xref: /openbmc/qemu/hw/ppc/spapr.c (revision 77a8257e)
1 /*
2  * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
3  *
4  * Copyright (c) 2004-2007 Fabrice Bellard
5  * Copyright (c) 2007 Jocelyn Mayer
6  * Copyright (c) 2010 David Gibson, IBM Corporation.
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  *
26  */
27 #include "sysemu/sysemu.h"
28 #include "sysemu/numa.h"
29 #include "hw/hw.h"
30 #include "hw/fw-path-provider.h"
31 #include "elf.h"
32 #include "net/net.h"
33 #include "sysemu/block-backend.h"
34 #include "sysemu/cpus.h"
35 #include "sysemu/kvm.h"
36 #include "kvm_ppc.h"
37 #include "mmu-hash64.h"
38 #include "qom/cpu.h"
39 
40 #include "hw/boards.h"
41 #include "hw/ppc/ppc.h"
42 #include "hw/loader.h"
43 
44 #include "hw/ppc/spapr.h"
45 #include "hw/ppc/spapr_vio.h"
46 #include "hw/pci-host/spapr.h"
47 #include "hw/ppc/xics.h"
48 #include "hw/pci/msi.h"
49 
50 #include "hw/pci/pci.h"
51 #include "hw/scsi/scsi.h"
52 #include "hw/virtio/virtio-scsi.h"
53 
54 #include "exec/address-spaces.h"
55 #include "hw/usb.h"
56 #include "qemu/config-file.h"
57 #include "qemu/error-report.h"
58 #include "trace.h"
59 #include "hw/nmi.h"
60 
61 #include "hw/compat.h"
62 
63 #include <libfdt.h>
64 
65 /* SLOF memory layout:
66  *
67  * SLOF raw image loaded at 0, copies its romfs right below the flat
68  * device-tree, then position SLOF itself 31M below that
69  *
70  * So we set FW_OVERHEAD to 40MB which should account for all of that
71  * and more
72  *
73  * We load our kernel at 4M, leaving space for SLOF initial image
74  */
75 #define FDT_MAX_SIZE            0x40000
76 #define RTAS_MAX_SIZE           0x10000
77 #define RTAS_MAX_ADDR           0x80000000 /* RTAS must stay below that */
78 #define FW_MAX_SIZE             0x400000
79 #define FW_FILE_NAME            "slof.bin"
80 #define FW_OVERHEAD             0x2800000
81 #define KERNEL_LOAD_ADDR        FW_MAX_SIZE
82 
83 #define MIN_RMA_SLOF            128UL
84 
85 #define TIMEBASE_FREQ           512000000ULL
86 
87 #define MAX_CPUS                255
88 
89 #define PHANDLE_XICP            0x00001111
90 
91 #define HTAB_SIZE(spapr)        (1ULL << ((spapr)->htab_shift))
92 
93 typedef struct sPAPRMachineState sPAPRMachineState;
94 
95 #define TYPE_SPAPR_MACHINE      "spapr-machine"
96 #define SPAPR_MACHINE(obj) \
97     OBJECT_CHECK(sPAPRMachineState, (obj), TYPE_SPAPR_MACHINE)
98 
99 /**
100  * sPAPRMachineState:
101  */
102 struct sPAPRMachineState {
103     /*< private >*/
104     MachineState parent_obj;
105 
106     /*< public >*/
107     char *kvm_type;
108 };
109 
110 sPAPREnvironment *spapr;
111 
112 static XICSState *try_create_xics(const char *type, int nr_servers,
113                                   int nr_irqs, Error **errp)
114 {
115     Error *err = NULL;
116     DeviceState *dev;
117 
118     dev = qdev_create(NULL, type);
119     qdev_prop_set_uint32(dev, "nr_servers", nr_servers);
120     qdev_prop_set_uint32(dev, "nr_irqs", nr_irqs);
121     object_property_set_bool(OBJECT(dev), true, "realized", &err);
122     if (err) {
123         error_propagate(errp, err);
124         object_unparent(OBJECT(dev));
125         return NULL;
126     }
127     return XICS_COMMON(dev);
128 }
129 
130 static XICSState *xics_system_init(MachineState *machine,
131                                    int nr_servers, int nr_irqs)
132 {
133     XICSState *icp = NULL;
134 
135     if (kvm_enabled()) {
136         Error *err = NULL;
137 
138         if (machine_kernel_irqchip_allowed(machine)) {
139             icp = try_create_xics(TYPE_KVM_XICS, nr_servers, nr_irqs, &err);
140         }
141         if (machine_kernel_irqchip_required(machine) && !icp) {
142             error_report("kernel_irqchip requested but unavailable: %s",
143                          error_get_pretty(err));
144         }
145     }
146 
147     if (!icp) {
148         icp = try_create_xics(TYPE_XICS, nr_servers, nr_irqs, &error_abort);
149     }
150 
151     return icp;
152 }
153 
154 static int spapr_fixup_cpu_smt_dt(void *fdt, int offset, PowerPCCPU *cpu,
155                                   int smt_threads)
156 {
157     int i, ret = 0;
158     uint32_t servers_prop[smt_threads];
159     uint32_t gservers_prop[smt_threads * 2];
160     int index = ppc_get_vcpu_dt_id(cpu);
161 
162     if (cpu->cpu_version) {
163         ret = fdt_setprop_cell(fdt, offset, "cpu-version", cpu->cpu_version);
164         if (ret < 0) {
165             return ret;
166         }
167     }
168 
169     /* Build interrupt servers and gservers properties */
170     for (i = 0; i < smt_threads; i++) {
171         servers_prop[i] = cpu_to_be32(index + i);
172         /* Hack, direct the group queues back to cpu 0 */
173         gservers_prop[i*2] = cpu_to_be32(index + i);
174         gservers_prop[i*2 + 1] = 0;
175     }
176     ret = fdt_setprop(fdt, offset, "ibm,ppc-interrupt-server#s",
177                       servers_prop, sizeof(servers_prop));
178     if (ret < 0) {
179         return ret;
180     }
181     ret = fdt_setprop(fdt, offset, "ibm,ppc-interrupt-gserver#s",
182                       gservers_prop, sizeof(gservers_prop));
183 
184     return ret;
185 }
186 
187 static int spapr_fixup_cpu_dt(void *fdt, sPAPREnvironment *spapr)
188 {
189     int ret = 0, offset, cpus_offset;
190     CPUState *cs;
191     char cpu_model[32];
192     int smt = kvmppc_smt_threads();
193     uint32_t pft_size_prop[] = {0, cpu_to_be32(spapr->htab_shift)};
194 
195     CPU_FOREACH(cs) {
196         PowerPCCPU *cpu = POWERPC_CPU(cs);
197         DeviceClass *dc = DEVICE_GET_CLASS(cs);
198         int index = ppc_get_vcpu_dt_id(cpu);
199         uint32_t associativity[] = {cpu_to_be32(0x5),
200                                     cpu_to_be32(0x0),
201                                     cpu_to_be32(0x0),
202                                     cpu_to_be32(0x0),
203                                     cpu_to_be32(cs->numa_node),
204                                     cpu_to_be32(index)};
205 
206         if ((index % smt) != 0) {
207             continue;
208         }
209 
210         snprintf(cpu_model, 32, "%s@%x", dc->fw_name, index);
211 
212         cpus_offset = fdt_path_offset(fdt, "/cpus");
213         if (cpus_offset < 0) {
214             cpus_offset = fdt_add_subnode(fdt, fdt_path_offset(fdt, "/"),
215                                           "cpus");
216             if (cpus_offset < 0) {
217                 return cpus_offset;
218             }
219         }
220         offset = fdt_subnode_offset(fdt, cpus_offset, cpu_model);
221         if (offset < 0) {
222             offset = fdt_add_subnode(fdt, cpus_offset, cpu_model);
223             if (offset < 0) {
224                 return offset;
225             }
226         }
227 
228         if (nb_numa_nodes > 1) {
229             ret = fdt_setprop(fdt, offset, "ibm,associativity", associativity,
230                               sizeof(associativity));
231             if (ret < 0) {
232                 return ret;
233             }
234         }
235 
236         ret = fdt_setprop(fdt, offset, "ibm,pft-size",
237                           pft_size_prop, sizeof(pft_size_prop));
238         if (ret < 0) {
239             return ret;
240         }
241 
242         ret = spapr_fixup_cpu_smt_dt(fdt, offset, cpu,
243                                      ppc_get_compat_smt_threads(cpu));
244         if (ret < 0) {
245             return ret;
246         }
247     }
248     return ret;
249 }
250 
251 
252 static size_t create_page_sizes_prop(CPUPPCState *env, uint32_t *prop,
253                                      size_t maxsize)
254 {
255     size_t maxcells = maxsize / sizeof(uint32_t);
256     int i, j, count;
257     uint32_t *p = prop;
258 
259     for (i = 0; i < PPC_PAGE_SIZES_MAX_SZ; i++) {
260         struct ppc_one_seg_page_size *sps = &env->sps.sps[i];
261 
262         if (!sps->page_shift) {
263             break;
264         }
265         for (count = 0; count < PPC_PAGE_SIZES_MAX_SZ; count++) {
266             if (sps->enc[count].page_shift == 0) {
267                 break;
268             }
269         }
270         if ((p - prop) >= (maxcells - 3 - count * 2)) {
271             break;
272         }
273         *(p++) = cpu_to_be32(sps->page_shift);
274         *(p++) = cpu_to_be32(sps->slb_enc);
275         *(p++) = cpu_to_be32(count);
276         for (j = 0; j < count; j++) {
277             *(p++) = cpu_to_be32(sps->enc[j].page_shift);
278             *(p++) = cpu_to_be32(sps->enc[j].pte_enc);
279         }
280     }
281 
282     return (p - prop) * sizeof(uint32_t);
283 }
284 
285 static hwaddr spapr_node0_size(void)
286 {
287     if (nb_numa_nodes) {
288         int i;
289         for (i = 0; i < nb_numa_nodes; ++i) {
290             if (numa_info[i].node_mem) {
291                 return MIN(pow2floor(numa_info[i].node_mem), ram_size);
292             }
293         }
294     }
295     return ram_size;
296 }
297 
298 #define _FDT(exp) \
299     do { \
300         int ret = (exp);                                           \
301         if (ret < 0) {                                             \
302             fprintf(stderr, "qemu: error creating device tree: %s: %s\n", \
303                     #exp, fdt_strerror(ret));                      \
304             exit(1);                                               \
305         }                                                          \
306     } while (0)
307 
308 static void add_str(GString *s, const gchar *s1)
309 {
310     g_string_append_len(s, s1, strlen(s1) + 1);
311 }
312 
313 static void *spapr_create_fdt_skel(hwaddr initrd_base,
314                                    hwaddr initrd_size,
315                                    hwaddr kernel_size,
316                                    bool little_endian,
317                                    const char *boot_device,
318                                    const char *kernel_cmdline,
319                                    uint32_t epow_irq)
320 {
321     void *fdt;
322     CPUState *cs;
323     uint32_t start_prop = cpu_to_be32(initrd_base);
324     uint32_t end_prop = cpu_to_be32(initrd_base + initrd_size);
325     GString *hypertas = g_string_sized_new(256);
326     GString *qemu_hypertas = g_string_sized_new(256);
327     uint32_t refpoints[] = {cpu_to_be32(0x4), cpu_to_be32(0x4)};
328     uint32_t interrupt_server_ranges_prop[] = {0, cpu_to_be32(smp_cpus)};
329     int smt = kvmppc_smt_threads();
330     unsigned char vec5[] = {0x0, 0x0, 0x0, 0x0, 0x0, 0x80};
331     QemuOpts *opts = qemu_opts_find(qemu_find_opts("smp-opts"), NULL);
332     unsigned sockets = opts ? qemu_opt_get_number(opts, "sockets", 0) : 0;
333     uint32_t cpus_per_socket = sockets ? (smp_cpus / sockets) : 1;
334     char *buf;
335 
336     add_str(hypertas, "hcall-pft");
337     add_str(hypertas, "hcall-term");
338     add_str(hypertas, "hcall-dabr");
339     add_str(hypertas, "hcall-interrupt");
340     add_str(hypertas, "hcall-tce");
341     add_str(hypertas, "hcall-vio");
342     add_str(hypertas, "hcall-splpar");
343     add_str(hypertas, "hcall-bulk");
344     add_str(hypertas, "hcall-set-mode");
345     add_str(qemu_hypertas, "hcall-memop1");
346 
347     fdt = g_malloc0(FDT_MAX_SIZE);
348     _FDT((fdt_create(fdt, FDT_MAX_SIZE)));
349 
350     if (kernel_size) {
351         _FDT((fdt_add_reservemap_entry(fdt, KERNEL_LOAD_ADDR, kernel_size)));
352     }
353     if (initrd_size) {
354         _FDT((fdt_add_reservemap_entry(fdt, initrd_base, initrd_size)));
355     }
356     _FDT((fdt_finish_reservemap(fdt)));
357 
358     /* Root node */
359     _FDT((fdt_begin_node(fdt, "")));
360     _FDT((fdt_property_string(fdt, "device_type", "chrp")));
361     _FDT((fdt_property_string(fdt, "model", "IBM pSeries (emulated by qemu)")));
362     _FDT((fdt_property_string(fdt, "compatible", "qemu,pseries")));
363 
364     /*
365      * Add info to guest to indentify which host is it being run on
366      * and what is the uuid of the guest
367      */
368     if (kvmppc_get_host_model(&buf)) {
369         _FDT((fdt_property_string(fdt, "host-model", buf)));
370         g_free(buf);
371     }
372     if (kvmppc_get_host_serial(&buf)) {
373         _FDT((fdt_property_string(fdt, "host-serial", buf)));
374         g_free(buf);
375     }
376 
377     buf = g_strdup_printf(UUID_FMT, qemu_uuid[0], qemu_uuid[1],
378                           qemu_uuid[2], qemu_uuid[3], qemu_uuid[4],
379                           qemu_uuid[5], qemu_uuid[6], qemu_uuid[7],
380                           qemu_uuid[8], qemu_uuid[9], qemu_uuid[10],
381                           qemu_uuid[11], qemu_uuid[12], qemu_uuid[13],
382                           qemu_uuid[14], qemu_uuid[15]);
383 
384     _FDT((fdt_property_string(fdt, "vm,uuid", buf)));
385     g_free(buf);
386 
387     _FDT((fdt_property_cell(fdt, "#address-cells", 0x2)));
388     _FDT((fdt_property_cell(fdt, "#size-cells", 0x2)));
389 
390     /* /chosen */
391     _FDT((fdt_begin_node(fdt, "chosen")));
392 
393     /* Set Form1_affinity */
394     _FDT((fdt_property(fdt, "ibm,architecture-vec-5", vec5, sizeof(vec5))));
395 
396     _FDT((fdt_property_string(fdt, "bootargs", kernel_cmdline)));
397     _FDT((fdt_property(fdt, "linux,initrd-start",
398                        &start_prop, sizeof(start_prop))));
399     _FDT((fdt_property(fdt, "linux,initrd-end",
400                        &end_prop, sizeof(end_prop))));
401     if (kernel_size) {
402         uint64_t kprop[2] = { cpu_to_be64(KERNEL_LOAD_ADDR),
403                               cpu_to_be64(kernel_size) };
404 
405         _FDT((fdt_property(fdt, "qemu,boot-kernel", &kprop, sizeof(kprop))));
406         if (little_endian) {
407             _FDT((fdt_property(fdt, "qemu,boot-kernel-le", NULL, 0)));
408         }
409     }
410     if (boot_device) {
411         _FDT((fdt_property_string(fdt, "qemu,boot-device", boot_device)));
412     }
413     if (boot_menu) {
414         _FDT((fdt_property_cell(fdt, "qemu,boot-menu", boot_menu)));
415     }
416     _FDT((fdt_property_cell(fdt, "qemu,graphic-width", graphic_width)));
417     _FDT((fdt_property_cell(fdt, "qemu,graphic-height", graphic_height)));
418     _FDT((fdt_property_cell(fdt, "qemu,graphic-depth", graphic_depth)));
419 
420     _FDT((fdt_end_node(fdt)));
421 
422     /* cpus */
423     _FDT((fdt_begin_node(fdt, "cpus")));
424 
425     _FDT((fdt_property_cell(fdt, "#address-cells", 0x1)));
426     _FDT((fdt_property_cell(fdt, "#size-cells", 0x0)));
427 
428     CPU_FOREACH(cs) {
429         PowerPCCPU *cpu = POWERPC_CPU(cs);
430         CPUPPCState *env = &cpu->env;
431         DeviceClass *dc = DEVICE_GET_CLASS(cs);
432         PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
433         int index = ppc_get_vcpu_dt_id(cpu);
434         char *nodename;
435         uint32_t segs[] = {cpu_to_be32(28), cpu_to_be32(40),
436                            0xffffffff, 0xffffffff};
437         uint32_t tbfreq = kvm_enabled() ? kvmppc_get_tbfreq() : TIMEBASE_FREQ;
438         uint32_t cpufreq = kvm_enabled() ? kvmppc_get_clockfreq() : 1000000000;
439         uint32_t page_sizes_prop[64];
440         size_t page_sizes_prop_size;
441 
442         if ((index % smt) != 0) {
443             continue;
444         }
445 
446         nodename = g_strdup_printf("%s@%x", dc->fw_name, index);
447 
448         _FDT((fdt_begin_node(fdt, nodename)));
449 
450         g_free(nodename);
451 
452         _FDT((fdt_property_cell(fdt, "reg", index)));
453         _FDT((fdt_property_string(fdt, "device_type", "cpu")));
454 
455         _FDT((fdt_property_cell(fdt, "cpu-version", env->spr[SPR_PVR])));
456         _FDT((fdt_property_cell(fdt, "d-cache-block-size",
457                                 env->dcache_line_size)));
458         _FDT((fdt_property_cell(fdt, "d-cache-line-size",
459                                 env->dcache_line_size)));
460         _FDT((fdt_property_cell(fdt, "i-cache-block-size",
461                                 env->icache_line_size)));
462         _FDT((fdt_property_cell(fdt, "i-cache-line-size",
463                                 env->icache_line_size)));
464 
465         if (pcc->l1_dcache_size) {
466             _FDT((fdt_property_cell(fdt, "d-cache-size", pcc->l1_dcache_size)));
467         } else {
468             fprintf(stderr, "Warning: Unknown L1 dcache size for cpu\n");
469         }
470         if (pcc->l1_icache_size) {
471             _FDT((fdt_property_cell(fdt, "i-cache-size", pcc->l1_icache_size)));
472         } else {
473             fprintf(stderr, "Warning: Unknown L1 icache size for cpu\n");
474         }
475 
476         _FDT((fdt_property_cell(fdt, "timebase-frequency", tbfreq)));
477         _FDT((fdt_property_cell(fdt, "clock-frequency", cpufreq)));
478         _FDT((fdt_property_cell(fdt, "ibm,slb-size", env->slb_nr)));
479         _FDT((fdt_property_string(fdt, "status", "okay")));
480         _FDT((fdt_property(fdt, "64-bit", NULL, 0)));
481 
482         if (env->spr_cb[SPR_PURR].oea_read) {
483             _FDT((fdt_property(fdt, "ibm,purr", NULL, 0)));
484         }
485 
486         if (env->mmu_model & POWERPC_MMU_1TSEG) {
487             _FDT((fdt_property(fdt, "ibm,processor-segment-sizes",
488                                segs, sizeof(segs))));
489         }
490 
491         /* Advertise VMX/VSX (vector extensions) if available
492          *   0 / no property == no vector extensions
493          *   1               == VMX / Altivec available
494          *   2               == VSX available */
495         if (env->insns_flags & PPC_ALTIVEC) {
496             uint32_t vmx = (env->insns_flags2 & PPC2_VSX) ? 2 : 1;
497 
498             _FDT((fdt_property_cell(fdt, "ibm,vmx", vmx)));
499         }
500 
501         /* Advertise DFP (Decimal Floating Point) if available
502          *   0 / no property == no DFP
503          *   1               == DFP available */
504         if (env->insns_flags2 & PPC2_DFP) {
505             _FDT((fdt_property_cell(fdt, "ibm,dfp", 1)));
506         }
507 
508         page_sizes_prop_size = create_page_sizes_prop(env, page_sizes_prop,
509                                                       sizeof(page_sizes_prop));
510         if (page_sizes_prop_size) {
511             _FDT((fdt_property(fdt, "ibm,segment-page-sizes",
512                                page_sizes_prop, page_sizes_prop_size)));
513         }
514 
515         _FDT((fdt_property_cell(fdt, "ibm,chip-id",
516                                 cs->cpu_index / cpus_per_socket)));
517 
518         _FDT((fdt_end_node(fdt)));
519     }
520 
521     _FDT((fdt_end_node(fdt)));
522 
523     /* RTAS */
524     _FDT((fdt_begin_node(fdt, "rtas")));
525 
526     if (!kvm_enabled() || kvmppc_spapr_use_multitce()) {
527         add_str(hypertas, "hcall-multi-tce");
528     }
529     _FDT((fdt_property(fdt, "ibm,hypertas-functions", hypertas->str,
530                        hypertas->len)));
531     g_string_free(hypertas, TRUE);
532     _FDT((fdt_property(fdt, "qemu,hypertas-functions", qemu_hypertas->str,
533                        qemu_hypertas->len)));
534     g_string_free(qemu_hypertas, TRUE);
535 
536     _FDT((fdt_property(fdt, "ibm,associativity-reference-points",
537         refpoints, sizeof(refpoints))));
538 
539     _FDT((fdt_property_cell(fdt, "rtas-error-log-max", RTAS_ERROR_LOG_MAX)));
540 
541     /*
542      * According to PAPR, rtas ibm,os-term does not guarantee a return
543      * back to the guest cpu.
544      *
545      * While an additional ibm,extended-os-term property indicates that
546      * rtas call return will always occur. Set this property.
547      */
548     _FDT((fdt_property(fdt, "ibm,extended-os-term", NULL, 0)));
549 
550     _FDT((fdt_end_node(fdt)));
551 
552     /* interrupt controller */
553     _FDT((fdt_begin_node(fdt, "interrupt-controller")));
554 
555     _FDT((fdt_property_string(fdt, "device_type",
556                               "PowerPC-External-Interrupt-Presentation")));
557     _FDT((fdt_property_string(fdt, "compatible", "IBM,ppc-xicp")));
558     _FDT((fdt_property(fdt, "interrupt-controller", NULL, 0)));
559     _FDT((fdt_property(fdt, "ibm,interrupt-server-ranges",
560                        interrupt_server_ranges_prop,
561                        sizeof(interrupt_server_ranges_prop))));
562     _FDT((fdt_property_cell(fdt, "#interrupt-cells", 2)));
563     _FDT((fdt_property_cell(fdt, "linux,phandle", PHANDLE_XICP)));
564     _FDT((fdt_property_cell(fdt, "phandle", PHANDLE_XICP)));
565 
566     _FDT((fdt_end_node(fdt)));
567 
568     /* vdevice */
569     _FDT((fdt_begin_node(fdt, "vdevice")));
570 
571     _FDT((fdt_property_string(fdt, "device_type", "vdevice")));
572     _FDT((fdt_property_string(fdt, "compatible", "IBM,vdevice")));
573     _FDT((fdt_property_cell(fdt, "#address-cells", 0x1)));
574     _FDT((fdt_property_cell(fdt, "#size-cells", 0x0)));
575     _FDT((fdt_property_cell(fdt, "#interrupt-cells", 0x2)));
576     _FDT((fdt_property(fdt, "interrupt-controller", NULL, 0)));
577 
578     _FDT((fdt_end_node(fdt)));
579 
580     /* event-sources */
581     spapr_events_fdt_skel(fdt, epow_irq);
582 
583     /* /hypervisor node */
584     if (kvm_enabled()) {
585         uint8_t hypercall[16];
586 
587         /* indicate KVM hypercall interface */
588         _FDT((fdt_begin_node(fdt, "hypervisor")));
589         _FDT((fdt_property_string(fdt, "compatible", "linux,kvm")));
590         if (kvmppc_has_cap_fixup_hcalls()) {
591             /*
592              * Older KVM versions with older guest kernels were broken with the
593              * magic page, don't allow the guest to map it.
594              */
595             kvmppc_get_hypercall(first_cpu->env_ptr, hypercall,
596                                  sizeof(hypercall));
597             _FDT((fdt_property(fdt, "hcall-instructions", hypercall,
598                               sizeof(hypercall))));
599         }
600         _FDT((fdt_end_node(fdt)));
601     }
602 
603     _FDT((fdt_end_node(fdt))); /* close root node */
604     _FDT((fdt_finish(fdt)));
605 
606     return fdt;
607 }
608 
609 int spapr_h_cas_compose_response(target_ulong addr, target_ulong size)
610 {
611     void *fdt, *fdt_skel;
612     sPAPRDeviceTreeUpdateHeader hdr = { .version_id = 1 };
613 
614     size -= sizeof(hdr);
615 
616     /* Create sceleton */
617     fdt_skel = g_malloc0(size);
618     _FDT((fdt_create(fdt_skel, size)));
619     _FDT((fdt_begin_node(fdt_skel, "")));
620     _FDT((fdt_end_node(fdt_skel)));
621     _FDT((fdt_finish(fdt_skel)));
622     fdt = g_malloc0(size);
623     _FDT((fdt_open_into(fdt_skel, fdt, size)));
624     g_free(fdt_skel);
625 
626     /* Fix skeleton up */
627     _FDT((spapr_fixup_cpu_dt(fdt, spapr)));
628 
629     /* Pack resulting tree */
630     _FDT((fdt_pack(fdt)));
631 
632     if (fdt_totalsize(fdt) + sizeof(hdr) > size) {
633         trace_spapr_cas_failed(size);
634         return -1;
635     }
636 
637     cpu_physical_memory_write(addr, &hdr, sizeof(hdr));
638     cpu_physical_memory_write(addr + sizeof(hdr), fdt, fdt_totalsize(fdt));
639     trace_spapr_cas_continue(fdt_totalsize(fdt) + sizeof(hdr));
640     g_free(fdt);
641 
642     return 0;
643 }
644 
645 static void spapr_populate_memory_node(void *fdt, int nodeid, hwaddr start,
646                                        hwaddr size)
647 {
648     uint32_t associativity[] = {
649         cpu_to_be32(0x4), /* length */
650         cpu_to_be32(0x0), cpu_to_be32(0x0),
651         cpu_to_be32(0x0), cpu_to_be32(nodeid)
652     };
653     char mem_name[32];
654     uint64_t mem_reg_property[2];
655     int off;
656 
657     mem_reg_property[0] = cpu_to_be64(start);
658     mem_reg_property[1] = cpu_to_be64(size);
659 
660     sprintf(mem_name, "memory@" TARGET_FMT_lx, start);
661     off = fdt_add_subnode(fdt, 0, mem_name);
662     _FDT(off);
663     _FDT((fdt_setprop_string(fdt, off, "device_type", "memory")));
664     _FDT((fdt_setprop(fdt, off, "reg", mem_reg_property,
665                       sizeof(mem_reg_property))));
666     _FDT((fdt_setprop(fdt, off, "ibm,associativity", associativity,
667                       sizeof(associativity))));
668 }
669 
670 static int spapr_populate_memory(sPAPREnvironment *spapr, void *fdt)
671 {
672     hwaddr mem_start, node_size;
673     int i, nb_nodes = nb_numa_nodes;
674     NodeInfo *nodes = numa_info;
675     NodeInfo ramnode;
676 
677     /* No NUMA nodes, assume there is just one node with whole RAM */
678     if (!nb_numa_nodes) {
679         nb_nodes = 1;
680         ramnode.node_mem = ram_size;
681         nodes = &ramnode;
682     }
683 
684     for (i = 0, mem_start = 0; i < nb_nodes; ++i) {
685         if (!nodes[i].node_mem) {
686             continue;
687         }
688         if (mem_start >= ram_size) {
689             node_size = 0;
690         } else {
691             node_size = nodes[i].node_mem;
692             if (node_size > ram_size - mem_start) {
693                 node_size = ram_size - mem_start;
694             }
695         }
696         if (!mem_start) {
697             /* ppc_spapr_init() checks for rma_size <= node0_size already */
698             spapr_populate_memory_node(fdt, i, 0, spapr->rma_size);
699             mem_start += spapr->rma_size;
700             node_size -= spapr->rma_size;
701         }
702         for ( ; node_size; ) {
703             hwaddr sizetmp = pow2floor(node_size);
704 
705             /* mem_start != 0 here */
706             if (ctzl(mem_start) < ctzl(sizetmp)) {
707                 sizetmp = 1ULL << ctzl(mem_start);
708             }
709 
710             spapr_populate_memory_node(fdt, i, mem_start, sizetmp);
711             node_size -= sizetmp;
712             mem_start += sizetmp;
713         }
714     }
715 
716     return 0;
717 }
718 
719 static void spapr_finalize_fdt(sPAPREnvironment *spapr,
720                                hwaddr fdt_addr,
721                                hwaddr rtas_addr,
722                                hwaddr rtas_size)
723 {
724     int ret, i;
725     size_t cb = 0;
726     char *bootlist;
727     void *fdt;
728     sPAPRPHBState *phb;
729 
730     fdt = g_malloc(FDT_MAX_SIZE);
731 
732     /* open out the base tree into a temp buffer for the final tweaks */
733     _FDT((fdt_open_into(spapr->fdt_skel, fdt, FDT_MAX_SIZE)));
734 
735     ret = spapr_populate_memory(spapr, fdt);
736     if (ret < 0) {
737         fprintf(stderr, "couldn't setup memory nodes in fdt\n");
738         exit(1);
739     }
740 
741     ret = spapr_populate_vdevice(spapr->vio_bus, fdt);
742     if (ret < 0) {
743         fprintf(stderr, "couldn't setup vio devices in fdt\n");
744         exit(1);
745     }
746 
747     QLIST_FOREACH(phb, &spapr->phbs, list) {
748         ret = spapr_populate_pci_dt(phb, PHANDLE_XICP, fdt);
749     }
750 
751     if (ret < 0) {
752         fprintf(stderr, "couldn't setup PCI devices in fdt\n");
753         exit(1);
754     }
755 
756     /* RTAS */
757     ret = spapr_rtas_device_tree_setup(fdt, rtas_addr, rtas_size);
758     if (ret < 0) {
759         fprintf(stderr, "Couldn't set up RTAS device tree properties\n");
760     }
761 
762     /* Advertise NUMA via ibm,associativity */
763     ret = spapr_fixup_cpu_dt(fdt, spapr);
764     if (ret < 0) {
765         fprintf(stderr, "Couldn't finalize CPU device tree properties\n");
766     }
767 
768     bootlist = get_boot_devices_list(&cb, true);
769     if (cb && bootlist) {
770         int offset = fdt_path_offset(fdt, "/chosen");
771         if (offset < 0) {
772             exit(1);
773         }
774         for (i = 0; i < cb; i++) {
775             if (bootlist[i] == '\n') {
776                 bootlist[i] = ' ';
777             }
778 
779         }
780         ret = fdt_setprop_string(fdt, offset, "qemu,boot-list", bootlist);
781     }
782 
783     if (!spapr->has_graphics) {
784         spapr_populate_chosen_stdout(fdt, spapr->vio_bus);
785     }
786 
787     _FDT((fdt_pack(fdt)));
788 
789     if (fdt_totalsize(fdt) > FDT_MAX_SIZE) {
790         hw_error("FDT too big ! 0x%x bytes (max is 0x%x)\n",
791                  fdt_totalsize(fdt), FDT_MAX_SIZE);
792         exit(1);
793     }
794 
795     cpu_physical_memory_write(fdt_addr, fdt, fdt_totalsize(fdt));
796 
797     g_free(bootlist);
798     g_free(fdt);
799 }
800 
801 static uint64_t translate_kernel_address(void *opaque, uint64_t addr)
802 {
803     return (addr & 0x0fffffff) + KERNEL_LOAD_ADDR;
804 }
805 
806 static void emulate_spapr_hypercall(PowerPCCPU *cpu)
807 {
808     CPUPPCState *env = &cpu->env;
809 
810     if (msr_pr) {
811         hcall_dprintf("Hypercall made with MSR[PR]=1\n");
812         env->gpr[3] = H_PRIVILEGE;
813     } else {
814         env->gpr[3] = spapr_hypercall(cpu, env->gpr[3], &env->gpr[4]);
815     }
816 }
817 
818 #define HPTE(_table, _i)   (void *)(((uint64_t *)(_table)) + ((_i) * 2))
819 #define HPTE_VALID(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_VALID)
820 #define HPTE_DIRTY(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_HPTE_DIRTY)
821 #define CLEAN_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) &= tswap64(~HPTE64_V_HPTE_DIRTY))
822 #define DIRTY_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) |= tswap64(HPTE64_V_HPTE_DIRTY))
823 
824 static void spapr_reset_htab(sPAPREnvironment *spapr)
825 {
826     long shift;
827     int index;
828 
829     /* allocate hash page table.  For now we always make this 16mb,
830      * later we should probably make it scale to the size of guest
831      * RAM */
832 
833     shift = kvmppc_reset_htab(spapr->htab_shift);
834 
835     if (shift > 0) {
836         /* Kernel handles htab, we don't need to allocate one */
837         spapr->htab_shift = shift;
838         kvmppc_kern_htab = true;
839 
840         /* Tell readers to update their file descriptor */
841         if (spapr->htab_fd >= 0) {
842             spapr->htab_fd_stale = true;
843         }
844     } else {
845         if (!spapr->htab) {
846             /* Allocate an htab if we don't yet have one */
847             spapr->htab = qemu_memalign(HTAB_SIZE(spapr), HTAB_SIZE(spapr));
848         }
849 
850         /* And clear it */
851         memset(spapr->htab, 0, HTAB_SIZE(spapr));
852 
853         for (index = 0; index < HTAB_SIZE(spapr) / HASH_PTE_SIZE_64; index++) {
854             DIRTY_HPTE(HPTE(spapr->htab, index));
855         }
856     }
857 
858     /* Update the RMA size if necessary */
859     if (spapr->vrma_adjust) {
860         spapr->rma_size = kvmppc_rma_size(spapr_node0_size(),
861                                           spapr->htab_shift);
862     }
863 }
864 
865 static int find_unknown_sysbus_device(SysBusDevice *sbdev, void *opaque)
866 {
867     bool matched = false;
868 
869     if (object_dynamic_cast(OBJECT(sbdev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
870         matched = true;
871     }
872 
873     if (!matched) {
874         error_report("Device %s is not supported by this machine yet.",
875                      qdev_fw_name(DEVICE(sbdev)));
876         exit(1);
877     }
878 
879     return 0;
880 }
881 
882 /*
883  * A guest reset will cause spapr->htab_fd to become stale if being used.
884  * Reopen the file descriptor to make sure the whole HTAB is properly read.
885  */
886 static int spapr_check_htab_fd(sPAPREnvironment *spapr)
887 {
888     int rc = 0;
889 
890     if (spapr->htab_fd_stale) {
891         close(spapr->htab_fd);
892         spapr->htab_fd = kvmppc_get_htab_fd(false);
893         if (spapr->htab_fd < 0) {
894             error_report("Unable to open fd for reading hash table from KVM: "
895                     "%s", strerror(errno));
896             rc = -1;
897         }
898         spapr->htab_fd_stale = false;
899     }
900 
901     return rc;
902 }
903 
904 static void ppc_spapr_reset(void)
905 {
906     PowerPCCPU *first_ppc_cpu;
907     uint32_t rtas_limit;
908 
909     /* Check for unknown sysbus devices */
910     foreach_dynamic_sysbus_device(find_unknown_sysbus_device, NULL);
911 
912     /* Reset the hash table & recalc the RMA */
913     spapr_reset_htab(spapr);
914 
915     qemu_devices_reset();
916 
917     /*
918      * We place the device tree and RTAS just below either the top of the RMA,
919      * or just below 2GB, whichever is lowere, so that it can be
920      * processed with 32-bit real mode code if necessary
921      */
922     rtas_limit = MIN(spapr->rma_size, RTAS_MAX_ADDR);
923     spapr->rtas_addr = rtas_limit - RTAS_MAX_SIZE;
924     spapr->fdt_addr = spapr->rtas_addr - FDT_MAX_SIZE;
925 
926     /* Load the fdt */
927     spapr_finalize_fdt(spapr, spapr->fdt_addr, spapr->rtas_addr,
928                        spapr->rtas_size);
929 
930     /* Copy RTAS over */
931     cpu_physical_memory_write(spapr->rtas_addr, spapr->rtas_blob,
932                               spapr->rtas_size);
933 
934     /* Set up the entry state */
935     first_ppc_cpu = POWERPC_CPU(first_cpu);
936     first_ppc_cpu->env.gpr[3] = spapr->fdt_addr;
937     first_ppc_cpu->env.gpr[5] = 0;
938     first_cpu->halted = 0;
939     first_ppc_cpu->env.nip = spapr->entry_point;
940 
941 }
942 
943 static void spapr_cpu_reset(void *opaque)
944 {
945     PowerPCCPU *cpu = opaque;
946     CPUState *cs = CPU(cpu);
947     CPUPPCState *env = &cpu->env;
948 
949     cpu_reset(cs);
950 
951     /* All CPUs start halted.  CPU0 is unhalted from the machine level
952      * reset code and the rest are explicitly started up by the guest
953      * using an RTAS call */
954     cs->halted = 1;
955 
956     env->spr[SPR_HIOR] = 0;
957 
958     env->external_htab = (uint8_t *)spapr->htab;
959     if (kvm_enabled() && !env->external_htab) {
960         /*
961          * HV KVM, set external_htab to 1 so our ppc_hash64_load_hpte*
962          * functions do the right thing.
963          */
964         env->external_htab = (void *)1;
965     }
966     env->htab_base = -1;
967     /*
968      * htab_mask is the mask used to normalize hash value to PTEG index.
969      * htab_shift is log2 of hash table size.
970      * We have 8 hpte per group, and each hpte is 16 bytes.
971      * ie have 128 bytes per hpte entry.
972      */
973     env->htab_mask = (1ULL << ((spapr)->htab_shift - 7)) - 1;
974     env->spr[SPR_SDR1] = (target_ulong)(uintptr_t)spapr->htab |
975         (spapr->htab_shift - 18);
976 }
977 
978 static void spapr_create_nvram(sPAPREnvironment *spapr)
979 {
980     DeviceState *dev = qdev_create(&spapr->vio_bus->bus, "spapr-nvram");
981     DriveInfo *dinfo = drive_get(IF_PFLASH, 0, 0);
982 
983     if (dinfo) {
984         qdev_prop_set_drive_nofail(dev, "drive", blk_by_legacy_dinfo(dinfo));
985     }
986 
987     qdev_init_nofail(dev);
988 
989     spapr->nvram = (struct sPAPRNVRAM *)dev;
990 }
991 
992 static void spapr_rtc_create(sPAPREnvironment *spapr)
993 {
994     DeviceState *dev = qdev_create(NULL, TYPE_SPAPR_RTC);
995 
996     qdev_init_nofail(dev);
997     spapr->rtc = dev;
998 
999     object_property_add_alias(qdev_get_machine(), "rtc-time",
1000                               OBJECT(spapr->rtc), "date", NULL);
1001 }
1002 
1003 /* Returns whether we want to use VGA or not */
1004 static int spapr_vga_init(PCIBus *pci_bus)
1005 {
1006     switch (vga_interface_type) {
1007     case VGA_NONE:
1008         return false;
1009     case VGA_DEVICE:
1010         return true;
1011     case VGA_STD:
1012         return pci_vga_init(pci_bus) != NULL;
1013     default:
1014         fprintf(stderr, "This vga model is not supported,"
1015                 "currently it only supports -vga std\n");
1016         exit(0);
1017     }
1018 }
1019 
1020 static int spapr_post_load(void *opaque, int version_id)
1021 {
1022     sPAPREnvironment *spapr = (sPAPREnvironment *)opaque;
1023     int err = 0;
1024 
1025     /* In earlier versions, there was no seperate qdev for the PAPR
1026      * RTC, so the RTC offset was stored directly in sPAPREnvironment.
1027      * So when migrating from those versions, poke the incoming offset
1028      * value into the RTC device */
1029     if (version_id < 3) {
1030         err = spapr_rtc_import_offset(spapr->rtc, spapr->rtc_offset);
1031     }
1032 
1033     return err;
1034 }
1035 
1036 static bool version_before_3(void *opaque, int version_id)
1037 {
1038     return version_id < 3;
1039 }
1040 
1041 static const VMStateDescription vmstate_spapr = {
1042     .name = "spapr",
1043     .version_id = 3,
1044     .minimum_version_id = 1,
1045     .post_load = spapr_post_load,
1046     .fields = (VMStateField[]) {
1047         /* used to be @next_irq */
1048         VMSTATE_UNUSED_BUFFER(version_before_3, 0, 4),
1049 
1050         /* RTC offset */
1051         VMSTATE_UINT64_TEST(rtc_offset, sPAPREnvironment, version_before_3),
1052 
1053         VMSTATE_PPC_TIMEBASE_V(tb, sPAPREnvironment, 2),
1054         VMSTATE_END_OF_LIST()
1055     },
1056 };
1057 
1058 static int htab_save_setup(QEMUFile *f, void *opaque)
1059 {
1060     sPAPREnvironment *spapr = opaque;
1061 
1062     /* "Iteration" header */
1063     qemu_put_be32(f, spapr->htab_shift);
1064 
1065     if (spapr->htab) {
1066         spapr->htab_save_index = 0;
1067         spapr->htab_first_pass = true;
1068     } else {
1069         assert(kvm_enabled());
1070 
1071         spapr->htab_fd = kvmppc_get_htab_fd(false);
1072         spapr->htab_fd_stale = false;
1073         if (spapr->htab_fd < 0) {
1074             fprintf(stderr, "Unable to open fd for reading hash table from KVM: %s\n",
1075                     strerror(errno));
1076             return -1;
1077         }
1078     }
1079 
1080 
1081     return 0;
1082 }
1083 
1084 static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr,
1085                                  int64_t max_ns)
1086 {
1087     int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
1088     int index = spapr->htab_save_index;
1089     int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
1090 
1091     assert(spapr->htab_first_pass);
1092 
1093     do {
1094         int chunkstart;
1095 
1096         /* Consume invalid HPTEs */
1097         while ((index < htabslots)
1098                && !HPTE_VALID(HPTE(spapr->htab, index))) {
1099             index++;
1100             CLEAN_HPTE(HPTE(spapr->htab, index));
1101         }
1102 
1103         /* Consume valid HPTEs */
1104         chunkstart = index;
1105         while ((index < htabslots) && (index - chunkstart < USHRT_MAX)
1106                && HPTE_VALID(HPTE(spapr->htab, index))) {
1107             index++;
1108             CLEAN_HPTE(HPTE(spapr->htab, index));
1109         }
1110 
1111         if (index > chunkstart) {
1112             int n_valid = index - chunkstart;
1113 
1114             qemu_put_be32(f, chunkstart);
1115             qemu_put_be16(f, n_valid);
1116             qemu_put_be16(f, 0);
1117             qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
1118                             HASH_PTE_SIZE_64 * n_valid);
1119 
1120             if ((qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - starttime) > max_ns) {
1121                 break;
1122             }
1123         }
1124     } while ((index < htabslots) && !qemu_file_rate_limit(f));
1125 
1126     if (index >= htabslots) {
1127         assert(index == htabslots);
1128         index = 0;
1129         spapr->htab_first_pass = false;
1130     }
1131     spapr->htab_save_index = index;
1132 }
1133 
1134 static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr,
1135                                 int64_t max_ns)
1136 {
1137     bool final = max_ns < 0;
1138     int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
1139     int examined = 0, sent = 0;
1140     int index = spapr->htab_save_index;
1141     int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
1142 
1143     assert(!spapr->htab_first_pass);
1144 
1145     do {
1146         int chunkstart, invalidstart;
1147 
1148         /* Consume non-dirty HPTEs */
1149         while ((index < htabslots)
1150                && !HPTE_DIRTY(HPTE(spapr->htab, index))) {
1151             index++;
1152             examined++;
1153         }
1154 
1155         chunkstart = index;
1156         /* Consume valid dirty HPTEs */
1157         while ((index < htabslots) && (index - chunkstart < USHRT_MAX)
1158                && HPTE_DIRTY(HPTE(spapr->htab, index))
1159                && HPTE_VALID(HPTE(spapr->htab, index))) {
1160             CLEAN_HPTE(HPTE(spapr->htab, index));
1161             index++;
1162             examined++;
1163         }
1164 
1165         invalidstart = index;
1166         /* Consume invalid dirty HPTEs */
1167         while ((index < htabslots) && (index - invalidstart < USHRT_MAX)
1168                && HPTE_DIRTY(HPTE(spapr->htab, index))
1169                && !HPTE_VALID(HPTE(spapr->htab, index))) {
1170             CLEAN_HPTE(HPTE(spapr->htab, index));
1171             index++;
1172             examined++;
1173         }
1174 
1175         if (index > chunkstart) {
1176             int n_valid = invalidstart - chunkstart;
1177             int n_invalid = index - invalidstart;
1178 
1179             qemu_put_be32(f, chunkstart);
1180             qemu_put_be16(f, n_valid);
1181             qemu_put_be16(f, n_invalid);
1182             qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
1183                             HASH_PTE_SIZE_64 * n_valid);
1184             sent += index - chunkstart;
1185 
1186             if (!final && (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - starttime) > max_ns) {
1187                 break;
1188             }
1189         }
1190 
1191         if (examined >= htabslots) {
1192             break;
1193         }
1194 
1195         if (index >= htabslots) {
1196             assert(index == htabslots);
1197             index = 0;
1198         }
1199     } while ((examined < htabslots) && (!qemu_file_rate_limit(f) || final));
1200 
1201     if (index >= htabslots) {
1202         assert(index == htabslots);
1203         index = 0;
1204     }
1205 
1206     spapr->htab_save_index = index;
1207 
1208     return (examined >= htabslots) && (sent == 0) ? 1 : 0;
1209 }
1210 
1211 #define MAX_ITERATION_NS    5000000 /* 5 ms */
1212 #define MAX_KVM_BUF_SIZE    2048
1213 
1214 static int htab_save_iterate(QEMUFile *f, void *opaque)
1215 {
1216     sPAPREnvironment *spapr = opaque;
1217     int rc = 0;
1218 
1219     /* Iteration header */
1220     qemu_put_be32(f, 0);
1221 
1222     if (!spapr->htab) {
1223         assert(kvm_enabled());
1224 
1225         rc = spapr_check_htab_fd(spapr);
1226         if (rc < 0) {
1227             return rc;
1228         }
1229 
1230         rc = kvmppc_save_htab(f, spapr->htab_fd,
1231                               MAX_KVM_BUF_SIZE, MAX_ITERATION_NS);
1232         if (rc < 0) {
1233             return rc;
1234         }
1235     } else  if (spapr->htab_first_pass) {
1236         htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
1237     } else {
1238         rc = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
1239     }
1240 
1241     /* End marker */
1242     qemu_put_be32(f, 0);
1243     qemu_put_be16(f, 0);
1244     qemu_put_be16(f, 0);
1245 
1246     return rc;
1247 }
1248 
1249 static int htab_save_complete(QEMUFile *f, void *opaque)
1250 {
1251     sPAPREnvironment *spapr = opaque;
1252 
1253     /* Iteration header */
1254     qemu_put_be32(f, 0);
1255 
1256     if (!spapr->htab) {
1257         int rc;
1258 
1259         assert(kvm_enabled());
1260 
1261         rc = spapr_check_htab_fd(spapr);
1262         if (rc < 0) {
1263             return rc;
1264         }
1265 
1266         rc = kvmppc_save_htab(f, spapr->htab_fd, MAX_KVM_BUF_SIZE, -1);
1267         if (rc < 0) {
1268             return rc;
1269         }
1270         close(spapr->htab_fd);
1271         spapr->htab_fd = -1;
1272     } else {
1273         htab_save_later_pass(f, spapr, -1);
1274     }
1275 
1276     /* End marker */
1277     qemu_put_be32(f, 0);
1278     qemu_put_be16(f, 0);
1279     qemu_put_be16(f, 0);
1280 
1281     return 0;
1282 }
1283 
1284 static int htab_load(QEMUFile *f, void *opaque, int version_id)
1285 {
1286     sPAPREnvironment *spapr = opaque;
1287     uint32_t section_hdr;
1288     int fd = -1;
1289 
1290     if (version_id < 1 || version_id > 1) {
1291         fprintf(stderr, "htab_load() bad version\n");
1292         return -EINVAL;
1293     }
1294 
1295     section_hdr = qemu_get_be32(f);
1296 
1297     if (section_hdr) {
1298         /* First section, just the hash shift */
1299         if (spapr->htab_shift != section_hdr) {
1300             return -EINVAL;
1301         }
1302         return 0;
1303     }
1304 
1305     if (!spapr->htab) {
1306         assert(kvm_enabled());
1307 
1308         fd = kvmppc_get_htab_fd(true);
1309         if (fd < 0) {
1310             fprintf(stderr, "Unable to open fd to restore KVM hash table: %s\n",
1311                     strerror(errno));
1312         }
1313     }
1314 
1315     while (true) {
1316         uint32_t index;
1317         uint16_t n_valid, n_invalid;
1318 
1319         index = qemu_get_be32(f);
1320         n_valid = qemu_get_be16(f);
1321         n_invalid = qemu_get_be16(f);
1322 
1323         if ((index == 0) && (n_valid == 0) && (n_invalid == 0)) {
1324             /* End of Stream */
1325             break;
1326         }
1327 
1328         if ((index + n_valid + n_invalid) >
1329             (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
1330             /* Bad index in stream */
1331             fprintf(stderr, "htab_load() bad index %d (%hd+%hd entries) "
1332                     "in htab stream (htab_shift=%d)\n", index, n_valid, n_invalid,
1333                     spapr->htab_shift);
1334             return -EINVAL;
1335         }
1336 
1337         if (spapr->htab) {
1338             if (n_valid) {
1339                 qemu_get_buffer(f, HPTE(spapr->htab, index),
1340                                 HASH_PTE_SIZE_64 * n_valid);
1341             }
1342             if (n_invalid) {
1343                 memset(HPTE(spapr->htab, index + n_valid), 0,
1344                        HASH_PTE_SIZE_64 * n_invalid);
1345             }
1346         } else {
1347             int rc;
1348 
1349             assert(fd >= 0);
1350 
1351             rc = kvmppc_load_htab_chunk(f, fd, index, n_valid, n_invalid);
1352             if (rc < 0) {
1353                 return rc;
1354             }
1355         }
1356     }
1357 
1358     if (!spapr->htab) {
1359         assert(fd >= 0);
1360         close(fd);
1361     }
1362 
1363     return 0;
1364 }
1365 
1366 static SaveVMHandlers savevm_htab_handlers = {
1367     .save_live_setup = htab_save_setup,
1368     .save_live_iterate = htab_save_iterate,
1369     .save_live_complete = htab_save_complete,
1370     .load_state = htab_load,
1371 };
1372 
1373 /* pSeries LPAR / sPAPR hardware init */
1374 static void ppc_spapr_init(MachineState *machine)
1375 {
1376     ram_addr_t ram_size = machine->ram_size;
1377     const char *cpu_model = machine->cpu_model;
1378     const char *kernel_filename = machine->kernel_filename;
1379     const char *kernel_cmdline = machine->kernel_cmdline;
1380     const char *initrd_filename = machine->initrd_filename;
1381     const char *boot_device = machine->boot_order;
1382     PowerPCCPU *cpu;
1383     CPUPPCState *env;
1384     PCIHostState *phb;
1385     int i;
1386     MemoryRegion *sysmem = get_system_memory();
1387     MemoryRegion *ram = g_new(MemoryRegion, 1);
1388     MemoryRegion *rma_region;
1389     void *rma = NULL;
1390     hwaddr rma_alloc_size;
1391     hwaddr node0_size = spapr_node0_size();
1392     uint32_t initrd_base = 0;
1393     long kernel_size = 0, initrd_size = 0;
1394     long load_limit, fw_size;
1395     bool kernel_le = false;
1396     char *filename;
1397 
1398     msi_supported = true;
1399 
1400     spapr = g_malloc0(sizeof(*spapr));
1401     QLIST_INIT(&spapr->phbs);
1402 
1403     cpu_ppc_hypercall = emulate_spapr_hypercall;
1404 
1405     /* Allocate RMA if necessary */
1406     rma_alloc_size = kvmppc_alloc_rma(&rma);
1407 
1408     if (rma_alloc_size == -1) {
1409         hw_error("qemu: Unable to create RMA\n");
1410         exit(1);
1411     }
1412 
1413     if (rma_alloc_size && (rma_alloc_size < node0_size)) {
1414         spapr->rma_size = rma_alloc_size;
1415     } else {
1416         spapr->rma_size = node0_size;
1417 
1418         /* With KVM, we don't actually know whether KVM supports an
1419          * unbounded RMA (PR KVM) or is limited by the hash table size
1420          * (HV KVM using VRMA), so we always assume the latter
1421          *
1422          * In that case, we also limit the initial allocations for RTAS
1423          * etc... to 256M since we have no way to know what the VRMA size
1424          * is going to be as it depends on the size of the hash table
1425          * isn't determined yet.
1426          */
1427         if (kvm_enabled()) {
1428             spapr->vrma_adjust = 1;
1429             spapr->rma_size = MIN(spapr->rma_size, 0x10000000);
1430         }
1431     }
1432 
1433     if (spapr->rma_size > node0_size) {
1434         fprintf(stderr, "Error: Numa node 0 has to span the RMA (%#08"HWADDR_PRIx")\n",
1435                 spapr->rma_size);
1436         exit(1);
1437     }
1438 
1439     /* Setup a load limit for the ramdisk leaving room for SLOF and FDT */
1440     load_limit = MIN(spapr->rma_size, RTAS_MAX_ADDR) - FW_OVERHEAD;
1441 
1442     /* We aim for a hash table of size 1/128 the size of RAM.  The
1443      * normal rule of thumb is 1/64 the size of RAM, but that's much
1444      * more than needed for the Linux guests we support. */
1445     spapr->htab_shift = 18; /* Minimum architected size */
1446     while (spapr->htab_shift <= 46) {
1447         if ((1ULL << (spapr->htab_shift + 7)) >= ram_size) {
1448             break;
1449         }
1450         spapr->htab_shift++;
1451     }
1452 
1453     /* Set up Interrupt Controller before we create the VCPUs */
1454     spapr->icp = xics_system_init(machine,
1455                                   smp_cpus * kvmppc_smt_threads() / smp_threads,
1456                                   XICS_IRQS);
1457 
1458     /* init CPUs */
1459     if (cpu_model == NULL) {
1460         cpu_model = kvm_enabled() ? "host" : "POWER7";
1461     }
1462     for (i = 0; i < smp_cpus; i++) {
1463         cpu = cpu_ppc_init(cpu_model);
1464         if (cpu == NULL) {
1465             fprintf(stderr, "Unable to find PowerPC CPU definition\n");
1466             exit(1);
1467         }
1468         env = &cpu->env;
1469 
1470         /* Set time-base frequency to 512 MHz */
1471         cpu_ppc_tb_init(env, TIMEBASE_FREQ);
1472 
1473         /* PAPR always has exception vectors in RAM not ROM. To ensure this,
1474          * MSR[IP] should never be set.
1475          */
1476         env->msr_mask &= ~(1 << 6);
1477 
1478         /* Tell KVM that we're in PAPR mode */
1479         if (kvm_enabled()) {
1480             kvmppc_set_papr(cpu);
1481         }
1482 
1483         if (cpu->max_compat) {
1484             if (ppc_set_compat(cpu, cpu->max_compat) < 0) {
1485                 exit(1);
1486             }
1487         }
1488 
1489         xics_cpu_setup(spapr->icp, cpu);
1490 
1491         qemu_register_reset(spapr_cpu_reset, cpu);
1492     }
1493 
1494     /* allocate RAM */
1495     spapr->ram_limit = ram_size;
1496     memory_region_allocate_system_memory(ram, NULL, "ppc_spapr.ram",
1497                                          spapr->ram_limit);
1498     memory_region_add_subregion(sysmem, 0, ram);
1499 
1500     if (rma_alloc_size && rma) {
1501         rma_region = g_new(MemoryRegion, 1);
1502         memory_region_init_ram_ptr(rma_region, NULL, "ppc_spapr.rma",
1503                                    rma_alloc_size, rma);
1504         vmstate_register_ram_global(rma_region);
1505         memory_region_add_subregion(sysmem, 0, rma_region);
1506     }
1507 
1508     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, "spapr-rtas.bin");
1509     spapr->rtas_size = get_image_size(filename);
1510     spapr->rtas_blob = g_malloc(spapr->rtas_size);
1511     if (load_image_size(filename, spapr->rtas_blob, spapr->rtas_size) < 0) {
1512         hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
1513         exit(1);
1514     }
1515     if (spapr->rtas_size > RTAS_MAX_SIZE) {
1516         hw_error("RTAS too big ! 0x%zx bytes (max is 0x%x)\n",
1517                  (size_t)spapr->rtas_size, RTAS_MAX_SIZE);
1518         exit(1);
1519     }
1520     g_free(filename);
1521 
1522     /* Set up EPOW events infrastructure */
1523     spapr_events_init(spapr);
1524 
1525     /* Set up the RTC RTAS interfaces */
1526     spapr_rtc_create(spapr);
1527 
1528     /* Set up VIO bus */
1529     spapr->vio_bus = spapr_vio_bus_init();
1530 
1531     for (i = 0; i < MAX_SERIAL_PORTS; i++) {
1532         if (serial_hds[i]) {
1533             spapr_vty_create(spapr->vio_bus, serial_hds[i]);
1534         }
1535     }
1536 
1537     /* We always have at least the nvram device on VIO */
1538     spapr_create_nvram(spapr);
1539 
1540     /* Set up PCI */
1541     spapr_pci_rtas_init();
1542 
1543     phb = spapr_create_phb(spapr, 0);
1544 
1545     for (i = 0; i < nb_nics; i++) {
1546         NICInfo *nd = &nd_table[i];
1547 
1548         if (!nd->model) {
1549             nd->model = g_strdup("ibmveth");
1550         }
1551 
1552         if (strcmp(nd->model, "ibmveth") == 0) {
1553             spapr_vlan_create(spapr->vio_bus, nd);
1554         } else {
1555             pci_nic_init_nofail(&nd_table[i], phb->bus, nd->model, NULL);
1556         }
1557     }
1558 
1559     for (i = 0; i <= drive_get_max_bus(IF_SCSI); i++) {
1560         spapr_vscsi_create(spapr->vio_bus);
1561     }
1562 
1563     /* Graphics */
1564     if (spapr_vga_init(phb->bus)) {
1565         spapr->has_graphics = true;
1566         machine->usb |= defaults_enabled();
1567     }
1568 
1569     if (machine->usb) {
1570         pci_create_simple(phb->bus, -1, "pci-ohci");
1571 
1572         if (spapr->has_graphics) {
1573             USBBus *usb_bus = usb_bus_find(-1);
1574 
1575             usb_create_simple(usb_bus, "usb-kbd");
1576             usb_create_simple(usb_bus, "usb-mouse");
1577         }
1578     }
1579 
1580     if (spapr->rma_size < (MIN_RMA_SLOF << 20)) {
1581         fprintf(stderr, "qemu: pSeries SLOF firmware requires >= "
1582                 "%ldM guest RMA (Real Mode Area memory)\n", MIN_RMA_SLOF);
1583         exit(1);
1584     }
1585 
1586     if (kernel_filename) {
1587         uint64_t lowaddr = 0;
1588 
1589         kernel_size = load_elf(kernel_filename, translate_kernel_address, NULL,
1590                                NULL, &lowaddr, NULL, 1, ELF_MACHINE, 0);
1591         if (kernel_size == ELF_LOAD_WRONG_ENDIAN) {
1592             kernel_size = load_elf(kernel_filename,
1593                                    translate_kernel_address, NULL,
1594                                    NULL, &lowaddr, NULL, 0, ELF_MACHINE, 0);
1595             kernel_le = kernel_size > 0;
1596         }
1597         if (kernel_size < 0) {
1598             fprintf(stderr, "qemu: error loading %s: %s\n",
1599                     kernel_filename, load_elf_strerror(kernel_size));
1600             exit(1);
1601         }
1602 
1603         /* load initrd */
1604         if (initrd_filename) {
1605             /* Try to locate the initrd in the gap between the kernel
1606              * and the firmware. Add a bit of space just in case
1607              */
1608             initrd_base = (KERNEL_LOAD_ADDR + kernel_size + 0x1ffff) & ~0xffff;
1609             initrd_size = load_image_targphys(initrd_filename, initrd_base,
1610                                               load_limit - initrd_base);
1611             if (initrd_size < 0) {
1612                 fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",
1613                         initrd_filename);
1614                 exit(1);
1615             }
1616         } else {
1617             initrd_base = 0;
1618             initrd_size = 0;
1619         }
1620     }
1621 
1622     if (bios_name == NULL) {
1623         bios_name = FW_FILE_NAME;
1624     }
1625     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
1626     fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE);
1627     if (fw_size < 0) {
1628         hw_error("qemu: could not load LPAR rtas '%s'\n", filename);
1629         exit(1);
1630     }
1631     g_free(filename);
1632 
1633     spapr->entry_point = 0x100;
1634 
1635     vmstate_register(NULL, 0, &vmstate_spapr, spapr);
1636     register_savevm_live(NULL, "spapr/htab", -1, 1,
1637                          &savevm_htab_handlers, spapr);
1638 
1639     /* Prepare the device tree */
1640     spapr->fdt_skel = spapr_create_fdt_skel(initrd_base, initrd_size,
1641                                             kernel_size, kernel_le,
1642                                             boot_device, kernel_cmdline,
1643                                             spapr->epow_irq);
1644     assert(spapr->fdt_skel != NULL);
1645 }
1646 
1647 static int spapr_kvm_type(const char *vm_type)
1648 {
1649     if (!vm_type) {
1650         return 0;
1651     }
1652 
1653     if (!strcmp(vm_type, "HV")) {
1654         return 1;
1655     }
1656 
1657     if (!strcmp(vm_type, "PR")) {
1658         return 2;
1659     }
1660 
1661     error_report("Unknown kvm-type specified '%s'", vm_type);
1662     exit(1);
1663 }
1664 
1665 /*
1666  * Implementation of an interface to adjust firmware path
1667  * for the bootindex property handling.
1668  */
1669 static char *spapr_get_fw_dev_path(FWPathProvider *p, BusState *bus,
1670                                    DeviceState *dev)
1671 {
1672 #define CAST(type, obj, name) \
1673     ((type *)object_dynamic_cast(OBJECT(obj), (name)))
1674     SCSIDevice *d = CAST(SCSIDevice,  dev, TYPE_SCSI_DEVICE);
1675     sPAPRPHBState *phb = CAST(sPAPRPHBState, dev, TYPE_SPAPR_PCI_HOST_BRIDGE);
1676 
1677     if (d) {
1678         void *spapr = CAST(void, bus->parent, "spapr-vscsi");
1679         VirtIOSCSI *virtio = CAST(VirtIOSCSI, bus->parent, TYPE_VIRTIO_SCSI);
1680         USBDevice *usb = CAST(USBDevice, bus->parent, TYPE_USB_DEVICE);
1681 
1682         if (spapr) {
1683             /*
1684              * Replace "channel@0/disk@0,0" with "disk@8000000000000000":
1685              * We use SRP luns of the form 8000 | (bus << 8) | (id << 5) | lun
1686              * in the top 16 bits of the 64-bit LUN
1687              */
1688             unsigned id = 0x8000 | (d->id << 8) | d->lun;
1689             return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
1690                                    (uint64_t)id << 48);
1691         } else if (virtio) {
1692             /*
1693              * We use SRP luns of the form 01000000 | (target << 8) | lun
1694              * in the top 32 bits of the 64-bit LUN
1695              * Note: the quote above is from SLOF and it is wrong,
1696              * the actual binding is:
1697              * swap 0100 or 10 << or 20 << ( target lun-id -- srplun )
1698              */
1699             unsigned id = 0x1000000 | (d->id << 16) | d->lun;
1700             return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
1701                                    (uint64_t)id << 32);
1702         } else if (usb) {
1703             /*
1704              * We use SRP luns of the form 01000000 | (usb-port << 16) | lun
1705              * in the top 32 bits of the 64-bit LUN
1706              */
1707             unsigned usb_port = atoi(usb->port->path);
1708             unsigned id = 0x1000000 | (usb_port << 16) | d->lun;
1709             return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
1710                                    (uint64_t)id << 32);
1711         }
1712     }
1713 
1714     if (phb) {
1715         /* Replace "pci" with "pci@800000020000000" */
1716         return g_strdup_printf("pci@%"PRIX64, phb->buid);
1717     }
1718 
1719     return NULL;
1720 }
1721 
1722 static char *spapr_get_kvm_type(Object *obj, Error **errp)
1723 {
1724     sPAPRMachineState *sm = SPAPR_MACHINE(obj);
1725 
1726     return g_strdup(sm->kvm_type);
1727 }
1728 
1729 static void spapr_set_kvm_type(Object *obj, const char *value, Error **errp)
1730 {
1731     sPAPRMachineState *sm = SPAPR_MACHINE(obj);
1732 
1733     g_free(sm->kvm_type);
1734     sm->kvm_type = g_strdup(value);
1735 }
1736 
1737 static void spapr_machine_initfn(Object *obj)
1738 {
1739     object_property_add_str(obj, "kvm-type",
1740                             spapr_get_kvm_type, spapr_set_kvm_type, NULL);
1741     object_property_set_description(obj, "kvm-type",
1742                                     "Specifies the KVM virtualization mode (HV, PR)",
1743                                     NULL);
1744 }
1745 
1746 static void ppc_cpu_do_nmi_on_cpu(void *arg)
1747 {
1748     CPUState *cs = arg;
1749 
1750     cpu_synchronize_state(cs);
1751     ppc_cpu_do_system_reset(cs);
1752 }
1753 
1754 static void spapr_nmi(NMIState *n, int cpu_index, Error **errp)
1755 {
1756     CPUState *cs;
1757 
1758     CPU_FOREACH(cs) {
1759         async_run_on_cpu(cs, ppc_cpu_do_nmi_on_cpu, cs);
1760     }
1761 }
1762 
1763 static void spapr_machine_class_init(ObjectClass *oc, void *data)
1764 {
1765     MachineClass *mc = MACHINE_CLASS(oc);
1766     FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);
1767     NMIClass *nc = NMI_CLASS(oc);
1768 
1769     mc->init = ppc_spapr_init;
1770     mc->reset = ppc_spapr_reset;
1771     mc->block_default_type = IF_SCSI;
1772     mc->max_cpus = MAX_CPUS;
1773     mc->no_parallel = 1;
1774     mc->default_boot_order = NULL;
1775     mc->kvm_type = spapr_kvm_type;
1776     mc->has_dynamic_sysbus = true;
1777 
1778     fwc->get_dev_path = spapr_get_fw_dev_path;
1779     nc->nmi_monitor_handler = spapr_nmi;
1780 }
1781 
1782 static const TypeInfo spapr_machine_info = {
1783     .name          = TYPE_SPAPR_MACHINE,
1784     .parent        = TYPE_MACHINE,
1785     .abstract      = true,
1786     .instance_size = sizeof(sPAPRMachineState),
1787     .instance_init = spapr_machine_initfn,
1788     .class_init    = spapr_machine_class_init,
1789     .interfaces = (InterfaceInfo[]) {
1790         { TYPE_FW_PATH_PROVIDER },
1791         { TYPE_NMI },
1792         { }
1793     },
1794 };
1795 
1796 #define SPAPR_COMPAT_2_2 \
1797         {\
1798             .driver   = TYPE_SPAPR_PCI_HOST_BRIDGE,\
1799             .property = "mem_win_size",\
1800             .value    = "0x20000000",\
1801         }
1802 
1803 #define SPAPR_COMPAT_2_1 \
1804         SPAPR_COMPAT_2_2
1805 
1806 static void spapr_machine_2_1_class_init(ObjectClass *oc, void *data)
1807 {
1808     MachineClass *mc = MACHINE_CLASS(oc);
1809     static GlobalProperty compat_props[] = {
1810         HW_COMPAT_2_1,
1811         SPAPR_COMPAT_2_1,
1812         { /* end of list */ }
1813     };
1814 
1815     mc->name = "pseries-2.1";
1816     mc->desc = "pSeries Logical Partition (PAPR compliant) v2.1";
1817     mc->compat_props = compat_props;
1818 }
1819 
1820 static const TypeInfo spapr_machine_2_1_info = {
1821     .name          = TYPE_SPAPR_MACHINE "2.1",
1822     .parent        = TYPE_SPAPR_MACHINE,
1823     .class_init    = spapr_machine_2_1_class_init,
1824 };
1825 
1826 static void spapr_machine_2_2_class_init(ObjectClass *oc, void *data)
1827 {
1828     static GlobalProperty compat_props[] = {
1829         SPAPR_COMPAT_2_2,
1830         { /* end of list */ }
1831     };
1832     MachineClass *mc = MACHINE_CLASS(oc);
1833 
1834     mc->name = "pseries-2.2";
1835     mc->desc = "pSeries Logical Partition (PAPR compliant) v2.2";
1836     mc->compat_props = compat_props;
1837 }
1838 
1839 static const TypeInfo spapr_machine_2_2_info = {
1840     .name          = TYPE_SPAPR_MACHINE "2.2",
1841     .parent        = TYPE_SPAPR_MACHINE,
1842     .class_init    = spapr_machine_2_2_class_init,
1843 };
1844 
1845 static void spapr_machine_2_3_class_init(ObjectClass *oc, void *data)
1846 {
1847     MachineClass *mc = MACHINE_CLASS(oc);
1848 
1849     mc->name = "pseries-2.3";
1850     mc->desc = "pSeries Logical Partition (PAPR compliant) v2.3";
1851     mc->alias = "pseries";
1852     mc->is_default = 1;
1853 }
1854 
1855 static const TypeInfo spapr_machine_2_3_info = {
1856     .name          = TYPE_SPAPR_MACHINE "2.3",
1857     .parent        = TYPE_SPAPR_MACHINE,
1858     .class_init    = spapr_machine_2_3_class_init,
1859 };
1860 
1861 static void spapr_machine_register_types(void)
1862 {
1863     type_register_static(&spapr_machine_info);
1864     type_register_static(&spapr_machine_2_1_info);
1865     type_register_static(&spapr_machine_2_2_info);
1866     type_register_static(&spapr_machine_2_3_info);
1867 }
1868 
1869 type_init(spapr_machine_register_types)
1870