1 #include "qemu/osdep.h"
2 #include "qemu/cutils.h"
3 #include "qapi/error.h"
4 #include "sysemu/hw_accel.h"
5 #include "sysemu/runstate.h"
7 #include "qemu/main-loop.h"
8 #include "qemu/module.h"
9 #include "qemu/error-report.h"
10 #include "exec/exec-all.h"
11 #include "helper_regs.h"
12 #include "hw/ppc/ppc.h"
13 #include "hw/ppc/spapr.h"
14 #include "hw/ppc/spapr_cpu_core.h"
15 #include "mmu-hash64.h"
16 #include "cpu-models.h"
19 #include "hw/ppc/fdt.h"
20 #include "hw/ppc/spapr_ovec.h"
21 #include "hw/ppc/spapr_numa.h"
22 #include "mmu-book3s-v3.h"
23 #include "hw/mem/memory-device.h"
25 bool is_ram_address(SpaprMachineState
*spapr
, hwaddr addr
)
27 MachineState
*machine
= MACHINE(spapr
);
28 DeviceMemoryState
*dms
= machine
->device_memory
;
30 if (addr
< machine
->ram_size
) {
33 if ((addr
>= dms
->base
)
34 && ((addr
- dms
->base
) < memory_region_size(&dms
->mr
))) {
41 /* Convert a return code from the KVM ioctl()s implementing resize HPT
42 * into a PAPR hypercall return code */
43 static target_ulong
resize_hpt_convert_rc(int ret
)
46 return H_LONG_BUSY_ORDER_100_SEC
;
47 } else if (ret
>= 10000) {
48 return H_LONG_BUSY_ORDER_10_SEC
;
49 } else if (ret
>= 1000) {
50 return H_LONG_BUSY_ORDER_1_SEC
;
51 } else if (ret
>= 100) {
52 return H_LONG_BUSY_ORDER_100_MSEC
;
53 } else if (ret
>= 10) {
54 return H_LONG_BUSY_ORDER_10_MSEC
;
56 return H_LONG_BUSY_ORDER_1_MSEC
;
79 static target_ulong
h_resize_hpt_prepare(PowerPCCPU
*cpu
,
80 SpaprMachineState
*spapr
,
84 target_ulong flags
= args
[0];
86 uint64_t current_ram_size
;
89 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
93 if (!spapr
->htab_shift
) {
94 /* Radix guest, no HPT */
95 return H_NOT_AVAILABLE
;
98 trace_spapr_h_resize_hpt_prepare(flags
, shift
);
104 if (shift
&& ((shift
< 18) || (shift
> 46))) {
108 current_ram_size
= MACHINE(spapr
)->ram_size
+ get_plugged_memory_size();
110 /* We only allow the guest to allocate an HPT one order above what
111 * we'd normally give them (to stop a small guest claiming a huge
112 * chunk of resources in the HPT */
113 if (shift
> (spapr_hpt_shift_for_ramsize(current_ram_size
) + 1)) {
117 rc
= kvmppc_resize_hpt_prepare(cpu
, flags
, shift
);
119 return resize_hpt_convert_rc(rc
);
126 return softmmu_resize_hpt_prepare(cpu
, spapr
, shift
);
129 static void do_push_sregs_to_kvm_pr(CPUState
*cs
, run_on_cpu_data data
)
133 cpu_synchronize_state(cs
);
135 ret
= kvmppc_put_books_sregs(POWERPC_CPU(cs
));
137 error_report("failed to push sregs to KVM: %s", strerror(-ret
));
142 void push_sregs_to_kvm_pr(SpaprMachineState
*spapr
)
147 * This is a hack for the benefit of KVM PR - it abuses the SDR1
148 * slot in kvm_sregs to communicate the userspace address of the
151 if (!kvm_enabled() || !spapr
->htab
) {
156 run_on_cpu(cs
, do_push_sregs_to_kvm_pr
, RUN_ON_CPU_NULL
);
160 static target_ulong
h_resize_hpt_commit(PowerPCCPU
*cpu
,
161 SpaprMachineState
*spapr
,
165 target_ulong flags
= args
[0];
166 target_ulong shift
= args
[1];
169 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
173 if (!spapr
->htab_shift
) {
174 /* Radix guest, no HPT */
175 return H_NOT_AVAILABLE
;
178 trace_spapr_h_resize_hpt_commit(flags
, shift
);
180 rc
= kvmppc_resize_hpt_commit(cpu
, flags
, shift
);
182 rc
= resize_hpt_convert_rc(rc
);
183 if (rc
== H_SUCCESS
) {
184 /* Need to set the new htab_shift in the machine state */
185 spapr
->htab_shift
= shift
;
194 return softmmu_resize_hpt_commit(cpu
, spapr
, flags
, shift
);
199 static target_ulong
h_set_sprg0(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
200 target_ulong opcode
, target_ulong
*args
)
202 cpu_synchronize_state(CPU(cpu
));
203 cpu
->env
.spr
[SPR_SPRG0
] = args
[0];
208 static target_ulong
h_set_dabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
209 target_ulong opcode
, target_ulong
*args
)
211 if (!ppc_has_spr(cpu
, SPR_DABR
)) {
212 return H_HARDWARE
; /* DABR register not available */
214 cpu_synchronize_state(CPU(cpu
));
216 if (ppc_has_spr(cpu
, SPR_DABRX
)) {
217 cpu
->env
.spr
[SPR_DABRX
] = 0x3; /* Use Problem and Privileged state */
218 } else if (!(args
[0] & 0x4)) { /* Breakpoint Translation set? */
219 return H_RESERVED_DABR
;
222 cpu
->env
.spr
[SPR_DABR
] = args
[0];
226 static target_ulong
h_set_xdabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
227 target_ulong opcode
, target_ulong
*args
)
229 target_ulong dabrx
= args
[1];
231 if (!ppc_has_spr(cpu
, SPR_DABR
) || !ppc_has_spr(cpu
, SPR_DABRX
)) {
235 if ((dabrx
& ~0xfULL
) != 0 || (dabrx
& H_DABRX_HYPERVISOR
) != 0
236 || (dabrx
& (H_DABRX_KERNEL
| H_DABRX_USER
)) == 0) {
240 cpu_synchronize_state(CPU(cpu
));
241 cpu
->env
.spr
[SPR_DABRX
] = dabrx
;
242 cpu
->env
.spr
[SPR_DABR
] = args
[0];
247 static target_ulong
h_page_init(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
248 target_ulong opcode
, target_ulong
*args
)
250 target_ulong flags
= args
[0];
251 hwaddr dst
= args
[1];
252 hwaddr src
= args
[2];
253 hwaddr len
= TARGET_PAGE_SIZE
;
254 uint8_t *pdst
, *psrc
;
255 target_long ret
= H_SUCCESS
;
257 if (flags
& ~(H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
258 | H_COPY_PAGE
| H_ZERO_PAGE
)) {
259 qemu_log_mask(LOG_UNIMP
, "h_page_init: Bad flags (" TARGET_FMT_lx
"\n",
264 /* Map-in destination */
265 if (!is_ram_address(spapr
, dst
) || (dst
& ~TARGET_PAGE_MASK
) != 0) {
268 pdst
= cpu_physical_memory_map(dst
, &len
, true);
269 if (!pdst
|| len
!= TARGET_PAGE_SIZE
) {
273 if (flags
& H_COPY_PAGE
) {
274 /* Map-in source, copy to destination, and unmap source again */
275 if (!is_ram_address(spapr
, src
) || (src
& ~TARGET_PAGE_MASK
) != 0) {
279 psrc
= cpu_physical_memory_map(src
, &len
, false);
280 if (!psrc
|| len
!= TARGET_PAGE_SIZE
) {
284 memcpy(pdst
, psrc
, len
);
285 cpu_physical_memory_unmap(psrc
, len
, 0, len
);
286 } else if (flags
& H_ZERO_PAGE
) {
287 memset(pdst
, 0, len
); /* Just clear the destination page */
290 if (kvm_enabled() && (flags
& H_ICACHE_SYNCHRONIZE
) != 0) {
291 kvmppc_dcbst_range(cpu
, pdst
, len
);
293 if (flags
& (H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
)) {
295 kvmppc_icbi_range(cpu
, pdst
, len
);
302 cpu_physical_memory_unmap(pdst
, TARGET_PAGE_SIZE
, 1, len
);
306 #define FLAGS_REGISTER_VPA 0x0000200000000000ULL
307 #define FLAGS_REGISTER_DTL 0x0000400000000000ULL
308 #define FLAGS_REGISTER_SLBSHADOW 0x0000600000000000ULL
309 #define FLAGS_DEREGISTER_VPA 0x0000a00000000000ULL
310 #define FLAGS_DEREGISTER_DTL 0x0000c00000000000ULL
311 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
313 static target_ulong
register_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
315 CPUState
*cs
= CPU(cpu
);
316 CPUPPCState
*env
= &cpu
->env
;
317 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
322 hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
326 if (vpa
% env
->dcache_line_size
) {
329 /* FIXME: bounds check the address */
331 size
= lduw_be_phys(cs
->as
, vpa
+ 0x4);
333 if (size
< VPA_MIN_SIZE
) {
337 /* VPA is not allowed to cross a page boundary */
338 if ((vpa
/ 4096) != ((vpa
+ size
- 1) / 4096)) {
342 spapr_cpu
->vpa_addr
= vpa
;
344 tmp
= ldub_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
);
345 tmp
|= VPA_SHARED_PROC_VAL
;
346 stb_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
, tmp
);
351 static target_ulong
deregister_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
353 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
355 if (spapr_cpu
->slb_shadow_addr
) {
359 if (spapr_cpu
->dtl_addr
) {
363 spapr_cpu
->vpa_addr
= 0;
367 static target_ulong
register_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
369 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
373 hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
377 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
382 if ((addr
/ 4096) != ((addr
+ size
- 1) / 4096)) {
386 if (!spapr_cpu
->vpa_addr
) {
390 spapr_cpu
->slb_shadow_addr
= addr
;
391 spapr_cpu
->slb_shadow_size
= size
;
396 static target_ulong
deregister_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
398 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
400 spapr_cpu
->slb_shadow_addr
= 0;
401 spapr_cpu
->slb_shadow_size
= 0;
405 static target_ulong
register_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
407 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
411 hcall_dprintf("Can't cope with DTL at logical 0\n");
415 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
421 if (!spapr_cpu
->vpa_addr
) {
425 spapr_cpu
->dtl_addr
= addr
;
426 spapr_cpu
->dtl_size
= size
;
431 static target_ulong
deregister_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
433 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
435 spapr_cpu
->dtl_addr
= 0;
436 spapr_cpu
->dtl_size
= 0;
441 static target_ulong
h_register_vpa(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
442 target_ulong opcode
, target_ulong
*args
)
444 target_ulong flags
= args
[0];
445 target_ulong procno
= args
[1];
446 target_ulong vpa
= args
[2];
447 target_ulong ret
= H_PARAMETER
;
450 tcpu
= spapr_find_cpu(procno
);
456 case FLAGS_REGISTER_VPA
:
457 ret
= register_vpa(tcpu
, vpa
);
460 case FLAGS_DEREGISTER_VPA
:
461 ret
= deregister_vpa(tcpu
, vpa
);
464 case FLAGS_REGISTER_SLBSHADOW
:
465 ret
= register_slb_shadow(tcpu
, vpa
);
468 case FLAGS_DEREGISTER_SLBSHADOW
:
469 ret
= deregister_slb_shadow(tcpu
, vpa
);
472 case FLAGS_REGISTER_DTL
:
473 ret
= register_dtl(tcpu
, vpa
);
476 case FLAGS_DEREGISTER_DTL
:
477 ret
= deregister_dtl(tcpu
, vpa
);
484 static target_ulong
h_cede(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
485 target_ulong opcode
, target_ulong
*args
)
487 CPUPPCState
*env
= &cpu
->env
;
488 CPUState
*cs
= CPU(cpu
);
489 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
491 env
->msr
|= (1ULL << MSR_EE
);
492 hreg_compute_hflags(env
);
494 if (spapr_cpu
->prod
) {
495 spapr_cpu
->prod
= false;
499 if (!cpu_has_work(cs
)) {
501 cs
->exception_index
= EXCP_HLT
;
502 cs
->exit_request
= 1;
509 * Confer to self, aka join. Cede could use the same pattern as well, if
510 * EXCP_HLT can be changed to ECXP_HALTED.
512 static target_ulong
h_confer_self(PowerPCCPU
*cpu
)
514 CPUState
*cs
= CPU(cpu
);
515 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
517 if (spapr_cpu
->prod
) {
518 spapr_cpu
->prod
= false;
522 cs
->exception_index
= EXCP_HALTED
;
523 cs
->exit_request
= 1;
528 static target_ulong
h_join(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
529 target_ulong opcode
, target_ulong
*args
)
531 CPUPPCState
*env
= &cpu
->env
;
533 bool last_unjoined
= true;
535 if (env
->msr
& (1ULL << MSR_EE
)) {
540 * Must not join the last CPU running. Interestingly, no such restriction
541 * for H_CONFER-to-self, but that is probably not intended to be used
542 * when H_JOIN is available.
545 PowerPCCPU
*c
= POWERPC_CPU(cs
);
546 CPUPPCState
*e
= &c
->env
;
551 /* Don't have a way to indicate joined, so use halted && MSR[EE]=0 */
552 if (!cs
->halted
|| (e
->msr
& (1ULL << MSR_EE
))) {
553 last_unjoined
= false;
561 return h_confer_self(cpu
);
564 static target_ulong
h_confer(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
565 target_ulong opcode
, target_ulong
*args
)
567 target_long target
= args
[0];
568 uint32_t dispatch
= args
[1];
569 CPUState
*cs
= CPU(cpu
);
570 SpaprCpuState
*spapr_cpu
;
573 * -1 means confer to all other CPUs without dispatch counter check,
574 * otherwise it's a targeted confer.
577 PowerPCCPU
*target_cpu
= spapr_find_cpu(target
);
578 uint32_t target_dispatch
;
585 * target == self is a special case, we wait until prodded, without
586 * dispatch counter check.
588 if (cpu
== target_cpu
) {
589 return h_confer_self(cpu
);
592 spapr_cpu
= spapr_cpu_state(target_cpu
);
593 if (!spapr_cpu
->vpa_addr
|| ((dispatch
& 1) == 0)) {
597 target_dispatch
= ldl_be_phys(cs
->as
,
598 spapr_cpu
->vpa_addr
+ VPA_DISPATCH_COUNTER
);
599 if (target_dispatch
!= dispatch
) {
604 * The targeted confer does not do anything special beyond yielding
605 * the current vCPU, but even this should be better than nothing.
606 * At least for single-threaded tcg, it gives the target a chance to
607 * run before we run again. Multi-threaded tcg does not really do
608 * anything with EXCP_YIELD yet.
612 cs
->exception_index
= EXCP_YIELD
;
613 cs
->exit_request
= 1;
619 static target_ulong
h_prod(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
620 target_ulong opcode
, target_ulong
*args
)
622 target_long target
= args
[0];
625 SpaprCpuState
*spapr_cpu
;
627 tcpu
= spapr_find_cpu(target
);
633 spapr_cpu
= spapr_cpu_state(tcpu
);
634 spapr_cpu
->prod
= true;
641 static target_ulong
h_rtas(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
642 target_ulong opcode
, target_ulong
*args
)
644 target_ulong rtas_r3
= args
[0];
645 uint32_t token
= rtas_ld(rtas_r3
, 0);
646 uint32_t nargs
= rtas_ld(rtas_r3
, 1);
647 uint32_t nret
= rtas_ld(rtas_r3
, 2);
649 return spapr_rtas_call(cpu
, spapr
, token
, nargs
, rtas_r3
+ 12,
650 nret
, rtas_r3
+ 12 + 4*nargs
);
653 static target_ulong
h_logical_load(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
654 target_ulong opcode
, target_ulong
*args
)
656 CPUState
*cs
= CPU(cpu
);
657 target_ulong size
= args
[0];
658 target_ulong addr
= args
[1];
662 args
[0] = ldub_phys(cs
->as
, addr
);
665 args
[0] = lduw_phys(cs
->as
, addr
);
668 args
[0] = ldl_phys(cs
->as
, addr
);
671 args
[0] = ldq_phys(cs
->as
, addr
);
677 static target_ulong
h_logical_store(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
678 target_ulong opcode
, target_ulong
*args
)
680 CPUState
*cs
= CPU(cpu
);
682 target_ulong size
= args
[0];
683 target_ulong addr
= args
[1];
684 target_ulong val
= args
[2];
688 stb_phys(cs
->as
, addr
, val
);
691 stw_phys(cs
->as
, addr
, val
);
694 stl_phys(cs
->as
, addr
, val
);
697 stq_phys(cs
->as
, addr
, val
);
703 static target_ulong
h_logical_memop(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
704 target_ulong opcode
, target_ulong
*args
)
706 CPUState
*cs
= CPU(cpu
);
708 target_ulong dst
= args
[0]; /* Destination address */
709 target_ulong src
= args
[1]; /* Source address */
710 target_ulong esize
= args
[2]; /* Element size (0=1,1=2,2=4,3=8) */
711 target_ulong count
= args
[3]; /* Element count */
712 target_ulong op
= args
[4]; /* 0 = copy, 1 = invert */
714 unsigned int mask
= (1 << esize
) - 1;
715 int step
= 1 << esize
;
717 if (count
> 0x80000000) {
721 if ((dst
& mask
) || (src
& mask
) || (op
> 1)) {
725 if (dst
>= src
&& dst
< (src
+ (count
<< esize
))) {
726 dst
= dst
+ ((count
- 1) << esize
);
727 src
= src
+ ((count
- 1) << esize
);
734 tmp
= ldub_phys(cs
->as
, src
);
737 tmp
= lduw_phys(cs
->as
, src
);
740 tmp
= ldl_phys(cs
->as
, src
);
743 tmp
= ldq_phys(cs
->as
, src
);
753 stb_phys(cs
->as
, dst
, tmp
);
756 stw_phys(cs
->as
, dst
, tmp
);
759 stl_phys(cs
->as
, dst
, tmp
);
762 stq_phys(cs
->as
, dst
, tmp
);
772 static target_ulong
h_logical_icbi(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
773 target_ulong opcode
, target_ulong
*args
)
775 /* Nothing to do on emulation, KVM will trap this in the kernel */
779 static target_ulong
h_logical_dcbf(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
780 target_ulong opcode
, target_ulong
*args
)
782 /* Nothing to do on emulation, KVM will trap this in the kernel */
786 static target_ulong
h_set_mode_resource_le(PowerPCCPU
*cpu
,
787 SpaprMachineState
*spapr
,
800 case H_SET_MODE_ENDIAN_BIG
:
801 spapr_set_all_lpcrs(0, LPCR_ILE
);
802 spapr_pci_switch_vga(spapr
, true);
805 case H_SET_MODE_ENDIAN_LITTLE
:
806 spapr_set_all_lpcrs(LPCR_ILE
, LPCR_ILE
);
807 spapr_pci_switch_vga(spapr
, false);
811 return H_UNSUPPORTED_FLAG
;
814 static target_ulong
h_set_mode_resource_addr_trans_mode(PowerPCCPU
*cpu
,
819 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
821 if (!(pcc
->insns_flags2
& PPC2_ISA207S
)) {
832 /* AIL=1 is reserved in POWER8/POWER9/POWER10 */
833 return H_UNSUPPORTED_FLAG
;
836 if (mflags
== 2 && (pcc
->insns_flags2
& PPC2_ISA310
)) {
837 /* AIL=2 is reserved in POWER10 (ISA v3.1) */
838 return H_UNSUPPORTED_FLAG
;
841 spapr_set_all_lpcrs(mflags
<< LPCR_AIL_SHIFT
, LPCR_AIL
);
846 static target_ulong
h_set_mode(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
847 target_ulong opcode
, target_ulong
*args
)
849 target_ulong resource
= args
[1];
850 target_ulong ret
= H_P2
;
853 case H_SET_MODE_RESOURCE_LE
:
854 ret
= h_set_mode_resource_le(cpu
, spapr
, args
[0], args
[2], args
[3]);
856 case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE
:
857 ret
= h_set_mode_resource_addr_trans_mode(cpu
, args
[0],
865 static target_ulong
h_clean_slb(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
866 target_ulong opcode
, target_ulong
*args
)
868 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
869 opcode
, " (H_CLEAN_SLB)");
873 static target_ulong
h_invalidate_pid(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
874 target_ulong opcode
, target_ulong
*args
)
876 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
877 opcode
, " (H_INVALIDATE_PID)");
881 static void spapr_check_setup_free_hpt(SpaprMachineState
*spapr
,
882 uint64_t patbe_old
, uint64_t patbe_new
)
886 * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
887 * HASH->RADIX : Free HPT
888 * RADIX->HASH : Allocate HPT
889 * NOTHING->HASH : Allocate HPT
890 * Note: NOTHING implies the case where we said the guest could choose
891 * later and so assumed radix and now it's called H_REG_PROC_TBL
894 if ((patbe_old
& PATE1_GR
) == (patbe_new
& PATE1_GR
)) {
895 /* We assume RADIX, so this catches all the "Do Nothing" cases */
896 } else if (!(patbe_old
& PATE1_GR
)) {
897 /* HASH->RADIX : Free HPT */
898 spapr_free_hpt(spapr
);
899 } else if (!(patbe_new
& PATE1_GR
)) {
900 /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
901 spapr_setup_hpt(spapr
);
906 #define FLAGS_MASK 0x01FULL
907 #define FLAG_MODIFY 0x10
908 #define FLAG_REGISTER 0x08
909 #define FLAG_RADIX 0x04
910 #define FLAG_HASH_PROC_TBL 0x02
911 #define FLAG_GTSE 0x01
913 static target_ulong
h_register_process_table(PowerPCCPU
*cpu
,
914 SpaprMachineState
*spapr
,
918 target_ulong flags
= args
[0];
919 target_ulong proc_tbl
= args
[1];
920 target_ulong page_size
= args
[2];
921 target_ulong table_size
= args
[3];
922 target_ulong update_lpcr
= 0;
925 if (flags
& ~FLAGS_MASK
) { /* Check no reserved bits are set */
928 if (flags
& FLAG_MODIFY
) {
929 if (flags
& FLAG_REGISTER
) {
930 if (flags
& FLAG_RADIX
) { /* Register new RADIX process table */
931 if (proc_tbl
& 0xfff || proc_tbl
>> 60) {
933 } else if (page_size
) {
935 } else if (table_size
> 24) {
938 cproc
= PATE1_GR
| proc_tbl
| table_size
;
939 } else { /* Register new HPT process table */
940 if (flags
& FLAG_HASH_PROC_TBL
) { /* Hash with Segment Tables */
941 /* TODO - Not Supported */
942 /* Technically caused by flag bits => H_PARAMETER */
944 } else { /* Hash with SLB */
945 if (proc_tbl
>> 38) {
947 } else if (page_size
& ~0x7) {
949 } else if (table_size
> 24) {
953 cproc
= (proc_tbl
<< 25) | page_size
<< 5 | table_size
;
956 } else { /* Deregister current process table */
958 * Set to benign value: (current GR) | 0. This allows
959 * deregistration in KVM to succeed even if the radix bit
960 * in flags doesn't match the radix bit in the old PATE.
962 cproc
= spapr
->patb_entry
& PATE1_GR
;
964 } else { /* Maintain current registration */
965 if (!(flags
& FLAG_RADIX
) != !(spapr
->patb_entry
& PATE1_GR
)) {
966 /* Technically caused by flag bits => H_PARAMETER */
967 return H_PARAMETER
; /* Existing Process Table Mismatch */
969 cproc
= spapr
->patb_entry
;
972 /* Check if we need to setup OR free the hpt */
973 spapr_check_setup_free_hpt(spapr
, spapr
->patb_entry
, cproc
);
975 spapr
->patb_entry
= cproc
; /* Save new process table */
977 /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
978 if (flags
& FLAG_RADIX
) /* Radix must use process tables, also set HR */
979 update_lpcr
|= (LPCR_UPRT
| LPCR_HR
);
980 else if (flags
& FLAG_HASH_PROC_TBL
) /* Hash with process tables */
981 update_lpcr
|= LPCR_UPRT
;
982 if (flags
& FLAG_GTSE
) /* Guest translation shootdown enable */
983 update_lpcr
|= LPCR_GTSE
;
985 spapr_set_all_lpcrs(update_lpcr
, LPCR_UPRT
| LPCR_HR
| LPCR_GTSE
);
988 return kvmppc_configure_v3_mmu(cpu
, flags
& FLAG_RADIX
,
989 flags
& FLAG_GTSE
, cproc
);
994 #define H_SIGNAL_SYS_RESET_ALL -1
995 #define H_SIGNAL_SYS_RESET_ALLBUTSELF -2
997 static target_ulong
h_signal_sys_reset(PowerPCCPU
*cpu
,
998 SpaprMachineState
*spapr
,
999 target_ulong opcode
, target_ulong
*args
)
1001 target_long target
= args
[0];
1006 if (target
< H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1011 PowerPCCPU
*c
= POWERPC_CPU(cs
);
1013 if (target
== H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1018 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1024 cs
= CPU(spapr_find_cpu(target
));
1026 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1033 /* Returns either a logical PVR or zero if none was found */
1034 static uint32_t cas_check_pvr(PowerPCCPU
*cpu
, uint32_t max_compat
,
1035 target_ulong
*addr
, bool *raw_mode_supported
)
1037 bool explicit_match
= false; /* Matched the CPU's real PVR */
1038 uint32_t best_compat
= 0;
1042 * We scan the supplied table of PVRs looking for two things
1043 * 1. Is our real CPU PVR in the list?
1044 * 2. What's the "best" listed logical PVR
1046 for (i
= 0; i
< 512; ++i
) {
1047 uint32_t pvr
, pvr_mask
;
1049 pvr_mask
= ldl_be_phys(&address_space_memory
, *addr
);
1050 pvr
= ldl_be_phys(&address_space_memory
, *addr
+ 4);
1053 if (~pvr_mask
& pvr
) {
1054 break; /* Terminator record */
1057 if ((cpu
->env
.spr
[SPR_PVR
] & pvr_mask
) == (pvr
& pvr_mask
)) {
1058 explicit_match
= true;
1060 if (ppc_check_compat(cpu
, pvr
, best_compat
, max_compat
)) {
1066 *raw_mode_supported
= explicit_match
;
1068 /* Parsing finished */
1069 trace_spapr_cas_pvr(cpu
->compat_pvr
, explicit_match
, best_compat
);
1075 target_ulong
do_client_architecture_support(PowerPCCPU
*cpu
,
1076 SpaprMachineState
*spapr
,
1078 target_ulong fdt_bufsize
)
1080 target_ulong ov_table
; /* Working address in data buffer */
1082 SpaprOptionVector
*ov1_guest
, *ov5_guest
;
1084 bool raw_mode_supported
= false;
1088 uint32_t max_compat
= spapr
->max_compat_pvr
;
1090 /* CAS is supposed to be called early when only the boot vCPU is active. */
1092 if (cs
== CPU(cpu
)) {
1096 warn_report("guest has multiple active vCPUs at CAS, which is not allowed");
1097 return H_MULTI_THREADS_ACTIVE
;
1101 cas_pvr
= cas_check_pvr(cpu
, max_compat
, &vec
, &raw_mode_supported
);
1102 if (!cas_pvr
&& (!raw_mode_supported
|| max_compat
)) {
1104 * We couldn't find a suitable compatibility mode, and either
1105 * the guest doesn't support "raw" mode for this CPU, or "raw"
1106 * mode is disabled because a maximum compat mode is set.
1108 error_report("Couldn't negotiate a suitable PVR during CAS");
1113 if (cpu
->compat_pvr
!= cas_pvr
) {
1114 Error
*local_err
= NULL
;
1116 if (ppc_set_compat_all(cas_pvr
, &local_err
) < 0) {
1117 /* We fail to set compat mode (likely because running with KVM PR),
1118 * but maybe we can fallback to raw mode if the guest supports it.
1120 if (!raw_mode_supported
) {
1121 error_report_err(local_err
);
1124 error_free(local_err
);
1128 /* For the future use: here @ov_table points to the first option vector */
1131 ov1_guest
= spapr_ovec_parse_vector(ov_table
, 1);
1133 warn_report("guest didn't provide option vector 1");
1136 ov5_guest
= spapr_ovec_parse_vector(ov_table
, 5);
1138 spapr_ovec_cleanup(ov1_guest
);
1139 warn_report("guest didn't provide option vector 5");
1142 if (spapr_ovec_test(ov5_guest
, OV5_MMU_BOTH
)) {
1143 error_report("guest requested hash and radix MMU, which is invalid.");
1146 if (spapr_ovec_test(ov5_guest
, OV5_XIVE_BOTH
)) {
1147 error_report("guest requested an invalid interrupt mode");
1151 guest_radix
= spapr_ovec_test(ov5_guest
, OV5_MMU_RADIX_300
);
1153 guest_xive
= spapr_ovec_test(ov5_guest
, OV5_XIVE_EXPLOIT
);
1156 * HPT resizing is a bit of a special case, because when enabled
1157 * we assume an HPT guest will support it until it says it
1158 * doesn't, instead of assuming it won't support it until it says
1159 * it does. Strictly speaking that approach could break for
1160 * guests which don't make a CAS call, but those are so old we
1161 * don't care about them. Without that assumption we'd have to
1162 * make at least a temporary allocation of an HPT sized for max
1163 * memory, which could be impossibly difficult under KVM HV if
1166 if (!guest_radix
&& !spapr_ovec_test(ov5_guest
, OV5_HPT_RESIZE
)) {
1167 int maxshift
= spapr_hpt_shift_for_ramsize(MACHINE(spapr
)->maxram_size
);
1169 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_REQUIRED
) {
1171 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1175 if (spapr
->htab_shift
< maxshift
) {
1176 /* Guest doesn't know about HPT resizing, so we
1177 * pre-emptively resize for the maximum permitted RAM. At
1178 * the point this is called, nothing should have been
1179 * entered into the existing HPT */
1180 spapr_reallocate_hpt(spapr
, maxshift
, &error_fatal
);
1181 push_sregs_to_kvm_pr(spapr
);
1185 /* NOTE: there are actually a number of ov5 bits where input from the
1186 * guest is always zero, and the platform/QEMU enables them independently
1187 * of guest input. To model these properly we'd want some sort of mask,
1188 * but since they only currently apply to memory migration as defined
1189 * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1190 * to worry about this for now.
1193 /* full range of negotiated ov5 capabilities */
1194 spapr_ovec_intersect(spapr
->ov5_cas
, spapr
->ov5
, ov5_guest
);
1195 spapr_ovec_cleanup(ov5_guest
);
1197 spapr_check_mmu_mode(guest_radix
);
1199 spapr
->cas_pre_isa3_guest
= !spapr_ovec_test(ov1_guest
, OV1_PPC_3_00
);
1200 spapr_ovec_cleanup(ov1_guest
);
1203 * Check for NUMA affinity conditions now that we know which NUMA
1204 * affinity the guest will use.
1206 spapr_numa_associativity_check(spapr
);
1209 * Ensure the guest asks for an interrupt mode we support;
1210 * otherwise terminate the boot.
1213 if (!spapr
->irq
->xive
) {
1215 "Guest requested unavailable interrupt mode (XIVE), try the ic-mode=xive or ic-mode=dual machine property");
1219 if (!spapr
->irq
->xics
) {
1221 "Guest requested unavailable interrupt mode (XICS), either don't set the ic-mode machine property or try ic-mode=xics or ic-mode=dual");
1226 spapr_irq_update_active_intc(spapr
);
1229 * Process all pending hot-plug/unplug requests now. An updated full
1230 * rendered FDT will be returned to the guest.
1232 spapr_drc_reset_all(spapr
);
1233 spapr_clear_pending_hotplug_events(spapr
);
1236 * If spapr_machine_reset() did not set up a HPT but one is necessary
1237 * (because the guest isn't going to use radix) then set it up here.
1239 if ((spapr
->patb_entry
& PATE1_GR
) && !guest_radix
) {
1240 /* legacy hash or new hash: */
1241 spapr_setup_hpt(spapr
);
1244 fdt
= spapr_build_fdt(spapr
, spapr
->vof
!= NULL
, fdt_bufsize
);
1245 g_free(spapr
->fdt_blob
);
1246 spapr
->fdt_size
= fdt_totalsize(fdt
);
1247 spapr
->fdt_initial_size
= spapr
->fdt_size
;
1248 spapr
->fdt_blob
= fdt
;
1253 static target_ulong
h_client_architecture_support(PowerPCCPU
*cpu
,
1254 SpaprMachineState
*spapr
,
1255 target_ulong opcode
,
1258 target_ulong vec
= ppc64_phys_to_real(args
[0]);
1259 target_ulong fdt_buf
= args
[1];
1260 target_ulong fdt_bufsize
= args
[2];
1262 SpaprDeviceTreeUpdateHeader hdr
= { .version_id
= 1 };
1264 if (fdt_bufsize
< sizeof(hdr
)) {
1265 error_report("SLOF provided insufficient CAS buffer "
1266 TARGET_FMT_lu
" (min: %zu)", fdt_bufsize
, sizeof(hdr
));
1270 fdt_bufsize
-= sizeof(hdr
);
1272 ret
= do_client_architecture_support(cpu
, spapr
, vec
, fdt_bufsize
);
1273 if (ret
== H_SUCCESS
) {
1274 _FDT((fdt_pack(spapr
->fdt_blob
)));
1275 spapr
->fdt_size
= fdt_totalsize(spapr
->fdt_blob
);
1276 spapr
->fdt_initial_size
= spapr
->fdt_size
;
1278 cpu_physical_memory_write(fdt_buf
, &hdr
, sizeof(hdr
));
1279 cpu_physical_memory_write(fdt_buf
+ sizeof(hdr
), spapr
->fdt_blob
,
1281 trace_spapr_cas_continue(spapr
->fdt_size
+ sizeof(hdr
));
1287 target_ulong
spapr_vof_client_architecture_support(MachineState
*ms
,
1289 target_ulong ovec_addr
)
1291 SpaprMachineState
*spapr
= SPAPR_MACHINE(ms
);
1293 target_ulong ret
= do_client_architecture_support(POWERPC_CPU(cs
), spapr
,
1294 ovec_addr
, FDT_MAX_SIZE
);
1297 * This adds stdout and generates phandles for boottime and CAS FDTs.
1298 * It is alright to update the FDT here as do_client_architecture_support()
1301 spapr_vof_client_dt_finalize(spapr
, spapr
->fdt_blob
);
1306 static target_ulong
h_get_cpu_characteristics(PowerPCCPU
*cpu
,
1307 SpaprMachineState
*spapr
,
1308 target_ulong opcode
,
1311 uint64_t characteristics
= H_CPU_CHAR_HON_BRANCH_HINTS
&
1312 ~H_CPU_CHAR_THR_RECONF_TRIG
;
1313 uint64_t behaviour
= H_CPU_BEHAV_FAVOUR_SECURITY
;
1314 uint8_t safe_cache
= spapr_get_cap(spapr
, SPAPR_CAP_CFPC
);
1315 uint8_t safe_bounds_check
= spapr_get_cap(spapr
, SPAPR_CAP_SBBC
);
1316 uint8_t safe_indirect_branch
= spapr_get_cap(spapr
, SPAPR_CAP_IBS
);
1317 uint8_t count_cache_flush_assist
= spapr_get_cap(spapr
,
1318 SPAPR_CAP_CCF_ASSIST
);
1320 switch (safe_cache
) {
1321 case SPAPR_CAP_WORKAROUND
:
1322 characteristics
|= H_CPU_CHAR_L1D_FLUSH_ORI30
;
1323 characteristics
|= H_CPU_CHAR_L1D_FLUSH_TRIG2
;
1324 characteristics
|= H_CPU_CHAR_L1D_THREAD_PRIV
;
1325 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1327 case SPAPR_CAP_FIXED
:
1328 behaviour
|= H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY
;
1329 behaviour
|= H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS
;
1331 default: /* broken */
1332 assert(safe_cache
== SPAPR_CAP_BROKEN
);
1333 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1337 switch (safe_bounds_check
) {
1338 case SPAPR_CAP_WORKAROUND
:
1339 characteristics
|= H_CPU_CHAR_SPEC_BAR_ORI31
;
1340 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1342 case SPAPR_CAP_FIXED
:
1344 default: /* broken */
1345 assert(safe_bounds_check
== SPAPR_CAP_BROKEN
);
1346 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1350 switch (safe_indirect_branch
) {
1351 case SPAPR_CAP_FIXED_NA
:
1353 case SPAPR_CAP_FIXED_CCD
:
1354 characteristics
|= H_CPU_CHAR_CACHE_COUNT_DIS
;
1356 case SPAPR_CAP_FIXED_IBS
:
1357 characteristics
|= H_CPU_CHAR_BCCTRL_SERIALISED
;
1359 case SPAPR_CAP_WORKAROUND
:
1360 behaviour
|= H_CPU_BEHAV_FLUSH_COUNT_CACHE
;
1361 if (count_cache_flush_assist
) {
1362 characteristics
|= H_CPU_CHAR_BCCTR_FLUSH_ASSIST
;
1365 default: /* broken */
1366 assert(safe_indirect_branch
== SPAPR_CAP_BROKEN
);
1370 args
[0] = characteristics
;
1371 args
[1] = behaviour
;
1375 static target_ulong
h_update_dt(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1376 target_ulong opcode
, target_ulong
*args
)
1378 target_ulong dt
= ppc64_phys_to_real(args
[0]);
1379 struct fdt_header hdr
= { 0 };
1381 SpaprMachineClass
*smc
= SPAPR_MACHINE_GET_CLASS(spapr
);
1384 cpu_physical_memory_read(dt
, &hdr
, sizeof(hdr
));
1385 cb
= fdt32_to_cpu(hdr
.totalsize
);
1387 if (!smc
->update_dt_enabled
) {
1391 /* Check that the fdt did not grow out of proportion */
1392 if (cb
> spapr
->fdt_initial_size
* 2) {
1393 trace_spapr_update_dt_failed_size(spapr
->fdt_initial_size
, cb
,
1394 fdt32_to_cpu(hdr
.magic
));
1398 fdt
= g_malloc0(cb
);
1399 cpu_physical_memory_read(dt
, fdt
, cb
);
1401 /* Check the fdt consistency */
1402 if (fdt_check_full(fdt
, cb
)) {
1403 trace_spapr_update_dt_failed_check(spapr
->fdt_initial_size
, cb
,
1404 fdt32_to_cpu(hdr
.magic
));
1408 g_free(spapr
->fdt_blob
);
1409 spapr
->fdt_size
= cb
;
1410 spapr
->fdt_blob
= fdt
;
1411 trace_spapr_update_dt(cb
);
1416 static spapr_hcall_fn papr_hypercall_table
[(MAX_HCALL_OPCODE
/ 4) + 1];
1417 static spapr_hcall_fn kvmppc_hypercall_table
[KVMPPC_HCALL_MAX
- KVMPPC_HCALL_BASE
+ 1];
1418 static spapr_hcall_fn svm_hypercall_table
[(SVM_HCALL_MAX
- SVM_HCALL_BASE
) / 4 + 1];
1420 void spapr_register_hypercall(target_ulong opcode
, spapr_hcall_fn fn
)
1422 spapr_hcall_fn
*slot
;
1424 if (opcode
<= MAX_HCALL_OPCODE
) {
1425 assert((opcode
& 0x3) == 0);
1427 slot
= &papr_hypercall_table
[opcode
/ 4];
1428 } else if (opcode
>= SVM_HCALL_BASE
&& opcode
<= SVM_HCALL_MAX
) {
1429 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1430 assert((opcode
& 0x3) == 0);
1432 slot
= &svm_hypercall_table
[(opcode
- SVM_HCALL_BASE
) / 4];
1434 assert((opcode
>= KVMPPC_HCALL_BASE
) && (opcode
<= KVMPPC_HCALL_MAX
));
1436 slot
= &kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
1443 target_ulong
spapr_hypercall(PowerPCCPU
*cpu
, target_ulong opcode
,
1446 SpaprMachineState
*spapr
= SPAPR_MACHINE(qdev_get_machine());
1448 if ((opcode
<= MAX_HCALL_OPCODE
)
1449 && ((opcode
& 0x3) == 0)) {
1450 spapr_hcall_fn fn
= papr_hypercall_table
[opcode
/ 4];
1453 return fn(cpu
, spapr
, opcode
, args
);
1455 } else if ((opcode
>= SVM_HCALL_BASE
) &&
1456 (opcode
<= SVM_HCALL_MAX
)) {
1457 spapr_hcall_fn fn
= svm_hypercall_table
[(opcode
- SVM_HCALL_BASE
) / 4];
1460 return fn(cpu
, spapr
, opcode
, args
);
1462 } else if ((opcode
>= KVMPPC_HCALL_BASE
) &&
1463 (opcode
<= KVMPPC_HCALL_MAX
)) {
1464 spapr_hcall_fn fn
= kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
1467 return fn(cpu
, spapr
, opcode
, args
);
1471 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx
"\n",
1477 static target_ulong
h_softmmu(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1478 target_ulong opcode
, target_ulong
*args
)
1480 g_assert_not_reached();
1483 static void hypercall_register_softmmu(void)
1486 spapr_register_hypercall(H_ENTER
, h_softmmu
);
1487 spapr_register_hypercall(H_REMOVE
, h_softmmu
);
1488 spapr_register_hypercall(H_PROTECT
, h_softmmu
);
1489 spapr_register_hypercall(H_READ
, h_softmmu
);
1492 spapr_register_hypercall(H_BULK_REMOVE
, h_softmmu
);
1495 static void hypercall_register_softmmu(void)
1502 #define PRTS_MASK 0x1f
1504 static target_ulong
h_set_ptbl(PowerPCCPU
*cpu
,
1505 SpaprMachineState
*spapr
,
1506 target_ulong opcode
,
1509 target_ulong ptcr
= args
[0];
1511 if (!spapr_get_cap(spapr
, SPAPR_CAP_NESTED_KVM_HV
)) {
1515 if ((ptcr
& PRTS_MASK
) + 12 - 4 > 12) {
1519 spapr
->nested_ptcr
= ptcr
; /* Save new partition table */
1524 static target_ulong
h_tlb_invalidate(PowerPCCPU
*cpu
,
1525 SpaprMachineState
*spapr
,
1526 target_ulong opcode
,
1530 * The spapr virtual hypervisor nested HV implementation retains no L2
1531 * translation state except for TLB. And the TLB is always invalidated
1532 * across L1<->L2 transitions, so nothing is required here.
1538 static target_ulong
h_copy_tofrom_guest(PowerPCCPU
*cpu
,
1539 SpaprMachineState
*spapr
,
1540 target_ulong opcode
,
1544 * This HCALL is not required, L1 KVM will take a slow path and walk the
1545 * page tables manually to do the data copy.
1551 * When this handler returns, the environment is switched to the L2 guest
1552 * and TCG begins running that. spapr_exit_nested() performs the switch from
1553 * L2 back to L1 and returns from the H_ENTER_NESTED hcall.
1555 static target_ulong
h_enter_nested(PowerPCCPU
*cpu
,
1556 SpaprMachineState
*spapr
,
1557 target_ulong opcode
,
1560 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
1561 CPUState
*cs
= CPU(cpu
);
1562 CPUPPCState
*env
= &cpu
->env
;
1563 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1564 target_ulong hv_ptr
= args
[0];
1565 target_ulong regs_ptr
= args
[1];
1566 target_ulong hdec
, now
= cpu_ppc_load_tbl(env
);
1567 target_ulong lpcr
, lpcr_mask
;
1568 struct kvmppc_hv_guest_state
*hvstate
;
1569 struct kvmppc_hv_guest_state hv_state
;
1570 struct kvmppc_pt_regs
*regs
;
1575 if (spapr
->nested_ptcr
== 0) {
1576 return H_NOT_AVAILABLE
;
1579 len
= sizeof(*hvstate
);
1580 hvstate
= address_space_map(CPU(cpu
)->as
, hv_ptr
, &len
, false,
1581 MEMTXATTRS_UNSPECIFIED
);
1582 if (len
!= sizeof(*hvstate
)) {
1583 address_space_unmap(CPU(cpu
)->as
, hvstate
, len
, 0, false);
1587 memcpy(&hv_state
, hvstate
, len
);
1589 address_space_unmap(CPU(cpu
)->as
, hvstate
, len
, len
, false);
1592 * We accept versions 1 and 2. Version 2 fields are unused because TCG
1593 * does not implement DAWR*.
1595 if (hv_state
.version
> HV_GUEST_STATE_VERSION
) {
1599 spapr_cpu
->nested_host_state
= g_try_malloc(sizeof(CPUPPCState
));
1600 if (!spapr_cpu
->nested_host_state
) {
1604 memcpy(spapr_cpu
->nested_host_state
, env
, sizeof(CPUPPCState
));
1606 len
= sizeof(*regs
);
1607 regs
= address_space_map(CPU(cpu
)->as
, regs_ptr
, &len
, false,
1608 MEMTXATTRS_UNSPECIFIED
);
1609 if (!regs
|| len
!= sizeof(*regs
)) {
1610 address_space_unmap(CPU(cpu
)->as
, regs
, len
, 0, false);
1611 g_free(spapr_cpu
->nested_host_state
);
1615 len
= sizeof(env
->gpr
);
1616 assert(len
== sizeof(regs
->gpr
));
1617 memcpy(env
->gpr
, regs
->gpr
, len
);
1619 env
->lr
= regs
->link
;
1620 env
->ctr
= regs
->ctr
;
1621 cpu_write_xer(env
, regs
->xer
);
1624 for (i
= 7; i
>= 0; i
--) {
1625 env
->crf
[i
] = cr
& 15;
1629 env
->msr
= regs
->msr
;
1630 env
->nip
= regs
->nip
;
1632 address_space_unmap(CPU(cpu
)->as
, regs
, len
, len
, false);
1634 env
->cfar
= hv_state
.cfar
;
1636 assert(env
->spr
[SPR_LPIDR
] == 0);
1637 env
->spr
[SPR_LPIDR
] = hv_state
.lpid
;
1639 lpcr_mask
= LPCR_DPFD
| LPCR_ILE
| LPCR_AIL
| LPCR_LD
| LPCR_MER
;
1640 lpcr
= (env
->spr
[SPR_LPCR
] & ~lpcr_mask
) | (hv_state
.lpcr
& lpcr_mask
);
1641 lpcr
|= LPCR_HR
| LPCR_UPRT
| LPCR_GTSE
| LPCR_HVICE
| LPCR_HDICE
;
1642 lpcr
&= ~LPCR_LPES0
;
1643 env
->spr
[SPR_LPCR
] = lpcr
& pcc
->lpcr_mask
;
1645 env
->spr
[SPR_PCR
] = hv_state
.pcr
;
1646 /* hv_state.amor is not used */
1647 env
->spr
[SPR_DPDES
] = hv_state
.dpdes
;
1648 env
->spr
[SPR_HFSCR
] = hv_state
.hfscr
;
1649 hdec
= hv_state
.hdec_expiry
- now
;
1650 spapr_cpu
->nested_tb_offset
= hv_state
.tb_offset
;
1651 /* TCG does not implement DAWR*, CIABR, PURR, SPURR, IC, VTB, HEIR SPRs*/
1652 env
->spr
[SPR_SRR0
] = hv_state
.srr0
;
1653 env
->spr
[SPR_SRR1
] = hv_state
.srr1
;
1654 env
->spr
[SPR_SPRG0
] = hv_state
.sprg
[0];
1655 env
->spr
[SPR_SPRG1
] = hv_state
.sprg
[1];
1656 env
->spr
[SPR_SPRG2
] = hv_state
.sprg
[2];
1657 env
->spr
[SPR_SPRG3
] = hv_state
.sprg
[3];
1658 env
->spr
[SPR_BOOKS_PID
] = hv_state
.pidr
;
1659 env
->spr
[SPR_PPR
] = hv_state
.ppr
;
1661 cpu_ppc_hdecr_init(env
);
1662 cpu_ppc_store_hdecr(env
, hdec
);
1665 * The hv_state.vcpu_token is not needed. It is used by the KVM
1666 * implementation to remember which L2 vCPU last ran on which physical
1667 * CPU so as to invalidate process scope translations if it is moved
1668 * between physical CPUs. For now TLBs are always flushed on L1<->L2
1669 * transitions so this is not a problem.
1671 * Could validate that the same vcpu_token does not attempt to run on
1672 * different L1 vCPUs at the same time, but that would be a L1 KVM bug
1673 * and it's not obviously worth a new data structure to do it.
1676 env
->tb_env
->tb_offset
+= spapr_cpu
->nested_tb_offset
;
1677 spapr_cpu
->in_nested
= true;
1679 hreg_compute_hflags(env
);
1681 env
->reserve_addr
= -1; /* Reset the reservation */
1684 * The spapr hcall helper sets env->gpr[3] to the return value, but at
1685 * this point the L1 is not returning from the hcall but rather we
1686 * start running the L2, so r3 must not be clobbered, so return env->gpr[3]
1687 * to leave it unchanged.
1692 void spapr_exit_nested(PowerPCCPU
*cpu
, int excp
)
1694 CPUState
*cs
= CPU(cpu
);
1695 CPUPPCState
*env
= &cpu
->env
;
1696 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1697 target_ulong r3_return
= env
->excp_vectors
[excp
]; /* hcall return value */
1698 target_ulong hv_ptr
= spapr_cpu
->nested_host_state
->gpr
[4];
1699 target_ulong regs_ptr
= spapr_cpu
->nested_host_state
->gpr
[5];
1700 struct kvmppc_hv_guest_state
*hvstate
;
1701 struct kvmppc_pt_regs
*regs
;
1706 assert(spapr_cpu
->in_nested
);
1708 cpu_ppc_hdecr_exit(env
);
1710 len
= sizeof(*hvstate
);
1711 hvstate
= address_space_map(CPU(cpu
)->as
, hv_ptr
, &len
, true,
1712 MEMTXATTRS_UNSPECIFIED
);
1713 if (len
!= sizeof(*hvstate
)) {
1714 address_space_unmap(CPU(cpu
)->as
, hvstate
, len
, 0, true);
1715 r3_return
= H_PARAMETER
;
1716 goto out_restore_l1
;
1719 hvstate
->cfar
= env
->cfar
;
1720 hvstate
->lpcr
= env
->spr
[SPR_LPCR
];
1721 hvstate
->pcr
= env
->spr
[SPR_PCR
];
1722 hvstate
->dpdes
= env
->spr
[SPR_DPDES
];
1723 hvstate
->hfscr
= env
->spr
[SPR_HFSCR
];
1725 if (excp
== POWERPC_EXCP_HDSI
) {
1726 hvstate
->hdar
= env
->spr
[SPR_HDAR
];
1727 hvstate
->hdsisr
= env
->spr
[SPR_HDSISR
];
1728 hvstate
->asdr
= env
->spr
[SPR_ASDR
];
1729 } else if (excp
== POWERPC_EXCP_HISI
) {
1730 hvstate
->asdr
= env
->spr
[SPR_ASDR
];
1733 /* HEIR should be implemented for HV mode and saved here. */
1734 hvstate
->srr0
= env
->spr
[SPR_SRR0
];
1735 hvstate
->srr1
= env
->spr
[SPR_SRR1
];
1736 hvstate
->sprg
[0] = env
->spr
[SPR_SPRG0
];
1737 hvstate
->sprg
[1] = env
->spr
[SPR_SPRG1
];
1738 hvstate
->sprg
[2] = env
->spr
[SPR_SPRG2
];
1739 hvstate
->sprg
[3] = env
->spr
[SPR_SPRG3
];
1740 hvstate
->pidr
= env
->spr
[SPR_BOOKS_PID
];
1741 hvstate
->ppr
= env
->spr
[SPR_PPR
];
1743 /* Is it okay to specify write length larger than actual data written? */
1744 address_space_unmap(CPU(cpu
)->as
, hvstate
, len
, len
, true);
1746 len
= sizeof(*regs
);
1747 regs
= address_space_map(CPU(cpu
)->as
, regs_ptr
, &len
, true,
1748 MEMTXATTRS_UNSPECIFIED
);
1749 if (!regs
|| len
!= sizeof(*regs
)) {
1750 address_space_unmap(CPU(cpu
)->as
, regs
, len
, 0, true);
1752 goto out_restore_l1
;
1755 len
= sizeof(env
->gpr
);
1756 assert(len
== sizeof(regs
->gpr
));
1757 memcpy(regs
->gpr
, env
->gpr
, len
);
1759 regs
->link
= env
->lr
;
1760 regs
->ctr
= env
->ctr
;
1761 regs
->xer
= cpu_read_xer(env
);
1764 for (i
= 0; i
< 8; i
++) {
1765 cr
|= (env
->crf
[i
] & 15) << (4 * (7 - i
));
1769 if (excp
== POWERPC_EXCP_MCHECK
||
1770 excp
== POWERPC_EXCP_RESET
||
1771 excp
== POWERPC_EXCP_SYSCALL
) {
1772 regs
->nip
= env
->spr
[SPR_SRR0
];
1773 regs
->msr
= env
->spr
[SPR_SRR1
] & env
->msr_mask
;
1775 regs
->nip
= env
->spr
[SPR_HSRR0
];
1776 regs
->msr
= env
->spr
[SPR_HSRR1
] & env
->msr_mask
;
1779 /* Is it okay to specify write length larger than actual data written? */
1780 address_space_unmap(CPU(cpu
)->as
, regs
, len
, len
, true);
1783 memcpy(env
->gpr
, spapr_cpu
->nested_host_state
->gpr
, sizeof(env
->gpr
));
1784 env
->lr
= spapr_cpu
->nested_host_state
->lr
;
1785 env
->ctr
= spapr_cpu
->nested_host_state
->ctr
;
1786 memcpy(env
->crf
, spapr_cpu
->nested_host_state
->crf
, sizeof(env
->crf
));
1787 env
->cfar
= spapr_cpu
->nested_host_state
->cfar
;
1788 env
->xer
= spapr_cpu
->nested_host_state
->xer
;
1789 env
->so
= spapr_cpu
->nested_host_state
->so
;
1790 env
->ov
= spapr_cpu
->nested_host_state
->ov
;
1791 env
->ov32
= spapr_cpu
->nested_host_state
->ov32
;
1792 env
->ca32
= spapr_cpu
->nested_host_state
->ca32
;
1793 env
->msr
= spapr_cpu
->nested_host_state
->msr
;
1794 env
->nip
= spapr_cpu
->nested_host_state
->nip
;
1796 assert(env
->spr
[SPR_LPIDR
] != 0);
1797 env
->spr
[SPR_LPCR
] = spapr_cpu
->nested_host_state
->spr
[SPR_LPCR
];
1798 env
->spr
[SPR_LPIDR
] = spapr_cpu
->nested_host_state
->spr
[SPR_LPIDR
];
1799 env
->spr
[SPR_PCR
] = spapr_cpu
->nested_host_state
->spr
[SPR_PCR
];
1800 env
->spr
[SPR_DPDES
] = 0;
1801 env
->spr
[SPR_HFSCR
] = spapr_cpu
->nested_host_state
->spr
[SPR_HFSCR
];
1802 env
->spr
[SPR_SRR0
] = spapr_cpu
->nested_host_state
->spr
[SPR_SRR0
];
1803 env
->spr
[SPR_SRR1
] = spapr_cpu
->nested_host_state
->spr
[SPR_SRR1
];
1804 env
->spr
[SPR_SPRG0
] = spapr_cpu
->nested_host_state
->spr
[SPR_SPRG0
];
1805 env
->spr
[SPR_SPRG1
] = spapr_cpu
->nested_host_state
->spr
[SPR_SPRG1
];
1806 env
->spr
[SPR_SPRG2
] = spapr_cpu
->nested_host_state
->spr
[SPR_SPRG2
];
1807 env
->spr
[SPR_SPRG3
] = spapr_cpu
->nested_host_state
->spr
[SPR_SPRG3
];
1808 env
->spr
[SPR_BOOKS_PID
] = spapr_cpu
->nested_host_state
->spr
[SPR_BOOKS_PID
];
1809 env
->spr
[SPR_PPR
] = spapr_cpu
->nested_host_state
->spr
[SPR_PPR
];
1812 * Return the interrupt vector address from H_ENTER_NESTED to the L1
1815 env
->gpr
[3] = r3_return
;
1817 env
->tb_env
->tb_offset
-= spapr_cpu
->nested_tb_offset
;
1818 spapr_cpu
->in_nested
= false;
1820 hreg_compute_hflags(env
);
1822 env
->reserve_addr
= -1; /* Reset the reservation */
1824 g_free(spapr_cpu
->nested_host_state
);
1825 spapr_cpu
->nested_host_state
= NULL
;
1828 static void hypercall_register_types(void)
1830 hypercall_register_softmmu();
1832 /* hcall-hpt-resize */
1833 spapr_register_hypercall(H_RESIZE_HPT_PREPARE
, h_resize_hpt_prepare
);
1834 spapr_register_hypercall(H_RESIZE_HPT_COMMIT
, h_resize_hpt_commit
);
1837 spapr_register_hypercall(H_REGISTER_VPA
, h_register_vpa
);
1838 spapr_register_hypercall(H_CEDE
, h_cede
);
1839 spapr_register_hypercall(H_CONFER
, h_confer
);
1840 spapr_register_hypercall(H_PROD
, h_prod
);
1843 spapr_register_hypercall(H_JOIN
, h_join
);
1845 spapr_register_hypercall(H_SIGNAL_SYS_RESET
, h_signal_sys_reset
);
1847 /* processor register resource access h-calls */
1848 spapr_register_hypercall(H_SET_SPRG0
, h_set_sprg0
);
1849 spapr_register_hypercall(H_SET_DABR
, h_set_dabr
);
1850 spapr_register_hypercall(H_SET_XDABR
, h_set_xdabr
);
1851 spapr_register_hypercall(H_PAGE_INIT
, h_page_init
);
1852 spapr_register_hypercall(H_SET_MODE
, h_set_mode
);
1854 /* In Memory Table MMU h-calls */
1855 spapr_register_hypercall(H_CLEAN_SLB
, h_clean_slb
);
1856 spapr_register_hypercall(H_INVALIDATE_PID
, h_invalidate_pid
);
1857 spapr_register_hypercall(H_REGISTER_PROC_TBL
, h_register_process_table
);
1859 /* hcall-get-cpu-characteristics */
1860 spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS
,
1861 h_get_cpu_characteristics
);
1863 /* "debugger" hcalls (also used by SLOF). Note: We do -not- differenciate
1864 * here between the "CI" and the "CACHE" variants, they will use whatever
1865 * mapping attributes qemu is using. When using KVM, the kernel will
1866 * enforce the attributes more strongly
1868 spapr_register_hypercall(H_LOGICAL_CI_LOAD
, h_logical_load
);
1869 spapr_register_hypercall(H_LOGICAL_CI_STORE
, h_logical_store
);
1870 spapr_register_hypercall(H_LOGICAL_CACHE_LOAD
, h_logical_load
);
1871 spapr_register_hypercall(H_LOGICAL_CACHE_STORE
, h_logical_store
);
1872 spapr_register_hypercall(H_LOGICAL_ICBI
, h_logical_icbi
);
1873 spapr_register_hypercall(H_LOGICAL_DCBF
, h_logical_dcbf
);
1874 spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP
, h_logical_memop
);
1876 /* qemu/KVM-PPC specific hcalls */
1877 spapr_register_hypercall(KVMPPC_H_RTAS
, h_rtas
);
1879 /* ibm,client-architecture-support support */
1880 spapr_register_hypercall(KVMPPC_H_CAS
, h_client_architecture_support
);
1882 spapr_register_hypercall(KVMPPC_H_UPDATE_DT
, h_update_dt
);
1884 spapr_register_hypercall(KVMPPC_H_SET_PARTITION_TABLE
, h_set_ptbl
);
1885 spapr_register_hypercall(KVMPPC_H_ENTER_NESTED
, h_enter_nested
);
1886 spapr_register_hypercall(KVMPPC_H_TLB_INVALIDATE
, h_tlb_invalidate
);
1887 spapr_register_hypercall(KVMPPC_H_COPY_TOFROM_GUEST
, h_copy_tofrom_guest
);
1890 type_init(hypercall_register_types
)