target/arm: fix crash on pmu register access
[qemu/ar7.git] / hw / ppc / spapr_vio.c
blob583c13dedaaff925130ff561b63f9742bfe6ee96
1 /*
2 * QEMU sPAPR VIO code
4 * Copyright (c) 2010 David Gibson, IBM Corporation <dwg@au1.ibm.com>
5 * Based on the s390 virtio bus code:
6 * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2 of the License, or (at your option) any later version.
13 * This library is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * Lesser General Public License for more details.
18 * You should have received a copy of the GNU Lesser General Public
19 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
22 #include "qemu/osdep.h"
23 #include "qemu/error-report.h"
24 #include "qapi/error.h"
25 #include "qapi/visitor.h"
26 #include "hw/hw.h"
27 #include "qemu/log.h"
28 #include "sysemu/sysemu.h"
29 #include "hw/boards.h"
30 #include "hw/loader.h"
31 #include "elf.h"
32 #include "hw/sysbus.h"
33 #include "sysemu/kvm.h"
34 #include "sysemu/device_tree.h"
35 #include "kvm_ppc.h"
36 #include "sysemu/qtest.h"
38 #include "hw/ppc/spapr.h"
39 #include "hw/ppc/spapr_vio.h"
40 #include "hw/ppc/fdt.h"
41 #include "trace.h"
43 #include <libfdt.h>
45 #define SPAPR_VIO_REG_BASE 0x71000000
47 static char *spapr_vio_get_dev_name(DeviceState *qdev)
49 SpaprVioDevice *dev = VIO_SPAPR_DEVICE(qdev);
50 SpaprVioDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
52 /* Device tree style name device@reg */
53 return g_strdup_printf("%s@%x", pc->dt_name, dev->reg);
56 static void spapr_vio_bus_class_init(ObjectClass *klass, void *data)
58 BusClass *k = BUS_CLASS(klass);
60 k->get_dev_path = spapr_vio_get_dev_name;
61 k->get_fw_dev_path = spapr_vio_get_dev_name;
64 static const TypeInfo spapr_vio_bus_info = {
65 .name = TYPE_SPAPR_VIO_BUS,
66 .parent = TYPE_BUS,
67 .class_init = spapr_vio_bus_class_init,
68 .instance_size = sizeof(SpaprVioBus),
71 SpaprVioDevice *spapr_vio_find_by_reg(SpaprVioBus *bus, uint32_t reg)
73 BusChild *kid;
74 SpaprVioDevice *dev = NULL;
76 QTAILQ_FOREACH(kid, &bus->bus.children, sibling) {
77 dev = (SpaprVioDevice *)kid->child;
78 if (dev->reg == reg) {
79 return dev;
83 return NULL;
86 static int vio_make_devnode(SpaprVioDevice *dev,
87 void *fdt)
89 SpaprVioDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
90 int vdevice_off, node_off, ret;
91 char *dt_name;
93 vdevice_off = fdt_path_offset(fdt, "/vdevice");
94 if (vdevice_off < 0) {
95 return vdevice_off;
98 dt_name = spapr_vio_get_dev_name(DEVICE(dev));
99 node_off = fdt_add_subnode(fdt, vdevice_off, dt_name);
100 g_free(dt_name);
101 if (node_off < 0) {
102 return node_off;
105 ret = fdt_setprop_cell(fdt, node_off, "reg", dev->reg);
106 if (ret < 0) {
107 return ret;
110 if (pc->dt_type) {
111 ret = fdt_setprop_string(fdt, node_off, "device_type",
112 pc->dt_type);
113 if (ret < 0) {
114 return ret;
118 if (pc->dt_compatible) {
119 ret = fdt_setprop_string(fdt, node_off, "compatible",
120 pc->dt_compatible);
121 if (ret < 0) {
122 return ret;
126 if (dev->irq) {
127 uint32_t ints_prop[2];
129 spapr_dt_irq(ints_prop, dev->irq, false);
130 ret = fdt_setprop(fdt, node_off, "interrupts", ints_prop,
131 sizeof(ints_prop));
132 if (ret < 0) {
133 return ret;
137 ret = spapr_tcet_dma_dt(fdt, node_off, "ibm,my-dma-window", dev->tcet);
138 if (ret < 0) {
139 return ret;
142 if (pc->devnode) {
143 ret = (pc->devnode)(dev, fdt, node_off);
144 if (ret < 0) {
145 return ret;
149 return node_off;
153 * CRQ handling
155 static target_ulong h_reg_crq(PowerPCCPU *cpu, SpaprMachineState *spapr,
156 target_ulong opcode, target_ulong *args)
158 target_ulong reg = args[0];
159 target_ulong queue_addr = args[1];
160 target_ulong queue_len = args[2];
161 SpaprVioDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
163 if (!dev) {
164 hcall_dprintf("Unit 0x" TARGET_FMT_lx " does not exist\n", reg);
165 return H_PARAMETER;
168 /* We can't grok a queue size bigger than 256M for now */
169 if (queue_len < 0x1000 || queue_len > 0x10000000) {
170 hcall_dprintf("Queue size too small or too big (0x" TARGET_FMT_lx
171 ")\n", queue_len);
172 return H_PARAMETER;
175 /* Check queue alignment */
176 if (queue_addr & 0xfff) {
177 hcall_dprintf("Queue not aligned (0x" TARGET_FMT_lx ")\n", queue_addr);
178 return H_PARAMETER;
181 /* Check if device supports CRQs */
182 if (!dev->crq.SendFunc) {
183 hcall_dprintf("Device does not support CRQ\n");
184 return H_NOT_FOUND;
187 /* Already a queue ? */
188 if (dev->crq.qsize) {
189 hcall_dprintf("CRQ already registered\n");
190 return H_RESOURCE;
192 dev->crq.qladdr = queue_addr;
193 dev->crq.qsize = queue_len;
194 dev->crq.qnext = 0;
196 trace_spapr_vio_h_reg_crq(reg, queue_addr, queue_len);
197 return H_SUCCESS;
200 static target_ulong free_crq(SpaprVioDevice *dev)
202 dev->crq.qladdr = 0;
203 dev->crq.qsize = 0;
204 dev->crq.qnext = 0;
206 trace_spapr_vio_free_crq(dev->reg);
208 return H_SUCCESS;
211 static target_ulong h_free_crq(PowerPCCPU *cpu, SpaprMachineState *spapr,
212 target_ulong opcode, target_ulong *args)
214 target_ulong reg = args[0];
215 SpaprVioDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
217 if (!dev) {
218 hcall_dprintf("Unit 0x" TARGET_FMT_lx " does not exist\n", reg);
219 return H_PARAMETER;
222 return free_crq(dev);
225 static target_ulong h_send_crq(PowerPCCPU *cpu, SpaprMachineState *spapr,
226 target_ulong opcode, target_ulong *args)
228 target_ulong reg = args[0];
229 target_ulong msg_hi = args[1];
230 target_ulong msg_lo = args[2];
231 SpaprVioDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
232 uint64_t crq_mangle[2];
234 if (!dev) {
235 hcall_dprintf("Unit 0x" TARGET_FMT_lx " does not exist\n", reg);
236 return H_PARAMETER;
238 crq_mangle[0] = cpu_to_be64(msg_hi);
239 crq_mangle[1] = cpu_to_be64(msg_lo);
241 if (dev->crq.SendFunc) {
242 return dev->crq.SendFunc(dev, (uint8_t *)crq_mangle);
245 return H_HARDWARE;
248 static target_ulong h_enable_crq(PowerPCCPU *cpu, SpaprMachineState *spapr,
249 target_ulong opcode, target_ulong *args)
251 target_ulong reg = args[0];
252 SpaprVioDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
254 if (!dev) {
255 hcall_dprintf("Unit 0x" TARGET_FMT_lx " does not exist\n", reg);
256 return H_PARAMETER;
259 return 0;
262 /* Returns negative error, 0 success, or positive: queue full */
263 int spapr_vio_send_crq(SpaprVioDevice *dev, uint8_t *crq)
265 int rc;
266 uint8_t byte;
268 if (!dev->crq.qsize) {
269 error_report("spapr_vio_send_creq on uninitialized queue");
270 return -1;
273 /* Maybe do a fast path for KVM just writing to the pages */
274 rc = spapr_vio_dma_read(dev, dev->crq.qladdr + dev->crq.qnext, &byte, 1);
275 if (rc) {
276 return rc;
278 if (byte != 0) {
279 return 1;
282 rc = spapr_vio_dma_write(dev, dev->crq.qladdr + dev->crq.qnext + 8,
283 &crq[8], 8);
284 if (rc) {
285 return rc;
288 kvmppc_eieio();
290 rc = spapr_vio_dma_write(dev, dev->crq.qladdr + dev->crq.qnext, crq, 8);
291 if (rc) {
292 return rc;
295 dev->crq.qnext = (dev->crq.qnext + 16) % dev->crq.qsize;
297 if (dev->signal_state & 1) {
298 qemu_irq_pulse(spapr_vio_qirq(dev));
301 return 0;
304 /* "quiesce" handling */
306 static void spapr_vio_quiesce_one(SpaprVioDevice *dev)
308 if (dev->tcet) {
309 device_reset(DEVICE(dev->tcet));
311 free_crq(dev);
314 void spapr_vio_set_bypass(SpaprVioDevice *dev, bool bypass)
316 if (!dev->tcet) {
317 return;
320 memory_region_set_enabled(&dev->mrbypass, bypass);
321 memory_region_set_enabled(spapr_tce_get_iommu(dev->tcet), !bypass);
323 dev->tcet->bypass = bypass;
326 static void rtas_set_tce_bypass(PowerPCCPU *cpu, SpaprMachineState *spapr,
327 uint32_t token,
328 uint32_t nargs, target_ulong args,
329 uint32_t nret, target_ulong rets)
331 SpaprVioBus *bus = spapr->vio_bus;
332 SpaprVioDevice *dev;
333 uint32_t unit, enable;
335 if (nargs != 2) {
336 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
337 return;
339 unit = rtas_ld(args, 0);
340 enable = rtas_ld(args, 1);
341 dev = spapr_vio_find_by_reg(bus, unit);
342 if (!dev) {
343 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
344 return;
347 if (!dev->tcet) {
348 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
349 return;
352 spapr_vio_set_bypass(dev, !!enable);
354 rtas_st(rets, 0, RTAS_OUT_SUCCESS);
357 static void rtas_quiesce(PowerPCCPU *cpu, SpaprMachineState *spapr,
358 uint32_t token,
359 uint32_t nargs, target_ulong args,
360 uint32_t nret, target_ulong rets)
362 SpaprVioBus *bus = spapr->vio_bus;
363 BusChild *kid;
364 SpaprVioDevice *dev = NULL;
366 if (nargs != 0) {
367 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
368 return;
371 QTAILQ_FOREACH(kid, &bus->bus.children, sibling) {
372 dev = (SpaprVioDevice *)kid->child;
373 spapr_vio_quiesce_one(dev);
376 rtas_st(rets, 0, RTAS_OUT_SUCCESS);
379 static SpaprVioDevice *reg_conflict(SpaprVioDevice *dev)
381 SpaprVioBus *bus = SPAPR_VIO_BUS(dev->qdev.parent_bus);
382 BusChild *kid;
383 SpaprVioDevice *other;
386 * Check for a device other than the given one which is already
387 * using the requested address. We have to open code this because
388 * the given dev might already be in the list.
390 QTAILQ_FOREACH(kid, &bus->bus.children, sibling) {
391 other = VIO_SPAPR_DEVICE(kid->child);
393 if (other != dev && other->reg == dev->reg) {
394 return other;
398 return 0;
401 static void spapr_vio_busdev_reset(DeviceState *qdev)
403 SpaprVioDevice *dev = VIO_SPAPR_DEVICE(qdev);
404 SpaprVioDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
406 /* Shut down the request queue and TCEs if necessary */
407 spapr_vio_quiesce_one(dev);
409 dev->signal_state = 0;
411 spapr_vio_set_bypass(dev, false);
412 if (pc->reset) {
413 pc->reset(dev);
418 * The register property of a VIO device is defined in livirt using
419 * 0x1000 as a base register number plus a 0x1000 increment. For the
420 * VIO tty device, the base number is changed to 0x30000000. QEMU uses
421 * a base register number of 0x71000000 and then a simple increment.
423 * The formula below tries to compute a unique index number from the
424 * register value that will be used to define the IRQ number of the
425 * VIO device.
427 * A maximum of 256 VIO devices is covered. Collisions are possible
428 * but they will be detected when the IRQ is claimed.
430 static inline uint32_t spapr_vio_reg_to_irq(uint32_t reg)
432 uint32_t irq;
434 if (reg >= SPAPR_VIO_REG_BASE) {
436 * VIO device register values when allocated by QEMU. For
437 * these, we simply mask the high bits to fit the overall
438 * range: [0x00 - 0xff].
440 * The nvram VIO device (reg=0x71000000) is a static device of
441 * the pseries machine and so is always allocated by QEMU. Its
442 * IRQ number is 0x0.
444 irq = reg & 0xff;
446 } else if (reg >= 0x30000000) {
448 * VIO tty devices register values, when allocated by livirt,
449 * are mapped in range [0xf0 - 0xff], gives us a maximum of 16
450 * vtys.
452 irq = 0xf0 | ((reg >> 12) & 0xf);
454 } else {
456 * Other VIO devices register values, when allocated by
457 * livirt, should be mapped in range [0x00 - 0xef]. Conflicts
458 * will be detected when IRQ is claimed.
460 irq = (reg >> 12) & 0xff;
463 return SPAPR_IRQ_VIO | irq;
466 static void spapr_vio_busdev_realize(DeviceState *qdev, Error **errp)
468 SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
469 SpaprVioDevice *dev = (SpaprVioDevice *)qdev;
470 SpaprVioDeviceClass *pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
471 char *id;
472 Error *local_err = NULL;
474 if (dev->reg != -1) {
476 * Explicitly assigned address, just verify that no-one else
477 * is using it. other mechanism). We have to open code this
478 * rather than using spapr_vio_find_by_reg() because sdev
479 * itself is already in the list.
481 SpaprVioDevice *other = reg_conflict(dev);
483 if (other) {
484 error_setg(errp, "%s and %s devices conflict at address %#x",
485 object_get_typename(OBJECT(qdev)),
486 object_get_typename(OBJECT(&other->qdev)),
487 dev->reg);
488 return;
490 } else {
491 /* Need to assign an address */
492 SpaprVioBus *bus = SPAPR_VIO_BUS(dev->qdev.parent_bus);
494 do {
495 dev->reg = bus->next_reg++;
496 } while (reg_conflict(dev));
499 /* Don't overwrite ids assigned on the command line */
500 if (!dev->qdev.id) {
501 id = spapr_vio_get_dev_name(DEVICE(dev));
502 dev->qdev.id = id;
505 dev->irq = spapr_vio_reg_to_irq(dev->reg);
507 if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
508 dev->irq = spapr_irq_findone(spapr, &local_err);
509 if (local_err) {
510 error_propagate(errp, local_err);
511 return;
515 spapr_irq_claim(spapr, dev->irq, false, &local_err);
516 if (local_err) {
517 error_propagate(errp, local_err);
518 return;
521 if (pc->rtce_window_size) {
522 uint32_t liobn = SPAPR_VIO_LIOBN(dev->reg);
524 memory_region_init(&dev->mrroot, OBJECT(dev), "iommu-spapr-root",
525 ram_size);
526 memory_region_init_alias(&dev->mrbypass, OBJECT(dev),
527 "iommu-spapr-bypass", get_system_memory(),
528 0, ram_size);
529 memory_region_add_subregion_overlap(&dev->mrroot, 0, &dev->mrbypass, 1);
530 address_space_init(&dev->as, &dev->mrroot, qdev->id);
532 dev->tcet = spapr_tce_new_table(qdev, liobn);
533 spapr_tce_table_enable(dev->tcet, SPAPR_TCE_PAGE_SHIFT, 0,
534 pc->rtce_window_size >> SPAPR_TCE_PAGE_SHIFT);
535 dev->tcet->vdev = dev;
536 memory_region_add_subregion_overlap(&dev->mrroot, 0,
537 spapr_tce_get_iommu(dev->tcet), 2);
540 pc->realize(dev, errp);
543 static target_ulong h_vio_signal(PowerPCCPU *cpu, SpaprMachineState *spapr,
544 target_ulong opcode,
545 target_ulong *args)
547 target_ulong reg = args[0];
548 target_ulong mode = args[1];
549 SpaprVioDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
550 SpaprVioDeviceClass *pc;
552 if (!dev) {
553 return H_PARAMETER;
556 pc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
558 if (mode & ~pc->signal_mask) {
559 return H_PARAMETER;
562 dev->signal_state = mode;
564 return H_SUCCESS;
567 SpaprVioBus *spapr_vio_bus_init(void)
569 SpaprVioBus *bus;
570 BusState *qbus;
571 DeviceState *dev;
573 /* Create bridge device */
574 dev = qdev_create(NULL, TYPE_SPAPR_VIO_BRIDGE);
575 qdev_init_nofail(dev);
577 /* Create bus on bridge device */
578 qbus = qbus_create(TYPE_SPAPR_VIO_BUS, dev, "spapr-vio");
579 bus = SPAPR_VIO_BUS(qbus);
580 bus->next_reg = SPAPR_VIO_REG_BASE;
582 /* hcall-vio */
583 spapr_register_hypercall(H_VIO_SIGNAL, h_vio_signal);
585 /* hcall-crq */
586 spapr_register_hypercall(H_REG_CRQ, h_reg_crq);
587 spapr_register_hypercall(H_FREE_CRQ, h_free_crq);
588 spapr_register_hypercall(H_SEND_CRQ, h_send_crq);
589 spapr_register_hypercall(H_ENABLE_CRQ, h_enable_crq);
591 /* RTAS calls */
592 spapr_rtas_register(RTAS_IBM_SET_TCE_BYPASS, "ibm,set-tce-bypass",
593 rtas_set_tce_bypass);
594 spapr_rtas_register(RTAS_QUIESCE, "quiesce", rtas_quiesce);
596 return bus;
599 static void spapr_vio_bridge_class_init(ObjectClass *klass, void *data)
601 DeviceClass *dc = DEVICE_CLASS(klass);
603 dc->fw_name = "vdevice";
606 static const TypeInfo spapr_vio_bridge_info = {
607 .name = TYPE_SPAPR_VIO_BRIDGE,
608 .parent = TYPE_SYS_BUS_DEVICE,
609 .class_init = spapr_vio_bridge_class_init,
612 const VMStateDescription vmstate_spapr_vio = {
613 .name = "spapr_vio",
614 .version_id = 1,
615 .minimum_version_id = 1,
616 .fields = (VMStateField[]) {
617 /* Sanity check */
618 VMSTATE_UINT32_EQUAL(reg, SpaprVioDevice, NULL),
619 VMSTATE_UINT32_EQUAL(irq, SpaprVioDevice, NULL),
621 /* General VIO device state */
622 VMSTATE_UINT64(signal_state, SpaprVioDevice),
623 VMSTATE_UINT64(crq.qladdr, SpaprVioDevice),
624 VMSTATE_UINT32(crq.qsize, SpaprVioDevice),
625 VMSTATE_UINT32(crq.qnext, SpaprVioDevice),
627 VMSTATE_END_OF_LIST()
631 static void vio_spapr_device_class_init(ObjectClass *klass, void *data)
633 DeviceClass *k = DEVICE_CLASS(klass);
634 k->realize = spapr_vio_busdev_realize;
635 k->reset = spapr_vio_busdev_reset;
636 k->bus_type = TYPE_SPAPR_VIO_BUS;
639 static const TypeInfo spapr_vio_type_info = {
640 .name = TYPE_VIO_SPAPR_DEVICE,
641 .parent = TYPE_DEVICE,
642 .instance_size = sizeof(SpaprVioDevice),
643 .abstract = true,
644 .class_size = sizeof(SpaprVioDeviceClass),
645 .class_init = vio_spapr_device_class_init,
648 static void spapr_vio_register_types(void)
650 type_register_static(&spapr_vio_bus_info);
651 type_register_static(&spapr_vio_bridge_info);
652 type_register_static(&spapr_vio_type_info);
655 type_init(spapr_vio_register_types)
657 static int compare_reg(const void *p1, const void *p2)
659 SpaprVioDevice const *dev1, *dev2;
661 dev1 = (SpaprVioDevice *)*(DeviceState **)p1;
662 dev2 = (SpaprVioDevice *)*(DeviceState **)p2;
664 if (dev1->reg < dev2->reg) {
665 return -1;
667 if (dev1->reg == dev2->reg) {
668 return 0;
671 /* dev1->reg > dev2->reg */
672 return 1;
675 void spapr_dt_vdevice(SpaprVioBus *bus, void *fdt)
677 DeviceState *qdev, **qdevs;
678 BusChild *kid;
679 int i, num, ret = 0;
680 int node;
682 _FDT(node = fdt_add_subnode(fdt, 0, "vdevice"));
684 _FDT(fdt_setprop_string(fdt, node, "device_type", "vdevice"));
685 _FDT(fdt_setprop_string(fdt, node, "compatible", "IBM,vdevice"));
686 _FDT(fdt_setprop_cell(fdt, node, "#address-cells", 1));
687 _FDT(fdt_setprop_cell(fdt, node, "#size-cells", 0));
688 _FDT(fdt_setprop_cell(fdt, node, "#interrupt-cells", 2));
689 _FDT(fdt_setprop(fdt, node, "interrupt-controller", NULL, 0));
691 /* Count qdevs on the bus list */
692 num = 0;
693 QTAILQ_FOREACH(kid, &bus->bus.children, sibling) {
694 num++;
697 /* Copy out into an array of pointers */
698 qdevs = g_new(DeviceState *, num);
699 num = 0;
700 QTAILQ_FOREACH(kid, &bus->bus.children, sibling) {
701 qdevs[num++] = kid->child;
704 /* Sort the array */
705 qsort(qdevs, num, sizeof(qdev), compare_reg);
707 /* Hack alert. Give the devices to libfdt in reverse order, we happen
708 * to know that will mean they are in forward order in the tree. */
709 for (i = num - 1; i >= 0; i--) {
710 SpaprVioDevice *dev = (SpaprVioDevice *)(qdevs[i]);
711 SpaprVioDeviceClass *vdc = VIO_SPAPR_DEVICE_GET_CLASS(dev);
713 ret = vio_make_devnode(dev, fdt);
714 if (ret < 0) {
715 error_report("Couldn't create device node /vdevice/%s@%"PRIx32,
716 vdc->dt_name, dev->reg);
717 exit(1);
721 g_free(qdevs);
724 gchar *spapr_vio_stdout_path(SpaprVioBus *bus)
726 SpaprVioDevice *dev;
727 char *name, *path;
729 dev = spapr_vty_get_default(bus);
730 if (!dev) {
731 return NULL;
734 name = spapr_vio_get_dev_name(DEVICE(dev));
735 path = g_strdup_printf("/vdevice/%s", name);
737 g_free(name);
738 return path;