Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

This is aimed to go to QEMU v2.12.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The catpad size is 1K size, which can overflow easily with around 20 devices
having bootindex. Replace usage of $cat with a dynamically allocated buffer(16K)
here. Introduce new words to work on the buffer (allocate, free and
concatenate)

Reported here: qemu/SLOF#3

Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

We were concatenating the word " parse-load" and $bootdev list that was input to
evaluate. Open code EVALUATE work such that concatenation is not required.
"load" and "load-next" does not use $cat anymore.

Reported here: qemu/SLOF#3

Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The struct contains an uneven amount of bytes, so we should use
the "packed" attribute to avoid padding problems here. So far the
problems did not show up yet since the struct is filled by Forth
code only and QEMU seems to be quite forgiving about the length of
the descriptor, but anyway, let's better be safe than sorry here.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The guest kernel fetches the device tree via the client interface,
calling it for every node and property, and traversing the entire tree
twice - first to build strings blob, second - to build struct blob.

On top of that there is also not so efficient implementation of
the "getprop" method - it calls slow  "get-property" which does full
search for a property.

As the result, on a 256 CPU + 256 Intel E1000 virtual devices,
the guest's flatten_device_tree() takes roughly 8.5sec.

However now we have a FDT rendering helper in SLOF which takes about 350ms
to render the FDT. This implements a client interface call to allow
the guest to read it during early boot and save time.

The produced DTB is almost the same as the guest kernel would have
produced itself - the differences are:
1. SLOF creates an empty reserved map; the guest can easily fix
it up later;
2. SLOF only reuses 40 most popular strings; the guest reuses everything
it can - on a 256CPU + 256 PCI devices guest, the difference is about
20KB for 350KB FDT blob.

Note, that the guest also ditches the "name" property just like SLOF
does:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/powerpc/kernel/prom_init.c?h=v4.13#n2302

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---

If the guest tries "fdt-fetch" and SLOF does not have it, than SLOF
prints an error:
===
copying OF device tree...

fdt-fetch NOT FOUNDBuilding dt strings...
Building dt structure...
===

and the guest continues with the old method. We could suppress SLOF error
for such unlikely situation though.

At the moment we count on the guest kernel to update or create device
tree properties pointing to the instantiated RTAS copy which is not
very reliable.

This stores rtas-base and rtas-size in the DT at the instantiation
point so later on the H_UPDATE_DT hcall can supply QEMU with an updated
location of RTAS.

This superseeds f9a60de "Add private HCALL to inform updated
RTAS base and entry".

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
Changes:
v5:
* ditched rtas-entry, added rtas-size (which is always 20 bytes though)

The existing code hardcodes the length of /openprom/model to 10 characters
even though it is less than that - len("aik")==3. All 10 chars go to
the device tree blob and DTC complains on such a property as there are
characters after terminating null:

aik@fstn1-p1:~$ dtc -f -I dtb -O dts -o dbg.dts dbg.dtb
Warning (model_is_string): "model" property in /openprom is not a string

This uses the real length and limits it by 10 to avoid breaking something.

Since the same code parses the build id field, this moves from-cstring
to a common place for both js2x and qemu boards.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

This creates flatten device tree and passes it to QEMU via a custom
hypercall right before jumping to RTAS.

This preloads strings with 40 property names from CPU and PCI device nodes
and the strings lookup only searches within these.

Test results on a guest with 256 CPUs and 256 virtual Intel E1000 devices
running on a POWER8 box:
FDTsize=366024 Strings=15888 Struct=350080 Reused str=12457 242 ms

A simple guest (one CPU, no PCI) with this patch as is:
FDTsize=15940 Strings=3148 Struct=12736 Reused str=84 7 ms

While we are here, fix the version handling in fdt-init. It only matters
a little for the fdt-debug==1 case though.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
---
Changes:
v6:
* fix memory sizes for free-mem
* store correct chosen-cpu to the header (used to be just 0)
* fdt-skip-string uses zcount now and works 30% faster
* moved to a new file - fdt-fl.fs

v5:
* applied latest comments from Segher
* s/fdt-property/fdt-copy-property/, s/fdt-properties/fdt-copy-properties/
* reduced the temporary buffers to 1MB each as the guest uses 1MB in total
anyway
* do not pass root phandle to fdt-flatten-tree, it fetches it from
device-tree itself
* reworked fdt-copy-properties to use for-all-words proposed by Segher

v4:
* reworked fdt-properties, works lot faster
* do not store "name" properties as nodes have names already

v3:
* fixed stack handling after hcall returned
* fixed format versions in both rendering and parsing paths
* rebased on top of removed unused hvcalls
* renamed used variables to have fdtfl- prefixes as there are already
some for parsing the initial dt

v2:
* fixed comments from review
* added strings cache
* changed last_compat_vers from 0x17 to 0x16 as suggested by dwg

---

I tested the blob by storing it from QEMU to a file and decompiling it.

This fixes the version handling in fdt-init. It only matters
a little for the fdt-debug==1 case though.

This defines /fdth word for the FDT header size; this will be used
in the next patch.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Greg Kurz <groug@kaod.org>

This replaces current set-chosen-cpu with a cleaner and faster
implementation which does not clobber the current node and stores
the chosen CPU phandle/ihandle.

This adds a helper to get the chosen CPU unit address.

This moves chosen cpu words to root.fs as otherwise it is quite hard
to maintain dependencies.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>

This adds some internal structure commented definitions so they won't
break things now and grep can find them.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

This reverts commits:

604d28c "board-qemu: add private hcall to inform host on "phandle" update"
089fc18 "libhvcall: drop unused KVMPPC_H_REPORT_MC_ERR and KVMPPC_H_NMI_MCE defines"
1c17c13 "rtas: Improve error handling in instantiate-rtas"
f9a60de "Add private HCALL to inform updated RTAS base and entry"

A bigger hammer is coming soon which will pass the entire device
tree to QEMU, not just some random bits.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Greg Kurz <groug@kaod.org>

QEMU can now set environment variables from the command line (with -prom-env).
By this means, we can set the output-device and input-device variables,
and SLOF can read it and set stdout and stdin accordingly.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Tested-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

According to TFTP Booting extension, after the success of BOOTP, BOOTREPLY
packet should be copied to bootp-response property under "/chosen"

While in current case, even when DHCP was used, bootp-response was being set. So
set bootp-response when BOOTP is used and dhcp-response for DHCP

Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

times_asked value remains same as the structure is zeroed, but it makes more
sense to do that directly instead of adding with previous value.

Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

When shutting down the adapter, SLOF writes 0 to the Event Ring Segment
Table Base Address Register (ERSTBA) but does not reset the Event Ring
Segment Table Size Register (ERSTSZ) which makes QEMU do DMA access
at zero address which fails in unassigned_mem_accepts.

This resets ERSTSZ right before resetting ERSTBA so these 2 registers
can stay in sync.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>

Found that virtio-net is using a around 200K receive buffer per device, if we
connect more than 40 virtio-net devices the heap(8MB) gets over. Because of
which allocation starts failing and the VM does not boot.

Moreover, the driver did not support opening multiple device, which is possible
using the OF client interface. As it was using globals to store the state
information of the driver.

Now the driver allocates a virtio_net structure during device open stage and
fills in the state information. This details are used during various device
functions and finally for cleaning up on close operation.

Now as the buffer memory is allocated during open and freed during the close
operations the heap usage is contained.

Reported-by: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The "interrupt-map" property in each PHB node references the "phandle"
property of the "interrupt-controller" node. This is used by the guest
OS to setup IRQs for any PCI device plugged into the PHB. QEMU sets this
property to an arbitrary value in the flattened DT passed to SLOF.

Since commit 82954d4, SLOF has some generic code to convert all
references to any "phandle" property to a SLOF specific value.

This is is perfectly okay for coldplug devices, since the guest OS only
sees the converted value in "interrupt-map". It is a problem though for
hotplug devices. Since they don't go through SLOF, the guest OS receives
the arbitrary value set by QEMU and fails to setup IRQs.

In order to support PHB hotplug, this patch introduces a new private
hcall, which allows SLOF to tell QEMU that a "phandle" was converted
from an old value to a new value.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

This is aimed to go to QEMU v2.10.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The functions used a bogus mixture between programming the registers
with pci-next-mem64 and pci-next-mem - the upper register bits were
filled with the value from the 64-bit memory space while the lower
bits were filled with the bits from the 32-bit memory space variable.

This separates handling of pci-{next|max}-mem64 from pci-{next|max}-mem.

This zeroes bottom 4 bits of the prefetchable memory limit and
prefetchable memory base registers for 32bit windows to enforce
that the resources are marked as 32bit.

This simplifies updating of the prefetchable memory limit in
ci-bridge-set-mem-limit.

Signed-off-by: Thomas Huth <thuth@redhat.com>
[aik: extended commit log with 32bit window changes]
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>

PCI bridges can only have one prefetchable memory area. If we are
already using 64-bit prefetchable memory regions, we can not use
a dedicated 32-bit prefetchable memory region anymore. In that
case the 32-bit BARs should all be located in the 32-bit non-
prefetchable memory space instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

They are completely unused, and ishexdigit seems even to be implemented
in a wrong way, thus let's simply remove them.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

Currently, it is not possible to use VGA devices attached to a
PCI bridge on board-qemu, e.g. by starting QEMU like this:

 qemu-system-ppc64 -nodefaults -device pci-bridge,id=br1,chassis_nr=1 \
        -serial mon:stdio -device VGA,id=video,bus=br1,addr=1

One of the problems is the missing translate-address at the end
of the map-in function of the bridge - which was already marked
as a TODO, but apparently has never been enabled. So let's do
that now!

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

…start

It's much easier to do this when we create the node instead of
looking up the device node again later in each of the boards.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The virtio-scsi device expects LUNs according to a "Single level LUN
structure" as defined in the "SCSI Architecture Model" specification.
SLOF currently only uses the "Single level LUN structure using
peripheral device addressing method" which provides the possibility
to specify up to 256 different LUNs.
To be able to use LUNs greater than 255, the "Single level LUN structure
using flat space addressing method" has to be used instead. This can
be done by setting the top-most bits to "01" instead of "00" in the first
byte of the two LUN bytes.

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1431584
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

The SLOF stack pointers - dp/rp - point to the top used element which
means for an empty stack they point to an element below the stack.
This means that for pushing to the stack we can use a store-with-update
instruction (stdu). This generates good code for most primitives,
better than the other stack pointer offsets.

However, with -Warray-bounds enabled, this produces warnings like below:

At the moment SLOF is  gcc produces a warning:
/home/aik/p/slof/slof/paflof.c: In function ‘engine’:
/home/aik/p/slof/slof/paflof.c:84:23: warning: array subscript is below array bounds [-Warray-bounds]
   dp = the_data_stack - 1;
        ~~~~~~~~~~~~~~~^~~

This silences gcc by doing c-cast.

Suggested-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
---

uintptr_t is not used anywhere in SLOF, hence type_u.

This patch moves the code that actually alter the device tree to a
separate word, for improved readability. While here, it also makes
the comment of fdt-replace-all-phandles more accurate.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

These two values are pushed on the stack by decode-int and stay unused
until the 2drop line. Let's drop them right away to make it obvious.

Signed-off-by: Greg Kurz <groug@kaod.org>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

Print all related variables, using the code from phb-parse-ranges in
board-qemu/slof/pci-phb.fs, so that we can easily check all the values
from the SLOF prompt, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

…fines

These defines were introduced to add support for FWNMI in KVM guests. This
has been WIP since 2015 and the KVM part finally made it to kvm-ppc-next.

Latest work on the QEMU side [1] no longer needs KVMPPC_H_REPORT_MC_ERR.
The KVMPPC_HCALL_MAX define is never used anywhere, and moreover it
is bogus since there's no KVMPPC_H_NMI_MCE private hcall.

[1] http://lists.nongnu.org/archive/html/qemu-ppc/2015-12/msg00199.html

Signed-off-by: Greg Kurz <groug@kaod.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

To be able to re-use the libnet code in other projects (where
the rather Open Firmware specific netload.c can not be used),
the function parse_tftp_args() must be moved to another file.
The function is related to TFTP, and its prototype is already
declared in tftp.h, so the code should reside in tftp.c.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

When compiling the libnet code with the -Wformat-security compiler
flag, there is a warning in tftp.c that printf is used without
format argument. It's not a real problem here, but let's make
the code ready for this compiler flag anyway and add a proper
format string here, too.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

When compiling SLOF with the -Wredundant-decls compiler flag,
there is currently a warning in the libnet code since the send_ip
pointer is currently declared twice, one time in ipv4.h and
one time in ipv6.h. To avoid this warning, let's move the
declaration to IP-version independent ethernet.h instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>

If size_t is only "int", memset() and friends are limited
to 4 GB. And ssize_t is already declared as "long", so it
is somewhat inconsequent to define size_t as "int" only.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>