1 #include "qemu/osdep.h"
2 #include "qapi/error.h"
3 #include "sysemu/hw_accel.h"
4 #include "sysemu/runstate.h"
6 #include "qemu/main-loop.h"
7 #include "qemu/module.h"
8 #include "qemu/error-report.h"
10 #include "exec/exec-all.h"
11 #include "helper_regs.h"
12 #include "hw/ppc/spapr.h"
13 #include "hw/ppc/spapr_cpu_core.h"
14 #include "mmu-hash64.h"
15 #include "cpu-models.h"
18 #include "hw/ppc/spapr_ovec.h"
19 #include "mmu-book3s-v3.h"
20 #include "hw/mem/memory-device.h"
22 static bool has_spr(PowerPCCPU
*cpu
, int spr
)
24 /* We can test whether the SPR is defined by checking for a valid name */
25 return cpu
->env
.spr_cb
[spr
].name
!= NULL
;
28 static inline bool valid_ptex(PowerPCCPU
*cpu
, target_ulong ptex
)
31 * hash value/pteg group index is normalized by HPT mask
33 if (((ptex
& ~7ULL) / HPTES_PER_GROUP
) & ~ppc_hash64_hpt_mask(cpu
)) {
39 static bool is_ram_address(SpaprMachineState
*spapr
, hwaddr addr
)
41 MachineState
*machine
= MACHINE(spapr
);
42 DeviceMemoryState
*dms
= machine
->device_memory
;
44 if (addr
< machine
->ram_size
) {
47 if ((addr
>= dms
->base
)
48 && ((addr
- dms
->base
) < memory_region_size(&dms
->mr
))) {
55 static target_ulong
h_enter(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
56 target_ulong opcode
, target_ulong
*args
)
58 target_ulong flags
= args
[0];
59 target_ulong ptex
= args
[1];
60 target_ulong pteh
= args
[2];
61 target_ulong ptel
= args
[3];
65 const ppc_hash_pte64_t
*hptes
;
67 apshift
= ppc_hash64_hpte_page_shift_noslb(cpu
, pteh
, ptel
);
69 /* Bad page size encoding */
73 raddr
= (ptel
& HPTE64_R_RPN
) & ~((1ULL << apshift
) - 1);
75 if (is_ram_address(spapr
, raddr
)) {
76 /* Regular RAM - should have WIMG=0010 */
77 if ((ptel
& HPTE64_R_WIMG
) != HPTE64_R_M
) {
81 target_ulong wimg_flags
;
82 /* Looks like an IO address */
83 /* FIXME: What WIMG combinations could be sensible for IO?
84 * For now we allow WIMG=010x, but are there others? */
85 /* FIXME: Should we check against registered IO addresses? */
86 wimg_flags
= (ptel
& (HPTE64_R_W
| HPTE64_R_I
| HPTE64_R_M
));
88 if (wimg_flags
!= HPTE64_R_I
&&
89 wimg_flags
!= (HPTE64_R_I
| HPTE64_R_M
)) {
96 if (!valid_ptex(cpu
, ptex
)) {
103 if (likely((flags
& H_EXACT
) == 0)) {
104 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
105 for (slot
= 0; slot
< 8; slot
++) {
106 if (!(ppc_hash64_hpte0(cpu
, hptes
, slot
) & HPTE64_V_VALID
)) {
110 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
115 hptes
= ppc_hash64_map_hptes(cpu
, ptex
+ slot
, 1);
116 if (ppc_hash64_hpte0(cpu
, hptes
, 0) & HPTE64_V_VALID
) {
117 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
+ slot
, 1);
120 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
123 spapr_store_hpte(cpu
, ptex
+ slot
, pteh
| HPTE64_V_HPTE_DIRTY
, ptel
);
125 args
[0] = ptex
+ slot
;
131 REMOVE_NOT_FOUND
= 1,
136 static RemoveResult
remove_hpte(PowerPCCPU
*cpu
140 target_ulong
*vp
, target_ulong
*rp
)
142 const ppc_hash_pte64_t
*hptes
;
145 if (!valid_ptex(cpu
, ptex
)) {
149 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, 1);
150 v
= ppc_hash64_hpte0(cpu
, hptes
, 0);
151 r
= ppc_hash64_hpte1(cpu
, hptes
, 0);
152 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
154 if ((v
& HPTE64_V_VALID
) == 0 ||
155 ((flags
& H_AVPN
) && (v
& ~0x7fULL
) != avpn
) ||
156 ((flags
& H_ANDCOND
) && (v
& avpn
) != 0)) {
157 return REMOVE_NOT_FOUND
;
161 spapr_store_hpte(cpu
, ptex
, HPTE64_V_HPTE_DIRTY
, 0);
162 ppc_hash64_tlb_flush_hpte(cpu
, ptex
, v
, r
);
163 return REMOVE_SUCCESS
;
166 static target_ulong
h_remove(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
167 target_ulong opcode
, target_ulong
*args
)
169 CPUPPCState
*env
= &cpu
->env
;
170 target_ulong flags
= args
[0];
171 target_ulong ptex
= args
[1];
172 target_ulong avpn
= args
[2];
175 ret
= remove_hpte(cpu
, ptex
, avpn
, flags
,
180 check_tlb_flush(env
, true);
183 case REMOVE_NOT_FOUND
:
193 g_assert_not_reached();
196 #define H_BULK_REMOVE_TYPE 0xc000000000000000ULL
197 #define H_BULK_REMOVE_REQUEST 0x4000000000000000ULL
198 #define H_BULK_REMOVE_RESPONSE 0x8000000000000000ULL
199 #define H_BULK_REMOVE_END 0xc000000000000000ULL
200 #define H_BULK_REMOVE_CODE 0x3000000000000000ULL
201 #define H_BULK_REMOVE_SUCCESS 0x0000000000000000ULL
202 #define H_BULK_REMOVE_NOT_FOUND 0x1000000000000000ULL
203 #define H_BULK_REMOVE_PARM 0x2000000000000000ULL
204 #define H_BULK_REMOVE_HW 0x3000000000000000ULL
205 #define H_BULK_REMOVE_RC 0x0c00000000000000ULL
206 #define H_BULK_REMOVE_FLAGS 0x0300000000000000ULL
207 #define H_BULK_REMOVE_ABSOLUTE 0x0000000000000000ULL
208 #define H_BULK_REMOVE_ANDCOND 0x0100000000000000ULL
209 #define H_BULK_REMOVE_AVPN 0x0200000000000000ULL
210 #define H_BULK_REMOVE_PTEX 0x00ffffffffffffffULL
212 #define H_BULK_REMOVE_MAX_BATCH 4
214 static target_ulong
h_bulk_remove(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
215 target_ulong opcode
, target_ulong
*args
)
217 CPUPPCState
*env
= &cpu
->env
;
219 target_ulong rc
= H_SUCCESS
;
221 for (i
= 0; i
< H_BULK_REMOVE_MAX_BATCH
; i
++) {
222 target_ulong
*tsh
= &args
[i
*2];
223 target_ulong tsl
= args
[i
*2 + 1];
224 target_ulong v
, r
, ret
;
226 if ((*tsh
& H_BULK_REMOVE_TYPE
) == H_BULK_REMOVE_END
) {
228 } else if ((*tsh
& H_BULK_REMOVE_TYPE
) != H_BULK_REMOVE_REQUEST
) {
232 *tsh
&= H_BULK_REMOVE_PTEX
| H_BULK_REMOVE_FLAGS
;
233 *tsh
|= H_BULK_REMOVE_RESPONSE
;
235 if ((*tsh
& H_BULK_REMOVE_ANDCOND
) && (*tsh
& H_BULK_REMOVE_AVPN
)) {
236 *tsh
|= H_BULK_REMOVE_PARM
;
240 ret
= remove_hpte(cpu
, *tsh
& H_BULK_REMOVE_PTEX
, tsl
,
241 (*tsh
& H_BULK_REMOVE_FLAGS
) >> 26,
248 *tsh
|= (r
& (HPTE64_R_C
| HPTE64_R_R
)) << 43;
261 check_tlb_flush(env
, true);
266 static target_ulong
h_protect(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
267 target_ulong opcode
, target_ulong
*args
)
269 CPUPPCState
*env
= &cpu
->env
;
270 target_ulong flags
= args
[0];
271 target_ulong ptex
= args
[1];
272 target_ulong avpn
= args
[2];
273 const ppc_hash_pte64_t
*hptes
;
276 if (!valid_ptex(cpu
, ptex
)) {
280 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, 1);
281 v
= ppc_hash64_hpte0(cpu
, hptes
, 0);
282 r
= ppc_hash64_hpte1(cpu
, hptes
, 0);
283 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, 1);
285 if ((v
& HPTE64_V_VALID
) == 0 ||
286 ((flags
& H_AVPN
) && (v
& ~0x7fULL
) != avpn
)) {
290 r
&= ~(HPTE64_R_PP0
| HPTE64_R_PP
| HPTE64_R_N
|
291 HPTE64_R_KEY_HI
| HPTE64_R_KEY_LO
);
292 r
|= (flags
<< 55) & HPTE64_R_PP0
;
293 r
|= (flags
<< 48) & HPTE64_R_KEY_HI
;
294 r
|= flags
& (HPTE64_R_PP
| HPTE64_R_N
| HPTE64_R_KEY_LO
);
295 spapr_store_hpte(cpu
, ptex
,
296 (v
& ~HPTE64_V_VALID
) | HPTE64_V_HPTE_DIRTY
, 0);
297 ppc_hash64_tlb_flush_hpte(cpu
, ptex
, v
, r
);
299 check_tlb_flush(env
, true);
300 /* Don't need a memory barrier, due to qemu's global lock */
301 spapr_store_hpte(cpu
, ptex
, v
| HPTE64_V_HPTE_DIRTY
, r
);
305 static target_ulong
h_read(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
306 target_ulong opcode
, target_ulong
*args
)
308 target_ulong flags
= args
[0];
309 target_ulong ptex
= args
[1];
310 int i
, ridx
, n_entries
= 1;
311 const ppc_hash_pte64_t
*hptes
;
313 if (!valid_ptex(cpu
, ptex
)) {
317 if (flags
& H_READ_4
) {
318 /* Clear the two low order bits */
323 hptes
= ppc_hash64_map_hptes(cpu
, ptex
, n_entries
);
324 for (i
= 0, ridx
= 0; i
< n_entries
; i
++) {
325 args
[ridx
++] = ppc_hash64_hpte0(cpu
, hptes
, i
);
326 args
[ridx
++] = ppc_hash64_hpte1(cpu
, hptes
, i
);
328 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, n_entries
);
333 struct SpaprPendingHpt
{
334 /* These fields are read-only after initialization */
338 /* These fields are protected by the BQL */
341 /* These fields are private to the preparation thread if
342 * !complete, otherwise protected by the BQL */
347 static void free_pending_hpt(SpaprPendingHpt
*pending
)
350 qemu_vfree(pending
->hpt
);
356 static void *hpt_prepare_thread(void *opaque
)
358 SpaprPendingHpt
*pending
= opaque
;
359 size_t size
= 1ULL << pending
->shift
;
361 pending
->hpt
= qemu_memalign(size
, size
);
363 memset(pending
->hpt
, 0, size
);
364 pending
->ret
= H_SUCCESS
;
366 pending
->ret
= H_NO_MEM
;
369 qemu_mutex_lock_iothread();
371 if (SPAPR_MACHINE(qdev_get_machine())->pending_hpt
== pending
) {
373 pending
->complete
= true;
375 /* We've been cancelled, clean ourselves up */
376 free_pending_hpt(pending
);
379 qemu_mutex_unlock_iothread();
383 /* Must be called with BQL held */
384 static void cancel_hpt_prepare(SpaprMachineState
*spapr
)
386 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
388 /* Let the thread know it's cancelled */
389 spapr
->pending_hpt
= NULL
;
396 if (!pending
->complete
) {
397 /* thread will clean itself up */
401 free_pending_hpt(pending
);
404 /* Convert a return code from the KVM ioctl()s implementing resize HPT
405 * into a PAPR hypercall return code */
406 static target_ulong
resize_hpt_convert_rc(int ret
)
409 return H_LONG_BUSY_ORDER_100_SEC
;
410 } else if (ret
>= 10000) {
411 return H_LONG_BUSY_ORDER_10_SEC
;
412 } else if (ret
>= 1000) {
413 return H_LONG_BUSY_ORDER_1_SEC
;
414 } else if (ret
>= 100) {
415 return H_LONG_BUSY_ORDER_100_MSEC
;
416 } else if (ret
>= 10) {
417 return H_LONG_BUSY_ORDER_10_MSEC
;
418 } else if (ret
> 0) {
419 return H_LONG_BUSY_ORDER_1_MSEC
;
442 static target_ulong
h_resize_hpt_prepare(PowerPCCPU
*cpu
,
443 SpaprMachineState
*spapr
,
447 target_ulong flags
= args
[0];
449 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
450 uint64_t current_ram_size
;
453 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
457 if (!spapr
->htab_shift
) {
458 /* Radix guest, no HPT */
459 return H_NOT_AVAILABLE
;
462 trace_spapr_h_resize_hpt_prepare(flags
, shift
);
468 if (shift
&& ((shift
< 18) || (shift
> 46))) {
472 current_ram_size
= MACHINE(spapr
)->ram_size
+ get_plugged_memory_size();
474 /* We only allow the guest to allocate an HPT one order above what
475 * we'd normally give them (to stop a small guest claiming a huge
476 * chunk of resources in the HPT */
477 if (shift
> (spapr_hpt_shift_for_ramsize(current_ram_size
) + 1)) {
481 rc
= kvmppc_resize_hpt_prepare(cpu
, flags
, shift
);
483 return resize_hpt_convert_rc(rc
);
487 /* something already in progress */
488 if (pending
->shift
== shift
) {
489 /* and it's suitable */
490 if (pending
->complete
) {
493 return H_LONG_BUSY_ORDER_100_MSEC
;
497 /* not suitable, cancel and replace */
498 cancel_hpt_prepare(spapr
);
506 /* start new prepare */
508 pending
= g_new0(SpaprPendingHpt
, 1);
509 pending
->shift
= shift
;
510 pending
->ret
= H_HARDWARE
;
512 qemu_thread_create(&pending
->thread
, "sPAPR HPT prepare",
513 hpt_prepare_thread
, pending
, QEMU_THREAD_DETACHED
);
515 spapr
->pending_hpt
= pending
;
517 /* In theory we could estimate the time more accurately based on
518 * the new size, but there's not much point */
519 return H_LONG_BUSY_ORDER_100_MSEC
;
522 static uint64_t new_hpte_load0(void *htab
, uint64_t pteg
, int slot
)
524 uint8_t *addr
= htab
;
526 addr
+= pteg
* HASH_PTEG_SIZE_64
;
527 addr
+= slot
* HASH_PTE_SIZE_64
;
531 static void new_hpte_store(void *htab
, uint64_t pteg
, int slot
,
532 uint64_t pte0
, uint64_t pte1
)
534 uint8_t *addr
= htab
;
536 addr
+= pteg
* HASH_PTEG_SIZE_64
;
537 addr
+= slot
* HASH_PTE_SIZE_64
;
540 stq_p(addr
+ HASH_PTE_SIZE_64
/ 2, pte1
);
543 static int rehash_hpte(PowerPCCPU
*cpu
,
544 const ppc_hash_pte64_t
*hptes
,
545 void *old_hpt
, uint64_t oldsize
,
546 void *new_hpt
, uint64_t newsize
,
547 uint64_t pteg
, int slot
)
549 uint64_t old_hash_mask
= (oldsize
>> 7) - 1;
550 uint64_t new_hash_mask
= (newsize
>> 7) - 1;
551 target_ulong pte0
= ppc_hash64_hpte0(cpu
, hptes
, slot
);
554 unsigned base_pg_shift
;
555 uint64_t hash
, new_pteg
, replace_pte0
;
557 if (!(pte0
& HPTE64_V_VALID
) || !(pte0
& HPTE64_V_BOLTED
)) {
561 pte1
= ppc_hash64_hpte1(cpu
, hptes
, slot
);
563 base_pg_shift
= ppc_hash64_hpte_page_shift_noslb(cpu
, pte0
, pte1
);
564 assert(base_pg_shift
); /* H_ENTER shouldn't allow a bad encoding */
565 avpn
= HPTE64_V_AVPN_VAL(pte0
) & ~(((1ULL << base_pg_shift
) - 1) >> 23);
567 if (pte0
& HPTE64_V_SECONDARY
) {
571 if ((pte0
& HPTE64_V_SSIZE
) == HPTE64_V_SSIZE_256M
) {
572 uint64_t offset
, vsid
;
574 /* We only have 28 - 23 bits of offset in avpn */
575 offset
= (avpn
& 0x1f) << 23;
577 /* We can find more bits from the pteg value */
578 if (base_pg_shift
< 23) {
579 offset
|= ((vsid
^ pteg
) & old_hash_mask
) << base_pg_shift
;
582 hash
= vsid
^ (offset
>> base_pg_shift
);
583 } else if ((pte0
& HPTE64_V_SSIZE
) == HPTE64_V_SSIZE_1T
) {
584 uint64_t offset
, vsid
;
586 /* We only have 40 - 23 bits of seg_off in avpn */
587 offset
= (avpn
& 0x1ffff) << 23;
589 if (base_pg_shift
< 23) {
590 offset
|= ((vsid
^ (vsid
<< 25) ^ pteg
) & old_hash_mask
)
594 hash
= vsid
^ (vsid
<< 25) ^ (offset
>> base_pg_shift
);
596 error_report("rehash_pte: Bad segment size in HPTE");
600 new_pteg
= hash
& new_hash_mask
;
601 if (pte0
& HPTE64_V_SECONDARY
) {
602 assert(~pteg
== (hash
& old_hash_mask
));
603 new_pteg
= ~new_pteg
;
605 assert(pteg
== (hash
& old_hash_mask
));
607 assert((oldsize
!= newsize
) || (pteg
== new_pteg
));
608 replace_pte0
= new_hpte_load0(new_hpt
, new_pteg
, slot
);
610 * Strictly speaking, we don't need all these tests, since we only
611 * ever rehash bolted HPTEs. We might in future handle non-bolted
612 * HPTEs, though so make the logic correct for those cases as
615 if (replace_pte0
& HPTE64_V_VALID
) {
616 assert(newsize
< oldsize
);
617 if (replace_pte0
& HPTE64_V_BOLTED
) {
618 if (pte0
& HPTE64_V_BOLTED
) {
619 /* Bolted collision, nothing we can do */
622 /* Discard this hpte */
628 new_hpte_store(new_hpt
, new_pteg
, slot
, pte0
, pte1
);
632 static int rehash_hpt(PowerPCCPU
*cpu
,
633 void *old_hpt
, uint64_t oldsize
,
634 void *new_hpt
, uint64_t newsize
)
636 uint64_t n_ptegs
= oldsize
>> 7;
641 for (pteg
= 0; pteg
< n_ptegs
; pteg
++) {
642 hwaddr ptex
= pteg
* HPTES_PER_GROUP
;
643 const ppc_hash_pte64_t
*hptes
644 = ppc_hash64_map_hptes(cpu
, ptex
, HPTES_PER_GROUP
);
650 for (slot
= 0; slot
< HPTES_PER_GROUP
; slot
++) {
651 rc
= rehash_hpte(cpu
, hptes
, old_hpt
, oldsize
, new_hpt
, newsize
,
653 if (rc
!= H_SUCCESS
) {
654 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
658 ppc_hash64_unmap_hptes(cpu
, hptes
, ptex
, HPTES_PER_GROUP
);
664 static void do_push_sregs_to_kvm_pr(CPUState
*cs
, run_on_cpu_data data
)
668 cpu_synchronize_state(cs
);
670 ret
= kvmppc_put_books_sregs(POWERPC_CPU(cs
));
672 error_report("failed to push sregs to KVM: %s", strerror(-ret
));
677 static void push_sregs_to_kvm_pr(SpaprMachineState
*spapr
)
682 * This is a hack for the benefit of KVM PR - it abuses the SDR1
683 * slot in kvm_sregs to communicate the userspace address of the
686 if (!kvm_enabled() || !spapr
->htab
) {
691 run_on_cpu(cs
, do_push_sregs_to_kvm_pr
, RUN_ON_CPU_NULL
);
695 static target_ulong
h_resize_hpt_commit(PowerPCCPU
*cpu
,
696 SpaprMachineState
*spapr
,
700 target_ulong flags
= args
[0];
701 target_ulong shift
= args
[1];
702 SpaprPendingHpt
*pending
= spapr
->pending_hpt
;
706 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_DISABLED
) {
710 if (!spapr
->htab_shift
) {
711 /* Radix guest, no HPT */
712 return H_NOT_AVAILABLE
;
715 trace_spapr_h_resize_hpt_commit(flags
, shift
);
717 rc
= kvmppc_resize_hpt_commit(cpu
, flags
, shift
);
719 rc
= resize_hpt_convert_rc(rc
);
720 if (rc
== H_SUCCESS
) {
721 /* Need to set the new htab_shift in the machine state */
722 spapr
->htab_shift
= shift
;
731 if (!pending
|| (pending
->shift
!= shift
)) {
732 /* no matching prepare */
736 if (!pending
->complete
) {
737 /* prepare has not completed */
741 /* Shouldn't have got past PREPARE without an HPT */
742 g_assert(spapr
->htab_shift
);
744 newsize
= 1ULL << pending
->shift
;
745 rc
= rehash_hpt(cpu
, spapr
->htab
, HTAB_SIZE(spapr
),
746 pending
->hpt
, newsize
);
747 if (rc
== H_SUCCESS
) {
748 qemu_vfree(spapr
->htab
);
749 spapr
->htab
= pending
->hpt
;
750 spapr
->htab_shift
= pending
->shift
;
752 push_sregs_to_kvm_pr(spapr
);
754 pending
->hpt
= NULL
; /* so it's not free()d */
758 spapr
->pending_hpt
= NULL
;
759 free_pending_hpt(pending
);
764 static target_ulong
h_set_sprg0(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
765 target_ulong opcode
, target_ulong
*args
)
767 cpu_synchronize_state(CPU(cpu
));
768 cpu
->env
.spr
[SPR_SPRG0
] = args
[0];
773 static target_ulong
h_set_dabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
774 target_ulong opcode
, target_ulong
*args
)
776 if (!has_spr(cpu
, SPR_DABR
)) {
777 return H_HARDWARE
; /* DABR register not available */
779 cpu_synchronize_state(CPU(cpu
));
781 if (has_spr(cpu
, SPR_DABRX
)) {
782 cpu
->env
.spr
[SPR_DABRX
] = 0x3; /* Use Problem and Privileged state */
783 } else if (!(args
[0] & 0x4)) { /* Breakpoint Translation set? */
784 return H_RESERVED_DABR
;
787 cpu
->env
.spr
[SPR_DABR
] = args
[0];
791 static target_ulong
h_set_xdabr(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
792 target_ulong opcode
, target_ulong
*args
)
794 target_ulong dabrx
= args
[1];
796 if (!has_spr(cpu
, SPR_DABR
) || !has_spr(cpu
, SPR_DABRX
)) {
800 if ((dabrx
& ~0xfULL
) != 0 || (dabrx
& H_DABRX_HYPERVISOR
) != 0
801 || (dabrx
& (H_DABRX_KERNEL
| H_DABRX_USER
)) == 0) {
805 cpu_synchronize_state(CPU(cpu
));
806 cpu
->env
.spr
[SPR_DABRX
] = dabrx
;
807 cpu
->env
.spr
[SPR_DABR
] = args
[0];
812 static target_ulong
h_page_init(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
813 target_ulong opcode
, target_ulong
*args
)
815 target_ulong flags
= args
[0];
816 hwaddr dst
= args
[1];
817 hwaddr src
= args
[2];
818 hwaddr len
= TARGET_PAGE_SIZE
;
819 uint8_t *pdst
, *psrc
;
820 target_long ret
= H_SUCCESS
;
822 if (flags
& ~(H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
823 | H_COPY_PAGE
| H_ZERO_PAGE
)) {
824 qemu_log_mask(LOG_UNIMP
, "h_page_init: Bad flags (" TARGET_FMT_lx
"\n",
829 /* Map-in destination */
830 if (!is_ram_address(spapr
, dst
) || (dst
& ~TARGET_PAGE_MASK
) != 0) {
833 pdst
= cpu_physical_memory_map(dst
, &len
, 1);
834 if (!pdst
|| len
!= TARGET_PAGE_SIZE
) {
838 if (flags
& H_COPY_PAGE
) {
839 /* Map-in source, copy to destination, and unmap source again */
840 if (!is_ram_address(spapr
, src
) || (src
& ~TARGET_PAGE_MASK
) != 0) {
844 psrc
= cpu_physical_memory_map(src
, &len
, 0);
845 if (!psrc
|| len
!= TARGET_PAGE_SIZE
) {
849 memcpy(pdst
, psrc
, len
);
850 cpu_physical_memory_unmap(psrc
, len
, 0, len
);
851 } else if (flags
& H_ZERO_PAGE
) {
852 memset(pdst
, 0, len
); /* Just clear the destination page */
855 if (kvm_enabled() && (flags
& H_ICACHE_SYNCHRONIZE
) != 0) {
856 kvmppc_dcbst_range(cpu
, pdst
, len
);
858 if (flags
& (H_ICACHE_SYNCHRONIZE
| H_ICACHE_INVALIDATE
)) {
860 kvmppc_icbi_range(cpu
, pdst
, len
);
867 cpu_physical_memory_unmap(pdst
, TARGET_PAGE_SIZE
, 1, len
);
871 #define FLAGS_REGISTER_VPA 0x0000200000000000ULL
872 #define FLAGS_REGISTER_DTL 0x0000400000000000ULL
873 #define FLAGS_REGISTER_SLBSHADOW 0x0000600000000000ULL
874 #define FLAGS_DEREGISTER_VPA 0x0000a00000000000ULL
875 #define FLAGS_DEREGISTER_DTL 0x0000c00000000000ULL
876 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
878 static target_ulong
register_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
880 CPUState
*cs
= CPU(cpu
);
881 CPUPPCState
*env
= &cpu
->env
;
882 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
887 hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
891 if (vpa
% env
->dcache_line_size
) {
894 /* FIXME: bounds check the address */
896 size
= lduw_be_phys(cs
->as
, vpa
+ 0x4);
898 if (size
< VPA_MIN_SIZE
) {
902 /* VPA is not allowed to cross a page boundary */
903 if ((vpa
/ 4096) != ((vpa
+ size
- 1) / 4096)) {
907 spapr_cpu
->vpa_addr
= vpa
;
909 tmp
= ldub_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
);
910 tmp
|= VPA_SHARED_PROC_VAL
;
911 stb_phys(cs
->as
, spapr_cpu
->vpa_addr
+ VPA_SHARED_PROC_OFFSET
, tmp
);
916 static target_ulong
deregister_vpa(PowerPCCPU
*cpu
, target_ulong vpa
)
918 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
920 if (spapr_cpu
->slb_shadow_addr
) {
924 if (spapr_cpu
->dtl_addr
) {
928 spapr_cpu
->vpa_addr
= 0;
932 static target_ulong
register_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
934 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
938 hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
942 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
947 if ((addr
/ 4096) != ((addr
+ size
- 1) / 4096)) {
951 if (!spapr_cpu
->vpa_addr
) {
955 spapr_cpu
->slb_shadow_addr
= addr
;
956 spapr_cpu
->slb_shadow_size
= size
;
961 static target_ulong
deregister_slb_shadow(PowerPCCPU
*cpu
, target_ulong addr
)
963 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
965 spapr_cpu
->slb_shadow_addr
= 0;
966 spapr_cpu
->slb_shadow_size
= 0;
970 static target_ulong
register_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
972 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
976 hcall_dprintf("Can't cope with DTL at logical 0\n");
980 size
= ldl_be_phys(CPU(cpu
)->as
, addr
+ 0x4);
986 if (!spapr_cpu
->vpa_addr
) {
990 spapr_cpu
->dtl_addr
= addr
;
991 spapr_cpu
->dtl_size
= size
;
996 static target_ulong
deregister_dtl(PowerPCCPU
*cpu
, target_ulong addr
)
998 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1000 spapr_cpu
->dtl_addr
= 0;
1001 spapr_cpu
->dtl_size
= 0;
1006 static target_ulong
h_register_vpa(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1007 target_ulong opcode
, target_ulong
*args
)
1009 target_ulong flags
= args
[0];
1010 target_ulong procno
= args
[1];
1011 target_ulong vpa
= args
[2];
1012 target_ulong ret
= H_PARAMETER
;
1015 tcpu
= spapr_find_cpu(procno
);
1021 case FLAGS_REGISTER_VPA
:
1022 ret
= register_vpa(tcpu
, vpa
);
1025 case FLAGS_DEREGISTER_VPA
:
1026 ret
= deregister_vpa(tcpu
, vpa
);
1029 case FLAGS_REGISTER_SLBSHADOW
:
1030 ret
= register_slb_shadow(tcpu
, vpa
);
1033 case FLAGS_DEREGISTER_SLBSHADOW
:
1034 ret
= deregister_slb_shadow(tcpu
, vpa
);
1037 case FLAGS_REGISTER_DTL
:
1038 ret
= register_dtl(tcpu
, vpa
);
1041 case FLAGS_DEREGISTER_DTL
:
1042 ret
= deregister_dtl(tcpu
, vpa
);
1049 static target_ulong
h_cede(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1050 target_ulong opcode
, target_ulong
*args
)
1052 CPUPPCState
*env
= &cpu
->env
;
1053 CPUState
*cs
= CPU(cpu
);
1054 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1056 env
->msr
|= (1ULL << MSR_EE
);
1057 hreg_compute_hflags(env
);
1059 if (spapr_cpu
->prod
) {
1060 spapr_cpu
->prod
= false;
1064 if (!cpu_has_work(cs
)) {
1066 cs
->exception_index
= EXCP_HLT
;
1067 cs
->exit_request
= 1;
1074 * Confer to self, aka join. Cede could use the same pattern as well, if
1075 * EXCP_HLT can be changed to ECXP_HALTED.
1077 static target_ulong
h_confer_self(PowerPCCPU
*cpu
)
1079 CPUState
*cs
= CPU(cpu
);
1080 SpaprCpuState
*spapr_cpu
= spapr_cpu_state(cpu
);
1082 if (spapr_cpu
->prod
) {
1083 spapr_cpu
->prod
= false;
1087 cs
->exception_index
= EXCP_HALTED
;
1088 cs
->exit_request
= 1;
1093 static target_ulong
h_join(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1094 target_ulong opcode
, target_ulong
*args
)
1096 CPUPPCState
*env
= &cpu
->env
;
1098 bool last_unjoined
= true;
1100 if (env
->msr
& (1ULL << MSR_EE
)) {
1105 * Must not join the last CPU running. Interestingly, no such restriction
1106 * for H_CONFER-to-self, but that is probably not intended to be used
1107 * when H_JOIN is available.
1110 PowerPCCPU
*c
= POWERPC_CPU(cs
);
1111 CPUPPCState
*e
= &c
->env
;
1116 /* Don't have a way to indicate joined, so use halted && MSR[EE]=0 */
1117 if (!cs
->halted
|| (e
->msr
& (1ULL << MSR_EE
))) {
1118 last_unjoined
= false;
1122 if (last_unjoined
) {
1126 return h_confer_self(cpu
);
1129 static target_ulong
h_confer(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1130 target_ulong opcode
, target_ulong
*args
)
1132 target_long target
= args
[0];
1133 uint32_t dispatch
= args
[1];
1134 CPUState
*cs
= CPU(cpu
);
1135 SpaprCpuState
*spapr_cpu
;
1138 * -1 means confer to all other CPUs without dispatch counter check,
1139 * otherwise it's a targeted confer.
1142 PowerPCCPU
*target_cpu
= spapr_find_cpu(target
);
1143 uint32_t target_dispatch
;
1150 * target == self is a special case, we wait until prodded, without
1151 * dispatch counter check.
1153 if (cpu
== target_cpu
) {
1154 return h_confer_self(cpu
);
1157 spapr_cpu
= spapr_cpu_state(target_cpu
);
1158 if (!spapr_cpu
->vpa_addr
|| ((dispatch
& 1) == 0)) {
1162 target_dispatch
= ldl_be_phys(cs
->as
,
1163 spapr_cpu
->vpa_addr
+ VPA_DISPATCH_COUNTER
);
1164 if (target_dispatch
!= dispatch
) {
1169 * The targeted confer does not do anything special beyond yielding
1170 * the current vCPU, but even this should be better than nothing.
1171 * At least for single-threaded tcg, it gives the target a chance to
1172 * run before we run again. Multi-threaded tcg does not really do
1173 * anything with EXCP_YIELD yet.
1177 cs
->exception_index
= EXCP_YIELD
;
1178 cs
->exit_request
= 1;
1184 static target_ulong
h_prod(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1185 target_ulong opcode
, target_ulong
*args
)
1187 target_long target
= args
[0];
1190 SpaprCpuState
*spapr_cpu
;
1192 tcpu
= spapr_find_cpu(target
);
1198 spapr_cpu
= spapr_cpu_state(tcpu
);
1199 spapr_cpu
->prod
= true;
1206 static target_ulong
h_rtas(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1207 target_ulong opcode
, target_ulong
*args
)
1209 target_ulong rtas_r3
= args
[0];
1210 uint32_t token
= rtas_ld(rtas_r3
, 0);
1211 uint32_t nargs
= rtas_ld(rtas_r3
, 1);
1212 uint32_t nret
= rtas_ld(rtas_r3
, 2);
1214 return spapr_rtas_call(cpu
, spapr
, token
, nargs
, rtas_r3
+ 12,
1215 nret
, rtas_r3
+ 12 + 4*nargs
);
1218 static target_ulong
h_logical_load(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1219 target_ulong opcode
, target_ulong
*args
)
1221 CPUState
*cs
= CPU(cpu
);
1222 target_ulong size
= args
[0];
1223 target_ulong addr
= args
[1];
1227 args
[0] = ldub_phys(cs
->as
, addr
);
1230 args
[0] = lduw_phys(cs
->as
, addr
);
1233 args
[0] = ldl_phys(cs
->as
, addr
);
1236 args
[0] = ldq_phys(cs
->as
, addr
);
1242 static target_ulong
h_logical_store(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1243 target_ulong opcode
, target_ulong
*args
)
1245 CPUState
*cs
= CPU(cpu
);
1247 target_ulong size
= args
[0];
1248 target_ulong addr
= args
[1];
1249 target_ulong val
= args
[2];
1253 stb_phys(cs
->as
, addr
, val
);
1256 stw_phys(cs
->as
, addr
, val
);
1259 stl_phys(cs
->as
, addr
, val
);
1262 stq_phys(cs
->as
, addr
, val
);
1268 static target_ulong
h_logical_memop(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1269 target_ulong opcode
, target_ulong
*args
)
1271 CPUState
*cs
= CPU(cpu
);
1273 target_ulong dst
= args
[0]; /* Destination address */
1274 target_ulong src
= args
[1]; /* Source address */
1275 target_ulong esize
= args
[2]; /* Element size (0=1,1=2,2=4,3=8) */
1276 target_ulong count
= args
[3]; /* Element count */
1277 target_ulong op
= args
[4]; /* 0 = copy, 1 = invert */
1279 unsigned int mask
= (1 << esize
) - 1;
1280 int step
= 1 << esize
;
1282 if (count
> 0x80000000) {
1286 if ((dst
& mask
) || (src
& mask
) || (op
> 1)) {
1290 if (dst
>= src
&& dst
< (src
+ (count
<< esize
))) {
1291 dst
= dst
+ ((count
- 1) << esize
);
1292 src
= src
+ ((count
- 1) << esize
);
1299 tmp
= ldub_phys(cs
->as
, src
);
1302 tmp
= lduw_phys(cs
->as
, src
);
1305 tmp
= ldl_phys(cs
->as
, src
);
1308 tmp
= ldq_phys(cs
->as
, src
);
1318 stb_phys(cs
->as
, dst
, tmp
);
1321 stw_phys(cs
->as
, dst
, tmp
);
1324 stl_phys(cs
->as
, dst
, tmp
);
1327 stq_phys(cs
->as
, dst
, tmp
);
1337 static target_ulong
h_logical_icbi(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1338 target_ulong opcode
, target_ulong
*args
)
1340 /* Nothing to do on emulation, KVM will trap this in the kernel */
1344 static target_ulong
h_logical_dcbf(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1345 target_ulong opcode
, target_ulong
*args
)
1347 /* Nothing to do on emulation, KVM will trap this in the kernel */
1351 static target_ulong
h_set_mode_resource_le(PowerPCCPU
*cpu
,
1352 target_ulong mflags
,
1353 target_ulong value1
,
1354 target_ulong value2
)
1364 case H_SET_MODE_ENDIAN_BIG
:
1365 spapr_set_all_lpcrs(0, LPCR_ILE
);
1366 spapr_pci_switch_vga(true);
1369 case H_SET_MODE_ENDIAN_LITTLE
:
1370 spapr_set_all_lpcrs(LPCR_ILE
, LPCR_ILE
);
1371 spapr_pci_switch_vga(false);
1375 return H_UNSUPPORTED_FLAG
;
1378 static target_ulong
h_set_mode_resource_addr_trans_mode(PowerPCCPU
*cpu
,
1379 target_ulong mflags
,
1380 target_ulong value1
,
1381 target_ulong value2
)
1383 PowerPCCPUClass
*pcc
= POWERPC_CPU_GET_CLASS(cpu
);
1385 if (!(pcc
->insns_flags2
& PPC2_ISA207S
)) {
1395 if (mflags
== AIL_RESERVED
) {
1396 return H_UNSUPPORTED_FLAG
;
1399 spapr_set_all_lpcrs(mflags
<< LPCR_AIL_SHIFT
, LPCR_AIL
);
1404 static target_ulong
h_set_mode(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1405 target_ulong opcode
, target_ulong
*args
)
1407 target_ulong resource
= args
[1];
1408 target_ulong ret
= H_P2
;
1411 case H_SET_MODE_RESOURCE_LE
:
1412 ret
= h_set_mode_resource_le(cpu
, args
[0], args
[2], args
[3]);
1414 case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE
:
1415 ret
= h_set_mode_resource_addr_trans_mode(cpu
, args
[0],
1423 static target_ulong
h_clean_slb(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1424 target_ulong opcode
, target_ulong
*args
)
1426 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
1427 opcode
, " (H_CLEAN_SLB)");
1431 static target_ulong
h_invalidate_pid(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1432 target_ulong opcode
, target_ulong
*args
)
1434 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx
"%s\n",
1435 opcode
, " (H_INVALIDATE_PID)");
1439 static void spapr_check_setup_free_hpt(SpaprMachineState
*spapr
,
1440 uint64_t patbe_old
, uint64_t patbe_new
)
1443 * We have 4 Options:
1444 * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
1445 * HASH->RADIX : Free HPT
1446 * RADIX->HASH : Allocate HPT
1447 * NOTHING->HASH : Allocate HPT
1448 * Note: NOTHING implies the case where we said the guest could choose
1449 * later and so assumed radix and now it's called H_REG_PROC_TBL
1452 if ((patbe_old
& PATE1_GR
) == (patbe_new
& PATE1_GR
)) {
1453 /* We assume RADIX, so this catches all the "Do Nothing" cases */
1454 } else if (!(patbe_old
& PATE1_GR
)) {
1455 /* HASH->RADIX : Free HPT */
1456 spapr_free_hpt(spapr
);
1457 } else if (!(patbe_new
& PATE1_GR
)) {
1458 /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
1459 spapr_setup_hpt_and_vrma(spapr
);
1464 #define FLAGS_MASK 0x01FULL
1465 #define FLAG_MODIFY 0x10
1466 #define FLAG_REGISTER 0x08
1467 #define FLAG_RADIX 0x04
1468 #define FLAG_HASH_PROC_TBL 0x02
1469 #define FLAG_GTSE 0x01
1471 static target_ulong
h_register_process_table(PowerPCCPU
*cpu
,
1472 SpaprMachineState
*spapr
,
1473 target_ulong opcode
,
1476 target_ulong flags
= args
[0];
1477 target_ulong proc_tbl
= args
[1];
1478 target_ulong page_size
= args
[2];
1479 target_ulong table_size
= args
[3];
1480 target_ulong update_lpcr
= 0;
1483 if (flags
& ~FLAGS_MASK
) { /* Check no reserved bits are set */
1486 if (flags
& FLAG_MODIFY
) {
1487 if (flags
& FLAG_REGISTER
) {
1488 if (flags
& FLAG_RADIX
) { /* Register new RADIX process table */
1489 if (proc_tbl
& 0xfff || proc_tbl
>> 60) {
1491 } else if (page_size
) {
1493 } else if (table_size
> 24) {
1496 cproc
= PATE1_GR
| proc_tbl
| table_size
;
1497 } else { /* Register new HPT process table */
1498 if (flags
& FLAG_HASH_PROC_TBL
) { /* Hash with Segment Tables */
1499 /* TODO - Not Supported */
1500 /* Technically caused by flag bits => H_PARAMETER */
1502 } else { /* Hash with SLB */
1503 if (proc_tbl
>> 38) {
1505 } else if (page_size
& ~0x7) {
1507 } else if (table_size
> 24) {
1511 cproc
= (proc_tbl
<< 25) | page_size
<< 5 | table_size
;
1514 } else { /* Deregister current process table */
1516 * Set to benign value: (current GR) | 0. This allows
1517 * deregistration in KVM to succeed even if the radix bit
1518 * in flags doesn't match the radix bit in the old PATE.
1520 cproc
= spapr
->patb_entry
& PATE1_GR
;
1522 } else { /* Maintain current registration */
1523 if (!(flags
& FLAG_RADIX
) != !(spapr
->patb_entry
& PATE1_GR
)) {
1524 /* Technically caused by flag bits => H_PARAMETER */
1525 return H_PARAMETER
; /* Existing Process Table Mismatch */
1527 cproc
= spapr
->patb_entry
;
1530 /* Check if we need to setup OR free the hpt */
1531 spapr_check_setup_free_hpt(spapr
, spapr
->patb_entry
, cproc
);
1533 spapr
->patb_entry
= cproc
; /* Save new process table */
1535 /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
1536 if (flags
& FLAG_RADIX
) /* Radix must use process tables, also set HR */
1537 update_lpcr
|= (LPCR_UPRT
| LPCR_HR
);
1538 else if (flags
& FLAG_HASH_PROC_TBL
) /* Hash with process tables */
1539 update_lpcr
|= LPCR_UPRT
;
1540 if (flags
& FLAG_GTSE
) /* Guest translation shootdown enable */
1541 update_lpcr
|= LPCR_GTSE
;
1543 spapr_set_all_lpcrs(update_lpcr
, LPCR_UPRT
| LPCR_HR
| LPCR_GTSE
);
1545 if (kvm_enabled()) {
1546 return kvmppc_configure_v3_mmu(cpu
, flags
& FLAG_RADIX
,
1547 flags
& FLAG_GTSE
, cproc
);
1552 #define H_SIGNAL_SYS_RESET_ALL -1
1553 #define H_SIGNAL_SYS_RESET_ALLBUTSELF -2
1555 static target_ulong
h_signal_sys_reset(PowerPCCPU
*cpu
,
1556 SpaprMachineState
*spapr
,
1557 target_ulong opcode
, target_ulong
*args
)
1559 target_long target
= args
[0];
1564 if (target
< H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1569 PowerPCCPU
*c
= POWERPC_CPU(cs
);
1571 if (target
== H_SIGNAL_SYS_RESET_ALLBUTSELF
) {
1576 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1582 cs
= CPU(spapr_find_cpu(target
));
1584 run_on_cpu(cs
, spapr_do_system_reset_on_cpu
, RUN_ON_CPU_NULL
);
1591 static uint32_t cas_check_pvr(SpaprMachineState
*spapr
, PowerPCCPU
*cpu
,
1592 target_ulong
*addr
, bool *raw_mode_supported
,
1595 bool explicit_match
= false; /* Matched the CPU's real PVR */
1596 uint32_t max_compat
= spapr
->max_compat_pvr
;
1597 uint32_t best_compat
= 0;
1601 * We scan the supplied table of PVRs looking for two things
1602 * 1. Is our real CPU PVR in the list?
1603 * 2. What's the "best" listed logical PVR
1605 for (i
= 0; i
< 512; ++i
) {
1606 uint32_t pvr
, pvr_mask
;
1608 pvr_mask
= ldl_be_phys(&address_space_memory
, *addr
);
1609 pvr
= ldl_be_phys(&address_space_memory
, *addr
+ 4);
1612 if (~pvr_mask
& pvr
) {
1613 break; /* Terminator record */
1616 if ((cpu
->env
.spr
[SPR_PVR
] & pvr_mask
) == (pvr
& pvr_mask
)) {
1617 explicit_match
= true;
1619 if (ppc_check_compat(cpu
, pvr
, best_compat
, max_compat
)) {
1625 if ((best_compat
== 0) && (!explicit_match
|| max_compat
)) {
1626 /* We couldn't find a suitable compatibility mode, and either
1627 * the guest doesn't support "raw" mode for this CPU, or raw
1628 * mode is disabled because a maximum compat mode is set */
1629 error_setg(errp
, "Couldn't negotiate a suitable PVR during CAS");
1633 *raw_mode_supported
= explicit_match
;
1635 /* Parsing finished */
1636 trace_spapr_cas_pvr(cpu
->compat_pvr
, explicit_match
, best_compat
);
1641 static target_ulong
h_client_architecture_support(PowerPCCPU
*cpu
,
1642 SpaprMachineState
*spapr
,
1643 target_ulong opcode
,
1646 /* Working address in data buffer */
1647 target_ulong addr
= ppc64_phys_to_real(args
[0]);
1648 target_ulong ov_table
;
1650 SpaprOptionVector
*ov1_guest
, *ov5_guest
, *ov5_cas_old
, *ov5_updates
;
1652 Error
*local_err
= NULL
;
1653 bool raw_mode_supported
= false;
1656 cas_pvr
= cas_check_pvr(spapr
, cpu
, &addr
, &raw_mode_supported
, &local_err
);
1658 error_report_err(local_err
);
1663 if (cpu
->compat_pvr
!= cas_pvr
) {
1664 ppc_set_compat_all(cas_pvr
, &local_err
);
1666 /* We fail to set compat mode (likely because running with KVM PR),
1667 * but maybe we can fallback to raw mode if the guest supports it.
1669 if (!raw_mode_supported
) {
1670 error_report_err(local_err
);
1673 error_free(local_err
);
1678 /* For the future use: here @ov_table points to the first option vector */
1681 ov1_guest
= spapr_ovec_parse_vector(ov_table
, 1);
1682 ov5_guest
= spapr_ovec_parse_vector(ov_table
, 5);
1683 if (spapr_ovec_test(ov5_guest
, OV5_MMU_BOTH
)) {
1684 error_report("guest requested hash and radix MMU, which is invalid.");
1687 if (spapr_ovec_test(ov5_guest
, OV5_XIVE_BOTH
)) {
1688 error_report("guest requested an invalid interrupt mode");
1692 /* The radix/hash bit in byte 24 requires special handling: */
1693 guest_radix
= spapr_ovec_test(ov5_guest
, OV5_MMU_RADIX_300
);
1694 spapr_ovec_clear(ov5_guest
, OV5_MMU_RADIX_300
);
1696 guest_xive
= spapr_ovec_test(ov5_guest
, OV5_XIVE_EXPLOIT
);
1699 * HPT resizing is a bit of a special case, because when enabled
1700 * we assume an HPT guest will support it until it says it
1701 * doesn't, instead of assuming it won't support it until it says
1702 * it does. Strictly speaking that approach could break for
1703 * guests which don't make a CAS call, but those are so old we
1704 * don't care about them. Without that assumption we'd have to
1705 * make at least a temporary allocation of an HPT sized for max
1706 * memory, which could be impossibly difficult under KVM HV if
1709 if (!guest_radix
&& !spapr_ovec_test(ov5_guest
, OV5_HPT_RESIZE
)) {
1710 int maxshift
= spapr_hpt_shift_for_ramsize(MACHINE(spapr
)->maxram_size
);
1712 if (spapr
->resize_hpt
== SPAPR_RESIZE_HPT_REQUIRED
) {
1714 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1718 if (spapr
->htab_shift
< maxshift
) {
1719 /* Guest doesn't know about HPT resizing, so we
1720 * pre-emptively resize for the maximum permitted RAM. At
1721 * the point this is called, nothing should have been
1722 * entered into the existing HPT */
1723 spapr_reallocate_hpt(spapr
, maxshift
, &error_fatal
);
1724 push_sregs_to_kvm_pr(spapr
);
1728 /* NOTE: there are actually a number of ov5 bits where input from the
1729 * guest is always zero, and the platform/QEMU enables them independently
1730 * of guest input. To model these properly we'd want some sort of mask,
1731 * but since they only currently apply to memory migration as defined
1732 * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1733 * to worry about this for now.
1735 ov5_cas_old
= spapr_ovec_clone(spapr
->ov5_cas
);
1737 /* also clear the radix/hash bit from the current ov5_cas bits to
1738 * be in sync with the newly ov5 bits. Else the radix bit will be
1739 * seen as being removed and this will generate a reset loop
1741 spapr_ovec_clear(ov5_cas_old
, OV5_MMU_RADIX_300
);
1743 /* full range of negotiated ov5 capabilities */
1744 spapr_ovec_intersect(spapr
->ov5_cas
, spapr
->ov5
, ov5_guest
);
1745 spapr_ovec_cleanup(ov5_guest
);
1746 /* capabilities that have been added since CAS-generated guest reset.
1747 * if capabilities have since been removed, generate another reset
1749 ov5_updates
= spapr_ovec_new();
1750 spapr
->cas_reboot
= spapr_ovec_diff(ov5_updates
,
1751 ov5_cas_old
, spapr
->ov5_cas
);
1752 spapr_ovec_cleanup(ov5_cas_old
);
1753 /* Now that processing is finished, set the radix/hash bit for the
1754 * guest if it requested a valid mode; otherwise terminate the boot. */
1756 if (kvm_enabled() && !kvmppc_has_cap_mmu_radix()) {
1757 error_report("Guest requested unavailable MMU mode (radix).");
1760 spapr_ovec_set(spapr
->ov5_cas
, OV5_MMU_RADIX_300
);
1762 if (kvm_enabled() && kvmppc_has_cap_mmu_radix()
1763 && !kvmppc_has_cap_mmu_hash_v3()) {
1764 error_report("Guest requested unavailable MMU mode (hash).");
1768 spapr
->cas_pre_isa3_guest
= !spapr_ovec_test(ov1_guest
, OV1_PPC_3_00
);
1769 spapr_ovec_cleanup(ov1_guest
);
1770 if (!spapr
->cas_reboot
) {
1771 /* If spapr_machine_reset() did not set up a HPT but one is necessary
1772 * (because the guest isn't going to use radix) then set it up here. */
1773 if ((spapr
->patb_entry
& PATE1_GR
) && !guest_radix
) {
1774 /* legacy hash or new hash: */
1775 spapr_setup_hpt_and_vrma(spapr
);
1778 (spapr_h_cas_compose_response(spapr
, args
[1], args
[2],
1783 * Ensure the guest asks for an interrupt mode we support; otherwise
1784 * terminate the boot.
1787 if (!spapr
->irq
->xive
) {
1789 "Guest requested unavailable interrupt mode (XIVE), try the ic-mode=xive or ic-mode=dual machine property");
1793 if (!spapr
->irq
->xics
) {
1795 "Guest requested unavailable interrupt mode (XICS), either don't set the ic-mode machine property or try ic-mode=xics or ic-mode=dual");
1801 * Generate a machine reset when we have an update of the
1802 * interrupt mode. Only required when the machine supports both
1805 if (!spapr
->cas_reboot
) {
1806 spapr
->cas_reboot
= spapr_ovec_test(ov5_updates
, OV5_XIVE_EXPLOIT
)
1807 && spapr
->irq
->xics
&& spapr
->irq
->xive
;
1810 spapr_ovec_cleanup(ov5_updates
);
1812 if (spapr
->cas_reboot
) {
1813 qemu_system_reset_request(SHUTDOWN_CAUSE_SUBSYSTEM_RESET
);
1819 static target_ulong
h_home_node_associativity(PowerPCCPU
*cpu
,
1820 SpaprMachineState
*spapr
,
1821 target_ulong opcode
,
1824 target_ulong flags
= args
[0];
1825 target_ulong procno
= args
[1];
1829 /* only support procno from H_REGISTER_VPA */
1834 tcpu
= spapr_find_cpu(procno
);
1839 /* sequence is the same as in the "ibm,associativity" property */
1842 #define ASSOCIATIVITY(a, b) (((uint64_t)(a) << 32) | \
1843 ((uint64_t)(b) & 0xffffffff))
1844 args
[idx
++] = ASSOCIATIVITY(0, 0);
1845 args
[idx
++] = ASSOCIATIVITY(0, tcpu
->node_id
);
1846 args
[idx
++] = ASSOCIATIVITY(procno
, -1);
1847 for ( ; idx
< 6; idx
++) {
1850 #undef ASSOCIATIVITY
1855 static target_ulong
h_get_cpu_characteristics(PowerPCCPU
*cpu
,
1856 SpaprMachineState
*spapr
,
1857 target_ulong opcode
,
1860 uint64_t characteristics
= H_CPU_CHAR_HON_BRANCH_HINTS
&
1861 ~H_CPU_CHAR_THR_RECONF_TRIG
;
1862 uint64_t behaviour
= H_CPU_BEHAV_FAVOUR_SECURITY
;
1863 uint8_t safe_cache
= spapr_get_cap(spapr
, SPAPR_CAP_CFPC
);
1864 uint8_t safe_bounds_check
= spapr_get_cap(spapr
, SPAPR_CAP_SBBC
);
1865 uint8_t safe_indirect_branch
= spapr_get_cap(spapr
, SPAPR_CAP_IBS
);
1866 uint8_t count_cache_flush_assist
= spapr_get_cap(spapr
,
1867 SPAPR_CAP_CCF_ASSIST
);
1869 switch (safe_cache
) {
1870 case SPAPR_CAP_WORKAROUND
:
1871 characteristics
|= H_CPU_CHAR_L1D_FLUSH_ORI30
;
1872 characteristics
|= H_CPU_CHAR_L1D_FLUSH_TRIG2
;
1873 characteristics
|= H_CPU_CHAR_L1D_THREAD_PRIV
;
1874 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1876 case SPAPR_CAP_FIXED
:
1878 default: /* broken */
1879 assert(safe_cache
== SPAPR_CAP_BROKEN
);
1880 behaviour
|= H_CPU_BEHAV_L1D_FLUSH_PR
;
1884 switch (safe_bounds_check
) {
1885 case SPAPR_CAP_WORKAROUND
:
1886 characteristics
|= H_CPU_CHAR_SPEC_BAR_ORI31
;
1887 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1889 case SPAPR_CAP_FIXED
:
1891 default: /* broken */
1892 assert(safe_bounds_check
== SPAPR_CAP_BROKEN
);
1893 behaviour
|= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR
;
1897 switch (safe_indirect_branch
) {
1898 case SPAPR_CAP_FIXED_NA
:
1900 case SPAPR_CAP_FIXED_CCD
:
1901 characteristics
|= H_CPU_CHAR_CACHE_COUNT_DIS
;
1903 case SPAPR_CAP_FIXED_IBS
:
1904 characteristics
|= H_CPU_CHAR_BCCTRL_SERIALISED
;
1906 case SPAPR_CAP_WORKAROUND
:
1907 behaviour
|= H_CPU_BEHAV_FLUSH_COUNT_CACHE
;
1908 if (count_cache_flush_assist
) {
1909 characteristics
|= H_CPU_CHAR_BCCTR_FLUSH_ASSIST
;
1912 default: /* broken */
1913 assert(safe_indirect_branch
== SPAPR_CAP_BROKEN
);
1917 args
[0] = characteristics
;
1918 args
[1] = behaviour
;
1922 static target_ulong
h_update_dt(PowerPCCPU
*cpu
, SpaprMachineState
*spapr
,
1923 target_ulong opcode
, target_ulong
*args
)
1925 target_ulong dt
= ppc64_phys_to_real(args
[0]);
1926 struct fdt_header hdr
= { 0 };
1928 SpaprMachineClass
*smc
= SPAPR_MACHINE_GET_CLASS(spapr
);
1931 cpu_physical_memory_read(dt
, &hdr
, sizeof(hdr
));
1932 cb
= fdt32_to_cpu(hdr
.totalsize
);
1934 if (!smc
->update_dt_enabled
) {
1938 /* Check that the fdt did not grow out of proportion */
1939 if (cb
> spapr
->fdt_initial_size
* 2) {
1940 trace_spapr_update_dt_failed_size(spapr
->fdt_initial_size
, cb
,
1941 fdt32_to_cpu(hdr
.magic
));
1945 fdt
= g_malloc0(cb
);
1946 cpu_physical_memory_read(dt
, fdt
, cb
);
1948 /* Check the fdt consistency */
1949 if (fdt_check_full(fdt
, cb
)) {
1950 trace_spapr_update_dt_failed_check(spapr
->fdt_initial_size
, cb
,
1951 fdt32_to_cpu(hdr
.magic
));
1955 g_free(spapr
->fdt_blob
);
1956 spapr
->fdt_size
= cb
;
1957 spapr
->fdt_blob
= fdt
;
1958 trace_spapr_update_dt(cb
);
1963 static spapr_hcall_fn papr_hypercall_table
[(MAX_HCALL_OPCODE
/ 4) + 1];
1964 static spapr_hcall_fn kvmppc_hypercall_table
[KVMPPC_HCALL_MAX
- KVMPPC_HCALL_BASE
+ 1];
1965 static spapr_hcall_fn svm_hypercall_table
[(SVM_HCALL_MAX
- SVM_HCALL_BASE
) / 4 + 1];
1967 void spapr_register_hypercall(target_ulong opcode
, spapr_hcall_fn fn
)
1969 spapr_hcall_fn
*slot
;
1971 if (opcode
<= MAX_HCALL_OPCODE
) {
1972 assert((opcode
& 0x3) == 0);
1974 slot
= &papr_hypercall_table
[opcode
/ 4];
1975 } else if (opcode
>= SVM_HCALL_BASE
&& opcode
<= SVM_HCALL_MAX
) {
1976 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1977 assert((opcode
& 0x3) == 0);
1979 slot
= &svm_hypercall_table
[(opcode
- SVM_HCALL_BASE
) / 4];
1981 assert((opcode
>= KVMPPC_HCALL_BASE
) && (opcode
<= KVMPPC_HCALL_MAX
));
1983 slot
= &kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
1990 target_ulong
spapr_hypercall(PowerPCCPU
*cpu
, target_ulong opcode
,
1993 SpaprMachineState
*spapr
= SPAPR_MACHINE(qdev_get_machine());
1995 if ((opcode
<= MAX_HCALL_OPCODE
)
1996 && ((opcode
& 0x3) == 0)) {
1997 spapr_hcall_fn fn
= papr_hypercall_table
[opcode
/ 4];
2000 return fn(cpu
, spapr
, opcode
, args
);
2002 } else if ((opcode
>= SVM_HCALL_BASE
) &&
2003 (opcode
<= SVM_HCALL_MAX
)) {
2004 spapr_hcall_fn fn
= svm_hypercall_table
[(opcode
- SVM_HCALL_BASE
) / 4];
2007 return fn(cpu
, spapr
, opcode
, args
);
2009 } else if ((opcode
>= KVMPPC_HCALL_BASE
) &&
2010 (opcode
<= KVMPPC_HCALL_MAX
)) {
2011 spapr_hcall_fn fn
= kvmppc_hypercall_table
[opcode
- KVMPPC_HCALL_BASE
];
2014 return fn(cpu
, spapr
, opcode
, args
);
2018 qemu_log_mask(LOG_UNIMP
, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx
"\n",
2023 static void hypercall_register_types(void)
2026 spapr_register_hypercall(H_ENTER
, h_enter
);
2027 spapr_register_hypercall(H_REMOVE
, h_remove
);
2028 spapr_register_hypercall(H_PROTECT
, h_protect
);
2029 spapr_register_hypercall(H_READ
, h_read
);
2032 spapr_register_hypercall(H_BULK_REMOVE
, h_bulk_remove
);
2034 /* hcall-hpt-resize */
2035 spapr_register_hypercall(H_RESIZE_HPT_PREPARE
, h_resize_hpt_prepare
);
2036 spapr_register_hypercall(H_RESIZE_HPT_COMMIT
, h_resize_hpt_commit
);
2039 spapr_register_hypercall(H_REGISTER_VPA
, h_register_vpa
);
2040 spapr_register_hypercall(H_CEDE
, h_cede
);
2041 spapr_register_hypercall(H_CONFER
, h_confer
);
2042 spapr_register_hypercall(H_PROD
, h_prod
);
2045 spapr_register_hypercall(H_JOIN
, h_join
);
2047 spapr_register_hypercall(H_SIGNAL_SYS_RESET
, h_signal_sys_reset
);
2049 /* processor register resource access h-calls */
2050 spapr_register_hypercall(H_SET_SPRG0
, h_set_sprg0
);
2051 spapr_register_hypercall(H_SET_DABR
, h_set_dabr
);
2052 spapr_register_hypercall(H_SET_XDABR
, h_set_xdabr
);
2053 spapr_register_hypercall(H_PAGE_INIT
, h_page_init
);
2054 spapr_register_hypercall(H_SET_MODE
, h_set_mode
);
2056 /* In Memory Table MMU h-calls */
2057 spapr_register_hypercall(H_CLEAN_SLB
, h_clean_slb
);
2058 spapr_register_hypercall(H_INVALIDATE_PID
, h_invalidate_pid
);
2059 spapr_register_hypercall(H_REGISTER_PROC_TBL
, h_register_process_table
);
2061 /* hcall-get-cpu-characteristics */
2062 spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS
,
2063 h_get_cpu_characteristics
);
2065 /* "debugger" hcalls (also used by SLOF). Note: We do -not- differenciate
2066 * here between the "CI" and the "CACHE" variants, they will use whatever
2067 * mapping attributes qemu is using. When using KVM, the kernel will
2068 * enforce the attributes more strongly
2070 spapr_register_hypercall(H_LOGICAL_CI_LOAD
, h_logical_load
);
2071 spapr_register_hypercall(H_LOGICAL_CI_STORE
, h_logical_store
);
2072 spapr_register_hypercall(H_LOGICAL_CACHE_LOAD
, h_logical_load
);
2073 spapr_register_hypercall(H_LOGICAL_CACHE_STORE
, h_logical_store
);
2074 spapr_register_hypercall(H_LOGICAL_ICBI
, h_logical_icbi
);
2075 spapr_register_hypercall(H_LOGICAL_DCBF
, h_logical_dcbf
);
2076 spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP
, h_logical_memop
);
2078 /* qemu/KVM-PPC specific hcalls */
2079 spapr_register_hypercall(KVMPPC_H_RTAS
, h_rtas
);
2081 /* ibm,client-architecture-support support */
2082 spapr_register_hypercall(KVMPPC_H_CAS
, h_client_architecture_support
);
2084 spapr_register_hypercall(KVMPPC_H_UPDATE_DT
, h_update_dt
);
2086 /* Virtual Processor Home Node */
2087 spapr_register_hypercall(H_HOME_NODE_ASSOCIATIVITY
,
2088 h_home_node_associativity
);
2091 type_init(hypercall_register_types
)