1 #include "qemu/osdep.h"
2 #include "qemu/cutils.h"
3 #include "qapi/error.h"
4 #include "system/hw_accel.h"
5 #include "system/runstate.h"
6 #include "system/tcg.h"
7 #include "qemu/log.h"
8 #include "qemu/main-loop.h"
9 #include "qemu/module.h"
10 #include "qemu/error-report.h"
11 #include "exec/tb-flush.h"
12 #include "exec/target_page.h"
13 #include "helper_regs.h"
14 #include "hw/ppc/ppc.h"
15 #include "hw/ppc/spapr.h"
16 #include "hw/ppc/spapr_cpu_core.h"
17 #include "hw/ppc/spapr_nested.h"
18 #include "mmu-hash64.h"
19 #include "cpu-models.h"
20 #include "trace.h"
21 #include "kvm_ppc.h"
22 #include "hw/ppc/fdt.h"
23 #include "hw/ppc/spapr_ovec.h"
24 #include "hw/ppc/spapr_numa.h"
25 #include "mmu-book3s-v3.h"
26 #include "hw/mem/memory-device.h"
27
is_ram_address(SpaprMachineState * spapr,hwaddr addr)28 bool is_ram_address(SpaprMachineState *spapr, hwaddr addr)
29 {
30 MachineState *machine = MACHINE(spapr);
31 DeviceMemoryState *dms = machine->device_memory;
32
33 if (addr < machine->ram_size) {
34 return true;
35 }
36 if (dms && (addr >= dms->base)
37 && ((addr - dms->base) < memory_region_size(&dms->mr))) {
38 return true;
39 }
40
41 return false;
42 }
43
44 /* Convert a return code from the KVM ioctl()s implementing resize HPT
45 * into a PAPR hypercall return code */
resize_hpt_convert_rc(int ret)46 static target_ulong resize_hpt_convert_rc(int ret)
47 {
48 if (ret >= 100000) {
49 return H_LONG_BUSY_ORDER_100_SEC;
50 } else if (ret >= 10000) {
51 return H_LONG_BUSY_ORDER_10_SEC;
52 } else if (ret >= 1000) {
53 return H_LONG_BUSY_ORDER_1_SEC;
54 } else if (ret >= 100) {
55 return H_LONG_BUSY_ORDER_100_MSEC;
56 } else if (ret >= 10) {
57 return H_LONG_BUSY_ORDER_10_MSEC;
58 } else if (ret > 0) {
59 return H_LONG_BUSY_ORDER_1_MSEC;
60 }
61
62 switch (ret) {
63 case 0:
64 return H_SUCCESS;
65 case -EPERM:
66 return H_AUTHORITY;
67 case -EINVAL:
68 return H_PARAMETER;
69 case -ENXIO:
70 return H_CLOSED;
71 case -ENOSPC:
72 return H_PTEG_FULL;
73 case -EBUSY:
74 return H_BUSY;
75 case -ENOMEM:
76 return H_NO_MEM;
77 default:
78 return H_HARDWARE;
79 }
80 }
81
h_resize_hpt_prepare(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)82 static target_ulong h_resize_hpt_prepare(PowerPCCPU *cpu,
83 SpaprMachineState *spapr,
84 target_ulong opcode,
85 target_ulong *args)
86 {
87 target_ulong flags = args[0];
88 int shift = args[1];
89 uint64_t current_ram_size;
90 int rc;
91
92 if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
93 return H_AUTHORITY;
94 }
95
96 if (!spapr->htab_shift) {
97 /* Radix guest, no HPT */
98 return H_NOT_AVAILABLE;
99 }
100
101 trace_spapr_h_resize_hpt_prepare(flags, shift);
102
103 if (flags != 0) {
104 return H_PARAMETER;
105 }
106
107 if (shift && ((shift < 18) || (shift > 46))) {
108 return H_PARAMETER;
109 }
110
111 current_ram_size = MACHINE(spapr)->ram_size + get_plugged_memory_size();
112
113 /* We only allow the guest to allocate an HPT one order above what
114 * we'd normally give them (to stop a small guest claiming a huge
115 * chunk of resources in the HPT */
116 if (shift > (spapr_hpt_shift_for_ramsize(current_ram_size) + 1)) {
117 return H_RESOURCE;
118 }
119
120 rc = kvmppc_resize_hpt_prepare(cpu, flags, shift);
121 if (rc != -ENOSYS) {
122 return resize_hpt_convert_rc(rc);
123 }
124
125 if (kvm_enabled()) {
126 return H_HARDWARE;
127 } else if (tcg_enabled()) {
128 return vhyp_mmu_resize_hpt_prepare(cpu, spapr, shift);
129 } else {
130 g_assert_not_reached();
131 }
132 }
133
do_push_sregs_to_kvm_pr(CPUState * cs,run_on_cpu_data data)134 static void do_push_sregs_to_kvm_pr(CPUState *cs, run_on_cpu_data data)
135 {
136 int ret;
137
138 cpu_synchronize_state(cs);
139
140 ret = kvmppc_put_books_sregs(POWERPC_CPU(cs));
141 if (ret < 0) {
142 error_report("failed to push sregs to KVM: %s", strerror(-ret));
143 exit(1);
144 }
145 }
146
push_sregs_to_kvm_pr(SpaprMachineState * spapr)147 void push_sregs_to_kvm_pr(SpaprMachineState *spapr)
148 {
149 CPUState *cs;
150
151 /*
152 * This is a hack for the benefit of KVM PR - it abuses the SDR1
153 * slot in kvm_sregs to communicate the userspace address of the
154 * HPT
155 */
156 if (!kvm_enabled() || !spapr->htab) {
157 return;
158 }
159
160 CPU_FOREACH(cs) {
161 run_on_cpu(cs, do_push_sregs_to_kvm_pr, RUN_ON_CPU_NULL);
162 }
163 }
164
h_resize_hpt_commit(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)165 static target_ulong h_resize_hpt_commit(PowerPCCPU *cpu,
166 SpaprMachineState *spapr,
167 target_ulong opcode,
168 target_ulong *args)
169 {
170 target_ulong flags = args[0];
171 target_ulong shift = args[1];
172 int rc;
173
174 if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
175 return H_AUTHORITY;
176 }
177
178 if (!spapr->htab_shift) {
179 /* Radix guest, no HPT */
180 return H_NOT_AVAILABLE;
181 }
182
183 trace_spapr_h_resize_hpt_commit(flags, shift);
184
185 rc = kvmppc_resize_hpt_commit(cpu, flags, shift);
186 if (rc != -ENOSYS) {
187 rc = resize_hpt_convert_rc(rc);
188 if (rc == H_SUCCESS) {
189 /* Need to set the new htab_shift in the machine state */
190 spapr->htab_shift = shift;
191 }
192 return rc;
193 }
194
195 if (kvm_enabled()) {
196 return H_HARDWARE;
197 } else if (tcg_enabled()) {
198 return vhyp_mmu_resize_hpt_commit(cpu, spapr, flags, shift);
199 } else {
200 g_assert_not_reached();
201 }
202 }
203
204
205
h_set_sprg0(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)206 static target_ulong h_set_sprg0(PowerPCCPU *cpu, SpaprMachineState *spapr,
207 target_ulong opcode, target_ulong *args)
208 {
209 cpu_synchronize_state(CPU(cpu));
210 cpu->env.spr[SPR_SPRG0] = args[0];
211
212 return H_SUCCESS;
213 }
214
h_set_dabr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)215 static target_ulong h_set_dabr(PowerPCCPU *cpu, SpaprMachineState *spapr,
216 target_ulong opcode, target_ulong *args)
217 {
218 if (!ppc_has_spr(cpu, SPR_DABR)) {
219 return H_HARDWARE; /* DABR register not available */
220 }
221 cpu_synchronize_state(CPU(cpu));
222
223 if (ppc_has_spr(cpu, SPR_DABRX)) {
224 cpu->env.spr[SPR_DABRX] = 0x3; /* Use Problem and Privileged state */
225 } else if (!(args[0] & 0x4)) { /* Breakpoint Translation set? */
226 return H_RESERVED_DABR;
227 }
228
229 cpu->env.spr[SPR_DABR] = args[0];
230 return H_SUCCESS;
231 }
232
h_set_xdabr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)233 static target_ulong h_set_xdabr(PowerPCCPU *cpu, SpaprMachineState *spapr,
234 target_ulong opcode, target_ulong *args)
235 {
236 target_ulong dabrx = args[1];
237
238 if (!ppc_has_spr(cpu, SPR_DABR) || !ppc_has_spr(cpu, SPR_DABRX)) {
239 return H_HARDWARE;
240 }
241
242 if ((dabrx & ~0xfULL) != 0 || (dabrx & H_DABRX_HYPERVISOR) != 0
243 || (dabrx & (H_DABRX_KERNEL | H_DABRX_USER)) == 0) {
244 return H_PARAMETER;
245 }
246
247 cpu_synchronize_state(CPU(cpu));
248 cpu->env.spr[SPR_DABRX] = dabrx;
249 cpu->env.spr[SPR_DABR] = args[0];
250
251 return H_SUCCESS;
252 }
253
h_page_init(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)254 static target_ulong h_page_init(PowerPCCPU *cpu, SpaprMachineState *spapr,
255 target_ulong opcode, target_ulong *args)
256 {
257 target_ulong flags = args[0];
258 hwaddr dst = args[1];
259 hwaddr src = args[2];
260 hwaddr len = TARGET_PAGE_SIZE;
261 uint8_t *pdst, *psrc;
262 target_long ret = H_SUCCESS;
263
264 if (flags & ~(H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE
265 | H_COPY_PAGE | H_ZERO_PAGE)) {
266 qemu_log_mask(LOG_UNIMP, "h_page_init: Bad flags (" TARGET_FMT_lx "\n",
267 flags);
268 return H_PARAMETER;
269 }
270
271 /* Map-in destination */
272 if (!is_ram_address(spapr, dst) || (dst & ~TARGET_PAGE_MASK) != 0) {
273 return H_PARAMETER;
274 }
275 pdst = cpu_physical_memory_map(dst, &len, true);
276 if (!pdst || len != TARGET_PAGE_SIZE) {
277 return H_PARAMETER;
278 }
279
280 if (flags & H_COPY_PAGE) {
281 /* Map-in source, copy to destination, and unmap source again */
282 if (!is_ram_address(spapr, src) || (src & ~TARGET_PAGE_MASK) != 0) {
283 ret = H_PARAMETER;
284 goto unmap_out;
285 }
286 psrc = cpu_physical_memory_map(src, &len, false);
287 if (!psrc || len != TARGET_PAGE_SIZE) {
288 ret = H_PARAMETER;
289 goto unmap_out;
290 }
291 memcpy(pdst, psrc, len);
292 cpu_physical_memory_unmap(psrc, len, 0, len);
293 } else if (flags & H_ZERO_PAGE) {
294 memset(pdst, 0, len); /* Just clear the destination page */
295 }
296
297 if (kvm_enabled() && (flags & H_ICACHE_SYNCHRONIZE) != 0) {
298 kvmppc_dcbst_range(cpu, pdst, len);
299 }
300 if (flags & (H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE)) {
301 if (kvm_enabled()) {
302 kvmppc_icbi_range(cpu, pdst, len);
303 } else if (tcg_enabled()) {
304 tb_flush(CPU(cpu));
305 } else {
306 g_assert_not_reached();
307 }
308 }
309
310 unmap_out:
311 cpu_physical_memory_unmap(pdst, TARGET_PAGE_SIZE, 1, len);
312 return ret;
313 }
314
315 #define FLAGS_REGISTER_VPA 0x0000200000000000ULL
316 #define FLAGS_REGISTER_DTL 0x0000400000000000ULL
317 #define FLAGS_REGISTER_SLBSHADOW 0x0000600000000000ULL
318 #define FLAGS_DEREGISTER_VPA 0x0000a00000000000ULL
319 #define FLAGS_DEREGISTER_DTL 0x0000c00000000000ULL
320 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
321
register_vpa(PowerPCCPU * cpu,target_ulong vpa)322 static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
323 {
324 CPUState *cs = CPU(cpu);
325 CPUPPCState *env = &cpu->env;
326 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
327 uint16_t size;
328 uint8_t tmp;
329
330 if (vpa == 0) {
331 hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
332 return H_HARDWARE;
333 }
334
335 if (vpa % env->dcache_line_size) {
336 return H_PARAMETER;
337 }
338 /* FIXME: bounds check the address */
339
340 size = lduw_be_phys(cs->as, vpa + 0x4);
341
342 if (size < VPA_MIN_SIZE) {
343 return H_PARAMETER;
344 }
345
346 /* VPA is not allowed to cross a page boundary */
347 if ((vpa / 4096) != ((vpa + size - 1) / 4096)) {
348 return H_PARAMETER;
349 }
350
351 spapr_cpu->vpa_addr = vpa;
352
353 tmp = ldub_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
354 tmp |= VPA_SHARED_PROC_VAL;
355 stb_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
356
357 return H_SUCCESS;
358 }
359
deregister_vpa(PowerPCCPU * cpu,target_ulong vpa)360 static target_ulong deregister_vpa(PowerPCCPU *cpu, target_ulong vpa)
361 {
362 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
363
364 if (spapr_cpu->slb_shadow_addr) {
365 return H_RESOURCE;
366 }
367
368 if (spapr_cpu->dtl_addr) {
369 return H_RESOURCE;
370 }
371
372 spapr_cpu->vpa_addr = 0;
373 return H_SUCCESS;
374 }
375
register_slb_shadow(PowerPCCPU * cpu,target_ulong addr)376 static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
377 {
378 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
379 uint32_t size;
380
381 if (addr == 0) {
382 hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
383 return H_HARDWARE;
384 }
385
386 size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
387 if (size < 0x8) {
388 return H_PARAMETER;
389 }
390
391 if ((addr / 4096) != ((addr + size - 1) / 4096)) {
392 return H_PARAMETER;
393 }
394
395 if (!spapr_cpu->vpa_addr) {
396 return H_RESOURCE;
397 }
398
399 spapr_cpu->slb_shadow_addr = addr;
400 spapr_cpu->slb_shadow_size = size;
401
402 return H_SUCCESS;
403 }
404
deregister_slb_shadow(PowerPCCPU * cpu,target_ulong addr)405 static target_ulong deregister_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
406 {
407 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
408
409 spapr_cpu->slb_shadow_addr = 0;
410 spapr_cpu->slb_shadow_size = 0;
411 return H_SUCCESS;
412 }
413
register_dtl(PowerPCCPU * cpu,target_ulong addr)414 static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
415 {
416 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
417 uint32_t size;
418
419 if (addr == 0) {
420 hcall_dprintf("Can't cope with DTL at logical 0\n");
421 return H_HARDWARE;
422 }
423
424 size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
425
426 if (size < 48) {
427 return H_PARAMETER;
428 }
429
430 if (!spapr_cpu->vpa_addr) {
431 return H_RESOURCE;
432 }
433
434 spapr_cpu->dtl_addr = addr;
435 spapr_cpu->dtl_size = size;
436
437 return H_SUCCESS;
438 }
439
deregister_dtl(PowerPCCPU * cpu,target_ulong addr)440 static target_ulong deregister_dtl(PowerPCCPU *cpu, target_ulong addr)
441 {
442 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
443
444 spapr_cpu->dtl_addr = 0;
445 spapr_cpu->dtl_size = 0;
446
447 return H_SUCCESS;
448 }
449
h_register_vpa(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)450 static target_ulong h_register_vpa(PowerPCCPU *cpu, SpaprMachineState *spapr,
451 target_ulong opcode, target_ulong *args)
452 {
453 target_ulong flags = args[0];
454 target_ulong procno = args[1];
455 target_ulong vpa = args[2];
456 target_ulong ret = H_PARAMETER;
457 PowerPCCPU *tcpu;
458
459 tcpu = spapr_find_cpu(procno);
460 if (!tcpu) {
461 return H_PARAMETER;
462 }
463
464 switch (flags) {
465 case FLAGS_REGISTER_VPA:
466 ret = register_vpa(tcpu, vpa);
467 break;
468
469 case FLAGS_DEREGISTER_VPA:
470 ret = deregister_vpa(tcpu, vpa);
471 break;
472
473 case FLAGS_REGISTER_SLBSHADOW:
474 ret = register_slb_shadow(tcpu, vpa);
475 break;
476
477 case FLAGS_DEREGISTER_SLBSHADOW:
478 ret = deregister_slb_shadow(tcpu, vpa);
479 break;
480
481 case FLAGS_REGISTER_DTL:
482 ret = register_dtl(tcpu, vpa);
483 break;
484
485 case FLAGS_DEREGISTER_DTL:
486 ret = deregister_dtl(tcpu, vpa);
487 break;
488 }
489
490 return ret;
491 }
492
h_cede(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)493 static target_ulong h_cede(PowerPCCPU *cpu, SpaprMachineState *spapr,
494 target_ulong opcode, target_ulong *args)
495 {
496 CPUPPCState *env = &cpu->env;
497 CPUState *cs = CPU(cpu);
498 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
499
500 env->msr |= (1ULL << MSR_EE);
501 hreg_compute_hflags(env);
502 ppc_maybe_interrupt(env);
503
504 if (spapr_cpu->prod) {
505 spapr_cpu->prod = false;
506 return H_SUCCESS;
507 }
508
509 if (!cpu_has_work(cs)) {
510 cs->halted = 1;
511 cs->exception_index = EXCP_HLT;
512 cs->exit_request = 1;
513 ppc_maybe_interrupt(env);
514 }
515
516 return H_SUCCESS;
517 }
518
519 /*
520 * Confer to self, aka join. Cede could use the same pattern as well, if
521 * EXCP_HLT can be changed to ECXP_HALTED.
522 */
h_confer_self(PowerPCCPU * cpu)523 static target_ulong h_confer_self(PowerPCCPU *cpu)
524 {
525 CPUState *cs = CPU(cpu);
526 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
527
528 if (spapr_cpu->prod) {
529 spapr_cpu->prod = false;
530 return H_SUCCESS;
531 }
532 cs->halted = 1;
533 cs->exception_index = EXCP_HALTED;
534 cs->exit_request = 1;
535 ppc_maybe_interrupt(&cpu->env);
536
537 return H_SUCCESS;
538 }
539
h_join(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)540 static target_ulong h_join(PowerPCCPU *cpu, SpaprMachineState *spapr,
541 target_ulong opcode, target_ulong *args)
542 {
543 CPUPPCState *env = &cpu->env;
544 CPUState *cs;
545 bool last_unjoined = true;
546
547 if (env->msr & (1ULL << MSR_EE)) {
548 return H_BAD_MODE;
549 }
550
551 /*
552 * Must not join the last CPU running. Interestingly, no such restriction
553 * for H_CONFER-to-self, but that is probably not intended to be used
554 * when H_JOIN is available.
555 */
556 CPU_FOREACH(cs) {
557 PowerPCCPU *c = POWERPC_CPU(cs);
558 CPUPPCState *e = &c->env;
559 if (c == cpu) {
560 continue;
561 }
562
563 /* Don't have a way to indicate joined, so use halted && MSR[EE]=0 */
564 if (!cs->halted || (e->msr & (1ULL << MSR_EE))) {
565 last_unjoined = false;
566 break;
567 }
568 }
569 if (last_unjoined) {
570 return H_CONTINUE;
571 }
572
573 return h_confer_self(cpu);
574 }
575
h_confer(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)576 static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
577 target_ulong opcode, target_ulong *args)
578 {
579 target_long target = args[0];
580 uint32_t dispatch = args[1];
581 CPUState *cs = CPU(cpu);
582 SpaprCpuState *spapr_cpu;
583
584 assert(tcg_enabled()); /* KVM will have handled this */
585
586 /*
587 * -1 means confer to all other CPUs without dispatch counter check,
588 * otherwise it's a targeted confer.
589 */
590 if (target != -1) {
591 PowerPCCPU *target_cpu = spapr_find_cpu(target);
592 uint32_t target_dispatch;
593
594 if (!target_cpu) {
595 return H_PARAMETER;
596 }
597
598 /*
599 * target == self is a special case, we wait until prodded, without
600 * dispatch counter check.
601 */
602 if (cpu == target_cpu) {
603 return h_confer_self(cpu);
604 }
605
606 spapr_cpu = spapr_cpu_state(target_cpu);
607 if (!spapr_cpu->vpa_addr || ((dispatch & 1) == 0)) {
608 return H_SUCCESS;
609 }
610
611 target_dispatch = ldl_be_phys(cs->as,
612 spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
613 if (target_dispatch != dispatch) {
614 return H_SUCCESS;
615 }
616
617 /*
618 * The targeted confer does not do anything special beyond yielding
619 * the current vCPU, but even this should be better than nothing.
620 * At least for single-threaded tcg, it gives the target a chance to
621 * run before we run again. Multi-threaded tcg does not really do
622 * anything with EXCP_YIELD yet.
623 */
624 }
625
626 cs->exception_index = EXCP_YIELD;
627 cs->exit_request = 1;
628 cpu_loop_exit(cs);
629
630 return H_SUCCESS;
631 }
632
h_prod(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)633 static target_ulong h_prod(PowerPCCPU *cpu, SpaprMachineState *spapr,
634 target_ulong opcode, target_ulong *args)
635 {
636 target_long target = args[0];
637 PowerPCCPU *tcpu;
638 CPUState *cs;
639 SpaprCpuState *spapr_cpu;
640
641 tcpu = spapr_find_cpu(target);
642 cs = CPU(tcpu);
643 if (!cs) {
644 return H_PARAMETER;
645 }
646
647 spapr_cpu = spapr_cpu_state(tcpu);
648 spapr_cpu->prod = true;
649 cs->halted = 0;
650 ppc_maybe_interrupt(&cpu->env);
651 qemu_cpu_kick(cs);
652
653 return H_SUCCESS;
654 }
655
h_rtas(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)656 static target_ulong h_rtas(PowerPCCPU *cpu, SpaprMachineState *spapr,
657 target_ulong opcode, target_ulong *args)
658 {
659 target_ulong rtas_r3 = args[0];
660 uint32_t token = rtas_ld(rtas_r3, 0);
661 uint32_t nargs = rtas_ld(rtas_r3, 1);
662 uint32_t nret = rtas_ld(rtas_r3, 2);
663
664 return spapr_rtas_call(cpu, spapr, token, nargs, rtas_r3 + 12,
665 nret, rtas_r3 + 12 + 4*nargs);
666 }
667
h_logical_load(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)668 static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
669 target_ulong opcode, target_ulong *args)
670 {
671 CPUState *cs = CPU(cpu);
672 target_ulong size = args[0];
673 target_ulong addr = args[1];
674
675 switch (size) {
676 case 1:
677 args[0] = ldub_phys(cs->as, addr);
678 return H_SUCCESS;
679 case 2:
680 args[0] = lduw_phys(cs->as, addr);
681 return H_SUCCESS;
682 case 4:
683 args[0] = ldl_phys(cs->as, addr);
684 return H_SUCCESS;
685 case 8:
686 args[0] = ldq_phys(cs->as, addr);
687 return H_SUCCESS;
688 }
689 return H_PARAMETER;
690 }
691
h_logical_store(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)692 static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
693 target_ulong opcode, target_ulong *args)
694 {
695 CPUState *cs = CPU(cpu);
696
697 target_ulong size = args[0];
698 target_ulong addr = args[1];
699 target_ulong val = args[2];
700
701 switch (size) {
702 case 1:
703 stb_phys(cs->as, addr, val);
704 return H_SUCCESS;
705 case 2:
706 stw_phys(cs->as, addr, val);
707 return H_SUCCESS;
708 case 4:
709 stl_phys(cs->as, addr, val);
710 return H_SUCCESS;
711 case 8:
712 stq_phys(cs->as, addr, val);
713 return H_SUCCESS;
714 }
715 return H_PARAMETER;
716 }
717
h_logical_memop(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)718 static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
719 target_ulong opcode, target_ulong *args)
720 {
721 CPUState *cs = CPU(cpu);
722
723 target_ulong dst = args[0]; /* Destination address */
724 target_ulong src = args[1]; /* Source address */
725 target_ulong esize = args[2]; /* Element size (0=1,1=2,2=4,3=8) */
726 target_ulong count = args[3]; /* Element count */
727 target_ulong op = args[4]; /* 0 = copy, 1 = invert */
728 uint64_t tmp;
729 unsigned int mask = (1 << esize) - 1;
730 int step = 1 << esize;
731
732 if (count > 0x80000000) {
733 return H_PARAMETER;
734 }
735
736 if ((dst & mask) || (src & mask) || (op > 1)) {
737 return H_PARAMETER;
738 }
739
740 if (dst >= src && dst < (src + (count << esize))) {
741 dst = dst + ((count - 1) << esize);
742 src = src + ((count - 1) << esize);
743 step = -step;
744 }
745
746 while (count--) {
747 switch (esize) {
748 case 0:
749 tmp = ldub_phys(cs->as, src);
750 break;
751 case 1:
752 tmp = lduw_phys(cs->as, src);
753 break;
754 case 2:
755 tmp = ldl_phys(cs->as, src);
756 break;
757 case 3:
758 tmp = ldq_phys(cs->as, src);
759 break;
760 default:
761 return H_PARAMETER;
762 }
763 if (op == 1) {
764 tmp = ~tmp;
765 }
766 switch (esize) {
767 case 0:
768 stb_phys(cs->as, dst, tmp);
769 break;
770 case 1:
771 stw_phys(cs->as, dst, tmp);
772 break;
773 case 2:
774 stl_phys(cs->as, dst, tmp);
775 break;
776 case 3:
777 stq_phys(cs->as, dst, tmp);
778 break;
779 }
780 dst = dst + step;
781 src = src + step;
782 }
783
784 return H_SUCCESS;
785 }
786
h_logical_icbi(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)787 static target_ulong h_logical_icbi(PowerPCCPU *cpu, SpaprMachineState *spapr,
788 target_ulong opcode, target_ulong *args)
789 {
790 /* Nothing to do on emulation, KVM will trap this in the kernel */
791 return H_SUCCESS;
792 }
793
h_logical_dcbf(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)794 static target_ulong h_logical_dcbf(PowerPCCPU *cpu, SpaprMachineState *spapr,
795 target_ulong opcode, target_ulong *args)
796 {
797 /* Nothing to do on emulation, KVM will trap this in the kernel */
798 return H_SUCCESS;
799 }
800
h_set_mode_resource_set_ciabr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong value1,target_ulong value2)801 static target_ulong h_set_mode_resource_set_ciabr(PowerPCCPU *cpu,
802 SpaprMachineState *spapr,
803 target_ulong mflags,
804 target_ulong value1,
805 target_ulong value2)
806 {
807 CPUPPCState *env = &cpu->env;
808
809 assert(tcg_enabled()); /* KVM will have handled this */
810
811 if (mflags) {
812 return H_UNSUPPORTED_FLAG;
813 }
814 if (value2) {
815 return H_P4;
816 }
817 if ((value1 & PPC_BITMASK(62, 63)) == 0x3) {
818 return H_P3;
819 }
820
821 ppc_store_ciabr(env, value1);
822
823 return H_SUCCESS;
824 }
825
h_set_mode_resource_set_dawr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong resource,target_ulong value1,target_ulong value2)826 static target_ulong h_set_mode_resource_set_dawr(PowerPCCPU *cpu,
827 SpaprMachineState *spapr,
828 target_ulong mflags,
829 target_ulong resource,
830 target_ulong value1,
831 target_ulong value2)
832 {
833 CPUPPCState *env = &cpu->env;
834
835 assert(tcg_enabled()); /* KVM will have handled this */
836
837 if (mflags) {
838 return H_UNSUPPORTED_FLAG;
839 }
840 if (value2 & PPC_BIT(61)) {
841 return H_P4;
842 }
843
844 if (resource == H_SET_MODE_RESOURCE_SET_DAWR0) {
845 ppc_store_dawr0(env, value1);
846 ppc_store_dawrx0(env, value2);
847 } else if (resource == H_SET_MODE_RESOURCE_SET_DAWR1) {
848 ppc_store_dawr1(env, value1);
849 ppc_store_dawrx1(env, value2);
850 } else {
851 g_assert_not_reached();
852 }
853
854 return H_SUCCESS;
855 }
856
h_set_mode_resource_le(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong value1,target_ulong value2)857 static target_ulong h_set_mode_resource_le(PowerPCCPU *cpu,
858 SpaprMachineState *spapr,
859 target_ulong mflags,
860 target_ulong value1,
861 target_ulong value2)
862 {
863 if (value1) {
864 return H_P3;
865 }
866 if (value2) {
867 return H_P4;
868 }
869
870 switch (mflags) {
871 case H_SET_MODE_ENDIAN_BIG:
872 spapr_set_all_lpcrs(0, LPCR_ILE);
873 spapr_pci_switch_vga(spapr, true);
874 return H_SUCCESS;
875
876 case H_SET_MODE_ENDIAN_LITTLE:
877 spapr_set_all_lpcrs(LPCR_ILE, LPCR_ILE);
878 spapr_pci_switch_vga(spapr, false);
879 return H_SUCCESS;
880 }
881
882 return H_UNSUPPORTED_FLAG;
883 }
884
h_set_mode_resource_addr_trans_mode(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong value1,target_ulong value2)885 static target_ulong h_set_mode_resource_addr_trans_mode(PowerPCCPU *cpu,
886 SpaprMachineState *spapr,
887 target_ulong mflags,
888 target_ulong value1,
889 target_ulong value2)
890 {
891 if (value1) {
892 return H_P3;
893 }
894
895 if (value2) {
896 return H_P4;
897 }
898
899 /*
900 * AIL-1 is not architected, and AIL-2 is not supported by QEMU spapr.
901 * It is supported for faithful emulation of bare metal systems, but for
902 * compatibility concerns we leave it out of the pseries machine.
903 */
904 if (mflags != 0 && mflags != 3) {
905 return H_UNSUPPORTED_FLAG;
906 }
907
908 if (mflags == 3) {
909 if (!spapr_get_cap(spapr, SPAPR_CAP_AIL_MODE_3)) {
910 return H_UNSUPPORTED_FLAG;
911 }
912 }
913
914 spapr_set_all_lpcrs(mflags << LPCR_AIL_SHIFT, LPCR_AIL);
915
916 return H_SUCCESS;
917 }
918
h_set_mode(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)919 static target_ulong h_set_mode(PowerPCCPU *cpu, SpaprMachineState *spapr,
920 target_ulong opcode, target_ulong *args)
921 {
922 target_ulong resource = args[1];
923 target_ulong ret = H_P2;
924
925 switch (resource) {
926 case H_SET_MODE_RESOURCE_SET_CIABR:
927 ret = h_set_mode_resource_set_ciabr(cpu, spapr, args[0], args[2],
928 args[3]);
929 break;
930 case H_SET_MODE_RESOURCE_SET_DAWR0:
931 case H_SET_MODE_RESOURCE_SET_DAWR1:
932 ret = h_set_mode_resource_set_dawr(cpu, spapr, args[0], args[1],
933 args[2], args[3]);
934 break;
935 case H_SET_MODE_RESOURCE_LE:
936 ret = h_set_mode_resource_le(cpu, spapr, args[0], args[2], args[3]);
937 break;
938 case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE:
939 ret = h_set_mode_resource_addr_trans_mode(cpu, spapr, args[0],
940 args[2], args[3]);
941 break;
942 }
943
944 return ret;
945 }
946
h_clean_slb(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)947 static target_ulong h_clean_slb(PowerPCCPU *cpu, SpaprMachineState *spapr,
948 target_ulong opcode, target_ulong *args)
949 {
950 qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx"%s\n",
951 opcode, " (H_CLEAN_SLB)");
952 return H_FUNCTION;
953 }
954
h_invalidate_pid(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)955 static target_ulong h_invalidate_pid(PowerPCCPU *cpu, SpaprMachineState *spapr,
956 target_ulong opcode, target_ulong *args)
957 {
958 qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx"%s\n",
959 opcode, " (H_INVALIDATE_PID)");
960 return H_FUNCTION;
961 }
962
spapr_check_setup_free_hpt(SpaprMachineState * spapr,uint64_t patbe_old,uint64_t patbe_new)963 static void spapr_check_setup_free_hpt(SpaprMachineState *spapr,
964 uint64_t patbe_old, uint64_t patbe_new)
965 {
966 /*
967 * We have 4 Options:
968 * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
969 * HASH->RADIX : Free HPT
970 * RADIX->HASH : Allocate HPT
971 * NOTHING->HASH : Allocate HPT
972 * Note: NOTHING implies the case where we said the guest could choose
973 * later and so assumed radix and now it's called H_REG_PROC_TBL
974 */
975
976 if ((patbe_old & PATE1_GR) == (patbe_new & PATE1_GR)) {
977 /* We assume RADIX, so this catches all the "Do Nothing" cases */
978 } else if (!(patbe_old & PATE1_GR)) {
979 /* HASH->RADIX : Free HPT */
980 spapr_free_hpt(spapr);
981 } else if (!(patbe_new & PATE1_GR)) {
982 /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
983 spapr_setup_hpt(spapr);
984 }
985 }
986
987 #define FLAGS_MASK 0x01FULL
988 #define FLAG_MODIFY 0x10
989 #define FLAG_REGISTER 0x08
990 #define FLAG_RADIX 0x04
991 #define FLAG_HASH_PROC_TBL 0x02
992 #define FLAG_GTSE 0x01
993
h_register_process_table(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)994 static target_ulong h_register_process_table(PowerPCCPU *cpu,
995 SpaprMachineState *spapr,
996 target_ulong opcode,
997 target_ulong *args)
998 {
999 target_ulong flags = args[0];
1000 target_ulong proc_tbl = args[1];
1001 target_ulong page_size = args[2];
1002 target_ulong table_size = args[3];
1003 target_ulong update_lpcr = 0;
1004 target_ulong table_byte_size;
1005 uint64_t cproc;
1006
1007 if (flags & ~FLAGS_MASK) { /* Check no reserved bits are set */
1008 return H_PARAMETER;
1009 }
1010 if (flags & FLAG_MODIFY) {
1011 if (flags & FLAG_REGISTER) {
1012 /* Check process table alignment */
1013 table_byte_size = 1ULL << (table_size + 12);
1014 if (proc_tbl & (table_byte_size - 1)) {
1015 qemu_log_mask(LOG_GUEST_ERROR,
1016 "%s: process table not properly aligned: proc_tbl 0x"
1017 TARGET_FMT_lx" proc_tbl_size 0x"TARGET_FMT_lx"\n",
1018 __func__, proc_tbl, table_byte_size);
1019 }
1020 if (flags & FLAG_RADIX) { /* Register new RADIX process table */
1021 if (proc_tbl & 0xfff || proc_tbl >> 60) {
1022 return H_P2;
1023 } else if (page_size) {
1024 return H_P3;
1025 } else if (table_size > 24) {
1026 return H_P4;
1027 }
1028 cproc = PATE1_GR | proc_tbl | table_size;
1029 } else { /* Register new HPT process table */
1030 if (flags & FLAG_HASH_PROC_TBL) { /* Hash with Segment Tables */
1031 /* TODO - Not Supported */
1032 /* Technically caused by flag bits => H_PARAMETER */
1033 return H_PARAMETER;
1034 } else { /* Hash with SLB */
1035 if (proc_tbl >> 38) {
1036 return H_P2;
1037 } else if (page_size & ~0x7) {
1038 return H_P3;
1039 } else if (table_size > 24) {
1040 return H_P4;
1041 }
1042 }
1043 cproc = (proc_tbl << 25) | page_size << 5 | table_size;
1044 }
1045
1046 } else { /* Deregister current process table */
1047 /*
1048 * Set to benign value: (current GR) | 0. This allows
1049 * deregistration in KVM to succeed even if the radix bit
1050 * in flags doesn't match the radix bit in the old PATE.
1051 */
1052 cproc = spapr->patb_entry & PATE1_GR;
1053 }
1054 } else { /* Maintain current registration */
1055 if (!(flags & FLAG_RADIX) != !(spapr->patb_entry & PATE1_GR)) {
1056 /* Technically caused by flag bits => H_PARAMETER */
1057 return H_PARAMETER; /* Existing Process Table Mismatch */
1058 }
1059 cproc = spapr->patb_entry;
1060 }
1061
1062 /* Check if we need to setup OR free the hpt */
1063 spapr_check_setup_free_hpt(spapr, spapr->patb_entry, cproc);
1064
1065 spapr->patb_entry = cproc; /* Save new process table */
1066
1067 /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
1068 if (flags & FLAG_RADIX) /* Radix must use process tables, also set HR */
1069 update_lpcr |= (LPCR_UPRT | LPCR_HR);
1070 else if (flags & FLAG_HASH_PROC_TBL) /* Hash with process tables */
1071 update_lpcr |= LPCR_UPRT;
1072 if (flags & FLAG_GTSE) /* Guest translation shootdown enable */
1073 update_lpcr |= LPCR_GTSE;
1074
1075 spapr_set_all_lpcrs(update_lpcr, LPCR_UPRT | LPCR_HR | LPCR_GTSE);
1076
1077 if (kvm_enabled()) {
1078 return kvmppc_configure_v3_mmu(cpu, flags & FLAG_RADIX,
1079 flags & FLAG_GTSE, cproc);
1080 }
1081 return H_SUCCESS;
1082 }
1083
1084 #define H_SIGNAL_SYS_RESET_ALL -1
1085 #define H_SIGNAL_SYS_RESET_ALLBUTSELF -2
1086
h_signal_sys_reset(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1087 static target_ulong h_signal_sys_reset(PowerPCCPU *cpu,
1088 SpaprMachineState *spapr,
1089 target_ulong opcode, target_ulong *args)
1090 {
1091 target_long target = args[0];
1092 CPUState *cs;
1093
1094 if (target < 0) {
1095 /* Broadcast */
1096 if (target < H_SIGNAL_SYS_RESET_ALLBUTSELF) {
1097 return H_PARAMETER;
1098 }
1099
1100 CPU_FOREACH(cs) {
1101 PowerPCCPU *c = POWERPC_CPU(cs);
1102
1103 if (target == H_SIGNAL_SYS_RESET_ALLBUTSELF) {
1104 if (c == cpu) {
1105 continue;
1106 }
1107 }
1108 run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
1109 }
1110 return H_SUCCESS;
1111
1112 } else {
1113 /* Unicast */
1114 cs = CPU(spapr_find_cpu(target));
1115 if (cs) {
1116 run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
1117 return H_SUCCESS;
1118 }
1119 return H_PARAMETER;
1120 }
1121 }
1122
1123 /* Returns either a logical PVR or zero if none was found */
cas_check_pvr(PowerPCCPU * cpu,uint32_t max_compat,target_ulong * addr,bool * raw_mode_supported)1124 static uint32_t cas_check_pvr(PowerPCCPU *cpu, uint32_t max_compat,
1125 target_ulong *addr, bool *raw_mode_supported)
1126 {
1127 bool explicit_match = false; /* Matched the CPU's real PVR */
1128 uint32_t best_compat = 0;
1129 int i;
1130
1131 /*
1132 * We scan the supplied table of PVRs looking for two things
1133 * 1. Is our real CPU PVR in the list?
1134 * 2. What's the "best" listed logical PVR
1135 */
1136 for (i = 0; i < 512; ++i) {
1137 uint32_t pvr, pvr_mask;
1138
1139 pvr_mask = ldl_be_phys(&address_space_memory, *addr);
1140 pvr = ldl_be_phys(&address_space_memory, *addr + 4);
1141 *addr += 8;
1142
1143 if (~pvr_mask & pvr) {
1144 break; /* Terminator record */
1145 }
1146
1147 if ((cpu->env.spr[SPR_PVR] & pvr_mask) == (pvr & pvr_mask)) {
1148 explicit_match = true;
1149 } else {
1150 if (ppc_check_compat(cpu, pvr, best_compat, max_compat)) {
1151 best_compat = pvr;
1152 }
1153 }
1154 }
1155
1156 *raw_mode_supported = explicit_match;
1157
1158 /* Parsing finished */
1159 trace_spapr_cas_pvr(cpu->compat_pvr, explicit_match, best_compat);
1160
1161 return best_compat;
1162 }
1163
1164 static
do_client_architecture_support(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong vec,target_ulong fdt_bufsize)1165 target_ulong do_client_architecture_support(PowerPCCPU *cpu,
1166 SpaprMachineState *spapr,
1167 target_ulong vec,
1168 target_ulong fdt_bufsize)
1169 {
1170 target_ulong ov_table; /* Working address in data buffer */
1171 uint32_t cas_pvr;
1172 SpaprOptionVector *ov1_guest, *ov5_guest;
1173 bool guest_radix;
1174 bool raw_mode_supported = false;
1175 bool guest_xive;
1176 CPUState *cs;
1177 void *fdt;
1178 uint32_t max_compat = spapr->max_compat_pvr;
1179
1180 /* CAS is supposed to be called early when only the boot vCPU is active. */
1181 CPU_FOREACH(cs) {
1182 if (cs == CPU(cpu)) {
1183 continue;
1184 }
1185 if (!cs->halted) {
1186 warn_report("guest has multiple active vCPUs at CAS, which is not allowed");
1187 return H_MULTI_THREADS_ACTIVE;
1188 }
1189 }
1190
1191 cas_pvr = cas_check_pvr(cpu, max_compat, &vec, &raw_mode_supported);
1192 if (!cas_pvr && (!raw_mode_supported || max_compat)) {
1193 /*
1194 * We couldn't find a suitable compatibility mode, and either
1195 * the guest doesn't support "raw" mode for this CPU, or "raw"
1196 * mode is disabled because a maximum compat mode is set.
1197 */
1198 error_report("Couldn't negotiate a suitable PVR during CAS");
1199 return H_HARDWARE;
1200 }
1201
1202 /* Update CPUs */
1203 if (cpu->compat_pvr != cas_pvr) {
1204 Error *local_err = NULL;
1205
1206 if (ppc_set_compat_all(cas_pvr, &local_err) < 0) {
1207 /* We fail to set compat mode (likely because running with KVM PR),
1208 * but maybe we can fallback to raw mode if the guest supports it.
1209 */
1210 if (!raw_mode_supported) {
1211 error_report_err(local_err);
1212 return H_HARDWARE;
1213 }
1214 error_free(local_err);
1215 }
1216 }
1217
1218 /* For the future use: here @ov_table points to the first option vector */
1219 ov_table = vec;
1220
1221 ov1_guest = spapr_ovec_parse_vector(ov_table, 1);
1222 if (!ov1_guest) {
1223 warn_report("guest didn't provide option vector 1");
1224 return H_PARAMETER;
1225 }
1226 ov5_guest = spapr_ovec_parse_vector(ov_table, 5);
1227 if (!ov5_guest) {
1228 spapr_ovec_cleanup(ov1_guest);
1229 warn_report("guest didn't provide option vector 5");
1230 return H_PARAMETER;
1231 }
1232 if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) {
1233 error_report("guest requested hash and radix MMU, which is invalid.");
1234 exit(EXIT_FAILURE);
1235 }
1236 if (spapr_ovec_test(ov5_guest, OV5_XIVE_BOTH)) {
1237 error_report("guest requested an invalid interrupt mode");
1238 exit(EXIT_FAILURE);
1239 }
1240
1241 guest_radix = spapr_ovec_test(ov5_guest, OV5_MMU_RADIX_300);
1242
1243 guest_xive = spapr_ovec_test(ov5_guest, OV5_XIVE_EXPLOIT);
1244
1245 /*
1246 * HPT resizing is a bit of a special case, because when enabled
1247 * we assume an HPT guest will support it until it says it
1248 * doesn't, instead of assuming it won't support it until it says
1249 * it does. Strictly speaking that approach could break for
1250 * guests which don't make a CAS call, but those are so old we
1251 * don't care about them. Without that assumption we'd have to
1252 * make at least a temporary allocation of an HPT sized for max
1253 * memory, which could be impossibly difficult under KVM HV if
1254 * maxram is large.
1255 */
1256 if (!guest_radix && !spapr_ovec_test(ov5_guest, OV5_HPT_RESIZE)) {
1257 int maxshift = spapr_hpt_shift_for_ramsize(MACHINE(spapr)->maxram_size);
1258
1259 if (spapr->resize_hpt == SPAPR_RESIZE_HPT_REQUIRED) {
1260 error_report(
1261 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1262 exit(1);
1263 }
1264
1265 if (spapr->htab_shift < maxshift) {
1266 /* Guest doesn't know about HPT resizing, so we
1267 * pre-emptively resize for the maximum permitted RAM. At
1268 * the point this is called, nothing should have been
1269 * entered into the existing HPT */
1270 spapr_reallocate_hpt(spapr, maxshift, &error_fatal);
1271 push_sregs_to_kvm_pr(spapr);
1272 }
1273 }
1274
1275 /* NOTE: there are actually a number of ov5 bits where input from the
1276 * guest is always zero, and the platform/QEMU enables them independently
1277 * of guest input. To model these properly we'd want some sort of mask,
1278 * but since they only currently apply to memory migration as defined
1279 * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1280 * to worry about this for now.
1281 */
1282
1283 /* full range of negotiated ov5 capabilities */
1284 spapr_ovec_intersect(spapr->ov5_cas, spapr->ov5, ov5_guest);
1285 spapr_ovec_cleanup(ov5_guest);
1286
1287 spapr_check_mmu_mode(guest_radix);
1288
1289 spapr->cas_pre_isa3_guest = !spapr_ovec_test(ov1_guest, OV1_PPC_3_00);
1290 spapr_ovec_cleanup(ov1_guest);
1291
1292 /*
1293 * Check for NUMA affinity conditions now that we know which NUMA
1294 * affinity the guest will use.
1295 */
1296 spapr_numa_associativity_check(spapr);
1297
1298 /*
1299 * Ensure the guest asks for an interrupt mode we support;
1300 * otherwise terminate the boot.
1301 */
1302 if (guest_xive) {
1303 if (!spapr->irq->xive) {
1304 error_report(
1305 "Guest requested unavailable interrupt mode (XIVE), try the ic-mode=xive or ic-mode=dual machine property");
1306 exit(EXIT_FAILURE);
1307 }
1308 } else {
1309 if (!spapr->irq->xics) {
1310 error_report(
1311 "Guest requested unavailable interrupt mode (XICS), either don't set the ic-mode machine property or try ic-mode=xics or ic-mode=dual");
1312 exit(EXIT_FAILURE);
1313 }
1314 }
1315
1316 spapr_irq_update_active_intc(spapr);
1317
1318 /*
1319 * Process all pending hot-plug/unplug requests now. An updated full
1320 * rendered FDT will be returned to the guest.
1321 */
1322 spapr_drc_reset_all(spapr);
1323 spapr_clear_pending_hotplug_events(spapr);
1324
1325 /*
1326 * If spapr_machine_reset() did not set up a HPT but one is necessary
1327 * (because the guest isn't going to use radix) then set it up here.
1328 */
1329 if ((spapr->patb_entry & PATE1_GR) && !guest_radix) {
1330 /* legacy hash or new hash: */
1331 spapr_setup_hpt(spapr);
1332 }
1333
1334 fdt = spapr_build_fdt(spapr, spapr->vof != NULL, fdt_bufsize);
1335 g_free(spapr->fdt_blob);
1336 spapr->fdt_size = fdt_totalsize(fdt);
1337 spapr->fdt_initial_size = spapr->fdt_size;
1338 spapr->fdt_blob = fdt;
1339
1340 /*
1341 * Set the machine->fdt pointer again since we just freed
1342 * it above (by freeing spapr->fdt_blob). We set this
1343 * pointer to enable support for the 'dumpdtb' QMP/HMP
1344 * command.
1345 */
1346 MACHINE(spapr)->fdt = fdt;
1347
1348 return H_SUCCESS;
1349 }
1350
h_client_architecture_support(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1351 static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
1352 SpaprMachineState *spapr,
1353 target_ulong opcode,
1354 target_ulong *args)
1355 {
1356 target_ulong vec = ppc64_phys_to_real(args[0]);
1357 target_ulong fdt_buf = args[1];
1358 target_ulong fdt_bufsize = args[2];
1359 target_ulong ret;
1360 SpaprDeviceTreeUpdateHeader hdr = { .version_id = 1 };
1361
1362 if (fdt_bufsize < sizeof(hdr)) {
1363 error_report("SLOF provided insufficient CAS buffer "
1364 TARGET_FMT_lu " (min: %zu)", fdt_bufsize, sizeof(hdr));
1365 exit(EXIT_FAILURE);
1366 }
1367
1368 fdt_bufsize -= sizeof(hdr);
1369
1370 ret = do_client_architecture_support(cpu, spapr, vec, fdt_bufsize);
1371 if (ret == H_SUCCESS) {
1372 _FDT((fdt_pack(spapr->fdt_blob)));
1373 spapr->fdt_size = fdt_totalsize(spapr->fdt_blob);
1374 spapr->fdt_initial_size = spapr->fdt_size;
1375
1376 cpu_physical_memory_write(fdt_buf, &hdr, sizeof(hdr));
1377 cpu_physical_memory_write(fdt_buf + sizeof(hdr), spapr->fdt_blob,
1378 spapr->fdt_size);
1379 trace_spapr_cas_continue(spapr->fdt_size + sizeof(hdr));
1380 }
1381
1382 return ret;
1383 }
1384
spapr_vof_client_architecture_support(MachineState * ms,CPUState * cs,target_ulong ovec_addr)1385 target_ulong spapr_vof_client_architecture_support(MachineState *ms,
1386 CPUState *cs,
1387 target_ulong ovec_addr)
1388 {
1389 SpaprMachineState *spapr = SPAPR_MACHINE(ms);
1390
1391 target_ulong ret = do_client_architecture_support(POWERPC_CPU(cs), spapr,
1392 ovec_addr, FDT_MAX_SIZE);
1393
1394 /*
1395 * This adds stdout and generates phandles for boottime and CAS FDTs.
1396 * It is alright to update the FDT here as do_client_architecture_support()
1397 * does not pack it.
1398 */
1399 spapr_vof_client_dt_finalize(spapr, spapr->fdt_blob);
1400
1401 return ret;
1402 }
1403
h_get_cpu_characteristics(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1404 static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
1405 SpaprMachineState *spapr,
1406 target_ulong opcode,
1407 target_ulong *args)
1408 {
1409 uint64_t characteristics = H_CPU_CHAR_HON_BRANCH_HINTS &
1410 ~H_CPU_CHAR_THR_RECONF_TRIG;
1411 uint64_t behaviour = H_CPU_BEHAV_FAVOUR_SECURITY;
1412 uint8_t safe_cache = spapr_get_cap(spapr, SPAPR_CAP_CFPC);
1413 uint8_t safe_bounds_check = spapr_get_cap(spapr, SPAPR_CAP_SBBC);
1414 uint8_t safe_indirect_branch = spapr_get_cap(spapr, SPAPR_CAP_IBS);
1415 uint8_t count_cache_flush_assist = spapr_get_cap(spapr,
1416 SPAPR_CAP_CCF_ASSIST);
1417
1418 switch (safe_cache) {
1419 case SPAPR_CAP_WORKAROUND:
1420 characteristics |= H_CPU_CHAR_L1D_FLUSH_ORI30;
1421 characteristics |= H_CPU_CHAR_L1D_FLUSH_TRIG2;
1422 characteristics |= H_CPU_CHAR_L1D_THREAD_PRIV;
1423 behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
1424 break;
1425 case SPAPR_CAP_FIXED:
1426 behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY;
1427 behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS;
1428 break;
1429 default: /* broken */
1430 assert(safe_cache == SPAPR_CAP_BROKEN);
1431 behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
1432 break;
1433 }
1434
1435 switch (safe_bounds_check) {
1436 case SPAPR_CAP_WORKAROUND:
1437 characteristics |= H_CPU_CHAR_SPEC_BAR_ORI31;
1438 behaviour |= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
1439 break;
1440 case SPAPR_CAP_FIXED:
1441 break;
1442 default: /* broken */
1443 assert(safe_bounds_check == SPAPR_CAP_BROKEN);
1444 behaviour |= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
1445 break;
1446 }
1447
1448 switch (safe_indirect_branch) {
1449 case SPAPR_CAP_FIXED_NA:
1450 break;
1451 case SPAPR_CAP_FIXED_CCD:
1452 characteristics |= H_CPU_CHAR_CACHE_COUNT_DIS;
1453 break;
1454 case SPAPR_CAP_FIXED_IBS:
1455 characteristics |= H_CPU_CHAR_BCCTRL_SERIALISED;
1456 break;
1457 case SPAPR_CAP_WORKAROUND:
1458 behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
1459 if (count_cache_flush_assist) {
1460 characteristics |= H_CPU_CHAR_BCCTR_FLUSH_ASSIST;
1461 }
1462 break;
1463 default: /* broken */
1464 assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
1465 break;
1466 }
1467
1468 args[0] = characteristics;
1469 args[1] = behaviour;
1470 return H_SUCCESS;
1471 }
1472
h_update_dt(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1473 static target_ulong h_update_dt(PowerPCCPU *cpu, SpaprMachineState *spapr,
1474 target_ulong opcode, target_ulong *args)
1475 {
1476 target_ulong dt = ppc64_phys_to_real(args[0]);
1477 struct fdt_header hdr = { 0 };
1478 unsigned cb;
1479 SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
1480 void *fdt;
1481
1482 cpu_physical_memory_read(dt, &hdr, sizeof(hdr));
1483 cb = fdt32_to_cpu(hdr.totalsize);
1484
1485 if (!smc->update_dt_enabled) {
1486 return H_SUCCESS;
1487 }
1488
1489 /* Check that the fdt did not grow out of proportion */
1490 if (cb > spapr->fdt_initial_size * 2) {
1491 trace_spapr_update_dt_failed_size(spapr->fdt_initial_size, cb,
1492 fdt32_to_cpu(hdr.magic));
1493 return H_PARAMETER;
1494 }
1495
1496 fdt = g_malloc0(cb);
1497 cpu_physical_memory_read(dt, fdt, cb);
1498
1499 /* Check the fdt consistency */
1500 if (fdt_check_full(fdt, cb)) {
1501 trace_spapr_update_dt_failed_check(spapr->fdt_initial_size, cb,
1502 fdt32_to_cpu(hdr.magic));
1503 return H_PARAMETER;
1504 }
1505
1506 g_free(spapr->fdt_blob);
1507 spapr->fdt_size = cb;
1508 spapr->fdt_blob = fdt;
1509 trace_spapr_update_dt(cb);
1510
1511 return H_SUCCESS;
1512 }
1513
1514 static spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
1515 static spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE + 1];
1516 static spapr_hcall_fn svm_hypercall_table[(SVM_HCALL_MAX - SVM_HCALL_BASE) / 4 + 1];
1517
spapr_register_hypercall(target_ulong opcode,spapr_hcall_fn fn)1518 void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)
1519 {
1520 spapr_hcall_fn *slot;
1521
1522 if (opcode <= MAX_HCALL_OPCODE) {
1523 assert((opcode & 0x3) == 0);
1524
1525 slot = &papr_hypercall_table[opcode / 4];
1526 } else if (opcode >= SVM_HCALL_BASE && opcode <= SVM_HCALL_MAX) {
1527 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1528 assert((opcode & 0x3) == 0);
1529
1530 slot = &svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1531 } else {
1532 assert((opcode >= KVMPPC_HCALL_BASE) && (opcode <= KVMPPC_HCALL_MAX));
1533
1534 slot = &kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1535 }
1536
1537 assert(!(*slot));
1538 *slot = fn;
1539 }
1540
spapr_unregister_hypercall(target_ulong opcode)1541 void spapr_unregister_hypercall(target_ulong opcode)
1542 {
1543 spapr_hcall_fn *slot;
1544
1545 if (opcode <= MAX_HCALL_OPCODE) {
1546 assert((opcode & 0x3) == 0);
1547
1548 slot = &papr_hypercall_table[opcode / 4];
1549 } else if (opcode >= SVM_HCALL_BASE && opcode <= SVM_HCALL_MAX) {
1550 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1551 assert((opcode & 0x3) == 0);
1552
1553 slot = &svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1554 } else {
1555 assert((opcode >= KVMPPC_HCALL_BASE) && (opcode <= KVMPPC_HCALL_MAX));
1556
1557 slot = &kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1558 }
1559
1560 *slot = NULL;
1561 }
1562
spapr_hypercall(PowerPCCPU * cpu,target_ulong opcode,target_ulong * args)1563 target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
1564 target_ulong *args)
1565 {
1566 SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
1567
1568 if ((opcode <= MAX_HCALL_OPCODE)
1569 && ((opcode & 0x3) == 0)) {
1570 spapr_hcall_fn fn = papr_hypercall_table[opcode / 4];
1571
1572 if (fn) {
1573 return fn(cpu, spapr, opcode, args);
1574 }
1575 } else if ((opcode >= SVM_HCALL_BASE) &&
1576 (opcode <= SVM_HCALL_MAX)) {
1577 spapr_hcall_fn fn = svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1578
1579 if (fn) {
1580 return fn(cpu, spapr, opcode, args);
1581 }
1582 } else if ((opcode >= KVMPPC_HCALL_BASE) &&
1583 (opcode <= KVMPPC_HCALL_MAX)) {
1584 spapr_hcall_fn fn = kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1585
1586 if (fn) {
1587 return fn(cpu, spapr, opcode, args);
1588 }
1589 }
1590
1591 qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx "\n",
1592 opcode);
1593 return H_FUNCTION;
1594 }
1595
1596 #ifdef CONFIG_TCG
hypercall_register_softmmu(void)1597 static void hypercall_register_softmmu(void)
1598 {
1599 /* DO NOTHING */
1600 }
1601 #else
h_softmmu(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1602 static target_ulong h_softmmu(PowerPCCPU *cpu, SpaprMachineState *spapr,
1603 target_ulong opcode, target_ulong *args)
1604 {
1605 g_assert_not_reached();
1606 }
1607
hypercall_register_softmmu(void)1608 static void hypercall_register_softmmu(void)
1609 {
1610 /* hcall-pft */
1611 spapr_register_hypercall(H_ENTER, h_softmmu);
1612 spapr_register_hypercall(H_REMOVE, h_softmmu);
1613 spapr_register_hypercall(H_PROTECT, h_softmmu);
1614 spapr_register_hypercall(H_READ, h_softmmu);
1615
1616 /* hcall-bulk */
1617 spapr_register_hypercall(H_BULK_REMOVE, h_softmmu);
1618 }
1619 #endif
1620
hypercall_register_types(void)1621 static void hypercall_register_types(void)
1622 {
1623 hypercall_register_softmmu();
1624
1625 /* hcall-hpt-resize */
1626 spapr_register_hypercall(H_RESIZE_HPT_PREPARE, h_resize_hpt_prepare);
1627 spapr_register_hypercall(H_RESIZE_HPT_COMMIT, h_resize_hpt_commit);
1628
1629 /* hcall-splpar */
1630 spapr_register_hypercall(H_REGISTER_VPA, h_register_vpa);
1631 spapr_register_hypercall(H_CEDE, h_cede);
1632 spapr_register_hypercall(H_CONFER, h_confer);
1633 spapr_register_hypercall(H_PROD, h_prod);
1634
1635 /* hcall-join */
1636 spapr_register_hypercall(H_JOIN, h_join);
1637
1638 spapr_register_hypercall(H_SIGNAL_SYS_RESET, h_signal_sys_reset);
1639
1640 /* processor register resource access h-calls */
1641 spapr_register_hypercall(H_SET_SPRG0, h_set_sprg0);
1642 spapr_register_hypercall(H_SET_DABR, h_set_dabr);
1643 spapr_register_hypercall(H_SET_XDABR, h_set_xdabr);
1644 spapr_register_hypercall(H_PAGE_INIT, h_page_init);
1645 spapr_register_hypercall(H_SET_MODE, h_set_mode);
1646
1647 /* In Memory Table MMU h-calls */
1648 spapr_register_hypercall(H_CLEAN_SLB, h_clean_slb);
1649 spapr_register_hypercall(H_INVALIDATE_PID, h_invalidate_pid);
1650 spapr_register_hypercall(H_REGISTER_PROC_TBL, h_register_process_table);
1651
1652 /* hcall-get-cpu-characteristics */
1653 spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS,
1654 h_get_cpu_characteristics);
1655
1656 /* "debugger" hcalls (also used by SLOF). Note: We do -not- differentiate
1657 * here between the "CI" and the "CACHE" variants, they will use whatever
1658 * mapping attributes qemu is using. When using KVM, the kernel will
1659 * enforce the attributes more strongly
1660 */
1661 spapr_register_hypercall(H_LOGICAL_CI_LOAD, h_logical_load);
1662 spapr_register_hypercall(H_LOGICAL_CI_STORE, h_logical_store);
1663 spapr_register_hypercall(H_LOGICAL_CACHE_LOAD, h_logical_load);
1664 spapr_register_hypercall(H_LOGICAL_CACHE_STORE, h_logical_store);
1665 spapr_register_hypercall(H_LOGICAL_ICBI, h_logical_icbi);
1666 spapr_register_hypercall(H_LOGICAL_DCBF, h_logical_dcbf);
1667 spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP, h_logical_memop);
1668
1669 /* qemu/KVM-PPC specific hcalls */
1670 spapr_register_hypercall(KVMPPC_H_RTAS, h_rtas);
1671
1672 /* ibm,client-architecture-support support */
1673 spapr_register_hypercall(KVMPPC_H_CAS, h_client_architecture_support);
1674
1675 spapr_register_hypercall(KVMPPC_H_UPDATE_DT, h_update_dt);
1676 }
1677
1678 type_init(hypercall_register_types)
1679