1 #include "qemu/osdep.h"
2 #include "qapi/error.h"
3 #include "sysemu/hw_accel.h"
4 #include "sysemu/sysemu.h"
6 #include "qemu/error-report.h"
8 #include "exec/exec-all.h"
9 #include "helper_regs.h"
10 #include "hw/ppc/spapr.h"
11 #include "hw/ppc/spapr_cpu_core.h"
12 #include "mmu-hash64.h"
13 #include "cpu-models.h"
16 #include "hw/ppc/spapr_ovec.h"
17 #include "mmu-book3s-v3.h"
18 #include "hw/mem/memory-device.h"
20 static bool has_spr(PowerPCCPU
*cpu
, int spr
)
22 /* We can test whether the SPR is defined by checking for a valid name */
23 return cpu
->env
.spr_cb
[spr
].name
!= NULL
;
26 static inline bool valid_ptex(PowerPCCPU
*cpu
, target_ulong ptex
)
29 * hash value/pteg group index is normalized by HPT mask
31 if (((ptex
& ~7ULL) / HPTES_PER_GROUP
) & ~ppc_hash64_hpt_mask(cpu
)) {
37 static bool is_ram_address(SpaprMachineState
*spapr
, hwaddr addr
)
39 MachineState
*machine
= MACHINE(spapr
);
40 DeviceMemoryState
*dms
= machine
->device_memory
;
42 if (addr
< machine
->ram_size
) {
45 if ((addr
>= dms
->base
)
46 && ((addr
- dms
->base
) < memory_region_size(&dms
->mr
))) {
53 static target_ulong
h_enter(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
54 target_ulong opcode
, target_ulong
*args
)
56 target_ulong flags
= args
[0];
57 target_ulong ptex
= args
[1];
58 target_ulong pteh
= args
[2];
59 target_ulong ptel
= args
[3];
63 const ppc_hash_pte64_t
*hptes
;
65 apshift
= ppc_hash64_hpte_page_shift_noslb(cpu
, pteh
, ptel
);
67 /* Bad page size encoding */
71 raddr
= (ptel
& HPTE64_R_RPN
) & ~((1ULL << apshift
) - 1);
73 if (is_ram_address(spapr
, raddr
)) {
74 /* Regular RAM - should have WIMG=0010 */
75 if ((ptel
& HPTE64_R_WIMG
) != HPTE64_R_M
) {
79 target_ulong wimg_flags
;
80 /* Looks like an IO address */
81 /* FIXME: What WIMG combinations could be sensible for IO?
82 * For now we allow WIMG=010x, but are there others? */
83 /* FIXME: Should we check against registered IO addresses? */
84 wimg_flags
= (ptel
& (HPTE64_R_W
| HPTE64_R_I
| HPTE64_R_M
));
86 if (wimg_flags
!= HPTE64_R_I
&&
87 wimg_flags
!= (HPTE64_R_I
| HPTE64_R_M
)) {
94 if (!valid_ptex(cpu
, ptex
)) {
101 if (likely((flags
& H_EXACT
) == 0)) {
102 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
103 for (slot
= 0; slot
< 8; slot
++) {
104 if (!(ppc_hash64_hpte0(cpu
, hptes
, slot
) & HPTE64_V_VALID
)) {
108 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
113 hptes
= ppc_hash64_map_hptes(cpu
, ptex
+ slot
, 1);
114 if (ppc_hash64_hpte0(cpu
, hptes
, 0) & HPTE64_V_VALID
) {
115 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
+ slot
, 1);
118 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
121 ppc_hash64_store_hpte(cpu
, ptex
+ slot
, pteh
| HPTE64_V_HPTE_DIRTY
, ptel
);
123 args
[0] = ptex
+ slot
;
129 REMOVE_NOT_FOUND
= 1,
134 static RemoveResult
remove_hpte(PowerPCCPU
*cpu
, target_ulong ptex
,
137 target_ulong
*vp
, target_ulong
*rp
)
139 const ppc_hash_pte64_t
*hptes
;
142 if (!valid_ptex(cpu
, ptex
)) {
146 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, 1);
147 v
= ppc_hash64_hpte0(cpu
, hptes
, 0);
148 r
= ppc_hash64_hpte1(cpu
, hptes
, 0);
149 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
151 if ((v
& HPTE64_V_VALID
) == 0 ||
152 ((flags
& H_AVPN
) && (v
& ~0x7fULL
) != avpn
) ||
153 ((flags
& H_ANDCOND
) && (v
& avpn
) != 0)) {
154 return REMOVE_NOT_FOUND
;
158 ppc_hash64_store_hpte(cpu
, ptex
, HPTE64_V_HPTE_DIRTY
, 0);
159 ppc_hash64_tlb_flush_hpte(cpu
, ptex
, v
, r
);
160 return REMOVE_SUCCESS
;
163 static target_ulong
h_remove(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
164 target_ulong opcode
, target_ulong
*args
)
166 CPUPPCState
*env
= &cpu
->env
;
167 target_ulong flags
= args
[0];
168 target_ulong ptex
= args
[1];
169 target_ulong avpn
= args
[2];
172 ret
= remove_hpte(cpu
, ptex
, avpn
, flags
,
177 check_tlb_flush(env
, true);
180 case REMOVE_NOT_FOUND
:
190 g_assert_not_reached();
193 #define H_BULK_REMOVE_TYPE 0xc000000000000000ULL
194 #define H_BULK_REMOVE_REQUEST 0x4000000000000000ULL
195 #define H_BULK_REMOVE_RESPONSE 0x8000000000000000ULL
196 #define H_BULK_REMOVE_END 0xc000000000000000ULL
197 #define H_BULK_REMOVE_CODE 0x3000000000000000ULL
198 #define H_BULK_REMOVE_SUCCESS 0x0000000000000000ULL
199 #define H_BULK_REMOVE_NOT_FOUND 0x1000000000000000ULL
200 #define H_BULK_REMOVE_PARM 0x2000000000000000ULL
201 #define H_BULK_REMOVE_HW 0x3000000000000000ULL
202 #define H_BULK_REMOVE_RC 0x0c00000000000000ULL
203 #define H_BULK_REMOVE_FLAGS 0x0300000000000000ULL
204 #define H_BULK_REMOVE_ABSOLUTE 0x0000000000000000ULL
205 #define H_BULK_REMOVE_ANDCOND 0x0100000000000000ULL
206 #define H_BULK_REMOVE_AVPN 0x0200000000000000ULL
207 #define H_BULK_REMOVE_PTEX 0x00ffffffffffffffULL
209 #define H_BULK_REMOVE_MAX_BATCH 4
211 static target_ulong
h_bulk_remove(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
212 target_ulong opcode
, target_ulong
*args
)
214 CPUPPCState
*env
= &cpu
->env
;
216 target_ulong rc
= H_SUCCESS
;
218 for (i
= 0; i
< H_BULK_REMOVE_MAX_BATCH
; i
++) {
219 target_ulong
*tsh
= &args
[i
*2];
220 target_ulong tsl
= args
[i
*2 + 1];
221 target_ulong v
, r
, ret
;
223 if ((*tsh
& H_BULK_REMOVE_TYPE
) == H_BULK_REMOVE_END
) {
225 } else if ((*tsh
& H_BULK_REMOVE_TYPE
) != H_BULK_REMOVE_REQUEST
) {
229 *tsh
&= H_BULK_REMOVE_PTEX
| H_BULK_REMOVE_FLAGS
;
230 *tsh
|= H_BULK_REMOVE_RESPONSE
;
232 if ((*tsh
& H_BULK_REMOVE_ANDCOND
) && (*tsh
& H_BULK_REMOVE_AVPN
)) {
233 *tsh
|= H_BULK_REMOVE_PARM
;
237 ret
= remove_hpte(cpu
, *tsh
& H_BULK_REMOVE_PTEX
, tsl
,
238 (*tsh
& H_BULK_REMOVE_FLAGS
) >> 26,
245 *tsh
|= (r
& (HPTE64_R_C
| HPTE64_R_R
)) << 43;
258 check_tlb_flush(env
, true);
263 static target_ulong
h_protect(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
264 target_ulong opcode
, target_ulong
*args
)
266 CPUPPCState
*env
= &cpu
->env
;
267 target_ulong flags
= args
[0];
268 target_ulong ptex
= args
[1];
269 target_ulong avpn
= args
[2];
270 const ppc_hash_pte64_t
*hptes
;
273 if (!valid_ptex(cpu
, ptex
)) {
277 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, 1);
278 v
= ppc_hash64_hpte0(cpu
, hptes
, 0);
279 r
= ppc_hash64_hpte1(cpu
, hptes
, 0);
280 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
282 if ((v
& HPTE64_V_VALID
) == 0 ||
283 ((flags
& H_AVPN
) && (v
& ~0x7fULL
) != avpn
)) {
287 r
&= ~(HPTE64_R_PP0
| HPTE64_R_PP
| HPTE64_R_N
|
288 HPTE64_R_KEY_HI
| HPTE64_R_KEY_LO
);
289 r
|= (flags
<< 55) & HPTE64_R_PP0
;
290 r
|= (flags
<< 48) & HPTE64_R_KEY_HI
;
291 r
|= flags
& (HPTE64_R_PP
| HPTE64_R_N
| HPTE64_R_KEY_LO
);
292 ppc_hash64_store_hpte(cpu
, ptex
,
293 (v
& ~HPTE64_V_VALID
) | HPTE64_V_HPTE_DIRTY
, 0);
294 ppc_hash64_tlb_flush_hpte(cpu
, ptex
, v
, r
);
296 check_tlb_flush(env
, true);
297 /* Don't need a memory barrier, due to qemu's global lock */
298 ppc_hash64_store_hpte(cpu
, ptex
, v
| HPTE64_V_HPTE_DIRTY
, r
);
302 static target_ulong
h_read(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
303 target_ulong opcode
, target_ulong
*args
)
305 target_ulong flags
= args
[0];
306 target_ulong ptex
= args
[1];
308 int i
, ridx
, n_entries
= 1;
310 if (!valid_ptex(cpu
, ptex
)) {
314 if (flags
& H_READ_4
) {
315 /* Clear the two low order bits */
320 hpte
= spapr
->htab
+ (ptex
* HASH_PTE_SIZE_64
);
322 for (i
= 0, ridx
= 0; i
< n_entries
; i
++) {
323 args
[ridx
++] = ldq_p(hpte
);
324 args
[ridx
++] = ldq_p(hpte
+ (HASH_PTE_SIZE_64
/2));
325 hpte
+= HASH_PTE_SIZE_64
;
331 struct SpaprPendingHpt
{
332 /* These fields are read-only after initialization */
336 /* These fields are protected by the BQL */
339 /* These fields are private to the preparation thread if
340 * !complete, otherwise protected by the BQL */
345 static void free_pending_hpt(SpaprPendingHpt
*pending
)
348 qemu_vfree(pending
->hpt
);
354 static void *hpt_prepare_thread(void *opaque
)
356 SpaprPendingHpt
*pending
= opaque
;
357 size_t size
= 1ULL << pending
->shift
;
359 pending
->hpt
= qemu_memalign(size
, size
);
361 memset(pending
->hpt
, 0, size
);
362 pending
->ret
= H_SUCCESS
;
364 pending
->ret
= H_NO_MEM
;
367 qemu_mutex_lock_iothread();
369 if (SPAPR_MACHINE(qdev_get_machine())->pending_hpt
== pending
) {
371 pending
->complete
= true;
373 /* We've been cancelled, clean ourselves up */
374 free_pending_hpt(pending
);
377 qemu_mutex_unlock_iothread();
381 /* Must be called with BQL held */
382 static void cancel_hpt_prepare(SpaprMachineState
*spapr
)
384 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
386 /* Let the thread know it's cancelled */
387 spapr
->pending_hpt
= NULL
;
394 if (!pending
->complete
) {
395 /* thread will clean itself up */
399 free_pending_hpt(pending
);
402 /* Convert a return code from the KVM ioctl()s implementing resize HPT
403 * into a PAPR hypercall return code */
404 static target_ulong
resize_hpt_convert_rc(int ret
)
407 return H_LONG_BUSY_ORDER_100_SEC
;
408 } else if (ret
>= 10000) {
409 return H_LONG_BUSY_ORDER_10_SEC
;
410 } else if (ret
>= 1000) {
411 return H_LONG_BUSY_ORDER_1_SEC
;
412 } else if (ret
>= 100) {
413 return H_LONG_BUSY_ORDER_100_MSEC
;
414 } else if (ret
>= 10) {
415 return H_LONG_BUSY_ORDER_10_MSEC
;
416 } else if (ret
> 0) {
417 return H_LONG_BUSY_ORDER_1_MSEC
;
440 static target_ulong
h_resize_hpt_prepare(PowerPCCPU
*cpu
,
441 SpaprMachineState
*spapr
,
445 target_ulong flags
= args
[0];
447 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
448 uint64_t current_ram_size
;
451 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
455 if (!spapr
->htab_shift
) {
456 /* Radix guest, no HPT */
457 return H_NOT_AVAILABLE
;
460 trace_spapr_h_resize_hpt_prepare(flags
, shift
);
466 if (shift
&& ((shift
< 18) || (shift
> 46))) {
470 current_ram_size
= MACHINE(spapr
)->ram_size
+ get_plugged_memory_size();
472 /* We only allow the guest to allocate an HPT one order above what
473 * we'd normally give them (to stop a small guest claiming a huge
474 * chunk of resources in the HPT */
475 if (shift
> (spapr_hpt_shift_for_ramsize(current_ram_size
) + 1)) {
479 rc
= kvmppc_resize_hpt_prepare(cpu
, flags
, shift
);
481 return resize_hpt_convert_rc(rc
);
485 /* something already in progress */
486 if (pending
->shift
== shift
) {
487 /* and it's suitable */
488 if (pending
->complete
) {
491 return H_LONG_BUSY_ORDER_100_MSEC
;
495 /* not suitable, cancel and replace */
496 cancel_hpt_prepare(spapr
);
504 /* start new prepare */
506 pending
= g_new0(SpaprPendingHpt
, 1);
507 pending
->shift
= shift
;
508 pending
->ret
= H_HARDWARE
;
510 qemu_thread_create(&pending
->thread
, "sPAPR HPT prepare",
511 hpt_prepare_thread
, pending
, QEMU_THREAD_DETACHED
);
513 spapr
->pending_hpt
= pending
;
515 /* In theory we could estimate the time more accurately based on
516 * the new size, but there's not much point */
517 return H_LONG_BUSY_ORDER_100_MSEC
;
520 static uint64_t new_hpte_load0(void *htab
, uint64_t pteg
, int slot
)
522 uint8_t *addr
= htab
;
524 addr
+= pteg
* HASH_PTEG_SIZE_64
;
525 addr
+= slot
* HASH_PTE_SIZE_64
;
529 static void new_hpte_store(void *htab
, uint64_t pteg
, int slot
,
530 uint64_t pte0
, uint64_t pte1
)
532 uint8_t *addr
= htab
;
534 addr
+= pteg
* HASH_PTEG_SIZE_64
;
535 addr
+= slot
* HASH_PTE_SIZE_64
;
538 stq_p(addr
+ HASH_PTE_SIZE_64
/ 2, pte1
);
541 static int rehash_hpte(PowerPCCPU
*cpu
,
542 const ppc_hash_pte64_t
*hptes
,
543 void *old_hpt
, uint64_t oldsize
,
544 void *new_hpt
, uint64_t newsize
,
545 uint64_t pteg
, int slot
)
547 uint64_t old_hash_mask
= (oldsize
>> 7) - 1;
548 uint64_t new_hash_mask
= (newsize
>> 7) - 1;
549 target_ulong pte0
= ppc_hash64_hpte0(cpu
, hptes
, slot
);
552 unsigned base_pg_shift
;
553 uint64_t hash
, new_pteg
, replace_pte0
;
555 if (!(pte0
& HPTE64_V_VALID
) || !(pte0
& HPTE64_V_BOLTED
)) {
559 pte1
= ppc_hash64_hpte1(cpu
, hptes
, slot
);
561 base_pg_shift
= ppc_hash64_hpte_page_shift_noslb(cpu
, pte0
, pte1
);
562 assert(base_pg_shift
); /* H_ENTER shouldn't allow a bad encoding */
563 avpn
= HPTE64_V_AVPN_VAL(pte0
) & ~(((1ULL << base_pg_shift
) - 1) >> 23);
565 if (pte0
& HPTE64_V_SECONDARY
) {
569 if ((pte0
& HPTE64_V_SSIZE
) == HPTE64_V_SSIZE_256M
) {
570 uint64_t offset
, vsid
;
572 /* We only have 28 - 23 bits of offset in avpn */
573 offset
= (avpn
& 0x1f) << 23;
575 /* We can find more bits from the pteg value */
576 if (base_pg_shift
< 23) {
577 offset
|= ((vsid
^ pteg
) & old_hash_mask
) << base_pg_shift
;
580 hash
= vsid
^ (offset
>> base_pg_shift
);
581 } else if ((pte0
& HPTE64_V_SSIZE
) == HPTE64_V_SSIZE_1T
) {
582 uint64_t offset
, vsid
;
584 /* We only have 40 - 23 bits of seg_off in avpn */
585 offset
= (avpn
& 0x1ffff) << 23;
587 if (base_pg_shift
< 23) {
588 offset
|= ((vsid
^ (vsid
<< 25) ^ pteg
) & old_hash_mask
)
592 hash
= vsid
^ (vsid
<< 25) ^ (offset
>> base_pg_shift
);
594 error_report("rehash_pte: Bad segment size in HPTE");
598 new_pteg
= hash
& new_hash_mask
;
599 if (pte0
& HPTE64_V_SECONDARY
) {
600 assert(~pteg
== (hash
& old_hash_mask
));
601 new_pteg
= ~new_pteg
;
603 assert(pteg
== (hash
& old_hash_mask
));
605 assert((oldsize
!= newsize
) || (pteg
== new_pteg
));
606 replace_pte0
= new_hpte_load0(new_hpt
, new_pteg
, slot
);
608 * Strictly speaking, we don't need all these tests, since we only
609 * ever rehash bolted HPTEs. We might in future handle non-bolted
610 * HPTEs, though so make the logic correct for those cases as
613 if (replace_pte0
& HPTE64_V_VALID
) {
614 assert(newsize
< oldsize
);
615 if (replace_pte0
& HPTE64_V_BOLTED
) {
616 if (pte0
& HPTE64_V_BOLTED
) {
617 /* Bolted collision, nothing we can do */
620 /* Discard this hpte */
626 new_hpte_store(new_hpt
, new_pteg
, slot
, pte0
, pte1
);
630 static int rehash_hpt(PowerPCCPU
*cpu
,
631 void *old_hpt
, uint64_t oldsize
,
632 void *new_hpt
, uint64_t newsize
)
634 uint64_t n_ptegs
= oldsize
>> 7;
639 for (pteg
= 0; pteg
< n_ptegs
; pteg
++) {
640 hwaddr ptex
= pteg
* HPTES_PER_GROUP
;
641 const ppc_hash_pte64_t
*hptes
642 = ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
648 for (slot
= 0; slot
< HPTES_PER_GROUP
; slot
++) {
649 rc
= rehash_hpte(cpu
, hptes
, old_hpt
, oldsize
, new_hpt
, newsize
,
651 if (rc
!= H_SUCCESS
) {
652 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
656 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
662 static void do_push_sregs_to_kvm_pr(CPUState
*cs
, run_on_cpu_data data
)
666 cpu_synchronize_state(cs
);
668 ret
= kvmppc_put_books_sregs(POWERPC_CPU(cs
));
670 error_report("failed to push sregs to KVM: %s", strerror(-ret
));
675 static void push_sregs_to_kvm_pr(SpaprMachineState
*spapr
)
680 * This is a hack for the benefit of KVM PR - it abuses the SDR1
681 * slot in kvm_sregs to communicate the userspace address of the
684 if (!kvm_enabled() || !spapr
->htab
) {
689 run_on_cpu(cs
, do_push_sregs_to_kvm_pr
, RUN_ON_CPU_NULL
);
693 static target_ulong
h_resize_hpt_commit(PowerPCCPU
*cpu
,
694 SpaprMachineState
*spapr
,
698 target_ulong flags
= args
[0];
699 target_ulong shift
= args
[1];
700 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
704 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
708 if (!spapr
->htab_shift
) {
709 /* Radix guest, no HPT */
710 return H_NOT_AVAILABLE
;
713 trace_spapr_h_resize_hpt_commit(flags
, shift
);
715 rc
= kvmppc_resize_hpt_commit(cpu
, flags
, shift
);
717 rc
= resize_hpt_convert_rc(rc
);
718 if (rc
== H_SUCCESS
) {
719 /* Need to set the new htab_shift in the machine state */
720 spapr
->htab_shift
= shift
;
729 if (!pending
|| (pending
->shift
!= shift
)) {
730 /* no matching prepare */
734 if (!pending
->complete
) {
735 /* prepare has not completed */
739 /* Shouldn't have got past PREPARE without an HPT */
740 g_assert(spapr
->htab_shift
);
742 newsize
= 1ULL << pending
->shift
;
743 rc
= rehash_hpt(cpu
, spapr
->htab
, HTAB_SIZE(spapr
),
744 pending
->hpt
, newsize
);
745 if (rc
== H_SUCCESS
) {
746 qemu_vfree(spapr
->htab
);
747 spapr
->htab
= pending
->hpt
;
748 spapr
->htab_shift
= pending
->shift
;
750 push_sregs_to_kvm_pr(spapr
);
752 pending
->hpt
= NULL
; /* so it's not free()d */
756 spapr
->pending_hpt
= NULL
;
757 free_pending_hpt(pending
);
762 static target_ulong
h_set_sprg0(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
763 target_ulong opcode
, target_ulong
*args
)
765 cpu_synchronize_state(CPU(cpu
));
766 cpu
->env
.spr
[SPR_SPRG0
] = args
[0];
771 static target_ulong
h_set_dabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
772 target_ulong opcode
, target_ulong
*args
)
774 if (!has_spr(cpu
, SPR_DABR
)) {
775 return H_HARDWARE
; /* DABR register not available */
777 cpu_synchronize_state(CPU(cpu
));
779 if (has_spr(cpu
, SPR_DABRX
)) {
780 cpu
->env
.spr
[SPR_DABRX
] = 0x3; /* Use Problem and Privileged state */
781 } else if (!(args
[0] & 0x4)) { /* Breakpoint Translation set? */
782 return H_RESERVED_DABR
;
785 cpu
->env
.spr
[SPR_DABR
] = args
[0];
789 static target_ulong
h_set_xdabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
790 target_ulong opcode
, target_ulong
*args
)
792 target_ulong dabrx
= args
[1];
794 if (!has_spr(cpu
, SPR_DABR
) || !has_spr(cpu
, SPR_DABRX
)) {
798 if ((dabrx
& ~0xfULL
) != 0 || (dabrx
& H_DABRX_HYPERVISOR
) != 0
799 || (dabrx
& (H_DABRX_KERNEL
| H_DABRX_USER
)) == 0) {
803 cpu_synchronize_state(CPU(cpu
));
804 cpu
->env
.spr
[SPR_DABRX
] = dabrx
;
805 cpu
->env
.spr
[SPR_DABR
] = args
[0];
810 static target_ulong
h_page_init(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
811 target_ulong opcode
, target_ulong
*args
)
813 target_ulong flags
= args
[0];
814 hwaddr dst
= args
[1];
815 hwaddr src
= args
[2];
816 hwaddr len
= TARGET_PAGE_SIZE
;
817 uint8_t *pdst
, *psrc
;
818 target_long ret
= H_SUCCESS
;
820 if (flags
& ~(H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
821 | H_COPY_PAGE
| H_ZERO_PAGE
)) {
822 qemu_log_mask(LOG_UNIMP
, "h_page_init: Bad flags (" TARGET_FMT_lx
"\n",
827 /* Map-in destination */
828 if (!is_ram_address(spapr
, dst
) || (dst
& ~TARGET_PAGE_MASK
) != 0) {
831 pdst
= cpu_physical_memory_map(dst
, &len
, 1);
832 if (!pdst
|| len
!= TARGET_PAGE_SIZE
) {
836 if (flags
& H_COPY_PAGE
) {
837 /* Map-in source, copy to destination, and unmap source again */
838 if (!is_ram_address(spapr
, src
) || (src
& ~TARGET_PAGE_MASK
) != 0) {
842 psrc
= cpu_physical_memory_map(src
, &len
, 0);
843 if (!psrc
|| len
!= TARGET_PAGE_SIZE
) {
847 memcpy(pdst
, psrc
, len
);
848 cpu_physical_memory_unmap(psrc
, len
, 0, len
);
849 } else if (flags
& H_ZERO_PAGE
) {
850 memset(pdst
, 0, len
); /* Just clear the destination page */
853 if (kvm_enabled() && (flags
& H_ICACHE_SYNCHRONIZE
) != 0) {
854 kvmppc_dcbst_range(cpu
, pdst
, len
);
856 if (flags
& (H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
)) {
858 kvmppc_icbi_range(cpu
, pdst
, len
);
865 cpu_physical_memory_unmap(pdst
, TARGET_PAGE_SIZE
, 1, len
);
869 #define FLAGS_REGISTER_VPA 0x0000200000000000ULL
870 #define FLAGS_REGISTER_DTL 0x0000400000000000ULL
871 #define FLAGS_REGISTER_SLBSHADOW 0x0000600000000000ULL
872 #define FLAGS_DEREGISTER_VPA 0x0000a00000000000ULL
873 #define FLAGS_DEREGISTER_DTL 0x0000c00000000000ULL
874 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
876 #define VPA_MIN_SIZE 640
877 #define VPA_SIZE_OFFSET 0x4
878 #define VPA_SHARED_PROC_OFFSET 0x9
879 #define VPA_SHARED_PROC_VAL 0x2
881 static target_ulong
register_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
883 CPUState
*cs
= CPU(cpu
);
884 CPUPPCState
*env
= &cpu
->env
;
885 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
890 hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
894 if (vpa
% env
->dcache_line_size
) {
897 /* FIXME: bounds check the address */
899 size
= lduw_be_phys(cs
->as
, vpa
+ 0x4);
901 if (size
< VPA_MIN_SIZE
) {
905 /* VPA is not allowed to cross a page boundary */
906 if ((vpa
/ 4096) != ((vpa
+ size
- 1) / 4096)) {
910 spapr_cpu
->vpa_addr
= vpa
;
912 tmp
= ldub_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
);
913 tmp
|= VPA_SHARED_PROC_VAL
;
914 stb_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
, tmp
);
919 static target_ulong
deregister_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
921 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
923 if (spapr_cpu
->slb_shadow_addr
) {
927 if (spapr_cpu
->dtl_addr
) {
931 spapr_cpu
->vpa_addr
= 0;
935 static target_ulong
register_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
937 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
941 hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
945 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
950 if ((addr
/ 4096) != ((addr
+ size
- 1) / 4096)) {
954 if (!spapr_cpu
->vpa_addr
) {
958 spapr_cpu
->slb_shadow_addr
= addr
;
959 spapr_cpu
->slb_shadow_size
= size
;
964 static target_ulong
deregister_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
966 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
968 spapr_cpu
->slb_shadow_addr
= 0;
969 spapr_cpu
->slb_shadow_size
= 0;
973 static target_ulong
register_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
975 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
979 hcall_dprintf("Can't cope with DTL at logical 0\n");
983 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
989 if (!spapr_cpu
->vpa_addr
) {
993 spapr_cpu
->dtl_addr
= addr
;
994 spapr_cpu
->dtl_size
= size
;
999 static target_ulong
deregister_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
1001 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1003 spapr_cpu
->dtl_addr
= 0;
1004 spapr_cpu
->dtl_size
= 0;
1009 static target_ulong
h_register_vpa(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1010 target_ulong opcode
, target_ulong
*args
)
1012 target_ulong flags
= args
[0];
1013 target_ulong procno
= args
[1];
1014 target_ulong vpa
= args
[2];
1015 target_ulong ret
= H_PARAMETER
;
1018 tcpu
= spapr_find_cpu(procno
);
1024 case FLAGS_REGISTER_VPA
:
1025 ret
= register_vpa(tcpu
, vpa
);
1028 case FLAGS_DEREGISTER_VPA
:
1029 ret
= deregister_vpa(tcpu
, vpa
);
1032 case FLAGS_REGISTER_SLBSHADOW
:
1033 ret
= register_slb_shadow(tcpu
, vpa
);
1036 case FLAGS_DEREGISTER_SLBSHADOW
:
1037 ret
= deregister_slb_shadow(tcpu
, vpa
);
1040 case FLAGS_REGISTER_DTL
:
1041 ret
= register_dtl(tcpu
, vpa
);
1044 case FLAGS_DEREGISTER_DTL
:
1045 ret
= deregister_dtl(tcpu
, vpa
);
1052 static target_ulong
h_cede(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1053 target_ulong opcode
, target_ulong
*args
)
1055 CPUPPCState
*env
= &cpu
->env
;
1056 CPUState
*cs
= CPU(cpu
);
1058 env
->msr
|= (1ULL << MSR_EE
);
1059 hreg_compute_hflags(env
);
1060 if (!cpu_has_work(cs
)) {
1062 cs
->exception_index
= EXCP_HLT
;
1063 cs
->exit_request
= 1;
1068 static target_ulong
h_rtas(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1069 target_ulong opcode
, target_ulong
*args
)
1071 target_ulong rtas_r3
= args
[0];
1072 uint32_t token
= rtas_ld(rtas_r3
, 0);
1073 uint32_t nargs
= rtas_ld(rtas_r3
, 1);
1074 uint32_t nret
= rtas_ld(rtas_r3
, 2);
1076 return spapr_rtas_call(cpu
, spapr
, token
, nargs
, rtas_r3
+ 12,
1077 nret
, rtas_r3
+ 12 + 4*nargs
);
1080 static target_ulong
h_logical_load(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1081 target_ulong opcode
, target_ulong
*args
)
1083 CPUState
*cs
= CPU(cpu
);
1084 target_ulong size
= args
[0];
1085 target_ulong addr
= args
[1];
1089 args
[0] = ldub_phys(cs
->as
, addr
);
1092 args
[0] = lduw_phys(cs
->as
, addr
);
1095 args
[0] = ldl_phys(cs
->as
, addr
);
1098 args
[0] = ldq_phys(cs
->as
, addr
);
1104 static target_ulong
h_logical_store(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1105 target_ulong opcode
, target_ulong
*args
)
1107 CPUState
*cs
= CPU(cpu
);
1109 target_ulong size
= args
[0];
1110 target_ulong addr
= args
[1];
1111 target_ulong val
= args
[2];
1115 stb_phys(cs
->as
, addr
, val
);
1118 stw_phys(cs
->as
, addr
, val
);
1121 stl_phys(cs
->as
, addr
, val
);
1124 stq_phys(cs
->as
, addr
, val
);
1130 static target_ulong
h_logical_memop(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1131 target_ulong opcode
, target_ulong
*args
)
1133 CPUState
*cs
= CPU(cpu
);
1135 target_ulong dst
= args
[0]; /* Destination address */
1136 target_ulong src
= args
[1]; /* Source address */
1137 target_ulong esize
= args
[2]; /* Element size (0=1,1=2,2=4,3=8) */
1138 target_ulong count
= args
[3]; /* Element count */
1139 target_ulong op
= args
[4]; /* 0 = copy, 1 = invert */
1141 unsigned int mask
= (1 << esize
) - 1;
1142 int step
= 1 << esize
;
1144 if (count
> 0x80000000) {
1148 if ((dst
& mask
) || (src
& mask
) || (op
> 1)) {
1152 if (dst
>= src
&& dst
< (src
+ (count
<< esize
))) {
1153 dst
= dst
+ ((count
- 1) << esize
);
1154 src
= src
+ ((count
- 1) << esize
);
1161 tmp
= ldub_phys(cs
->as
, src
);
1164 tmp
= lduw_phys(cs
->as
, src
);
1167 tmp
= ldl_phys(cs
->as
, src
);
1170 tmp
= ldq_phys(cs
->as
, src
);
1180 stb_phys(cs
->as
, dst
, tmp
);
1183 stw_phys(cs
->as
, dst
, tmp
);
1186 stl_phys(cs
->as
, dst
, tmp
);
1189 stq_phys(cs
->as
, dst
, tmp
);
1199 static target_ulong
h_logical_icbi(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1200 target_ulong opcode
, target_ulong
*args
)
1202 /* Nothing to do on emulation, KVM will trap this in the kernel */
1206 static target_ulong
h_logical_dcbf(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1207 target_ulong opcode
, target_ulong
*args
)
1209 /* Nothing to do on emulation, KVM will trap this in the kernel */
1213 static target_ulong
h_set_mode_resource_le(PowerPCCPU
*cpu
,
1214 target_ulong mflags
,
1215 target_ulong value1
,
1216 target_ulong value2
)
1226 case H_SET_MODE_ENDIAN_BIG
:
1227 spapr_set_all_lpcrs(0, LPCR_ILE
);
1228 spapr_pci_switch_vga(true);
1231 case H_SET_MODE_ENDIAN_LITTLE
:
1232 spapr_set_all_lpcrs(LPCR_ILE
, LPCR_ILE
);
1233 spapr_pci_switch_vga(false);
1237 return H_UNSUPPORTED_FLAG
;
1240 static target_ulong
h_set_mode_resource_addr_trans_mode(PowerPCCPU
*cpu
,
1241 target_ulong mflags
,
1242 target_ulong value1
,
1243 target_ulong value2
)
1245 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
1247 if (!(pcc
->insns_flags2
& PPC2_ISA207S
)) {
1257 if (mflags
== AIL_RESERVED
) {
1258 return H_UNSUPPORTED_FLAG
;
1261 spapr_set_all_lpcrs(mflags
<< LPCR_AIL_SHIFT
, LPCR_AIL
);
1266 static target_ulong
h_set_mode(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1267 target_ulong opcode
, target_ulong
*args
)
1269 target_ulong resource
= args
[1];
1270 target_ulong ret
= H_P2
;
1273 case H_SET_MODE_RESOURCE_LE
:
1274 ret
= h_set_mode_resource_le(cpu
, args
[0], args
[2], args
[3]);
1276 case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE
:
1277 ret
= h_set_mode_resource_addr_trans_mode(cpu
, args
[0],
1285 static target_ulong
h_clean_slb(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1286 target_ulong opcode
, target_ulong
*args
)
1288 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
1289 opcode
, " (H_CLEAN_SLB)");
1293 static target_ulong
h_invalidate_pid(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1294 target_ulong opcode
, target_ulong
*args
)
1296 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
1297 opcode
, " (H_INVALIDATE_PID)");
1301 static void spapr_check_setup_free_hpt(SpaprMachineState
*spapr
,
1302 uint64_t patbe_old
, uint64_t patbe_new
)
1305 * We have 4 Options:
1306 * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
1307 * HASH->RADIX : Free HPT
1308 * RADIX->HASH : Allocate HPT
1309 * NOTHING->HASH : Allocate HPT
1310 * Note: NOTHING implies the case where we said the guest could choose
1311 * later and so assumed radix and now it's called H_REG_PROC_TBL
1314 if ((patbe_old
& PATE1_GR
) == (patbe_new
& PATE1_GR
)) {
1315 /* We assume RADIX, so this catches all the "Do Nothing" cases */
1316 } else if (!(patbe_old
& PATE1_GR
)) {
1317 /* HASH->RADIX : Free HPT */
1318 spapr_free_hpt(spapr
);
1319 } else if (!(patbe_new
& PATE1_GR
)) {
1320 /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
1321 spapr_setup_hpt_and_vrma(spapr
);
1326 #define FLAGS_MASK 0x01FULL
1327 #define FLAG_MODIFY 0x10
1328 #define FLAG_REGISTER 0x08
1329 #define FLAG_RADIX 0x04
1330 #define FLAG_HASH_PROC_TBL 0x02
1331 #define FLAG_GTSE 0x01
1333 static target_ulong
h_register_process_table(PowerPCCPU
*cpu
,
1334 SpaprMachineState
*spapr
,
1335 target_ulong opcode
,
1338 target_ulong flags
= args
[0];
1339 target_ulong proc_tbl
= args
[1];
1340 target_ulong page_size
= args
[2];
1341 target_ulong table_size
= args
[3];
1342 target_ulong update_lpcr
= 0;
1345 if (flags
& ~FLAGS_MASK
) { /* Check no reserved bits are set */
1348 if (flags
& FLAG_MODIFY
) {
1349 if (flags
& FLAG_REGISTER
) {
1350 if (flags
& FLAG_RADIX
) { /* Register new RADIX process table */
1351 if (proc_tbl
& 0xfff || proc_tbl
>> 60) {
1353 } else if (page_size
) {
1355 } else if (table_size
> 24) {
1358 cproc
= PATE1_GR
| proc_tbl
| table_size
;
1359 } else { /* Register new HPT process table */
1360 if (flags
& FLAG_HASH_PROC_TBL
) { /* Hash with Segment Tables */
1361 /* TODO - Not Supported */
1362 /* Technically caused by flag bits => H_PARAMETER */
1364 } else { /* Hash with SLB */
1365 if (proc_tbl
>> 38) {
1367 } else if (page_size
& ~0x7) {
1369 } else if (table_size
> 24) {
1373 cproc
= (proc_tbl
<< 25) | page_size
<< 5 | table_size
;
1376 } else { /* Deregister current process table */
1378 * Set to benign value: (current GR) | 0. This allows
1379 * deregistration in KVM to succeed even if the radix bit
1380 * in flags doesn't match the radix bit in the old PATE.
1382 cproc
= spapr
->patb_entry
& PATE1_GR
;
1384 } else { /* Maintain current registration */
1385 if (!(flags
& FLAG_RADIX
) != !(spapr
->patb_entry
& PATE1_GR
)) {
1386 /* Technically caused by flag bits => H_PARAMETER */
1387 return H_PARAMETER
; /* Existing Process Table Mismatch */
1389 cproc
= spapr
->patb_entry
;
1392 /* Check if we need to setup OR free the hpt */
1393 spapr_check_setup_free_hpt(spapr
, spapr
->patb_entry
, cproc
);
1395 spapr
->patb_entry
= cproc
; /* Save new process table */
1397 /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
1398 if (flags
& FLAG_RADIX
) /* Radix must use process tables, also set HR */
1399 update_lpcr
|= (LPCR_UPRT
| LPCR_HR
);
1400 else if (flags
& FLAG_HASH_PROC_TBL
) /* Hash with process tables */
1401 update_lpcr
|= LPCR_UPRT
;
1402 if (flags
& FLAG_GTSE
) /* Guest translation shootdown enable */
1403 update_lpcr
|= LPCR_GTSE
;
1405 spapr_set_all_lpcrs(update_lpcr
, LPCR_UPRT
| LPCR_HR
| LPCR_GTSE
);
1407 if (kvm_enabled()) {
1408 return kvmppc_configure_v3_mmu(cpu
, flags
& FLAG_RADIX
,
1409 flags
& FLAG_GTSE
, cproc
);
1414 #define H_SIGNAL_SYS_RESET_ALL -1
1415 #define H_SIGNAL_SYS_RESET_ALLBUTSELF -2
1417 static target_ulong
h_signal_sys_reset(PowerPCCPU
*cpu
,
1418 SpaprMachineState
*spapr
,
1419 target_ulong opcode
, target_ulong
*args
)
1421 target_long target
= args
[0];
1426 if (target
< H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1431 PowerPCCPU
*c
= POWERPC_CPU(cs
);
1433 if (target
== H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1438 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1444 cs
= CPU(spapr_find_cpu(target
));
1446 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1453 static uint32_t cas_check_pvr(SpaprMachineState
*spapr
, PowerPCCPU
*cpu
,
1454 target_ulong
*addr
, bool *raw_mode_supported
,
1457 bool explicit_match
= false; /* Matched the CPU's real PVR */
1458 uint32_t max_compat
= spapr
->max_compat_pvr
;
1459 uint32_t best_compat
= 0;
1463 * We scan the supplied table of PVRs looking for two things
1464 * 1. Is our real CPU PVR in the list?
1465 * 2. What's the "best" listed logical PVR
1467 for (i
= 0; i
< 512; ++i
) {
1468 uint32_t pvr
, pvr_mask
;
1470 pvr_mask
= ldl_be_phys(&address_space_memory
, *addr
);
1471 pvr
= ldl_be_phys(&address_space_memory
, *addr
+ 4);
1474 if (~pvr_mask
& pvr
) {
1475 break; /* Terminator record */
1478 if ((cpu
->env
.spr
[SPR_PVR
] & pvr_mask
) == (pvr
& pvr_mask
)) {
1479 explicit_match
= true;
1481 if (ppc_check_compat(cpu
, pvr
, best_compat
, max_compat
)) {
1487 if ((best_compat
== 0) && (!explicit_match
|| max_compat
)) {
1488 /* We couldn't find a suitable compatibility mode, and either
1489 * the guest doesn't support "raw" mode for this CPU, or raw
1490 * mode is disabled because a maximum compat mode is set */
1491 error_setg(errp
, "Couldn't negotiate a suitable PVR during CAS");
1495 *raw_mode_supported
= explicit_match
;
1497 /* Parsing finished */
1498 trace_spapr_cas_pvr(cpu
->compat_pvr
, explicit_match
, best_compat
);
1503 static target_ulong
h_client_architecture_support(PowerPCCPU
*cpu
,
1504 SpaprMachineState
*spapr
,
1505 target_ulong opcode
,
1508 /* Working address in data buffer */
1509 target_ulong addr
= ppc64_phys_to_real(args
[0]);
1510 target_ulong ov_table
;
1512 SpaprOptionVector
*ov1_guest
, *ov5_guest
, *ov5_cas_old
, *ov5_updates
;
1514 Error
*local_err
= NULL
;
1515 bool raw_mode_supported
= false;
1517 cas_pvr
= cas_check_pvr(spapr
, cpu
, &addr
, &raw_mode_supported
, &local_err
);
1519 error_report_err(local_err
);
1524 if (cpu
->compat_pvr
!= cas_pvr
) {
1525 ppc_set_compat_all(cas_pvr
, &local_err
);
1527 /* We fail to set compat mode (likely because running with KVM PR),
1528 * but maybe we can fallback to raw mode if the guest supports it.
1530 if (!raw_mode_supported
) {
1531 error_report_err(local_err
);
1534 error_free(local_err
);
1539 /* For the future use: here @ov_table points to the first option vector */
1542 ov1_guest
= spapr_ovec_parse_vector(ov_table
, 1);
1543 ov5_guest
= spapr_ovec_parse_vector(ov_table
, 5);
1544 if (spapr_ovec_test(ov5_guest
, OV5_MMU_BOTH
)) {
1545 error_report("guest requested hash and radix MMU, which is invalid.");
1548 /* The radix/hash bit in byte 24 requires special handling: */
1549 guest_radix
= spapr_ovec_test(ov5_guest
, OV5_MMU_RADIX_300
);
1550 spapr_ovec_clear(ov5_guest
, OV5_MMU_RADIX_300
);
1553 * HPT resizing is a bit of a special case, because when enabled
1554 * we assume an HPT guest will support it until it says it
1555 * doesn't, instead of assuming it won't support it until it says
1556 * it does. Strictly speaking that approach could break for
1557 * guests which don't make a CAS call, but those are so old we
1558 * don't care about them. Without that assumption we'd have to
1559 * make at least a temporary allocation of an HPT sized for max
1560 * memory, which could be impossibly difficult under KVM HV if
1563 if (!guest_radix
&& !spapr_ovec_test(ov5_guest
, OV5_HPT_RESIZE
)) {
1564 int maxshift
= spapr_hpt_shift_for_ramsize(MACHINE(spapr
)->maxram_size
);
1566 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_REQUIRED
) {
1568 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1572 if (spapr
->htab_shift
< maxshift
) {
1573 /* Guest doesn't know about HPT resizing, so we
1574 * pre-emptively resize for the maximum permitted RAM. At
1575 * the point this is called, nothing should have been
1576 * entered into the existing HPT */
1577 spapr_reallocate_hpt(spapr
, maxshift
, &error_fatal
);
1578 push_sregs_to_kvm_pr(spapr
);
1582 /* NOTE: there are actually a number of ov5 bits where input from the
1583 * guest is always zero, and the platform/QEMU enables them independently
1584 * of guest input. To model these properly we'd want some sort of mask,
1585 * but since they only currently apply to memory migration as defined
1586 * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1587 * to worry about this for now.
1589 ov5_cas_old
= spapr_ovec_clone(spapr
->ov5_cas
);
1591 /* also clear the radix/hash bit from the current ov5_cas bits to
1592 * be in sync with the newly ov5 bits. Else the radix bit will be
1593 * seen as being removed and this will generate a reset loop
1595 spapr_ovec_clear(ov5_cas_old
, OV5_MMU_RADIX_300
);
1597 /* full range of negotiated ov5 capabilities */
1598 spapr_ovec_intersect(spapr
->ov5_cas
, spapr
->ov5
, ov5_guest
);
1599 spapr_ovec_cleanup(ov5_guest
);
1600 /* capabilities that have been added since CAS-generated guest reset.
1601 * if capabilities have since been removed, generate another reset
1603 ov5_updates
= spapr_ovec_new();
1604 spapr
->cas_reboot
= spapr_ovec_diff(ov5_updates
,
1605 ov5_cas_old
, spapr
->ov5_cas
);
1606 /* Now that processing is finished, set the radix/hash bit for the
1607 * guest if it requested a valid mode; otherwise terminate the boot. */
1609 if (kvm_enabled() && !kvmppc_has_cap_mmu_radix()) {
1610 error_report("Guest requested unavailable MMU mode (radix).");
1613 spapr_ovec_set(spapr
->ov5_cas
, OV5_MMU_RADIX_300
);
1615 if (kvm_enabled() && kvmppc_has_cap_mmu_radix()
1616 && !kvmppc_has_cap_mmu_hash_v3()) {
1617 error_report("Guest requested unavailable MMU mode (hash).");
1621 spapr
->cas_legacy_guest_workaround
= !spapr_ovec_test(ov1_guest
,
1623 if (!spapr
->cas_reboot
) {
1624 /* If spapr_machine_reset() did not set up a HPT but one is necessary
1625 * (because the guest isn't going to use radix) then set it up here. */
1626 if ((spapr
->patb_entry
& PATE1_GR
) && !guest_radix
) {
1627 /* legacy hash or new hash: */
1628 spapr_setup_hpt_and_vrma(spapr
);
1631 (spapr_h_cas_compose_response(spapr
, args
[1], args
[2],
1636 * Generate a machine reset when we have an update of the
1637 * interrupt mode. Only required when the machine supports both
1640 if (!spapr
->cas_reboot
) {
1641 spapr
->cas_reboot
= spapr_ovec_test(ov5_updates
, OV5_XIVE_EXPLOIT
)
1642 && spapr
->irq
->ov5
& SPAPR_OV5_XIVE_BOTH
;
1645 spapr_ovec_cleanup(ov5_updates
);
1647 if (spapr
->cas_reboot
) {
1648 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET
);
1654 static target_ulong
h_home_node_associativity(PowerPCCPU
*cpu
,
1655 SpaprMachineState
*spapr
,
1656 target_ulong opcode
,
1659 target_ulong flags
= args
[0];
1660 target_ulong procno
= args
[1];
1664 /* only support procno from H_REGISTER_VPA */
1669 tcpu
= spapr_find_cpu(procno
);
1674 /* sequence is the same as in the "ibm,associativity" property */
1677 #define ASSOCIATIVITY(a, b) (((uint64_t)(a) << 32) | \
1678 ((uint64_t)(b) & 0xffffffff))
1679 args
[idx
++] = ASSOCIATIVITY(0, 0);
1680 args
[idx
++] = ASSOCIATIVITY(0, tcpu
->node_id
);
1681 args
[idx
++] = ASSOCIATIVITY(procno
, -1);
1682 for ( ; idx
< 6; idx
++) {
1685 #undef ASSOCIATIVITY
1690 static target_ulong
h_get_cpu_characteristics(PowerPCCPU
*cpu
,
1691 SpaprMachineState
*spapr
,
1692 target_ulong opcode
,
1695 uint64_t characteristics
= H_CPU_CHAR_HON_BRANCH_HINTS
&
1696 ~H_CPU_CHAR_THR_RECONF_TRIG
;
1697 uint64_t behaviour
= H_CPU_BEHAV_FAVOUR_SECURITY
;
1698 uint8_t safe_cache
= spapr_get_cap(spapr
, SPAPR_CAP_CFPC
);
1699 uint8_t safe_bounds_check
= spapr_get_cap(spapr
, SPAPR_CAP_SBBC
);
1700 uint8_t safe_indirect_branch
= spapr_get_cap(spapr
, SPAPR_CAP_IBS
);
1701 uint8_t count_cache_flush_assist
= spapr_get_cap(spapr
,
1702 SPAPR_CAP_CCF_ASSIST
);
1704 switch (safe_cache
) {
1705 case SPAPR_CAP_WORKAROUND
:
1706 characteristics
|= H_CPU_CHAR_L1D_FLUSH_ORI30
;
1707 characteristics
|= H_CPU_CHAR_L1D_FLUSH_TRIG2
;
1708 characteristics
|= H_CPU_CHAR_L1D_THREAD_PRIV
;
1709 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1711 case SPAPR_CAP_FIXED
:
1713 default: /* broken */
1714 assert(safe_cache
== SPAPR_CAP_BROKEN
);
1715 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1719 switch (safe_bounds_check
) {
1720 case SPAPR_CAP_WORKAROUND
:
1721 characteristics
|= H_CPU_CHAR_SPEC_BAR_ORI31
;
1722 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1724 case SPAPR_CAP_FIXED
:
1726 default: /* broken */
1727 assert(safe_bounds_check
== SPAPR_CAP_BROKEN
);
1728 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1732 switch (safe_indirect_branch
) {
1733 case SPAPR_CAP_FIXED_NA
:
1735 case SPAPR_CAP_FIXED_CCD
:
1736 characteristics
|= H_CPU_CHAR_CACHE_COUNT_DIS
;
1738 case SPAPR_CAP_FIXED_IBS
:
1739 characteristics
|= H_CPU_CHAR_BCCTRL_SERIALISED
;
1741 case SPAPR_CAP_WORKAROUND
:
1742 behaviour
|= H_CPU_BEHAV_FLUSH_COUNT_CACHE
;
1743 if (count_cache_flush_assist
) {
1744 characteristics
|= H_CPU_CHAR_BCCTR_FLUSH_ASSIST
;
1747 default: /* broken */
1748 assert(safe_indirect_branch
== SPAPR_CAP_BROKEN
);
1752 args
[0] = characteristics
;
1753 args
[1] = behaviour
;
1757 static target_ulong
h_update_dt(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1758 target_ulong opcode
, target_ulong
*args
)
1760 target_ulong dt
= ppc64_phys_to_real(args
[0]);
1761 struct fdt_header hdr
= { 0 };
1763 SpaprMachineClass
*smc
= SPAPR_MACHINE_GET_CLASS(spapr
);
1766 cpu_physical_memory_read(dt
, &hdr
, sizeof(hdr
));
1767 cb
= fdt32_to_cpu(hdr
.totalsize
);
1769 if (!smc
->update_dt_enabled
) {
1773 /* Check that the fdt did not grow out of proportion */
1774 if (cb
> spapr
->fdt_initial_size
* 2) {
1775 trace_spapr_update_dt_failed_size(spapr
->fdt_initial_size
, cb
,
1776 fdt32_to_cpu(hdr
.magic
));
1780 fdt
= g_malloc0(cb
);
1781 cpu_physical_memory_read(dt
, fdt
, cb
);
1783 /* Check the fdt consistency */
1784 if (fdt_check_full(fdt
, cb
)) {
1785 trace_spapr_update_dt_failed_check(spapr
->fdt_initial_size
, cb
,
1786 fdt32_to_cpu(hdr
.magic
));
1790 g_free(spapr
->fdt_blob
);
1791 spapr
->fdt_size
= cb
;
1792 spapr
->fdt_blob
= fdt
;
1793 trace_spapr_update_dt(cb
);
1798 static spapr_hcall_fn papr_hypercall_table
[(MAX_HCALL_OPCODE
/ 4) + 1];
1799 static spapr_hcall_fn kvmppc_hypercall_table
[KVMPPC_HCALL_MAX
- KVMPPC_HCALL_BASE
+ 1];
1801 void spapr_register_hypercall(target_ulong opcode
, spapr_hcall_fn fn
)
1803 spapr_hcall_fn
*slot
;
1805 if (opcode
<= MAX_HCALL_OPCODE
) {
1806 assert((opcode
& 0x3) == 0);
1808 slot
= &papr_hypercall_table
[opcode
/ 4];
1810 assert((opcode
>= KVMPPC_HCALL_BASE
) && (opcode
<= KVMPPC_HCALL_MAX
));
1812 slot
= &kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
1819 target_ulong
spapr_hypercall(PowerPCCPU
*cpu
, target_ulong opcode
,
1822 SpaprMachineState
*spapr
= SPAPR_MACHINE(qdev_get_machine());
1824 if ((opcode
<= MAX_HCALL_OPCODE
)
1825 && ((opcode
& 0x3) == 0)) {
1826 spapr_hcall_fn fn
= papr_hypercall_table
[opcode
/ 4];
1829 return fn(cpu
, spapr
, opcode
, args
);
1831 } else if ((opcode
>= KVMPPC_HCALL_BASE
) &&
1832 (opcode
<= KVMPPC_HCALL_MAX
)) {
1833 spapr_hcall_fn fn
= kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
1836 return fn(cpu
, spapr
, opcode
, args
);
1840 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx
"\n",
1845 static void hypercall_register_types(void)
1848 spapr_register_hypercall(H_ENTER
, h_enter
);
1849 spapr_register_hypercall(H_REMOVE
, h_remove
);
1850 spapr_register_hypercall(H_PROTECT
, h_protect
);
1851 spapr_register_hypercall(H_READ
, h_read
);
1854 spapr_register_hypercall(H_BULK_REMOVE
, h_bulk_remove
);
1856 /* hcall-hpt-resize */
1857 spapr_register_hypercall(H_RESIZE_HPT_PREPARE
, h_resize_hpt_prepare
);
1858 spapr_register_hypercall(H_RESIZE_HPT_COMMIT
, h_resize_hpt_commit
);
1861 spapr_register_hypercall(H_REGISTER_VPA
, h_register_vpa
);
1862 spapr_register_hypercall(H_CEDE
, h_cede
);
1863 spapr_register_hypercall(H_SIGNAL_SYS_RESET
, h_signal_sys_reset
);
1865 /* processor register resource access h-calls */
1866 spapr_register_hypercall(H_SET_SPRG0
, h_set_sprg0
);
1867 spapr_register_hypercall(H_SET_DABR
, h_set_dabr
);
1868 spapr_register_hypercall(H_SET_XDABR
, h_set_xdabr
);
1869 spapr_register_hypercall(H_PAGE_INIT
, h_page_init
);
1870 spapr_register_hypercall(H_SET_MODE
, h_set_mode
);
1872 /* In Memory Table MMU h-calls */
1873 spapr_register_hypercall(H_CLEAN_SLB
, h_clean_slb
);
1874 spapr_register_hypercall(H_INVALIDATE_PID
, h_invalidate_pid
);
1875 spapr_register_hypercall(H_REGISTER_PROC_TBL
, h_register_process_table
);
1877 /* hcall-get-cpu-characteristics */
1878 spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS
,
1879 h_get_cpu_characteristics
);
1881 /* "debugger" hcalls (also used by SLOF). Note: We do -not- differenciate
1882 * here between the "CI" and the "CACHE" variants, they will use whatever
1883 * mapping attributes qemu is using. When using KVM, the kernel will
1884 * enforce the attributes more strongly
1886 spapr_register_hypercall(H_LOGICAL_CI_LOAD
, h_logical_load
);
1887 spapr_register_hypercall(H_LOGICAL_CI_STORE
, h_logical_store
);
1888 spapr_register_hypercall(H_LOGICAL_CACHE_LOAD
, h_logical_load
);
1889 spapr_register_hypercall(H_LOGICAL_CACHE_STORE
, h_logical_store
);
1890 spapr_register_hypercall(H_LOGICAL_ICBI
, h_logical_icbi
);
1891 spapr_register_hypercall(H_LOGICAL_DCBF
, h_logical_dcbf
);
1892 spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP
, h_logical_memop
);
1894 /* qemu/KVM-PPC specific hcalls */
1895 spapr_register_hypercall(KVMPPC_H_RTAS
, h_rtas
);
1897 /* ibm,client-architecture-support support */
1898 spapr_register_hypercall(KVMPPC_H_CAS
, h_client_architecture_support
);
1900 spapr_register_hypercall(KVMPPC_H_UPDATE_DT
, h_update_dt
);
1902 /* Virtual Processor Home Node */
1903 spapr_register_hypercall(H_HOME_NODE_ASSOCIATIVITY
,
1904 h_home_node_associativity
);
1907 type_init(hypercall_register_types
)