAS_SUSPEND);
940     qemu_fdt_setprop_cell(fdt, "/rtas", "power-off", RTAS_POWER_OFF);
941     qemu_fdt_setprop_cell(fdt, "/rtas", "set-indicator", RTAS_SET_INDICATOR);
942     qemu_fdt_setprop_cell(fdt, "/rtas", "display-character",
943                           RTAS_DISPLAY_CHARACTER);
944     qemu_fdt_setprop_cell(fdt, "/rtas", "write-pci-config",
945                           RTAS_WRITE_PCI_CONFIG);
946     qemu_fdt_setprop_cell(fdt, "/rtas", "read-pci-config",
947                           RTAS_READ_PCI_CONFIG);
948     /* Pegasos2 firmware misspells check-exception and guests use that */
949     qemu_fdt_setprop_cell(fdt, "/rtas", "check-execption",
950                           RTAS_CHECK_EXCEPTION);
951     qemu_fdt_setprop_cell(fdt, "/rtas", "event-scan", RTAS_EVENT_SCAN);
952     qemu_fdt_setprop_cell(fdt, "/rtas", "set-time-of-day",
953                           RTAS_SET_TIME_OF_DAY);
954     qemu_fdt_setprop_cell(fdt, "/rtas", "get-time-of-day",
955                           RTAS_GET_TIME_OF_DAY);
956     qemu_fdt_setprop_cell(fdt, "/rtas", "nvram-store", RTAS_NVRAM_STORE);
957     qemu_fdt_setprop_cell(fdt, "/rtas", "nvram-fetch", RTAS_NVRAM_FETCH);
958     qemu_fdt_setprop_cell(fdt, "/rtas", "restart-rtas", RTAS_RESTART_RTAS);
959     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-error-log-max", 0);
960     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-event-scan-rate", 0);
961     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-display-device", 0);
962     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-size", 20);
963     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-version", 1);
964     qemu_fdt_setprop_string(fdt, "/rtas", "name", "rtas");
965 
966     /* cpus */
967     qemu_fdt_add_subnode(fdt, "/cpus");
968     qemu_fdt_setprop_cell(fdt, "/cpus", "#cpus", 1);
969     qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 1);
970     qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0);
971     qemu_fdt_setprop_string(fdt, "/cpus", "name", "cpus");
972 
973     /* FIXME Get CPU name from CPU object */
974     const char *cp = "/cpus/PowerPC,G4";
975     qemu_fdt_add_subnode(fdt, cp);
976     qemu_fdt_setprop_cell(fdt, cp, "l2cr", 0);
977     qemu_fdt_setprop_cell(fdt, cp, "d-cache-size", 0x8000);
978     qemu_fdt_setprop_cell(fdt, cp, "d-cache-block-size",
979                           cpu->env.dcache_line_size);
980     qemu_fdt_setprop_cell(fdt, cp, "d-cache-line-size",
981                           cpu->env.dcache_line_size);
982     qemu_fdt_setprop_cell(fdt, cp, "i-cache-size", 0x8000);
983     qemu_fdt_setprop_cell(fdt, cp, "i-cache-block-size",
984                           cpu->env.icache_line_size);
985     qemu_fdt_setprop_cell(fdt, cp, "i-cache-line-size",
986                           cpu->env.icache_line_size);
987     if (cpu->env.id_tlbs) {
988         qemu_fdt_setprop_cell(fdt, cp, "i-tlb-sets", cpu->env.nb_ways);
989         qemu_fdt_setprop_cell(fdt, cp, "i-tlb-size", cpu->env.tlb_per_way);
990         qemu_fdt_setprop_cell(fdt, cp, "d-tlb-sets", cpu->env.nb_ways);
991         qemu_fdt_setprop_cell(fdt, cp, "d-tlb-size", cpu->env.tlb_per_way);
992         qemu_fdt_setprop_string(fdt, cp, "tlb-split", "");
993     }
994     qemu_fdt_setprop_cell(fdt, cp, "tlb-sets", cpu->env.nb_ways);
995     qemu_fdt_setprop_cell(fdt, cp, "tlb-size", cpu->env.nb_tlb);
996     qemu_fdt_setprop_string(fdt, cp, "state", "running");
997     if (cpu->env.insns_flags & PPC_ALTIVEC) {
998         qemu_fdt_setprop_string(fdt, cp, "altivec", "");
999         qemu_fdt_setprop_string(fdt, cp, "data-streams", "");
1000     }
1001     /*
1002      * FIXME What flags do data-streams, external-control and
1003      * performance-monitor depend on?
1004      */
1005     qemu_fdt_setprop_string(fdt, cp, "external-control", "");
1006     if (cpu->env.insns_flags & PPC_FLOAT_FSQRT) {
1007         qemu_fdt_setprop_string(fdt, cp, "general-purpose", "");
1008     }
1009     qemu_fdt_setprop_string(fdt, cp, "performance-monitor", "");
1010     if (cpu->env.insns_flags & PPC_FLOAT_FRES) {
1011         qemu_fdt_setprop_string(fdt, cp, "graphics", "");
1012     }
1013     qemu_fdt_setprop_cell(fdt, cp, "reservation-granule-size", 4);
1014     qemu_fdt_setprop_cell(fdt, cp, "timebase-frequency",
1015                           cpu->env.tb_env->tb_freq);
1016     qemu_fdt_setprop_cell(fdt, cp, "bus-frequency", BUS_FREQ_HZ);
1017     qemu_fdt_setprop_cell(fdt, cp, "clock-frequency", BUS_FREQ_HZ * 7.5);
1018     qemu_fdt_setprop_cell(fdt, cp, "cpu-version", cpu->env.spr[SPR_PVR]);
1019     cells[0] = 0;
1020     cells[1] = 0;
1021     qemu_fdt_setprop(fdt, cp, "reg", cells, 2 * sizeof(cells[0]));
1022     qemu_fdt_setprop_string(fdt, cp, "device_type", "cpu");
1023     qemu_fdt_setprop_string(fdt, cp, "name", strrchr(cp, '/') + 1);
1024 
1025     /* memory */
1026     qemu_fdt_add_subnode(fdt, "/memory@0");
1027     cells[0] = 0;
1028     cells[1] = cpu_to_be32(machine->ram_size);
1029     qemu_fdt_setprop(fdt, "/memory@0", "reg", cells, 2 * sizeof(cells[0]));
1030     qemu_fdt_setprop_string(fdt, "/memory@0", "device_type", "memory");
1031     qemu_fdt_setprop_string(fdt, "/memory@0", "name", "memory");
1032 
1033     qemu_fdt_add_subnode(fdt, "/chosen");
1034     if (pm->initrd_addr && pm->initrd_size) {
1035         qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end",
1036                               pm->initrd_addr + pm->initrd_size);
1037         qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start",
1038                               pm->initrd_addr);
1039     }
1040     qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
1041                             machine->kernel_cmdline ?: "");
1042     qemu_fdt_setprop_string(fdt, "/chosen", "name", "chosen");
1043 
1044     qemu_fdt_add_subnode(fdt, "/openprom");
1045     qemu_fdt_setprop_string(fdt, "/openprom", "model", "Pegasos2,1.1");
1046 
1047     return fdt;
1048 }
1049