1 #include "qemu/osdep.h"
2 #include "qemu/cutils.h"
3 #include "qapi/error.h"
4 #include "sysemu/hw_accel.h"
5 #include "sysemu/runstate.h"
7 #include "qemu/main-loop.h"
8 #include "qemu/module.h"
9 #include "qemu/error-report.h"
11 #include "exec/exec-all.h"
12 #include "helper_regs.h"
13 #include "hw/ppc/spapr.h"
14 #include "hw/ppc/spapr_cpu_core.h"
15 #include "mmu-hash64.h"
16 #include "cpu-models.h"
19 #include "hw/ppc/fdt.h"
20 #include "hw/ppc/spapr_ovec.h"
21 #include "mmu-book3s-v3.h"
22 #include "hw/mem/memory-device.h"
24 static bool has_spr(PowerPCCPU
*cpu
, int spr
)
26 /* We can test whether the SPR is defined by checking for a valid name */
27 return cpu
->env
.spr_cb
[spr
].name
!= NULL
;
30 static inline bool valid_ptex(PowerPCCPU
*cpu
, target_ulong ptex
)
33 * hash value/pteg group index is normalized by HPT mask
35 if (((ptex
& ~7ULL) / HPTES_PER_GROUP
) & ~ppc_hash64_hpt_mask(cpu
)) {
41 static bool is_ram_address(SpaprMachineState
*spapr
, hwaddr addr
)
43 MachineState
*machine
= MACHINE(spapr
);
44 DeviceMemoryState
*dms
= machine
->device_memory
;
46 if (addr
< machine
->ram_size
) {
49 if ((addr
>= dms
->base
)
50 && ((addr
- dms
->base
) < memory_region_size(&dms
->mr
))) {
57 static target_ulong
h_enter(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
58 target_ulong opcode
, target_ulong
*args
)
60 target_ulong flags
= args
[0];
61 target_ulong ptex
= args
[1];
62 target_ulong pteh
= args
[2];
63 target_ulong ptel
= args
[3];
67 const ppc_hash_pte64_t
*hptes
;
69 apshift
= ppc_hash64_hpte_page_shift_noslb(cpu
, pteh
, ptel
);
71 /* Bad page size encoding */
75 raddr
= (ptel
& HPTE64_R_RPN
) & ~((1ULL << apshift
) - 1);
77 if (is_ram_address(spapr
, raddr
)) {
78 /* Regular RAM - should have WIMG=0010 */
79 if ((ptel
& HPTE64_R_WIMG
) != HPTE64_R_M
) {
83 target_ulong wimg_flags
;
84 /* Looks like an IO address */
85 /* FIXME: What WIMG combinations could be sensible for IO?
86 * For now we allow WIMG=010x, but are there others? */
87 /* FIXME: Should we check against registered IO addresses? */
88 wimg_flags
= (ptel
& (HPTE64_R_W
| HPTE64_R_I
| HPTE64_R_M
));
90 if (wimg_flags
!= HPTE64_R_I
&&
91 wimg_flags
!= (HPTE64_R_I
| HPTE64_R_M
)) {
98 if (!valid_ptex(cpu
, ptex
)) {
105 if (likely((flags
& H_EXACT
) == 0)) {
106 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
107 for (slot
= 0; slot
< 8; slot
++) {
108 if (!(ppc_hash64_hpte0(cpu
, hptes
, slot
) & HPTE64_V_VALID
)) {
112 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
117 hptes
= ppc_hash64_map_hptes(cpu
, ptex
+ slot
, 1);
118 if (ppc_hash64_hpte0(cpu
, hptes
, 0) & HPTE64_V_VALID
) {
119 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
+ slot
, 1);
122 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
125 spapr_store_hpte(cpu
, ptex
+ slot
, pteh
| HPTE64_V_HPTE_DIRTY
, ptel
);
127 args
[0] = ptex
+ slot
;
133 REMOVE_NOT_FOUND
= 1,
138 static RemoveResult
remove_hpte(PowerPCCPU
*cpu
142 target_ulong
*vp
, target_ulong
*rp
)
144 const ppc_hash_pte64_t
*hptes
;
147 if (!valid_ptex(cpu
, ptex
)) {
151 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, 1);
152 v
= ppc_hash64_hpte0(cpu
, hptes
, 0);
153 r
= ppc_hash64_hpte1(cpu
, hptes
, 0);
154 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
156 if ((v
& HPTE64_V_VALID
) == 0 ||
157 ((flags
& H_AVPN
) && (v
& ~0x7fULL
) != avpn
) ||
158 ((flags
& H_ANDCOND
) && (v
& avpn
) != 0)) {
159 return REMOVE_NOT_FOUND
;
163 spapr_store_hpte(cpu
, ptex
, HPTE64_V_HPTE_DIRTY
, 0);
164 ppc_hash64_tlb_flush_hpte(cpu
, ptex
, v
, r
);
165 return REMOVE_SUCCESS
;
168 static target_ulong
h_remove(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
169 target_ulong opcode
, target_ulong
*args
)
171 CPUPPCState
*env
= &cpu
->env
;
172 target_ulong flags
= args
[0];
173 target_ulong ptex
= args
[1];
174 target_ulong avpn
= args
[2];
177 ret
= remove_hpte(cpu
, ptex
, avpn
, flags
,
182 check_tlb_flush(env
, true);
185 case REMOVE_NOT_FOUND
:
195 g_assert_not_reached();
198 #define H_BULK_REMOVE_TYPE 0xc000000000000000ULL
199 #define H_BULK_REMOVE_REQUEST 0x4000000000000000ULL
200 #define H_BULK_REMOVE_RESPONSE 0x8000000000000000ULL
201 #define H_BULK_REMOVE_END 0xc000000000000000ULL
202 #define H_BULK_REMOVE_CODE 0x3000000000000000ULL
203 #define H_BULK_REMOVE_SUCCESS 0x0000000000000000ULL
204 #define H_BULK_REMOVE_NOT_FOUND 0x1000000000000000ULL
205 #define H_BULK_REMOVE_PARM 0x2000000000000000ULL
206 #define H_BULK_REMOVE_HW 0x3000000000000000ULL
207 #define H_BULK_REMOVE_RC 0x0c00000000000000ULL
208 #define H_BULK_REMOVE_FLAGS 0x0300000000000000ULL
209 #define H_BULK_REMOVE_ABSOLUTE 0x0000000000000000ULL
210 #define H_BULK_REMOVE_ANDCOND 0x0100000000000000ULL
211 #define H_BULK_REMOVE_AVPN 0x0200000000000000ULL
212 #define H_BULK_REMOVE_PTEX 0x00ffffffffffffffULL
214 #define H_BULK_REMOVE_MAX_BATCH 4
216 static target_ulong
h_bulk_remove(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
217 target_ulong opcode
, target_ulong
*args
)
219 CPUPPCState
*env
= &cpu
->env
;
221 target_ulong rc
= H_SUCCESS
;
223 for (i
= 0; i
< H_BULK_REMOVE_MAX_BATCH
; i
++) {
224 target_ulong
*tsh
= &args
[i
*2];
225 target_ulong tsl
= args
[i
*2 + 1];
226 target_ulong v
, r
, ret
;
228 if ((*tsh
& H_BULK_REMOVE_TYPE
) == H_BULK_REMOVE_END
) {
230 } else if ((*tsh
& H_BULK_REMOVE_TYPE
) != H_BULK_REMOVE_REQUEST
) {
234 *tsh
&= H_BULK_REMOVE_PTEX
| H_BULK_REMOVE_FLAGS
;
235 *tsh
|= H_BULK_REMOVE_RESPONSE
;
237 if ((*tsh
& H_BULK_REMOVE_ANDCOND
) && (*tsh
& H_BULK_REMOVE_AVPN
)) {
238 *tsh
|= H_BULK_REMOVE_PARM
;
242 ret
= remove_hpte(cpu
, *tsh
& H_BULK_REMOVE_PTEX
, tsl
,
243 (*tsh
& H_BULK_REMOVE_FLAGS
) >> 26,
250 *tsh
|= (r
& (HPTE64_R_C
| HPTE64_R_R
)) << 43;
263 check_tlb_flush(env
, true);
268 static target_ulong
h_protect(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
269 target_ulong opcode
, target_ulong
*args
)
271 CPUPPCState
*env
= &cpu
->env
;
272 target_ulong flags
= args
[0];
273 target_ulong ptex
= args
[1];
274 target_ulong avpn
= args
[2];
275 const ppc_hash_pte64_t
*hptes
;
278 if (!valid_ptex(cpu
, ptex
)) {
282 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, 1);
283 v
= ppc_hash64_hpte0(cpu
, hptes
, 0);
284 r
= ppc_hash64_hpte1(cpu
, hptes
, 0);
285 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
287 if ((v
& HPTE64_V_VALID
) == 0 ||
288 ((flags
& H_AVPN
) && (v
& ~0x7fULL
) != avpn
)) {
292 r
&= ~(HPTE64_R_PP0
| HPTE64_R_PP
| HPTE64_R_N
|
293 HPTE64_R_KEY_HI
| HPTE64_R_KEY_LO
);
294 r
|= (flags
<< 55) & HPTE64_R_PP0
;
295 r
|= (flags
<< 48) & HPTE64_R_KEY_HI
;
296 r
|= flags
& (HPTE64_R_PP
| HPTE64_R_N
| HPTE64_R_KEY_LO
);
297 spapr_store_hpte(cpu
, ptex
,
298 (v
& ~HPTE64_V_VALID
) | HPTE64_V_HPTE_DIRTY
, 0);
299 ppc_hash64_tlb_flush_hpte(cpu
, ptex
, v
, r
);
301 check_tlb_flush(env
, true);
302 /* Don't need a memory barrier, due to qemu's global lock */
303 spapr_store_hpte(cpu
, ptex
, v
| HPTE64_V_HPTE_DIRTY
, r
);
307 static target_ulong
h_read(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
308 target_ulong opcode
, target_ulong
*args
)
310 target_ulong flags
= args
[0];
311 target_ulong ptex
= args
[1];
312 int i
, ridx
, n_entries
= 1;
313 const ppc_hash_pte64_t
*hptes
;
315 if (!valid_ptex(cpu
, ptex
)) {
319 if (flags
& H_READ_4
) {
320 /* Clear the two low order bits */
325 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, n_entries
);
326 for (i
= 0, ridx
= 0; i
< n_entries
; i
++) {
327 args
[ridx
++] = ppc_hash64_hpte0(cpu
, hptes
, i
);
328 args
[ridx
++] = ppc_hash64_hpte1(cpu
, hptes
, i
);
330 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, n_entries
);
335 struct SpaprPendingHpt
{
336 /* These fields are read-only after initialization */
340 /* These fields are protected by the BQL */
343 /* These fields are private to the preparation thread if
344 * !complete, otherwise protected by the BQL */
349 static void free_pending_hpt(SpaprPendingHpt
*pending
)
352 qemu_vfree(pending
->hpt
);
358 static void *hpt_prepare_thread(void *opaque
)
360 SpaprPendingHpt
*pending
= opaque
;
361 size_t size
= 1ULL << pending
->shift
;
363 pending
->hpt
= qemu_try_memalign(size
, size
);
365 memset(pending
->hpt
, 0, size
);
366 pending
->ret
= H_SUCCESS
;
368 pending
->ret
= H_NO_MEM
;
371 qemu_mutex_lock_iothread();
373 if (SPAPR_MACHINE(qdev_get_machine())->pending_hpt
== pending
) {
375 pending
->complete
= true;
377 /* We've been cancelled, clean ourselves up */
378 free_pending_hpt(pending
);
381 qemu_mutex_unlock_iothread();
385 /* Must be called with BQL held */
386 static void cancel_hpt_prepare(SpaprMachineState
*spapr
)
388 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
390 /* Let the thread know it's cancelled */
391 spapr
->pending_hpt
= NULL
;
398 if (!pending
->complete
) {
399 /* thread will clean itself up */
403 free_pending_hpt(pending
);
406 /* Convert a return code from the KVM ioctl()s implementing resize HPT
407 * into a PAPR hypercall return code */
408 static target_ulong
resize_hpt_convert_rc(int ret
)
411 return H_LONG_BUSY_ORDER_100_SEC
;
412 } else if (ret
>= 10000) {
413 return H_LONG_BUSY_ORDER_10_SEC
;
414 } else if (ret
>= 1000) {
415 return H_LONG_BUSY_ORDER_1_SEC
;
416 } else if (ret
>= 100) {
417 return H_LONG_BUSY_ORDER_100_MSEC
;
418 } else if (ret
>= 10) {
419 return H_LONG_BUSY_ORDER_10_MSEC
;
420 } else if (ret
> 0) {
421 return H_LONG_BUSY_ORDER_1_MSEC
;
444 static target_ulong
h_resize_hpt_prepare(PowerPCCPU
*cpu
,
445 SpaprMachineState
*spapr
,
449 target_ulong flags
= args
[0];
451 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
452 uint64_t current_ram_size
;
455 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
459 if (!spapr
->htab_shift
) {
460 /* Radix guest, no HPT */
461 return H_NOT_AVAILABLE
;
464 trace_spapr_h_resize_hpt_prepare(flags
, shift
);
470 if (shift
&& ((shift
< 18) || (shift
> 46))) {
474 current_ram_size
= MACHINE(spapr
)->ram_size
+ get_plugged_memory_size();
476 /* We only allow the guest to allocate an HPT one order above what
477 * we'd normally give them (to stop a small guest claiming a huge
478 * chunk of resources in the HPT */
479 if (shift
> (spapr_hpt_shift_for_ramsize(current_ram_size
) + 1)) {
483 rc
= kvmppc_resize_hpt_prepare(cpu
, flags
, shift
);
485 return resize_hpt_convert_rc(rc
);
489 /* something already in progress */
490 if (pending
->shift
== shift
) {
491 /* and it's suitable */
492 if (pending
->complete
) {
495 return H_LONG_BUSY_ORDER_100_MSEC
;
499 /* not suitable, cancel and replace */
500 cancel_hpt_prepare(spapr
);
508 /* start new prepare */
510 pending
= g_new0(SpaprPendingHpt
, 1);
511 pending
->shift
= shift
;
512 pending
->ret
= H_HARDWARE
;
514 qemu_thread_create(&pending
->thread
, "sPAPR HPT prepare",
515 hpt_prepare_thread
, pending
, QEMU_THREAD_DETACHED
);
517 spapr
->pending_hpt
= pending
;
519 /* In theory we could estimate the time more accurately based on
520 * the new size, but there's not much point */
521 return H_LONG_BUSY_ORDER_100_MSEC
;
524 static uint64_t new_hpte_load0(void *htab
, uint64_t pteg
, int slot
)
526 uint8_t *addr
= htab
;
528 addr
+= pteg
* HASH_PTEG_SIZE_64
;
529 addr
+= slot
* HASH_PTE_SIZE_64
;
533 static void new_hpte_store(void *htab
, uint64_t pteg
, int slot
,
534 uint64_t pte0
, uint64_t pte1
)
536 uint8_t *addr
= htab
;
538 addr
+= pteg
* HASH_PTEG_SIZE_64
;
539 addr
+= slot
* HASH_PTE_SIZE_64
;
542 stq_p(addr
+ HASH_PTE_SIZE_64
/ 2, pte1
);
545 static int rehash_hpte(PowerPCCPU
*cpu
,
546 const ppc_hash_pte64_t
*hptes
,
547 void *old_hpt
, uint64_t oldsize
,
548 void *new_hpt
, uint64_t newsize
,
549 uint64_t pteg
, int slot
)
551 uint64_t old_hash_mask
= (oldsize
>> 7) - 1;
552 uint64_t new_hash_mask
= (newsize
>> 7) - 1;
553 target_ulong pte0
= ppc_hash64_hpte0(cpu
, hptes
, slot
);
556 unsigned base_pg_shift
;
557 uint64_t hash
, new_pteg
, replace_pte0
;
559 if (!(pte0
& HPTE64_V_VALID
) || !(pte0
& HPTE64_V_BOLTED
)) {
563 pte1
= ppc_hash64_hpte1(cpu
, hptes
, slot
);
565 base_pg_shift
= ppc_hash64_hpte_page_shift_noslb(cpu
, pte0
, pte1
);
566 assert(base_pg_shift
); /* H_ENTER shouldn't allow a bad encoding */
567 avpn
= HPTE64_V_AVPN_VAL(pte0
) & ~(((1ULL << base_pg_shift
) - 1) >> 23);
569 if (pte0
& HPTE64_V_SECONDARY
) {
573 if ((pte0
& HPTE64_V_SSIZE
) == HPTE64_V_SSIZE_256M
) {
574 uint64_t offset
, vsid
;
576 /* We only have 28 - 23 bits of offset in avpn */
577 offset
= (avpn
& 0x1f) << 23;
579 /* We can find more bits from the pteg value */
580 if (base_pg_shift
< 23) {
581 offset
|= ((vsid
^ pteg
) & old_hash_mask
) << base_pg_shift
;
584 hash
= vsid
^ (offset
>> base_pg_shift
);
585 } else if ((pte0
& HPTE64_V_SSIZE
) == HPTE64_V_SSIZE_1T
) {
586 uint64_t offset
, vsid
;
588 /* We only have 40 - 23 bits of seg_off in avpn */
589 offset
= (avpn
& 0x1ffff) << 23;
591 if (base_pg_shift
< 23) {
592 offset
|= ((vsid
^ (vsid
<< 25) ^ pteg
) & old_hash_mask
)
596 hash
= vsid
^ (vsid
<< 25) ^ (offset
>> base_pg_shift
);
598 error_report("rehash_pte: Bad segment size in HPTE");
602 new_pteg
= hash
& new_hash_mask
;
603 if (pte0
& HPTE64_V_SECONDARY
) {
604 assert(~pteg
== (hash
& old_hash_mask
));
605 new_pteg
= ~new_pteg
;
607 assert(pteg
== (hash
& old_hash_mask
));
609 assert((oldsize
!= newsize
) || (pteg
== new_pteg
));
610 replace_pte0
= new_hpte_load0(new_hpt
, new_pteg
, slot
);
612 * Strictly speaking, we don't need all these tests, since we only
613 * ever rehash bolted HPTEs. We might in future handle non-bolted
614 * HPTEs, though so make the logic correct for those cases as
617 if (replace_pte0
& HPTE64_V_VALID
) {
618 assert(newsize
< oldsize
);
619 if (replace_pte0
& HPTE64_V_BOLTED
) {
620 if (pte0
& HPTE64_V_BOLTED
) {
621 /* Bolted collision, nothing we can do */
624 /* Discard this hpte */
630 new_hpte_store(new_hpt
, new_pteg
, slot
, pte0
, pte1
);
634 static int rehash_hpt(PowerPCCPU
*cpu
,
635 void *old_hpt
, uint64_t oldsize
,
636 void *new_hpt
, uint64_t newsize
)
638 uint64_t n_ptegs
= oldsize
>> 7;
643 for (pteg
= 0; pteg
< n_ptegs
; pteg
++) {
644 hwaddr ptex
= pteg
* HPTES_PER_GROUP
;
645 const ppc_hash_pte64_t
*hptes
646 = ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
652 for (slot
= 0; slot
< HPTES_PER_GROUP
; slot
++) {
653 rc
= rehash_hpte(cpu
, hptes
, old_hpt
, oldsize
, new_hpt
, newsize
,
655 if (rc
!= H_SUCCESS
) {
656 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
660 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
666 static void do_push_sregs_to_kvm_pr(CPUState
*cs
, run_on_cpu_data data
)
670 cpu_synchronize_state(cs
);
672 ret
= kvmppc_put_books_sregs(POWERPC_CPU(cs
));
674 error_report("failed to push sregs to KVM: %s", strerror(-ret
));
679 static void push_sregs_to_kvm_pr(SpaprMachineState
*spapr
)
684 * This is a hack for the benefit of KVM PR - it abuses the SDR1
685 * slot in kvm_sregs to communicate the userspace address of the
688 if (!kvm_enabled() || !spapr
->htab
) {
693 run_on_cpu(cs
, do_push_sregs_to_kvm_pr
, RUN_ON_CPU_NULL
);
697 static target_ulong
h_resize_hpt_commit(PowerPCCPU
*cpu
,
698 SpaprMachineState
*spapr
,
702 target_ulong flags
= args
[0];
703 target_ulong shift
= args
[1];
704 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
708 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
712 if (!spapr
->htab_shift
) {
713 /* Radix guest, no HPT */
714 return H_NOT_AVAILABLE
;
717 trace_spapr_h_resize_hpt_commit(flags
, shift
);
719 rc
= kvmppc_resize_hpt_commit(cpu
, flags
, shift
);
721 rc
= resize_hpt_convert_rc(rc
);
722 if (rc
== H_SUCCESS
) {
723 /* Need to set the new htab_shift in the machine state */
724 spapr
->htab_shift
= shift
;
733 if (!pending
|| (pending
->shift
!= shift
)) {
734 /* no matching prepare */
738 if (!pending
->complete
) {
739 /* prepare has not completed */
743 /* Shouldn't have got past PREPARE without an HPT */
744 g_assert(spapr
->htab_shift
);
746 newsize
= 1ULL << pending
->shift
;
747 rc
= rehash_hpt(cpu
, spapr
->htab
, HTAB_SIZE(spapr
),
748 pending
->hpt
, newsize
);
749 if (rc
== H_SUCCESS
) {
750 qemu_vfree(spapr
->htab
);
751 spapr
->htab
= pending
->hpt
;
752 spapr
->htab_shift
= pending
->shift
;
754 push_sregs_to_kvm_pr(spapr
);
756 pending
->hpt
= NULL
; /* so it's not free()d */
760 spapr
->pending_hpt
= NULL
;
761 free_pending_hpt(pending
);
766 static target_ulong
h_set_sprg0(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
767 target_ulong opcode
, target_ulong
*args
)
769 cpu_synchronize_state(CPU(cpu
));
770 cpu
->env
.spr
[SPR_SPRG0
] = args
[0];
775 static target_ulong
h_set_dabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
776 target_ulong opcode
, target_ulong
*args
)
778 if (!has_spr(cpu
, SPR_DABR
)) {
779 return H_HARDWARE
; /* DABR register not available */
781 cpu_synchronize_state(CPU(cpu
));
783 if (has_spr(cpu
, SPR_DABRX
)) {
784 cpu
->env
.spr
[SPR_DABRX
] = 0x3; /* Use Problem and Privileged state */
785 } else if (!(args
[0] & 0x4)) { /* Breakpoint Translation set? */
786 return H_RESERVED_DABR
;
789 cpu
->env
.spr
[SPR_DABR
] = args
[0];
793 static target_ulong
h_set_xdabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
794 target_ulong opcode
, target_ulong
*args
)
796 target_ulong dabrx
= args
[1];
798 if (!has_spr(cpu
, SPR_DABR
) || !has_spr(cpu
, SPR_DABRX
)) {
802 if ((dabrx
& ~0xfULL
) != 0 || (dabrx
& H_DABRX_HYPERVISOR
) != 0
803 || (dabrx
& (H_DABRX_KERNEL
| H_DABRX_USER
)) == 0) {
807 cpu_synchronize_state(CPU(cpu
));
808 cpu
->env
.spr
[SPR_DABRX
] = dabrx
;
809 cpu
->env
.spr
[SPR_DABR
] = args
[0];
814 static target_ulong
h_page_init(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
815 target_ulong opcode
, target_ulong
*args
)
817 target_ulong flags
= args
[0];
818 hwaddr dst
= args
[1];
819 hwaddr src
= args
[2];
820 hwaddr len
= TARGET_PAGE_SIZE
;
821 uint8_t *pdst
, *psrc
;
822 target_long ret
= H_SUCCESS
;
824 if (flags
& ~(H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
825 | H_COPY_PAGE
| H_ZERO_PAGE
)) {
826 qemu_log_mask(LOG_UNIMP
, "h_page_init: Bad flags (" TARGET_FMT_lx
"\n",
831 /* Map-in destination */
832 if (!is_ram_address(spapr
, dst
) || (dst
& ~TARGET_PAGE_MASK
) != 0) {
835 pdst
= cpu_physical_memory_map(dst
, &len
, true);
836 if (!pdst
|| len
!= TARGET_PAGE_SIZE
) {
840 if (flags
& H_COPY_PAGE
) {
841 /* Map-in source, copy to destination, and unmap source again */
842 if (!is_ram_address(spapr
, src
) || (src
& ~TARGET_PAGE_MASK
) != 0) {
846 psrc
= cpu_physical_memory_map(src
, &len
, false);
847 if (!psrc
|| len
!= TARGET_PAGE_SIZE
) {
851 memcpy(pdst
, psrc
, len
);
852 cpu_physical_memory_unmap(psrc
, len
, 0, len
);
853 } else if (flags
& H_ZERO_PAGE
) {
854 memset(pdst
, 0, len
); /* Just clear the destination page */
857 if (kvm_enabled() && (flags
& H_ICACHE_SYNCHRONIZE
) != 0) {
858 kvmppc_dcbst_range(cpu
, pdst
, len
);
860 if (flags
& (H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
)) {
862 kvmppc_icbi_range(cpu
, pdst
, len
);
869 cpu_physical_memory_unmap(pdst
, TARGET_PAGE_SIZE
, 1, len
);
873 #define FLAGS_REGISTER_VPA 0x0000200000000000ULL
874 #define FLAGS_REGISTER_DTL 0x0000400000000000ULL
875 #define FLAGS_REGISTER_SLBSHADOW 0x0000600000000000ULL
876 #define FLAGS_DEREGISTER_VPA 0x0000a00000000000ULL
877 #define FLAGS_DEREGISTER_DTL 0x0000c00000000000ULL
878 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
880 static target_ulong
register_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
882 CPUState
*cs
= CPU(cpu
);
883 CPUPPCState
*env
= &cpu
->env
;
884 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
889 hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
893 if (vpa
% env
->dcache_line_size
) {
896 /* FIXME: bounds check the address */
898 size
= lduw_be_phys(cs
->as
, vpa
+ 0x4);
900 if (size
< VPA_MIN_SIZE
) {
904 /* VPA is not allowed to cross a page boundary */
905 if ((vpa
/ 4096) != ((vpa
+ size
- 1) / 4096)) {
909 spapr_cpu
->vpa_addr
= vpa
;
911 tmp
= ldub_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
);
912 tmp
|= VPA_SHARED_PROC_VAL
;
913 stb_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
, tmp
);
918 static target_ulong
deregister_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
920 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
922 if (spapr_cpu
->slb_shadow_addr
) {
926 if (spapr_cpu
->dtl_addr
) {
930 spapr_cpu
->vpa_addr
= 0;
934 static target_ulong
register_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
936 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
940 hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
944 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
949 if ((addr
/ 4096) != ((addr
+ size
- 1) / 4096)) {
953 if (!spapr_cpu
->vpa_addr
) {
957 spapr_cpu
->slb_shadow_addr
= addr
;
958 spapr_cpu
->slb_shadow_size
= size
;
963 static target_ulong
deregister_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
965 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
967 spapr_cpu
->slb_shadow_addr
= 0;
968 spapr_cpu
->slb_shadow_size
= 0;
972 static target_ulong
register_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
974 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
978 hcall_dprintf("Can't cope with DTL at logical 0\n");
982 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
988 if (!spapr_cpu
->vpa_addr
) {
992 spapr_cpu
->dtl_addr
= addr
;
993 spapr_cpu
->dtl_size
= size
;
998 static target_ulong
deregister_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
1000 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1002 spapr_cpu
->dtl_addr
= 0;
1003 spapr_cpu
->dtl_size
= 0;
1008 static target_ulong
h_register_vpa(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1009 target_ulong opcode
, target_ulong
*args
)
1011 target_ulong flags
= args
[0];
1012 target_ulong procno
= args
[1];
1013 target_ulong vpa
= args
[2];
1014 target_ulong ret
= H_PARAMETER
;
1017 tcpu
= spapr_find_cpu(procno
);
1023 case FLAGS_REGISTER_VPA
:
1024 ret
= register_vpa(tcpu
, vpa
);
1027 case FLAGS_DEREGISTER_VPA
:
1028 ret
= deregister_vpa(tcpu
, vpa
);
1031 case FLAGS_REGISTER_SLBSHADOW
:
1032 ret
= register_slb_shadow(tcpu
, vpa
);
1035 case FLAGS_DEREGISTER_SLBSHADOW
:
1036 ret
= deregister_slb_shadow(tcpu
, vpa
);
1039 case FLAGS_REGISTER_DTL
:
1040 ret
= register_dtl(tcpu
, vpa
);
1043 case FLAGS_DEREGISTER_DTL
:
1044 ret
= deregister_dtl(tcpu
, vpa
);
1051 static target_ulong
h_cede(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1052 target_ulong opcode
, target_ulong
*args
)
1054 CPUPPCState
*env
= &cpu
->env
;
1055 CPUState
*cs
= CPU(cpu
);
1056 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1058 env
->msr
|= (1ULL << MSR_EE
);
1059 hreg_compute_hflags(env
);
1061 if (spapr_cpu
->prod
) {
1062 spapr_cpu
->prod
= false;
1066 if (!cpu_has_work(cs
)) {
1068 cs
->exception_index
= EXCP_HLT
;
1069 cs
->exit_request
= 1;
1076 * Confer to self, aka join. Cede could use the same pattern as well, if
1077 * EXCP_HLT can be changed to ECXP_HALTED.
1079 static target_ulong
h_confer_self(PowerPCCPU
*cpu
)
1081 CPUState
*cs
= CPU(cpu
);
1082 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1084 if (spapr_cpu
->prod
) {
1085 spapr_cpu
->prod
= false;
1089 cs
->exception_index
= EXCP_HALTED
;
1090 cs
->exit_request
= 1;
1095 static target_ulong
h_join(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1096 target_ulong opcode
, target_ulong
*args
)
1098 CPUPPCState
*env
= &cpu
->env
;
1100 bool last_unjoined
= true;
1102 if (env
->msr
& (1ULL << MSR_EE
)) {
1107 * Must not join the last CPU running. Interestingly, no such restriction
1108 * for H_CONFER-to-self, but that is probably not intended to be used
1109 * when H_JOIN is available.
1112 PowerPCCPU
*c
= POWERPC_CPU(cs
);
1113 CPUPPCState
*e
= &c
->env
;
1118 /* Don't have a way to indicate joined, so use halted && MSR[EE]=0 */
1119 if (!cs
->halted
|| (e
->msr
& (1ULL << MSR_EE
))) {
1120 last_unjoined
= false;
1124 if (last_unjoined
) {
1128 return h_confer_self(cpu
);
1131 static target_ulong
h_confer(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1132 target_ulong opcode
, target_ulong
*args
)
1134 target_long target
= args
[0];
1135 uint32_t dispatch
= args
[1];
1136 CPUState
*cs
= CPU(cpu
);
1137 SpaprCpuState
*spapr_cpu
;
1140 * -1 means confer to all other CPUs without dispatch counter check,
1141 * otherwise it's a targeted confer.
1144 PowerPCCPU
*target_cpu
= spapr_find_cpu(target
);
1145 uint32_t target_dispatch
;
1152 * target == self is a special case, we wait until prodded, without
1153 * dispatch counter check.
1155 if (cpu
== target_cpu
) {
1156 return h_confer_self(cpu
);
1159 spapr_cpu
= spapr_cpu_state(target_cpu
);
1160 if (!spapr_cpu
->vpa_addr
|| ((dispatch
& 1) == 0)) {
1164 target_dispatch
= ldl_be_phys(cs
->as
,
1165 spapr_cpu
->vpa_addr
+ VPA_DISPATCH_COUNTER
);
1166 if (target_dispatch
!= dispatch
) {
1171 * The targeted confer does not do anything special beyond yielding
1172 * the current vCPU, but even this should be better than nothing.
1173 * At least for single-threaded tcg, it gives the target a chance to
1174 * run before we run again. Multi-threaded tcg does not really do
1175 * anything with EXCP_YIELD yet.
1179 cs
->exception_index
= EXCP_YIELD
;
1180 cs
->exit_request
= 1;
1186 static target_ulong
h_prod(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1187 target_ulong opcode
, target_ulong
*args
)
1189 target_long target
= args
[0];
1192 SpaprCpuState
*spapr_cpu
;
1194 tcpu
= spapr_find_cpu(target
);
1200 spapr_cpu
= spapr_cpu_state(tcpu
);
1201 spapr_cpu
->prod
= true;
1208 static target_ulong
h_rtas(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1209 target_ulong opcode
, target_ulong
*args
)
1211 target_ulong rtas_r3
= args
[0];
1212 uint32_t token
= rtas_ld(rtas_r3
, 0);
1213 uint32_t nargs
= rtas_ld(rtas_r3
, 1);
1214 uint32_t nret
= rtas_ld(rtas_r3
, 2);
1216 return spapr_rtas_call(cpu
, spapr
, token
, nargs
, rtas_r3
+ 12,
1217 nret
, rtas_r3
+ 12 + 4*nargs
);
1220 static target_ulong
h_logical_load(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1221 target_ulong opcode
, target_ulong
*args
)
1223 CPUState
*cs
= CPU(cpu
);
1224 target_ulong size
= args
[0];
1225 target_ulong addr
= args
[1];
1229 args
[0] = ldub_phys(cs
->as
, addr
);
1232 args
[0] = lduw_phys(cs
->as
, addr
);
1235 args
[0] = ldl_phys(cs
->as
, addr
);
1238 args
[0] = ldq_phys(cs
->as
, addr
);
1244 static target_ulong
h_logical_store(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1245 target_ulong opcode
, target_ulong
*args
)
1247 CPUState
*cs
= CPU(cpu
);
1249 target_ulong size
= args
[0];
1250 target_ulong addr
= args
[1];
1251 target_ulong val
= args
[2];
1255 stb_phys(cs
->as
, addr
, val
);
1258 stw_phys(cs
->as
, addr
, val
);
1261 stl_phys(cs
->as
, addr
, val
);
1264 stq_phys(cs
->as
, addr
, val
);
1270 static target_ulong
h_logical_memop(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1271 target_ulong opcode
, target_ulong
*args
)
1273 CPUState
*cs
= CPU(cpu
);
1275 target_ulong dst
= args
[0]; /* Destination address */
1276 target_ulong src
= args
[1]; /* Source address */
1277 target_ulong esize
= args
[2]; /* Element size (0=1,1=2,2=4,3=8) */
1278 target_ulong count
= args
[3]; /* Element count */
1279 target_ulong op
= args
[4]; /* 0 = copy, 1 = invert */
1281 unsigned int mask
= (1 << esize
) - 1;
1282 int step
= 1 << esize
;
1284 if (count
> 0x80000000) {
1288 if ((dst
& mask
) || (src
& mask
) || (op
> 1)) {
1292 if (dst
>= src
&& dst
< (src
+ (count
<< esize
))) {
1293 dst
= dst
+ ((count
- 1) << esize
);
1294 src
= src
+ ((count
- 1) << esize
);
1301 tmp
= ldub_phys(cs
->as
, src
);
1304 tmp
= lduw_phys(cs
->as
, src
);
1307 tmp
= ldl_phys(cs
->as
, src
);
1310 tmp
= ldq_phys(cs
->as
, src
);
1320 stb_phys(cs
->as
, dst
, tmp
);
1323 stw_phys(cs
->as
, dst
, tmp
);
1326 stl_phys(cs
->as
, dst
, tmp
);
1329 stq_phys(cs
->as
, dst
, tmp
);
1339 static target_ulong
h_logical_icbi(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1340 target_ulong opcode
, target_ulong
*args
)
1342 /* Nothing to do on emulation, KVM will trap this in the kernel */
1346 static target_ulong
h_logical_dcbf(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1347 target_ulong opcode
, target_ulong
*args
)
1349 /* Nothing to do on emulation, KVM will trap this in the kernel */
1353 static target_ulong
h_set_mode_resource_le(PowerPCCPU
*cpu
,
1354 SpaprMachineState
*spapr
,
1355 target_ulong mflags
,
1356 target_ulong value1
,
1357 target_ulong value2
)
1367 case H_SET_MODE_ENDIAN_BIG
:
1368 spapr_set_all_lpcrs(0, LPCR_ILE
);
1369 spapr_pci_switch_vga(spapr
, true);
1372 case H_SET_MODE_ENDIAN_LITTLE
:
1373 spapr_set_all_lpcrs(LPCR_ILE
, LPCR_ILE
);
1374 spapr_pci_switch_vga(spapr
, false);
1378 return H_UNSUPPORTED_FLAG
;
1381 static target_ulong
h_set_mode_resource_addr_trans_mode(PowerPCCPU
*cpu
,
1382 target_ulong mflags
,
1383 target_ulong value1
,
1384 target_ulong value2
)
1386 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
1388 if (!(pcc
->insns_flags2
& PPC2_ISA207S
)) {
1398 if (mflags
== AIL_RESERVED
) {
1399 return H_UNSUPPORTED_FLAG
;
1402 spapr_set_all_lpcrs(mflags
<< LPCR_AIL_SHIFT
, LPCR_AIL
);
1407 static target_ulong
h_set_mode(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1408 target_ulong opcode
, target_ulong
*args
)
1410 target_ulong resource
= args
[1];
1411 target_ulong ret
= H_P2
;
1414 case H_SET_MODE_RESOURCE_LE
:
1415 ret
= h_set_mode_resource_le(cpu
, spapr
, args
[0], args
[2], args
[3]);
1417 case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE
:
1418 ret
= h_set_mode_resource_addr_trans_mode(cpu
, args
[0],
1426 static target_ulong
h_clean_slb(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1427 target_ulong opcode
, target_ulong
*args
)
1429 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
1430 opcode
, " (H_CLEAN_SLB)");
1434 static target_ulong
h_invalidate_pid(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1435 target_ulong opcode
, target_ulong
*args
)
1437 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
1438 opcode
, " (H_INVALIDATE_PID)");
1442 static void spapr_check_setup_free_hpt(SpaprMachineState
*spapr
,
1443 uint64_t patbe_old
, uint64_t patbe_new
)
1446 * We have 4 Options:
1447 * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
1448 * HASH->RADIX : Free HPT
1449 * RADIX->HASH : Allocate HPT
1450 * NOTHING->HASH : Allocate HPT
1451 * Note: NOTHING implies the case where we said the guest could choose
1452 * later and so assumed radix and now it's called H_REG_PROC_TBL
1455 if ((patbe_old
& PATE1_GR
) == (patbe_new
& PATE1_GR
)) {
1456 /* We assume RADIX, so this catches all the "Do Nothing" cases */
1457 } else if (!(patbe_old
& PATE1_GR
)) {
1458 /* HASH->RADIX : Free HPT */
1459 spapr_free_hpt(spapr
);
1460 } else if (!(patbe_new
& PATE1_GR
)) {
1461 /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
1462 spapr_setup_hpt(spapr
);
1467 #define FLAGS_MASK 0x01FULL
1468 #define FLAG_MODIFY 0x10
1469 #define FLAG_REGISTER 0x08
1470 #define FLAG_RADIX 0x04
1471 #define FLAG_HASH_PROC_TBL 0x02
1472 #define FLAG_GTSE 0x01
1474 static target_ulong
h_register_process_table(PowerPCCPU
*cpu
,
1475 SpaprMachineState
*spapr
,
1476 target_ulong opcode
,
1479 target_ulong flags
= args
[0];
1480 target_ulong proc_tbl
= args
[1];
1481 target_ulong page_size
= args
[2];
1482 target_ulong table_size
= args
[3];
1483 target_ulong update_lpcr
= 0;
1486 if (flags
& ~FLAGS_MASK
) { /* Check no reserved bits are set */
1489 if (flags
& FLAG_MODIFY
) {
1490 if (flags
& FLAG_REGISTER
) {
1491 if (flags
& FLAG_RADIX
) { /* Register new RADIX process table */
1492 if (proc_tbl
& 0xfff || proc_tbl
>> 60) {
1494 } else if (page_size
) {
1496 } else if (table_size
> 24) {
1499 cproc
= PATE1_GR
| proc_tbl
| table_size
;
1500 } else { /* Register new HPT process table */
1501 if (flags
& FLAG_HASH_PROC_TBL
) { /* Hash with Segment Tables */
1502 /* TODO - Not Supported */
1503 /* Technically caused by flag bits => H_PARAMETER */
1505 } else { /* Hash with SLB */
1506 if (proc_tbl
>> 38) {
1508 } else if (page_size
& ~0x7) {
1510 } else if (table_size
> 24) {
1514 cproc
= (proc_tbl
<< 25) | page_size
<< 5 | table_size
;
1517 } else { /* Deregister current process table */
1519 * Set to benign value: (current GR) | 0. This allows
1520 * deregistration in KVM to succeed even if the radix bit
1521 * in flags doesn't match the radix bit in the old PATE.
1523 cproc
= spapr
->patb_entry
& PATE1_GR
;
1525 } else { /* Maintain current registration */
1526 if (!(flags
& FLAG_RADIX
) != !(spapr
->patb_entry
& PATE1_GR
)) {
1527 /* Technically caused by flag bits => H_PARAMETER */
1528 return H_PARAMETER
; /* Existing Process Table Mismatch */
1530 cproc
= spapr
->patb_entry
;
1533 /* Check if we need to setup OR free the hpt */
1534 spapr_check_setup_free_hpt(spapr
, spapr
->patb_entry
, cproc
);
1536 spapr
->patb_entry
= cproc
; /* Save new process table */
1538 /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
1539 if (flags
& FLAG_RADIX
) /* Radix must use process tables, also set HR */
1540 update_lpcr
|= (LPCR_UPRT
| LPCR_HR
);
1541 else if (flags
& FLAG_HASH_PROC_TBL
) /* Hash with process tables */
1542 update_lpcr
|= LPCR_UPRT
;
1543 if (flags
& FLAG_GTSE
) /* Guest translation shootdown enable */
1544 update_lpcr
|= LPCR_GTSE
;
1546 spapr_set_all_lpcrs(update_lpcr
, LPCR_UPRT
| LPCR_HR
| LPCR_GTSE
);
1548 if (kvm_enabled()) {
1549 return kvmppc_configure_v3_mmu(cpu
, flags
& FLAG_RADIX
,
1550 flags
& FLAG_GTSE
, cproc
);
1555 #define H_SIGNAL_SYS_RESET_ALL -1
1556 #define H_SIGNAL_SYS_RESET_ALLBUTSELF -2
1558 static target_ulong
h_signal_sys_reset(PowerPCCPU
*cpu
,
1559 SpaprMachineState
*spapr
,
1560 target_ulong opcode
, target_ulong
*args
)
1562 target_long target
= args
[0];
1567 if (target
< H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1572 PowerPCCPU
*c
= POWERPC_CPU(cs
);
1574 if (target
== H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1579 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1585 cs
= CPU(spapr_find_cpu(target
));
1587 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1594 /* Returns either a logical PVR or zero if none was found */
1595 static uint32_t cas_check_pvr(PowerPCCPU
*cpu
, uint32_t max_compat
,
1596 target_ulong
*addr
, bool *raw_mode_supported
)
1598 bool explicit_match
= false; /* Matched the CPU's real PVR */
1599 uint32_t best_compat
= 0;
1603 * We scan the supplied table of PVRs looking for two things
1604 * 1. Is our real CPU PVR in the list?
1605 * 2. What's the "best" listed logical PVR
1607 for (i
= 0; i
< 512; ++i
) {
1608 uint32_t pvr
, pvr_mask
;
1610 pvr_mask
= ldl_be_phys(&address_space_memory
, *addr
);
1611 pvr
= ldl_be_phys(&address_space_memory
, *addr
+ 4);
1614 if (~pvr_mask
& pvr
) {
1615 break; /* Terminator record */
1618 if ((cpu
->env
.spr
[SPR_PVR
] & pvr_mask
) == (pvr
& pvr_mask
)) {
1619 explicit_match
= true;
1621 if (ppc_check_compat(cpu
, pvr
, best_compat
, max_compat
)) {
1627 *raw_mode_supported
= explicit_match
;
1629 /* Parsing finished */
1630 trace_spapr_cas_pvr(cpu
->compat_pvr
, explicit_match
, best_compat
);
1636 target_ulong
do_client_architecture_support(PowerPCCPU
*cpu
,
1637 SpaprMachineState
*spapr
,
1639 target_ulong fdt_bufsize
)
1641 target_ulong ov_table
; /* Working address in data buffer */
1643 SpaprOptionVector
*ov1_guest
, *ov5_guest
;
1645 bool raw_mode_supported
= false;
1649 uint32_t max_compat
= spapr
->max_compat_pvr
;
1651 /* CAS is supposed to be called early when only the boot vCPU is active. */
1653 if (cs
== CPU(cpu
)) {
1657 warn_report("guest has multiple active vCPUs at CAS, which is not allowed");
1658 return H_MULTI_THREADS_ACTIVE
;
1662 cas_pvr
= cas_check_pvr(cpu
, max_compat
, &vec
, &raw_mode_supported
);
1663 if (!cas_pvr
&& (!raw_mode_supported
|| max_compat
)) {
1665 * We couldn't find a suitable compatibility mode, and either
1666 * the guest doesn't support "raw" mode for this CPU, or "raw"
1667 * mode is disabled because a maximum compat mode is set.
1669 error_report("Couldn't negotiate a suitable PVR during CAS");
1674 if (cpu
->compat_pvr
!= cas_pvr
) {
1675 Error
*local_err
= NULL
;
1677 if (ppc_set_compat_all(cas_pvr
, &local_err
) < 0) {
1678 /* We fail to set compat mode (likely because running with KVM PR),
1679 * but maybe we can fallback to raw mode if the guest supports it.
1681 if (!raw_mode_supported
) {
1682 error_report_err(local_err
);
1685 error_free(local_err
);
1689 /* For the future use: here @ov_table points to the first option vector */
1692 ov1_guest
= spapr_ovec_parse_vector(ov_table
, 1);
1694 warn_report("guest didn't provide option vector 1");
1697 ov5_guest
= spapr_ovec_parse_vector(ov_table
, 5);
1699 spapr_ovec_cleanup(ov1_guest
);
1700 warn_report("guest didn't provide option vector 5");
1703 if (spapr_ovec_test(ov5_guest
, OV5_MMU_BOTH
)) {
1704 error_report("guest requested hash and radix MMU, which is invalid.");
1707 if (spapr_ovec_test(ov5_guest
, OV5_XIVE_BOTH
)) {
1708 error_report("guest requested an invalid interrupt mode");
1712 guest_radix
= spapr_ovec_test(ov5_guest
, OV5_MMU_RADIX_300
);
1714 guest_xive
= spapr_ovec_test(ov5_guest
, OV5_XIVE_EXPLOIT
);
1717 * HPT resizing is a bit of a special case, because when enabled
1718 * we assume an HPT guest will support it until it says it
1719 * doesn't, instead of assuming it won't support it until it says
1720 * it does. Strictly speaking that approach could break for
1721 * guests which don't make a CAS call, but those are so old we
1722 * don't care about them. Without that assumption we'd have to
1723 * make at least a temporary allocation of an HPT sized for max
1724 * memory, which could be impossibly difficult under KVM HV if
1727 if (!guest_radix
&& !spapr_ovec_test(ov5_guest
, OV5_HPT_RESIZE
)) {
1728 int maxshift
= spapr_hpt_shift_for_ramsize(MACHINE(spapr
)->maxram_size
);
1730 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_REQUIRED
) {
1732 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1736 if (spapr
->htab_shift
< maxshift
) {
1737 /* Guest doesn't know about HPT resizing, so we
1738 * pre-emptively resize for the maximum permitted RAM. At
1739 * the point this is called, nothing should have been
1740 * entered into the existing HPT */
1741 spapr_reallocate_hpt(spapr
, maxshift
, &error_fatal
);
1742 push_sregs_to_kvm_pr(spapr
);
1746 /* NOTE: there are actually a number of ov5 bits where input from the
1747 * guest is always zero, and the platform/QEMU enables them independently
1748 * of guest input. To model these properly we'd want some sort of mask,
1749 * but since they only currently apply to memory migration as defined
1750 * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1751 * to worry about this for now.
1754 /* full range of negotiated ov5 capabilities */
1755 spapr_ovec_intersect(spapr
->ov5_cas
, spapr
->ov5
, ov5_guest
);
1756 spapr_ovec_cleanup(ov5_guest
);
1759 if (kvm_enabled() && !kvmppc_has_cap_mmu_radix()) {
1760 error_report("Guest requested unavailable MMU mode (radix).");
1764 if (kvm_enabled() && kvmppc_has_cap_mmu_radix()
1765 && !kvmppc_has_cap_mmu_hash_v3()) {
1766 error_report("Guest requested unavailable MMU mode (hash).");
1770 spapr
->cas_pre_isa3_guest
= !spapr_ovec_test(ov1_guest
, OV1_PPC_3_00
);
1771 spapr_ovec_cleanup(ov1_guest
);
1774 * Ensure the guest asks for an interrupt mode we support;
1775 * otherwise terminate the boot.
1778 if (!spapr
->irq
->xive
) {
1780 "Guest requested unavailable interrupt mode (XIVE), try the ic-mode=xive or ic-mode=dual machine property");
1784 if (!spapr
->irq
->xics
) {
1786 "Guest requested unavailable interrupt mode (XICS), either don't set the ic-mode machine property or try ic-mode=xics or ic-mode=dual");
1791 spapr_irq_update_active_intc(spapr
);
1794 * Process all pending hot-plug/unplug requests now. An updated full
1795 * rendered FDT will be returned to the guest.
1797 spapr_drc_reset_all(spapr
);
1798 spapr_clear_pending_hotplug_events(spapr
);
1801 * If spapr_machine_reset() did not set up a HPT but one is necessary
1802 * (because the guest isn't going to use radix) then set it up here.
1804 if ((spapr
->patb_entry
& PATE1_GR
) && !guest_radix
) {
1805 /* legacy hash or new hash: */
1806 spapr_setup_hpt(spapr
);
1809 fdt
= spapr_build_fdt(spapr
, false, fdt_bufsize
);
1811 g_free(spapr
->fdt_blob
);
1812 spapr
->fdt_size
= fdt_totalsize(fdt
);
1813 spapr
->fdt_initial_size
= spapr
->fdt_size
;
1814 spapr
->fdt_blob
= fdt
;
1819 static target_ulong
h_client_architecture_support(PowerPCCPU
*cpu
,
1820 SpaprMachineState
*spapr
,
1821 target_ulong opcode
,
1824 target_ulong vec
= ppc64_phys_to_real(args
[0]);
1825 target_ulong fdt_buf
= args
[1];
1826 target_ulong fdt_bufsize
= args
[2];
1828 SpaprDeviceTreeUpdateHeader hdr
= { .version_id
= 1 };
1830 if (fdt_bufsize
< sizeof(hdr
)) {
1831 error_report("SLOF provided insufficient CAS buffer "
1832 TARGET_FMT_lu
" (min: %zu)", fdt_bufsize
, sizeof(hdr
));
1836 fdt_bufsize
-= sizeof(hdr
);
1838 ret
= do_client_architecture_support(cpu
, spapr
, vec
, fdt_bufsize
);
1839 if (ret
== H_SUCCESS
) {
1840 _FDT((fdt_pack(spapr
->fdt_blob
)));
1841 spapr
->fdt_size
= fdt_totalsize(spapr
->fdt_blob
);
1842 spapr
->fdt_initial_size
= spapr
->fdt_size
;
1844 cpu_physical_memory_write(fdt_buf
, &hdr
, sizeof(hdr
));
1845 cpu_physical_memory_write(fdt_buf
+ sizeof(hdr
), spapr
->fdt_blob
,
1847 trace_spapr_cas_continue(spapr
->fdt_size
+ sizeof(hdr
));
1853 static target_ulong
h_get_cpu_characteristics(PowerPCCPU
*cpu
,
1854 SpaprMachineState
*spapr
,
1855 target_ulong opcode
,
1858 uint64_t characteristics
= H_CPU_CHAR_HON_BRANCH_HINTS
&
1859 ~H_CPU_CHAR_THR_RECONF_TRIG
;
1860 uint64_t behaviour
= H_CPU_BEHAV_FAVOUR_SECURITY
;
1861 uint8_t safe_cache
= spapr_get_cap(spapr
, SPAPR_CAP_CFPC
);
1862 uint8_t safe_bounds_check
= spapr_get_cap(spapr
, SPAPR_CAP_SBBC
);
1863 uint8_t safe_indirect_branch
= spapr_get_cap(spapr
, SPAPR_CAP_IBS
);
1864 uint8_t count_cache_flush_assist
= spapr_get_cap(spapr
,
1865 SPAPR_CAP_CCF_ASSIST
);
1867 switch (safe_cache
) {
1868 case SPAPR_CAP_WORKAROUND
:
1869 characteristics
|= H_CPU_CHAR_L1D_FLUSH_ORI30
;
1870 characteristics
|= H_CPU_CHAR_L1D_FLUSH_TRIG2
;
1871 characteristics
|= H_CPU_CHAR_L1D_THREAD_PRIV
;
1872 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1874 case SPAPR_CAP_FIXED
:
1876 default: /* broken */
1877 assert(safe_cache
== SPAPR_CAP_BROKEN
);
1878 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1882 switch (safe_bounds_check
) {
1883 case SPAPR_CAP_WORKAROUND
:
1884 characteristics
|= H_CPU_CHAR_SPEC_BAR_ORI31
;
1885 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1887 case SPAPR_CAP_FIXED
:
1889 default: /* broken */
1890 assert(safe_bounds_check
== SPAPR_CAP_BROKEN
);
1891 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1895 switch (safe_indirect_branch
) {
1896 case SPAPR_CAP_FIXED_NA
:
1898 case SPAPR_CAP_FIXED_CCD
:
1899 characteristics
|= H_CPU_CHAR_CACHE_COUNT_DIS
;
1901 case SPAPR_CAP_FIXED_IBS
:
1902 characteristics
|= H_CPU_CHAR_BCCTRL_SERIALISED
;
1904 case SPAPR_CAP_WORKAROUND
:
1905 behaviour
|= H_CPU_BEHAV_FLUSH_COUNT_CACHE
;
1906 if (count_cache_flush_assist
) {
1907 characteristics
|= H_CPU_CHAR_BCCTR_FLUSH_ASSIST
;
1910 default: /* broken */
1911 assert(safe_indirect_branch
== SPAPR_CAP_BROKEN
);
1915 args
[0] = characteristics
;
1916 args
[1] = behaviour
;
1920 static target_ulong
h_update_dt(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1921 target_ulong opcode
, target_ulong
*args
)
1923 target_ulong dt
= ppc64_phys_to_real(args
[0]);
1924 struct fdt_header hdr
= { 0 };
1926 SpaprMachineClass
*smc
= SPAPR_MACHINE_GET_CLASS(spapr
);
1929 cpu_physical_memory_read(dt
, &hdr
, sizeof(hdr
));
1930 cb
= fdt32_to_cpu(hdr
.totalsize
);
1932 if (!smc
->update_dt_enabled
) {
1936 /* Check that the fdt did not grow out of proportion */
1937 if (cb
> spapr
->fdt_initial_size
* 2) {
1938 trace_spapr_update_dt_failed_size(spapr
->fdt_initial_size
, cb
,
1939 fdt32_to_cpu(hdr
.magic
));
1943 fdt
= g_malloc0(cb
);
1944 cpu_physical_memory_read(dt
, fdt
, cb
);
1946 /* Check the fdt consistency */
1947 if (fdt_check_full(fdt
, cb
)) {
1948 trace_spapr_update_dt_failed_check(spapr
->fdt_initial_size
, cb
,
1949 fdt32_to_cpu(hdr
.magic
));
1953 g_free(spapr
->fdt_blob
);
1954 spapr
->fdt_size
= cb
;
1955 spapr
->fdt_blob
= fdt
;
1956 trace_spapr_update_dt(cb
);
1961 static spapr_hcall_fn papr_hypercall_table
[(MAX_HCALL_OPCODE
/ 4) + 1];
1962 static spapr_hcall_fn kvmppc_hypercall_table
[KVMPPC_HCALL_MAX
- KVMPPC_HCALL_BASE
+ 1];
1963 static spapr_hcall_fn svm_hypercall_table
[(SVM_HCALL_MAX
- SVM_HCALL_BASE
) / 4 + 1];
1965 void spapr_register_hypercall(target_ulong opcode
, spapr_hcall_fn fn
)
1967 spapr_hcall_fn
*slot
;
1969 if (opcode
<= MAX_HCALL_OPCODE
) {
1970 assert((opcode
& 0x3) == 0);
1972 slot
= &papr_hypercall_table
[opcode
/ 4];
1973 } else if (opcode
>= SVM_HCALL_BASE
&& opcode
<= SVM_HCALL_MAX
) {
1974 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1975 assert((opcode
& 0x3) == 0);
1977 slot
= &svm_hypercall_table
[(opcode
- SVM_HCALL_BASE
) / 4];
1979 assert((opcode
>= KVMPPC_HCALL_BASE
) && (opcode
<= KVMPPC_HCALL_MAX
));
1981 slot
= &kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
1988 target_ulong
spapr_hypercall(PowerPCCPU
*cpu
, target_ulong opcode
,
1991 SpaprMachineState
*spapr
= SPAPR_MACHINE(qdev_get_machine());
1993 if ((opcode
<= MAX_HCALL_OPCODE
)
1994 && ((opcode
& 0x3) == 0)) {
1995 spapr_hcall_fn fn
= papr_hypercall_table
[opcode
/ 4];
1998 return fn(cpu
, spapr
, opcode
, args
);
2000 } else if ((opcode
>= SVM_HCALL_BASE
) &&
2001 (opcode
<= SVM_HCALL_MAX
)) {
2002 spapr_hcall_fn fn
= svm_hypercall_table
[(opcode
- SVM_HCALL_BASE
) / 4];
2005 return fn(cpu
, spapr
, opcode
, args
);
2007 } else if ((opcode
>= KVMPPC_HCALL_BASE
) &&
2008 (opcode
<= KVMPPC_HCALL_MAX
)) {
2009 spapr_hcall_fn fn
= kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
2012 return fn(cpu
, spapr
, opcode
, args
);
2016 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx
"\n",
2021 static void hypercall_register_types(void)
2024 spapr_register_hypercall(H_ENTER
, h_enter
);
2025 spapr_register_hypercall(H_REMOVE
, h_remove
);
2026 spapr_register_hypercall(H_PROTECT
, h_protect
);
2027 spapr_register_hypercall(H_READ
, h_read
);
2030 spapr_register_hypercall(H_BULK_REMOVE
, h_bulk_remove
);
2032 /* hcall-hpt-resize */
2033 spapr_register_hypercall(H_RESIZE_HPT_PREPARE
, h_resize_hpt_prepare
);
2034 spapr_register_hypercall(H_RESIZE_HPT_COMMIT
, h_resize_hpt_commit
);
2037 spapr_register_hypercall(H_REGISTER_VPA
, h_register_vpa
);
2038 spapr_register_hypercall(H_CEDE
, h_cede
);
2039 spapr_register_hypercall(H_CONFER
, h_confer
);
2040 spapr_register_hypercall(H_PROD
, h_prod
);
2043 spapr_register_hypercall(H_JOIN
, h_join
);
2045 spapr_register_hypercall(H_SIGNAL_SYS_RESET
, h_signal_sys_reset
);
2047 /* processor register resource access h-calls */
2048 spapr_register_hypercall(H_SET_SPRG0
, h_set_sprg0
);
2049 spapr_register_hypercall(H_SET_DABR
, h_set_dabr
);
2050 spapr_register_hypercall(H_SET_XDABR
, h_set_xdabr
);
2051 spapr_register_hypercall(H_PAGE_INIT
, h_page_init
);
2052 spapr_register_hypercall(H_SET_MODE
, h_set_mode
);
2054 /* In Memory Table MMU h-calls */
2055 spapr_register_hypercall(H_CLEAN_SLB
, h_clean_slb
);
2056 spapr_register_hypercall(H_INVALIDATE_PID
, h_invalidate_pid
);
2057 spapr_register_hypercall(H_REGISTER_PROC_TBL
, h_register_process_table
);
2059 /* hcall-get-cpu-characteristics */
2060 spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS
,
2061 h_get_cpu_characteristics
);
2063 /* "debugger" hcalls (also used by SLOF). Note: We do -not- differenciate
2064 * here between the "CI" and the "CACHE" variants, they will use whatever
2065 * mapping attributes qemu is using. When using KVM, the kernel will
2066 * enforce the attributes more strongly
2068 spapr_register_hypercall(H_LOGICAL_CI_LOAD
, h_logical_load
);
2069 spapr_register_hypercall(H_LOGICAL_CI_STORE
, h_logical_store
);
2070 spapr_register_hypercall(H_LOGICAL_CACHE_LOAD
, h_logical_load
);
2071 spapr_register_hypercall(H_LOGICAL_CACHE_STORE
, h_logical_store
);
2072 spapr_register_hypercall(H_LOGICAL_ICBI
, h_logical_icbi
);
2073 spapr_register_hypercall(H_LOGICAL_DCBF
, h_logical_dcbf
);
2074 spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP
, h_logical_memop
);
2076 /* qemu/KVM-PPC specific hcalls */
2077 spapr_register_hypercall(KVMPPC_H_RTAS
, h_rtas
);
2079 /* ibm,client-architecture-support support */
2080 spapr_register_hypercall(KVMPPC_H_CAS
, h_client_architecture_support
);
2082 spapr_register_hypercall(KVMPPC_H_UPDATE_DT
, h_update_dt
);
2085 type_init(hypercall_register_types
)