xref: /openbmc/qemu/hw/ppc/pegasos2.c (revision 8a2f1f921cc84cae3aa54c29e24e8c1defc9ef34)
1 /*
2  * QEMU PowerPC CHRP (Genesi/bPlan Pegasos II) hardware System Emulator
3  *
4  * Copyright (c) 2018-2021 BALATON Zoltan
5  *
6  * This work is licensed under the GNU GPL license version 2 or later.
7  *
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/units.h"
12 #include "qapi/error.h"
13 #include "hw/ppc/ppc.h"
14 #include "hw/sysbus.h"
15 #include "hw/pci/pci_host.h"
16 #include "hw/irq.h"
17 #include "hw/or-irq.h"
18 #include "hw/pci-host/mv64361.h"
19 #include "hw/isa/vt82c686.h"
20 #include "hw/ide/pci.h"
21 #include "hw/i2c/smbus_eeprom.h"
22 #include "hw/qdev-properties.h"
23 #include "system/reset.h"
24 #include "system/runstate.h"
25 #include "system/qtest.h"
26 #include "hw/boards.h"
27 #include "hw/loader.h"
28 #include "hw/fw-path-provider.h"
29 #include "elf.h"
30 #include "qemu/log.h"
31 #include "qemu/error-report.h"
32 #include "system/kvm.h"
33 #include "kvm_ppc.h"
34 #include "exec/address-spaces.h"
35 #include "qom/qom-qobject.h"
36 #include "qobject/qdict.h"
37 #include "trace.h"
38 #include "qemu/datadir.h"
39 #include "system/device_tree.h"
40 #include "hw/ppc/vof.h"
41 
42 #include <libfdt.h>
43 
44 #define PROM_FILENAME "vof.bin"
45 #define PROM_ADDR     0xfff00000
46 #define PROM_SIZE     0x80000
47 
48 #define INITRD_MIN_ADDR 0x600000
49 
50 #define KVMPPC_HCALL_BASE    0xf000
51 #define KVMPPC_H_RTAS        (KVMPPC_HCALL_BASE + 0x0)
52 #define KVMPPC_H_VOF_CLIENT  (KVMPPC_HCALL_BASE + 0x5)
53 
54 #define H_SUCCESS     0
55 #define H_PRIVILEGE  -3  /* Caller not privileged */
56 #define H_PARAMETER  -4  /* Parameter invalid, out-of-range or conflicting */
57 
58 #define BUS_FREQ_HZ 133333333
59 
60 #define PCI0_CFG_ADDR 0xcf8
61 #define PCI0_MEM_BASE 0xc0000000
62 #define PCI0_MEM_SIZE 0x20000000
63 #define PCI0_IO_BASE  0xf8000000
64 #define PCI0_IO_SIZE  0x10000
65 
66 #define PCI1_CFG_ADDR 0xc78
67 #define PCI1_MEM_BASE 0x80000000
68 #define PCI1_MEM_SIZE 0x40000000
69 #define PCI1_IO_BASE  0xfe000000
70 #define PCI1_IO_SIZE  0x10000
71 
72 #define TYPE_PEGASOS2_MACHINE  MACHINE_TYPE_NAME("pegasos2")
73 OBJECT_DECLARE_TYPE(Pegasos2MachineState, MachineClass, PEGASOS2_MACHINE)
74 
75 struct Pegasos2MachineState {
76     MachineState parent_obj;
77 
78     PowerPCCPU *cpu;
79     DeviceState *mv;
80     IRQState pci_irqs[PCI_NUM_PINS];
81     OrIRQState orirq[PCI_NUM_PINS];
82     qemu_irq mv_pirq[PCI_NUM_PINS];
83     qemu_irq via_pirq[PCI_NUM_PINS];
84     Vof *vof;
85     void *fdt_blob;
86     uint64_t kernel_addr;
87     uint64_t kernel_entry;
88     uint64_t kernel_size;
89     uint64_t initrd_addr;
90     uint64_t initrd_size;
91 };
92 
93 static void *build_fdt(MachineState *machine, int *fdt_size);
94 
95 static void pegasos2_cpu_reset(void *opaque)
96 {
97     PowerPCCPU *cpu = opaque;
98     Pegasos2MachineState *pm = PEGASOS2_MACHINE(current_machine);
99 
100     cpu_reset(CPU(cpu));
101     cpu->env.spr[SPR_HID1] = 7ULL << 28;
102     if (pm->vof) {
103         cpu->env.gpr[1] = 2 * VOF_STACK_SIZE - 0x20;
104         cpu->env.nip = 0x100;
105     }
106     cpu_ppc_tb_reset(&cpu->env);
107 }
108 
109 static void pegasos2_pci_irq(void *opaque, int n, int level)
110 {
111     Pegasos2MachineState *pm = opaque;
112 
113     /* PCI interrupt lines are connected to both MV64361 and VT8231 */
114     qemu_set_irq(pm->mv_pirq[n], level);
115     qemu_set_irq(pm->via_pirq[n], level);
116 }
117 
118 static void pegasos2_init(MachineState *machine)
119 {
120     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
121     CPUPPCState *env;
122     MemoryRegion *rom = g_new(MemoryRegion, 1);
123     PCIBus *pci_bus;
124     Object *via;
125     PCIDevice *dev;
126     I2CBus *i2c_bus;
127     const char *fwname = machine->firmware ?: PROM_FILENAME;
128     char *filename;
129     int i;
130     ssize_t sz;
131     uint8_t *spd_data;
132 
133     /* init CPU */
134     pm->cpu = POWERPC_CPU(cpu_create(machine->cpu_type));
135     env = &pm->cpu->env;
136     if (PPC_INPUT(env) != PPC_FLAGS_INPUT_6xx) {
137         error_report("Incompatible CPU, only 6xx bus supported");
138         exit(1);
139     }
140 
141     /* Set time-base frequency */
142     cpu_ppc_tb_init(env, BUS_FREQ_HZ / 4);
143     qemu_register_reset(pegasos2_cpu_reset, pm->cpu);
144 
145     /* RAM */
146     if (machine->ram_size > 2 * GiB) {
147         error_report("RAM size more than 2 GiB is not supported");
148         exit(1);
149     }
150     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
151 
152     /* allocate and load firmware */
153     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, fwname);
154     if (!filename) {
155         error_report("Could not find firmware '%s'", fwname);
156         exit(1);
157     }
158     if (!machine->firmware && !pm->vof) {
159         pm->vof = g_malloc0(sizeof(*pm->vof));
160     }
161     memory_region_init_rom(rom, NULL, "pegasos2.rom", PROM_SIZE, &error_fatal);
162     memory_region_add_subregion(get_system_memory(), PROM_ADDR, rom);
163     sz = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
164                   ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
165     if (sz <= 0) {
166         sz = load_image_targphys(filename, pm->vof ? 0 : PROM_ADDR, PROM_SIZE);
167     }
168     if (sz <= 0 || sz > PROM_SIZE) {
169         error_report("Could not load firmware '%s'", filename);
170         exit(1);
171     }
172     g_free(filename);
173     if (pm->vof) {
174         pm->vof->fw_size = sz;
175     }
176 
177     /* Marvell Discovery II system controller */
178     pm->mv = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
179                           qdev_get_gpio_in(DEVICE(pm->cpu), PPC6xx_INPUT_INT)));
180     for (i = 0; i < PCI_NUM_PINS; i++) {
181         pm->mv_pirq[i] = qdev_get_gpio_in_named(pm->mv, "gpp", 12 + i);
182     }
183     pci_bus = mv64361_get_pci_bus(pm->mv, 1);
184 
185     /* VIA VT8231 South Bridge (multifunction PCI device) */
186     via = OBJECT(pci_new_multifunction(PCI_DEVFN(12, 0), TYPE_VT8231_ISA));
187 
188     /* Set properties on individual devices before realizing the south bridge */
189     if (machine->audiodev) {
190         dev = PCI_DEVICE(object_resolve_path_component(via, "ac97"));
191         qdev_prop_set_string(DEVICE(dev), "audiodev", machine->audiodev);
192     }
193 
194     pci_realize_and_unref(PCI_DEVICE(via), pci_bus, &error_abort);
195     for (i = 0; i < PCI_NUM_PINS; i++) {
196         pm->via_pirq[i] = qdev_get_gpio_in_named(DEVICE(via), "pirq", i);
197     }
198     object_property_add_alias(OBJECT(machine), "rtc-time",
199                               object_resolve_path_component(via, "rtc"),
200                               "date");
201     qdev_connect_gpio_out_named(DEVICE(via), "intr", 0,
202                                 qdev_get_gpio_in_named(pm->mv, "gpp", 31));
203 
204     dev = PCI_DEVICE(object_resolve_path_component(via, "ide"));
205     pci_ide_create_devs(dev);
206 
207     dev = PCI_DEVICE(object_resolve_path_component(via, "pm"));
208     i2c_bus = I2C_BUS(qdev_get_child_bus(DEVICE(dev), "i2c"));
209     spd_data = spd_data_generate(DDR, machine->ram_size);
210     smbus_eeprom_init_one(i2c_bus, 0x57, spd_data);
211 
212     /* other PC hardware */
213     pci_vga_init(pci_bus);
214 
215     /* PCI interrupt routing: lines from pci.0 and pci.1 are ORed */
216     for (int h = 0; h < 2; h++) {
217         DeviceState *pd;
218         g_autofree const char *pn = g_strdup_printf("pcihost%d", h);
219 
220         pd = DEVICE(object_resolve_path_component(OBJECT(pm->mv), pn));
221         assert(pd);
222         for (i = 0; i < PCI_NUM_PINS; i++) {
223             OrIRQState *ori = &pm->orirq[i];
224 
225             if (h == 0) {
226                 g_autofree const char *n = g_strdup_printf("pci-orirq[%d]", i);
227 
228                 object_initialize_child_with_props(OBJECT(pm), n,
229                                                    ori, sizeof(*ori),
230                                                    TYPE_OR_IRQ, &error_fatal,
231                                                    "num-lines", "2", NULL);
232                 qdev_realize(DEVICE(ori), NULL, &error_fatal);
233                 qemu_init_irq(&pm->pci_irqs[i], pegasos2_pci_irq, pm, i);
234                 qdev_connect_gpio_out(DEVICE(ori), 0, &pm->pci_irqs[i]);
235             }
236             qdev_connect_gpio_out(pd, i, qdev_get_gpio_in(DEVICE(ori), h));
237         }
238     }
239 
240     if (machine->kernel_filename) {
241         sz = load_elf(machine->kernel_filename, NULL, NULL, NULL,
242                       &pm->kernel_entry, &pm->kernel_addr, NULL, NULL,
243                       ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
244         if (sz <= 0) {
245             error_report("Could not load kernel '%s'",
246                          machine->kernel_filename);
247             exit(1);
248         }
249         pm->kernel_size = sz;
250         if (!pm->vof) {
251             warn_report("Option -kernel may be ineffective with -bios.");
252         }
253     } else if (pm->vof && !qtest_enabled()) {
254         warn_report("Using Virtual OpenFirmware but no -kernel option.");
255     }
256 
257     if (machine->initrd_filename) {
258         pm->initrd_addr = pm->kernel_addr + pm->kernel_size + 64 * KiB;
259         pm->initrd_addr = ROUND_UP(pm->initrd_addr, 4);
260         pm->initrd_addr = MAX(pm->initrd_addr, INITRD_MIN_ADDR);
261         sz = load_image_targphys(machine->initrd_filename, pm->initrd_addr,
262                                  machine->ram_size - pm->initrd_addr);
263         if (sz <= 0) {
264             error_report("Could not load initrd '%s'",
265                          machine->initrd_filename);
266             exit(1);
267         }
268         pm->initrd_size = sz;
269     }
270 
271     if (!pm->vof && machine->kernel_cmdline && machine->kernel_cmdline[0]) {
272         warn_report("Option -append may be ineffective with -bios.");
273     }
274 }
275 
276 static uint32_t pegasos2_mv_reg_read(Pegasos2MachineState *pm,
277                                      uint32_t addr, uint32_t len)
278 {
279     MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->mv), 0);
280     uint64_t val = 0xffffffffULL;
281     memory_region_dispatch_read(r, addr, &val, size_memop(len) | MO_LE,
282                                 MEMTXATTRS_UNSPECIFIED);
283     return val;
284 }
285 
286 static void pegasos2_mv_reg_write(Pegasos2MachineState *pm, uint32_t addr,
287                                   uint32_t len, uint32_t val)
288 {
289     MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->mv), 0);
290     memory_region_dispatch_write(r, addr, val, size_memop(len) | MO_LE,
291                                  MEMTXATTRS_UNSPECIFIED);
292 }
293 
294 static uint32_t pegasos2_pci_config_read(Pegasos2MachineState *pm, int bus,
295                                          uint32_t addr, uint32_t len)
296 {
297     hwaddr pcicfg = bus ? PCI1_CFG_ADDR : PCI0_CFG_ADDR;
298     uint64_t val = 0xffffffffULL;
299 
300     if (len <= 4) {
301         pegasos2_mv_reg_write(pm, pcicfg, 4, addr | BIT(31));
302         val = pegasos2_mv_reg_read(pm, pcicfg + 4, len);
303     }
304     return val;
305 }
306 
307 static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
308                                       uint32_t addr, uint32_t len, uint32_t val)
309 {
310     hwaddr pcicfg = bus ? PCI1_CFG_ADDR : PCI0_CFG_ADDR;
311 
312     pegasos2_mv_reg_write(pm, pcicfg, 4, addr | BIT(31));
313     pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
314 }
315 
316 static void pegasos2_superio_write(uint8_t addr, uint8_t val)
317 {
318     cpu_physical_memory_write(PCI1_IO_BASE + 0x3f0, &addr, 1);
319     cpu_physical_memory_write(PCI1_IO_BASE + 0x3f1, &val, 1);
320 }
321 
322 static void pegasos2_machine_reset(MachineState *machine, ResetType type)
323 {
324     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
325     void *fdt;
326     uint64_t d[2];
327     int sz;
328 
329     qemu_devices_reset(type);
330     if (!pm->vof) {
331         return; /* Firmware should set up machine so nothing to do */
332     }
333 
334     /* Otherwise, set up devices that board firmware would normally do */
335     pegasos2_mv_reg_write(pm, 0, 4, 0x28020ff);
336     pegasos2_mv_reg_write(pm, 0x278, 4, 0xa31fc);
337     pegasos2_mv_reg_write(pm, 0xf300, 4, 0x11ff0400);
338     pegasos2_mv_reg_write(pm, 0xf10c, 4, 0x80000000);
339     pegasos2_mv_reg_write(pm, 0x1c, 4, 0x8000000);
340     pegasos2_pci_config_write(pm, 0, PCI_COMMAND, 2, PCI_COMMAND_IO |
341                               PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
342     pegasos2_pci_config_write(pm, 1, PCI_COMMAND, 2, PCI_COMMAND_IO |
343                               PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
344 
345     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
346                               PCI_INTERRUPT_LINE, 2, 0x9);
347     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
348                               0x50, 1, 0x6);
349     pegasos2_superio_write(0xf4, 0xbe);
350     pegasos2_superio_write(0xf6, 0xef);
351     pegasos2_superio_write(0xf7, 0xfc);
352     pegasos2_superio_write(0xf2, 0x14);
353     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
354                               0x50, 1, 0x2);
355     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
356                               0x55, 1, 0x90);
357     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
358                               0x56, 1, 0x99);
359     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
360                               0x57, 1, 0x90);
361 
362     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
363                               PCI_INTERRUPT_LINE, 2, 0x109);
364     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
365                               PCI_CLASS_PROG, 1, 0xf);
366     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
367                               0x40, 1, 0xb);
368     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
369                               0x50, 4, 0x17171717);
370     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 1) << 8) |
371                               PCI_COMMAND, 2, 0x87);
372 
373     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 2) << 8) |
374                               PCI_INTERRUPT_LINE, 2, 0x409);
375     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 2) << 8) |
376                               PCI_COMMAND, 2, 0x7);
377 
378     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 3) << 8) |
379                               PCI_INTERRUPT_LINE, 2, 0x409);
380     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 3) << 8) |
381                               PCI_COMMAND, 2, 0x7);
382 
383     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
384                               PCI_INTERRUPT_LINE, 2, 0x9);
385     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
386                               0x48, 4, 0xf00);
387     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
388                               0x40, 4, 0x558020);
389     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 4) << 8) |
390                               0x90, 4, 0xd00);
391 
392     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 5) << 8) |
393                               PCI_INTERRUPT_LINE, 2, 0x309);
394 
395     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 6) << 8) |
396                               PCI_INTERRUPT_LINE, 2, 0x309);
397 
398     /* Device tree and VOF set up */
399     vof_init(pm->vof, machine->ram_size, &error_fatal);
400     if (vof_claim(pm->vof, 0, VOF_STACK_SIZE, VOF_STACK_SIZE) == -1) {
401         error_report("Memory allocation for stack failed");
402         exit(1);
403     }
404     if (pm->kernel_size &&
405         vof_claim(pm->vof, pm->kernel_addr, pm->kernel_size, 0) == -1) {
406         error_report("Memory for kernel is in use");
407         exit(1);
408     }
409     if (pm->initrd_size &&
410         vof_claim(pm->vof, pm->initrd_addr, pm->initrd_size, 0) == -1) {
411         error_report("Memory for initrd is in use");
412         exit(1);
413     }
414     fdt = build_fdt(machine, &sz);
415     /* FIXME: VOF assumes entry is same as load address */
416     d[0] = cpu_to_be64(pm->kernel_entry);
417     d[1] = cpu_to_be64(pm->kernel_size - (pm->kernel_entry - pm->kernel_addr));
418     qemu_fdt_setprop(fdt, "/chosen", "qemu,boot-kernel", d, sizeof(d));
419 
420     qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
421     g_free(pm->fdt_blob);
422     pm->fdt_blob = fdt;
423 
424     vof_build_dt(fdt, pm->vof);
425     vof_client_open_store(fdt, pm->vof, "/chosen", "stdout", "/failsafe");
426 
427     /* Set machine->fdt for 'dumpdtb' QMP/HMP command */
428     machine->fdt = fdt;
429 
430     pm->cpu->vhyp = PPC_VIRTUAL_HYPERVISOR(machine);
431     pm->cpu->vhyp_class = PPC_VIRTUAL_HYPERVISOR_GET_CLASS(pm->cpu->vhyp);
432 }
433 
434 enum pegasos2_rtas_tokens {
435     RTAS_RESTART_RTAS = 0,
436     RTAS_NVRAM_FETCH = 1,
437     RTAS_NVRAM_STORE = 2,
438     RTAS_GET_TIME_OF_DAY = 3,
439     RTAS_SET_TIME_OF_DAY = 4,
440     RTAS_EVENT_SCAN = 6,
441     RTAS_CHECK_EXCEPTION = 7,
442     RTAS_READ_PCI_CONFIG = 8,
443     RTAS_WRITE_PCI_CONFIG = 9,
444     RTAS_DISPLAY_CHARACTER = 10,
445     RTAS_SET_INDICATOR = 11,
446     RTAS_POWER_OFF = 17,
447     RTAS_SUSPEND = 18,
448     RTAS_HIBERNATE = 19,
449     RTAS_SYSTEM_REBOOT = 20,
450 };
451 
452 static target_ulong pegasos2_rtas(PowerPCCPU *cpu, Pegasos2MachineState *pm,
453                                   target_ulong args_real)
454 {
455     AddressSpace *as = CPU(cpu)->as;
456     uint32_t token = ldl_be_phys(as, args_real);
457     uint32_t nargs = ldl_be_phys(as, args_real + 4);
458     uint32_t nrets = ldl_be_phys(as, args_real + 8);
459     uint32_t args = args_real + 12;
460     uint32_t rets = args_real + 12 + nargs * 4;
461 
462     if (nrets < 1) {
463         qemu_log_mask(LOG_GUEST_ERROR, "Too few return values in RTAS call\n");
464         return H_PARAMETER;
465     }
466     switch (token) {
467     case RTAS_GET_TIME_OF_DAY:
468     {
469         QObject *qo = object_property_get_qobject(qdev_get_machine(),
470                                                   "rtc-time", &error_fatal);
471         QDict *qd = qobject_to(QDict, qo);
472 
473         if (nargs != 0 || nrets != 8 || !qd) {
474             stl_be_phys(as, rets, -1);
475             qobject_unref(qo);
476             return H_PARAMETER;
477         }
478 
479         stl_be_phys(as, rets, 0);
480         stl_be_phys(as, rets + 4, qdict_get_int(qd, "tm_year") + 1900);
481         stl_be_phys(as, rets + 8, qdict_get_int(qd, "tm_mon") + 1);
482         stl_be_phys(as, rets + 12, qdict_get_int(qd, "tm_mday"));
483         stl_be_phys(as, rets + 16, qdict_get_int(qd, "tm_hour"));
484         stl_be_phys(as, rets + 20, qdict_get_int(qd, "tm_min"));
485         stl_be_phys(as, rets + 24, qdict_get_int(qd, "tm_sec"));
486         stl_be_phys(as, rets + 28, 0);
487         qobject_unref(qo);
488         return H_SUCCESS;
489     }
490     case RTAS_READ_PCI_CONFIG:
491     {
492         uint32_t addr, len, val;
493 
494         if (nargs != 2 || nrets != 2) {
495             stl_be_phys(as, rets, -1);
496             return H_PARAMETER;
497         }
498         addr = ldl_be_phys(as, args);
499         len = ldl_be_phys(as, args + 4);
500         val = pegasos2_pci_config_read(pm, !(addr >> 24),
501                                        addr & 0x0fffffff, len);
502         stl_be_phys(as, rets, 0);
503         stl_be_phys(as, rets + 4, val);
504         return H_SUCCESS;
505     }
506     case RTAS_WRITE_PCI_CONFIG:
507     {
508         uint32_t addr, len, val;
509 
510         if (nargs != 3 || nrets != 1) {
511             stl_be_phys(as, rets, -1);
512             return H_PARAMETER;
513         }
514         addr = ldl_be_phys(as, args);
515         len = ldl_be_phys(as, args + 4);
516         val = ldl_be_phys(as, args + 8);
517         pegasos2_pci_config_write(pm, !(addr >> 24),
518                                   addr & 0x0fffffff, len, val);
519         stl_be_phys(as, rets, 0);
520         return H_SUCCESS;
521     }
522     case RTAS_DISPLAY_CHARACTER:
523         if (nargs != 1 || nrets != 1) {
524             stl_be_phys(as, rets, -1);
525             return H_PARAMETER;
526         }
527         qemu_log_mask(LOG_UNIMP, "%c", ldl_be_phys(as, args));
528         stl_be_phys(as, rets, 0);
529         return H_SUCCESS;
530     case RTAS_POWER_OFF:
531     {
532         if (nargs != 2 || nrets != 1) {
533             stl_be_phys(as, rets, -1);
534             return H_PARAMETER;
535         }
536         qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
537         stl_be_phys(as, rets, 0);
538         return H_SUCCESS;
539     }
540     default:
541         qemu_log_mask(LOG_UNIMP, "Unknown RTAS token %u (args=%u, rets=%u)\n",
542                       token, nargs, nrets);
543         stl_be_phys(as, rets, 0);
544         return H_SUCCESS;
545     }
546 }
547 
548 static bool pegasos2_cpu_in_nested(PowerPCCPU *cpu)
549 {
550     return false;
551 }
552 
553 static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
554 {
555     Pegasos2MachineState *pm = PEGASOS2_MACHINE(vhyp);
556     CPUPPCState *env = &cpu->env;
557 
558     /* The TCG path should also be holding the BQL at this point */
559     g_assert(bql_locked());
560 
561     if (FIELD_EX64(env->msr, MSR, PR)) {
562         qemu_log_mask(LOG_GUEST_ERROR, "Hypercall made with MSR[PR]=1\n");
563         env->gpr[3] = H_PRIVILEGE;
564     } else if (env->gpr[3] == KVMPPC_H_RTAS) {
565         env->gpr[3] = pegasos2_rtas(cpu, pm, env->gpr[4]);
566     } else if (env->gpr[3] == KVMPPC_H_VOF_CLIENT) {
567         int ret = vof_client_call(MACHINE(pm), pm->vof, pm->fdt_blob,
568                                   env->gpr[4]);
569         env->gpr[3] = (ret ? H_PARAMETER : H_SUCCESS);
570     } else {
571         qemu_log_mask(LOG_GUEST_ERROR, "Unsupported hypercall " TARGET_FMT_lx
572                       "\n", env->gpr[3]);
573         env->gpr[3] = -1;
574     }
575 }
576 
577 static void vhyp_nop(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
578 {
579 }
580 
581 static target_ulong vhyp_encode_hpt_for_kvm_pr(PPCVirtualHypervisor *vhyp)
582 {
583     return POWERPC_CPU(current_cpu)->env.spr[SPR_SDR1];
584 }
585 
586 static bool pegasos2_setprop(MachineState *ms, const char *path,
587                              const char *propname, void *val, int vallen)
588 {
589     return true;
590 }
591 
592 static void pegasos2_machine_class_init(ObjectClass *oc, void *data)
593 {
594     MachineClass *mc = MACHINE_CLASS(oc);
595     PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(oc);
596     VofMachineIfClass *vmc = VOF_MACHINE_CLASS(oc);
597 
598     mc->desc = "Genesi/bPlan Pegasos II";
599     mc->init = pegasos2_init;
600     mc->reset = pegasos2_machine_reset;
601     mc->block_default_type = IF_IDE;
602     mc->default_boot_order = "cd";
603     mc->default_display = "std";
604     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("7457_v1.2");
605     mc->default_ram_id = "pegasos2.ram";
606     mc->default_ram_size = 512 * MiB;
607     mc->no_sdcard = ON_OFF_AUTO_OFF;
608     machine_add_audiodev_property(mc);
609 
610     vhc->cpu_in_nested = pegasos2_cpu_in_nested;
611     vhc->hypercall = pegasos2_hypercall;
612     vhc->cpu_exec_enter = vhyp_nop;
613     vhc->cpu_exec_exit = vhyp_nop;
614     vhc->encode_hpt_for_kvm_pr = vhyp_encode_hpt_for_kvm_pr;
615 
616     vmc->setprop = pegasos2_setprop;
617 }
618 
619 static const TypeInfo pegasos2_machine_info = {
620     .name          = TYPE_PEGASOS2_MACHINE,
621     .parent        = TYPE_MACHINE,
622     .class_init    = pegasos2_machine_class_init,
623     .instance_size = sizeof(Pegasos2MachineState),
624     .interfaces = (InterfaceInfo[]) {
625         { TYPE_PPC_VIRTUAL_HYPERVISOR },
626         { TYPE_VOF_MACHINE_IF },
627         { }
628     },
629 };
630 
631 static void pegasos2_machine_register_types(void)
632 {
633     type_register_static(&pegasos2_machine_info);
634 }
635 
636 type_init(pegasos2_machine_register_types)
637 
638 /* FDT creation for passing to firmware */
639 
640 typedef struct {
641     void *fdt;
642     const char *path;
643 } FDTInfo;
644 
645 /* We do everything in reverse order so it comes out right in the tree */
646 
647 static void dt_ide(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
648 {
649     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "spi");
650 }
651 
652 static void dt_usb(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
653 {
654     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#size-cells", 0);
655     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#address-cells", 1);
656     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "usb");
657 }
658 
659 static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
660 {
661     GString *name = g_string_sized_new(64);
662     uint32_t cells[3];
663 
664     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#size-cells", 1);
665     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#address-cells", 2);
666     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "isa");
667     qemu_fdt_setprop_string(fi->fdt, fi->path, "name", "isa");
668 
669     /* additional devices */
670     g_string_printf(name, "%s/lpt@i3bc", fi->path);
671     qemu_fdt_add_subnode(fi->fdt, name->str);
672     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
673     cells[0] = cpu_to_be32(7);
674     cells[1] = 0;
675     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
676                      cells, 2 * sizeof(cells[0]));
677     cells[0] = cpu_to_be32(1);
678     cells[1] = cpu_to_be32(0x3bc);
679     cells[2] = cpu_to_be32(8);
680     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
681     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "lpt");
682     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "lpt");
683 
684     g_string_printf(name, "%s/fdc@i3f0", fi->path);
685     qemu_fdt_add_subnode(fi->fdt, name->str);
686     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
687     cells[0] = cpu_to_be32(6);
688     cells[1] = 0;
689     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
690                      cells, 2 * sizeof(cells[0]));
691     cells[0] = cpu_to_be32(1);
692     cells[1] = cpu_to_be32(0x3f0);
693     cells[2] = cpu_to_be32(8);
694     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
695     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "fdc");
696     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "fdc");
697 
698     g_string_printf(name, "%s/timer@i40", fi->path);
699     qemu_fdt_add_subnode(fi->fdt, name->str);
700     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
701     cells[0] = cpu_to_be32(1);
702     cells[1] = cpu_to_be32(0x40);
703     cells[2] = cpu_to_be32(8);
704     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
705     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "timer");
706     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "timer");
707 
708     g_string_printf(name, "%s/rtc@i70", fi->path);
709     qemu_fdt_add_subnode(fi->fdt, name->str);
710     qemu_fdt_setprop_string(fi->fdt, name->str, "compatible", "ds1385-rtc");
711     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
712     cells[0] = cpu_to_be32(8);
713     cells[1] = 0;
714     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
715                      cells, 2 * sizeof(cells[0]));
716     cells[0] = cpu_to_be32(1);
717     cells[1] = cpu_to_be32(0x70);
718     cells[2] = cpu_to_be32(2);
719     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
720     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "rtc");
721     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "rtc");
722 
723     g_string_printf(name, "%s/keyboard@i60", fi->path);
724     qemu_fdt_add_subnode(fi->fdt, name->str);
725     cells[0] = cpu_to_be32(1);
726     cells[1] = 0;
727     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
728                      cells, 2 * sizeof(cells[0]));
729     cells[0] = cpu_to_be32(1);
730     cells[1] = cpu_to_be32(0x60);
731     cells[2] = cpu_to_be32(5);
732     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
733     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "keyboard");
734     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "keyboard");
735 
736     g_string_printf(name, "%s/8042@i60", fi->path);
737     qemu_fdt_add_subnode(fi->fdt, name->str);
738     qemu_fdt_setprop_cell(fi->fdt, name->str, "#interrupt-cells", 2);
739     qemu_fdt_setprop_cell(fi->fdt, name->str, "#size-cells", 0);
740     qemu_fdt_setprop_cell(fi->fdt, name->str, "#address-cells", 1);
741     qemu_fdt_setprop_string(fi->fdt, name->str, "interrupt-controller", "");
742     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
743     cells[0] = cpu_to_be32(1);
744     cells[1] = cpu_to_be32(0x60);
745     cells[2] = cpu_to_be32(5);
746     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
747     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "");
748     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "8042");
749 
750     g_string_printf(name, "%s/serial@i2f8", fi->path);
751     qemu_fdt_add_subnode(fi->fdt, name->str);
752     qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
753     cells[0] = cpu_to_be32(3);
754     cells[1] = 0;
755     qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
756                      cells, 2 * sizeof(cells[0]));
757     cells[0] = cpu_to_be32(1);
758     cells[1] = cpu_to_be32(0x2f8);
759     cells[2] = cpu_to_be32(8);
760     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
761     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "serial");
762     qemu_fdt_setprop_string(fi->fdt, name->str, "name", "serial");
763 
764     g_string_free(name, TRUE);
765 }
766 
767 static struct {
768     const char *id;
769     const char *name;
770     void (*dtf)(PCIBus *bus, PCIDevice *d, FDTInfo *fi);
771 } device_map[] = {
772     { "pci11ab,6460", "host", NULL },
773     { "pci1106,8231", "isa", dt_isa },
774     { "pci1106,571", "ide", dt_ide },
775     { "pci1106,3044", "firewire", NULL },
776     { "pci1106,3038", "usb", dt_usb },
777     { "pci1106,8235", "other", NULL },
778     { "pci1106,3058", "sound", NULL },
779     { NULL, NULL }
780 };
781 
782 static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
783 {
784     FDTInfo *fi = opaque;
785     GString *node = g_string_new(NULL);
786     uint32_t cells[(PCI_NUM_REGIONS + 1) * 5];
787     int i, j;
788     const char *name = NULL;
789     g_autofree const gchar *pn = g_strdup_printf("pci%x,%x",
790                                      pci_get_word(&d->config[PCI_VENDOR_ID]),
791                                      pci_get_word(&d->config[PCI_DEVICE_ID]));
792 
793     if (pci_get_word(&d->config[PCI_CLASS_DEVICE])  ==
794         PCI_CLASS_NETWORK_ETHERNET) {
795         name = "ethernet";
796     } else if (pci_get_word(&d->config[PCI_CLASS_DEVICE]) >> 8 ==
797         PCI_BASE_CLASS_DISPLAY) {
798         name = "display";
799     }
800     for (i = 0; device_map[i].id; i++) {
801         if (!strcmp(pn, device_map[i].id)) {
802             name = device_map[i].name;
803             break;
804         }
805     }
806     g_string_printf(node, "%s/%s@%x", fi->path, (name ?: pn),
807                     PCI_SLOT(d->devfn));
808     if (PCI_FUNC(d->devfn)) {
809         g_string_append_printf(node, ",%x", PCI_FUNC(d->devfn));
810     }
811 
812     qemu_fdt_add_subnode(fi->fdt, node->str);
813     if (device_map[i].dtf) {
814         FDTInfo cfi = { fi->fdt, node->str };
815         device_map[i].dtf(bus, d, &cfi);
816     }
817     cells[0] = cpu_to_be32(d->devfn << 8);
818     cells[1] = 0;
819     cells[2] = 0;
820     cells[3] = 0;
821     cells[4] = 0;
822     j = 5;
823     for (i = 0; i < PCI_NUM_REGIONS; i++) {
824         if (!d->io_regions[i].size) {
825             continue;
826         }
827         cells[j] = PCI_BASE_ADDRESS_0 + i * 4;
828         if (cells[j] == 0x28) {
829             cells[j] = 0x30;
830         }
831         cells[j] = cpu_to_be32(d->devfn << 8 | cells[j]);
832         if (d->io_regions[i].type & PCI_BASE_ADDRESS_SPACE_IO) {
833             cells[j] |= cpu_to_be32(1 << 24);
834         } else {
835             if (d->io_regions[i].type & PCI_BASE_ADDRESS_MEM_TYPE_64) {
836                 cells[j] |= cpu_to_be32(3 << 24);
837             } else {
838                 cells[j] |= cpu_to_be32(2 << 24);
839             }
840             if (d->io_regions[i].type & PCI_BASE_ADDRESS_MEM_PREFETCH) {
841                 cells[j] |= cpu_to_be32(4 << 28);
842             }
843         }
844         cells[j + 1] = 0;
845         cells[j + 2] = 0;
846         cells[j + 3] = cpu_to_be32(d->io_regions[i].size >> 32);
847         cells[j + 4] = cpu_to_be32(d->io_regions[i].size);
848         j += 5;
849     }
850     qemu_fdt_setprop(fi->fdt, node->str, "reg", cells, j * sizeof(cells[0]));
851     qemu_fdt_setprop_string(fi->fdt, node->str, "name", name ?: pn);
852     if (pci_get_byte(&d->config[PCI_INTERRUPT_PIN])) {
853         qemu_fdt_setprop_cell(fi->fdt, node->str, "interrupts",
854                               pci_get_byte(&d->config[PCI_INTERRUPT_PIN]));
855     }
856     /* Pegasos2 firmware has subsystem-id amd subsystem-vendor-id swapped */
857     qemu_fdt_setprop_cell(fi->fdt, node->str, "subsystem-vendor-id",
858                           pci_get_word(&d->config[PCI_SUBSYSTEM_ID]));
859     qemu_fdt_setprop_cell(fi->fdt, node->str, "subsystem-id",
860                           pci_get_word(&d->config[PCI_SUBSYSTEM_VENDOR_ID]));
861     cells[0] = pci_get_long(&d->config[PCI_CLASS_REVISION]);
862     qemu_fdt_setprop_cell(fi->fdt, node->str, "class-code", cells[0] >> 8);
863     qemu_fdt_setprop_cell(fi->fdt, node->str, "revision-id", cells[0] & 0xff);
864     qemu_fdt_setprop_cell(fi->fdt, node->str, "device-id",
865                           pci_get_word(&d->config[PCI_DEVICE_ID]));
866     qemu_fdt_setprop_cell(fi->fdt, node->str, "vendor-id",
867                           pci_get_word(&d->config[PCI_VENDOR_ID]));
868 
869     g_string_free(node, TRUE);
870 }
871 
872 static void *build_fdt(MachineState *machine, int *fdt_size)
873 {
874     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
875     PowerPCCPU *cpu = pm->cpu;
876     PCIBus *pci_bus;
877     FDTInfo fi;
878     uint32_t cells[16];
879     void *fdt = create_device_tree(fdt_size);
880 
881     fi.fdt = fdt;
882 
883     /* root node */
884     qemu_fdt_setprop_string(fdt, "/", "CODEGEN,description",
885                             "Pegasos CHRP PowerPC System");
886     qemu_fdt_setprop_string(fdt, "/", "CODEGEN,board", "Pegasos2");
887     qemu_fdt_setprop_string(fdt, "/", "CODEGEN,vendor", "bplan GmbH");
888     qemu_fdt_setprop_string(fdt, "/", "revision", "2B");
889     qemu_fdt_setprop_string(fdt, "/", "model", "Pegasos2");
890     qemu_fdt_setprop_string(fdt, "/", "device_type", "chrp");
891     qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 1);
892     qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos2");
893 
894     /* pci@c0000000 */
895     qemu_fdt_add_subnode(fdt, "/pci@c0000000");
896     cells[0] = 0;
897     cells[1] = 0;
898     qemu_fdt_setprop(fdt, "/pci@c0000000", "bus-range",
899                      cells, 2 * sizeof(cells[0]));
900     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "pci-bridge-number", 1);
901     cells[0] = cpu_to_be32(PCI0_MEM_BASE);
902     cells[1] = cpu_to_be32(PCI0_MEM_SIZE);
903     qemu_fdt_setprop(fdt, "/pci@c0000000", "reg", cells, 2 * sizeof(cells[0]));
904     cells[0] = cpu_to_be32(0x01000000);
905     cells[1] = 0;
906     cells[2] = 0;
907     cells[3] = cpu_to_be32(PCI0_IO_BASE);
908     cells[4] = 0;
909     cells[5] = cpu_to_be32(PCI0_IO_SIZE);
910     cells[6] = cpu_to_be32(0x02000000);
911     cells[7] = 0;
912     cells[8] = cpu_to_be32(PCI0_MEM_BASE);
913     cells[9] = cpu_to_be32(PCI0_MEM_BASE);
914     cells[10] = 0;
915     cells[11] = cpu_to_be32(PCI0_MEM_SIZE);
916     qemu_fdt_setprop(fdt, "/pci@c0000000", "ranges",
917                      cells, 12 * sizeof(cells[0]));
918     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#size-cells", 2);
919     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#address-cells", 3);
920     qemu_fdt_setprop_string(fdt, "/pci@c0000000", "device_type", "pci");
921     qemu_fdt_setprop_string(fdt, "/pci@c0000000", "name", "pci");
922 
923     fi.path = "/pci@c0000000";
924     pci_bus = mv64361_get_pci_bus(pm->mv, 0);
925     pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
926 
927     /* pci@80000000 */
928     qemu_fdt_add_subnode(fdt, "/pci@80000000");
929     cells[0] = 0;
930     cells[1] = 0;
931     qemu_fdt_setprop(fdt, "/pci@80000000", "bus-range",
932                      cells, 2 * sizeof(cells[0]));
933     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "pci-bridge-number", 0);
934     cells[0] = cpu_to_be32(PCI1_MEM_BASE);
935     cells[1] = cpu_to_be32(PCI1_MEM_SIZE);
936     qemu_fdt_setprop(fdt, "/pci@80000000", "reg", cells, 2 * sizeof(cells[0]));
937     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "8259-interrupt-acknowledge",
938                           0xf1000cb4);
939     cells[0] = cpu_to_be32(0x01000000);
940     cells[1] = 0;
941     cells[2] = 0;
942     cells[3] = cpu_to_be32(PCI1_IO_BASE);
943     cells[4] = 0;
944     cells[5] = cpu_to_be32(PCI1_IO_SIZE);
945     cells[6] = cpu_to_be32(0x02000000);
946     cells[7] = 0;
947     cells[8] = cpu_to_be32(PCI1_MEM_BASE);
948     cells[9] = cpu_to_be32(PCI1_MEM_BASE);
949     cells[10] = 0;
950     cells[11] = cpu_to_be32(PCI1_MEM_SIZE);
951     qemu_fdt_setprop(fdt, "/pci@80000000", "ranges",
952                      cells, 12 * sizeof(cells[0]));
953     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#size-cells", 2);
954     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#address-cells", 3);
955     qemu_fdt_setprop_string(fdt, "/pci@80000000", "device_type", "pci");
956     qemu_fdt_setprop_string(fdt, "/pci@80000000", "name", "pci");
957 
958     fi.path = "/pci@80000000";
959     pci_bus = mv64361_get_pci_bus(pm->mv, 1);
960     pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
961 
962     qemu_fdt_add_subnode(fdt, "/failsafe");
963     qemu_fdt_setprop_string(fdt, "/failsafe", "device_type", "serial");
964     qemu_fdt_setprop_string(fdt, "/failsafe", "name", "failsafe");
965 
966     qemu_fdt_add_subnode(fdt, "/rtas");
967     qemu_fdt_setprop_cell(fdt, "/rtas", "system-reboot", RTAS_SYSTEM_REBOOT);
968     qemu_fdt_setprop_cell(fdt, "/rtas", "hibernate", RTAS_HIBERNATE);
969     qemu_fdt_setprop_cell(fdt, "/rtas", "suspend", RTAS_SUSPEND);
970     qemu_fdt_setprop_cell(fdt, "/rtas", "power-off", RTAS_POWER_OFF);
971     qemu_fdt_setprop_cell(fdt, "/rtas", "set-indicator", RTAS_SET_INDICATOR);
972     qemu_fdt_setprop_cell(fdt, "/rtas", "display-character",
973                           RTAS_DISPLAY_CHARACTER);
974     qemu_fdt_setprop_cell(fdt, "/rtas", "write-pci-config",
975                           RTAS_WRITE_PCI_CONFIG);
976     qemu_fdt_setprop_cell(fdt, "/rtas", "read-pci-config",
977                           RTAS_READ_PCI_CONFIG);
978     /* Pegasos2 firmware misspells check-exception and guests use that */
979     qemu_fdt_setprop_cell(fdt, "/rtas", "check-execption",
980                           RTAS_CHECK_EXCEPTION);
981     qemu_fdt_setprop_cell(fdt, "/rtas", "event-scan", RTAS_EVENT_SCAN);
982     qemu_fdt_setprop_cell(fdt, "/rtas", "set-time-of-day",
983                           RTAS_SET_TIME_OF_DAY);
984     qemu_fdt_setprop_cell(fdt, "/rtas", "get-time-of-day",
985                           RTAS_GET_TIME_OF_DAY);
986     qemu_fdt_setprop_cell(fdt, "/rtas", "nvram-store", RTAS_NVRAM_STORE);
987     qemu_fdt_setprop_cell(fdt, "/rtas", "nvram-fetch", RTAS_NVRAM_FETCH);
988     qemu_fdt_setprop_cell(fdt, "/rtas", "restart-rtas", RTAS_RESTART_RTAS);
989     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-error-log-max", 0);
990     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-event-scan-rate", 0);
991     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-display-device", 0);
992     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-size", 20);
993     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-version", 1);
994     qemu_fdt_setprop_string(fdt, "/rtas", "name", "rtas");
995 
996     /* cpus */
997     qemu_fdt_add_subnode(fdt, "/cpus");
998     qemu_fdt_setprop_cell(fdt, "/cpus", "#cpus", 1);
999     qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 1);
1000     qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0);
1001     qemu_fdt_setprop_string(fdt, "/cpus", "name", "cpus");
1002 
1003     /* FIXME Get CPU name from CPU object */
1004     const char *cp = "/cpus/PowerPC,G4";
1005     qemu_fdt_add_subnode(fdt, cp);
1006     qemu_fdt_setprop_cell(fdt, cp, "l2cr", 0);
1007     qemu_fdt_setprop_cell(fdt, cp, "d-cache-size", 0x8000);
1008     qemu_fdt_setprop_cell(fdt, cp, "d-cache-block-size",
1009                           cpu->env.dcache_line_size);
1010     qemu_fdt_setprop_cell(fdt, cp, "d-cache-line-size",
1011                           cpu->env.dcache_line_size);
1012     qemu_fdt_setprop_cell(fdt, cp, "i-cache-size", 0x8000);
1013     qemu_fdt_setprop_cell(fdt, cp, "i-cache-block-size",
1014                           cpu->env.icache_line_size);
1015     qemu_fdt_setprop_cell(fdt, cp, "i-cache-line-size",
1016                           cpu->env.icache_line_size);
1017     if (ppc_is_split_tlb(cpu)) {
1018         qemu_fdt_setprop_cell(fdt, cp, "i-tlb-sets", cpu->env.nb_ways);
1019         qemu_fdt_setprop_cell(fdt, cp, "i-tlb-size", cpu->env.tlb_per_way);
1020         qemu_fdt_setprop_cell(fdt, cp, "d-tlb-sets", cpu->env.nb_ways);
1021         qemu_fdt_setprop_cell(fdt, cp, "d-tlb-size", cpu->env.tlb_per_way);
1022         qemu_fdt_setprop_string(fdt, cp, "tlb-split", "");
1023     }
1024     qemu_fdt_setprop_cell(fdt, cp, "tlb-sets", cpu->env.nb_ways);
1025     qemu_fdt_setprop_cell(fdt, cp, "tlb-size", cpu->env.nb_tlb);
1026     qemu_fdt_setprop_string(fdt, cp, "state", "running");
1027     if (cpu->env.insns_flags & PPC_ALTIVEC) {
1028         qemu_fdt_setprop_string(fdt, cp, "altivec", "");
1029         qemu_fdt_setprop_string(fdt, cp, "data-streams", "");
1030     }
1031     /*
1032      * FIXME What flags do data-streams, external-control and
1033      * performance-monitor depend on?
1034      */
1035     qemu_fdt_setprop_string(fdt, cp, "external-control", "");
1036     if (cpu->env.insns_flags & PPC_FLOAT_FSQRT) {
1037         qemu_fdt_setprop_string(fdt, cp, "general-purpose", "");
1038     }
1039     qemu_fdt_setprop_string(fdt, cp, "performance-monitor", "");
1040     if (cpu->env.insns_flags & PPC_FLOAT_FRES) {
1041         qemu_fdt_setprop_string(fdt, cp, "graphics", "");
1042     }
1043     qemu_fdt_setprop_cell(fdt, cp, "reservation-granule-size", 4);
1044     qemu_fdt_setprop_cell(fdt, cp, "timebase-frequency",
1045                           cpu->env.tb_env->tb_freq);
1046     qemu_fdt_setprop_cell(fdt, cp, "bus-frequency", BUS_FREQ_HZ);
1047     qemu_fdt_setprop_cell(fdt, cp, "clock-frequency", BUS_FREQ_HZ * 7.5);
1048     qemu_fdt_setprop_cell(fdt, cp, "cpu-version", cpu->env.spr[SPR_PVR]);
1049     cells[0] = 0;
1050     cells[1] = 0;
1051     qemu_fdt_setprop(fdt, cp, "reg", cells, 2 * sizeof(cells[0]));
1052     qemu_fdt_setprop_string(fdt, cp, "device_type", "cpu");
1053     qemu_fdt_setprop_string(fdt, cp, "name", strrchr(cp, '/') + 1);
1054 
1055     /* memory */
1056     qemu_fdt_add_subnode(fdt, "/memory@0");
1057     cells[0] = 0;
1058     cells[1] = cpu_to_be32(machine->ram_size);
1059     qemu_fdt_setprop(fdt, "/memory@0", "reg", cells, 2 * sizeof(cells[0]));
1060     qemu_fdt_setprop_string(fdt, "/memory@0", "device_type", "memory");
1061     qemu_fdt_setprop_string(fdt, "/memory@0", "name", "memory");
1062 
1063     qemu_fdt_add_subnode(fdt, "/chosen");
1064     if (pm->initrd_addr && pm->initrd_size) {
1065         qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end",
1066                               pm->initrd_addr + pm->initrd_size);
1067         qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start",
1068                               pm->initrd_addr);
1069     }
1070     qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
1071                             machine->kernel_cmdline ?: "");
1072     qemu_fdt_setprop_string(fdt, "/chosen", "name", "chosen");
1073 
1074     qemu_fdt_add_subnode(fdt, "/openprom");
1075     qemu_fdt_setprop_string(fdt, "/openprom", "model", "Pegasos2,1.1");
1076 
1077     return fdt;
1078 }
1079