1 #include "qemu/osdep.h"
2 #include "qemu/cutils.h"
3 #include "qapi/error.h"
4 #include "system/hw_accel.h"
5 #include "system/runstate.h"
6 #include "system/tcg.h"
7 #include "qemu/log.h"
8 #include "qemu/main-loop.h"
9 #include "qemu/module.h"
10 #include "qemu/error-report.h"
11 #include "exec/tb-flush.h"
12 #include "helper_regs.h"
13 #include "hw/ppc/ppc.h"
14 #include "hw/ppc/spapr.h"
15 #include "hw/ppc/spapr_cpu_core.h"
16 #include "hw/ppc/spapr_nested.h"
17 #include "mmu-hash64.h"
18 #include "cpu-models.h"
19 #include "trace.h"
20 #include "kvm_ppc.h"
21 #include "hw/ppc/fdt.h"
22 #include "hw/ppc/spapr_ovec.h"
23 #include "hw/ppc/spapr_numa.h"
24 #include "mmu-book3s-v3.h"
25 #include "hw/mem/memory-device.h"
26
is_ram_address(SpaprMachineState * spapr,hwaddr addr)27 bool is_ram_address(SpaprMachineState *spapr, hwaddr addr)
28 {
29 MachineState *machine = MACHINE(spapr);
30 DeviceMemoryState *dms = machine->device_memory;
31
32 if (addr < machine->ram_size) {
33 return true;
34 }
35 if (dms && (addr >= dms->base)
36 && ((addr - dms->base) < memory_region_size(&dms->mr))) {
37 return true;
38 }
39
40 return false;
41 }
42
43 /* Convert a return code from the KVM ioctl()s implementing resize HPT
44 * into a PAPR hypercall return code */
resize_hpt_convert_rc(int ret)45 static target_ulong resize_hpt_convert_rc(int ret)
46 {
47 if (ret >= 100000) {
48 return H_LONG_BUSY_ORDER_100_SEC;
49 } else if (ret >= 10000) {
50 return H_LONG_BUSY_ORDER_10_SEC;
51 } else if (ret >= 1000) {
52 return H_LONG_BUSY_ORDER_1_SEC;
53 } else if (ret >= 100) {
54 return H_LONG_BUSY_ORDER_100_MSEC;
55 } else if (ret >= 10) {
56 return H_LONG_BUSY_ORDER_10_MSEC;
57 } else if (ret > 0) {
58 return H_LONG_BUSY_ORDER_1_MSEC;
59 }
60
61 switch (ret) {
62 case 0:
63 return H_SUCCESS;
64 case -EPERM:
65 return H_AUTHORITY;
66 case -EINVAL:
67 return H_PARAMETER;
68 case -ENXIO:
69 return H_CLOSED;
70 case -ENOSPC:
71 return H_PTEG_FULL;
72 case -EBUSY:
73 return H_BUSY;
74 case -ENOMEM:
75 return H_NO_MEM;
76 default:
77 return H_HARDWARE;
78 }
79 }
80
h_resize_hpt_prepare(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)81 static target_ulong h_resize_hpt_prepare(PowerPCCPU *cpu,
82 SpaprMachineState *spapr,
83 target_ulong opcode,
84 target_ulong *args)
85 {
86 target_ulong flags = args[0];
87 int shift = args[1];
88 uint64_t current_ram_size;
89 int rc;
90
91 if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
92 return H_AUTHORITY;
93 }
94
95 if (!spapr->htab_shift) {
96 /* Radix guest, no HPT */
97 return H_NOT_AVAILABLE;
98 }
99
100 trace_spapr_h_resize_hpt_prepare(flags, shift);
101
102 if (flags != 0) {
103 return H_PARAMETER;
104 }
105
106 if (shift && ((shift < 18) || (shift > 46))) {
107 return H_PARAMETER;
108 }
109
110 current_ram_size = MACHINE(spapr)->ram_size + get_plugged_memory_size();
111
112 /* We only allow the guest to allocate an HPT one order above what
113 * we'd normally give them (to stop a small guest claiming a huge
114 * chunk of resources in the HPT */
115 if (shift > (spapr_hpt_shift_for_ramsize(current_ram_size) + 1)) {
116 return H_RESOURCE;
117 }
118
119 rc = kvmppc_resize_hpt_prepare(cpu, flags, shift);
120 if (rc != -ENOSYS) {
121 return resize_hpt_convert_rc(rc);
122 }
123
124 if (kvm_enabled()) {
125 return H_HARDWARE;
126 } else if (tcg_enabled()) {
127 return vhyp_mmu_resize_hpt_prepare(cpu, spapr, shift);
128 } else {
129 g_assert_not_reached();
130 }
131 }
132
do_push_sregs_to_kvm_pr(CPUState * cs,run_on_cpu_data data)133 static void do_push_sregs_to_kvm_pr(CPUState *cs, run_on_cpu_data data)
134 {
135 int ret;
136
137 cpu_synchronize_state(cs);
138
139 ret = kvmppc_put_books_sregs(POWERPC_CPU(cs));
140 if (ret < 0) {
141 error_report("failed to push sregs to KVM: %s", strerror(-ret));
142 exit(1);
143 }
144 }
145
push_sregs_to_kvm_pr(SpaprMachineState * spapr)146 void push_sregs_to_kvm_pr(SpaprMachineState *spapr)
147 {
148 CPUState *cs;
149
150 /*
151 * This is a hack for the benefit of KVM PR - it abuses the SDR1
152 * slot in kvm_sregs to communicate the userspace address of the
153 * HPT
154 */
155 if (!kvm_enabled() || !spapr->htab) {
156 return;
157 }
158
159 CPU_FOREACH(cs) {
160 run_on_cpu(cs, do_push_sregs_to_kvm_pr, RUN_ON_CPU_NULL);
161 }
162 }
163
h_resize_hpt_commit(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)164 static target_ulong h_resize_hpt_commit(PowerPCCPU *cpu,
165 SpaprMachineState *spapr,
166 target_ulong opcode,
167 target_ulong *args)
168 {
169 target_ulong flags = args[0];
170 target_ulong shift = args[1];
171 int rc;
172
173 if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
174 return H_AUTHORITY;
175 }
176
177 if (!spapr->htab_shift) {
178 /* Radix guest, no HPT */
179 return H_NOT_AVAILABLE;
180 }
181
182 trace_spapr_h_resize_hpt_commit(flags, shift);
183
184 rc = kvmppc_resize_hpt_commit(cpu, flags, shift);
185 if (rc != -ENOSYS) {
186 rc = resize_hpt_convert_rc(rc);
187 if (rc == H_SUCCESS) {
188 /* Need to set the new htab_shift in the machine state */
189 spapr->htab_shift = shift;
190 }
191 return rc;
192 }
193
194 if (kvm_enabled()) {
195 return H_HARDWARE;
196 } else if (tcg_enabled()) {
197 return vhyp_mmu_resize_hpt_commit(cpu, spapr, flags, shift);
198 } else {
199 g_assert_not_reached();
200 }
201 }
202
203
204
h_set_sprg0(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)205 static target_ulong h_set_sprg0(PowerPCCPU *cpu, SpaprMachineState *spapr,
206 target_ulong opcode, target_ulong *args)
207 {
208 cpu_synchronize_state(CPU(cpu));
209 cpu->env.spr[SPR_SPRG0] = args[0];
210
211 return H_SUCCESS;
212 }
213
h_set_dabr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)214 static target_ulong h_set_dabr(PowerPCCPU *cpu, SpaprMachineState *spapr,
215 target_ulong opcode, target_ulong *args)
216 {
217 if (!ppc_has_spr(cpu, SPR_DABR)) {
218 return H_HARDWARE; /* DABR register not available */
219 }
220 cpu_synchronize_state(CPU(cpu));
221
222 if (ppc_has_spr(cpu, SPR_DABRX)) {
223 cpu->env.spr[SPR_DABRX] = 0x3; /* Use Problem and Privileged state */
224 } else if (!(args[0] & 0x4)) { /* Breakpoint Translation set? */
225 return H_RESERVED_DABR;
226 }
227
228 cpu->env.spr[SPR_DABR] = args[0];
229 return H_SUCCESS;
230 }
231
h_set_xdabr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)232 static target_ulong h_set_xdabr(PowerPCCPU *cpu, SpaprMachineState *spapr,
233 target_ulong opcode, target_ulong *args)
234 {
235 target_ulong dabrx = args[1];
236
237 if (!ppc_has_spr(cpu, SPR_DABR) || !ppc_has_spr(cpu, SPR_DABRX)) {
238 return H_HARDWARE;
239 }
240
241 if ((dabrx & ~0xfULL) != 0 || (dabrx & H_DABRX_HYPERVISOR) != 0
242 || (dabrx & (H_DABRX_KERNEL | H_DABRX_USER)) == 0) {
243 return H_PARAMETER;
244 }
245
246 cpu_synchronize_state(CPU(cpu));
247 cpu->env.spr[SPR_DABRX] = dabrx;
248 cpu->env.spr[SPR_DABR] = args[0];
249
250 return H_SUCCESS;
251 }
252
h_page_init(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)253 static target_ulong h_page_init(PowerPCCPU *cpu, SpaprMachineState *spapr,
254 target_ulong opcode, target_ulong *args)
255 {
256 target_ulong flags = args[0];
257 hwaddr dst = args[1];
258 hwaddr src = args[2];
259 hwaddr len = TARGET_PAGE_SIZE;
260 uint8_t *pdst, *psrc;
261 target_long ret = H_SUCCESS;
262
263 if (flags & ~(H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE
264 | H_COPY_PAGE | H_ZERO_PAGE)) {
265 qemu_log_mask(LOG_UNIMP, "h_page_init: Bad flags (" TARGET_FMT_lx "\n",
266 flags);
267 return H_PARAMETER;
268 }
269
270 /* Map-in destination */
271 if (!is_ram_address(spapr, dst) || (dst & ~TARGET_PAGE_MASK) != 0) {
272 return H_PARAMETER;
273 }
274 pdst = cpu_physical_memory_map(dst, &len, true);
275 if (!pdst || len != TARGET_PAGE_SIZE) {
276 return H_PARAMETER;
277 }
278
279 if (flags & H_COPY_PAGE) {
280 /* Map-in source, copy to destination, and unmap source again */
281 if (!is_ram_address(spapr, src) || (src & ~TARGET_PAGE_MASK) != 0) {
282 ret = H_PARAMETER;
283 goto unmap_out;
284 }
285 psrc = cpu_physical_memory_map(src, &len, false);
286 if (!psrc || len != TARGET_PAGE_SIZE) {
287 ret = H_PARAMETER;
288 goto unmap_out;
289 }
290 memcpy(pdst, psrc, len);
291 cpu_physical_memory_unmap(psrc, len, 0, len);
292 } else if (flags & H_ZERO_PAGE) {
293 memset(pdst, 0, len); /* Just clear the destination page */
294 }
295
296 if (kvm_enabled() && (flags & H_ICACHE_SYNCHRONIZE) != 0) {
297 kvmppc_dcbst_range(cpu, pdst, len);
298 }
299 if (flags & (H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE)) {
300 if (kvm_enabled()) {
301 kvmppc_icbi_range(cpu, pdst, len);
302 } else if (tcg_enabled()) {
303 tb_flush(CPU(cpu));
304 } else {
305 g_assert_not_reached();
306 }
307 }
308
309 unmap_out:
310 cpu_physical_memory_unmap(pdst, TARGET_PAGE_SIZE, 1, len);
311 return ret;
312 }
313
314 #define FLAGS_REGISTER_VPA 0x0000200000000000ULL
315 #define FLAGS_REGISTER_DTL 0x0000400000000000ULL
316 #define FLAGS_REGISTER_SLBSHADOW 0x0000600000000000ULL
317 #define FLAGS_DEREGISTER_VPA 0x0000a00000000000ULL
318 #define FLAGS_DEREGISTER_DTL 0x0000c00000000000ULL
319 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
320
register_vpa(PowerPCCPU * cpu,target_ulong vpa)321 static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
322 {
323 CPUState *cs = CPU(cpu);
324 CPUPPCState *env = &cpu->env;
325 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
326 uint16_t size;
327 uint8_t tmp;
328
329 if (vpa == 0) {
330 hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
331 return H_HARDWARE;
332 }
333
334 if (vpa % env->dcache_line_size) {
335 return H_PARAMETER;
336 }
337 /* FIXME: bounds check the address */
338
339 size = lduw_be_phys(cs->as, vpa + 0x4);
340
341 if (size < VPA_MIN_SIZE) {
342 return H_PARAMETER;
343 }
344
345 /* VPA is not allowed to cross a page boundary */
346 if ((vpa / 4096) != ((vpa + size - 1) / 4096)) {
347 return H_PARAMETER;
348 }
349
350 spapr_cpu->vpa_addr = vpa;
351
352 tmp = ldub_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
353 tmp |= VPA_SHARED_PROC_VAL;
354 stb_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
355
356 return H_SUCCESS;
357 }
358
deregister_vpa(PowerPCCPU * cpu,target_ulong vpa)359 static target_ulong deregister_vpa(PowerPCCPU *cpu, target_ulong vpa)
360 {
361 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
362
363 if (spapr_cpu->slb_shadow_addr) {
364 return H_RESOURCE;
365 }
366
367 if (spapr_cpu->dtl_addr) {
368 return H_RESOURCE;
369 }
370
371 spapr_cpu->vpa_addr = 0;
372 return H_SUCCESS;
373 }
374
register_slb_shadow(PowerPCCPU * cpu,target_ulong addr)375 static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
376 {
377 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
378 uint32_t size;
379
380 if (addr == 0) {
381 hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
382 return H_HARDWARE;
383 }
384
385 size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
386 if (size < 0x8) {
387 return H_PARAMETER;
388 }
389
390 if ((addr / 4096) != ((addr + size - 1) / 4096)) {
391 return H_PARAMETER;
392 }
393
394 if (!spapr_cpu->vpa_addr) {
395 return H_RESOURCE;
396 }
397
398 spapr_cpu->slb_shadow_addr = addr;
399 spapr_cpu->slb_shadow_size = size;
400
401 return H_SUCCESS;
402 }
403
deregister_slb_shadow(PowerPCCPU * cpu,target_ulong addr)404 static target_ulong deregister_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
405 {
406 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
407
408 spapr_cpu->slb_shadow_addr = 0;
409 spapr_cpu->slb_shadow_size = 0;
410 return H_SUCCESS;
411 }
412
register_dtl(PowerPCCPU * cpu,target_ulong addr)413 static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
414 {
415 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
416 uint32_t size;
417
418 if (addr == 0) {
419 hcall_dprintf("Can't cope with DTL at logical 0\n");
420 return H_HARDWARE;
421 }
422
423 size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
424
425 if (size < 48) {
426 return H_PARAMETER;
427 }
428
429 if (!spapr_cpu->vpa_addr) {
430 return H_RESOURCE;
431 }
432
433 spapr_cpu->dtl_addr = addr;
434 spapr_cpu->dtl_size = size;
435
436 return H_SUCCESS;
437 }
438
deregister_dtl(PowerPCCPU * cpu,target_ulong addr)439 static target_ulong deregister_dtl(PowerPCCPU *cpu, target_ulong addr)
440 {
441 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
442
443 spapr_cpu->dtl_addr = 0;
444 spapr_cpu->dtl_size = 0;
445
446 return H_SUCCESS;
447 }
448
h_register_vpa(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)449 static target_ulong h_register_vpa(PowerPCCPU *cpu, SpaprMachineState *spapr,
450 target_ulong opcode, target_ulong *args)
451 {
452 target_ulong flags = args[0];
453 target_ulong procno = args[1];
454 target_ulong vpa = args[2];
455 target_ulong ret = H_PARAMETER;
456 PowerPCCPU *tcpu;
457
458 tcpu = spapr_find_cpu(procno);
459 if (!tcpu) {
460 return H_PARAMETER;
461 }
462
463 switch (flags) {
464 case FLAGS_REGISTER_VPA:
465 ret = register_vpa(tcpu, vpa);
466 break;
467
468 case FLAGS_DEREGISTER_VPA:
469 ret = deregister_vpa(tcpu, vpa);
470 break;
471
472 case FLAGS_REGISTER_SLBSHADOW:
473 ret = register_slb_shadow(tcpu, vpa);
474 break;
475
476 case FLAGS_DEREGISTER_SLBSHADOW:
477 ret = deregister_slb_shadow(tcpu, vpa);
478 break;
479
480 case FLAGS_REGISTER_DTL:
481 ret = register_dtl(tcpu, vpa);
482 break;
483
484 case FLAGS_DEREGISTER_DTL:
485 ret = deregister_dtl(tcpu, vpa);
486 break;
487 }
488
489 return ret;
490 }
491
h_cede(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)492 static target_ulong h_cede(PowerPCCPU *cpu, SpaprMachineState *spapr,
493 target_ulong opcode, target_ulong *args)
494 {
495 CPUPPCState *env = &cpu->env;
496 CPUState *cs = CPU(cpu);
497 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
498
499 env->msr |= (1ULL << MSR_EE);
500 hreg_compute_hflags(env);
501 ppc_maybe_interrupt(env);
502
503 if (spapr_cpu->prod) {
504 spapr_cpu->prod = false;
505 return H_SUCCESS;
506 }
507
508 if (!cpu_has_work(cs)) {
509 cs->halted = 1;
510 cs->exception_index = EXCP_HLT;
511 cs->exit_request = 1;
512 ppc_maybe_interrupt(env);
513 }
514
515 return H_SUCCESS;
516 }
517
518 /*
519 * Confer to self, aka join. Cede could use the same pattern as well, if
520 * EXCP_HLT can be changed to ECXP_HALTED.
521 */
h_confer_self(PowerPCCPU * cpu)522 static target_ulong h_confer_self(PowerPCCPU *cpu)
523 {
524 CPUState *cs = CPU(cpu);
525 SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
526
527 if (spapr_cpu->prod) {
528 spapr_cpu->prod = false;
529 return H_SUCCESS;
530 }
531 cs->halted = 1;
532 cs->exception_index = EXCP_HALTED;
533 cs->exit_request = 1;
534 ppc_maybe_interrupt(&cpu->env);
535
536 return H_SUCCESS;
537 }
538
h_join(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)539 static target_ulong h_join(PowerPCCPU *cpu, SpaprMachineState *spapr,
540 target_ulong opcode, target_ulong *args)
541 {
542 CPUPPCState *env = &cpu->env;
543 CPUState *cs;
544 bool last_unjoined = true;
545
546 if (env->msr & (1ULL << MSR_EE)) {
547 return H_BAD_MODE;
548 }
549
550 /*
551 * Must not join the last CPU running. Interestingly, no such restriction
552 * for H_CONFER-to-self, but that is probably not intended to be used
553 * when H_JOIN is available.
554 */
555 CPU_FOREACH(cs) {
556 PowerPCCPU *c = POWERPC_CPU(cs);
557 CPUPPCState *e = &c->env;
558 if (c == cpu) {
559 continue;
560 }
561
562 /* Don't have a way to indicate joined, so use halted && MSR[EE]=0 */
563 if (!cs->halted || (e->msr & (1ULL << MSR_EE))) {
564 last_unjoined = false;
565 break;
566 }
567 }
568 if (last_unjoined) {
569 return H_CONTINUE;
570 }
571
572 return h_confer_self(cpu);
573 }
574
h_confer(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)575 static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
576 target_ulong opcode, target_ulong *args)
577 {
578 target_long target = args[0];
579 uint32_t dispatch = args[1];
580 CPUState *cs = CPU(cpu);
581 SpaprCpuState *spapr_cpu;
582
583 assert(tcg_enabled()); /* KVM will have handled this */
584
585 /*
586 * -1 means confer to all other CPUs without dispatch counter check,
587 * otherwise it's a targeted confer.
588 */
589 if (target != -1) {
590 PowerPCCPU *target_cpu = spapr_find_cpu(target);
591 uint32_t target_dispatch;
592
593 if (!target_cpu) {
594 return H_PARAMETER;
595 }
596
597 /*
598 * target == self is a special case, we wait until prodded, without
599 * dispatch counter check.
600 */
601 if (cpu == target_cpu) {
602 return h_confer_self(cpu);
603 }
604
605 spapr_cpu = spapr_cpu_state(target_cpu);
606 if (!spapr_cpu->vpa_addr || ((dispatch & 1) == 0)) {
607 return H_SUCCESS;
608 }
609
610 target_dispatch = ldl_be_phys(cs->as,
611 spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
612 if (target_dispatch != dispatch) {
613 return H_SUCCESS;
614 }
615
616 /*
617 * The targeted confer does not do anything special beyond yielding
618 * the current vCPU, but even this should be better than nothing.
619 * At least for single-threaded tcg, it gives the target a chance to
620 * run before we run again. Multi-threaded tcg does not really do
621 * anything with EXCP_YIELD yet.
622 */
623 }
624
625 cs->exception_index = EXCP_YIELD;
626 cs->exit_request = 1;
627 cpu_loop_exit(cs);
628
629 return H_SUCCESS;
630 }
631
h_prod(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)632 static target_ulong h_prod(PowerPCCPU *cpu, SpaprMachineState *spapr,
633 target_ulong opcode, target_ulong *args)
634 {
635 target_long target = args[0];
636 PowerPCCPU *tcpu;
637 CPUState *cs;
638 SpaprCpuState *spapr_cpu;
639
640 tcpu = spapr_find_cpu(target);
641 cs = CPU(tcpu);
642 if (!cs) {
643 return H_PARAMETER;
644 }
645
646 spapr_cpu = spapr_cpu_state(tcpu);
647 spapr_cpu->prod = true;
648 cs->halted = 0;
649 ppc_maybe_interrupt(&cpu->env);
650 qemu_cpu_kick(cs);
651
652 return H_SUCCESS;
653 }
654
h_rtas(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)655 static target_ulong h_rtas(PowerPCCPU *cpu, SpaprMachineState *spapr,
656 target_ulong opcode, target_ulong *args)
657 {
658 target_ulong rtas_r3 = args[0];
659 uint32_t token = rtas_ld(rtas_r3, 0);
660 uint32_t nargs = rtas_ld(rtas_r3, 1);
661 uint32_t nret = rtas_ld(rtas_r3, 2);
662
663 return spapr_rtas_call(cpu, spapr, token, nargs, rtas_r3 + 12,
664 nret, rtas_r3 + 12 + 4*nargs);
665 }
666
h_logical_load(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)667 static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
668 target_ulong opcode, target_ulong *args)
669 {
670 CPUState *cs = CPU(cpu);
671 target_ulong size = args[0];
672 target_ulong addr = args[1];
673
674 switch (size) {
675 case 1:
676 args[0] = ldub_phys(cs->as, addr);
677 return H_SUCCESS;
678 case 2:
679 args[0] = lduw_phys(cs->as, addr);
680 return H_SUCCESS;
681 case 4:
682 args[0] = ldl_phys(cs->as, addr);
683 return H_SUCCESS;
684 case 8:
685 args[0] = ldq_phys(cs->as, addr);
686 return H_SUCCESS;
687 }
688 return H_PARAMETER;
689 }
690
h_logical_store(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)691 static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
692 target_ulong opcode, target_ulong *args)
693 {
694 CPUState *cs = CPU(cpu);
695
696 target_ulong size = args[0];
697 target_ulong addr = args[1];
698 target_ulong val = args[2];
699
700 switch (size) {
701 case 1:
702 stb_phys(cs->as, addr, val);
703 return H_SUCCESS;
704 case 2:
705 stw_phys(cs->as, addr, val);
706 return H_SUCCESS;
707 case 4:
708 stl_phys(cs->as, addr, val);
709 return H_SUCCESS;
710 case 8:
711 stq_phys(cs->as, addr, val);
712 return H_SUCCESS;
713 }
714 return H_PARAMETER;
715 }
716
h_logical_memop(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)717 static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
718 target_ulong opcode, target_ulong *args)
719 {
720 CPUState *cs = CPU(cpu);
721
722 target_ulong dst = args[0]; /* Destination address */
723 target_ulong src = args[1]; /* Source address */
724 target_ulong esize = args[2]; /* Element size (0=1,1=2,2=4,3=8) */
725 target_ulong count = args[3]; /* Element count */
726 target_ulong op = args[4]; /* 0 = copy, 1 = invert */
727 uint64_t tmp;
728 unsigned int mask = (1 << esize) - 1;
729 int step = 1 << esize;
730
731 if (count > 0x80000000) {
732 return H_PARAMETER;
733 }
734
735 if ((dst & mask) || (src & mask) || (op > 1)) {
736 return H_PARAMETER;
737 }
738
739 if (dst >= src && dst < (src + (count << esize))) {
740 dst = dst + ((count - 1) << esize);
741 src = src + ((count - 1) << esize);
742 step = -step;
743 }
744
745 while (count--) {
746 switch (esize) {
747 case 0:
748 tmp = ldub_phys(cs->as, src);
749 break;
750 case 1:
751 tmp = lduw_phys(cs->as, src);
752 break;
753 case 2:
754 tmp = ldl_phys(cs->as, src);
755 break;
756 case 3:
757 tmp = ldq_phys(cs->as, src);
758 break;
759 default:
760 return H_PARAMETER;
761 }
762 if (op == 1) {
763 tmp = ~tmp;
764 }
765 switch (esize) {
766 case 0:
767 stb_phys(cs->as, dst, tmp);
768 break;
769 case 1:
770 stw_phys(cs->as, dst, tmp);
771 break;
772 case 2:
773 stl_phys(cs->as, dst, tmp);
774 break;
775 case 3:
776 stq_phys(cs->as, dst, tmp);
777 break;
778 }
779 dst = dst + step;
780 src = src + step;
781 }
782
783 return H_SUCCESS;
784 }
785
h_logical_icbi(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)786 static target_ulong h_logical_icbi(PowerPCCPU *cpu, SpaprMachineState *spapr,
787 target_ulong opcode, target_ulong *args)
788 {
789 /* Nothing to do on emulation, KVM will trap this in the kernel */
790 return H_SUCCESS;
791 }
792
h_logical_dcbf(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)793 static target_ulong h_logical_dcbf(PowerPCCPU *cpu, SpaprMachineState *spapr,
794 target_ulong opcode, target_ulong *args)
795 {
796 /* Nothing to do on emulation, KVM will trap this in the kernel */
797 return H_SUCCESS;
798 }
799
h_set_mode_resource_set_ciabr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong value1,target_ulong value2)800 static target_ulong h_set_mode_resource_set_ciabr(PowerPCCPU *cpu,
801 SpaprMachineState *spapr,
802 target_ulong mflags,
803 target_ulong value1,
804 target_ulong value2)
805 {
806 CPUPPCState *env = &cpu->env;
807
808 assert(tcg_enabled()); /* KVM will have handled this */
809
810 if (mflags) {
811 return H_UNSUPPORTED_FLAG;
812 }
813 if (value2) {
814 return H_P4;
815 }
816 if ((value1 & PPC_BITMASK(62, 63)) == 0x3) {
817 return H_P3;
818 }
819
820 ppc_store_ciabr(env, value1);
821
822 return H_SUCCESS;
823 }
824
h_set_mode_resource_set_dawr(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong resource,target_ulong value1,target_ulong value2)825 static target_ulong h_set_mode_resource_set_dawr(PowerPCCPU *cpu,
826 SpaprMachineState *spapr,
827 target_ulong mflags,
828 target_ulong resource,
829 target_ulong value1,
830 target_ulong value2)
831 {
832 CPUPPCState *env = &cpu->env;
833
834 assert(tcg_enabled()); /* KVM will have handled this */
835
836 if (mflags) {
837 return H_UNSUPPORTED_FLAG;
838 }
839 if (value2 & PPC_BIT(61)) {
840 return H_P4;
841 }
842
843 if (resource == H_SET_MODE_RESOURCE_SET_DAWR0) {
844 ppc_store_dawr0(env, value1);
845 ppc_store_dawrx0(env, value2);
846 } else if (resource == H_SET_MODE_RESOURCE_SET_DAWR1) {
847 ppc_store_dawr1(env, value1);
848 ppc_store_dawrx1(env, value2);
849 } else {
850 g_assert_not_reached();
851 }
852
853 return H_SUCCESS;
854 }
855
h_set_mode_resource_le(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong value1,target_ulong value2)856 static target_ulong h_set_mode_resource_le(PowerPCCPU *cpu,
857 SpaprMachineState *spapr,
858 target_ulong mflags,
859 target_ulong value1,
860 target_ulong value2)
861 {
862 if (value1) {
863 return H_P3;
864 }
865 if (value2) {
866 return H_P4;
867 }
868
869 switch (mflags) {
870 case H_SET_MODE_ENDIAN_BIG:
871 spapr_set_all_lpcrs(0, LPCR_ILE);
872 spapr_pci_switch_vga(spapr, true);
873 return H_SUCCESS;
874
875 case H_SET_MODE_ENDIAN_LITTLE:
876 spapr_set_all_lpcrs(LPCR_ILE, LPCR_ILE);
877 spapr_pci_switch_vga(spapr, false);
878 return H_SUCCESS;
879 }
880
881 return H_UNSUPPORTED_FLAG;
882 }
883
h_set_mode_resource_addr_trans_mode(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong mflags,target_ulong value1,target_ulong value2)884 static target_ulong h_set_mode_resource_addr_trans_mode(PowerPCCPU *cpu,
885 SpaprMachineState *spapr,
886 target_ulong mflags,
887 target_ulong value1,
888 target_ulong value2)
889 {
890 if (value1) {
891 return H_P3;
892 }
893
894 if (value2) {
895 return H_P4;
896 }
897
898 /*
899 * AIL-1 is not architected, and AIL-2 is not supported by QEMU spapr.
900 * It is supported for faithful emulation of bare metal systems, but for
901 * compatibility concerns we leave it out of the pseries machine.
902 */
903 if (mflags != 0 && mflags != 3) {
904 return H_UNSUPPORTED_FLAG;
905 }
906
907 if (mflags == 3) {
908 if (!spapr_get_cap(spapr, SPAPR_CAP_AIL_MODE_3)) {
909 return H_UNSUPPORTED_FLAG;
910 }
911 }
912
913 spapr_set_all_lpcrs(mflags << LPCR_AIL_SHIFT, LPCR_AIL);
914
915 return H_SUCCESS;
916 }
917
h_set_mode(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)918 static target_ulong h_set_mode(PowerPCCPU *cpu, SpaprMachineState *spapr,
919 target_ulong opcode, target_ulong *args)
920 {
921 target_ulong resource = args[1];
922 target_ulong ret = H_P2;
923
924 switch (resource) {
925 case H_SET_MODE_RESOURCE_SET_CIABR:
926 ret = h_set_mode_resource_set_ciabr(cpu, spapr, args[0], args[2],
927 args[3]);
928 break;
929 case H_SET_MODE_RESOURCE_SET_DAWR0:
930 case H_SET_MODE_RESOURCE_SET_DAWR1:
931 ret = h_set_mode_resource_set_dawr(cpu, spapr, args[0], args[1],
932 args[2], args[3]);
933 break;
934 case H_SET_MODE_RESOURCE_LE:
935 ret = h_set_mode_resource_le(cpu, spapr, args[0], args[2], args[3]);
936 break;
937 case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE:
938 ret = h_set_mode_resource_addr_trans_mode(cpu, spapr, args[0],
939 args[2], args[3]);
940 break;
941 }
942
943 return ret;
944 }
945
h_clean_slb(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)946 static target_ulong h_clean_slb(PowerPCCPU *cpu, SpaprMachineState *spapr,
947 target_ulong opcode, target_ulong *args)
948 {
949 qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx"%s\n",
950 opcode, " (H_CLEAN_SLB)");
951 return H_FUNCTION;
952 }
953
h_invalidate_pid(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)954 static target_ulong h_invalidate_pid(PowerPCCPU *cpu, SpaprMachineState *spapr,
955 target_ulong opcode, target_ulong *args)
956 {
957 qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx"%s\n",
958 opcode, " (H_INVALIDATE_PID)");
959 return H_FUNCTION;
960 }
961
spapr_check_setup_free_hpt(SpaprMachineState * spapr,uint64_t patbe_old,uint64_t patbe_new)962 static void spapr_check_setup_free_hpt(SpaprMachineState *spapr,
963 uint64_t patbe_old, uint64_t patbe_new)
964 {
965 /*
966 * We have 4 Options:
967 * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
968 * HASH->RADIX : Free HPT
969 * RADIX->HASH : Allocate HPT
970 * NOTHING->HASH : Allocate HPT
971 * Note: NOTHING implies the case where we said the guest could choose
972 * later and so assumed radix and now it's called H_REG_PROC_TBL
973 */
974
975 if ((patbe_old & PATE1_GR) == (patbe_new & PATE1_GR)) {
976 /* We assume RADIX, so this catches all the "Do Nothing" cases */
977 } else if (!(patbe_old & PATE1_GR)) {
978 /* HASH->RADIX : Free HPT */
979 spapr_free_hpt(spapr);
980 } else if (!(patbe_new & PATE1_GR)) {
981 /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
982 spapr_setup_hpt(spapr);
983 }
984 return;
985 }
986
987 #define FLAGS_MASK 0x01FULL
988 #define FLAG_MODIFY 0x10
989 #define FLAG_REGISTER 0x08
990 #define FLAG_RADIX 0x04
991 #define FLAG_HASH_PROC_TBL 0x02
992 #define FLAG_GTSE 0x01
993
h_register_process_table(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)994 static target_ulong h_register_process_table(PowerPCCPU *cpu,
995 SpaprMachineState *spapr,
996 target_ulong opcode,
997 target_ulong *args)
998 {
999 target_ulong flags = args[0];
1000 target_ulong proc_tbl = args[1];
1001 target_ulong page_size = args[2];
1002 target_ulong table_size = args[3];
1003 target_ulong update_lpcr = 0;
1004 target_ulong table_byte_size;
1005 uint64_t cproc;
1006
1007 if (flags & ~FLAGS_MASK) { /* Check no reserved bits are set */
1008 return H_PARAMETER;
1009 }
1010 if (flags & FLAG_MODIFY) {
1011 if (flags & FLAG_REGISTER) {
1012 /* Check process table alignment */
1013 table_byte_size = 1ULL << (table_size + 12);
1014 if (proc_tbl & (table_byte_size - 1)) {
1015 qemu_log_mask(LOG_GUEST_ERROR,
1016 "%s: process table not properly aligned: proc_tbl 0x"
1017 TARGET_FMT_lx" proc_tbl_size 0x"TARGET_FMT_lx"\n",
1018 __func__, proc_tbl, table_byte_size);
1019 }
1020 if (flags & FLAG_RADIX) { /* Register new RADIX process table */
1021 if (proc_tbl & 0xfff || proc_tbl >> 60) {
1022 return H_P2;
1023 } else if (page_size) {
1024 return H_P3;
1025 } else if (table_size > 24) {
1026 return H_P4;
1027 }
1028 cproc = PATE1_GR | proc_tbl | table_size;
1029 } else { /* Register new HPT process table */
1030 if (flags & FLAG_HASH_PROC_TBL) { /* Hash with Segment Tables */
1031 /* TODO - Not Supported */
1032 /* Technically caused by flag bits => H_PARAMETER */
1033 return H_PARAMETER;
1034 } else { /* Hash with SLB */
1035 if (proc_tbl >> 38) {
1036 return H_P2;
1037 } else if (page_size & ~0x7) {
1038 return H_P3;
1039 } else if (table_size > 24) {
1040 return H_P4;
1041 }
1042 }
1043 cproc = (proc_tbl << 25) | page_size << 5 | table_size;
1044 }
1045
1046 } else { /* Deregister current process table */
1047 /*
1048 * Set to benign value: (current GR) | 0. This allows
1049 * deregistration in KVM to succeed even if the radix bit
1050 * in flags doesn't match the radix bit in the old PATE.
1051 */
1052 cproc = spapr->patb_entry & PATE1_GR;
1053 }
1054 } else { /* Maintain current registration */
1055 if (!(flags & FLAG_RADIX) != !(spapr->patb_entry & PATE1_GR)) {
1056 /* Technically caused by flag bits => H_PARAMETER */
1057 return H_PARAMETER; /* Existing Process Table Mismatch */
1058 }
1059 cproc = spapr->patb_entry;
1060 }
1061
1062 /* Check if we need to setup OR free the hpt */
1063 spapr_check_setup_free_hpt(spapr, spapr->patb_entry, cproc);
1064
1065 spapr->patb_entry = cproc; /* Save new process table */
1066
1067 /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
1068 if (flags & FLAG_RADIX) /* Radix must use process tables, also set HR */
1069 update_lpcr |= (LPCR_UPRT | LPCR_HR);
1070 else if (flags & FLAG_HASH_PROC_TBL) /* Hash with process tables */
1071 update_lpcr |= LPCR_UPRT;
1072 if (flags & FLAG_GTSE) /* Guest translation shootdown enable */
1073 update_lpcr |= LPCR_GTSE;
1074
1075 spapr_set_all_lpcrs(update_lpcr, LPCR_UPRT | LPCR_HR | LPCR_GTSE);
1076
1077 if (kvm_enabled()) {
1078 return kvmppc_configure_v3_mmu(cpu, flags & FLAG_RADIX,
1079 flags & FLAG_GTSE, cproc);
1080 }
1081 return H_SUCCESS;
1082 }
1083
1084 #define H_SIGNAL_SYS_RESET_ALL -1
1085 #define H_SIGNAL_SYS_RESET_ALLBUTSELF -2
1086
h_signal_sys_reset(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1087 static target_ulong h_signal_sys_reset(PowerPCCPU *cpu,
1088 SpaprMachineState *spapr,
1089 target_ulong opcode, target_ulong *args)
1090 {
1091 target_long target = args[0];
1092 CPUState *cs;
1093
1094 if (target < 0) {
1095 /* Broadcast */
1096 if (target < H_SIGNAL_SYS_RESET_ALLBUTSELF) {
1097 return H_PARAMETER;
1098 }
1099
1100 CPU_FOREACH(cs) {
1101 PowerPCCPU *c = POWERPC_CPU(cs);
1102
1103 if (target == H_SIGNAL_SYS_RESET_ALLBUTSELF) {
1104 if (c == cpu) {
1105 continue;
1106 }
1107 }
1108 run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
1109 }
1110 return H_SUCCESS;
1111
1112 } else {
1113 /* Unicast */
1114 cs = CPU(spapr_find_cpu(target));
1115 if (cs) {
1116 run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
1117 return H_SUCCESS;
1118 }
1119 return H_PARAMETER;
1120 }
1121 }
1122
1123 /* Returns either a logical PVR or zero if none was found */
cas_check_pvr(PowerPCCPU * cpu,uint32_t max_compat,target_ulong * addr,bool * raw_mode_supported)1124 static uint32_t cas_check_pvr(PowerPCCPU *cpu, uint32_t max_compat,
1125 target_ulong *addr, bool *raw_mode_supported)
1126 {
1127 bool explicit_match = false; /* Matched the CPU's real PVR */
1128 uint32_t best_compat = 0;
1129 int i;
1130
1131 /*
1132 * We scan the supplied table of PVRs looking for two things
1133 * 1. Is our real CPU PVR in the list?
1134 * 2. What's the "best" listed logical PVR
1135 */
1136 for (i = 0; i < 512; ++i) {
1137 uint32_t pvr, pvr_mask;
1138
1139 pvr_mask = ldl_be_phys(&address_space_memory, *addr);
1140 pvr = ldl_be_phys(&address_space_memory, *addr + 4);
1141 *addr += 8;
1142
1143 if (~pvr_mask & pvr) {
1144 break; /* Terminator record */
1145 }
1146
1147 if ((cpu->env.spr[SPR_PVR] & pvr_mask) == (pvr & pvr_mask)) {
1148 explicit_match = true;
1149 } else {
1150 if (ppc_check_compat(cpu, pvr, best_compat, max_compat)) {
1151 best_compat = pvr;
1152 }
1153 }
1154 }
1155
1156 *raw_mode_supported = explicit_match;
1157
1158 /* Parsing finished */
1159 trace_spapr_cas_pvr(cpu->compat_pvr, explicit_match, best_compat);
1160
1161 return best_compat;
1162 }
1163
1164 static
do_client_architecture_support(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong vec,target_ulong fdt_bufsize)1165 target_ulong do_client_architecture_support(PowerPCCPU *cpu,
1166 SpaprMachineState *spapr,
1167 target_ulong vec,
1168 target_ulong fdt_bufsize)
1169 {
1170 target_ulong ov_table; /* Working address in data buffer */
1171 uint32_t cas_pvr;
1172 SpaprOptionVector *ov1_guest, *ov5_guest;
1173 bool guest_radix;
1174 bool raw_mode_supported = false;
1175 bool guest_xive;
1176 CPUState *cs;
1177 void *fdt;
1178 uint32_t max_compat = spapr->max_compat_pvr;
1179
1180 /* CAS is supposed to be called early when only the boot vCPU is active. */
1181 CPU_FOREACH(cs) {
1182 if (cs == CPU(cpu)) {
1183 continue;
1184 }
1185 if (!cs->halted) {
1186 warn_report("guest has multiple active vCPUs at CAS, which is not allowed");
1187 return H_MULTI_THREADS_ACTIVE;
1188 }
1189 }
1190
1191 cas_pvr = cas_check_pvr(cpu, max_compat, &vec, &raw_mode_supported);
1192 if (!cas_pvr && (!raw_mode_supported || max_compat)) {
1193 /*
1194 * We couldn't find a suitable compatibility mode, and either
1195 * the guest doesn't support "raw" mode for this CPU, or "raw"
1196 * mode is disabled because a maximum compat mode is set.
1197 */
1198 error_report("Couldn't negotiate a suitable PVR during CAS");
1199 return H_HARDWARE;
1200 }
1201
1202 /* Update CPUs */
1203 if (cpu->compat_pvr != cas_pvr) {
1204 Error *local_err = NULL;
1205
1206 if (ppc_set_compat_all(cas_pvr, &local_err) < 0) {
1207 /* We fail to set compat mode (likely because running with KVM PR),
1208 * but maybe we can fallback to raw mode if the guest supports it.
1209 */
1210 if (!raw_mode_supported) {
1211 error_report_err(local_err);
1212 return H_HARDWARE;
1213 }
1214 error_free(local_err);
1215 }
1216 }
1217
1218 /* For the future use: here @ov_table points to the first option vector */
1219 ov_table = vec;
1220
1221 ov1_guest = spapr_ovec_parse_vector(ov_table, 1);
1222 if (!ov1_guest) {
1223 warn_report("guest didn't provide option vector 1");
1224 return H_PARAMETER;
1225 }
1226 ov5_guest = spapr_ovec_parse_vector(ov_table, 5);
1227 if (!ov5_guest) {
1228 spapr_ovec_cleanup(ov1_guest);
1229 warn_report("guest didn't provide option vector 5");
1230 return H_PARAMETER;
1231 }
1232 if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) {
1233 error_report("guest requested hash and radix MMU, which is invalid.");
1234 exit(EXIT_FAILURE);
1235 }
1236 if (spapr_ovec_test(ov5_guest, OV5_XIVE_BOTH)) {
1237 error_report("guest requested an invalid interrupt mode");
1238 exit(EXIT_FAILURE);
1239 }
1240
1241 guest_radix = spapr_ovec_test(ov5_guest, OV5_MMU_RADIX_300);
1242
1243 guest_xive = spapr_ovec_test(ov5_guest, OV5_XIVE_EXPLOIT);
1244
1245 /*
1246 * HPT resizing is a bit of a special case, because when enabled
1247 * we assume an HPT guest will support it until it says it
1248 * doesn't, instead of assuming it won't support it until it says
1249 * it does. Strictly speaking that approach could break for
1250 * guests which don't make a CAS call, but those are so old we
1251 * don't care about them. Without that assumption we'd have to
1252 * make at least a temporary allocation of an HPT sized for max
1253 * memory, which could be impossibly difficult under KVM HV if
1254 * maxram is large.
1255 */
1256 if (!guest_radix && !spapr_ovec_test(ov5_guest, OV5_HPT_RESIZE)) {
1257 int maxshift = spapr_hpt_shift_for_ramsize(MACHINE(spapr)->maxram_size);
1258
1259 if (spapr->resize_hpt == SPAPR_RESIZE_HPT_REQUIRED) {
1260 error_report(
1261 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1262 exit(1);
1263 }
1264
1265 if (spapr->htab_shift < maxshift) {
1266 /* Guest doesn't know about HPT resizing, so we
1267 * pre-emptively resize for the maximum permitted RAM. At
1268 * the point this is called, nothing should have been
1269 * entered into the existing HPT */
1270 spapr_reallocate_hpt(spapr, maxshift, &error_fatal);
1271 push_sregs_to_kvm_pr(spapr);
1272 }
1273 }
1274
1275 /* NOTE: there are actually a number of ov5 bits where input from the
1276 * guest is always zero, and the platform/QEMU enables them independently
1277 * of guest input. To model these properly we'd want some sort of mask,
1278 * but since they only currently apply to memory migration as defined
1279 * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1280 * to worry about this for now.
1281 */
1282
1283 /* full range of negotiated ov5 capabilities */
1284 spapr_ovec_intersect(spapr->ov5_cas, spapr->ov5, ov5_guest);
1285 spapr_ovec_cleanup(ov5_guest);
1286
1287 spapr_check_mmu_mode(guest_radix);
1288
1289 spapr->cas_pre_isa3_guest = !spapr_ovec_test(ov1_guest, OV1_PPC_3_00);
1290 spapr_ovec_cleanup(ov1_guest);
1291
1292 /*
1293 * Check for NUMA affinity conditions now that we know which NUMA
1294 * affinity the guest will use.
1295 */
1296 spapr_numa_associativity_check(spapr);
1297
1298 /*
1299 * Ensure the guest asks for an interrupt mode we support;
1300 * otherwise terminate the boot.
1301 */
1302 if (guest_xive) {
1303 if (!spapr->irq->xive) {
1304 error_report(
1305 "Guest requested unavailable interrupt mode (XIVE), try the ic-mode=xive or ic-mode=dual machine property");
1306 exit(EXIT_FAILURE);
1307 }
1308 } else {
1309 if (!spapr->irq->xics) {
1310 error_report(
1311 "Guest requested unavailable interrupt mode (XICS), either don't set the ic-mode machine property or try ic-mode=xics or ic-mode=dual");
1312 exit(EXIT_FAILURE);
1313 }
1314 }
1315
1316 spapr_irq_update_active_intc(spapr);
1317
1318 /*
1319 * Process all pending hot-plug/unplug requests now. An updated full
1320 * rendered FDT will be returned to the guest.
1321 */
1322 spapr_drc_reset_all(spapr);
1323 spapr_clear_pending_hotplug_events(spapr);
1324
1325 /*
1326 * If spapr_machine_reset() did not set up a HPT but one is necessary
1327 * (because the guest isn't going to use radix) then set it up here.
1328 */
1329 if ((spapr->patb_entry & PATE1_GR) && !guest_radix) {
1330 /* legacy hash or new hash: */
1331 spapr_setup_hpt(spapr);
1332 }
1333
1334 fdt = spapr_build_fdt(spapr, spapr->vof != NULL, fdt_bufsize);
1335 g_free(spapr->fdt_blob);
1336 spapr->fdt_size = fdt_totalsize(fdt);
1337 spapr->fdt_initial_size = spapr->fdt_size;
1338 spapr->fdt_blob = fdt;
1339
1340 /*
1341 * Set the machine->fdt pointer again since we just freed
1342 * it above (by freeing spapr->fdt_blob). We set this
1343 * pointer to enable support for the 'dumpdtb' QMP/HMP
1344 * command.
1345 */
1346 MACHINE(spapr)->fdt = fdt;
1347
1348 return H_SUCCESS;
1349 }
1350
h_client_architecture_support(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1351 static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
1352 SpaprMachineState *spapr,
1353 target_ulong opcode,
1354 target_ulong *args)
1355 {
1356 target_ulong vec = ppc64_phys_to_real(args[0]);
1357 target_ulong fdt_buf = args[1];
1358 target_ulong fdt_bufsize = args[2];
1359 target_ulong ret;
1360 SpaprDeviceTreeUpdateHeader hdr = { .version_id = 1 };
1361
1362 if (fdt_bufsize < sizeof(hdr)) {
1363 error_report("SLOF provided insufficient CAS buffer "
1364 TARGET_FMT_lu " (min: %zu)", fdt_bufsize, sizeof(hdr));
1365 exit(EXIT_FAILURE);
1366 }
1367
1368 fdt_bufsize -= sizeof(hdr);
1369
1370 ret = do_client_architecture_support(cpu, spapr, vec, fdt_bufsize);
1371 if (ret == H_SUCCESS) {
1372 _FDT((fdt_pack(spapr->fdt_blob)));
1373 spapr->fdt_size = fdt_totalsize(spapr->fdt_blob);
1374 spapr->fdt_initial_size = spapr->fdt_size;
1375
1376 cpu_physical_memory_write(fdt_buf, &hdr, sizeof(hdr));
1377 cpu_physical_memory_write(fdt_buf + sizeof(hdr), spapr->fdt_blob,
1378 spapr->fdt_size);
1379 trace_spapr_cas_continue(spapr->fdt_size + sizeof(hdr));
1380 }
1381
1382 return ret;
1383 }
1384
spapr_vof_client_architecture_support(MachineState * ms,CPUState * cs,target_ulong ovec_addr)1385 target_ulong spapr_vof_client_architecture_support(MachineState *ms,
1386 CPUState *cs,
1387 target_ulong ovec_addr)
1388 {
1389 SpaprMachineState *spapr = SPAPR_MACHINE(ms);
1390
1391 target_ulong ret = do_client_architecture_support(POWERPC_CPU(cs), spapr,
1392 ovec_addr, FDT_MAX_SIZE);
1393
1394 /*
1395 * This adds stdout and generates phandles for boottime and CAS FDTs.
1396 * It is alright to update the FDT here as do_client_architecture_support()
1397 * does not pack it.
1398 */
1399 spapr_vof_client_dt_finalize(spapr, spapr->fdt_blob);
1400
1401 return ret;
1402 }
1403
h_get_cpu_characteristics(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1404 static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
1405 SpaprMachineState *spapr,
1406 target_ulong opcode,
1407 target_ulong *args)
1408 {
1409 uint64_t characteristics = H_CPU_CHAR_HON_BRANCH_HINTS &
1410 ~H_CPU_CHAR_THR_RECONF_TRIG;
1411 uint64_t behaviour = H_CPU_BEHAV_FAVOUR_SECURITY;
1412 uint8_t safe_cache = spapr_get_cap(spapr, SPAPR_CAP_CFPC);
1413 uint8_t safe_bounds_check = spapr_get_cap(spapr, SPAPR_CAP_SBBC);
1414 uint8_t safe_indirect_branch = spapr_get_cap(spapr, SPAPR_CAP_IBS);
1415 uint8_t count_cache_flush_assist = spapr_get_cap(spapr,
1416 SPAPR_CAP_CCF_ASSIST);
1417
1418 switch (safe_cache) {
1419 case SPAPR_CAP_WORKAROUND:
1420 characteristics |= H_CPU_CHAR_L1D_FLUSH_ORI30;
1421 characteristics |= H_CPU_CHAR_L1D_FLUSH_TRIG2;
1422 characteristics |= H_CPU_CHAR_L1D_THREAD_PRIV;
1423 behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
1424 break;
1425 case SPAPR_CAP_FIXED:
1426 behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY;
1427 behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS;
1428 break;
1429 default: /* broken */
1430 assert(safe_cache == SPAPR_CAP_BROKEN);
1431 behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
1432 break;
1433 }
1434
1435 switch (safe_bounds_check) {
1436 case SPAPR_CAP_WORKAROUND:
1437 characteristics |= H_CPU_CHAR_SPEC_BAR_ORI31;
1438 behaviour |= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
1439 break;
1440 case SPAPR_CAP_FIXED:
1441 break;
1442 default: /* broken */
1443 assert(safe_bounds_check == SPAPR_CAP_BROKEN);
1444 behaviour |= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
1445 break;
1446 }
1447
1448 switch (safe_indirect_branch) {
1449 case SPAPR_CAP_FIXED_NA:
1450 break;
1451 case SPAPR_CAP_FIXED_CCD:
1452 characteristics |= H_CPU_CHAR_CACHE_COUNT_DIS;
1453 break;
1454 case SPAPR_CAP_FIXED_IBS:
1455 characteristics |= H_CPU_CHAR_BCCTRL_SERIALISED;
1456 break;
1457 case SPAPR_CAP_WORKAROUND:
1458 behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
1459 if (count_cache_flush_assist) {
1460 characteristics |= H_CPU_CHAR_BCCTR_FLUSH_ASSIST;
1461 }
1462 break;
1463 default: /* broken */
1464 assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
1465 break;
1466 }
1467
1468 args[0] = characteristics;
1469 args[1] = behaviour;
1470 return H_SUCCESS;
1471 }
1472
h_update_dt(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1473 static target_ulong h_update_dt(PowerPCCPU *cpu, SpaprMachineState *spapr,
1474 target_ulong opcode, target_ulong *args)
1475 {
1476 target_ulong dt = ppc64_phys_to_real(args[0]);
1477 struct fdt_header hdr = { 0 };
1478 unsigned cb;
1479 SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
1480 void *fdt;
1481
1482 cpu_physical_memory_read(dt, &hdr, sizeof(hdr));
1483 cb = fdt32_to_cpu(hdr.totalsize);
1484
1485 if (!smc->update_dt_enabled) {
1486 return H_SUCCESS;
1487 }
1488
1489 /* Check that the fdt did not grow out of proportion */
1490 if (cb > spapr->fdt_initial_size * 2) {
1491 trace_spapr_update_dt_failed_size(spapr->fdt_initial_size, cb,
1492 fdt32_to_cpu(hdr.magic));
1493 return H_PARAMETER;
1494 }
1495
1496 fdt = g_malloc0(cb);
1497 cpu_physical_memory_read(dt, fdt, cb);
1498
1499 /* Check the fdt consistency */
1500 if (fdt_check_full(fdt, cb)) {
1501 trace_spapr_update_dt_failed_check(spapr->fdt_initial_size, cb,
1502 fdt32_to_cpu(hdr.magic));
1503 return H_PARAMETER;
1504 }
1505
1506 g_free(spapr->fdt_blob);
1507 spapr->fdt_size = cb;
1508 spapr->fdt_blob = fdt;
1509 trace_spapr_update_dt(cb);
1510
1511 return H_SUCCESS;
1512 }
1513
1514 static spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
1515 static spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE + 1];
1516 static spapr_hcall_fn svm_hypercall_table[(SVM_HCALL_MAX - SVM_HCALL_BASE) / 4 + 1];
1517
spapr_register_hypercall(target_ulong opcode,spapr_hcall_fn fn)1518 void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)
1519 {
1520 spapr_hcall_fn *slot;
1521
1522 if (opcode <= MAX_HCALL_OPCODE) {
1523 assert((opcode & 0x3) == 0);
1524
1525 slot = &papr_hypercall_table[opcode / 4];
1526 } else if (opcode >= SVM_HCALL_BASE && opcode <= SVM_HCALL_MAX) {
1527 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1528 assert((opcode & 0x3) == 0);
1529
1530 slot = &svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1531 } else {
1532 assert((opcode >= KVMPPC_HCALL_BASE) && (opcode <= KVMPPC_HCALL_MAX));
1533
1534 slot = &kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1535 }
1536
1537 assert(!(*slot));
1538 *slot = fn;
1539 }
1540
spapr_unregister_hypercall(target_ulong opcode)1541 void spapr_unregister_hypercall(target_ulong opcode)
1542 {
1543 spapr_hcall_fn *slot;
1544
1545 if (opcode <= MAX_HCALL_OPCODE) {
1546 assert((opcode & 0x3) == 0);
1547
1548 slot = &papr_hypercall_table[opcode / 4];
1549 } else if (opcode >= SVM_HCALL_BASE && opcode <= SVM_HCALL_MAX) {
1550 /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1551 assert((opcode & 0x3) == 0);
1552
1553 slot = &svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1554 } else {
1555 assert((opcode >= KVMPPC_HCALL_BASE) && (opcode <= KVMPPC_HCALL_MAX));
1556
1557 slot = &kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1558 }
1559
1560 *slot = NULL;
1561 }
1562
spapr_hypercall(PowerPCCPU * cpu,target_ulong opcode,target_ulong * args)1563 target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
1564 target_ulong *args)
1565 {
1566 SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
1567
1568 if ((opcode <= MAX_HCALL_OPCODE)
1569 && ((opcode & 0x3) == 0)) {
1570 spapr_hcall_fn fn = papr_hypercall_table[opcode / 4];
1571
1572 if (fn) {
1573 return fn(cpu, spapr, opcode, args);
1574 }
1575 } else if ((opcode >= SVM_HCALL_BASE) &&
1576 (opcode <= SVM_HCALL_MAX)) {
1577 spapr_hcall_fn fn = svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1578
1579 if (fn) {
1580 return fn(cpu, spapr, opcode, args);
1581 }
1582 } else if ((opcode >= KVMPPC_HCALL_BASE) &&
1583 (opcode <= KVMPPC_HCALL_MAX)) {
1584 spapr_hcall_fn fn = kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1585
1586 if (fn) {
1587 return fn(cpu, spapr, opcode, args);
1588 }
1589 }
1590
1591 qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx "\n",
1592 opcode);
1593 return H_FUNCTION;
1594 }
1595
1596 #ifdef CONFIG_TCG
hypercall_register_softmmu(void)1597 static void hypercall_register_softmmu(void)
1598 {
1599 /* DO NOTHING */
1600 }
1601 #else
h_softmmu(PowerPCCPU * cpu,SpaprMachineState * spapr,target_ulong opcode,target_ulong * args)1602 static target_ulong h_softmmu(PowerPCCPU *cpu, SpaprMachineState *spapr,
1603 target_ulong opcode, target_ulong *args)
1604 {
1605 g_assert_not_reached();
1606 }
1607
hypercall_register_softmmu(void)1608 static void hypercall_register_softmmu(void)
1609 {
1610 /* hcall-pft */
1611 spapr_register_hypercall(H_ENTER, h_softmmu);
1612 spapr_register_hypercall(H_REMOVE, h_softmmu);
1613 spapr_register_hypercall(H_PROTECT, h_softmmu);
1614 spapr_register_hypercall(H_READ, h_softmmu);
1615
1616 /* hcall-bulk */
1617 spapr_register_hypercall(H_BULK_REMOVE, h_softmmu);
1618 }
1619 #endif
1620
hypercall_register_types(void)1621 static void hypercall_register_types(void)
1622 {
1623 hypercall_register_softmmu();
1624
1625 /* hcall-hpt-resize */
1626 spapr_register_hypercall(H_RESIZE_HPT_PREPARE, h_resize_hpt_prepare);
1627 spapr_register_hypercall(H_RESIZE_HPT_COMMIT, h_resize_hpt_commit);
1628
1629 /* hcall-splpar */
1630 spapr_register_hypercall(H_REGISTER_VPA, h_register_vpa);
1631 spapr_register_hypercall(H_CEDE, h_cede);
1632 spapr_register_hypercall(H_CONFER, h_confer);
1633 spapr_register_hypercall(H_PROD, h_prod);
1634
1635 /* hcall-join */
1636 spapr_register_hypercall(H_JOIN, h_join);
1637
1638 spapr_register_hypercall(H_SIGNAL_SYS_RESET, h_signal_sys_reset);
1639
1640 /* processor register resource access h-calls */
1641 spapr_register_hypercall(H_SET_SPRG0, h_set_sprg0);
1642 spapr_register_hypercall(H_SET_DABR, h_set_dabr);
1643 spapr_register_hypercall(H_SET_XDABR, h_set_xdabr);
1644 spapr_register_hypercall(H_PAGE_INIT, h_page_init);
1645 spapr_register_hypercall(H_SET_MODE, h_set_mode);
1646
1647 /* In Memory Table MMU h-calls */
1648 spapr_register_hypercall(H_CLEAN_SLB, h_clean_slb);
1649 spapr_register_hypercall(H_INVALIDATE_PID, h_invalidate_pid);
1650 spapr_register_hypercall(H_REGISTER_PROC_TBL, h_register_process_table);
1651
1652 /* hcall-get-cpu-characteristics */
1653 spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS,
1654 h_get_cpu_characteristics);
1655
1656 /* "debugger" hcalls (also used by SLOF). Note: We do -not- differentiate
1657 * here between the "CI" and the "CACHE" variants, they will use whatever
1658 * mapping attributes qemu is using. When using KVM, the kernel will
1659 * enforce the attributes more strongly
1660 */
1661 spapr_register_hypercall(H_LOGICAL_CI_LOAD, h_logical_load);
1662 spapr_register_hypercall(H_LOGICAL_CI_STORE, h_logical_store);
1663 spapr_register_hypercall(H_LOGICAL_CACHE_LOAD, h_logical_load);
1664 spapr_register_hypercall(H_LOGICAL_CACHE_STORE, h_logical_store);
1665 spapr_register_hypercall(H_LOGICAL_ICBI, h_logical_icbi);
1666 spapr_register_hypercall(H_LOGICAL_DCBF, h_logical_dcbf);
1667 spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP, h_logical_memop);
1668
1669 /* qemu/KVM-PPC specific hcalls */
1670 spapr_register_hypercall(KVMPPC_H_RTAS, h_rtas);
1671
1672 /* ibm,client-architecture-support support */
1673 spapr_register_hypercall(KVMPPC_H_CAS, h_client_architecture_support);
1674
1675 spapr_register_hypercall(KVMPPC_H_UPDATE_DT, h_update_dt);
1676 }
1677
1678 type_init(hypercall_register_types)
1679