2 * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
4 * Copyright (c) 2004-2007 Fabrice Bellard
5 * Copyright (c) 2007 Jocelyn Mayer
6 * Copyright (c) 2010 David Gibson, IBM Corporation.
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
36 #include "hw/boards.h"
38 #include "hw/loader.h"
41 #include "hw/spapr_vio.h"
42 #include "hw/spapr_pci.h"
49 #include "exec-memory.h"
53 #define KERNEL_LOAD_ADDR 0x00000000
54 #define INITRD_LOAD_ADDR 0x02800000
55 #define FDT_MAX_SIZE 0x10000
56 #define RTAS_MAX_SIZE 0x10000
57 #define FW_MAX_SIZE 0x400000
58 #define FW_FILE_NAME "slof.bin"
60 #define MIN_RMA_SLOF 128UL
62 #define TIMEBASE_FREQ 512000000ULL
65 #define XICS_IRQS 1024
67 #define SPAPR_PCI_BUID 0x800000020000001ULL
68 #define SPAPR_PCI_MEM_WIN_ADDR (0x10000000000ULL + 0xA0000000)
69 #define SPAPR_PCI_MEM_WIN_SIZE 0x20000000
70 #define SPAPR_PCI_IO_WIN_ADDR (0x10000000000ULL + 0x80000000)
72 #define PHANDLE_XICP 0x00001111
74 sPAPREnvironment
*spapr
;
76 qemu_irq
spapr_allocate_irq(uint32_t hint
, uint32_t *irq_num
)
83 /* FIXME: we should probably check for collisions somehow */
85 irq
= spapr
->next_irq
++;
88 qirq
= xics_find_qirq(spapr
->icp
, irq
);
100 static void *spapr_create_fdt_skel(const char *cpu_model
,
101 target_phys_addr_t rma_size
,
102 target_phys_addr_t initrd_base
,
103 target_phys_addr_t initrd_size
,
104 const char *boot_device
,
105 const char *kernel_cmdline
,
110 uint64_t mem_reg_property_rma
[] = { 0, cpu_to_be64(rma_size
) };
111 uint64_t mem_reg_property_nonrma
[] = { cpu_to_be64(rma_size
),
112 cpu_to_be64(ram_size
- rma_size
) };
113 uint32_t start_prop
= cpu_to_be32(initrd_base
);
114 uint32_t end_prop
= cpu_to_be32(initrd_base
+ initrd_size
);
115 uint32_t pft_size_prop
[] = {0, cpu_to_be32(hash_shift
)};
116 char hypertas_prop
[] = "hcall-pft\0hcall-term\0hcall-dabr\0hcall-interrupt"
117 "\0hcall-tce\0hcall-vio\0hcall-splpar\0hcall-bulk";
118 uint32_t interrupt_server_ranges_prop
[] = {0, cpu_to_be32(smp_cpus
)};
121 int smt
= kvmppc_smt_threads();
127 fprintf(stderr, "qemu: error creating device tree: %s: %s\n", \
128 #exp, fdt_strerror(ret)); \
133 fdt
= g_malloc0(FDT_MAX_SIZE
);
134 _FDT((fdt_create(fdt
, FDT_MAX_SIZE
)));
136 _FDT((fdt_finish_reservemap(fdt
)));
139 _FDT((fdt_begin_node(fdt
, "")));
140 _FDT((fdt_property_string(fdt
, "device_type", "chrp")));
141 _FDT((fdt_property_string(fdt
, "model", "IBM pSeries (emulated by qemu)")));
143 _FDT((fdt_property_cell(fdt
, "#address-cells", 0x2)));
144 _FDT((fdt_property_cell(fdt
, "#size-cells", 0x2)));
147 _FDT((fdt_begin_node(fdt
, "chosen")));
149 _FDT((fdt_property_string(fdt
, "bootargs", kernel_cmdline
)));
150 _FDT((fdt_property(fdt
, "linux,initrd-start",
151 &start_prop
, sizeof(start_prop
))));
152 _FDT((fdt_property(fdt
, "linux,initrd-end",
153 &end_prop
, sizeof(end_prop
))));
154 _FDT((fdt_property_string(fdt
, "qemu,boot-device", boot_device
)));
157 * Because we don't always invoke any firmware, we can't rely on
158 * that to do BAR allocation. Long term, we should probably do
159 * that ourselves, but for now, this setting (plus advertising the
160 * current BARs as 0) causes sufficiently recent kernels to to the
161 * BAR assignment themselves */
162 _FDT((fdt_property_cell(fdt
, "linux,pci-probe-only", 0)));
164 _FDT((fdt_end_node(fdt
)));
167 _FDT((fdt_begin_node(fdt
, "memory@0")));
169 _FDT((fdt_property_string(fdt
, "device_type", "memory")));
170 _FDT((fdt_property(fdt
, "reg", mem_reg_property_rma
,
171 sizeof(mem_reg_property_rma
))));
172 _FDT((fdt_end_node(fdt
)));
174 if (ram_size
> rma_size
) {
177 sprintf(mem_name
, "memory@%" PRIx64
, (uint64_t)rma_size
);
178 _FDT((fdt_begin_node(fdt
, mem_name
)));
179 _FDT((fdt_property_string(fdt
, "device_type", "memory")));
180 _FDT((fdt_property(fdt
, "reg", mem_reg_property_nonrma
,
181 sizeof(mem_reg_property_nonrma
))));
182 _FDT((fdt_end_node(fdt
)));
186 _FDT((fdt_begin_node(fdt
, "cpus")));
188 _FDT((fdt_property_cell(fdt
, "#address-cells", 0x1)));
189 _FDT((fdt_property_cell(fdt
, "#size-cells", 0x0)));
191 modelname
= g_strdup(cpu_model
);
193 for (i
= 0; i
< strlen(modelname
); i
++) {
194 modelname
[i
] = toupper(modelname
[i
]);
197 for (env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
198 int index
= env
->cpu_index
;
199 uint32_t servers_prop
[smp_threads
];
200 uint32_t gservers_prop
[smp_threads
* 2];
202 uint32_t segs
[] = {cpu_to_be32(28), cpu_to_be32(40),
203 0xffffffff, 0xffffffff};
204 uint32_t tbfreq
= kvm_enabled() ? kvmppc_get_tbfreq() : TIMEBASE_FREQ
;
205 uint32_t cpufreq
= kvm_enabled() ? kvmppc_get_clockfreq() : 1000000000;
207 if ((index
% smt
) != 0) {
211 if (asprintf(&nodename
, "%s@%x", modelname
, index
) < 0) {
212 fprintf(stderr
, "Allocation failure\n");
216 _FDT((fdt_begin_node(fdt
, nodename
)));
220 _FDT((fdt_property_cell(fdt
, "reg", index
)));
221 _FDT((fdt_property_string(fdt
, "device_type", "cpu")));
223 _FDT((fdt_property_cell(fdt
, "cpu-version", env
->spr
[SPR_PVR
])));
224 _FDT((fdt_property_cell(fdt
, "dcache-block-size",
225 env
->dcache_line_size
)));
226 _FDT((fdt_property_cell(fdt
, "icache-block-size",
227 env
->icache_line_size
)));
228 _FDT((fdt_property_cell(fdt
, "timebase-frequency", tbfreq
)));
229 _FDT((fdt_property_cell(fdt
, "clock-frequency", cpufreq
)));
230 _FDT((fdt_property_cell(fdt
, "ibm,slb-size", env
->slb_nr
)));
231 _FDT((fdt_property(fdt
, "ibm,pft-size",
232 pft_size_prop
, sizeof(pft_size_prop
))));
233 _FDT((fdt_property_string(fdt
, "status", "okay")));
234 _FDT((fdt_property(fdt
, "64-bit", NULL
, 0)));
236 /* Build interrupt servers and gservers properties */
237 for (i
= 0; i
< smp_threads
; i
++) {
238 servers_prop
[i
] = cpu_to_be32(index
+ i
);
239 /* Hack, direct the group queues back to cpu 0 */
240 gservers_prop
[i
*2] = cpu_to_be32(index
+ i
);
241 gservers_prop
[i
*2 + 1] = 0;
243 _FDT((fdt_property(fdt
, "ibm,ppc-interrupt-server#s",
244 servers_prop
, sizeof(servers_prop
))));
245 _FDT((fdt_property(fdt
, "ibm,ppc-interrupt-gserver#s",
246 gservers_prop
, sizeof(gservers_prop
))));
248 if (env
->mmu_model
& POWERPC_MMU_1TSEG
) {
249 _FDT((fdt_property(fdt
, "ibm,processor-segment-sizes",
250 segs
, sizeof(segs
))));
253 /* Advertise VMX/VSX (vector extensions) if available
254 * 0 / no property == no vector extensions
255 * 1 == VMX / Altivec available
256 * 2 == VSX available */
257 if (env
->insns_flags
& PPC_ALTIVEC
) {
258 uint32_t vmx
= (env
->insns_flags2
& PPC2_VSX
) ? 2 : 1;
260 _FDT((fdt_property_cell(fdt
, "ibm,vmx", vmx
)));
263 /* Advertise DFP (Decimal Floating Point) if available
264 * 0 / no property == no DFP
265 * 1 == DFP available */
266 if (env
->insns_flags2
& PPC2_DFP
) {
267 _FDT((fdt_property_cell(fdt
, "ibm,dfp", 1)));
270 _FDT((fdt_end_node(fdt
)));
275 _FDT((fdt_end_node(fdt
)));
278 _FDT((fdt_begin_node(fdt
, "rtas")));
280 _FDT((fdt_property(fdt
, "ibm,hypertas-functions", hypertas_prop
,
281 sizeof(hypertas_prop
))));
283 _FDT((fdt_end_node(fdt
)));
285 /* interrupt controller */
286 _FDT((fdt_begin_node(fdt
, "interrupt-controller")));
288 _FDT((fdt_property_string(fdt
, "device_type",
289 "PowerPC-External-Interrupt-Presentation")));
290 _FDT((fdt_property_string(fdt
, "compatible", "IBM,ppc-xicp")));
291 _FDT((fdt_property(fdt
, "interrupt-controller", NULL
, 0)));
292 _FDT((fdt_property(fdt
, "ibm,interrupt-server-ranges",
293 interrupt_server_ranges_prop
,
294 sizeof(interrupt_server_ranges_prop
))));
295 _FDT((fdt_property_cell(fdt
, "#interrupt-cells", 2)));
296 _FDT((fdt_property_cell(fdt
, "linux,phandle", PHANDLE_XICP
)));
297 _FDT((fdt_property_cell(fdt
, "phandle", PHANDLE_XICP
)));
299 _FDT((fdt_end_node(fdt
)));
302 _FDT((fdt_begin_node(fdt
, "vdevice")));
304 _FDT((fdt_property_string(fdt
, "device_type", "vdevice")));
305 _FDT((fdt_property_string(fdt
, "compatible", "IBM,vdevice")));
306 _FDT((fdt_property_cell(fdt
, "#address-cells", 0x1)));
307 _FDT((fdt_property_cell(fdt
, "#size-cells", 0x0)));
308 _FDT((fdt_property_cell(fdt
, "#interrupt-cells", 0x2)));
309 _FDT((fdt_property(fdt
, "interrupt-controller", NULL
, 0)));
311 _FDT((fdt_end_node(fdt
)));
313 _FDT((fdt_end_node(fdt
))); /* close root node */
314 _FDT((fdt_finish(fdt
)));
319 static void spapr_finalize_fdt(sPAPREnvironment
*spapr
,
320 target_phys_addr_t fdt_addr
,
321 target_phys_addr_t rtas_addr
,
322 target_phys_addr_t rtas_size
)
328 fdt
= g_malloc(FDT_MAX_SIZE
);
330 /* open out the base tree into a temp buffer for the final tweaks */
331 _FDT((fdt_open_into(spapr
->fdt_skel
, fdt
, FDT_MAX_SIZE
)));
333 ret
= spapr_populate_vdevice(spapr
->vio_bus
, fdt
);
335 fprintf(stderr
, "couldn't setup vio devices in fdt\n");
339 QLIST_FOREACH(phb
, &spapr
->phbs
, list
) {
340 ret
= spapr_populate_pci_devices(phb
, PHANDLE_XICP
, fdt
);
344 fprintf(stderr
, "couldn't setup PCI devices in fdt\n");
349 ret
= spapr_rtas_device_tree_setup(fdt
, rtas_addr
, rtas_size
);
351 fprintf(stderr
, "Couldn't set up RTAS device tree properties\n");
354 _FDT((fdt_pack(fdt
)));
356 cpu_physical_memory_write(fdt_addr
, fdt
, fdt_totalsize(fdt
));
361 static uint64_t translate_kernel_address(void *opaque
, uint64_t addr
)
363 return (addr
& 0x0fffffff) + KERNEL_LOAD_ADDR
;
366 static void emulate_spapr_hypercall(CPUState
*env
)
368 env
->gpr
[3] = spapr_hypercall(env
, env
->gpr
[3], &env
->gpr
[4]);
371 static void spapr_reset(void *opaque
)
373 sPAPREnvironment
*spapr
= (sPAPREnvironment
*)opaque
;
375 fprintf(stderr
, "sPAPR reset\n");
377 /* flush out the hash table */
378 memset(spapr
->htab
, 0, spapr
->htab_size
);
381 spapr_finalize_fdt(spapr
, spapr
->fdt_addr
, spapr
->rtas_addr
,
384 /* Set up the entry state */
385 first_cpu
->gpr
[3] = spapr
->fdt_addr
;
386 first_cpu
->gpr
[5] = 0;
387 first_cpu
->halted
= 0;
388 first_cpu
->nip
= spapr
->entry_point
;
392 /* pSeries LPAR / sPAPR hardware init */
393 static void ppc_spapr_init(ram_addr_t ram_size
,
394 const char *boot_device
,
395 const char *kernel_filename
,
396 const char *kernel_cmdline
,
397 const char *initrd_filename
,
398 const char *cpu_model
)
402 MemoryRegion
*sysmem
= get_system_memory();
403 MemoryRegion
*ram
= g_new(MemoryRegion
, 1);
404 target_phys_addr_t rma_alloc_size
, rma_size
;
405 uint32_t initrd_base
;
406 long kernel_size
, initrd_size
, fw_size
;
407 long pteg_shift
= 17;
410 spapr
= g_malloc0(sizeof(*spapr
));
411 QLIST_INIT(&spapr
->phbs
);
413 cpu_ppc_hypercall
= emulate_spapr_hypercall
;
415 /* Allocate RMA if necessary */
416 rma_alloc_size
= kvmppc_alloc_rma("ppc_spapr.rma", sysmem
);
418 if (rma_alloc_size
== -1) {
419 hw_error("qemu: Unable to create RMA\n");
422 if (rma_alloc_size
&& (rma_alloc_size
< ram_size
)) {
423 rma_size
= rma_alloc_size
;
428 /* We place the device tree just below either the top of the RMA,
429 * or just below 2GB, whichever is lowere, so that it can be
430 * processed with 32-bit real mode code if necessary */
431 spapr
->fdt_addr
= MIN(rma_size
, 0x80000000) - FDT_MAX_SIZE
;
432 spapr
->rtas_addr
= spapr
->fdt_addr
- RTAS_MAX_SIZE
;
435 if (cpu_model
== NULL
) {
436 cpu_model
= kvm_enabled() ? "host" : "POWER7";
438 for (i
= 0; i
< smp_cpus
; i
++) {
439 env
= cpu_init(cpu_model
);
442 fprintf(stderr
, "Unable to find PowerPC CPU definition\n");
445 /* Set time-base frequency to 512 MHz */
446 cpu_ppc_tb_init(env
, TIMEBASE_FREQ
);
447 qemu_register_reset((QEMUResetHandler
*)&cpu_reset
, env
);
449 env
->hreset_vector
= 0x60;
450 env
->hreset_excp_prefix
= 0;
451 env
->gpr
[3] = env
->cpu_index
;
455 spapr
->ram_limit
= ram_size
;
456 if (spapr
->ram_limit
> rma_alloc_size
) {
457 ram_addr_t nonrma_base
= rma_alloc_size
;
458 ram_addr_t nonrma_size
= spapr
->ram_limit
- rma_alloc_size
;
460 memory_region_init_ram(ram
, NULL
, "ppc_spapr.ram", nonrma_size
);
461 memory_region_add_subregion(sysmem
, nonrma_base
, ram
);
464 /* allocate hash page table. For now we always make this 16mb,
465 * later we should probably make it scale to the size of guest
467 spapr
->htab_size
= 1ULL << (pteg_shift
+ 7);
468 spapr
->htab
= qemu_memalign(spapr
->htab_size
, spapr
->htab_size
);
470 for (env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
471 env
->external_htab
= spapr
->htab
;
473 env
->htab_mask
= spapr
->htab_size
- 1;
475 /* Tell KVM that we're in PAPR mode */
476 env
->spr
[SPR_SDR1
] = (unsigned long)spapr
->htab
|
477 ((pteg_shift
+ 7) - 18);
478 env
->spr
[SPR_HIOR
] = 0;
481 kvmppc_set_papr(env
);
485 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
, "spapr-rtas.bin");
486 spapr
->rtas_size
= load_image_targphys(filename
, spapr
->rtas_addr
,
487 ram_size
- spapr
->rtas_addr
);
488 if (spapr
->rtas_size
< 0) {
489 hw_error("qemu: could not load LPAR rtas '%s'\n", filename
);
494 /* Set up Interrupt Controller */
495 spapr
->icp
= xics_system_init(XICS_IRQS
);
496 spapr
->next_irq
= 16;
499 spapr
->vio_bus
= spapr_vio_bus_init();
501 for (i
= 0; i
< MAX_SERIAL_PORTS
; i
++) {
503 spapr_vty_create(spapr
->vio_bus
, SPAPR_VTY_BASE_ADDRESS
+ i
,
509 spapr_create_phb(spapr
, "pci", SPAPR_PCI_BUID
,
510 SPAPR_PCI_MEM_WIN_ADDR
,
511 SPAPR_PCI_MEM_WIN_SIZE
,
512 SPAPR_PCI_IO_WIN_ADDR
);
514 for (i
= 0; i
< nb_nics
; i
++) {
515 NICInfo
*nd
= &nd_table
[i
];
518 nd
->model
= g_strdup("ibmveth");
521 if (strcmp(nd
->model
, "ibmveth") == 0) {
522 spapr_vlan_create(spapr
->vio_bus
, 0x1000 + i
, nd
);
524 pci_nic_init_nofail(&nd_table
[i
], nd
->model
, NULL
);
528 for (i
= 0; i
<= drive_get_max_bus(IF_SCSI
); i
++) {
529 spapr_vscsi_create(spapr
->vio_bus
, 0x2000 + i
);
532 if (kernel_filename
) {
533 uint64_t lowaddr
= 0;
535 kernel_size
= load_elf(kernel_filename
, translate_kernel_address
, NULL
,
536 NULL
, &lowaddr
, NULL
, 1, ELF_MACHINE
, 0);
537 if (kernel_size
< 0) {
538 kernel_size
= load_image_targphys(kernel_filename
,
540 ram_size
- KERNEL_LOAD_ADDR
);
542 if (kernel_size
< 0) {
543 fprintf(stderr
, "qemu: could not load kernel '%s'\n",
549 if (initrd_filename
) {
550 initrd_base
= INITRD_LOAD_ADDR
;
551 initrd_size
= load_image_targphys(initrd_filename
, initrd_base
,
552 ram_size
- initrd_base
);
553 if (initrd_size
< 0) {
554 fprintf(stderr
, "qemu: could not load initial ram disk '%s'\n",
563 spapr
->entry_point
= KERNEL_LOAD_ADDR
;
565 if (rma_size
< (MIN_RMA_SLOF
<< 20)) {
566 fprintf(stderr
, "qemu: pSeries SLOF firmware requires >= "
567 "%ldM guest RMA (Real Mode Area memory)\n", MIN_RMA_SLOF
);
570 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
, FW_FILE_NAME
);
571 fw_size
= load_image_targphys(filename
, 0, FW_MAX_SIZE
);
573 hw_error("qemu: could not load LPAR rtas '%s'\n", filename
);
577 spapr
->entry_point
= 0x100;
581 /* SLOF will startup the secondary CPUs using RTAS,
582 rather than expecting a kexec() style entry */
583 for (env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
) {
588 /* Prepare the device tree */
589 spapr
->fdt_skel
= spapr_create_fdt_skel(cpu_model
, rma_size
,
590 initrd_base
, initrd_size
,
591 boot_device
, kernel_cmdline
,
593 assert(spapr
->fdt_skel
!= NULL
);
595 qemu_register_reset(spapr_reset
, spapr
);
598 static QEMUMachine spapr_machine
= {
600 .desc
= "pSeries Logical Partition (PAPR compliant)",
601 .init
= ppc_spapr_init
,
602 .max_cpus
= MAX_CPUS
,
608 static void spapr_machine_init(void)
610 qemu_register_machine(&spapr_machine
);
613 machine_init(spapr_machine_init
);