xref: /openbmc/qemu/hw/ppc/spapr.c (revision 59a3a1c0)
1 /*
2  * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
3  *
4  * Copyright (c) 2004-2007 Fabrice Bellard
5  * Copyright (c) 2007 Jocelyn Mayer
6  * Copyright (c) 2010 David Gibson, IBM Corporation.
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  */
26 
27 #include "qemu/osdep.h"
28 #include "qemu-common.h"
29 #include "qapi/error.h"
30 #include "qapi/visitor.h"
31 #include "sysemu/sysemu.h"
32 #include "sysemu/hostmem.h"
33 #include "sysemu/numa.h"
34 #include "sysemu/qtest.h"
35 #include "sysemu/reset.h"
36 #include "sysemu/runstate.h"
37 #include "qemu/log.h"
38 #include "hw/fw-path-provider.h"
39 #include "elf.h"
40 #include "net/net.h"
41 #include "sysemu/device_tree.h"
42 #include "sysemu/cpus.h"
43 #include "sysemu/hw_accel.h"
44 #include "kvm_ppc.h"
45 #include "migration/misc.h"
46 #include "migration/qemu-file-types.h"
47 #include "migration/global_state.h"
48 #include "migration/register.h"
49 #include "mmu-hash64.h"
50 #include "mmu-book3s-v3.h"
51 #include "cpu-models.h"
52 #include "qom/cpu.h"
53 
54 #include "hw/boards.h"
55 #include "hw/ppc/ppc.h"
56 #include "hw/loader.h"
57 
58 #include "hw/ppc/fdt.h"
59 #include "hw/ppc/spapr.h"
60 #include "hw/ppc/spapr_vio.h"
61 #include "hw/qdev-properties.h"
62 #include "hw/pci-host/spapr.h"
63 #include "hw/pci/msi.h"
64 
65 #include "hw/pci/pci.h"
66 #include "hw/scsi/scsi.h"
67 #include "hw/virtio/virtio-scsi.h"
68 #include "hw/virtio/vhost-scsi-common.h"
69 
70 #include "exec/address-spaces.h"
71 #include "exec/ram_addr.h"
72 #include "hw/usb.h"
73 #include "qemu/config-file.h"
74 #include "qemu/error-report.h"
75 #include "trace.h"
76 #include "hw/nmi.h"
77 #include "hw/intc/intc.h"
78 
79 #include "qemu/cutils.h"
80 #include "hw/ppc/spapr_cpu_core.h"
81 #include "hw/mem/memory-device.h"
82 
83 #include <libfdt.h>
84 
85 /* SLOF memory layout:
86  *
87  * SLOF raw image loaded at 0, copies its romfs right below the flat
88  * device-tree, then position SLOF itself 31M below that
89  *
90  * So we set FW_OVERHEAD to 40MB which should account for all of that
91  * and more
92  *
93  * We load our kernel at 4M, leaving space for SLOF initial image
94  */
95 #define FDT_MAX_SIZE            0x100000
96 #define RTAS_MAX_SIZE           0x10000
97 #define RTAS_MAX_ADDR           0x80000000 /* RTAS must stay below that */
98 #define FW_MAX_SIZE             0x400000
99 #define FW_FILE_NAME            "slof.bin"
100 #define FW_OVERHEAD             0x2800000
101 #define KERNEL_LOAD_ADDR        FW_MAX_SIZE
102 
103 #define MIN_RMA_SLOF            128UL
104 
105 #define PHANDLE_INTC            0x00001111
106 
107 /* These two functions implement the VCPU id numbering: one to compute them
108  * all and one to identify thread 0 of a VCORE. Any change to the first one
109  * is likely to have an impact on the second one, so let's keep them close.
110  */
111 static int spapr_vcpu_id(SpaprMachineState *spapr, int cpu_index)
112 {
113     MachineState *ms = MACHINE(spapr);
114     unsigned int smp_threads = ms->smp.threads;
115 
116     assert(spapr->vsmt);
117     return
118         (cpu_index / smp_threads) * spapr->vsmt + cpu_index % smp_threads;
119 }
120 static bool spapr_is_thread0_in_vcore(SpaprMachineState *spapr,
121                                       PowerPCCPU *cpu)
122 {
123     assert(spapr->vsmt);
124     return spapr_get_vcpu_id(cpu) % spapr->vsmt == 0;
125 }
126 
127 static bool pre_2_10_vmstate_dummy_icp_needed(void *opaque)
128 {
129     /* Dummy entries correspond to unused ICPState objects in older QEMUs,
130      * and newer QEMUs don't even have them. In both cases, we don't want
131      * to send anything on the wire.
132      */
133     return false;
134 }
135 
136 static const VMStateDescription pre_2_10_vmstate_dummy_icp = {
137     .name = "icp/server",
138     .version_id = 1,
139     .minimum_version_id = 1,
140     .needed = pre_2_10_vmstate_dummy_icp_needed,
141     .fields = (VMStateField[]) {
142         VMSTATE_UNUSED(4), /* uint32_t xirr */
143         VMSTATE_UNUSED(1), /* uint8_t pending_priority */
144         VMSTATE_UNUSED(1), /* uint8_t mfrr */
145         VMSTATE_END_OF_LIST()
146     },
147 };
148 
149 static void pre_2_10_vmstate_register_dummy_icp(int i)
150 {
151     vmstate_register(NULL, i, &pre_2_10_vmstate_dummy_icp,
152                      (void *)(uintptr_t) i);
153 }
154 
155 static void pre_2_10_vmstate_unregister_dummy_icp(int i)
156 {
157     vmstate_unregister(NULL, &pre_2_10_vmstate_dummy_icp,
158                        (void *)(uintptr_t) i);
159 }
160 
161 int spapr_max_server_number(SpaprMachineState *spapr)
162 {
163     MachineState *ms = MACHINE(spapr);
164 
165     assert(spapr->vsmt);
166     return DIV_ROUND_UP(ms->smp.max_cpus * spapr->vsmt, ms->smp.threads);
167 }
168 
169 static int spapr_fixup_cpu_smt_dt(void *fdt, int offset, PowerPCCPU *cpu,
170                                   int smt_threads)
171 {
172     int i, ret = 0;
173     uint32_t servers_prop[smt_threads];
174     uint32_t gservers_prop[smt_threads * 2];
175     int index = spapr_get_vcpu_id(cpu);
176 
177     if (cpu->compat_pvr) {
178         ret = fdt_setprop_cell(fdt, offset, "cpu-version", cpu->compat_pvr);
179         if (ret < 0) {
180             return ret;
181         }
182     }
183 
184     /* Build interrupt servers and gservers properties */
185     for (i = 0; i < smt_threads; i++) {
186         servers_prop[i] = cpu_to_be32(index + i);
187         /* Hack, direct the group queues back to cpu 0 */
188         gservers_prop[i*2] = cpu_to_be32(index + i);
189         gservers_prop[i*2 + 1] = 0;
190     }
191     ret = fdt_setprop(fdt, offset, "ibm,ppc-interrupt-server#s",
192                       servers_prop, sizeof(servers_prop));
193     if (ret < 0) {
194         return ret;
195     }
196     ret = fdt_setprop(fdt, offset, "ibm,ppc-interrupt-gserver#s",
197                       gservers_prop, sizeof(gservers_prop));
198 
199     return ret;
200 }
201 
202 static int spapr_fixup_cpu_numa_dt(void *fdt, int offset, PowerPCCPU *cpu)
203 {
204     int index = spapr_get_vcpu_id(cpu);
205     uint32_t associativity[] = {cpu_to_be32(0x5),
206                                 cpu_to_be32(0x0),
207                                 cpu_to_be32(0x0),
208                                 cpu_to_be32(0x0),
209                                 cpu_to_be32(cpu->node_id),
210                                 cpu_to_be32(index)};
211 
212     /* Advertise NUMA via ibm,associativity */
213     return fdt_setprop(fdt, offset, "ibm,associativity", associativity,
214                           sizeof(associativity));
215 }
216 
217 /* Populate the "ibm,pa-features" property */
218 static void spapr_populate_pa_features(SpaprMachineState *spapr,
219                                        PowerPCCPU *cpu,
220                                        void *fdt, int offset,
221                                        bool legacy_guest)
222 {
223     uint8_t pa_features_206[] = { 6, 0,
224         0xf6, 0x1f, 0xc7, 0x00, 0x80, 0xc0 };
225     uint8_t pa_features_207[] = { 24, 0,
226         0xf6, 0x1f, 0xc7, 0xc0, 0x80, 0xf0,
227         0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
228         0x00, 0x00, 0x00, 0x00, 0x80, 0x00,
229         0x80, 0x00, 0x80, 0x00, 0x00, 0x00 };
230     uint8_t pa_features_300[] = { 66, 0,
231         /* 0: MMU|FPU|SLB|RUN|DABR|NX, 1: fri[nzpm]|DABRX|SPRG3|SLB0|PP110 */
232         /* 2: VPM|DS205|PPR|DS202|DS206, 3: LSD|URG, SSO, 5: LE|CFAR|EB|LSQ */
233         0xf6, 0x1f, 0xc7, 0xc0, 0x80, 0xf0, /* 0 - 5 */
234         /* 6: DS207 */
235         0x80, 0x00, 0x00, 0x00, 0x00, 0x00, /* 6 - 11 */
236         /* 16: Vector */
237         0x00, 0x00, 0x00, 0x00, 0x80, 0x00, /* 12 - 17 */
238         /* 18: Vec. Scalar, 20: Vec. XOR, 22: HTM */
239         0x80, 0x00, 0x80, 0x00, 0x00, 0x00, /* 18 - 23 */
240         /* 24: Ext. Dec, 26: 64 bit ftrs, 28: PM ftrs */
241         0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 24 - 29 */
242         /* 30: MMR, 32: LE atomic, 34: EBB + ext EBB */
243         0x80, 0x00, 0x80, 0x00, 0xC0, 0x00, /* 30 - 35 */
244         /* 36: SPR SO, 38: Copy/Paste, 40: Radix MMU */
245         0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 36 - 41 */
246         /* 42: PM, 44: PC RA, 46: SC vec'd */
247         0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 42 - 47 */
248         /* 48: SIMD, 50: QP BFP, 52: String */
249         0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 48 - 53 */
250         /* 54: DecFP, 56: DecI, 58: SHA */
251         0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 54 - 59 */
252         /* 60: NM atomic, 62: RNG */
253         0x80, 0x00, 0x80, 0x00, 0x00, 0x00, /* 60 - 65 */
254     };
255     uint8_t *pa_features = NULL;
256     size_t pa_size;
257 
258     if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_2_06, 0, cpu->compat_pvr)) {
259         pa_features = pa_features_206;
260         pa_size = sizeof(pa_features_206);
261     }
262     if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_2_07, 0, cpu->compat_pvr)) {
263         pa_features = pa_features_207;
264         pa_size = sizeof(pa_features_207);
265     }
266     if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_3_00, 0, cpu->compat_pvr)) {
267         pa_features = pa_features_300;
268         pa_size = sizeof(pa_features_300);
269     }
270     if (!pa_features) {
271         return;
272     }
273 
274     if (ppc_hash64_has(cpu, PPC_HASH64_CI_LARGEPAGE)) {
275         /*
276          * Note: we keep CI large pages off by default because a 64K capable
277          * guest provisioned with large pages might otherwise try to map a qemu
278          * framebuffer (or other kind of memory mapped PCI BAR) using 64K pages
279          * even if that qemu runs on a 4k host.
280          * We dd this bit back here if we are confident this is not an issue
281          */
282         pa_features[3] |= 0x20;
283     }
284     if ((spapr_get_cap(spapr, SPAPR_CAP_HTM) != 0) && pa_size > 24) {
285         pa_features[24] |= 0x80;    /* Transactional memory support */
286     }
287     if (legacy_guest && pa_size > 40) {
288         /* Workaround for broken kernels that attempt (guest) radix
289          * mode when they can't handle it, if they see the radix bit set
290          * in pa-features. So hide it from them. */
291         pa_features[40 + 2] &= ~0x80; /* Radix MMU */
292     }
293 
294     _FDT((fdt_setprop(fdt, offset, "ibm,pa-features", pa_features, pa_size)));
295 }
296 
297 static int spapr_fixup_cpu_dt(void *fdt, SpaprMachineState *spapr)
298 {
299     MachineState *ms = MACHINE(spapr);
300     int ret = 0, offset, cpus_offset;
301     CPUState *cs;
302     char cpu_model[32];
303     uint32_t pft_size_prop[] = {0, cpu_to_be32(spapr->htab_shift)};
304 
305     CPU_FOREACH(cs) {
306         PowerPCCPU *cpu = POWERPC_CPU(cs);
307         DeviceClass *dc = DEVICE_GET_CLASS(cs);
308         int index = spapr_get_vcpu_id(cpu);
309         int compat_smt = MIN(ms->smp.threads, ppc_compat_max_vthreads(cpu));
310 
311         if (!spapr_is_thread0_in_vcore(spapr, cpu)) {
312             continue;
313         }
314 
315         snprintf(cpu_model, 32, "%s@%x", dc->fw_name, index);
316 
317         cpus_offset = fdt_path_offset(fdt, "/cpus");
318         if (cpus_offset < 0) {
319             cpus_offset = fdt_add_subnode(fdt, 0, "cpus");
320             if (cpus_offset < 0) {
321                 return cpus_offset;
322             }
323         }
324         offset = fdt_subnode_offset(fdt, cpus_offset, cpu_model);
325         if (offset < 0) {
326             offset = fdt_add_subnode(fdt, cpus_offset, cpu_model);
327             if (offset < 0) {
328                 return offset;
329             }
330         }
331 
332         ret = fdt_setprop(fdt, offset, "ibm,pft-size",
333                           pft_size_prop, sizeof(pft_size_prop));
334         if (ret < 0) {
335             return ret;
336         }
337 
338         if (nb_numa_nodes > 1) {
339             ret = spapr_fixup_cpu_numa_dt(fdt, offset, cpu);
340             if (ret < 0) {
341                 return ret;
342             }
343         }
344 
345         ret = spapr_fixup_cpu_smt_dt(fdt, offset, cpu, compat_smt);
346         if (ret < 0) {
347             return ret;
348         }
349 
350         spapr_populate_pa_features(spapr, cpu, fdt, offset,
351                                    spapr->cas_legacy_guest_workaround);
352     }
353     return ret;
354 }
355 
356 static hwaddr spapr_node0_size(MachineState *machine)
357 {
358     if (nb_numa_nodes) {
359         int i;
360         for (i = 0; i < nb_numa_nodes; ++i) {
361             if (numa_info[i].node_mem) {
362                 return MIN(pow2floor(numa_info[i].node_mem),
363                            machine->ram_size);
364             }
365         }
366     }
367     return machine->ram_size;
368 }
369 
370 static void add_str(GString *s, const gchar *s1)
371 {
372     g_string_append_len(s, s1, strlen(s1) + 1);
373 }
374 
375 static int spapr_populate_memory_node(void *fdt, int nodeid, hwaddr start,
376                                        hwaddr size)
377 {
378     uint32_t associativity[] = {
379         cpu_to_be32(0x4), /* length */
380         cpu_to_be32(0x0), cpu_to_be32(0x0),
381         cpu_to_be32(0x0), cpu_to_be32(nodeid)
382     };
383     char mem_name[32];
384     uint64_t mem_reg_property[2];
385     int off;
386 
387     mem_reg_property[0] = cpu_to_be64(start);
388     mem_reg_property[1] = cpu_to_be64(size);
389 
390     sprintf(mem_name, "memory@" TARGET_FMT_lx, start);
391     off = fdt_add_subnode(fdt, 0, mem_name);
392     _FDT(off);
393     _FDT((fdt_setprop_string(fdt, off, "device_type", "memory")));
394     _FDT((fdt_setprop(fdt, off, "reg", mem_reg_property,
395                       sizeof(mem_reg_property))));
396     _FDT((fdt_setprop(fdt, off, "ibm,associativity", associativity,
397                       sizeof(associativity))));
398     return off;
399 }
400 
401 static int spapr_populate_memory(SpaprMachineState *spapr, void *fdt)
402 {
403     MachineState *machine = MACHINE(spapr);
404     hwaddr mem_start, node_size;
405     int i, nb_nodes = nb_numa_nodes;
406     NodeInfo *nodes = numa_info;
407     NodeInfo ramnode;
408 
409     /* No NUMA nodes, assume there is just one node with whole RAM */
410     if (!nb_numa_nodes) {
411         nb_nodes = 1;
412         ramnode.node_mem = machine->ram_size;
413         nodes = &ramnode;
414     }
415 
416     for (i = 0, mem_start = 0; i < nb_nodes; ++i) {
417         if (!nodes[i].node_mem) {
418             continue;
419         }
420         if (mem_start >= machine->ram_size) {
421             node_size = 0;
422         } else {
423             node_size = nodes[i].node_mem;
424             if (node_size > machine->ram_size - mem_start) {
425                 node_size = machine->ram_size - mem_start;
426             }
427         }
428         if (!mem_start) {
429             /* spapr_machine_init() checks for rma_size <= node0_size
430              * already */
431             spapr_populate_memory_node(fdt, i, 0, spapr->rma_size);
432             mem_start += spapr->rma_size;
433             node_size -= spapr->rma_size;
434         }
435         for ( ; node_size; ) {
436             hwaddr sizetmp = pow2floor(node_size);
437 
438             /* mem_start != 0 here */
439             if (ctzl(mem_start) < ctzl(sizetmp)) {
440                 sizetmp = 1ULL << ctzl(mem_start);
441             }
442 
443             spapr_populate_memory_node(fdt, i, mem_start, sizetmp);
444             node_size -= sizetmp;
445             mem_start += sizetmp;
446         }
447     }
448 
449     return 0;
450 }
451 
452 static void spapr_populate_cpu_dt(CPUState *cs, void *fdt, int offset,
453                                   SpaprMachineState *spapr)
454 {
455     MachineState *ms = MACHINE(spapr);
456     PowerPCCPU *cpu = POWERPC_CPU(cs);
457     CPUPPCState *env = &cpu->env;
458     PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
459     int index = spapr_get_vcpu_id(cpu);
460     uint32_t segs[] = {cpu_to_be32(28), cpu_to_be32(40),
461                        0xffffffff, 0xffffffff};
462     uint32_t tbfreq = kvm_enabled() ? kvmppc_get_tbfreq()
463         : SPAPR_TIMEBASE_FREQ;
464     uint32_t cpufreq = kvm_enabled() ? kvmppc_get_clockfreq() : 1000000000;
465     uint32_t page_sizes_prop[64];
466     size_t page_sizes_prop_size;
467     unsigned int smp_threads = ms->smp.threads;
468     uint32_t vcpus_per_socket = smp_threads * ms->smp.cores;
469     uint32_t pft_size_prop[] = {0, cpu_to_be32(spapr->htab_shift)};
470     int compat_smt = MIN(smp_threads, ppc_compat_max_vthreads(cpu));
471     SpaprDrc *drc;
472     int drc_index;
473     uint32_t radix_AP_encodings[PPC_PAGE_SIZES_MAX_SZ];
474     int i;
475 
476     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_CPU, index);
477     if (drc) {
478         drc_index = spapr_drc_index(drc);
479         _FDT((fdt_setprop_cell(fdt, offset, "ibm,my-drc-index", drc_index)));
480     }
481 
482     _FDT((fdt_setprop_cell(fdt, offset, "reg", index)));
483     _FDT((fdt_setprop_string(fdt, offset, "device_type", "cpu")));
484 
485     _FDT((fdt_setprop_cell(fdt, offset, "cpu-version", env->spr[SPR_PVR])));
486     _FDT((fdt_setprop_cell(fdt, offset, "d-cache-block-size",
487                            env->dcache_line_size)));
488     _FDT((fdt_setprop_cell(fdt, offset, "d-cache-line-size",
489                            env->dcache_line_size)));
490     _FDT((fdt_setprop_cell(fdt, offset, "i-cache-block-size",
491                            env->icache_line_size)));
492     _FDT((fdt_setprop_cell(fdt, offset, "i-cache-line-size",
493                            env->icache_line_size)));
494 
495     if (pcc->l1_dcache_size) {
496         _FDT((fdt_setprop_cell(fdt, offset, "d-cache-size",
497                                pcc->l1_dcache_size)));
498     } else {
499         warn_report("Unknown L1 dcache size for cpu");
500     }
501     if (pcc->l1_icache_size) {
502         _FDT((fdt_setprop_cell(fdt, offset, "i-cache-size",
503                                pcc->l1_icache_size)));
504     } else {
505         warn_report("Unknown L1 icache size for cpu");
506     }
507 
508     _FDT((fdt_setprop_cell(fdt, offset, "timebase-frequency", tbfreq)));
509     _FDT((fdt_setprop_cell(fdt, offset, "clock-frequency", cpufreq)));
510     _FDT((fdt_setprop_cell(fdt, offset, "slb-size", cpu->hash64_opts->slb_size)));
511     _FDT((fdt_setprop_cell(fdt, offset, "ibm,slb-size", cpu->hash64_opts->slb_size)));
512     _FDT((fdt_setprop_string(fdt, offset, "status", "okay")));
513     _FDT((fdt_setprop(fdt, offset, "64-bit", NULL, 0)));
514 
515     if (env->spr_cb[SPR_PURR].oea_read) {
516         _FDT((fdt_setprop_cell(fdt, offset, "ibm,purr", 1)));
517     }
518     if (env->spr_cb[SPR_SPURR].oea_read) {
519         _FDT((fdt_setprop_cell(fdt, offset, "ibm,spurr", 1)));
520     }
521 
522     if (ppc_hash64_has(cpu, PPC_HASH64_1TSEG)) {
523         _FDT((fdt_setprop(fdt, offset, "ibm,processor-segment-sizes",
524                           segs, sizeof(segs))));
525     }
526 
527     /* Advertise VSX (vector extensions) if available
528      *   1               == VMX / Altivec available
529      *   2               == VSX available
530      *
531      * Only CPUs for which we create core types in spapr_cpu_core.c
532      * are possible, and all of those have VMX */
533     if (spapr_get_cap(spapr, SPAPR_CAP_VSX) != 0) {
534         _FDT((fdt_setprop_cell(fdt, offset, "ibm,vmx", 2)));
535     } else {
536         _FDT((fdt_setprop_cell(fdt, offset, "ibm,vmx", 1)));
537     }
538 
539     /* Advertise DFP (Decimal Floating Point) if available
540      *   0 / no property == no DFP
541      *   1               == DFP available */
542     if (spapr_get_cap(spapr, SPAPR_CAP_DFP) != 0) {
543         _FDT((fdt_setprop_cell(fdt, offset, "ibm,dfp", 1)));
544     }
545 
546     page_sizes_prop_size = ppc_create_page_sizes_prop(cpu, page_sizes_prop,
547                                                       sizeof(page_sizes_prop));
548     if (page_sizes_prop_size) {
549         _FDT((fdt_setprop(fdt, offset, "ibm,segment-page-sizes",
550                           page_sizes_prop, page_sizes_prop_size)));
551     }
552 
553     spapr_populate_pa_features(spapr, cpu, fdt, offset, false);
554 
555     _FDT((fdt_setprop_cell(fdt, offset, "ibm,chip-id",
556                            cs->cpu_index / vcpus_per_socket)));
557 
558     _FDT((fdt_setprop(fdt, offset, "ibm,pft-size",
559                       pft_size_prop, sizeof(pft_size_prop))));
560 
561     if (nb_numa_nodes > 1) {
562         _FDT(spapr_fixup_cpu_numa_dt(fdt, offset, cpu));
563     }
564 
565     _FDT(spapr_fixup_cpu_smt_dt(fdt, offset, cpu, compat_smt));
566 
567     if (pcc->radix_page_info) {
568         for (i = 0; i < pcc->radix_page_info->count; i++) {
569             radix_AP_encodings[i] =
570                 cpu_to_be32(pcc->radix_page_info->entries[i]);
571         }
572         _FDT((fdt_setprop(fdt, offset, "ibm,processor-radix-AP-encodings",
573                           radix_AP_encodings,
574                           pcc->radix_page_info->count *
575                           sizeof(radix_AP_encodings[0]))));
576     }
577 
578     /*
579      * We set this property to let the guest know that it can use the large
580      * decrementer and its width in bits.
581      */
582     if (spapr_get_cap(spapr, SPAPR_CAP_LARGE_DECREMENTER) != SPAPR_CAP_OFF)
583         _FDT((fdt_setprop_u32(fdt, offset, "ibm,dec-bits",
584                               pcc->lrg_decr_bits)));
585 }
586 
587 static void spapr_populate_cpus_dt_node(void *fdt, SpaprMachineState *spapr)
588 {
589     CPUState **rev;
590     CPUState *cs;
591     int n_cpus;
592     int cpus_offset;
593     char *nodename;
594     int i;
595 
596     cpus_offset = fdt_add_subnode(fdt, 0, "cpus");
597     _FDT(cpus_offset);
598     _FDT((fdt_setprop_cell(fdt, cpus_offset, "#address-cells", 0x1)));
599     _FDT((fdt_setprop_cell(fdt, cpus_offset, "#size-cells", 0x0)));
600 
601     /*
602      * We walk the CPUs in reverse order to ensure that CPU DT nodes
603      * created by fdt_add_subnode() end up in the right order in FDT
604      * for the guest kernel the enumerate the CPUs correctly.
605      *
606      * The CPU list cannot be traversed in reverse order, so we need
607      * to do extra work.
608      */
609     n_cpus = 0;
610     rev = NULL;
611     CPU_FOREACH(cs) {
612         rev = g_renew(CPUState *, rev, n_cpus + 1);
613         rev[n_cpus++] = cs;
614     }
615 
616     for (i = n_cpus - 1; i >= 0; i--) {
617         CPUState *cs = rev[i];
618         PowerPCCPU *cpu = POWERPC_CPU(cs);
619         int index = spapr_get_vcpu_id(cpu);
620         DeviceClass *dc = DEVICE_GET_CLASS(cs);
621         int offset;
622 
623         if (!spapr_is_thread0_in_vcore(spapr, cpu)) {
624             continue;
625         }
626 
627         nodename = g_strdup_printf("%s@%x", dc->fw_name, index);
628         offset = fdt_add_subnode(fdt, cpus_offset, nodename);
629         g_free(nodename);
630         _FDT(offset);
631         spapr_populate_cpu_dt(cs, fdt, offset, spapr);
632     }
633 
634     g_free(rev);
635 }
636 
637 static int spapr_rng_populate_dt(void *fdt)
638 {
639     int node;
640     int ret;
641 
642     node = qemu_fdt_add_subnode(fdt, "/ibm,platform-facilities");
643     if (node <= 0) {
644         return -1;
645     }
646     ret = fdt_setprop_string(fdt, node, "device_type",
647                              "ibm,platform-facilities");
648     ret |= fdt_setprop_cell(fdt, node, "#address-cells", 0x1);
649     ret |= fdt_setprop_cell(fdt, node, "#size-cells", 0x0);
650 
651     node = fdt_add_subnode(fdt, node, "ibm,random-v1");
652     if (node <= 0) {
653         return -1;
654     }
655     ret |= fdt_setprop_string(fdt, node, "compatible", "ibm,random");
656 
657     return ret ? -1 : 0;
658 }
659 
660 static uint32_t spapr_pc_dimm_node(MemoryDeviceInfoList *list, ram_addr_t addr)
661 {
662     MemoryDeviceInfoList *info;
663 
664     for (info = list; info; info = info->next) {
665         MemoryDeviceInfo *value = info->value;
666 
667         if (value && value->type == MEMORY_DEVICE_INFO_KIND_DIMM) {
668             PCDIMMDeviceInfo *pcdimm_info = value->u.dimm.data;
669 
670             if (addr >= pcdimm_info->addr &&
671                 addr < (pcdimm_info->addr + pcdimm_info->size)) {
672                 return pcdimm_info->node;
673             }
674         }
675     }
676 
677     return -1;
678 }
679 
680 struct sPAPRDrconfCellV2 {
681      uint32_t seq_lmbs;
682      uint64_t base_addr;
683      uint32_t drc_index;
684      uint32_t aa_index;
685      uint32_t flags;
686 } QEMU_PACKED;
687 
688 typedef struct DrconfCellQueue {
689     struct sPAPRDrconfCellV2 cell;
690     QSIMPLEQ_ENTRY(DrconfCellQueue) entry;
691 } DrconfCellQueue;
692 
693 static DrconfCellQueue *
694 spapr_get_drconf_cell(uint32_t seq_lmbs, uint64_t base_addr,
695                       uint32_t drc_index, uint32_t aa_index,
696                       uint32_t flags)
697 {
698     DrconfCellQueue *elem;
699 
700     elem = g_malloc0(sizeof(*elem));
701     elem->cell.seq_lmbs = cpu_to_be32(seq_lmbs);
702     elem->cell.base_addr = cpu_to_be64(base_addr);
703     elem->cell.drc_index = cpu_to_be32(drc_index);
704     elem->cell.aa_index = cpu_to_be32(aa_index);
705     elem->cell.flags = cpu_to_be32(flags);
706 
707     return elem;
708 }
709 
710 /* ibm,dynamic-memory-v2 */
711 static int spapr_populate_drmem_v2(SpaprMachineState *spapr, void *fdt,
712                                    int offset, MemoryDeviceInfoList *dimms)
713 {
714     MachineState *machine = MACHINE(spapr);
715     uint8_t *int_buf, *cur_index;
716     int ret;
717     uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
718     uint64_t addr, cur_addr, size;
719     uint32_t nr_boot_lmbs = (machine->device_memory->base / lmb_size);
720     uint64_t mem_end = machine->device_memory->base +
721                        memory_region_size(&machine->device_memory->mr);
722     uint32_t node, buf_len, nr_entries = 0;
723     SpaprDrc *drc;
724     DrconfCellQueue *elem, *next;
725     MemoryDeviceInfoList *info;
726     QSIMPLEQ_HEAD(, DrconfCellQueue) drconf_queue
727         = QSIMPLEQ_HEAD_INITIALIZER(drconf_queue);
728 
729     /* Entry to cover RAM and the gap area */
730     elem = spapr_get_drconf_cell(nr_boot_lmbs, 0, 0, -1,
731                                  SPAPR_LMB_FLAGS_RESERVED |
732                                  SPAPR_LMB_FLAGS_DRC_INVALID);
733     QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
734     nr_entries++;
735 
736     cur_addr = machine->device_memory->base;
737     for (info = dimms; info; info = info->next) {
738         PCDIMMDeviceInfo *di = info->value->u.dimm.data;
739 
740         addr = di->addr;
741         size = di->size;
742         node = di->node;
743 
744         /* Entry for hot-pluggable area */
745         if (cur_addr < addr) {
746             drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, cur_addr / lmb_size);
747             g_assert(drc);
748             elem = spapr_get_drconf_cell((addr - cur_addr) / lmb_size,
749                                          cur_addr, spapr_drc_index(drc), -1, 0);
750             QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
751             nr_entries++;
752         }
753 
754         /* Entry for DIMM */
755         drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, addr / lmb_size);
756         g_assert(drc);
757         elem = spapr_get_drconf_cell(size / lmb_size, addr,
758                                      spapr_drc_index(drc), node,
759                                      SPAPR_LMB_FLAGS_ASSIGNED);
760         QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
761         nr_entries++;
762         cur_addr = addr + size;
763     }
764 
765     /* Entry for remaining hotpluggable area */
766     if (cur_addr < mem_end) {
767         drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, cur_addr / lmb_size);
768         g_assert(drc);
769         elem = spapr_get_drconf_cell((mem_end - cur_addr) / lmb_size,
770                                      cur_addr, spapr_drc_index(drc), -1, 0);
771         QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
772         nr_entries++;
773     }
774 
775     buf_len = nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);
776     int_buf = cur_index = g_malloc0(buf_len);
777     *(uint32_t *)int_buf = cpu_to_be32(nr_entries);
778     cur_index += sizeof(nr_entries);
779 
780     QSIMPLEQ_FOREACH_SAFE(elem, &drconf_queue, entry, next) {
781         memcpy(cur_index, &elem->cell, sizeof(elem->cell));
782         cur_index += sizeof(elem->cell);
783         QSIMPLEQ_REMOVE(&drconf_queue, elem, DrconfCellQueue, entry);
784         g_free(elem);
785     }
786 
787     ret = fdt_setprop(fdt, offset, "ibm,dynamic-memory-v2", int_buf, buf_len);
788     g_free(int_buf);
789     if (ret < 0) {
790         return -1;
791     }
792     return 0;
793 }
794 
795 /* ibm,dynamic-memory */
796 static int spapr_populate_drmem_v1(SpaprMachineState *spapr, void *fdt,
797                                    int offset, MemoryDeviceInfoList *dimms)
798 {
799     MachineState *machine = MACHINE(spapr);
800     int i, ret;
801     uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
802     uint32_t device_lmb_start = machine->device_memory->base / lmb_size;
803     uint32_t nr_lmbs = (machine->device_memory->base +
804                        memory_region_size(&machine->device_memory->mr)) /
805                        lmb_size;
806     uint32_t *int_buf, *cur_index, buf_len;
807 
808     /*
809      * Allocate enough buffer size to fit in ibm,dynamic-memory
810      */
811     buf_len = (nr_lmbs * SPAPR_DR_LMB_LIST_ENTRY_SIZE + 1) * sizeof(uint32_t);
812     cur_index = int_buf = g_malloc0(buf_len);
813     int_buf[0] = cpu_to_be32(nr_lmbs);
814     cur_index++;
815     for (i = 0; i < nr_lmbs; i++) {
816         uint64_t addr = i * lmb_size;
817         uint32_t *dynamic_memory = cur_index;
818 
819         if (i >= device_lmb_start) {
820             SpaprDrc *drc;
821 
822             drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, i);
823             g_assert(drc);
824 
825             dynamic_memory[0] = cpu_to_be32(addr >> 32);
826             dynamic_memory[1] = cpu_to_be32(addr & 0xffffffff);
827             dynamic_memory[2] = cpu_to_be32(spapr_drc_index(drc));
828             dynamic_memory[3] = cpu_to_be32(0); /* reserved */
829             dynamic_memory[4] = cpu_to_be32(spapr_pc_dimm_node(dimms, addr));
830             if (memory_region_present(get_system_memory(), addr)) {
831                 dynamic_memory[5] = cpu_to_be32(SPAPR_LMB_FLAGS_ASSIGNED);
832             } else {
833                 dynamic_memory[5] = cpu_to_be32(0);
834             }
835         } else {
836             /*
837              * LMB information for RMA, boot time RAM and gap b/n RAM and
838              * device memory region -- all these are marked as reserved
839              * and as having no valid DRC.
840              */
841             dynamic_memory[0] = cpu_to_be32(addr >> 32);
842             dynamic_memory[1] = cpu_to_be32(addr & 0xffffffff);
843             dynamic_memory[2] = cpu_to_be32(0);
844             dynamic_memory[3] = cpu_to_be32(0); /* reserved */
845             dynamic_memory[4] = cpu_to_be32(-1);
846             dynamic_memory[5] = cpu_to_be32(SPAPR_LMB_FLAGS_RESERVED |
847                                             SPAPR_LMB_FLAGS_DRC_INVALID);
848         }
849 
850         cur_index += SPAPR_DR_LMB_LIST_ENTRY_SIZE;
851     }
852     ret = fdt_setprop(fdt, offset, "ibm,dynamic-memory", int_buf, buf_len);
853     g_free(int_buf);
854     if (ret < 0) {
855         return -1;
856     }
857     return 0;
858 }
859 
860 /*
861  * Adds ibm,dynamic-reconfiguration-memory node.
862  * Refer to docs/specs/ppc-spapr-hotplug.txt for the documentation
863  * of this device tree node.
864  */
865 static int spapr_populate_drconf_memory(SpaprMachineState *spapr, void *fdt)
866 {
867     MachineState *machine = MACHINE(spapr);
868     int ret, i, offset;
869     uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
870     uint32_t prop_lmb_size[] = {0, cpu_to_be32(lmb_size)};
871     uint32_t *int_buf, *cur_index, buf_len;
872     int nr_nodes = nb_numa_nodes ? nb_numa_nodes : 1;
873     MemoryDeviceInfoList *dimms = NULL;
874 
875     /*
876      * Don't create the node if there is no device memory
877      */
878     if (machine->ram_size == machine->maxram_size) {
879         return 0;
880     }
881 
882     offset = fdt_add_subnode(fdt, 0, "ibm,dynamic-reconfiguration-memory");
883 
884     ret = fdt_setprop(fdt, offset, "ibm,lmb-size", prop_lmb_size,
885                     sizeof(prop_lmb_size));
886     if (ret < 0) {
887         return ret;
888     }
889 
890     ret = fdt_setprop_cell(fdt, offset, "ibm,memory-flags-mask", 0xff);
891     if (ret < 0) {
892         return ret;
893     }
894 
895     ret = fdt_setprop_cell(fdt, offset, "ibm,memory-preservation-time", 0x0);
896     if (ret < 0) {
897         return ret;
898     }
899 
900     /* ibm,dynamic-memory or ibm,dynamic-memory-v2 */
901     dimms = qmp_memory_device_list();
902     if (spapr_ovec_test(spapr->ov5_cas, OV5_DRMEM_V2)) {
903         ret = spapr_populate_drmem_v2(spapr, fdt, offset, dimms);
904     } else {
905         ret = spapr_populate_drmem_v1(spapr, fdt, offset, dimms);
906     }
907     qapi_free_MemoryDeviceInfoList(dimms);
908 
909     if (ret < 0) {
910         return ret;
911     }
912 
913     /* ibm,associativity-lookup-arrays */
914     buf_len = (nr_nodes * 4 + 2) * sizeof(uint32_t);
915     cur_index = int_buf = g_malloc0(buf_len);
916     int_buf[0] = cpu_to_be32(nr_nodes);
917     int_buf[1] = cpu_to_be32(4); /* Number of entries per associativity list */
918     cur_index += 2;
919     for (i = 0; i < nr_nodes; i++) {
920         uint32_t associativity[] = {
921             cpu_to_be32(0x0),
922             cpu_to_be32(0x0),
923             cpu_to_be32(0x0),
924             cpu_to_be32(i)
925         };
926         memcpy(cur_index, associativity, sizeof(associativity));
927         cur_index += 4;
928     }
929     ret = fdt_setprop(fdt, offset, "ibm,associativity-lookup-arrays", int_buf,
930             (cur_index - int_buf) * sizeof(uint32_t));
931     g_free(int_buf);
932 
933     return ret;
934 }
935 
936 static int spapr_dt_cas_updates(SpaprMachineState *spapr, void *fdt,
937                                 SpaprOptionVector *ov5_updates)
938 {
939     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
940     int ret = 0, offset;
941 
942     /* Generate ibm,dynamic-reconfiguration-memory node if required */
943     if (spapr_ovec_test(ov5_updates, OV5_DRCONF_MEMORY)) {
944         g_assert(smc->dr_lmb_enabled);
945         ret = spapr_populate_drconf_memory(spapr, fdt);
946         if (ret) {
947             goto out;
948         }
949     }
950 
951     offset = fdt_path_offset(fdt, "/chosen");
952     if (offset < 0) {
953         offset = fdt_add_subnode(fdt, 0, "chosen");
954         if (offset < 0) {
955             return offset;
956         }
957     }
958     ret = spapr_ovec_populate_dt(fdt, offset, spapr->ov5_cas,
959                                  "ibm,architecture-vec-5");
960 
961 out:
962     return ret;
963 }
964 
965 static bool spapr_hotplugged_dev_before_cas(void)
966 {
967     Object *drc_container, *obj;
968     ObjectProperty *prop;
969     ObjectPropertyIterator iter;
970 
971     drc_container = container_get(object_get_root(), "/dr-connector");
972     object_property_iter_init(&iter, drc_container);
973     while ((prop = object_property_iter_next(&iter))) {
974         if (!strstart(prop->type, "link<", NULL)) {
975             continue;
976         }
977         obj = object_property_get_link(drc_container, prop->name, NULL);
978         if (spapr_drc_needed(obj)) {
979             return true;
980         }
981     }
982     return false;
983 }
984 
985 int spapr_h_cas_compose_response(SpaprMachineState *spapr,
986                                  target_ulong addr, target_ulong size,
987                                  SpaprOptionVector *ov5_updates)
988 {
989     void *fdt, *fdt_skel;
990     SpaprDeviceTreeUpdateHeader hdr = { .version_id = 1 };
991 
992     if (spapr_hotplugged_dev_before_cas()) {
993         return 1;
994     }
995 
996     if (size < sizeof(hdr) || size > FW_MAX_SIZE) {
997         error_report("SLOF provided an unexpected CAS buffer size "
998                      TARGET_FMT_lu " (min: %zu, max: %u)",
999                      size, sizeof(hdr), FW_MAX_SIZE);
1000         exit(EXIT_FAILURE);
1001     }
1002 
1003     size -= sizeof(hdr);
1004 
1005     /* Create skeleton */
1006     fdt_skel = g_malloc0(size);
1007     _FDT((fdt_create(fdt_skel, size)));
1008     _FDT((fdt_finish_reservemap(fdt_skel)));
1009     _FDT((fdt_begin_node(fdt_skel, "")));
1010     _FDT((fdt_end_node(fdt_skel)));
1011     _FDT((fdt_finish(fdt_skel)));
1012     fdt = g_malloc0(size);
1013     _FDT((fdt_open_into(fdt_skel, fdt, size)));
1014     g_free(fdt_skel);
1015 
1016     /* Fixup cpu nodes */
1017     _FDT((spapr_fixup_cpu_dt(fdt, spapr)));
1018 
1019     if (spapr_dt_cas_updates(spapr, fdt, ov5_updates)) {
1020         return -1;
1021     }
1022 
1023     /* Pack resulting tree */
1024     _FDT((fdt_pack(fdt)));
1025 
1026     if (fdt_totalsize(fdt) + sizeof(hdr) > size) {
1027         trace_spapr_cas_failed(size);
1028         return -1;
1029     }
1030 
1031     cpu_physical_memory_write(addr, &hdr, sizeof(hdr));
1032     cpu_physical_memory_write(addr + sizeof(hdr), fdt, fdt_totalsize(fdt));
1033     trace_spapr_cas_continue(fdt_totalsize(fdt) + sizeof(hdr));
1034     g_free(fdt);
1035 
1036     return 0;
1037 }
1038 
1039 static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
1040 {
1041     MachineState *ms = MACHINE(spapr);
1042     int rtas;
1043     GString *hypertas = g_string_sized_new(256);
1044     GString *qemu_hypertas = g_string_sized_new(256);
1045     uint32_t refpoints[] = { cpu_to_be32(0x4), cpu_to_be32(0x4) };
1046     uint64_t max_device_addr = MACHINE(spapr)->device_memory->base +
1047         memory_region_size(&MACHINE(spapr)->device_memory->mr);
1048     uint32_t lrdr_capacity[] = {
1049         cpu_to_be32(max_device_addr >> 32),
1050         cpu_to_be32(max_device_addr & 0xffffffff),
1051         0, cpu_to_be32(SPAPR_MEMORY_BLOCK_SIZE),
1052         cpu_to_be32(ms->smp.max_cpus / ms->smp.threads),
1053     };
1054     uint32_t maxdomain = cpu_to_be32(spapr->gpu_numa_id > 1 ? 1 : 0);
1055     uint32_t maxdomains[] = {
1056         cpu_to_be32(4),
1057         maxdomain,
1058         maxdomain,
1059         maxdomain,
1060         cpu_to_be32(spapr->gpu_numa_id),
1061     };
1062 
1063     _FDT(rtas = fdt_add_subnode(fdt, 0, "rtas"));
1064 
1065     /* hypertas */
1066     add_str(hypertas, "hcall-pft");
1067     add_str(hypertas, "hcall-term");
1068     add_str(hypertas, "hcall-dabr");
1069     add_str(hypertas, "hcall-interrupt");
1070     add_str(hypertas, "hcall-tce");
1071     add_str(hypertas, "hcall-vio");
1072     add_str(hypertas, "hcall-splpar");
1073     add_str(hypertas, "hcall-bulk");
1074     add_str(hypertas, "hcall-set-mode");
1075     add_str(hypertas, "hcall-sprg0");
1076     add_str(hypertas, "hcall-copy");
1077     add_str(hypertas, "hcall-debug");
1078     add_str(hypertas, "hcall-vphn");
1079     add_str(qemu_hypertas, "hcall-memop1");
1080 
1081     if (!kvm_enabled() || kvmppc_spapr_use_multitce()) {
1082         add_str(hypertas, "hcall-multi-tce");
1083     }
1084 
1085     if (spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) {
1086         add_str(hypertas, "hcall-hpt-resize");
1087     }
1088 
1089     _FDT(fdt_setprop(fdt, rtas, "ibm,hypertas-functions",
1090                      hypertas->str, hypertas->len));
1091     g_string_free(hypertas, TRUE);
1092     _FDT(fdt_setprop(fdt, rtas, "qemu,hypertas-functions",
1093                      qemu_hypertas->str, qemu_hypertas->len));
1094     g_string_free(qemu_hypertas, TRUE);
1095 
1096     _FDT(fdt_setprop(fdt, rtas, "ibm,associativity-reference-points",
1097                      refpoints, sizeof(refpoints)));
1098 
1099     _FDT(fdt_setprop(fdt, rtas, "ibm,max-associativity-domains",
1100                      maxdomains, sizeof(maxdomains)));
1101 
1102     _FDT(fdt_setprop_cell(fdt, rtas, "rtas-error-log-max",
1103                           RTAS_ERROR_LOG_MAX));
1104     _FDT(fdt_setprop_cell(fdt, rtas, "rtas-event-scan-rate",
1105                           RTAS_EVENT_SCAN_RATE));
1106 
1107     g_assert(msi_nonbroken);
1108     _FDT(fdt_setprop(fdt, rtas, "ibm,change-msix-capable", NULL, 0));
1109 
1110     /*
1111      * According to PAPR, rtas ibm,os-term does not guarantee a return
1112      * back to the guest cpu.
1113      *
1114      * While an additional ibm,extended-os-term property indicates
1115      * that rtas call return will always occur. Set this property.
1116      */
1117     _FDT(fdt_setprop(fdt, rtas, "ibm,extended-os-term", NULL, 0));
1118 
1119     _FDT(fdt_setprop(fdt, rtas, "ibm,lrdr-capacity",
1120                      lrdr_capacity, sizeof(lrdr_capacity)));
1121 
1122     spapr_dt_rtas_tokens(fdt, rtas);
1123 }
1124 
1125 /*
1126  * Prepare ibm,arch-vec-5-platform-support, which indicates the MMU
1127  * and the XIVE features that the guest may request and thus the valid
1128  * values for bytes 23..26 of option vector 5:
1129  */
1130 static void spapr_dt_ov5_platform_support(SpaprMachineState *spapr, void *fdt,
1131                                           int chosen)
1132 {
1133     PowerPCCPU *first_ppc_cpu = POWERPC_CPU(first_cpu);
1134 
1135     char val[2 * 4] = {
1136         23, spapr->irq->ov5, /* Xive mode. */
1137         24, 0x00, /* Hash/Radix, filled in below. */
1138         25, 0x00, /* Hash options: Segment Tables == no, GTSE == no. */
1139         26, 0x40, /* Radix options: GTSE == yes. */
1140     };
1141 
1142     if (!ppc_check_compat(first_ppc_cpu, CPU_POWERPC_LOGICAL_3_00, 0,
1143                           first_ppc_cpu->compat_pvr)) {
1144         /*
1145          * If we're in a pre POWER9 compat mode then the guest should
1146          * do hash and use the legacy interrupt mode
1147          */
1148         val[1] = 0x00; /* XICS */
1149         val[3] = 0x00; /* Hash */
1150     } else if (kvm_enabled()) {
1151         if (kvmppc_has_cap_mmu_radix() && kvmppc_has_cap_mmu_hash_v3()) {
1152             val[3] = 0x80; /* OV5_MMU_BOTH */
1153         } else if (kvmppc_has_cap_mmu_radix()) {
1154             val[3] = 0x40; /* OV5_MMU_RADIX_300 */
1155         } else {
1156             val[3] = 0x00; /* Hash */
1157         }
1158     } else {
1159         /* V3 MMU supports both hash and radix in tcg (with dynamic switching) */
1160         val[3] = 0xC0;
1161     }
1162     _FDT(fdt_setprop(fdt, chosen, "ibm,arch-vec-5-platform-support",
1163                      val, sizeof(val)));
1164 }
1165 
1166 static void spapr_dt_chosen(SpaprMachineState *spapr, void *fdt)
1167 {
1168     MachineState *machine = MACHINE(spapr);
1169     int chosen;
1170     const char *boot_device = machine->boot_order;
1171     char *stdout_path = spapr_vio_stdout_path(spapr->vio_bus);
1172     size_t cb = 0;
1173     char *bootlist = get_boot_devices_list(&cb);
1174 
1175     _FDT(chosen = fdt_add_subnode(fdt, 0, "chosen"));
1176 
1177     _FDT(fdt_setprop_string(fdt, chosen, "bootargs", machine->kernel_cmdline));
1178     _FDT(fdt_setprop_cell(fdt, chosen, "linux,initrd-start",
1179                           spapr->initrd_base));
1180     _FDT(fdt_setprop_cell(fdt, chosen, "linux,initrd-end",
1181                           spapr->initrd_base + spapr->initrd_size));
1182 
1183     if (spapr->kernel_size) {
1184         uint64_t kprop[2] = { cpu_to_be64(KERNEL_LOAD_ADDR),
1185                               cpu_to_be64(spapr->kernel_size) };
1186 
1187         _FDT(fdt_setprop(fdt, chosen, "qemu,boot-kernel",
1188                          &kprop, sizeof(kprop)));
1189         if (spapr->kernel_le) {
1190             _FDT(fdt_setprop(fdt, chosen, "qemu,boot-kernel-le", NULL, 0));
1191         }
1192     }
1193     if (boot_menu) {
1194         _FDT((fdt_setprop_cell(fdt, chosen, "qemu,boot-menu", boot_menu)));
1195     }
1196     _FDT(fdt_setprop_cell(fdt, chosen, "qemu,graphic-width", graphic_width));
1197     _FDT(fdt_setprop_cell(fdt, chosen, "qemu,graphic-height", graphic_height));
1198     _FDT(fdt_setprop_cell(fdt, chosen, "qemu,graphic-depth", graphic_depth));
1199 
1200     if (cb && bootlist) {
1201         int i;
1202 
1203         for (i = 0; i < cb; i++) {
1204             if (bootlist[i] == '\n') {
1205                 bootlist[i] = ' ';
1206             }
1207         }
1208         _FDT(fdt_setprop_string(fdt, chosen, "qemu,boot-list", bootlist));
1209     }
1210 
1211     if (boot_device && strlen(boot_device)) {
1212         _FDT(fdt_setprop_string(fdt, chosen, "qemu,boot-device", boot_device));
1213     }
1214 
1215     if (!spapr->has_graphics && stdout_path) {
1216         /*
1217          * "linux,stdout-path" and "stdout" properties are deprecated by linux
1218          * kernel. New platforms should only use the "stdout-path" property. Set
1219          * the new property and continue using older property to remain
1220          * compatible with the existing firmware.
1221          */
1222         _FDT(fdt_setprop_string(fdt, chosen, "linux,stdout-path", stdout_path));
1223         _FDT(fdt_setprop_string(fdt, chosen, "stdout-path", stdout_path));
1224     }
1225 
1226     spapr_dt_ov5_platform_support(spapr, fdt, chosen);
1227 
1228     g_free(stdout_path);
1229     g_free(bootlist);
1230 }
1231 
1232 static void spapr_dt_hypervisor(SpaprMachineState *spapr, void *fdt)
1233 {
1234     /* The /hypervisor node isn't in PAPR - this is a hack to allow PR
1235      * KVM to work under pHyp with some guest co-operation */
1236     int hypervisor;
1237     uint8_t hypercall[16];
1238 
1239     _FDT(hypervisor = fdt_add_subnode(fdt, 0, "hypervisor"));
1240     /* indicate KVM hypercall interface */
1241     _FDT(fdt_setprop_string(fdt, hypervisor, "compatible", "linux,kvm"));
1242     if (kvmppc_has_cap_fixup_hcalls()) {
1243         /*
1244          * Older KVM versions with older guest kernels were broken
1245          * with the magic page, don't allow the guest to map it.
1246          */
1247         if (!kvmppc_get_hypercall(first_cpu->env_ptr, hypercall,
1248                                   sizeof(hypercall))) {
1249             _FDT(fdt_setprop(fdt, hypervisor, "hcall-instructions",
1250                              hypercall, sizeof(hypercall)));
1251         }
1252     }
1253 }
1254 
1255 static void *spapr_build_fdt(SpaprMachineState *spapr)
1256 {
1257     MachineState *machine = MACHINE(spapr);
1258     MachineClass *mc = MACHINE_GET_CLASS(machine);
1259     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(machine);
1260     int ret;
1261     void *fdt;
1262     SpaprPhbState *phb;
1263     char *buf;
1264 
1265     fdt = g_malloc0(FDT_MAX_SIZE);
1266     _FDT((fdt_create_empty_tree(fdt, FDT_MAX_SIZE)));
1267 
1268     /* Root node */
1269     _FDT(fdt_setprop_string(fdt, 0, "device_type", "chrp"));
1270     _FDT(fdt_setprop_string(fdt, 0, "model", "IBM pSeries (emulated by qemu)"));
1271     _FDT(fdt_setprop_string(fdt, 0, "compatible", "qemu,pseries"));
1272 
1273     /* Guest UUID & Name*/
1274     buf = qemu_uuid_unparse_strdup(&qemu_uuid);
1275     _FDT(fdt_setprop_string(fdt, 0, "vm,uuid", buf));
1276     if (qemu_uuid_set) {
1277         _FDT(fdt_setprop_string(fdt, 0, "system-id", buf));
1278     }
1279     g_free(buf);
1280 
1281     if (qemu_get_vm_name()) {
1282         _FDT(fdt_setprop_string(fdt, 0, "ibm,partition-name",
1283                                 qemu_get_vm_name()));
1284     }
1285 
1286     /* Host Model & Serial Number */
1287     if (spapr->host_model) {
1288         _FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model));
1289     } else if (smc->broken_host_serial_model && kvmppc_get_host_model(&buf)) {
1290         _FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
1291         g_free(buf);
1292     }
1293 
1294     if (spapr->host_serial) {
1295         _FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial));
1296     } else if (smc->broken_host_serial_model && kvmppc_get_host_serial(&buf)) {
1297         _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
1298         g_free(buf);
1299     }
1300 
1301     _FDT(fdt_setprop_cell(fdt, 0, "#address-cells", 2));
1302     _FDT(fdt_setprop_cell(fdt, 0, "#size-cells", 2));
1303 
1304     /* /interrupt controller */
1305     spapr->irq->dt_populate(spapr, spapr_max_server_number(spapr), fdt,
1306                           PHANDLE_INTC);
1307 
1308     ret = spapr_populate_memory(spapr, fdt);
1309     if (ret < 0) {
1310         error_report("couldn't setup memory nodes in fdt");
1311         exit(1);
1312     }
1313 
1314     /* /vdevice */
1315     spapr_dt_vdevice(spapr->vio_bus, fdt);
1316 
1317     if (object_resolve_path_type("", TYPE_SPAPR_RNG, NULL)) {
1318         ret = spapr_rng_populate_dt(fdt);
1319         if (ret < 0) {
1320             error_report("could not set up rng device in the fdt");
1321             exit(1);
1322         }
1323     }
1324 
1325     QLIST_FOREACH(phb, &spapr->phbs, list) {
1326         ret = spapr_dt_phb(phb, PHANDLE_INTC, fdt, spapr->irq->nr_msis, NULL);
1327         if (ret < 0) {
1328             error_report("couldn't setup PCI devices in fdt");
1329             exit(1);
1330         }
1331     }
1332 
1333     /* cpus */
1334     spapr_populate_cpus_dt_node(fdt, spapr);
1335 
1336     if (smc->dr_lmb_enabled) {
1337         _FDT(spapr_dt_drc(fdt, 0, NULL, SPAPR_DR_CONNECTOR_TYPE_LMB));
1338     }
1339 
1340     if (mc->has_hotpluggable_cpus) {
1341         int offset = fdt_path_offset(fdt, "/cpus");
1342         ret = spapr_dt_drc(fdt, offset, NULL, SPAPR_DR_CONNECTOR_TYPE_CPU);
1343         if (ret < 0) {
1344             error_report("Couldn't set up CPU DR device tree properties");
1345             exit(1);
1346         }
1347     }
1348 
1349     /* /event-sources */
1350     spapr_dt_events(spapr, fdt);
1351 
1352     /* /rtas */
1353     spapr_dt_rtas(spapr, fdt);
1354 
1355     /* /chosen */
1356     spapr_dt_chosen(spapr, fdt);
1357 
1358     /* /hypervisor */
1359     if (kvm_enabled()) {
1360         spapr_dt_hypervisor(spapr, fdt);
1361     }
1362 
1363     /* Build memory reserve map */
1364     if (spapr->kernel_size) {
1365         _FDT((fdt_add_mem_rsv(fdt, KERNEL_LOAD_ADDR, spapr->kernel_size)));
1366     }
1367     if (spapr->initrd_size) {
1368         _FDT((fdt_add_mem_rsv(fdt, spapr->initrd_base, spapr->initrd_size)));
1369     }
1370 
1371     /* ibm,client-architecture-support updates */
1372     ret = spapr_dt_cas_updates(spapr, fdt, spapr->ov5_cas);
1373     if (ret < 0) {
1374         error_report("couldn't setup CAS properties fdt");
1375         exit(1);
1376     }
1377 
1378     if (smc->dr_phb_enabled) {
1379         ret = spapr_dt_drc(fdt, 0, NULL, SPAPR_DR_CONNECTOR_TYPE_PHB);
1380         if (ret < 0) {
1381             error_report("Couldn't set up PHB DR device tree properties");
1382             exit(1);
1383         }
1384     }
1385 
1386     return fdt;
1387 }
1388 
1389 static uint64_t translate_kernel_address(void *opaque, uint64_t addr)
1390 {
1391     return (addr & 0x0fffffff) + KERNEL_LOAD_ADDR;
1392 }
1393 
1394 static void emulate_spapr_hypercall(PPCVirtualHypervisor *vhyp,
1395                                     PowerPCCPU *cpu)
1396 {
1397     CPUPPCState *env = &cpu->env;
1398 
1399     /* The TCG path should also be holding the BQL at this point */
1400     g_assert(qemu_mutex_iothread_locked());
1401 
1402     if (msr_pr) {
1403         hcall_dprintf("Hypercall made with MSR[PR]=1\n");
1404         env->gpr[3] = H_PRIVILEGE;
1405     } else {
1406         env->gpr[3] = spapr_hypercall(cpu, env->gpr[3], &env->gpr[4]);
1407     }
1408 }
1409 
1410 struct LPCRSyncState {
1411     target_ulong value;
1412     target_ulong mask;
1413 };
1414 
1415 static void do_lpcr_sync(CPUState *cs, run_on_cpu_data arg)
1416 {
1417     struct LPCRSyncState *s = arg.host_ptr;
1418     PowerPCCPU *cpu = POWERPC_CPU(cs);
1419     CPUPPCState *env = &cpu->env;
1420     target_ulong lpcr;
1421 
1422     cpu_synchronize_state(cs);
1423     lpcr = env->spr[SPR_LPCR];
1424     lpcr &= ~s->mask;
1425     lpcr |= s->value;
1426     ppc_store_lpcr(cpu, lpcr);
1427 }
1428 
1429 void spapr_set_all_lpcrs(target_ulong value, target_ulong mask)
1430 {
1431     CPUState *cs;
1432     struct LPCRSyncState s = {
1433         .value = value,
1434         .mask = mask
1435     };
1436     CPU_FOREACH(cs) {
1437         run_on_cpu(cs, do_lpcr_sync, RUN_ON_CPU_HOST_PTR(&s));
1438     }
1439 }
1440 
1441 static void spapr_get_pate(PPCVirtualHypervisor *vhyp, ppc_v3_pate_t *entry)
1442 {
1443     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1444 
1445     /* Copy PATE1:GR into PATE0:HR */
1446     entry->dw0 = spapr->patb_entry & PATE0_HR;
1447     entry->dw1 = spapr->patb_entry;
1448 }
1449 
1450 #define HPTE(_table, _i)   (void *)(((uint64_t *)(_table)) + ((_i) * 2))
1451 #define HPTE_VALID(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_VALID)
1452 #define HPTE_DIRTY(_hpte)  (tswap64(*((uint64_t *)(_hpte))) & HPTE64_V_HPTE_DIRTY)
1453 #define CLEAN_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) &= tswap64(~HPTE64_V_HPTE_DIRTY))
1454 #define DIRTY_HPTE(_hpte)  ((*(uint64_t *)(_hpte)) |= tswap64(HPTE64_V_HPTE_DIRTY))
1455 
1456 /*
1457  * Get the fd to access the kernel htab, re-opening it if necessary
1458  */
1459 static int get_htab_fd(SpaprMachineState *spapr)
1460 {
1461     Error *local_err = NULL;
1462 
1463     if (spapr->htab_fd >= 0) {
1464         return spapr->htab_fd;
1465     }
1466 
1467     spapr->htab_fd = kvmppc_get_htab_fd(false, 0, &local_err);
1468     if (spapr->htab_fd < 0) {
1469         error_report_err(local_err);
1470     }
1471 
1472     return spapr->htab_fd;
1473 }
1474 
1475 void close_htab_fd(SpaprMachineState *spapr)
1476 {
1477     if (spapr->htab_fd >= 0) {
1478         close(spapr->htab_fd);
1479     }
1480     spapr->htab_fd = -1;
1481 }
1482 
1483 static hwaddr spapr_hpt_mask(PPCVirtualHypervisor *vhyp)
1484 {
1485     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1486 
1487     return HTAB_SIZE(spapr) / HASH_PTEG_SIZE_64 - 1;
1488 }
1489 
1490 static target_ulong spapr_encode_hpt_for_kvm_pr(PPCVirtualHypervisor *vhyp)
1491 {
1492     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1493 
1494     assert(kvm_enabled());
1495 
1496     if (!spapr->htab) {
1497         return 0;
1498     }
1499 
1500     return (target_ulong)(uintptr_t)spapr->htab | (spapr->htab_shift - 18);
1501 }
1502 
1503 static const ppc_hash_pte64_t *spapr_map_hptes(PPCVirtualHypervisor *vhyp,
1504                                                 hwaddr ptex, int n)
1505 {
1506     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1507     hwaddr pte_offset = ptex * HASH_PTE_SIZE_64;
1508 
1509     if (!spapr->htab) {
1510         /*
1511          * HTAB is controlled by KVM. Fetch into temporary buffer
1512          */
1513         ppc_hash_pte64_t *hptes = g_malloc(n * HASH_PTE_SIZE_64);
1514         kvmppc_read_hptes(hptes, ptex, n);
1515         return hptes;
1516     }
1517 
1518     /*
1519      * HTAB is controlled by QEMU. Just point to the internally
1520      * accessible PTEG.
1521      */
1522     return (const ppc_hash_pte64_t *)(spapr->htab + pte_offset);
1523 }
1524 
1525 static void spapr_unmap_hptes(PPCVirtualHypervisor *vhyp,
1526                               const ppc_hash_pte64_t *hptes,
1527                               hwaddr ptex, int n)
1528 {
1529     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1530 
1531     if (!spapr->htab) {
1532         g_free((void *)hptes);
1533     }
1534 
1535     /* Nothing to do for qemu managed HPT */
1536 }
1537 
1538 void spapr_store_hpte(PowerPCCPU *cpu, hwaddr ptex,
1539                       uint64_t pte0, uint64_t pte1)
1540 {
1541     SpaprMachineState *spapr = SPAPR_MACHINE(cpu->vhyp);
1542     hwaddr offset = ptex * HASH_PTE_SIZE_64;
1543 
1544     if (!spapr->htab) {
1545         kvmppc_write_hpte(ptex, pte0, pte1);
1546     } else {
1547         if (pte0 & HPTE64_V_VALID) {
1548             stq_p(spapr->htab + offset + HASH_PTE_SIZE_64 / 2, pte1);
1549             /*
1550              * When setting valid, we write PTE1 first. This ensures
1551              * proper synchronization with the reading code in
1552              * ppc_hash64_pteg_search()
1553              */
1554             smp_wmb();
1555             stq_p(spapr->htab + offset, pte0);
1556         } else {
1557             stq_p(spapr->htab + offset, pte0);
1558             /*
1559              * When clearing it we set PTE0 first. This ensures proper
1560              * synchronization with the reading code in
1561              * ppc_hash64_pteg_search()
1562              */
1563             smp_wmb();
1564             stq_p(spapr->htab + offset + HASH_PTE_SIZE_64 / 2, pte1);
1565         }
1566     }
1567 }
1568 
1569 static void spapr_hpte_set_c(PPCVirtualHypervisor *vhyp, hwaddr ptex,
1570                              uint64_t pte1)
1571 {
1572     hwaddr offset = ptex * HASH_PTE_SIZE_64 + 15;
1573     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1574 
1575     if (!spapr->htab) {
1576         /* There should always be a hash table when this is called */
1577         error_report("spapr_hpte_set_c called with no hash table !");
1578         return;
1579     }
1580 
1581     /* The HW performs a non-atomic byte update */
1582     stb_p(spapr->htab + offset, (pte1 & 0xff) | 0x80);
1583 }
1584 
1585 static void spapr_hpte_set_r(PPCVirtualHypervisor *vhyp, hwaddr ptex,
1586                              uint64_t pte1)
1587 {
1588     hwaddr offset = ptex * HASH_PTE_SIZE_64 + 14;
1589     SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1590 
1591     if (!spapr->htab) {
1592         /* There should always be a hash table when this is called */
1593         error_report("spapr_hpte_set_r called with no hash table !");
1594         return;
1595     }
1596 
1597     /* The HW performs a non-atomic byte update */
1598     stb_p(spapr->htab + offset, ((pte1 >> 8) & 0xff) | 0x01);
1599 }
1600 
1601 int spapr_hpt_shift_for_ramsize(uint64_t ramsize)
1602 {
1603     int shift;
1604 
1605     /* We aim for a hash table of size 1/128 the size of RAM (rounded
1606      * up).  The PAPR recommendation is actually 1/64 of RAM size, but
1607      * that's much more than is needed for Linux guests */
1608     shift = ctz64(pow2ceil(ramsize)) - 7;
1609     shift = MAX(shift, 18); /* Minimum architected size */
1610     shift = MIN(shift, 46); /* Maximum architected size */
1611     return shift;
1612 }
1613 
1614 void spapr_free_hpt(SpaprMachineState *spapr)
1615 {
1616     g_free(spapr->htab);
1617     spapr->htab = NULL;
1618     spapr->htab_shift = 0;
1619     close_htab_fd(spapr);
1620 }
1621 
1622 void spapr_reallocate_hpt(SpaprMachineState *spapr, int shift,
1623                           Error **errp)
1624 {
1625     long rc;
1626 
1627     /* Clean up any HPT info from a previous boot */
1628     spapr_free_hpt(spapr);
1629 
1630     rc = kvmppc_reset_htab(shift);
1631     if (rc < 0) {
1632         /* kernel-side HPT needed, but couldn't allocate one */
1633         error_setg_errno(errp, errno,
1634                          "Failed to allocate KVM HPT of order %d (try smaller maxmem?)",
1635                          shift);
1636         /* This is almost certainly fatal, but if the caller really
1637          * wants to carry on with shift == 0, it's welcome to try */
1638     } else if (rc > 0) {
1639         /* kernel-side HPT allocated */
1640         if (rc != shift) {
1641             error_setg(errp,
1642                        "Requested order %d HPT, but kernel allocated order %ld (try smaller maxmem?)",
1643                        shift, rc);
1644         }
1645 
1646         spapr->htab_shift = shift;
1647         spapr->htab = NULL;
1648     } else {
1649         /* kernel-side HPT not needed, allocate in userspace instead */
1650         size_t size = 1ULL << shift;
1651         int i;
1652 
1653         spapr->htab = qemu_memalign(size, size);
1654         if (!spapr->htab) {
1655             error_setg_errno(errp, errno,
1656                              "Could not allocate HPT of order %d", shift);
1657             return;
1658         }
1659 
1660         memset(spapr->htab, 0, size);
1661         spapr->htab_shift = shift;
1662 
1663         for (i = 0; i < size / HASH_PTE_SIZE_64; i++) {
1664             DIRTY_HPTE(HPTE(spapr->htab, i));
1665         }
1666     }
1667     /* We're setting up a hash table, so that means we're not radix */
1668     spapr->patb_entry = 0;
1669     spapr_set_all_lpcrs(0, LPCR_HR | LPCR_UPRT);
1670 }
1671 
1672 void spapr_setup_hpt_and_vrma(SpaprMachineState *spapr)
1673 {
1674     int hpt_shift;
1675 
1676     if ((spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED)
1677         || (spapr->cas_reboot
1678             && !spapr_ovec_test(spapr->ov5_cas, OV5_HPT_RESIZE))) {
1679         hpt_shift = spapr_hpt_shift_for_ramsize(MACHINE(spapr)->maxram_size);
1680     } else {
1681         uint64_t current_ram_size;
1682 
1683         current_ram_size = MACHINE(spapr)->ram_size + get_plugged_memory_size();
1684         hpt_shift = spapr_hpt_shift_for_ramsize(current_ram_size);
1685     }
1686     spapr_reallocate_hpt(spapr, hpt_shift, &error_fatal);
1687 
1688     if (spapr->vrma_adjust) {
1689         spapr->rma_size = kvmppc_rma_size(spapr_node0_size(MACHINE(spapr)),
1690                                           spapr->htab_shift);
1691     }
1692 }
1693 
1694 static int spapr_reset_drcs(Object *child, void *opaque)
1695 {
1696     SpaprDrc *drc =
1697         (SpaprDrc *) object_dynamic_cast(child,
1698                                                  TYPE_SPAPR_DR_CONNECTOR);
1699 
1700     if (drc) {
1701         spapr_drc_reset(drc);
1702     }
1703 
1704     return 0;
1705 }
1706 
1707 static void spapr_machine_reset(MachineState *machine)
1708 {
1709     SpaprMachineState *spapr = SPAPR_MACHINE(machine);
1710     PowerPCCPU *first_ppc_cpu;
1711     uint32_t rtas_limit;
1712     hwaddr rtas_addr, fdt_addr;
1713     void *fdt;
1714     int rc;
1715 
1716     spapr_caps_apply(spapr);
1717 
1718     first_ppc_cpu = POWERPC_CPU(first_cpu);
1719     if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
1720         ppc_type_check_compat(machine->cpu_type, CPU_POWERPC_LOGICAL_3_00, 0,
1721                               spapr->max_compat_pvr)) {
1722         /*
1723          * If using KVM with radix mode available, VCPUs can be started
1724          * without a HPT because KVM will start them in radix mode.
1725          * Set the GR bit in PATE so that we know there is no HPT.
1726          */
1727         spapr->patb_entry = PATE1_GR;
1728         spapr_set_all_lpcrs(LPCR_HR | LPCR_UPRT, LPCR_HR | LPCR_UPRT);
1729     } else {
1730         spapr_setup_hpt_and_vrma(spapr);
1731     }
1732 
1733     /*
1734      * NVLink2-connected GPU RAM needs to be placed on a separate NUMA node.
1735      * We assign a new numa ID per GPU in spapr_pci_collect_nvgpu() which is
1736      * called from vPHB reset handler so we initialize the counter here.
1737      * If no NUMA is configured from the QEMU side, we start from 1 as GPU RAM
1738      * must be equally distant from any other node.
1739      * The final value of spapr->gpu_numa_id is going to be written to
1740      * max-associativity-domains in spapr_build_fdt().
1741      */
1742     spapr->gpu_numa_id = MAX(1, nb_numa_nodes);
1743     qemu_devices_reset();
1744 
1745     /*
1746      * If this reset wasn't generated by CAS, we should reset our
1747      * negotiated options and start from scratch
1748      */
1749     if (!spapr->cas_reboot) {
1750         spapr_ovec_cleanup(spapr->ov5_cas);
1751         spapr->ov5_cas = spapr_ovec_new();
1752 
1753         ppc_set_compat(first_ppc_cpu, spapr->max_compat_pvr, &error_fatal);
1754     }
1755 
1756     if (!SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
1757         spapr_irq_msi_reset(spapr);
1758     }
1759 
1760     /*
1761      * This is fixing some of the default configuration of the XIVE
1762      * devices. To be called after the reset of the machine devices.
1763      */
1764     spapr_irq_reset(spapr, &error_fatal);
1765 
1766     /*
1767      * There is no CAS under qtest. Simulate one to please the code that
1768      * depends on spapr->ov5_cas. This is especially needed to test device
1769      * unplug, so we do that before resetting the DRCs.
1770      */
1771     if (qtest_enabled()) {
1772         spapr_ovec_cleanup(spapr->ov5_cas);
1773         spapr->ov5_cas = spapr_ovec_clone(spapr->ov5);
1774     }
1775 
1776     /* DRC reset may cause a device to be unplugged. This will cause troubles
1777      * if this device is used by another device (eg, a running vhost backend
1778      * will crash QEMU if the DIMM holding the vring goes away). To avoid such
1779      * situations, we reset DRCs after all devices have been reset.
1780      */
1781     object_child_foreach_recursive(object_get_root(), spapr_reset_drcs, NULL);
1782 
1783     spapr_clear_pending_events(spapr);
1784 
1785     /*
1786      * We place the device tree and RTAS just below either the top of the RMA,
1787      * or just below 2GB, whichever is lower, so that it can be
1788      * processed with 32-bit real mode code if necessary
1789      */
1790     rtas_limit = MIN(spapr->rma_size, RTAS_MAX_ADDR);
1791     rtas_addr = rtas_limit - RTAS_MAX_SIZE;
1792     fdt_addr = rtas_addr - FDT_MAX_SIZE;
1793 
1794     fdt = spapr_build_fdt(spapr);
1795 
1796     spapr_load_rtas(spapr, fdt, rtas_addr);
1797 
1798     rc = fdt_pack(fdt);
1799 
1800     /* Should only fail if we've built a corrupted tree */
1801     assert(rc == 0);
1802 
1803     if (fdt_totalsize(fdt) > FDT_MAX_SIZE) {
1804         error_report("FDT too big ! 0x%x bytes (max is 0x%x)",
1805                      fdt_totalsize(fdt), FDT_MAX_SIZE);
1806         exit(1);
1807     }
1808 
1809     /* Load the fdt */
1810     qemu_fdt_dumpdtb(fdt, fdt_totalsize(fdt));
1811     cpu_physical_memory_write(fdt_addr, fdt, fdt_totalsize(fdt));
1812     g_free(spapr->fdt_blob);
1813     spapr->fdt_size = fdt_totalsize(fdt);
1814     spapr->fdt_initial_size = spapr->fdt_size;
1815     spapr->fdt_blob = fdt;
1816 
1817     /* Set up the entry state */
1818     spapr_cpu_set_entry_state(first_ppc_cpu, SPAPR_ENTRY_POINT, fdt_addr);
1819     first_ppc_cpu->env.gpr[5] = 0;
1820 
1821     spapr->cas_reboot = false;
1822 }
1823 
1824 static void spapr_create_nvram(SpaprMachineState *spapr)
1825 {
1826     DeviceState *dev = qdev_create(&spapr->vio_bus->bus, "spapr-nvram");
1827     DriveInfo *dinfo = drive_get(IF_PFLASH, 0, 0);
1828 
1829     if (dinfo) {
1830         qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo),
1831                             &error_fatal);
1832     }
1833 
1834     qdev_init_nofail(dev);
1835 
1836     spapr->nvram = (struct SpaprNvram *)dev;
1837 }
1838 
1839 static void spapr_rtc_create(SpaprMachineState *spapr)
1840 {
1841     object_initialize_child(OBJECT(spapr), "rtc",
1842                             &spapr->rtc, sizeof(spapr->rtc), TYPE_SPAPR_RTC,
1843                             &error_fatal, NULL);
1844     object_property_set_bool(OBJECT(&spapr->rtc), true, "realized",
1845                               &error_fatal);
1846     object_property_add_alias(OBJECT(spapr), "rtc-time", OBJECT(&spapr->rtc),
1847                               "date", &error_fatal);
1848 }
1849 
1850 /* Returns whether we want to use VGA or not */
1851 static bool spapr_vga_init(PCIBus *pci_bus, Error **errp)
1852 {
1853     switch (vga_interface_type) {
1854     case VGA_NONE:
1855         return false;
1856     case VGA_DEVICE:
1857         return true;
1858     case VGA_STD:
1859     case VGA_VIRTIO:
1860     case VGA_CIRRUS:
1861         return pci_vga_init(pci_bus) != NULL;
1862     default:
1863         error_setg(errp,
1864                    "Unsupported VGA mode, only -vga std or -vga virtio is supported");
1865         return false;
1866     }
1867 }
1868 
1869 static int spapr_pre_load(void *opaque)
1870 {
1871     int rc;
1872 
1873     rc = spapr_caps_pre_load(opaque);
1874     if (rc) {
1875         return rc;
1876     }
1877 
1878     return 0;
1879 }
1880 
1881 static int spapr_post_load(void *opaque, int version_id)
1882 {
1883     SpaprMachineState *spapr = (SpaprMachineState *)opaque;
1884     int err = 0;
1885 
1886     err = spapr_caps_post_migration(spapr);
1887     if (err) {
1888         return err;
1889     }
1890 
1891     /*
1892      * In earlier versions, there was no separate qdev for the PAPR
1893      * RTC, so the RTC offset was stored directly in sPAPREnvironment.
1894      * So when migrating from those versions, poke the incoming offset
1895      * value into the RTC device
1896      */
1897     if (version_id < 3) {
1898         err = spapr_rtc_import_offset(&spapr->rtc, spapr->rtc_offset);
1899         if (err) {
1900             return err;
1901         }
1902     }
1903 
1904     if (kvm_enabled() && spapr->patb_entry) {
1905         PowerPCCPU *cpu = POWERPC_CPU(first_cpu);
1906         bool radix = !!(spapr->patb_entry & PATE1_GR);
1907         bool gtse = !!(cpu->env.spr[SPR_LPCR] & LPCR_GTSE);
1908 
1909         /*
1910          * Update LPCR:HR and UPRT as they may not be set properly in
1911          * the stream
1912          */
1913         spapr_set_all_lpcrs(radix ? (LPCR_HR | LPCR_UPRT) : 0,
1914                             LPCR_HR | LPCR_UPRT);
1915 
1916         err = kvmppc_configure_v3_mmu(cpu, radix, gtse, spapr->patb_entry);
1917         if (err) {
1918             error_report("Process table config unsupported by the host");
1919             return -EINVAL;
1920         }
1921     }
1922 
1923     err = spapr_irq_post_load(spapr, version_id);
1924     if (err) {
1925         return err;
1926     }
1927 
1928     return err;
1929 }
1930 
1931 static int spapr_pre_save(void *opaque)
1932 {
1933     int rc;
1934 
1935     rc = spapr_caps_pre_save(opaque);
1936     if (rc) {
1937         return rc;
1938     }
1939 
1940     return 0;
1941 }
1942 
1943 static bool version_before_3(void *opaque, int version_id)
1944 {
1945     return version_id < 3;
1946 }
1947 
1948 static bool spapr_pending_events_needed(void *opaque)
1949 {
1950     SpaprMachineState *spapr = (SpaprMachineState *)opaque;
1951     return !QTAILQ_EMPTY(&spapr->pending_events);
1952 }
1953 
1954 static const VMStateDescription vmstate_spapr_event_entry = {
1955     .name = "spapr_event_log_entry",
1956     .version_id = 1,
1957     .minimum_version_id = 1,
1958     .fields = (VMStateField[]) {
1959         VMSTATE_UINT32(summary, SpaprEventLogEntry),
1960         VMSTATE_UINT32(extended_length, SpaprEventLogEntry),
1961         VMSTATE_VBUFFER_ALLOC_UINT32(extended_log, SpaprEventLogEntry, 0,
1962                                      NULL, extended_length),
1963         VMSTATE_END_OF_LIST()
1964     },
1965 };
1966 
1967 static const VMStateDescription vmstate_spapr_pending_events = {
1968     .name = "spapr_pending_events",
1969     .version_id = 1,
1970     .minimum_version_id = 1,
1971     .needed = spapr_pending_events_needed,
1972     .fields = (VMStateField[]) {
1973         VMSTATE_QTAILQ_V(pending_events, SpaprMachineState, 1,
1974                          vmstate_spapr_event_entry, SpaprEventLogEntry, next),
1975         VMSTATE_END_OF_LIST()
1976     },
1977 };
1978 
1979 static bool spapr_ov5_cas_needed(void *opaque)
1980 {
1981     SpaprMachineState *spapr = opaque;
1982     SpaprOptionVector *ov5_mask = spapr_ovec_new();
1983     SpaprOptionVector *ov5_legacy = spapr_ovec_new();
1984     SpaprOptionVector *ov5_removed = spapr_ovec_new();
1985     bool cas_needed;
1986 
1987     /* Prior to the introduction of SpaprOptionVector, we had two option
1988      * vectors we dealt with: OV5_FORM1_AFFINITY, and OV5_DRCONF_MEMORY.
1989      * Both of these options encode machine topology into the device-tree
1990      * in such a way that the now-booted OS should still be able to interact
1991      * appropriately with QEMU regardless of what options were actually
1992      * negotiatied on the source side.
1993      *
1994      * As such, we can avoid migrating the CAS-negotiated options if these
1995      * are the only options available on the current machine/platform.
1996      * Since these are the only options available for pseries-2.7 and
1997      * earlier, this allows us to maintain old->new/new->old migration
1998      * compatibility.
1999      *
2000      * For QEMU 2.8+, there are additional CAS-negotiatable options available
2001      * via default pseries-2.8 machines and explicit command-line parameters.
2002      * Some of these options, like OV5_HP_EVT, *do* require QEMU to be aware
2003      * of the actual CAS-negotiated values to continue working properly. For
2004      * example, availability of memory unplug depends on knowing whether
2005      * OV5_HP_EVT was negotiated via CAS.
2006      *
2007      * Thus, for any cases where the set of available CAS-negotiatable
2008      * options extends beyond OV5_FORM1_AFFINITY and OV5_DRCONF_MEMORY, we
2009      * include the CAS-negotiated options in the migration stream, unless
2010      * if they affect boot time behaviour only.
2011      */
2012     spapr_ovec_set(ov5_mask, OV5_FORM1_AFFINITY);
2013     spapr_ovec_set(ov5_mask, OV5_DRCONF_MEMORY);
2014     spapr_ovec_set(ov5_mask, OV5_DRMEM_V2);
2015 
2016     /* spapr_ovec_diff returns true if bits were removed. we avoid using
2017      * the mask itself since in the future it's possible "legacy" bits may be
2018      * removed via machine options, which could generate a false positive
2019      * that breaks migration.
2020      */
2021     spapr_ovec_intersect(ov5_legacy, spapr->ov5, ov5_mask);
2022     cas_needed = spapr_ovec_diff(ov5_removed, spapr->ov5, ov5_legacy);
2023 
2024     spapr_ovec_cleanup(ov5_mask);
2025     spapr_ovec_cleanup(ov5_legacy);
2026     spapr_ovec_cleanup(ov5_removed);
2027 
2028     return cas_needed;
2029 }
2030 
2031 static const VMStateDescription vmstate_spapr_ov5_cas = {
2032     .name = "spapr_option_vector_ov5_cas",
2033     .version_id = 1,
2034     .minimum_version_id = 1,
2035     .needed = spapr_ov5_cas_needed,
2036     .fields = (VMStateField[]) {
2037         VMSTATE_STRUCT_POINTER_V(ov5_cas, SpaprMachineState, 1,
2038                                  vmstate_spapr_ovec, SpaprOptionVector),
2039         VMSTATE_END_OF_LIST()
2040     },
2041 };
2042 
2043 static bool spapr_patb_entry_needed(void *opaque)
2044 {
2045     SpaprMachineState *spapr = opaque;
2046 
2047     return !!spapr->patb_entry;
2048 }
2049 
2050 static const VMStateDescription vmstate_spapr_patb_entry = {
2051     .name = "spapr_patb_entry",
2052     .version_id = 1,
2053     .minimum_version_id = 1,
2054     .needed = spapr_patb_entry_needed,
2055     .fields = (VMStateField[]) {
2056         VMSTATE_UINT64(patb_entry, SpaprMachineState),
2057         VMSTATE_END_OF_LIST()
2058     },
2059 };
2060 
2061 static bool spapr_irq_map_needed(void *opaque)
2062 {
2063     SpaprMachineState *spapr = opaque;
2064 
2065     return spapr->irq_map && !bitmap_empty(spapr->irq_map, spapr->irq_map_nr);
2066 }
2067 
2068 static const VMStateDescription vmstate_spapr_irq_map = {
2069     .name = "spapr_irq_map",
2070     .version_id = 1,
2071     .minimum_version_id = 1,
2072     .needed = spapr_irq_map_needed,
2073     .fields = (VMStateField[]) {
2074         VMSTATE_BITMAP(irq_map, SpaprMachineState, 0, irq_map_nr),
2075         VMSTATE_END_OF_LIST()
2076     },
2077 };
2078 
2079 static bool spapr_dtb_needed(void *opaque)
2080 {
2081     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(opaque);
2082 
2083     return smc->update_dt_enabled;
2084 }
2085 
2086 static int spapr_dtb_pre_load(void *opaque)
2087 {
2088     SpaprMachineState *spapr = (SpaprMachineState *)opaque;
2089 
2090     g_free(spapr->fdt_blob);
2091     spapr->fdt_blob = NULL;
2092     spapr->fdt_size = 0;
2093 
2094     return 0;
2095 }
2096 
2097 static const VMStateDescription vmstate_spapr_dtb = {
2098     .name = "spapr_dtb",
2099     .version_id = 1,
2100     .minimum_version_id = 1,
2101     .needed = spapr_dtb_needed,
2102     .pre_load = spapr_dtb_pre_load,
2103     .fields = (VMStateField[]) {
2104         VMSTATE_UINT32(fdt_initial_size, SpaprMachineState),
2105         VMSTATE_UINT32(fdt_size, SpaprMachineState),
2106         VMSTATE_VBUFFER_ALLOC_UINT32(fdt_blob, SpaprMachineState, 0, NULL,
2107                                      fdt_size),
2108         VMSTATE_END_OF_LIST()
2109     },
2110 };
2111 
2112 static const VMStateDescription vmstate_spapr = {
2113     .name = "spapr",
2114     .version_id = 3,
2115     .minimum_version_id = 1,
2116     .pre_load = spapr_pre_load,
2117     .post_load = spapr_post_load,
2118     .pre_save = spapr_pre_save,
2119     .fields = (VMStateField[]) {
2120         /* used to be @next_irq */
2121         VMSTATE_UNUSED_BUFFER(version_before_3, 0, 4),
2122 
2123         /* RTC offset */
2124         VMSTATE_UINT64_TEST(rtc_offset, SpaprMachineState, version_before_3),
2125 
2126         VMSTATE_PPC_TIMEBASE_V(tb, SpaprMachineState, 2),
2127         VMSTATE_END_OF_LIST()
2128     },
2129     .subsections = (const VMStateDescription*[]) {
2130         &vmstate_spapr_ov5_cas,
2131         &vmstate_spapr_patb_entry,
2132         &vmstate_spapr_pending_events,
2133         &vmstate_spapr_cap_htm,
2134         &vmstate_spapr_cap_vsx,
2135         &vmstate_spapr_cap_dfp,
2136         &vmstate_spapr_cap_cfpc,
2137         &vmstate_spapr_cap_sbbc,
2138         &vmstate_spapr_cap_ibs,
2139         &vmstate_spapr_cap_hpt_maxpagesize,
2140         &vmstate_spapr_irq_map,
2141         &vmstate_spapr_cap_nested_kvm_hv,
2142         &vmstate_spapr_dtb,
2143         &vmstate_spapr_cap_large_decr,
2144         &vmstate_spapr_cap_ccf_assist,
2145         NULL
2146     }
2147 };
2148 
2149 static int htab_save_setup(QEMUFile *f, void *opaque)
2150 {
2151     SpaprMachineState *spapr = opaque;
2152 
2153     /* "Iteration" header */
2154     if (!spapr->htab_shift) {
2155         qemu_put_be32(f, -1);
2156     } else {
2157         qemu_put_be32(f, spapr->htab_shift);
2158     }
2159 
2160     if (spapr->htab) {
2161         spapr->htab_save_index = 0;
2162         spapr->htab_first_pass = true;
2163     } else {
2164         if (spapr->htab_shift) {
2165             assert(kvm_enabled());
2166         }
2167     }
2168 
2169 
2170     return 0;
2171 }
2172 
2173 static void htab_save_chunk(QEMUFile *f, SpaprMachineState *spapr,
2174                             int chunkstart, int n_valid, int n_invalid)
2175 {
2176     qemu_put_be32(f, chunkstart);
2177     qemu_put_be16(f, n_valid);
2178     qemu_put_be16(f, n_invalid);
2179     qemu_put_buffer(f, HPTE(spapr->htab, chunkstart),
2180                     HASH_PTE_SIZE_64 * n_valid);
2181 }
2182 
2183 static void htab_save_end_marker(QEMUFile *f)
2184 {
2185     qemu_put_be32(f, 0);
2186     qemu_put_be16(f, 0);
2187     qemu_put_be16(f, 0);
2188 }
2189 
2190 static void htab_save_first_pass(QEMUFile *f, SpaprMachineState *spapr,
2191                                  int64_t max_ns)
2192 {
2193     bool has_timeout = max_ns != -1;
2194     int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
2195     int index = spapr->htab_save_index;
2196     int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
2197 
2198     assert(spapr->htab_first_pass);
2199 
2200     do {
2201         int chunkstart;
2202 
2203         /* Consume invalid HPTEs */
2204         while ((index < htabslots)
2205                && !HPTE_VALID(HPTE(spapr->htab, index))) {
2206             CLEAN_HPTE(HPTE(spapr->htab, index));
2207             index++;
2208         }
2209 
2210         /* Consume valid HPTEs */
2211         chunkstart = index;
2212         while ((index < htabslots) && (index - chunkstart < USHRT_MAX)
2213                && HPTE_VALID(HPTE(spapr->htab, index))) {
2214             CLEAN_HPTE(HPTE(spapr->htab, index));
2215             index++;
2216         }
2217 
2218         if (index > chunkstart) {
2219             int n_valid = index - chunkstart;
2220 
2221             htab_save_chunk(f, spapr, chunkstart, n_valid, 0);
2222 
2223             if (has_timeout &&
2224                 (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - starttime) > max_ns) {
2225                 break;
2226             }
2227         }
2228     } while ((index < htabslots) && !qemu_file_rate_limit(f));
2229 
2230     if (index >= htabslots) {
2231         assert(index == htabslots);
2232         index = 0;
2233         spapr->htab_first_pass = false;
2234     }
2235     spapr->htab_save_index = index;
2236 }
2237 
2238 static int htab_save_later_pass(QEMUFile *f, SpaprMachineState *spapr,
2239                                 int64_t max_ns)
2240 {
2241     bool final = max_ns < 0;
2242     int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
2243     int examined = 0, sent = 0;
2244     int index = spapr->htab_save_index;
2245     int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
2246 
2247     assert(!spapr->htab_first_pass);
2248 
2249     do {
2250         int chunkstart, invalidstart;
2251 
2252         /* Consume non-dirty HPTEs */
2253         while ((index < htabslots)
2254                && !HPTE_DIRTY(HPTE(spapr->htab, index))) {
2255             index++;
2256             examined++;
2257         }
2258 
2259         chunkstart = index;
2260         /* Consume valid dirty HPTEs */
2261         while ((index < htabslots) && (index - chunkstart < USHRT_MAX)
2262                && HPTE_DIRTY(HPTE(spapr->htab, index))
2263                && HPTE_VALID(HPTE(spapr->htab, index))) {
2264             CLEAN_HPTE(HPTE(spapr->htab, index));
2265             index++;
2266             examined++;
2267         }
2268 
2269         invalidstart = index;
2270         /* Consume invalid dirty HPTEs */
2271         while ((index < htabslots) && (index - invalidstart < USHRT_MAX)
2272                && HPTE_DIRTY(HPTE(spapr->htab, index))
2273                && !HPTE_VALID(HPTE(spapr->htab, index))) {
2274             CLEAN_HPTE(HPTE(spapr->htab, index));
2275             index++;
2276             examined++;
2277         }
2278 
2279         if (index > chunkstart) {
2280             int n_valid = invalidstart - chunkstart;
2281             int n_invalid = index - invalidstart;
2282 
2283             htab_save_chunk(f, spapr, chunkstart, n_valid, n_invalid);
2284             sent += index - chunkstart;
2285 
2286             if (!final && (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - starttime) > max_ns) {
2287                 break;
2288             }
2289         }
2290 
2291         if (examined >= htabslots) {
2292             break;
2293         }
2294 
2295         if (index >= htabslots) {
2296             assert(index == htabslots);
2297             index = 0;
2298         }
2299     } while ((examined < htabslots) && (!qemu_file_rate_limit(f) || final));
2300 
2301     if (index >= htabslots) {
2302         assert(index == htabslots);
2303         index = 0;
2304     }
2305 
2306     spapr->htab_save_index = index;
2307 
2308     return (examined >= htabslots) && (sent == 0) ? 1 : 0;
2309 }
2310 
2311 #define MAX_ITERATION_NS    5000000 /* 5 ms */
2312 #define MAX_KVM_BUF_SIZE    2048
2313 
2314 static int htab_save_iterate(QEMUFile *f, void *opaque)
2315 {
2316     SpaprMachineState *spapr = opaque;
2317     int fd;
2318     int rc = 0;
2319 
2320     /* Iteration header */
2321     if (!spapr->htab_shift) {
2322         qemu_put_be32(f, -1);
2323         return 1;
2324     } else {
2325         qemu_put_be32(f, 0);
2326     }
2327 
2328     if (!spapr->htab) {
2329         assert(kvm_enabled());
2330 
2331         fd = get_htab_fd(spapr);
2332         if (fd < 0) {
2333             return fd;
2334         }
2335 
2336         rc = kvmppc_save_htab(f, fd, MAX_KVM_BUF_SIZE, MAX_ITERATION_NS);
2337         if (rc < 0) {
2338             return rc;
2339         }
2340     } else  if (spapr->htab_first_pass) {
2341         htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
2342     } else {
2343         rc = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
2344     }
2345 
2346     htab_save_end_marker(f);
2347 
2348     return rc;
2349 }
2350 
2351 static int htab_save_complete(QEMUFile *f, void *opaque)
2352 {
2353     SpaprMachineState *spapr = opaque;
2354     int fd;
2355 
2356     /* Iteration header */
2357     if (!spapr->htab_shift) {
2358         qemu_put_be32(f, -1);
2359         return 0;
2360     } else {
2361         qemu_put_be32(f, 0);
2362     }
2363 
2364     if (!spapr->htab) {
2365         int rc;
2366 
2367         assert(kvm_enabled());
2368 
2369         fd = get_htab_fd(spapr);
2370         if (fd < 0) {
2371             return fd;
2372         }
2373 
2374         rc = kvmppc_save_htab(f, fd, MAX_KVM_BUF_SIZE, -1);
2375         if (rc < 0) {
2376             return rc;
2377         }
2378     } else {
2379         if (spapr->htab_first_pass) {
2380             htab_save_first_pass(f, spapr, -1);
2381         }
2382         htab_save_later_pass(f, spapr, -1);
2383     }
2384 
2385     /* End marker */
2386     htab_save_end_marker(f);
2387 
2388     return 0;
2389 }
2390 
2391 static int htab_load(QEMUFile *f, void *opaque, int version_id)
2392 {
2393     SpaprMachineState *spapr = opaque;
2394     uint32_t section_hdr;
2395     int fd = -1;
2396     Error *local_err = NULL;
2397 
2398     if (version_id < 1 || version_id > 1) {
2399         error_report("htab_load() bad version");
2400         return -EINVAL;
2401     }
2402 
2403     section_hdr = qemu_get_be32(f);
2404 
2405     if (section_hdr == -1) {
2406         spapr_free_hpt(spapr);
2407         return 0;
2408     }
2409 
2410     if (section_hdr) {
2411         /* First section gives the htab size */
2412         spapr_reallocate_hpt(spapr, section_hdr, &local_err);
2413         if (local_err) {
2414             error_report_err(local_err);
2415             return -EINVAL;
2416         }
2417         return 0;
2418     }
2419 
2420     if (!spapr->htab) {
2421         assert(kvm_enabled());
2422 
2423         fd = kvmppc_get_htab_fd(true, 0, &local_err);
2424         if (fd < 0) {
2425             error_report_err(local_err);
2426             return fd;
2427         }
2428     }
2429 
2430     while (true) {
2431         uint32_t index;
2432         uint16_t n_valid, n_invalid;
2433 
2434         index = qemu_get_be32(f);
2435         n_valid = qemu_get_be16(f);
2436         n_invalid = qemu_get_be16(f);
2437 
2438         if ((index == 0) && (n_valid == 0) && (n_invalid == 0)) {
2439             /* End of Stream */
2440             break;
2441         }
2442 
2443         if ((index + n_valid + n_invalid) >
2444             (HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
2445             /* Bad index in stream */
2446             error_report(
2447                 "htab_load() bad index %d (%hd+%hd entries) in htab stream (htab_shift=%d)",
2448                 index, n_valid, n_invalid, spapr->htab_shift);
2449             return -EINVAL;
2450         }
2451 
2452         if (spapr->htab) {
2453             if (n_valid) {
2454                 qemu_get_buffer(f, HPTE(spapr->htab, index),
2455                                 HASH_PTE_SIZE_64 * n_valid);
2456             }
2457             if (n_invalid) {
2458                 memset(HPTE(spapr->htab, index + n_valid), 0,
2459                        HASH_PTE_SIZE_64 * n_invalid);
2460             }
2461         } else {
2462             int rc;
2463 
2464             assert(fd >= 0);
2465 
2466             rc = kvmppc_load_htab_chunk(f, fd, index, n_valid, n_invalid);
2467             if (rc < 0) {
2468                 return rc;
2469             }
2470         }
2471     }
2472 
2473     if (!spapr->htab) {
2474         assert(fd >= 0);
2475         close(fd);
2476     }
2477 
2478     return 0;
2479 }
2480 
2481 static void htab_save_cleanup(void *opaque)
2482 {
2483     SpaprMachineState *spapr = opaque;
2484 
2485     close_htab_fd(spapr);
2486 }
2487 
2488 static SaveVMHandlers savevm_htab_handlers = {
2489     .save_setup = htab_save_setup,
2490     .save_live_iterate = htab_save_iterate,
2491     .save_live_complete_precopy = htab_save_complete,
2492     .save_cleanup = htab_save_cleanup,
2493     .load_state = htab_load,
2494 };
2495 
2496 static void spapr_boot_set(void *opaque, const char *boot_device,
2497                            Error **errp)
2498 {
2499     MachineState *machine = MACHINE(opaque);
2500     machine->boot_order = g_strdup(boot_device);
2501 }
2502 
2503 static void spapr_create_lmb_dr_connectors(SpaprMachineState *spapr)
2504 {
2505     MachineState *machine = MACHINE(spapr);
2506     uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
2507     uint32_t nr_lmbs = (machine->maxram_size - machine->ram_size)/lmb_size;
2508     int i;
2509 
2510     for (i = 0; i < nr_lmbs; i++) {
2511         uint64_t addr;
2512 
2513         addr = i * lmb_size + machine->device_memory->base;
2514         spapr_dr_connector_new(OBJECT(spapr), TYPE_SPAPR_DRC_LMB,
2515                                addr / lmb_size);
2516     }
2517 }
2518 
2519 /*
2520  * If RAM size, maxmem size and individual node mem sizes aren't aligned
2521  * to SPAPR_MEMORY_BLOCK_SIZE(256MB), then refuse to start the guest
2522  * since we can't support such unaligned sizes with DRCONF_MEMORY.
2523  */
2524 static void spapr_validate_node_memory(MachineState *machine, Error **errp)
2525 {
2526     int i;
2527 
2528     if (machine->ram_size % SPAPR_MEMORY_BLOCK_SIZE) {
2529         error_setg(errp, "Memory size 0x" RAM_ADDR_FMT
2530                    " is not aligned to %" PRIu64 " MiB",
2531                    machine->ram_size,
2532                    SPAPR_MEMORY_BLOCK_SIZE / MiB);
2533         return;
2534     }
2535 
2536     if (machine->maxram_size % SPAPR_MEMORY_BLOCK_SIZE) {
2537         error_setg(errp, "Maximum memory size 0x" RAM_ADDR_FMT
2538                    " is not aligned to %" PRIu64 " MiB",
2539                    machine->ram_size,
2540                    SPAPR_MEMORY_BLOCK_SIZE / MiB);
2541         return;
2542     }
2543 
2544     for (i = 0; i < nb_numa_nodes; i++) {
2545         if (numa_info[i].node_mem % SPAPR_MEMORY_BLOCK_SIZE) {
2546             error_setg(errp,
2547                        "Node %d memory size 0x%" PRIx64
2548                        " is not aligned to %" PRIu64 " MiB",
2549                        i, numa_info[i].node_mem,
2550                        SPAPR_MEMORY_BLOCK_SIZE / MiB);
2551             return;
2552         }
2553     }
2554 }
2555 
2556 /* find cpu slot in machine->possible_cpus by core_id */
2557 static CPUArchId *spapr_find_cpu_slot(MachineState *ms, uint32_t id, int *idx)
2558 {
2559     int index = id / ms->smp.threads;
2560 
2561     if (index >= ms->possible_cpus->len) {
2562         return NULL;
2563     }
2564     if (idx) {
2565         *idx = index;
2566     }
2567     return &ms->possible_cpus->cpus[index];
2568 }
2569 
2570 static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
2571 {
2572     MachineState *ms = MACHINE(spapr);
2573     Error *local_err = NULL;
2574     bool vsmt_user = !!spapr->vsmt;
2575     int kvm_smt = kvmppc_smt_threads();
2576     int ret;
2577     unsigned int smp_threads = ms->smp.threads;
2578 
2579     if (!kvm_enabled() && (smp_threads > 1)) {
2580         error_setg(&local_err, "TCG cannot support more than 1 thread/core "
2581                      "on a pseries machine");
2582         goto out;
2583     }
2584     if (!is_power_of_2(smp_threads)) {
2585         error_setg(&local_err, "Cannot support %d threads/core on a pseries "
2586                      "machine because it must be a power of 2", smp_threads);
2587         goto out;
2588     }
2589 
2590     /* Detemine the VSMT mode to use: */
2591     if (vsmt_user) {
2592         if (spapr->vsmt < smp_threads) {
2593             error_setg(&local_err, "Cannot support VSMT mode %d"
2594                          " because it must be >= threads/core (%d)",
2595                          spapr->vsmt, smp_threads);
2596             goto out;
2597         }
2598         /* In this case, spapr->vsmt has been set by the command line */
2599     } else {
2600         /*
2601          * Default VSMT value is tricky, because we need it to be as
2602          * consistent as possible (for migration), but this requires
2603          * changing it for at least some existing cases.  We pick 8 as
2604          * the value that we'd get with KVM on POWER8, the
2605          * overwhelmingly common case in production systems.
2606          */
2607         spapr->vsmt = MAX(8, smp_threads);
2608     }
2609 
2610     /* KVM: If necessary, set the SMT mode: */
2611     if (kvm_enabled() && (spapr->vsmt != kvm_smt)) {
2612         ret = kvmppc_set_smt_threads(spapr->vsmt);
2613         if (ret) {
2614             /* Looks like KVM isn't able to change VSMT mode */
2615             error_setg(&local_err,
2616                        "Failed to set KVM's VSMT mode to %d (errno %d)",
2617                        spapr->vsmt, ret);
2618             /* We can live with that if the default one is big enough
2619              * for the number of threads, and a submultiple of the one
2620              * we want.  In this case we'll waste some vcpu ids, but
2621              * behaviour will be correct */
2622             if ((kvm_smt >= smp_threads) && ((spapr->vsmt % kvm_smt) == 0)) {
2623                 warn_report_err(local_err);
2624                 local_err = NULL;
2625                 goto out;
2626             } else {
2627                 if (!vsmt_user) {
2628                     error_append_hint(&local_err,
2629                                       "On PPC, a VM with %d threads/core"
2630                                       " on a host with %d threads/core"
2631                                       " requires the use of VSMT mode %d.\n",
2632                                       smp_threads, kvm_smt, spapr->vsmt);
2633                 }
2634                 kvmppc_hint_smt_possible(&local_err);
2635                 goto out;
2636             }
2637         }
2638     }
2639     /* else TCG: nothing to do currently */
2640 out:
2641     error_propagate(errp, local_err);
2642 }
2643 
2644 static void spapr_init_cpus(SpaprMachineState *spapr)
2645 {
2646     MachineState *machine = MACHINE(spapr);
2647     MachineClass *mc = MACHINE_GET_CLASS(machine);
2648     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(machine);
2649     const char *type = spapr_get_cpu_core_type(machine->cpu_type);
2650     const CPUArchIdList *possible_cpus;
2651     unsigned int smp_cpus = machine->smp.cpus;
2652     unsigned int smp_threads = machine->smp.threads;
2653     unsigned int max_cpus = machine->smp.max_cpus;
2654     int boot_cores_nr = smp_cpus / smp_threads;
2655     int i;
2656 
2657     possible_cpus = mc->possible_cpu_arch_ids(machine);
2658     if (mc->has_hotpluggable_cpus) {
2659         if (smp_cpus % smp_threads) {
2660             error_report("smp_cpus (%u) must be multiple of threads (%u)",
2661                          smp_cpus, smp_threads);
2662             exit(1);
2663         }
2664         if (max_cpus % smp_threads) {
2665             error_report("max_cpus (%u) must be multiple of threads (%u)",
2666                          max_cpus, smp_threads);
2667             exit(1);
2668         }
2669     } else {
2670         if (max_cpus != smp_cpus) {
2671             error_report("This machine version does not support CPU hotplug");
2672             exit(1);
2673         }
2674         boot_cores_nr = possible_cpus->len;
2675     }
2676 
2677     if (smc->pre_2_10_has_unused_icps) {
2678         int i;
2679 
2680         for (i = 0; i < spapr_max_server_number(spapr); i++) {
2681             /* Dummy entries get deregistered when real ICPState objects
2682              * are registered during CPU core hotplug.
2683              */
2684             pre_2_10_vmstate_register_dummy_icp(i);
2685         }
2686     }
2687 
2688     for (i = 0; i < possible_cpus->len; i++) {
2689         int core_id = i * smp_threads;
2690 
2691         if (mc->has_hotpluggable_cpus) {
2692             spapr_dr_connector_new(OBJECT(spapr), TYPE_SPAPR_DRC_CPU,
2693                                    spapr_vcpu_id(spapr, core_id));
2694         }
2695 
2696         if (i < boot_cores_nr) {
2697             Object *core  = object_new(type);
2698             int nr_threads = smp_threads;
2699 
2700             /* Handle the partially filled core for older machine types */
2701             if ((i + 1) * smp_threads >= smp_cpus) {
2702                 nr_threads = smp_cpus - i * smp_threads;
2703             }
2704 
2705             object_property_set_int(core, nr_threads, "nr-threads",
2706                                     &error_fatal);
2707             object_property_set_int(core, core_id, CPU_CORE_PROP_CORE_ID,
2708                                     &error_fatal);
2709             object_property_set_bool(core, true, "realized", &error_fatal);
2710 
2711             object_unref(core);
2712         }
2713     }
2714 }
2715 
2716 static PCIHostState *spapr_create_default_phb(void)
2717 {
2718     DeviceState *dev;
2719 
2720     dev = qdev_create(NULL, TYPE_SPAPR_PCI_HOST_BRIDGE);
2721     qdev_prop_set_uint32(dev, "index", 0);
2722     qdev_init_nofail(dev);
2723 
2724     return PCI_HOST_BRIDGE(dev);
2725 }
2726 
2727 /* pSeries LPAR / sPAPR hardware init */
2728 static void spapr_machine_init(MachineState *machine)
2729 {
2730     SpaprMachineState *spapr = SPAPR_MACHINE(machine);
2731     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(machine);
2732     const char *kernel_filename = machine->kernel_filename;
2733     const char *initrd_filename = machine->initrd_filename;
2734     PCIHostState *phb;
2735     int i;
2736     MemoryRegion *sysmem = get_system_memory();
2737     MemoryRegion *ram = g_new(MemoryRegion, 1);
2738     hwaddr node0_size = spapr_node0_size(machine);
2739     long load_limit, fw_size;
2740     char *filename;
2741     Error *resize_hpt_err = NULL;
2742 
2743     msi_nonbroken = true;
2744 
2745     QLIST_INIT(&spapr->phbs);
2746     QTAILQ_INIT(&spapr->pending_dimm_unplugs);
2747 
2748     /* Determine capabilities to run with */
2749     spapr_caps_init(spapr);
2750 
2751     kvmppc_check_papr_resize_hpt(&resize_hpt_err);
2752     if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DEFAULT) {
2753         /*
2754          * If the user explicitly requested a mode we should either
2755          * supply it, or fail completely (which we do below).  But if
2756          * it's not set explicitly, we reset our mode to something
2757          * that works
2758          */
2759         if (resize_hpt_err) {
2760             spapr->resize_hpt = SPAPR_RESIZE_HPT_DISABLED;
2761             error_free(resize_hpt_err);
2762             resize_hpt_err = NULL;
2763         } else {
2764             spapr->resize_hpt = smc->resize_hpt_default;
2765         }
2766     }
2767 
2768     assert(spapr->resize_hpt != SPAPR_RESIZE_HPT_DEFAULT);
2769 
2770     if ((spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) && resize_hpt_err) {
2771         /*
2772          * User requested HPT resize, but this host can't supply it.  Bail out
2773          */
2774         error_report_err(resize_hpt_err);
2775         exit(1);
2776     }
2777 
2778     spapr->rma_size = node0_size;
2779 
2780     /* With KVM, we don't actually know whether KVM supports an
2781      * unbounded RMA (PR KVM) or is limited by the hash table size
2782      * (HV KVM using VRMA), so we always assume the latter
2783      *
2784      * In that case, we also limit the initial allocations for RTAS
2785      * etc... to 256M since we have no way to know what the VRMA size
2786      * is going to be as it depends on the size of the hash table
2787      * which isn't determined yet.
2788      */
2789     if (kvm_enabled()) {
2790         spapr->vrma_adjust = 1;
2791         spapr->rma_size = MIN(spapr->rma_size, 0x10000000);
2792     }
2793 
2794     /* Actually we don't support unbounded RMA anymore since we added
2795      * proper emulation of HV mode. The max we can get is 16G which
2796      * also happens to be what we configure for PAPR mode so make sure
2797      * we don't do anything bigger than that
2798      */
2799     spapr->rma_size = MIN(spapr->rma_size, 0x400000000ull);
2800 
2801     if (spapr->rma_size > node0_size) {
2802         error_report("Numa node 0 has to span the RMA (%#08"HWADDR_PRIx")",
2803                      spapr->rma_size);
2804         exit(1);
2805     }
2806 
2807     /* Setup a load limit for the ramdisk leaving room for SLOF and FDT */
2808     load_limit = MIN(spapr->rma_size, RTAS_MAX_ADDR) - FW_OVERHEAD;
2809 
2810     /*
2811      * VSMT must be set in order to be able to compute VCPU ids, ie to
2812      * call spapr_max_server_number() or spapr_vcpu_id().
2813      */
2814     spapr_set_vsmt_mode(spapr, &error_fatal);
2815 
2816     /* Set up Interrupt Controller before we create the VCPUs */
2817     spapr_irq_init(spapr, &error_fatal);
2818 
2819     /* Set up containers for ibm,client-architecture-support negotiated options
2820      */
2821     spapr->ov5 = spapr_ovec_new();
2822     spapr->ov5_cas = spapr_ovec_new();
2823 
2824     if (smc->dr_lmb_enabled) {
2825         spapr_ovec_set(spapr->ov5, OV5_DRCONF_MEMORY);
2826         spapr_validate_node_memory(machine, &error_fatal);
2827     }
2828 
2829     spapr_ovec_set(spapr->ov5, OV5_FORM1_AFFINITY);
2830 
2831     /* advertise support for dedicated HP event source to guests */
2832     if (spapr->use_hotplug_event_source) {
2833         spapr_ovec_set(spapr->ov5, OV5_HP_EVT);
2834     }
2835 
2836     /* advertise support for HPT resizing */
2837     if (spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) {
2838         spapr_ovec_set(spapr->ov5, OV5_HPT_RESIZE);
2839     }
2840 
2841     /* advertise support for ibm,dyamic-memory-v2 */
2842     spapr_ovec_set(spapr->ov5, OV5_DRMEM_V2);
2843 
2844     /* advertise XIVE on POWER9 machines */
2845     if (spapr->irq->ov5 & (SPAPR_OV5_XIVE_EXPLOIT | SPAPR_OV5_XIVE_BOTH)) {
2846         spapr_ovec_set(spapr->ov5, OV5_XIVE_EXPLOIT);
2847     }
2848 
2849     /* init CPUs */
2850     spapr_init_cpus(spapr);
2851 
2852     if ((!kvm_enabled() || kvmppc_has_cap_mmu_radix()) &&
2853         ppc_type_check_compat(machine->cpu_type, CPU_POWERPC_LOGICAL_3_00, 0,
2854                               spapr->max_compat_pvr)) {
2855         /* KVM and TCG always allow GTSE with radix... */
2856         spapr_ovec_set(spapr->ov5, OV5_MMU_RADIX_GTSE);
2857     }
2858     /* ... but not with hash (currently). */
2859 
2860     if (kvm_enabled()) {
2861         /* Enable H_LOGICAL_CI_* so SLOF can talk to in-kernel devices */
2862         kvmppc_enable_logical_ci_hcalls();
2863         kvmppc_enable_set_mode_hcall();
2864 
2865         /* H_CLEAR_MOD/_REF are mandatory in PAPR, but off by default */
2866         kvmppc_enable_clear_ref_mod_hcalls();
2867 
2868         /* Enable H_PAGE_INIT */
2869         kvmppc_enable_h_page_init();
2870     }
2871 
2872     /* allocate RAM */
2873     memory_region_allocate_system_memory(ram, NULL, "ppc_spapr.ram",
2874                                          machine->ram_size);
2875     memory_region_add_subregion(sysmem, 0, ram);
2876 
2877     /* always allocate the device memory information */
2878     machine->device_memory = g_malloc0(sizeof(*machine->device_memory));
2879 
2880     /* initialize hotplug memory address space */
2881     if (machine->ram_size < machine->maxram_size) {
2882         ram_addr_t device_mem_size = machine->maxram_size - machine->ram_size;
2883         /*
2884          * Limit the number of hotpluggable memory slots to half the number
2885          * slots that KVM supports, leaving the other half for PCI and other
2886          * devices. However ensure that number of slots doesn't drop below 32.
2887          */
2888         int max_memslots = kvm_enabled() ? kvm_get_max_memslots() / 2 :
2889                            SPAPR_MAX_RAM_SLOTS;
2890 
2891         if (max_memslots < SPAPR_MAX_RAM_SLOTS) {
2892             max_memslots = SPAPR_MAX_RAM_SLOTS;
2893         }
2894         if (machine->ram_slots > max_memslots) {
2895             error_report("Specified number of memory slots %"
2896                          PRIu64" exceeds max supported %d",
2897                          machine->ram_slots, max_memslots);
2898             exit(1);
2899         }
2900 
2901         machine->device_memory->base = ROUND_UP(machine->ram_size,
2902                                                 SPAPR_DEVICE_MEM_ALIGN);
2903         memory_region_init(&machine->device_memory->mr, OBJECT(spapr),
2904                            "device-memory", device_mem_size);
2905         memory_region_add_subregion(sysmem, machine->device_memory->base,
2906                                     &machine->device_memory->mr);
2907     }
2908 
2909     if (smc->dr_lmb_enabled) {
2910         spapr_create_lmb_dr_connectors(spapr);
2911     }
2912 
2913     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, "spapr-rtas.bin");
2914     if (!filename) {
2915         error_report("Could not find LPAR rtas '%s'", "spapr-rtas.bin");
2916         exit(1);
2917     }
2918     spapr->rtas_size = get_image_size(filename);
2919     if (spapr->rtas_size < 0) {
2920         error_report("Could not get size of LPAR rtas '%s'", filename);
2921         exit(1);
2922     }
2923     spapr->rtas_blob = g_malloc(spapr->rtas_size);
2924     if (load_image_size(filename, spapr->rtas_blob, spapr->rtas_size) < 0) {
2925         error_report("Could not load LPAR rtas '%s'", filename);
2926         exit(1);
2927     }
2928     if (spapr->rtas_size > RTAS_MAX_SIZE) {
2929         error_report("RTAS too big ! 0x%zx bytes (max is 0x%x)",
2930                      (size_t)spapr->rtas_size, RTAS_MAX_SIZE);
2931         exit(1);
2932     }
2933     g_free(filename);
2934 
2935     /* Set up RTAS event infrastructure */
2936     spapr_events_init(spapr);
2937 
2938     /* Set up the RTC RTAS interfaces */
2939     spapr_rtc_create(spapr);
2940 
2941     /* Set up VIO bus */
2942     spapr->vio_bus = spapr_vio_bus_init();
2943 
2944     for (i = 0; i < serial_max_hds(); i++) {
2945         if (serial_hd(i)) {
2946             spapr_vty_create(spapr->vio_bus, serial_hd(i));
2947         }
2948     }
2949 
2950     /* We always have at least the nvram device on VIO */
2951     spapr_create_nvram(spapr);
2952 
2953     /*
2954      * Setup hotplug / dynamic-reconfiguration connectors. top-level
2955      * connectors (described in root DT node's "ibm,drc-types" property)
2956      * are pre-initialized here. additional child connectors (such as
2957      * connectors for a PHBs PCI slots) are added as needed during their
2958      * parent's realization.
2959      */
2960     if (smc->dr_phb_enabled) {
2961         for (i = 0; i < SPAPR_MAX_PHBS; i++) {
2962             spapr_dr_connector_new(OBJECT(machine), TYPE_SPAPR_DRC_PHB, i);
2963         }
2964     }
2965 
2966     /* Set up PCI */
2967     spapr_pci_rtas_init();
2968 
2969     phb = spapr_create_default_phb();
2970 
2971     for (i = 0; i < nb_nics; i++) {
2972         NICInfo *nd = &nd_table[i];
2973 
2974         if (!nd->model) {
2975             nd->model = g_strdup("spapr-vlan");
2976         }
2977 
2978         if (g_str_equal(nd->model, "spapr-vlan") ||
2979             g_str_equal(nd->model, "ibmveth")) {
2980             spapr_vlan_create(spapr->vio_bus, nd);
2981         } else {
2982             pci_nic_init_nofail(&nd_table[i], phb->bus, nd->model, NULL);
2983         }
2984     }
2985 
2986     for (i = 0; i <= drive_get_max_bus(IF_SCSI); i++) {
2987         spapr_vscsi_create(spapr->vio_bus);
2988     }
2989 
2990     /* Graphics */
2991     if (spapr_vga_init(phb->bus, &error_fatal)) {
2992         spapr->has_graphics = true;
2993         machine->usb |= defaults_enabled() && !machine->usb_disabled;
2994     }
2995 
2996     if (machine->usb) {
2997         if (smc->use_ohci_by_default) {
2998             pci_create_simple(phb->bus, -1, "pci-ohci");
2999         } else {
3000             pci_create_simple(phb->bus, -1, "nec-usb-xhci");
3001         }
3002 
3003         if (spapr->has_graphics) {
3004             USBBus *usb_bus = usb_bus_find(-1);
3005 
3006             usb_create_simple(usb_bus, "usb-kbd");
3007             usb_create_simple(usb_bus, "usb-mouse");
3008         }
3009     }
3010 
3011     if (spapr->rma_size < (MIN_RMA_SLOF * MiB)) {
3012         error_report(
3013             "pSeries SLOF firmware requires >= %ldM guest RMA (Real Mode Area memory)",
3014             MIN_RMA_SLOF);
3015         exit(1);
3016     }
3017 
3018     if (kernel_filename) {
3019         uint64_t lowaddr = 0;
3020 
3021         spapr->kernel_size = load_elf(kernel_filename, NULL,
3022                                       translate_kernel_address, NULL,
3023                                       NULL, &lowaddr, NULL, 1,
3024                                       PPC_ELF_MACHINE, 0, 0);
3025         if (spapr->kernel_size == ELF_LOAD_WRONG_ENDIAN) {
3026             spapr->kernel_size = load_elf(kernel_filename, NULL,
3027                                           translate_kernel_address, NULL, NULL,
3028                                           &lowaddr, NULL, 0, PPC_ELF_MACHINE,
3029                                           0, 0);
3030             spapr->kernel_le = spapr->kernel_size > 0;
3031         }
3032         if (spapr->kernel_size < 0) {
3033             error_report("error loading %s: %s", kernel_filename,
3034                          load_elf_strerror(spapr->kernel_size));
3035             exit(1);
3036         }
3037 
3038         /* load initrd */
3039         if (initrd_filename) {
3040             /* Try to locate the initrd in the gap between the kernel
3041              * and the firmware. Add a bit of space just in case
3042              */
3043             spapr->initrd_base = (KERNEL_LOAD_ADDR + spapr->kernel_size
3044                                   + 0x1ffff) & ~0xffff;
3045             spapr->initrd_size = load_image_targphys(initrd_filename,
3046                                                      spapr->initrd_base,
3047                                                      load_limit
3048                                                      - spapr->initrd_base);
3049             if (spapr->initrd_size < 0) {
3050                 error_report("could not load initial ram disk '%s'",
3051                              initrd_filename);
3052                 exit(1);
3053             }
3054         }
3055     }
3056 
3057     if (bios_name == NULL) {
3058         bios_name = FW_FILE_NAME;
3059     }
3060     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
3061     if (!filename) {
3062         error_report("Could not find LPAR firmware '%s'", bios_name);
3063         exit(1);
3064     }
3065     fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE);
3066     if (fw_size <= 0) {
3067         error_report("Could not load LPAR firmware '%s'", filename);
3068         exit(1);
3069     }
3070     g_free(filename);
3071 
3072     /* FIXME: Should register things through the MachineState's qdev
3073      * interface, this is a legacy from the sPAPREnvironment structure
3074      * which predated MachineState but had a similar function */
3075     vmstate_register(NULL, 0, &vmstate_spapr, spapr);
3076     register_savevm_live(NULL, "spapr/htab", -1, 1,
3077                          &savevm_htab_handlers, spapr);
3078 
3079     qbus_set_hotplug_handler(sysbus_get_default(), OBJECT(machine),
3080                              &error_fatal);
3081 
3082     qemu_register_boot_set(spapr_boot_set, spapr);
3083 
3084     if (kvm_enabled()) {
3085         /* to stop and start vmclock */
3086         qemu_add_vm_change_state_handler(cpu_ppc_clock_vm_state_change,
3087                                          &spapr->tb);
3088 
3089         kvmppc_spapr_enable_inkernel_multitce();
3090     }
3091 }
3092 
3093 static int spapr_kvm_type(MachineState *machine, const char *vm_type)
3094 {
3095     if (!vm_type) {
3096         return 0;
3097     }
3098 
3099     if (!strcmp(vm_type, "HV")) {
3100         return 1;
3101     }
3102 
3103     if (!strcmp(vm_type, "PR")) {
3104         return 2;
3105     }
3106 
3107     error_report("Unknown kvm-type specified '%s'", vm_type);
3108     exit(1);
3109 }
3110 
3111 /*
3112  * Implementation of an interface to adjust firmware path
3113  * for the bootindex property handling.
3114  */
3115 static char *spapr_get_fw_dev_path(FWPathProvider *p, BusState *bus,
3116                                    DeviceState *dev)
3117 {
3118 #define CAST(type, obj, name) \
3119     ((type *)object_dynamic_cast(OBJECT(obj), (name)))
3120     SCSIDevice *d = CAST(SCSIDevice,  dev, TYPE_SCSI_DEVICE);
3121     SpaprPhbState *phb = CAST(SpaprPhbState, dev, TYPE_SPAPR_PCI_HOST_BRIDGE);
3122     VHostSCSICommon *vsc = CAST(VHostSCSICommon, dev, TYPE_VHOST_SCSI_COMMON);
3123 
3124     if (d) {
3125         void *spapr = CAST(void, bus->parent, "spapr-vscsi");
3126         VirtIOSCSI *virtio = CAST(VirtIOSCSI, bus->parent, TYPE_VIRTIO_SCSI);
3127         USBDevice *usb = CAST(USBDevice, bus->parent, TYPE_USB_DEVICE);
3128 
3129         if (spapr) {
3130             /*
3131              * Replace "channel@0/disk@0,0" with "disk@8000000000000000":
3132              * In the top 16 bits of the 64-bit LUN, we use SRP luns of the form
3133              * 0x8000 | (target << 8) | (bus << 5) | lun
3134              * (see the "Logical unit addressing format" table in SAM5)
3135              */
3136             unsigned id = 0x8000 | (d->id << 8) | (d->channel << 5) | d->lun;
3137             return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
3138                                    (uint64_t)id << 48);
3139         } else if (virtio) {
3140             /*
3141              * We use SRP luns of the form 01000000 | (target << 8) | lun
3142              * in the top 32 bits of the 64-bit LUN
3143              * Note: the quote above is from SLOF and it is wrong,
3144              * the actual binding is:
3145              * swap 0100 or 10 << or 20 << ( target lun-id -- srplun )
3146              */
3147             unsigned id = 0x1000000 | (d->id << 16) | d->lun;
3148             if (d->lun >= 256) {
3149                 /* Use the LUN "flat space addressing method" */
3150                 id |= 0x4000;
3151             }
3152             return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
3153                                    (uint64_t)id << 32);
3154         } else if (usb) {
3155             /*
3156              * We use SRP luns of the form 01000000 | (usb-port << 16) | lun
3157              * in the top 32 bits of the 64-bit LUN
3158              */
3159             unsigned usb_port = atoi(usb->port->path);
3160             unsigned id = 0x1000000 | (usb_port << 16) | d->lun;
3161             return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
3162                                    (uint64_t)id << 32);
3163         }
3164     }
3165 
3166     /*
3167      * SLOF probes the USB devices, and if it recognizes that the device is a
3168      * storage device, it changes its name to "storage" instead of "usb-host",
3169      * and additionally adds a child node for the SCSI LUN, so the correct
3170      * boot path in SLOF is something like .../storage@1/disk@xxx" instead.
3171      */
3172     if (strcmp("usb-host", qdev_fw_name(dev)) == 0) {
3173         USBDevice *usbdev = CAST(USBDevice, dev, TYPE_USB_DEVICE);
3174         if (usb_host_dev_is_scsi_storage(usbdev)) {
3175             return g_strdup_printf("storage@%s/disk", usbdev->port->path);
3176         }
3177     }
3178 
3179     if (phb) {
3180         /* Replace "pci" with "pci@800000020000000" */
3181         return g_strdup_printf("pci@%"PRIX64, phb->buid);
3182     }
3183 
3184     if (vsc) {
3185         /* Same logic as virtio above */
3186         unsigned id = 0x1000000 | (vsc->target << 16) | vsc->lun;
3187         return g_strdup_printf("disk@%"PRIX64, (uint64_t)id << 32);
3188     }
3189 
3190     if (g_str_equal("pci-bridge", qdev_fw_name(dev))) {
3191         /* SLOF uses "pci" instead of "pci-bridge" for PCI bridges */
3192         PCIDevice *pcidev = CAST(PCIDevice, dev, TYPE_PCI_DEVICE);
3193         return g_strdup_printf("pci@%x", PCI_SLOT(pcidev->devfn));
3194     }
3195 
3196     return NULL;
3197 }
3198 
3199 static char *spapr_get_kvm_type(Object *obj, Error **errp)
3200 {
3201     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3202 
3203     return g_strdup(spapr->kvm_type);
3204 }
3205 
3206 static void spapr_set_kvm_type(Object *obj, const char *value, Error **errp)
3207 {
3208     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3209 
3210     g_free(spapr->kvm_type);
3211     spapr->kvm_type = g_strdup(value);
3212 }
3213 
3214 static bool spapr_get_modern_hotplug_events(Object *obj, Error **errp)
3215 {
3216     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3217 
3218     return spapr->use_hotplug_event_source;
3219 }
3220 
3221 static void spapr_set_modern_hotplug_events(Object *obj, bool value,
3222                                             Error **errp)
3223 {
3224     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3225 
3226     spapr->use_hotplug_event_source = value;
3227 }
3228 
3229 static bool spapr_get_msix_emulation(Object *obj, Error **errp)
3230 {
3231     return true;
3232 }
3233 
3234 static char *spapr_get_resize_hpt(Object *obj, Error **errp)
3235 {
3236     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3237 
3238     switch (spapr->resize_hpt) {
3239     case SPAPR_RESIZE_HPT_DEFAULT:
3240         return g_strdup("default");
3241     case SPAPR_RESIZE_HPT_DISABLED:
3242         return g_strdup("disabled");
3243     case SPAPR_RESIZE_HPT_ENABLED:
3244         return g_strdup("enabled");
3245     case SPAPR_RESIZE_HPT_REQUIRED:
3246         return g_strdup("required");
3247     }
3248     g_assert_not_reached();
3249 }
3250 
3251 static void spapr_set_resize_hpt(Object *obj, const char *value, Error **errp)
3252 {
3253     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3254 
3255     if (strcmp(value, "default") == 0) {
3256         spapr->resize_hpt = SPAPR_RESIZE_HPT_DEFAULT;
3257     } else if (strcmp(value, "disabled") == 0) {
3258         spapr->resize_hpt = SPAPR_RESIZE_HPT_DISABLED;
3259     } else if (strcmp(value, "enabled") == 0) {
3260         spapr->resize_hpt = SPAPR_RESIZE_HPT_ENABLED;
3261     } else if (strcmp(value, "required") == 0) {
3262         spapr->resize_hpt = SPAPR_RESIZE_HPT_REQUIRED;
3263     } else {
3264         error_setg(errp, "Bad value for \"resize-hpt\" property");
3265     }
3266 }
3267 
3268 static void spapr_get_vsmt(Object *obj, Visitor *v, const char *name,
3269                                    void *opaque, Error **errp)
3270 {
3271     visit_type_uint32(v, name, (uint32_t *)opaque, errp);
3272 }
3273 
3274 static void spapr_set_vsmt(Object *obj, Visitor *v, const char *name,
3275                                    void *opaque, Error **errp)
3276 {
3277     visit_type_uint32(v, name, (uint32_t *)opaque, errp);
3278 }
3279 
3280 static char *spapr_get_ic_mode(Object *obj, Error **errp)
3281 {
3282     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3283 
3284     if (spapr->irq == &spapr_irq_xics_legacy) {
3285         return g_strdup("legacy");
3286     } else if (spapr->irq == &spapr_irq_xics) {
3287         return g_strdup("xics");
3288     } else if (spapr->irq == &spapr_irq_xive) {
3289         return g_strdup("xive");
3290     } else if (spapr->irq == &spapr_irq_dual) {
3291         return g_strdup("dual");
3292     }
3293     g_assert_not_reached();
3294 }
3295 
3296 static void spapr_set_ic_mode(Object *obj, const char *value, Error **errp)
3297 {
3298     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3299 
3300     if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
3301         error_setg(errp, "This machine only uses the legacy XICS backend, don't pass ic-mode");
3302         return;
3303     }
3304 
3305     /* The legacy IRQ backend can not be set */
3306     if (strcmp(value, "xics") == 0) {
3307         spapr->irq = &spapr_irq_xics;
3308     } else if (strcmp(value, "xive") == 0) {
3309         spapr->irq = &spapr_irq_xive;
3310     } else if (strcmp(value, "dual") == 0) {
3311         spapr->irq = &spapr_irq_dual;
3312     } else {
3313         error_setg(errp, "Bad value for \"ic-mode\" property");
3314     }
3315 }
3316 
3317 static char *spapr_get_host_model(Object *obj, Error **errp)
3318 {
3319     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3320 
3321     return g_strdup(spapr->host_model);
3322 }
3323 
3324 static void spapr_set_host_model(Object *obj, const char *value, Error **errp)
3325 {
3326     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3327 
3328     g_free(spapr->host_model);
3329     spapr->host_model = g_strdup(value);
3330 }
3331 
3332 static char *spapr_get_host_serial(Object *obj, Error **errp)
3333 {
3334     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3335 
3336     return g_strdup(spapr->host_serial);
3337 }
3338 
3339 static void spapr_set_host_serial(Object *obj, const char *value, Error **errp)
3340 {
3341     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3342 
3343     g_free(spapr->host_serial);
3344     spapr->host_serial = g_strdup(value);
3345 }
3346 
3347 static void spapr_instance_init(Object *obj)
3348 {
3349     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3350     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
3351 
3352     spapr->htab_fd = -1;
3353     spapr->use_hotplug_event_source = true;
3354     object_property_add_str(obj, "kvm-type",
3355                             spapr_get_kvm_type, spapr_set_kvm_type, NULL);
3356     object_property_set_description(obj, "kvm-type",
3357                                     "Specifies the KVM virtualization mode (HV, PR)",
3358                                     NULL);
3359     object_property_add_bool(obj, "modern-hotplug-events",
3360                             spapr_get_modern_hotplug_events,
3361                             spapr_set_modern_hotplug_events,
3362                             NULL);
3363     object_property_set_description(obj, "modern-hotplug-events",
3364                                     "Use dedicated hotplug event mechanism in"
3365                                     " place of standard EPOW events when possible"
3366                                     " (required for memory hot-unplug support)",
3367                                     NULL);
3368     ppc_compat_add_property(obj, "max-cpu-compat", &spapr->max_compat_pvr,
3369                             "Maximum permitted CPU compatibility mode",
3370                             &error_fatal);
3371 
3372     object_property_add_str(obj, "resize-hpt",
3373                             spapr_get_resize_hpt, spapr_set_resize_hpt, NULL);
3374     object_property_set_description(obj, "resize-hpt",
3375                                     "Resizing of the Hash Page Table (enabled, disabled, required)",
3376                                     NULL);
3377     object_property_add(obj, "vsmt", "uint32", spapr_get_vsmt,
3378                         spapr_set_vsmt, NULL, &spapr->vsmt, &error_abort);
3379     object_property_set_description(obj, "vsmt",
3380                                     "Virtual SMT: KVM behaves as if this were"
3381                                     " the host's SMT mode", &error_abort);
3382     object_property_add_bool(obj, "vfio-no-msix-emulation",
3383                              spapr_get_msix_emulation, NULL, NULL);
3384 
3385     /* The machine class defines the default interrupt controller mode */
3386     spapr->irq = smc->irq;
3387     object_property_add_str(obj, "ic-mode", spapr_get_ic_mode,
3388                             spapr_set_ic_mode, NULL);
3389     object_property_set_description(obj, "ic-mode",
3390                  "Specifies the interrupt controller mode (xics, xive, dual)",
3391                  NULL);
3392 
3393     object_property_add_str(obj, "host-model",
3394         spapr_get_host_model, spapr_set_host_model,
3395         &error_abort);
3396     object_property_set_description(obj, "host-model",
3397         "Host model to advertise in guest device tree", &error_abort);
3398     object_property_add_str(obj, "host-serial",
3399         spapr_get_host_serial, spapr_set_host_serial,
3400         &error_abort);
3401     object_property_set_description(obj, "host-serial",
3402         "Host serial number to advertise in guest device tree", &error_abort);
3403 }
3404 
3405 static void spapr_machine_finalizefn(Object *obj)
3406 {
3407     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3408 
3409     g_free(spapr->kvm_type);
3410 }
3411 
3412 void spapr_do_system_reset_on_cpu(CPUState *cs, run_on_cpu_data arg)
3413 {
3414     cpu_synchronize_state(cs);
3415     ppc_cpu_do_system_reset(cs);
3416 }
3417 
3418 static void spapr_nmi(NMIState *n, int cpu_index, Error **errp)
3419 {
3420     CPUState *cs;
3421 
3422     CPU_FOREACH(cs) {
3423         async_run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
3424     }
3425 }
3426 
3427 int spapr_lmb_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
3428                           void *fdt, int *fdt_start_offset, Error **errp)
3429 {
3430     uint64_t addr;
3431     uint32_t node;
3432 
3433     addr = spapr_drc_index(drc) * SPAPR_MEMORY_BLOCK_SIZE;
3434     node = object_property_get_uint(OBJECT(drc->dev), PC_DIMM_NODE_PROP,
3435                                     &error_abort);
3436     *fdt_start_offset = spapr_populate_memory_node(fdt, node, addr,
3437                                                    SPAPR_MEMORY_BLOCK_SIZE);
3438     return 0;
3439 }
3440 
3441 static void spapr_add_lmbs(DeviceState *dev, uint64_t addr_start, uint64_t size,
3442                            bool dedicated_hp_event_source, Error **errp)
3443 {
3444     SpaprDrc *drc;
3445     uint32_t nr_lmbs = size/SPAPR_MEMORY_BLOCK_SIZE;
3446     int i;
3447     uint64_t addr = addr_start;
3448     bool hotplugged = spapr_drc_hotplugged(dev);
3449     Error *local_err = NULL;
3450 
3451     for (i = 0; i < nr_lmbs; i++) {
3452         drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3453                               addr / SPAPR_MEMORY_BLOCK_SIZE);
3454         g_assert(drc);
3455 
3456         spapr_drc_attach(drc, dev, &local_err);
3457         if (local_err) {
3458             while (addr > addr_start) {
3459                 addr -= SPAPR_MEMORY_BLOCK_SIZE;
3460                 drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3461                                       addr / SPAPR_MEMORY_BLOCK_SIZE);
3462                 spapr_drc_detach(drc);
3463             }
3464             error_propagate(errp, local_err);
3465             return;
3466         }
3467         if (!hotplugged) {
3468             spapr_drc_reset(drc);
3469         }
3470         addr += SPAPR_MEMORY_BLOCK_SIZE;
3471     }
3472     /* send hotplug notification to the
3473      * guest only in case of hotplugged memory
3474      */
3475     if (hotplugged) {
3476         if (dedicated_hp_event_source) {
3477             drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3478                                   addr_start / SPAPR_MEMORY_BLOCK_SIZE);
3479             spapr_hotplug_req_add_by_count_indexed(SPAPR_DR_CONNECTOR_TYPE_LMB,
3480                                                    nr_lmbs,
3481                                                    spapr_drc_index(drc));
3482         } else {
3483             spapr_hotplug_req_add_by_count(SPAPR_DR_CONNECTOR_TYPE_LMB,
3484                                            nr_lmbs);
3485         }
3486     }
3487 }
3488 
3489 static void spapr_memory_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
3490                               Error **errp)
3491 {
3492     Error *local_err = NULL;
3493     SpaprMachineState *ms = SPAPR_MACHINE(hotplug_dev);
3494     PCDIMMDevice *dimm = PC_DIMM(dev);
3495     uint64_t size, addr;
3496 
3497     size = memory_device_get_region_size(MEMORY_DEVICE(dev), &error_abort);
3498 
3499     pc_dimm_plug(dimm, MACHINE(ms), &local_err);
3500     if (local_err) {
3501         goto out;
3502     }
3503 
3504     addr = object_property_get_uint(OBJECT(dimm),
3505                                     PC_DIMM_ADDR_PROP, &local_err);
3506     if (local_err) {
3507         goto out_unplug;
3508     }
3509 
3510     spapr_add_lmbs(dev, addr, size, spapr_ovec_test(ms->ov5_cas, OV5_HP_EVT),
3511                    &local_err);
3512     if (local_err) {
3513         goto out_unplug;
3514     }
3515 
3516     return;
3517 
3518 out_unplug:
3519     pc_dimm_unplug(dimm, MACHINE(ms));
3520 out:
3521     error_propagate(errp, local_err);
3522 }
3523 
3524 static void spapr_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
3525                                   Error **errp)
3526 {
3527     const SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(hotplug_dev);
3528     SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_dev);
3529     PCDIMMDevice *dimm = PC_DIMM(dev);
3530     Error *local_err = NULL;
3531     uint64_t size;
3532     Object *memdev;
3533     hwaddr pagesize;
3534 
3535     if (!smc->dr_lmb_enabled) {
3536         error_setg(errp, "Memory hotplug not supported for this machine");
3537         return;
3538     }
3539 
3540     size = memory_device_get_region_size(MEMORY_DEVICE(dimm), &local_err);
3541     if (local_err) {
3542         error_propagate(errp, local_err);
3543         return;
3544     }
3545 
3546     if (size % SPAPR_MEMORY_BLOCK_SIZE) {
3547         error_setg(errp, "Hotplugged memory size must be a multiple of "
3548                       "%" PRIu64 " MB", SPAPR_MEMORY_BLOCK_SIZE / MiB);
3549         return;
3550     }
3551 
3552     memdev = object_property_get_link(OBJECT(dimm), PC_DIMM_MEMDEV_PROP,
3553                                       &error_abort);
3554     pagesize = host_memory_backend_pagesize(MEMORY_BACKEND(memdev));
3555     spapr_check_pagesize(spapr, pagesize, &local_err);
3556     if (local_err) {
3557         error_propagate(errp, local_err);
3558         return;
3559     }
3560 
3561     pc_dimm_pre_plug(dimm, MACHINE(hotplug_dev), NULL, errp);
3562 }
3563 
3564 struct SpaprDimmState {
3565     PCDIMMDevice *dimm;
3566     uint32_t nr_lmbs;
3567     QTAILQ_ENTRY(SpaprDimmState) next;
3568 };
3569 
3570 static SpaprDimmState *spapr_pending_dimm_unplugs_find(SpaprMachineState *s,
3571                                                        PCDIMMDevice *dimm)
3572 {
3573     SpaprDimmState *dimm_state = NULL;
3574 
3575     QTAILQ_FOREACH(dimm_state, &s->pending_dimm_unplugs, next) {
3576         if (dimm_state->dimm == dimm) {
3577             break;
3578         }
3579     }
3580     return dimm_state;
3581 }
3582 
3583 static SpaprDimmState *spapr_pending_dimm_unplugs_add(SpaprMachineState *spapr,
3584                                                       uint32_t nr_lmbs,
3585                                                       PCDIMMDevice *dimm)
3586 {
3587     SpaprDimmState *ds = NULL;
3588 
3589     /*
3590      * If this request is for a DIMM whose removal had failed earlier
3591      * (due to guest's refusal to remove the LMBs), we would have this
3592      * dimm already in the pending_dimm_unplugs list. In that
3593      * case don't add again.
3594      */
3595     ds = spapr_pending_dimm_unplugs_find(spapr, dimm);
3596     if (!ds) {
3597         ds = g_malloc0(sizeof(SpaprDimmState));
3598         ds->nr_lmbs = nr_lmbs;
3599         ds->dimm = dimm;
3600         QTAILQ_INSERT_HEAD(&spapr->pending_dimm_unplugs, ds, next);
3601     }
3602     return ds;
3603 }
3604 
3605 static void spapr_pending_dimm_unplugs_remove(SpaprMachineState *spapr,
3606                                               SpaprDimmState *dimm_state)
3607 {
3608     QTAILQ_REMOVE(&spapr->pending_dimm_unplugs, dimm_state, next);
3609     g_free(dimm_state);
3610 }
3611 
3612 static SpaprDimmState *spapr_recover_pending_dimm_state(SpaprMachineState *ms,
3613                                                         PCDIMMDevice *dimm)
3614 {
3615     SpaprDrc *drc;
3616     uint64_t size = memory_device_get_region_size(MEMORY_DEVICE(dimm),
3617                                                   &error_abort);
3618     uint32_t nr_lmbs = size / SPAPR_MEMORY_BLOCK_SIZE;
3619     uint32_t avail_lmbs = 0;
3620     uint64_t addr_start, addr;
3621     int i;
3622 
3623     addr_start = object_property_get_int(OBJECT(dimm), PC_DIMM_ADDR_PROP,
3624                                          &error_abort);
3625 
3626     addr = addr_start;
3627     for (i = 0; i < nr_lmbs; i++) {
3628         drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3629                               addr / SPAPR_MEMORY_BLOCK_SIZE);
3630         g_assert(drc);
3631         if (drc->dev) {
3632             avail_lmbs++;
3633         }
3634         addr += SPAPR_MEMORY_BLOCK_SIZE;
3635     }
3636 
3637     return spapr_pending_dimm_unplugs_add(ms, avail_lmbs, dimm);
3638 }
3639 
3640 /* Callback to be called during DRC release. */
3641 void spapr_lmb_release(DeviceState *dev)
3642 {
3643     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);
3644     SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_ctrl);
3645     SpaprDimmState *ds = spapr_pending_dimm_unplugs_find(spapr, PC_DIMM(dev));
3646 
3647     /* This information will get lost if a migration occurs
3648      * during the unplug process. In this case recover it. */
3649     if (ds == NULL) {
3650         ds = spapr_recover_pending_dimm_state(spapr, PC_DIMM(dev));
3651         g_assert(ds);
3652         /* The DRC being examined by the caller at least must be counted */
3653         g_assert(ds->nr_lmbs);
3654     }
3655 
3656     if (--ds->nr_lmbs) {
3657         return;
3658     }
3659 
3660     /*
3661      * Now that all the LMBs have been removed by the guest, call the
3662      * unplug handler chain. This can never fail.
3663      */
3664     hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);
3665     object_unparent(OBJECT(dev));
3666 }
3667 
3668 static void spapr_memory_unplug(HotplugHandler *hotplug_dev, DeviceState *dev)
3669 {
3670     SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_dev);
3671     SpaprDimmState *ds = spapr_pending_dimm_unplugs_find(spapr, PC_DIMM(dev));
3672 
3673     pc_dimm_unplug(PC_DIMM(dev), MACHINE(hotplug_dev));
3674     object_property_set_bool(OBJECT(dev), false, "realized", NULL);
3675     spapr_pending_dimm_unplugs_remove(spapr, ds);
3676 }
3677 
3678 static void spapr_memory_unplug_request(HotplugHandler *hotplug_dev,
3679                                         DeviceState *dev, Error **errp)
3680 {
3681     SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_dev);
3682     Error *local_err = NULL;
3683     PCDIMMDevice *dimm = PC_DIMM(dev);
3684     uint32_t nr_lmbs;
3685     uint64_t size, addr_start, addr;
3686     int i;
3687     SpaprDrc *drc;
3688 
3689     size = memory_device_get_region_size(MEMORY_DEVICE(dimm), &error_abort);
3690     nr_lmbs = size / SPAPR_MEMORY_BLOCK_SIZE;
3691 
3692     addr_start = object_property_get_uint(OBJECT(dimm), PC_DIMM_ADDR_PROP,
3693                                          &local_err);
3694     if (local_err) {
3695         goto out;
3696     }
3697 
3698     /*
3699      * An existing pending dimm state for this DIMM means that there is an
3700      * unplug operation in progress, waiting for the spapr_lmb_release
3701      * callback to complete the job (BQL can't cover that far). In this case,
3702      * bail out to avoid detaching DRCs that were already released.
3703      */
3704     if (spapr_pending_dimm_unplugs_find(spapr, dimm)) {
3705         error_setg(&local_err,
3706                    "Memory unplug already in progress for device %s",
3707                    dev->id);
3708         goto out;
3709     }
3710 
3711     spapr_pending_dimm_unplugs_add(spapr, nr_lmbs, dimm);
3712 
3713     addr = addr_start;
3714     for (i = 0; i < nr_lmbs; i++) {
3715         drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3716                               addr / SPAPR_MEMORY_BLOCK_SIZE);
3717         g_assert(drc);
3718 
3719         spapr_drc_detach(drc);
3720         addr += SPAPR_MEMORY_BLOCK_SIZE;
3721     }
3722 
3723     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3724                           addr_start / SPAPR_MEMORY_BLOCK_SIZE);
3725     spapr_hotplug_req_remove_by_count_indexed(SPAPR_DR_CONNECTOR_TYPE_LMB,
3726                                               nr_lmbs, spapr_drc_index(drc));
3727 out:
3728     error_propagate(errp, local_err);
3729 }
3730 
3731 /* Callback to be called during DRC release. */
3732 void spapr_core_release(DeviceState *dev)
3733 {
3734     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);
3735 
3736     /* Call the unplug handler chain. This can never fail. */
3737     hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);
3738     object_unparent(OBJECT(dev));
3739 }
3740 
3741 static void spapr_core_unplug(HotplugHandler *hotplug_dev, DeviceState *dev)
3742 {
3743     MachineState *ms = MACHINE(hotplug_dev);
3744     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(ms);
3745     CPUCore *cc = CPU_CORE(dev);
3746     CPUArchId *core_slot = spapr_find_cpu_slot(ms, cc->core_id, NULL);
3747 
3748     if (smc->pre_2_10_has_unused_icps) {
3749         SpaprCpuCore *sc = SPAPR_CPU_CORE(OBJECT(dev));
3750         int i;
3751 
3752         for (i = 0; i < cc->nr_threads; i++) {
3753             CPUState *cs = CPU(sc->threads[i]);
3754 
3755             pre_2_10_vmstate_register_dummy_icp(cs->cpu_index);
3756         }
3757     }
3758 
3759     assert(core_slot);
3760     core_slot->cpu = NULL;
3761     object_property_set_bool(OBJECT(dev), false, "realized", NULL);
3762 }
3763 
3764 static
3765 void spapr_core_unplug_request(HotplugHandler *hotplug_dev, DeviceState *dev,
3766                                Error **errp)
3767 {
3768     SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
3769     int index;
3770     SpaprDrc *drc;
3771     CPUCore *cc = CPU_CORE(dev);
3772 
3773     if (!spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index)) {
3774         error_setg(errp, "Unable to find CPU core with core-id: %d",
3775                    cc->core_id);
3776         return;
3777     }
3778     if (index == 0) {
3779         error_setg(errp, "Boot CPU core may not be unplugged");
3780         return;
3781     }
3782 
3783     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_CPU,
3784                           spapr_vcpu_id(spapr, cc->core_id));
3785     g_assert(drc);
3786 
3787     spapr_drc_detach(drc);
3788 
3789     spapr_hotplug_req_remove_by_index(drc);
3790 }
3791 
3792 int spapr_core_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
3793                            void *fdt, int *fdt_start_offset, Error **errp)
3794 {
3795     SpaprCpuCore *core = SPAPR_CPU_CORE(drc->dev);
3796     CPUState *cs = CPU(core->threads[0]);
3797     PowerPCCPU *cpu = POWERPC_CPU(cs);
3798     DeviceClass *dc = DEVICE_GET_CLASS(cs);
3799     int id = spapr_get_vcpu_id(cpu);
3800     char *nodename;
3801     int offset;
3802 
3803     nodename = g_strdup_printf("%s@%x", dc->fw_name, id);
3804     offset = fdt_add_subnode(fdt, 0, nodename);
3805     g_free(nodename);
3806 
3807     spapr_populate_cpu_dt(cs, fdt, offset, spapr);
3808 
3809     *fdt_start_offset = offset;
3810     return 0;
3811 }
3812 
3813 static void spapr_core_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
3814                             Error **errp)
3815 {
3816     SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
3817     MachineClass *mc = MACHINE_GET_CLASS(spapr);
3818     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
3819     SpaprCpuCore *core = SPAPR_CPU_CORE(OBJECT(dev));
3820     CPUCore *cc = CPU_CORE(dev);
3821     CPUState *cs;
3822     SpaprDrc *drc;
3823     Error *local_err = NULL;
3824     CPUArchId *core_slot;
3825     int index;
3826     bool hotplugged = spapr_drc_hotplugged(dev);
3827 
3828     core_slot = spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index);
3829     if (!core_slot) {
3830         error_setg(errp, "Unable to find CPU core with core-id: %d",
3831                    cc->core_id);
3832         return;
3833     }
3834     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_CPU,
3835                           spapr_vcpu_id(spapr, cc->core_id));
3836 
3837     g_assert(drc || !mc->has_hotpluggable_cpus);
3838 
3839     if (drc) {
3840         spapr_drc_attach(drc, dev, &local_err);
3841         if (local_err) {
3842             error_propagate(errp, local_err);
3843             return;
3844         }
3845 
3846         if (hotplugged) {
3847             /*
3848              * Send hotplug notification interrupt to the guest only
3849              * in case of hotplugged CPUs.
3850              */
3851             spapr_hotplug_req_add_by_index(drc);
3852         } else {
3853             spapr_drc_reset(drc);
3854         }
3855     }
3856 
3857     core_slot->cpu = OBJECT(dev);
3858 
3859     if (smc->pre_2_10_has_unused_icps) {
3860         int i;
3861 
3862         for (i = 0; i < cc->nr_threads; i++) {
3863             cs = CPU(core->threads[i]);
3864             pre_2_10_vmstate_unregister_dummy_icp(cs->cpu_index);
3865         }
3866     }
3867 }
3868 
3869 static void spapr_core_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
3870                                 Error **errp)
3871 {
3872     MachineState *machine = MACHINE(OBJECT(hotplug_dev));
3873     MachineClass *mc = MACHINE_GET_CLASS(hotplug_dev);
3874     Error *local_err = NULL;
3875     CPUCore *cc = CPU_CORE(dev);
3876     const char *base_core_type = spapr_get_cpu_core_type(machine->cpu_type);
3877     const char *type = object_get_typename(OBJECT(dev));
3878     CPUArchId *core_slot;
3879     int index;
3880     unsigned int smp_threads = machine->smp.threads;
3881 
3882     if (dev->hotplugged && !mc->has_hotpluggable_cpus) {
3883         error_setg(&local_err, "CPU hotplug not supported for this machine");
3884         goto out;
3885     }
3886 
3887     if (strcmp(base_core_type, type)) {
3888         error_setg(&local_err, "CPU core type should be %s", base_core_type);
3889         goto out;
3890     }
3891 
3892     if (cc->core_id % smp_threads) {
3893         error_setg(&local_err, "invalid core id %d", cc->core_id);
3894         goto out;
3895     }
3896 
3897     /*
3898      * In general we should have homogeneous threads-per-core, but old
3899      * (pre hotplug support) machine types allow the last core to have
3900      * reduced threads as a compatibility hack for when we allowed
3901      * total vcpus not a multiple of threads-per-core.
3902      */
3903     if (mc->has_hotpluggable_cpus && (cc->nr_threads != smp_threads)) {
3904         error_setg(&local_err, "invalid nr-threads %d, must be %d",
3905                    cc->nr_threads, smp_threads);
3906         goto out;
3907     }
3908 
3909     core_slot = spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index);
3910     if (!core_slot) {
3911         error_setg(&local_err, "core id %d out of range", cc->core_id);
3912         goto out;
3913     }
3914 
3915     if (core_slot->cpu) {
3916         error_setg(&local_err, "core %d already populated", cc->core_id);
3917         goto out;
3918     }
3919 
3920     numa_cpu_pre_plug(core_slot, dev, &local_err);
3921 
3922 out:
3923     error_propagate(errp, local_err);
3924 }
3925 
3926 int spapr_phb_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
3927                           void *fdt, int *fdt_start_offset, Error **errp)
3928 {
3929     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(drc->dev);
3930     int intc_phandle;
3931 
3932     intc_phandle = spapr_irq_get_phandle(spapr, spapr->fdt_blob, errp);
3933     if (intc_phandle <= 0) {
3934         return -1;
3935     }
3936 
3937     if (spapr_dt_phb(sphb, intc_phandle, fdt, spapr->irq->nr_msis,
3938                      fdt_start_offset)) {
3939         error_setg(errp, "unable to create FDT node for PHB %d", sphb->index);
3940         return -1;
3941     }
3942 
3943     /* generally SLOF creates these, for hotplug it's up to QEMU */
3944     _FDT(fdt_setprop_string(fdt, *fdt_start_offset, "name", "pci"));
3945 
3946     return 0;
3947 }
3948 
3949 static void spapr_phb_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
3950                                Error **errp)
3951 {
3952     SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
3953     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
3954     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
3955     const unsigned windows_supported = spapr_phb_windows_supported(sphb);
3956 
3957     if (dev->hotplugged && !smc->dr_phb_enabled) {
3958         error_setg(errp, "PHB hotplug not supported for this machine");
3959         return;
3960     }
3961 
3962     if (sphb->index == (uint32_t)-1) {
3963         error_setg(errp, "\"index\" for PAPR PHB is mandatory");
3964         return;
3965     }
3966 
3967     /*
3968      * This will check that sphb->index doesn't exceed the maximum number of
3969      * PHBs for the current machine type.
3970      */
3971     smc->phb_placement(spapr, sphb->index,
3972                        &sphb->buid, &sphb->io_win_addr,
3973                        &sphb->mem_win_addr, &sphb->mem64_win_addr,
3974                        windows_supported, sphb->dma_liobn,
3975                        &sphb->nv2_gpa_win_addr, &sphb->nv2_atsd_win_addr,
3976                        errp);
3977 }
3978 
3979 static void spapr_phb_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
3980                            Error **errp)
3981 {
3982     SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
3983     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
3984     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
3985     SpaprDrc *drc;
3986     bool hotplugged = spapr_drc_hotplugged(dev);
3987     Error *local_err = NULL;
3988 
3989     if (!smc->dr_phb_enabled) {
3990         return;
3991     }
3992 
3993     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_PHB, sphb->index);
3994     /* hotplug hooks should check it's enabled before getting this far */
3995     assert(drc);
3996 
3997     spapr_drc_attach(drc, DEVICE(dev), &local_err);
3998     if (local_err) {
3999         error_propagate(errp, local_err);
4000         return;
4001     }
4002 
4003     if (hotplugged) {
4004         spapr_hotplug_req_add_by_index(drc);
4005     } else {
4006         spapr_drc_reset(drc);
4007     }
4008 }
4009 
4010 void spapr_phb_release(DeviceState *dev)
4011 {
4012     HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);
4013 
4014     hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);
4015     object_unparent(OBJECT(dev));
4016 }
4017 
4018 static void spapr_phb_unplug(HotplugHandler *hotplug_dev, DeviceState *dev)
4019 {
4020     object_property_set_bool(OBJECT(dev), false, "realized", NULL);
4021 }
4022 
4023 static void spapr_phb_unplug_request(HotplugHandler *hotplug_dev,
4024                                      DeviceState *dev, Error **errp)
4025 {
4026     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
4027     SpaprDrc *drc;
4028 
4029     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_PHB, sphb->index);
4030     assert(drc);
4031 
4032     if (!spapr_drc_unplug_requested(drc)) {
4033         spapr_drc_detach(drc);
4034         spapr_hotplug_req_remove_by_index(drc);
4035     }
4036 }
4037 
4038 static void spapr_machine_device_plug(HotplugHandler *hotplug_dev,
4039                                       DeviceState *dev, Error **errp)
4040 {
4041     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4042         spapr_memory_plug(hotplug_dev, dev, errp);
4043     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4044         spapr_core_plug(hotplug_dev, dev, errp);
4045     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4046         spapr_phb_plug(hotplug_dev, dev, errp);
4047     }
4048 }
4049 
4050 static void spapr_machine_device_unplug(HotplugHandler *hotplug_dev,
4051                                         DeviceState *dev, Error **errp)
4052 {
4053     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4054         spapr_memory_unplug(hotplug_dev, dev);
4055     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4056         spapr_core_unplug(hotplug_dev, dev);
4057     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4058         spapr_phb_unplug(hotplug_dev, dev);
4059     }
4060 }
4061 
4062 static void spapr_machine_device_unplug_request(HotplugHandler *hotplug_dev,
4063                                                 DeviceState *dev, Error **errp)
4064 {
4065     SpaprMachineState *sms = SPAPR_MACHINE(OBJECT(hotplug_dev));
4066     MachineClass *mc = MACHINE_GET_CLASS(sms);
4067     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4068 
4069     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4070         if (spapr_ovec_test(sms->ov5_cas, OV5_HP_EVT)) {
4071             spapr_memory_unplug_request(hotplug_dev, dev, errp);
4072         } else {
4073             /* NOTE: this means there is a window after guest reset, prior to
4074              * CAS negotiation, where unplug requests will fail due to the
4075              * capability not being detected yet. This is a bit different than
4076              * the case with PCI unplug, where the events will be queued and
4077              * eventually handled by the guest after boot
4078              */
4079             error_setg(errp, "Memory hot unplug not supported for this guest");
4080         }
4081     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4082         if (!mc->has_hotpluggable_cpus) {
4083             error_setg(errp, "CPU hot unplug not supported on this machine");
4084             return;
4085         }
4086         spapr_core_unplug_request(hotplug_dev, dev, errp);
4087     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4088         if (!smc->dr_phb_enabled) {
4089             error_setg(errp, "PHB hot unplug not supported on this machine");
4090             return;
4091         }
4092         spapr_phb_unplug_request(hotplug_dev, dev, errp);
4093     }
4094 }
4095 
4096 static void spapr_machine_device_pre_plug(HotplugHandler *hotplug_dev,
4097                                           DeviceState *dev, Error **errp)
4098 {
4099     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4100         spapr_memory_pre_plug(hotplug_dev, dev, errp);
4101     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4102         spapr_core_pre_plug(hotplug_dev, dev, errp);
4103     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4104         spapr_phb_pre_plug(hotplug_dev, dev, errp);
4105     }
4106 }
4107 
4108 static HotplugHandler *spapr_get_hotplug_handler(MachineState *machine,
4109                                                  DeviceState *dev)
4110 {
4111     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
4112         object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE) ||
4113         object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4114         return HOTPLUG_HANDLER(machine);
4115     }
4116     if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
4117         PCIDevice *pcidev = PCI_DEVICE(dev);
4118         PCIBus *root = pci_device_root_bus(pcidev);
4119         SpaprPhbState *phb =
4120             (SpaprPhbState *)object_dynamic_cast(OBJECT(BUS(root)->parent),
4121                                                  TYPE_SPAPR_PCI_HOST_BRIDGE);
4122 
4123         if (phb) {
4124             return HOTPLUG_HANDLER(phb);
4125         }
4126     }
4127     return NULL;
4128 }
4129 
4130 static CpuInstanceProperties
4131 spapr_cpu_index_to_props(MachineState *machine, unsigned cpu_index)
4132 {
4133     CPUArchId *core_slot;
4134     MachineClass *mc = MACHINE_GET_CLASS(machine);
4135 
4136     /* make sure possible_cpu are intialized */
4137     mc->possible_cpu_arch_ids(machine);
4138     /* get CPU core slot containing thread that matches cpu_index */
4139     core_slot = spapr_find_cpu_slot(machine, cpu_index, NULL);
4140     assert(core_slot);
4141     return core_slot->props;
4142 }
4143 
4144 static int64_t spapr_get_default_cpu_node_id(const MachineState *ms, int idx)
4145 {
4146     return idx / ms->smp.cores % nb_numa_nodes;
4147 }
4148 
4149 static const CPUArchIdList *spapr_possible_cpu_arch_ids(MachineState *machine)
4150 {
4151     int i;
4152     unsigned int smp_threads = machine->smp.threads;
4153     unsigned int smp_cpus = machine->smp.cpus;
4154     const char *core_type;
4155     int spapr_max_cores = machine->smp.max_cpus / smp_threads;
4156     MachineClass *mc = MACHINE_GET_CLASS(machine);
4157 
4158     if (!mc->has_hotpluggable_cpus) {
4159         spapr_max_cores = QEMU_ALIGN_UP(smp_cpus, smp_threads) / smp_threads;
4160     }
4161     if (machine->possible_cpus) {
4162         assert(machine->possible_cpus->len == spapr_max_cores);
4163         return machine->possible_cpus;
4164     }
4165 
4166     core_type = spapr_get_cpu_core_type(machine->cpu_type);
4167     if (!core_type) {
4168         error_report("Unable to find sPAPR CPU Core definition");
4169         exit(1);
4170     }
4171 
4172     machine->possible_cpus = g_malloc0(sizeof(CPUArchIdList) +
4173                              sizeof(CPUArchId) * spapr_max_cores);
4174     machine->possible_cpus->len = spapr_max_cores;
4175     for (i = 0; i < machine->possible_cpus->len; i++) {
4176         int core_id = i * smp_threads;
4177 
4178         machine->possible_cpus->cpus[i].type = core_type;
4179         machine->possible_cpus->cpus[i].vcpus_count = smp_threads;
4180         machine->possible_cpus->cpus[i].arch_id = core_id;
4181         machine->possible_cpus->cpus[i].props.has_core_id = true;
4182         machine->possible_cpus->cpus[i].props.core_id = core_id;
4183     }
4184     return machine->possible_cpus;
4185 }
4186 
4187 static void spapr_phb_placement(SpaprMachineState *spapr, uint32_t index,
4188                                 uint64_t *buid, hwaddr *pio,
4189                                 hwaddr *mmio32, hwaddr *mmio64,
4190                                 unsigned n_dma, uint32_t *liobns,
4191                                 hwaddr *nv2gpa, hwaddr *nv2atsd, Error **errp)
4192 {
4193     /*
4194      * New-style PHB window placement.
4195      *
4196      * Goals: Gives large (1TiB), naturally aligned 64-bit MMIO window
4197      * for each PHB, in addition to 2GiB 32-bit MMIO and 64kiB PIO
4198      * windows.
4199      *
4200      * Some guest kernels can't work with MMIO windows above 1<<46
4201      * (64TiB), so we place up to 31 PHBs in the area 32TiB..64TiB
4202      *
4203      * 32TiB..(33TiB+1984kiB) contains the 64kiB PIO windows for each
4204      * PHB stacked together.  (32TiB+2GiB)..(32TiB+64GiB) contains the
4205      * 2GiB 32-bit MMIO windows for each PHB.  Then 33..64TiB has the
4206      * 1TiB 64-bit MMIO windows for each PHB.
4207      */
4208     const uint64_t base_buid = 0x800000020000000ULL;
4209     int i;
4210 
4211     /* Sanity check natural alignments */
4212     QEMU_BUILD_BUG_ON((SPAPR_PCI_BASE % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
4213     QEMU_BUILD_BUG_ON((SPAPR_PCI_LIMIT % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
4214     QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM64_WIN_SIZE % SPAPR_PCI_MEM32_WIN_SIZE) != 0);
4215     QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM32_WIN_SIZE % SPAPR_PCI_IO_WIN_SIZE) != 0);
4216     /* Sanity check bounds */
4217     QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_IO_WIN_SIZE) >
4218                       SPAPR_PCI_MEM32_WIN_SIZE);
4219     QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_MEM32_WIN_SIZE) >
4220                       SPAPR_PCI_MEM64_WIN_SIZE);
4221 
4222     if (index >= SPAPR_MAX_PHBS) {
4223         error_setg(errp, "\"index\" for PAPR PHB is too large (max %llu)",
4224                    SPAPR_MAX_PHBS - 1);
4225         return;
4226     }
4227 
4228     *buid = base_buid + index;
4229     for (i = 0; i < n_dma; ++i) {
4230         liobns[i] = SPAPR_PCI_LIOBN(index, i);
4231     }
4232 
4233     *pio = SPAPR_PCI_BASE + index * SPAPR_PCI_IO_WIN_SIZE;
4234     *mmio32 = SPAPR_PCI_BASE + (index + 1) * SPAPR_PCI_MEM32_WIN_SIZE;
4235     *mmio64 = SPAPR_PCI_BASE + (index + 1) * SPAPR_PCI_MEM64_WIN_SIZE;
4236 
4237     *nv2gpa = SPAPR_PCI_NV2RAM64_WIN_BASE + index * SPAPR_PCI_NV2RAM64_WIN_SIZE;
4238     *nv2atsd = SPAPR_PCI_NV2ATSD_WIN_BASE + index * SPAPR_PCI_NV2ATSD_WIN_SIZE;
4239 }
4240 
4241 static ICSState *spapr_ics_get(XICSFabric *dev, int irq)
4242 {
4243     SpaprMachineState *spapr = SPAPR_MACHINE(dev);
4244 
4245     return ics_valid_irq(spapr->ics, irq) ? spapr->ics : NULL;
4246 }
4247 
4248 static void spapr_ics_resend(XICSFabric *dev)
4249 {
4250     SpaprMachineState *spapr = SPAPR_MACHINE(dev);
4251 
4252     ics_resend(spapr->ics);
4253 }
4254 
4255 static ICPState *spapr_icp_get(XICSFabric *xi, int vcpu_id)
4256 {
4257     PowerPCCPU *cpu = spapr_find_cpu(vcpu_id);
4258 
4259     return cpu ? spapr_cpu_state(cpu)->icp : NULL;
4260 }
4261 
4262 static void spapr_pic_print_info(InterruptStatsProvider *obj,
4263                                  Monitor *mon)
4264 {
4265     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
4266 
4267     spapr->irq->print_info(spapr, mon);
4268 }
4269 
4270 int spapr_get_vcpu_id(PowerPCCPU *cpu)
4271 {
4272     return cpu->vcpu_id;
4273 }
4274 
4275 void spapr_set_vcpu_id(PowerPCCPU *cpu, int cpu_index, Error **errp)
4276 {
4277     SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
4278     MachineState *ms = MACHINE(spapr);
4279     int vcpu_id;
4280 
4281     vcpu_id = spapr_vcpu_id(spapr, cpu_index);
4282 
4283     if (kvm_enabled() && !kvm_vcpu_id_is_valid(vcpu_id)) {
4284         error_setg(errp, "Can't create CPU with id %d in KVM", vcpu_id);
4285         error_append_hint(errp, "Adjust the number of cpus to %d "
4286                           "or try to raise the number of threads per core\n",
4287                           vcpu_id * ms->smp.threads / spapr->vsmt);
4288         return;
4289     }
4290 
4291     cpu->vcpu_id = vcpu_id;
4292 }
4293 
4294 PowerPCCPU *spapr_find_cpu(int vcpu_id)
4295 {
4296     CPUState *cs;
4297 
4298     CPU_FOREACH(cs) {
4299         PowerPCCPU *cpu = POWERPC_CPU(cs);
4300 
4301         if (spapr_get_vcpu_id(cpu) == vcpu_id) {
4302             return cpu;
4303         }
4304     }
4305 
4306     return NULL;
4307 }
4308 
4309 static void spapr_machine_class_init(ObjectClass *oc, void *data)
4310 {
4311     MachineClass *mc = MACHINE_CLASS(oc);
4312     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(oc);
4313     FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);
4314     NMIClass *nc = NMI_CLASS(oc);
4315     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
4316     PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(oc);
4317     XICSFabricClass *xic = XICS_FABRIC_CLASS(oc);
4318     InterruptStatsProviderClass *ispc = INTERRUPT_STATS_PROVIDER_CLASS(oc);
4319 
4320     mc->desc = "pSeries Logical Partition (PAPR compliant)";
4321     mc->ignore_boot_device_suffixes = true;
4322 
4323     /*
4324      * We set up the default / latest behaviour here.  The class_init
4325      * functions for the specific versioned machine types can override
4326      * these details for backwards compatibility
4327      */
4328     mc->init = spapr_machine_init;
4329     mc->reset = spapr_machine_reset;
4330     mc->block_default_type = IF_SCSI;
4331     mc->max_cpus = 1024;
4332     mc->no_parallel = 1;
4333     mc->default_boot_order = "";
4334     mc->default_ram_size = 512 * MiB;
4335     mc->default_display = "std";
4336     mc->kvm_type = spapr_kvm_type;
4337     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_SPAPR_PCI_HOST_BRIDGE);
4338     mc->pci_allow_0_address = true;
4339     assert(!mc->get_hotplug_handler);
4340     mc->get_hotplug_handler = spapr_get_hotplug_handler;
4341     hc->pre_plug = spapr_machine_device_pre_plug;
4342     hc->plug = spapr_machine_device_plug;
4343     mc->cpu_index_to_instance_props = spapr_cpu_index_to_props;
4344     mc->get_default_cpu_node_id = spapr_get_default_cpu_node_id;
4345     mc->possible_cpu_arch_ids = spapr_possible_cpu_arch_ids;
4346     hc->unplug_request = spapr_machine_device_unplug_request;
4347     hc->unplug = spapr_machine_device_unplug;
4348 
4349     smc->dr_lmb_enabled = true;
4350     smc->update_dt_enabled = true;
4351     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power9_v2.0");
4352     mc->has_hotpluggable_cpus = true;
4353     smc->resize_hpt_default = SPAPR_RESIZE_HPT_ENABLED;
4354     fwc->get_dev_path = spapr_get_fw_dev_path;
4355     nc->nmi_monitor_handler = spapr_nmi;
4356     smc->phb_placement = spapr_phb_placement;
4357     vhc->hypercall = emulate_spapr_hypercall;
4358     vhc->hpt_mask = spapr_hpt_mask;
4359     vhc->map_hptes = spapr_map_hptes;
4360     vhc->unmap_hptes = spapr_unmap_hptes;
4361     vhc->hpte_set_c = spapr_hpte_set_c;
4362     vhc->hpte_set_r = spapr_hpte_set_r;
4363     vhc->get_pate = spapr_get_pate;
4364     vhc->encode_hpt_for_kvm_pr = spapr_encode_hpt_for_kvm_pr;
4365     xic->ics_get = spapr_ics_get;
4366     xic->ics_resend = spapr_ics_resend;
4367     xic->icp_get = spapr_icp_get;
4368     ispc->print_info = spapr_pic_print_info;
4369     /* Force NUMA node memory size to be a multiple of
4370      * SPAPR_MEMORY_BLOCK_SIZE (256M) since that's the granularity
4371      * in which LMBs are represented and hot-added
4372      */
4373     mc->numa_mem_align_shift = 28;
4374     mc->numa_mem_supported = true;
4375 
4376     smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_OFF;
4377     smc->default_caps.caps[SPAPR_CAP_VSX] = SPAPR_CAP_ON;
4378     smc->default_caps.caps[SPAPR_CAP_DFP] = SPAPR_CAP_ON;
4379     smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
4380     smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
4381     smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_WORKAROUND;
4382     smc->default_caps.caps[SPAPR_CAP_HPT_MAXPAGESIZE] = 16; /* 64kiB */
4383     smc->default_caps.caps[SPAPR_CAP_NESTED_KVM_HV] = SPAPR_CAP_OFF;
4384     smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_ON;
4385     smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
4386     spapr_caps_add_properties(smc, &error_abort);
4387     smc->irq = &spapr_irq_dual;
4388     smc->dr_phb_enabled = true;
4389 }
4390 
4391 static const TypeInfo spapr_machine_info = {
4392     .name          = TYPE_SPAPR_MACHINE,
4393     .parent        = TYPE_MACHINE,
4394     .abstract      = true,
4395     .instance_size = sizeof(SpaprMachineState),
4396     .instance_init = spapr_instance_init,
4397     .instance_finalize = spapr_machine_finalizefn,
4398     .class_size    = sizeof(SpaprMachineClass),
4399     .class_init    = spapr_machine_class_init,
4400     .interfaces = (InterfaceInfo[]) {
4401         { TYPE_FW_PATH_PROVIDER },
4402         { TYPE_NMI },
4403         { TYPE_HOTPLUG_HANDLER },
4404         { TYPE_PPC_VIRTUAL_HYPERVISOR },
4405         { TYPE_XICS_FABRIC },
4406         { TYPE_INTERRUPT_STATS_PROVIDER },
4407         { }
4408     },
4409 };
4410 
4411 #define DEFINE_SPAPR_MACHINE(suffix, verstr, latest)                 \
4412     static void spapr_machine_##suffix##_class_init(ObjectClass *oc, \
4413                                                     void *data)      \
4414     {                                                                \
4415         MachineClass *mc = MACHINE_CLASS(oc);                        \
4416         spapr_machine_##suffix##_class_options(mc);                  \
4417         if (latest) {                                                \
4418             mc->alias = "pseries";                                   \
4419             mc->is_default = 1;                                      \
4420         }                                                            \
4421     }                                                                \
4422     static const TypeInfo spapr_machine_##suffix##_info = {          \
4423         .name = MACHINE_TYPE_NAME("pseries-" verstr),                \
4424         .parent = TYPE_SPAPR_MACHINE,                                \
4425         .class_init = spapr_machine_##suffix##_class_init,           \
4426     };                                                               \
4427     static void spapr_machine_register_##suffix(void)                \
4428     {                                                                \
4429         type_register(&spapr_machine_##suffix##_info);               \
4430     }                                                                \
4431     type_init(spapr_machine_register_##suffix)
4432 
4433 /*
4434  * pseries-4.1
4435  */
4436 static void spapr_machine_4_1_class_options(MachineClass *mc)
4437 {
4438     /* Defaults for the latest behaviour inherited from the base class */
4439 }
4440 
4441 DEFINE_SPAPR_MACHINE(4_1, "4.1", true);
4442 
4443 /*
4444  * pseries-4.0
4445  */
4446 static void phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
4447                               uint64_t *buid, hwaddr *pio,
4448                               hwaddr *mmio32, hwaddr *mmio64,
4449                               unsigned n_dma, uint32_t *liobns,
4450                               hwaddr *nv2gpa, hwaddr *nv2atsd, Error **errp)
4451 {
4452     spapr_phb_placement(spapr, index, buid, pio, mmio32, mmio64, n_dma, liobns,
4453                         nv2gpa, nv2atsd, errp);
4454     *nv2gpa = 0;
4455     *nv2atsd = 0;
4456 }
4457 
4458 static void spapr_machine_4_0_class_options(MachineClass *mc)
4459 {
4460     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4461 
4462     spapr_machine_4_1_class_options(mc);
4463     compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
4464     smc->phb_placement = phb_placement_4_0;
4465     smc->irq = &spapr_irq_xics;
4466     smc->pre_4_1_migration = true;
4467 }
4468 
4469 DEFINE_SPAPR_MACHINE(4_0, "4.0", false);
4470 
4471 /*
4472  * pseries-3.1
4473  */
4474 static void spapr_machine_3_1_class_options(MachineClass *mc)
4475 {
4476     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4477 
4478     spapr_machine_4_0_class_options(mc);
4479     compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len);
4480 
4481     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power8_v2.0");
4482     smc->update_dt_enabled = false;
4483     smc->dr_phb_enabled = false;
4484     smc->broken_host_serial_model = true;
4485     smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_BROKEN;
4486     smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_BROKEN;
4487     smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_BROKEN;
4488     smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_OFF;
4489 }
4490 
4491 DEFINE_SPAPR_MACHINE(3_1, "3.1", false);
4492 
4493 /*
4494  * pseries-3.0
4495  */
4496 
4497 static void spapr_machine_3_0_class_options(MachineClass *mc)
4498 {
4499     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4500 
4501     spapr_machine_3_1_class_options(mc);
4502     compat_props_add(mc->compat_props, hw_compat_3_0, hw_compat_3_0_len);
4503 
4504     smc->legacy_irq_allocation = true;
4505     smc->irq = &spapr_irq_xics_legacy;
4506 }
4507 
4508 DEFINE_SPAPR_MACHINE(3_0, "3.0", false);
4509 
4510 /*
4511  * pseries-2.12
4512  */
4513 static void spapr_machine_2_12_class_options(MachineClass *mc)
4514 {
4515     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4516     static GlobalProperty compat[] = {
4517         { TYPE_POWERPC_CPU, "pre-3.0-migration", "on" },
4518         { TYPE_SPAPR_CPU_CORE, "pre-3.0-migration", "on" },
4519     };
4520 
4521     spapr_machine_3_0_class_options(mc);
4522     compat_props_add(mc->compat_props, hw_compat_2_12, hw_compat_2_12_len);
4523     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4524 
4525     /* We depend on kvm_enabled() to choose a default value for the
4526      * hpt-max-page-size capability. Of course we can't do it here
4527      * because this is too early and the HW accelerator isn't initialzed
4528      * yet. Postpone this to machine init (see default_caps_with_cpu()).
4529      */
4530     smc->default_caps.caps[SPAPR_CAP_HPT_MAXPAGESIZE] = 0;
4531 }
4532 
4533 DEFINE_SPAPR_MACHINE(2_12, "2.12", false);
4534 
4535 static void spapr_machine_2_12_sxxm_class_options(MachineClass *mc)
4536 {
4537     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4538 
4539     spapr_machine_2_12_class_options(mc);
4540     smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
4541     smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
4542     smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_FIXED_CCD;
4543 }
4544 
4545 DEFINE_SPAPR_MACHINE(2_12_sxxm, "2.12-sxxm", false);
4546 
4547 /*
4548  * pseries-2.11
4549  */
4550 
4551 static void spapr_machine_2_11_class_options(MachineClass *mc)
4552 {
4553     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4554 
4555     spapr_machine_2_12_class_options(mc);
4556     smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_ON;
4557     compat_props_add(mc->compat_props, hw_compat_2_11, hw_compat_2_11_len);
4558 }
4559 
4560 DEFINE_SPAPR_MACHINE(2_11, "2.11", false);
4561 
4562 /*
4563  * pseries-2.10
4564  */
4565 
4566 static void spapr_machine_2_10_class_options(MachineClass *mc)
4567 {
4568     spapr_machine_2_11_class_options(mc);
4569     compat_props_add(mc->compat_props, hw_compat_2_10, hw_compat_2_10_len);
4570 }
4571 
4572 DEFINE_SPAPR_MACHINE(2_10, "2.10", false);
4573 
4574 /*
4575  * pseries-2.9
4576  */
4577 
4578 static void spapr_machine_2_9_class_options(MachineClass *mc)
4579 {
4580     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4581     static GlobalProperty compat[] = {
4582         { TYPE_POWERPC_CPU, "pre-2.10-migration", "on" },
4583     };
4584 
4585     spapr_machine_2_10_class_options(mc);
4586     compat_props_add(mc->compat_props, hw_compat_2_9, hw_compat_2_9_len);
4587     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4588     mc->numa_auto_assign_ram = numa_legacy_auto_assign_ram;
4589     smc->pre_2_10_has_unused_icps = true;
4590     smc->resize_hpt_default = SPAPR_RESIZE_HPT_DISABLED;
4591 }
4592 
4593 DEFINE_SPAPR_MACHINE(2_9, "2.9", false);
4594 
4595 /*
4596  * pseries-2.8
4597  */
4598 
4599 static void spapr_machine_2_8_class_options(MachineClass *mc)
4600 {
4601     static GlobalProperty compat[] = {
4602         { TYPE_SPAPR_PCI_HOST_BRIDGE, "pcie-extended-configuration-space", "off" },
4603     };
4604 
4605     spapr_machine_2_9_class_options(mc);
4606     compat_props_add(mc->compat_props, hw_compat_2_8, hw_compat_2_8_len);
4607     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4608     mc->numa_mem_align_shift = 23;
4609 }
4610 
4611 DEFINE_SPAPR_MACHINE(2_8, "2.8", false);
4612 
4613 /*
4614  * pseries-2.7
4615  */
4616 
4617 static void phb_placement_2_7(SpaprMachineState *spapr, uint32_t index,
4618                               uint64_t *buid, hwaddr *pio,
4619                               hwaddr *mmio32, hwaddr *mmio64,
4620                               unsigned n_dma, uint32_t *liobns,
4621                               hwaddr *nv2gpa, hwaddr *nv2atsd, Error **errp)
4622 {
4623     /* Legacy PHB placement for pseries-2.7 and earlier machine types */
4624     const uint64_t base_buid = 0x800000020000000ULL;
4625     const hwaddr phb_spacing = 0x1000000000ULL; /* 64 GiB */
4626     const hwaddr mmio_offset = 0xa0000000; /* 2 GiB + 512 MiB */
4627     const hwaddr pio_offset = 0x80000000; /* 2 GiB */
4628     const uint32_t max_index = 255;
4629     const hwaddr phb0_alignment = 0x10000000000ULL; /* 1 TiB */
4630 
4631     uint64_t ram_top = MACHINE(spapr)->ram_size;
4632     hwaddr phb0_base, phb_base;
4633     int i;
4634 
4635     /* Do we have device memory? */
4636     if (MACHINE(spapr)->maxram_size > ram_top) {
4637         /* Can't just use maxram_size, because there may be an
4638          * alignment gap between normal and device memory regions
4639          */
4640         ram_top = MACHINE(spapr)->device_memory->base +
4641             memory_region_size(&MACHINE(spapr)->device_memory->mr);
4642     }
4643 
4644     phb0_base = QEMU_ALIGN_UP(ram_top, phb0_alignment);
4645 
4646     if (index > max_index) {
4647         error_setg(errp, "\"index\" for PAPR PHB is too large (max %u)",
4648                    max_index);
4649         return;
4650     }
4651 
4652     *buid = base_buid + index;
4653     for (i = 0; i < n_dma; ++i) {
4654         liobns[i] = SPAPR_PCI_LIOBN(index, i);
4655     }
4656 
4657     phb_base = phb0_base + index * phb_spacing;
4658     *pio = phb_base + pio_offset;
4659     *mmio32 = phb_base + mmio_offset;
4660     /*
4661      * We don't set the 64-bit MMIO window, relying on the PHB's
4662      * fallback behaviour of automatically splitting a large "32-bit"
4663      * window into contiguous 32-bit and 64-bit windows
4664      */
4665 
4666     *nv2gpa = 0;
4667     *nv2atsd = 0;
4668 }
4669 
4670 static void spapr_machine_2_7_class_options(MachineClass *mc)
4671 {
4672     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4673     static GlobalProperty compat[] = {
4674         { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0xf80000000", },
4675         { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem64_win_size", "0", },
4676         { TYPE_POWERPC_CPU, "pre-2.8-migration", "on", },
4677         { TYPE_SPAPR_PCI_HOST_BRIDGE, "pre-2.8-migration", "on", },
4678     };
4679 
4680     spapr_machine_2_8_class_options(mc);
4681     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power7_v2.3");
4682     mc->default_machine_opts = "modern-hotplug-events=off";
4683     compat_props_add(mc->compat_props, hw_compat_2_7, hw_compat_2_7_len);
4684     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4685     smc->phb_placement = phb_placement_2_7;
4686 }
4687 
4688 DEFINE_SPAPR_MACHINE(2_7, "2.7", false);
4689 
4690 /*
4691  * pseries-2.6
4692  */
4693 
4694 static void spapr_machine_2_6_class_options(MachineClass *mc)
4695 {
4696     static GlobalProperty compat[] = {
4697         { TYPE_SPAPR_PCI_HOST_BRIDGE, "ddw", "off" },
4698     };
4699 
4700     spapr_machine_2_7_class_options(mc);
4701     mc->has_hotpluggable_cpus = false;
4702     compat_props_add(mc->compat_props, hw_compat_2_6, hw_compat_2_6_len);
4703     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4704 }
4705 
4706 DEFINE_SPAPR_MACHINE(2_6, "2.6", false);
4707 
4708 /*
4709  * pseries-2.5
4710  */
4711 
4712 static void spapr_machine_2_5_class_options(MachineClass *mc)
4713 {
4714     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4715     static GlobalProperty compat[] = {
4716         { "spapr-vlan", "use-rx-buffer-pools", "off" },
4717     };
4718 
4719     spapr_machine_2_6_class_options(mc);
4720     smc->use_ohci_by_default = true;
4721     compat_props_add(mc->compat_props, hw_compat_2_5, hw_compat_2_5_len);
4722     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4723 }
4724 
4725 DEFINE_SPAPR_MACHINE(2_5, "2.5", false);
4726 
4727 /*
4728  * pseries-2.4
4729  */
4730 
4731 static void spapr_machine_2_4_class_options(MachineClass *mc)
4732 {
4733     SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4734 
4735     spapr_machine_2_5_class_options(mc);
4736     smc->dr_lmb_enabled = false;
4737     compat_props_add(mc->compat_props, hw_compat_2_4, hw_compat_2_4_len);
4738 }
4739 
4740 DEFINE_SPAPR_MACHINE(2_4, "2.4", false);
4741 
4742 /*
4743  * pseries-2.3
4744  */
4745 
4746 static void spapr_machine_2_3_class_options(MachineClass *mc)
4747 {
4748     static GlobalProperty compat[] = {
4749         { "spapr-pci-host-bridge", "dynamic-reconfiguration", "off" },
4750     };
4751     spapr_machine_2_4_class_options(mc);
4752     compat_props_add(mc->compat_props, hw_compat_2_3, hw_compat_2_3_len);
4753     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4754 }
4755 DEFINE_SPAPR_MACHINE(2_3, "2.3", false);
4756 
4757 /*
4758  * pseries-2.2
4759  */
4760 
4761 static void spapr_machine_2_2_class_options(MachineClass *mc)
4762 {
4763     static GlobalProperty compat[] = {
4764         { TYPE_SPAPR_PCI_HOST_BRIDGE, "mem_win_size", "0x20000000" },
4765     };
4766 
4767     spapr_machine_2_3_class_options(mc);
4768     compat_props_add(mc->compat_props, hw_compat_2_2, hw_compat_2_2_len);
4769     compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
4770     mc->default_machine_opts = "modern-hotplug-events=off,suppress-vmdesc=on";
4771 }
4772 DEFINE_SPAPR_MACHINE(2_2, "2.2", false);
4773 
4774 /*
4775  * pseries-2.1
4776  */
4777 
4778 static void spapr_machine_2_1_class_options(MachineClass *mc)
4779 {
4780     spapr_machine_2_2_class_options(mc);
4781     compat_props_add(mc->compat_props, hw_compat_2_1, hw_compat_2_1_len);
4782 }
4783 DEFINE_SPAPR_MACHINE(2_1, "2.1", false);
4784 
4785 static void spapr_machine_register_types(void)
4786 {
4787     type_register_static(&spapr_machine_info);
4788 }
4789 
4790 type_init(spapr_machine_register_types)
4791