xref: /openbmc/qemu/hw/ppc/spapr_hcall.c (revision e6a19a64)
1 #include "qemu/osdep.h"
2 #include "qemu/cutils.h"
3 #include "qapi/error.h"
4 #include "sysemu/hw_accel.h"
5 #include "sysemu/runstate.h"
6 #include "sysemu/tcg.h"
7 #include "qemu/log.h"
8 #include "qemu/main-loop.h"
9 #include "qemu/module.h"
10 #include "qemu/error-report.h"
11 #include "exec/exec-all.h"
12 #include "exec/tb-flush.h"
13 #include "helper_regs.h"
14 #include "hw/ppc/ppc.h"
15 #include "hw/ppc/spapr.h"
16 #include "hw/ppc/spapr_cpu_core.h"
17 #include "hw/ppc/spapr_nested.h"
18 #include "mmu-hash64.h"
19 #include "cpu-models.h"
20 #include "trace.h"
21 #include "kvm_ppc.h"
22 #include "hw/ppc/fdt.h"
23 #include "hw/ppc/spapr_ovec.h"
24 #include "hw/ppc/spapr_numa.h"
25 #include "mmu-book3s-v3.h"
26 #include "hw/mem/memory-device.h"
27 
28 bool is_ram_address(SpaprMachineState *spapr, hwaddr addr)
29 {
30     MachineState *machine = MACHINE(spapr);
31     DeviceMemoryState *dms = machine->device_memory;
32 
33     if (addr < machine->ram_size) {
34         return true;
35     }
36     if (dms && (addr >= dms->base)
37         && ((addr - dms->base) < memory_region_size(&dms->mr))) {
38         return true;
39     }
40 
41     return false;
42 }
43 
44 /* Convert a return code from the KVM ioctl()s implementing resize HPT
45  * into a PAPR hypercall return code */
46 static target_ulong resize_hpt_convert_rc(int ret)
47 {
48     if (ret >= 100000) {
49         return H_LONG_BUSY_ORDER_100_SEC;
50     } else if (ret >= 10000) {
51         return H_LONG_BUSY_ORDER_10_SEC;
52     } else if (ret >= 1000) {
53         return H_LONG_BUSY_ORDER_1_SEC;
54     } else if (ret >= 100) {
55         return H_LONG_BUSY_ORDER_100_MSEC;
56     } else if (ret >= 10) {
57         return H_LONG_BUSY_ORDER_10_MSEC;
58     } else if (ret > 0) {
59         return H_LONG_BUSY_ORDER_1_MSEC;
60     }
61 
62     switch (ret) {
63     case 0:
64         return H_SUCCESS;
65     case -EPERM:
66         return H_AUTHORITY;
67     case -EINVAL:
68         return H_PARAMETER;
69     case -ENXIO:
70         return H_CLOSED;
71     case -ENOSPC:
72         return H_PTEG_FULL;
73     case -EBUSY:
74         return H_BUSY;
75     case -ENOMEM:
76         return H_NO_MEM;
77     default:
78         return H_HARDWARE;
79     }
80 }
81 
82 static target_ulong h_resize_hpt_prepare(PowerPCCPU *cpu,
83                                          SpaprMachineState *spapr,
84                                          target_ulong opcode,
85                                          target_ulong *args)
86 {
87     target_ulong flags = args[0];
88     int shift = args[1];
89     uint64_t current_ram_size;
90     int rc;
91 
92     if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
93         return H_AUTHORITY;
94     }
95 
96     if (!spapr->htab_shift) {
97         /* Radix guest, no HPT */
98         return H_NOT_AVAILABLE;
99     }
100 
101     trace_spapr_h_resize_hpt_prepare(flags, shift);
102 
103     if (flags != 0) {
104         return H_PARAMETER;
105     }
106 
107     if (shift && ((shift < 18) || (shift > 46))) {
108         return H_PARAMETER;
109     }
110 
111     current_ram_size = MACHINE(spapr)->ram_size + get_plugged_memory_size();
112 
113     /* We only allow the guest to allocate an HPT one order above what
114      * we'd normally give them (to stop a small guest claiming a huge
115      * chunk of resources in the HPT */
116     if (shift > (spapr_hpt_shift_for_ramsize(current_ram_size) + 1)) {
117         return H_RESOURCE;
118     }
119 
120     rc = kvmppc_resize_hpt_prepare(cpu, flags, shift);
121     if (rc != -ENOSYS) {
122         return resize_hpt_convert_rc(rc);
123     }
124 
125     if (kvm_enabled()) {
126         return H_HARDWARE;
127     }
128 
129     return softmmu_resize_hpt_prepare(cpu, spapr, shift);
130 }
131 
132 static void do_push_sregs_to_kvm_pr(CPUState *cs, run_on_cpu_data data)
133 {
134     int ret;
135 
136     cpu_synchronize_state(cs);
137 
138     ret = kvmppc_put_books_sregs(POWERPC_CPU(cs));
139     if (ret < 0) {
140         error_report("failed to push sregs to KVM: %s", strerror(-ret));
141         exit(1);
142     }
143 }
144 
145 void push_sregs_to_kvm_pr(SpaprMachineState *spapr)
146 {
147     CPUState *cs;
148 
149     /*
150      * This is a hack for the benefit of KVM PR - it abuses the SDR1
151      * slot in kvm_sregs to communicate the userspace address of the
152      * HPT
153      */
154     if (!kvm_enabled() || !spapr->htab) {
155         return;
156     }
157 
158     CPU_FOREACH(cs) {
159         run_on_cpu(cs, do_push_sregs_to_kvm_pr, RUN_ON_CPU_NULL);
160     }
161 }
162 
163 static target_ulong h_resize_hpt_commit(PowerPCCPU *cpu,
164                                         SpaprMachineState *spapr,
165                                         target_ulong opcode,
166                                         target_ulong *args)
167 {
168     target_ulong flags = args[0];
169     target_ulong shift = args[1];
170     int rc;
171 
172     if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
173         return H_AUTHORITY;
174     }
175 
176     if (!spapr->htab_shift) {
177         /* Radix guest, no HPT */
178         return H_NOT_AVAILABLE;
179     }
180 
181     trace_spapr_h_resize_hpt_commit(flags, shift);
182 
183     rc = kvmppc_resize_hpt_commit(cpu, flags, shift);
184     if (rc != -ENOSYS) {
185         rc = resize_hpt_convert_rc(rc);
186         if (rc == H_SUCCESS) {
187             /* Need to set the new htab_shift in the machine state */
188             spapr->htab_shift = shift;
189         }
190         return rc;
191     }
192 
193     if (kvm_enabled()) {
194         return H_HARDWARE;
195     }
196 
197     return softmmu_resize_hpt_commit(cpu, spapr, flags, shift);
198 }
199 
200 
201 
202 static target_ulong h_set_sprg0(PowerPCCPU *cpu, SpaprMachineState *spapr,
203                                 target_ulong opcode, target_ulong *args)
204 {
205     cpu_synchronize_state(CPU(cpu));
206     cpu->env.spr[SPR_SPRG0] = args[0];
207 
208     return H_SUCCESS;
209 }
210 
211 static target_ulong h_set_dabr(PowerPCCPU *cpu, SpaprMachineState *spapr,
212                                target_ulong opcode, target_ulong *args)
213 {
214     if (!ppc_has_spr(cpu, SPR_DABR)) {
215         return H_HARDWARE;              /* DABR register not available */
216     }
217     cpu_synchronize_state(CPU(cpu));
218 
219     if (ppc_has_spr(cpu, SPR_DABRX)) {
220         cpu->env.spr[SPR_DABRX] = 0x3;  /* Use Problem and Privileged state */
221     } else if (!(args[0] & 0x4)) {      /* Breakpoint Translation set? */
222         return H_RESERVED_DABR;
223     }
224 
225     cpu->env.spr[SPR_DABR] = args[0];
226     return H_SUCCESS;
227 }
228 
229 static target_ulong h_set_xdabr(PowerPCCPU *cpu, SpaprMachineState *spapr,
230                                 target_ulong opcode, target_ulong *args)
231 {
232     target_ulong dabrx = args[1];
233 
234     if (!ppc_has_spr(cpu, SPR_DABR) || !ppc_has_spr(cpu, SPR_DABRX)) {
235         return H_HARDWARE;
236     }
237 
238     if ((dabrx & ~0xfULL) != 0 || (dabrx & H_DABRX_HYPERVISOR) != 0
239         || (dabrx & (H_DABRX_KERNEL | H_DABRX_USER)) == 0) {
240         return H_PARAMETER;
241     }
242 
243     cpu_synchronize_state(CPU(cpu));
244     cpu->env.spr[SPR_DABRX] = dabrx;
245     cpu->env.spr[SPR_DABR] = args[0];
246 
247     return H_SUCCESS;
248 }
249 
250 static target_ulong h_page_init(PowerPCCPU *cpu, SpaprMachineState *spapr,
251                                 target_ulong opcode, target_ulong *args)
252 {
253     target_ulong flags = args[0];
254     hwaddr dst = args[1];
255     hwaddr src = args[2];
256     hwaddr len = TARGET_PAGE_SIZE;
257     uint8_t *pdst, *psrc;
258     target_long ret = H_SUCCESS;
259 
260     if (flags & ~(H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE
261                   | H_COPY_PAGE | H_ZERO_PAGE)) {
262         qemu_log_mask(LOG_UNIMP, "h_page_init: Bad flags (" TARGET_FMT_lx "\n",
263                       flags);
264         return H_PARAMETER;
265     }
266 
267     /* Map-in destination */
268     if (!is_ram_address(spapr, dst) || (dst & ~TARGET_PAGE_MASK) != 0) {
269         return H_PARAMETER;
270     }
271     pdst = cpu_physical_memory_map(dst, &len, true);
272     if (!pdst || len != TARGET_PAGE_SIZE) {
273         return H_PARAMETER;
274     }
275 
276     if (flags & H_COPY_PAGE) {
277         /* Map-in source, copy to destination, and unmap source again */
278         if (!is_ram_address(spapr, src) || (src & ~TARGET_PAGE_MASK) != 0) {
279             ret = H_PARAMETER;
280             goto unmap_out;
281         }
282         psrc = cpu_physical_memory_map(src, &len, false);
283         if (!psrc || len != TARGET_PAGE_SIZE) {
284             ret = H_PARAMETER;
285             goto unmap_out;
286         }
287         memcpy(pdst, psrc, len);
288         cpu_physical_memory_unmap(psrc, len, 0, len);
289     } else if (flags & H_ZERO_PAGE) {
290         memset(pdst, 0, len);          /* Just clear the destination page */
291     }
292 
293     if (kvm_enabled() && (flags & H_ICACHE_SYNCHRONIZE) != 0) {
294         kvmppc_dcbst_range(cpu, pdst, len);
295     }
296     if (flags & (H_ICACHE_SYNCHRONIZE | H_ICACHE_INVALIDATE)) {
297         if (kvm_enabled()) {
298             kvmppc_icbi_range(cpu, pdst, len);
299         } else {
300             tb_flush(CPU(cpu));
301         }
302     }
303 
304 unmap_out:
305     cpu_physical_memory_unmap(pdst, TARGET_PAGE_SIZE, 1, len);
306     return ret;
307 }
308 
309 #define FLAGS_REGISTER_VPA         0x0000200000000000ULL
310 #define FLAGS_REGISTER_DTL         0x0000400000000000ULL
311 #define FLAGS_REGISTER_SLBSHADOW   0x0000600000000000ULL
312 #define FLAGS_DEREGISTER_VPA       0x0000a00000000000ULL
313 #define FLAGS_DEREGISTER_DTL       0x0000c00000000000ULL
314 #define FLAGS_DEREGISTER_SLBSHADOW 0x0000e00000000000ULL
315 
316 static target_ulong register_vpa(PowerPCCPU *cpu, target_ulong vpa)
317 {
318     CPUState *cs = CPU(cpu);
319     CPUPPCState *env = &cpu->env;
320     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
321     uint16_t size;
322     uint8_t tmp;
323 
324     if (vpa == 0) {
325         hcall_dprintf("Can't cope with registering a VPA at logical 0\n");
326         return H_HARDWARE;
327     }
328 
329     if (vpa % env->dcache_line_size) {
330         return H_PARAMETER;
331     }
332     /* FIXME: bounds check the address */
333 
334     size = lduw_be_phys(cs->as, vpa + 0x4);
335 
336     if (size < VPA_MIN_SIZE) {
337         return H_PARAMETER;
338     }
339 
340     /* VPA is not allowed to cross a page boundary */
341     if ((vpa / 4096) != ((vpa + size - 1) / 4096)) {
342         return H_PARAMETER;
343     }
344 
345     spapr_cpu->vpa_addr = vpa;
346 
347     tmp = ldub_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET);
348     tmp |= VPA_SHARED_PROC_VAL;
349     stb_phys(cs->as, spapr_cpu->vpa_addr + VPA_SHARED_PROC_OFFSET, tmp);
350 
351     return H_SUCCESS;
352 }
353 
354 static target_ulong deregister_vpa(PowerPCCPU *cpu, target_ulong vpa)
355 {
356     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
357 
358     if (spapr_cpu->slb_shadow_addr) {
359         return H_RESOURCE;
360     }
361 
362     if (spapr_cpu->dtl_addr) {
363         return H_RESOURCE;
364     }
365 
366     spapr_cpu->vpa_addr = 0;
367     return H_SUCCESS;
368 }
369 
370 static target_ulong register_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
371 {
372     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
373     uint32_t size;
374 
375     if (addr == 0) {
376         hcall_dprintf("Can't cope with SLB shadow at logical 0\n");
377         return H_HARDWARE;
378     }
379 
380     size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
381     if (size < 0x8) {
382         return H_PARAMETER;
383     }
384 
385     if ((addr / 4096) != ((addr + size - 1) / 4096)) {
386         return H_PARAMETER;
387     }
388 
389     if (!spapr_cpu->vpa_addr) {
390         return H_RESOURCE;
391     }
392 
393     spapr_cpu->slb_shadow_addr = addr;
394     spapr_cpu->slb_shadow_size = size;
395 
396     return H_SUCCESS;
397 }
398 
399 static target_ulong deregister_slb_shadow(PowerPCCPU *cpu, target_ulong addr)
400 {
401     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
402 
403     spapr_cpu->slb_shadow_addr = 0;
404     spapr_cpu->slb_shadow_size = 0;
405     return H_SUCCESS;
406 }
407 
408 static target_ulong register_dtl(PowerPCCPU *cpu, target_ulong addr)
409 {
410     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
411     uint32_t size;
412 
413     if (addr == 0) {
414         hcall_dprintf("Can't cope with DTL at logical 0\n");
415         return H_HARDWARE;
416     }
417 
418     size = ldl_be_phys(CPU(cpu)->as, addr + 0x4);
419 
420     if (size < 48) {
421         return H_PARAMETER;
422     }
423 
424     if (!spapr_cpu->vpa_addr) {
425         return H_RESOURCE;
426     }
427 
428     spapr_cpu->dtl_addr = addr;
429     spapr_cpu->dtl_size = size;
430 
431     return H_SUCCESS;
432 }
433 
434 static target_ulong deregister_dtl(PowerPCCPU *cpu, target_ulong addr)
435 {
436     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
437 
438     spapr_cpu->dtl_addr = 0;
439     spapr_cpu->dtl_size = 0;
440 
441     return H_SUCCESS;
442 }
443 
444 static target_ulong h_register_vpa(PowerPCCPU *cpu, SpaprMachineState *spapr,
445                                    target_ulong opcode, target_ulong *args)
446 {
447     target_ulong flags = args[0];
448     target_ulong procno = args[1];
449     target_ulong vpa = args[2];
450     target_ulong ret = H_PARAMETER;
451     PowerPCCPU *tcpu;
452 
453     tcpu = spapr_find_cpu(procno);
454     if (!tcpu) {
455         return H_PARAMETER;
456     }
457 
458     switch (flags) {
459     case FLAGS_REGISTER_VPA:
460         ret = register_vpa(tcpu, vpa);
461         break;
462 
463     case FLAGS_DEREGISTER_VPA:
464         ret = deregister_vpa(tcpu, vpa);
465         break;
466 
467     case FLAGS_REGISTER_SLBSHADOW:
468         ret = register_slb_shadow(tcpu, vpa);
469         break;
470 
471     case FLAGS_DEREGISTER_SLBSHADOW:
472         ret = deregister_slb_shadow(tcpu, vpa);
473         break;
474 
475     case FLAGS_REGISTER_DTL:
476         ret = register_dtl(tcpu, vpa);
477         break;
478 
479     case FLAGS_DEREGISTER_DTL:
480         ret = deregister_dtl(tcpu, vpa);
481         break;
482     }
483 
484     return ret;
485 }
486 
487 static target_ulong h_cede(PowerPCCPU *cpu, SpaprMachineState *spapr,
488                            target_ulong opcode, target_ulong *args)
489 {
490     CPUPPCState *env = &cpu->env;
491     CPUState *cs = CPU(cpu);
492     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
493 
494     env->msr |= (1ULL << MSR_EE);
495     hreg_compute_hflags(env);
496     ppc_maybe_interrupt(env);
497 
498     if (spapr_cpu->prod) {
499         spapr_cpu->prod = false;
500         return H_SUCCESS;
501     }
502 
503     if (!cpu_has_work(cs)) {
504         cs->halted = 1;
505         cs->exception_index = EXCP_HLT;
506         cs->exit_request = 1;
507         ppc_maybe_interrupt(env);
508     }
509 
510     return H_SUCCESS;
511 }
512 
513 /*
514  * Confer to self, aka join. Cede could use the same pattern as well, if
515  * EXCP_HLT can be changed to ECXP_HALTED.
516  */
517 static target_ulong h_confer_self(PowerPCCPU *cpu)
518 {
519     CPUState *cs = CPU(cpu);
520     SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
521 
522     if (spapr_cpu->prod) {
523         spapr_cpu->prod = false;
524         return H_SUCCESS;
525     }
526     cs->halted = 1;
527     cs->exception_index = EXCP_HALTED;
528     cs->exit_request = 1;
529     ppc_maybe_interrupt(&cpu->env);
530 
531     return H_SUCCESS;
532 }
533 
534 static target_ulong h_join(PowerPCCPU *cpu, SpaprMachineState *spapr,
535                            target_ulong opcode, target_ulong *args)
536 {
537     CPUPPCState *env = &cpu->env;
538     CPUState *cs;
539     bool last_unjoined = true;
540 
541     if (env->msr & (1ULL << MSR_EE)) {
542         return H_BAD_MODE;
543     }
544 
545     /*
546      * Must not join the last CPU running. Interestingly, no such restriction
547      * for H_CONFER-to-self, but that is probably not intended to be used
548      * when H_JOIN is available.
549      */
550     CPU_FOREACH(cs) {
551         PowerPCCPU *c = POWERPC_CPU(cs);
552         CPUPPCState *e = &c->env;
553         if (c == cpu) {
554             continue;
555         }
556 
557         /* Don't have a way to indicate joined, so use halted && MSR[EE]=0 */
558         if (!cs->halted || (e->msr & (1ULL << MSR_EE))) {
559             last_unjoined = false;
560             break;
561         }
562     }
563     if (last_unjoined) {
564         return H_CONTINUE;
565     }
566 
567     return h_confer_self(cpu);
568 }
569 
570 static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
571                            target_ulong opcode, target_ulong *args)
572 {
573     target_long target = args[0];
574     uint32_t dispatch = args[1];
575     CPUState *cs = CPU(cpu);
576     SpaprCpuState *spapr_cpu;
577 
578     /*
579      * -1 means confer to all other CPUs without dispatch counter check,
580      *  otherwise it's a targeted confer.
581      */
582     if (target != -1) {
583         PowerPCCPU *target_cpu = spapr_find_cpu(target);
584         uint32_t target_dispatch;
585 
586         if (!target_cpu) {
587             return H_PARAMETER;
588         }
589 
590         /*
591          * target == self is a special case, we wait until prodded, without
592          * dispatch counter check.
593          */
594         if (cpu == target_cpu) {
595             return h_confer_self(cpu);
596         }
597 
598         spapr_cpu = spapr_cpu_state(target_cpu);
599         if (!spapr_cpu->vpa_addr || ((dispatch & 1) == 0)) {
600             return H_SUCCESS;
601         }
602 
603         target_dispatch = ldl_be_phys(cs->as,
604                                   spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
605         if (target_dispatch != dispatch) {
606             return H_SUCCESS;
607         }
608 
609         /*
610          * The targeted confer does not do anything special beyond yielding
611          * the current vCPU, but even this should be better than nothing.
612          * At least for single-threaded tcg, it gives the target a chance to
613          * run before we run again. Multi-threaded tcg does not really do
614          * anything with EXCP_YIELD yet.
615          */
616     }
617 
618     cs->exception_index = EXCP_YIELD;
619     cs->exit_request = 1;
620     cpu_loop_exit(cs);
621 
622     return H_SUCCESS;
623 }
624 
625 static target_ulong h_prod(PowerPCCPU *cpu, SpaprMachineState *spapr,
626                            target_ulong opcode, target_ulong *args)
627 {
628     target_long target = args[0];
629     PowerPCCPU *tcpu;
630     CPUState *cs;
631     SpaprCpuState *spapr_cpu;
632 
633     tcpu = spapr_find_cpu(target);
634     cs = CPU(tcpu);
635     if (!cs) {
636         return H_PARAMETER;
637     }
638 
639     spapr_cpu = spapr_cpu_state(tcpu);
640     spapr_cpu->prod = true;
641     cs->halted = 0;
642     ppc_maybe_interrupt(&cpu->env);
643     qemu_cpu_kick(cs);
644 
645     return H_SUCCESS;
646 }
647 
648 static target_ulong h_rtas(PowerPCCPU *cpu, SpaprMachineState *spapr,
649                            target_ulong opcode, target_ulong *args)
650 {
651     target_ulong rtas_r3 = args[0];
652     uint32_t token = rtas_ld(rtas_r3, 0);
653     uint32_t nargs = rtas_ld(rtas_r3, 1);
654     uint32_t nret = rtas_ld(rtas_r3, 2);
655 
656     return spapr_rtas_call(cpu, spapr, token, nargs, rtas_r3 + 12,
657                            nret, rtas_r3 + 12 + 4*nargs);
658 }
659 
660 static target_ulong h_logical_load(PowerPCCPU *cpu, SpaprMachineState *spapr,
661                                    target_ulong opcode, target_ulong *args)
662 {
663     CPUState *cs = CPU(cpu);
664     target_ulong size = args[0];
665     target_ulong addr = args[1];
666 
667     switch (size) {
668     case 1:
669         args[0] = ldub_phys(cs->as, addr);
670         return H_SUCCESS;
671     case 2:
672         args[0] = lduw_phys(cs->as, addr);
673         return H_SUCCESS;
674     case 4:
675         args[0] = ldl_phys(cs->as, addr);
676         return H_SUCCESS;
677     case 8:
678         args[0] = ldq_phys(cs->as, addr);
679         return H_SUCCESS;
680     }
681     return H_PARAMETER;
682 }
683 
684 static target_ulong h_logical_store(PowerPCCPU *cpu, SpaprMachineState *spapr,
685                                     target_ulong opcode, target_ulong *args)
686 {
687     CPUState *cs = CPU(cpu);
688 
689     target_ulong size = args[0];
690     target_ulong addr = args[1];
691     target_ulong val  = args[2];
692 
693     switch (size) {
694     case 1:
695         stb_phys(cs->as, addr, val);
696         return H_SUCCESS;
697     case 2:
698         stw_phys(cs->as, addr, val);
699         return H_SUCCESS;
700     case 4:
701         stl_phys(cs->as, addr, val);
702         return H_SUCCESS;
703     case 8:
704         stq_phys(cs->as, addr, val);
705         return H_SUCCESS;
706     }
707     return H_PARAMETER;
708 }
709 
710 static target_ulong h_logical_memop(PowerPCCPU *cpu, SpaprMachineState *spapr,
711                                     target_ulong opcode, target_ulong *args)
712 {
713     CPUState *cs = CPU(cpu);
714 
715     target_ulong dst   = args[0]; /* Destination address */
716     target_ulong src   = args[1]; /* Source address */
717     target_ulong esize = args[2]; /* Element size (0=1,1=2,2=4,3=8) */
718     target_ulong count = args[3]; /* Element count */
719     target_ulong op    = args[4]; /* 0 = copy, 1 = invert */
720     uint64_t tmp;
721     unsigned int mask = (1 << esize) - 1;
722     int step = 1 << esize;
723 
724     if (count > 0x80000000) {
725         return H_PARAMETER;
726     }
727 
728     if ((dst & mask) || (src & mask) || (op > 1)) {
729         return H_PARAMETER;
730     }
731 
732     if (dst >= src && dst < (src + (count << esize))) {
733             dst = dst + ((count - 1) << esize);
734             src = src + ((count - 1) << esize);
735             step = -step;
736     }
737 
738     while (count--) {
739         switch (esize) {
740         case 0:
741             tmp = ldub_phys(cs->as, src);
742             break;
743         case 1:
744             tmp = lduw_phys(cs->as, src);
745             break;
746         case 2:
747             tmp = ldl_phys(cs->as, src);
748             break;
749         case 3:
750             tmp = ldq_phys(cs->as, src);
751             break;
752         default:
753             return H_PARAMETER;
754         }
755         if (op == 1) {
756             tmp = ~tmp;
757         }
758         switch (esize) {
759         case 0:
760             stb_phys(cs->as, dst, tmp);
761             break;
762         case 1:
763             stw_phys(cs->as, dst, tmp);
764             break;
765         case 2:
766             stl_phys(cs->as, dst, tmp);
767             break;
768         case 3:
769             stq_phys(cs->as, dst, tmp);
770             break;
771         }
772         dst = dst + step;
773         src = src + step;
774     }
775 
776     return H_SUCCESS;
777 }
778 
779 static target_ulong h_logical_icbi(PowerPCCPU *cpu, SpaprMachineState *spapr,
780                                    target_ulong opcode, target_ulong *args)
781 {
782     /* Nothing to do on emulation, KVM will trap this in the kernel */
783     return H_SUCCESS;
784 }
785 
786 static target_ulong h_logical_dcbf(PowerPCCPU *cpu, SpaprMachineState *spapr,
787                                    target_ulong opcode, target_ulong *args)
788 {
789     /* Nothing to do on emulation, KVM will trap this in the kernel */
790     return H_SUCCESS;
791 }
792 
793 static target_ulong h_set_mode_resource_set_ciabr(PowerPCCPU *cpu,
794                                                   SpaprMachineState *spapr,
795                                                   target_ulong mflags,
796                                                   target_ulong value1,
797                                                   target_ulong value2)
798 {
799     CPUPPCState *env = &cpu->env;
800 
801     assert(tcg_enabled()); /* KVM will have handled this */
802 
803     if (mflags) {
804         return H_UNSUPPORTED_FLAG;
805     }
806     if (value2) {
807         return H_P4;
808     }
809     if ((value1 & PPC_BITMASK(62, 63)) == 0x3) {
810         return H_P3;
811     }
812 
813     ppc_store_ciabr(env, value1);
814 
815     return H_SUCCESS;
816 }
817 
818 static target_ulong h_set_mode_resource_set_dawr0(PowerPCCPU *cpu,
819                                                   SpaprMachineState *spapr,
820                                                   target_ulong mflags,
821                                                   target_ulong value1,
822                                                   target_ulong value2)
823 {
824     CPUPPCState *env = &cpu->env;
825 
826     assert(tcg_enabled()); /* KVM will have handled this */
827 
828     if (mflags) {
829         return H_UNSUPPORTED_FLAG;
830     }
831     if (value2 & PPC_BIT(61)) {
832         return H_P4;
833     }
834 
835     ppc_store_dawr0(env, value1);
836     ppc_store_dawrx0(env, value2);
837 
838     return H_SUCCESS;
839 }
840 
841 static target_ulong h_set_mode_resource_le(PowerPCCPU *cpu,
842                                            SpaprMachineState *spapr,
843                                            target_ulong mflags,
844                                            target_ulong value1,
845                                            target_ulong value2)
846 {
847     if (value1) {
848         return H_P3;
849     }
850     if (value2) {
851         return H_P4;
852     }
853 
854     switch (mflags) {
855     case H_SET_MODE_ENDIAN_BIG:
856         spapr_set_all_lpcrs(0, LPCR_ILE);
857         spapr_pci_switch_vga(spapr, true);
858         return H_SUCCESS;
859 
860     case H_SET_MODE_ENDIAN_LITTLE:
861         spapr_set_all_lpcrs(LPCR_ILE, LPCR_ILE);
862         spapr_pci_switch_vga(spapr, false);
863         return H_SUCCESS;
864     }
865 
866     return H_UNSUPPORTED_FLAG;
867 }
868 
869 static target_ulong h_set_mode_resource_addr_trans_mode(PowerPCCPU *cpu,
870                                                         SpaprMachineState *spapr,
871                                                         target_ulong mflags,
872                                                         target_ulong value1,
873                                                         target_ulong value2)
874 {
875     if (value1) {
876         return H_P3;
877     }
878 
879     if (value2) {
880         return H_P4;
881     }
882 
883     /*
884      * AIL-1 is not architected, and AIL-2 is not supported by QEMU spapr.
885      * It is supported for faithful emulation of bare metal systems, but for
886      * compatibility concerns we leave it out of the pseries machine.
887      */
888     if (mflags != 0 && mflags != 3) {
889         return H_UNSUPPORTED_FLAG;
890     }
891 
892     if (mflags == 3) {
893         if (!spapr_get_cap(spapr, SPAPR_CAP_AIL_MODE_3)) {
894             return H_UNSUPPORTED_FLAG;
895         }
896     }
897 
898     spapr_set_all_lpcrs(mflags << LPCR_AIL_SHIFT, LPCR_AIL);
899 
900     return H_SUCCESS;
901 }
902 
903 static target_ulong h_set_mode(PowerPCCPU *cpu, SpaprMachineState *spapr,
904                                target_ulong opcode, target_ulong *args)
905 {
906     target_ulong resource = args[1];
907     target_ulong ret = H_P2;
908 
909     switch (resource) {
910     case H_SET_MODE_RESOURCE_SET_CIABR:
911         ret = h_set_mode_resource_set_ciabr(cpu, spapr, args[0], args[2],
912                                             args[3]);
913         break;
914     case H_SET_MODE_RESOURCE_SET_DAWR0:
915         ret = h_set_mode_resource_set_dawr0(cpu, spapr, args[0], args[2],
916                                             args[3]);
917         break;
918     case H_SET_MODE_RESOURCE_LE:
919         ret = h_set_mode_resource_le(cpu, spapr, args[0], args[2], args[3]);
920         break;
921     case H_SET_MODE_RESOURCE_ADDR_TRANS_MODE:
922         ret = h_set_mode_resource_addr_trans_mode(cpu, spapr, args[0],
923                                                   args[2], args[3]);
924         break;
925     }
926 
927     return ret;
928 }
929 
930 static target_ulong h_clean_slb(PowerPCCPU *cpu, SpaprMachineState *spapr,
931                                 target_ulong opcode, target_ulong *args)
932 {
933     qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx"%s\n",
934                   opcode, " (H_CLEAN_SLB)");
935     return H_FUNCTION;
936 }
937 
938 static target_ulong h_invalidate_pid(PowerPCCPU *cpu, SpaprMachineState *spapr,
939                                      target_ulong opcode, target_ulong *args)
940 {
941     qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x"TARGET_FMT_lx"%s\n",
942                   opcode, " (H_INVALIDATE_PID)");
943     return H_FUNCTION;
944 }
945 
946 static void spapr_check_setup_free_hpt(SpaprMachineState *spapr,
947                                        uint64_t patbe_old, uint64_t patbe_new)
948 {
949     /*
950      * We have 4 Options:
951      * HASH->HASH || RADIX->RADIX || NOTHING->RADIX : Do Nothing
952      * HASH->RADIX                                  : Free HPT
953      * RADIX->HASH                                  : Allocate HPT
954      * NOTHING->HASH                                : Allocate HPT
955      * Note: NOTHING implies the case where we said the guest could choose
956      *       later and so assumed radix and now it's called H_REG_PROC_TBL
957      */
958 
959     if ((patbe_old & PATE1_GR) == (patbe_new & PATE1_GR)) {
960         /* We assume RADIX, so this catches all the "Do Nothing" cases */
961     } else if (!(patbe_old & PATE1_GR)) {
962         /* HASH->RADIX : Free HPT */
963         spapr_free_hpt(spapr);
964     } else if (!(patbe_new & PATE1_GR)) {
965         /* RADIX->HASH || NOTHING->HASH : Allocate HPT */
966         spapr_setup_hpt(spapr);
967     }
968     return;
969 }
970 
971 #define FLAGS_MASK              0x01FULL
972 #define FLAG_MODIFY             0x10
973 #define FLAG_REGISTER           0x08
974 #define FLAG_RADIX              0x04
975 #define FLAG_HASH_PROC_TBL      0x02
976 #define FLAG_GTSE               0x01
977 
978 static target_ulong h_register_process_table(PowerPCCPU *cpu,
979                                              SpaprMachineState *spapr,
980                                              target_ulong opcode,
981                                              target_ulong *args)
982 {
983     target_ulong flags = args[0];
984     target_ulong proc_tbl = args[1];
985     target_ulong page_size = args[2];
986     target_ulong table_size = args[3];
987     target_ulong update_lpcr = 0;
988     target_ulong table_byte_size;
989     uint64_t cproc;
990 
991     if (flags & ~FLAGS_MASK) { /* Check no reserved bits are set */
992         return H_PARAMETER;
993     }
994     if (flags & FLAG_MODIFY) {
995         if (flags & FLAG_REGISTER) {
996             /* Check process table alignment */
997             table_byte_size = 1ULL << (table_size + 12);
998             if (proc_tbl & (table_byte_size - 1)) {
999                 qemu_log_mask(LOG_GUEST_ERROR,
1000                     "%s: process table not properly aligned: proc_tbl 0x"
1001                     TARGET_FMT_lx" proc_tbl_size 0x"TARGET_FMT_lx"\n",
1002                     __func__, proc_tbl, table_byte_size);
1003             }
1004             if (flags & FLAG_RADIX) { /* Register new RADIX process table */
1005                 if (proc_tbl & 0xfff || proc_tbl >> 60) {
1006                     return H_P2;
1007                 } else if (page_size) {
1008                     return H_P3;
1009                 } else if (table_size > 24) {
1010                     return H_P4;
1011                 }
1012                 cproc = PATE1_GR | proc_tbl | table_size;
1013             } else { /* Register new HPT process table */
1014                 if (flags & FLAG_HASH_PROC_TBL) { /* Hash with Segment Tables */
1015                     /* TODO - Not Supported */
1016                     /* Technically caused by flag bits => H_PARAMETER */
1017                     return H_PARAMETER;
1018                 } else { /* Hash with SLB */
1019                     if (proc_tbl >> 38) {
1020                         return H_P2;
1021                     } else if (page_size & ~0x7) {
1022                         return H_P3;
1023                     } else if (table_size > 24) {
1024                         return H_P4;
1025                     }
1026                 }
1027                 cproc = (proc_tbl << 25) | page_size << 5 | table_size;
1028             }
1029 
1030         } else { /* Deregister current process table */
1031             /*
1032              * Set to benign value: (current GR) | 0. This allows
1033              * deregistration in KVM to succeed even if the radix bit
1034              * in flags doesn't match the radix bit in the old PATE.
1035              */
1036             cproc = spapr->patb_entry & PATE1_GR;
1037         }
1038     } else { /* Maintain current registration */
1039         if (!(flags & FLAG_RADIX) != !(spapr->patb_entry & PATE1_GR)) {
1040             /* Technically caused by flag bits => H_PARAMETER */
1041             return H_PARAMETER; /* Existing Process Table Mismatch */
1042         }
1043         cproc = spapr->patb_entry;
1044     }
1045 
1046     /* Check if we need to setup OR free the hpt */
1047     spapr_check_setup_free_hpt(spapr, spapr->patb_entry, cproc);
1048 
1049     spapr->patb_entry = cproc; /* Save new process table */
1050 
1051     /* Update the UPRT, HR and GTSE bits in the LPCR for all cpus */
1052     if (flags & FLAG_RADIX)     /* Radix must use process tables, also set HR */
1053         update_lpcr |= (LPCR_UPRT | LPCR_HR);
1054     else if (flags & FLAG_HASH_PROC_TBL) /* Hash with process tables */
1055         update_lpcr |= LPCR_UPRT;
1056     if (flags & FLAG_GTSE)      /* Guest translation shootdown enable */
1057         update_lpcr |= LPCR_GTSE;
1058 
1059     spapr_set_all_lpcrs(update_lpcr, LPCR_UPRT | LPCR_HR | LPCR_GTSE);
1060 
1061     if (kvm_enabled()) {
1062         return kvmppc_configure_v3_mmu(cpu, flags & FLAG_RADIX,
1063                                        flags & FLAG_GTSE, cproc);
1064     }
1065     return H_SUCCESS;
1066 }
1067 
1068 #define H_SIGNAL_SYS_RESET_ALL         -1
1069 #define H_SIGNAL_SYS_RESET_ALLBUTSELF  -2
1070 
1071 static target_ulong h_signal_sys_reset(PowerPCCPU *cpu,
1072                                        SpaprMachineState *spapr,
1073                                        target_ulong opcode, target_ulong *args)
1074 {
1075     target_long target = args[0];
1076     CPUState *cs;
1077 
1078     if (target < 0) {
1079         /* Broadcast */
1080         if (target < H_SIGNAL_SYS_RESET_ALLBUTSELF) {
1081             return H_PARAMETER;
1082         }
1083 
1084         CPU_FOREACH(cs) {
1085             PowerPCCPU *c = POWERPC_CPU(cs);
1086 
1087             if (target == H_SIGNAL_SYS_RESET_ALLBUTSELF) {
1088                 if (c == cpu) {
1089                     continue;
1090                 }
1091             }
1092             run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
1093         }
1094         return H_SUCCESS;
1095 
1096     } else {
1097         /* Unicast */
1098         cs = CPU(spapr_find_cpu(target));
1099         if (cs) {
1100             run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
1101             return H_SUCCESS;
1102         }
1103         return H_PARAMETER;
1104     }
1105 }
1106 
1107 /* Returns either a logical PVR or zero if none was found */
1108 static uint32_t cas_check_pvr(PowerPCCPU *cpu, uint32_t max_compat,
1109                               target_ulong *addr, bool *raw_mode_supported)
1110 {
1111     bool explicit_match = false; /* Matched the CPU's real PVR */
1112     uint32_t best_compat = 0;
1113     int i;
1114 
1115     /*
1116      * We scan the supplied table of PVRs looking for two things
1117      *   1. Is our real CPU PVR in the list?
1118      *   2. What's the "best" listed logical PVR
1119      */
1120     for (i = 0; i < 512; ++i) {
1121         uint32_t pvr, pvr_mask;
1122 
1123         pvr_mask = ldl_be_phys(&address_space_memory, *addr);
1124         pvr = ldl_be_phys(&address_space_memory, *addr + 4);
1125         *addr += 8;
1126 
1127         if (~pvr_mask & pvr) {
1128             break; /* Terminator record */
1129         }
1130 
1131         if ((cpu->env.spr[SPR_PVR] & pvr_mask) == (pvr & pvr_mask)) {
1132             explicit_match = true;
1133         } else {
1134             if (ppc_check_compat(cpu, pvr, best_compat, max_compat)) {
1135                 best_compat = pvr;
1136             }
1137         }
1138     }
1139 
1140     *raw_mode_supported = explicit_match;
1141 
1142     /* Parsing finished */
1143     trace_spapr_cas_pvr(cpu->compat_pvr, explicit_match, best_compat);
1144 
1145     return best_compat;
1146 }
1147 
1148 static
1149 target_ulong do_client_architecture_support(PowerPCCPU *cpu,
1150                                             SpaprMachineState *spapr,
1151                                             target_ulong vec,
1152                                             target_ulong fdt_bufsize)
1153 {
1154     target_ulong ov_table; /* Working address in data buffer */
1155     uint32_t cas_pvr;
1156     SpaprOptionVector *ov1_guest, *ov5_guest;
1157     bool guest_radix;
1158     bool raw_mode_supported = false;
1159     bool guest_xive;
1160     CPUState *cs;
1161     void *fdt;
1162     uint32_t max_compat = spapr->max_compat_pvr;
1163 
1164     /* CAS is supposed to be called early when only the boot vCPU is active. */
1165     CPU_FOREACH(cs) {
1166         if (cs == CPU(cpu)) {
1167             continue;
1168         }
1169         if (!cs->halted) {
1170             warn_report("guest has multiple active vCPUs at CAS, which is not allowed");
1171             return H_MULTI_THREADS_ACTIVE;
1172         }
1173     }
1174 
1175     cas_pvr = cas_check_pvr(cpu, max_compat, &vec, &raw_mode_supported);
1176     if (!cas_pvr && (!raw_mode_supported || max_compat)) {
1177         /*
1178          * We couldn't find a suitable compatibility mode, and either
1179          * the guest doesn't support "raw" mode for this CPU, or "raw"
1180          * mode is disabled because a maximum compat mode is set.
1181          */
1182         error_report("Couldn't negotiate a suitable PVR during CAS");
1183         return H_HARDWARE;
1184     }
1185 
1186     /* Update CPUs */
1187     if (cpu->compat_pvr != cas_pvr) {
1188         Error *local_err = NULL;
1189 
1190         if (ppc_set_compat_all(cas_pvr, &local_err) < 0) {
1191             /* We fail to set compat mode (likely because running with KVM PR),
1192              * but maybe we can fallback to raw mode if the guest supports it.
1193              */
1194             if (!raw_mode_supported) {
1195                 error_report_err(local_err);
1196                 return H_HARDWARE;
1197             }
1198             error_free(local_err);
1199         }
1200     }
1201 
1202     /* For the future use: here @ov_table points to the first option vector */
1203     ov_table = vec;
1204 
1205     ov1_guest = spapr_ovec_parse_vector(ov_table, 1);
1206     if (!ov1_guest) {
1207         warn_report("guest didn't provide option vector 1");
1208         return H_PARAMETER;
1209     }
1210     ov5_guest = spapr_ovec_parse_vector(ov_table, 5);
1211     if (!ov5_guest) {
1212         spapr_ovec_cleanup(ov1_guest);
1213         warn_report("guest didn't provide option vector 5");
1214         return H_PARAMETER;
1215     }
1216     if (spapr_ovec_test(ov5_guest, OV5_MMU_BOTH)) {
1217         error_report("guest requested hash and radix MMU, which is invalid.");
1218         exit(EXIT_FAILURE);
1219     }
1220     if (spapr_ovec_test(ov5_guest, OV5_XIVE_BOTH)) {
1221         error_report("guest requested an invalid interrupt mode");
1222         exit(EXIT_FAILURE);
1223     }
1224 
1225     guest_radix = spapr_ovec_test(ov5_guest, OV5_MMU_RADIX_300);
1226 
1227     guest_xive = spapr_ovec_test(ov5_guest, OV5_XIVE_EXPLOIT);
1228 
1229     /*
1230      * HPT resizing is a bit of a special case, because when enabled
1231      * we assume an HPT guest will support it until it says it
1232      * doesn't, instead of assuming it won't support it until it says
1233      * it does.  Strictly speaking that approach could break for
1234      * guests which don't make a CAS call, but those are so old we
1235      * don't care about them.  Without that assumption we'd have to
1236      * make at least a temporary allocation of an HPT sized for max
1237      * memory, which could be impossibly difficult under KVM HV if
1238      * maxram is large.
1239      */
1240     if (!guest_radix && !spapr_ovec_test(ov5_guest, OV5_HPT_RESIZE)) {
1241         int maxshift = spapr_hpt_shift_for_ramsize(MACHINE(spapr)->maxram_size);
1242 
1243         if (spapr->resize_hpt == SPAPR_RESIZE_HPT_REQUIRED) {
1244             error_report(
1245                 "h_client_architecture_support: Guest doesn't support HPT resizing, but resize-hpt=required");
1246             exit(1);
1247         }
1248 
1249         if (spapr->htab_shift < maxshift) {
1250             /* Guest doesn't know about HPT resizing, so we
1251              * pre-emptively resize for the maximum permitted RAM.  At
1252              * the point this is called, nothing should have been
1253              * entered into the existing HPT */
1254             spapr_reallocate_hpt(spapr, maxshift, &error_fatal);
1255             push_sregs_to_kvm_pr(spapr);
1256         }
1257     }
1258 
1259     /* NOTE: there are actually a number of ov5 bits where input from the
1260      * guest is always zero, and the platform/QEMU enables them independently
1261      * of guest input. To model these properly we'd want some sort of mask,
1262      * but since they only currently apply to memory migration as defined
1263      * by LoPAPR 1.1, 14.5.4.8, which QEMU doesn't implement, we don't need
1264      * to worry about this for now.
1265      */
1266 
1267     /* full range of negotiated ov5 capabilities */
1268     spapr_ovec_intersect(spapr->ov5_cas, spapr->ov5, ov5_guest);
1269     spapr_ovec_cleanup(ov5_guest);
1270 
1271     spapr_check_mmu_mode(guest_radix);
1272 
1273     spapr->cas_pre_isa3_guest = !spapr_ovec_test(ov1_guest, OV1_PPC_3_00);
1274     spapr_ovec_cleanup(ov1_guest);
1275 
1276     /*
1277      * Check for NUMA affinity conditions now that we know which NUMA
1278      * affinity the guest will use.
1279      */
1280     spapr_numa_associativity_check(spapr);
1281 
1282     /*
1283      * Ensure the guest asks for an interrupt mode we support;
1284      * otherwise terminate the boot.
1285      */
1286     if (guest_xive) {
1287         if (!spapr->irq->xive) {
1288             error_report(
1289 "Guest requested unavailable interrupt mode (XIVE), try the ic-mode=xive or ic-mode=dual machine property");
1290             exit(EXIT_FAILURE);
1291         }
1292     } else {
1293         if (!spapr->irq->xics) {
1294             error_report(
1295 "Guest requested unavailable interrupt mode (XICS), either don't set the ic-mode machine property or try ic-mode=xics or ic-mode=dual");
1296             exit(EXIT_FAILURE);
1297         }
1298     }
1299 
1300     spapr_irq_update_active_intc(spapr);
1301 
1302     /*
1303      * Process all pending hot-plug/unplug requests now. An updated full
1304      * rendered FDT will be returned to the guest.
1305      */
1306     spapr_drc_reset_all(spapr);
1307     spapr_clear_pending_hotplug_events(spapr);
1308 
1309     /*
1310      * If spapr_machine_reset() did not set up a HPT but one is necessary
1311      * (because the guest isn't going to use radix) then set it up here.
1312      */
1313     if ((spapr->patb_entry & PATE1_GR) && !guest_radix) {
1314         /* legacy hash or new hash: */
1315         spapr_setup_hpt(spapr);
1316     }
1317 
1318     fdt = spapr_build_fdt(spapr, spapr->vof != NULL, fdt_bufsize);
1319     g_free(spapr->fdt_blob);
1320     spapr->fdt_size = fdt_totalsize(fdt);
1321     spapr->fdt_initial_size = spapr->fdt_size;
1322     spapr->fdt_blob = fdt;
1323 
1324     /*
1325      * Set the machine->fdt pointer again since we just freed
1326      * it above (by freeing spapr->fdt_blob). We set this
1327      * pointer to enable support for the 'dumpdtb' QMP/HMP
1328      * command.
1329      */
1330     MACHINE(spapr)->fdt = fdt;
1331 
1332     return H_SUCCESS;
1333 }
1334 
1335 static target_ulong h_client_architecture_support(PowerPCCPU *cpu,
1336                                                   SpaprMachineState *spapr,
1337                                                   target_ulong opcode,
1338                                                   target_ulong *args)
1339 {
1340     target_ulong vec = ppc64_phys_to_real(args[0]);
1341     target_ulong fdt_buf = args[1];
1342     target_ulong fdt_bufsize = args[2];
1343     target_ulong ret;
1344     SpaprDeviceTreeUpdateHeader hdr = { .version_id = 1 };
1345 
1346     if (fdt_bufsize < sizeof(hdr)) {
1347         error_report("SLOF provided insufficient CAS buffer "
1348                      TARGET_FMT_lu " (min: %zu)", fdt_bufsize, sizeof(hdr));
1349         exit(EXIT_FAILURE);
1350     }
1351 
1352     fdt_bufsize -= sizeof(hdr);
1353 
1354     ret = do_client_architecture_support(cpu, spapr, vec, fdt_bufsize);
1355     if (ret == H_SUCCESS) {
1356         _FDT((fdt_pack(spapr->fdt_blob)));
1357         spapr->fdt_size = fdt_totalsize(spapr->fdt_blob);
1358         spapr->fdt_initial_size = spapr->fdt_size;
1359 
1360         cpu_physical_memory_write(fdt_buf, &hdr, sizeof(hdr));
1361         cpu_physical_memory_write(fdt_buf + sizeof(hdr), spapr->fdt_blob,
1362                                   spapr->fdt_size);
1363         trace_spapr_cas_continue(spapr->fdt_size + sizeof(hdr));
1364     }
1365 
1366     return ret;
1367 }
1368 
1369 target_ulong spapr_vof_client_architecture_support(MachineState *ms,
1370                                                    CPUState *cs,
1371                                                    target_ulong ovec_addr)
1372 {
1373     SpaprMachineState *spapr = SPAPR_MACHINE(ms);
1374 
1375     target_ulong ret = do_client_architecture_support(POWERPC_CPU(cs), spapr,
1376                                                       ovec_addr, FDT_MAX_SIZE);
1377 
1378     /*
1379      * This adds stdout and generates phandles for boottime and CAS FDTs.
1380      * It is alright to update the FDT here as do_client_architecture_support()
1381      * does not pack it.
1382      */
1383     spapr_vof_client_dt_finalize(spapr, spapr->fdt_blob);
1384 
1385     return ret;
1386 }
1387 
1388 static target_ulong h_get_cpu_characteristics(PowerPCCPU *cpu,
1389                                               SpaprMachineState *spapr,
1390                                               target_ulong opcode,
1391                                               target_ulong *args)
1392 {
1393     uint64_t characteristics = H_CPU_CHAR_HON_BRANCH_HINTS &
1394                                ~H_CPU_CHAR_THR_RECONF_TRIG;
1395     uint64_t behaviour = H_CPU_BEHAV_FAVOUR_SECURITY;
1396     uint8_t safe_cache = spapr_get_cap(spapr, SPAPR_CAP_CFPC);
1397     uint8_t safe_bounds_check = spapr_get_cap(spapr, SPAPR_CAP_SBBC);
1398     uint8_t safe_indirect_branch = spapr_get_cap(spapr, SPAPR_CAP_IBS);
1399     uint8_t count_cache_flush_assist = spapr_get_cap(spapr,
1400                                                      SPAPR_CAP_CCF_ASSIST);
1401 
1402     switch (safe_cache) {
1403     case SPAPR_CAP_WORKAROUND:
1404         characteristics |= H_CPU_CHAR_L1D_FLUSH_ORI30;
1405         characteristics |= H_CPU_CHAR_L1D_FLUSH_TRIG2;
1406         characteristics |= H_CPU_CHAR_L1D_THREAD_PRIV;
1407         behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
1408         break;
1409     case SPAPR_CAP_FIXED:
1410         behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_ENTRY;
1411         behaviour |= H_CPU_BEHAV_NO_L1D_FLUSH_UACCESS;
1412         break;
1413     default: /* broken */
1414         assert(safe_cache == SPAPR_CAP_BROKEN);
1415         behaviour |= H_CPU_BEHAV_L1D_FLUSH_PR;
1416         break;
1417     }
1418 
1419     switch (safe_bounds_check) {
1420     case SPAPR_CAP_WORKAROUND:
1421         characteristics |= H_CPU_CHAR_SPEC_BAR_ORI31;
1422         behaviour |= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
1423         break;
1424     case SPAPR_CAP_FIXED:
1425         break;
1426     default: /* broken */
1427         assert(safe_bounds_check == SPAPR_CAP_BROKEN);
1428         behaviour |= H_CPU_BEHAV_BNDS_CHK_SPEC_BAR;
1429         break;
1430     }
1431 
1432     switch (safe_indirect_branch) {
1433     case SPAPR_CAP_FIXED_NA:
1434         break;
1435     case SPAPR_CAP_FIXED_CCD:
1436         characteristics |= H_CPU_CHAR_CACHE_COUNT_DIS;
1437         break;
1438     case SPAPR_CAP_FIXED_IBS:
1439         characteristics |= H_CPU_CHAR_BCCTRL_SERIALISED;
1440         break;
1441     case SPAPR_CAP_WORKAROUND:
1442         behaviour |= H_CPU_BEHAV_FLUSH_COUNT_CACHE;
1443         if (count_cache_flush_assist) {
1444             characteristics |= H_CPU_CHAR_BCCTR_FLUSH_ASSIST;
1445         }
1446         break;
1447     default: /* broken */
1448         assert(safe_indirect_branch == SPAPR_CAP_BROKEN);
1449         break;
1450     }
1451 
1452     args[0] = characteristics;
1453     args[1] = behaviour;
1454     return H_SUCCESS;
1455 }
1456 
1457 static target_ulong h_update_dt(PowerPCCPU *cpu, SpaprMachineState *spapr,
1458                                 target_ulong opcode, target_ulong *args)
1459 {
1460     target_ulong dt = ppc64_phys_to_real(args[0]);
1461     struct fdt_header hdr = { 0 };
1462     unsigned cb;
1463     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
1464     void *fdt;
1465 
1466     cpu_physical_memory_read(dt, &hdr, sizeof(hdr));
1467     cb = fdt32_to_cpu(hdr.totalsize);
1468 
1469     if (!smc->update_dt_enabled) {
1470         return H_SUCCESS;
1471     }
1472 
1473     /* Check that the fdt did not grow out of proportion */
1474     if (cb > spapr->fdt_initial_size * 2) {
1475         trace_spapr_update_dt_failed_size(spapr->fdt_initial_size, cb,
1476                                           fdt32_to_cpu(hdr.magic));
1477         return H_PARAMETER;
1478     }
1479 
1480     fdt = g_malloc0(cb);
1481     cpu_physical_memory_read(dt, fdt, cb);
1482 
1483     /* Check the fdt consistency */
1484     if (fdt_check_full(fdt, cb)) {
1485         trace_spapr_update_dt_failed_check(spapr->fdt_initial_size, cb,
1486                                            fdt32_to_cpu(hdr.magic));
1487         return H_PARAMETER;
1488     }
1489 
1490     g_free(spapr->fdt_blob);
1491     spapr->fdt_size = cb;
1492     spapr->fdt_blob = fdt;
1493     trace_spapr_update_dt(cb);
1494 
1495     return H_SUCCESS;
1496 }
1497 
1498 static spapr_hcall_fn papr_hypercall_table[(MAX_HCALL_OPCODE / 4) + 1];
1499 static spapr_hcall_fn kvmppc_hypercall_table[KVMPPC_HCALL_MAX - KVMPPC_HCALL_BASE + 1];
1500 static spapr_hcall_fn svm_hypercall_table[(SVM_HCALL_MAX - SVM_HCALL_BASE) / 4 + 1];
1501 
1502 void spapr_register_hypercall(target_ulong opcode, spapr_hcall_fn fn)
1503 {
1504     spapr_hcall_fn *slot;
1505 
1506     if (opcode <= MAX_HCALL_OPCODE) {
1507         assert((opcode & 0x3) == 0);
1508 
1509         slot = &papr_hypercall_table[opcode / 4];
1510     } else if (opcode >= SVM_HCALL_BASE && opcode <= SVM_HCALL_MAX) {
1511         /* we only have SVM-related hcall numbers assigned in multiples of 4 */
1512         assert((opcode & 0x3) == 0);
1513 
1514         slot = &svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1515     } else {
1516         assert((opcode >= KVMPPC_HCALL_BASE) && (opcode <= KVMPPC_HCALL_MAX));
1517 
1518         slot = &kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1519     }
1520 
1521     assert(!(*slot));
1522     *slot = fn;
1523 }
1524 
1525 target_ulong spapr_hypercall(PowerPCCPU *cpu, target_ulong opcode,
1526                              target_ulong *args)
1527 {
1528     SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
1529 
1530     if ((opcode <= MAX_HCALL_OPCODE)
1531         && ((opcode & 0x3) == 0)) {
1532         spapr_hcall_fn fn = papr_hypercall_table[opcode / 4];
1533 
1534         if (fn) {
1535             return fn(cpu, spapr, opcode, args);
1536         }
1537     } else if ((opcode >= SVM_HCALL_BASE) &&
1538                (opcode <= SVM_HCALL_MAX)) {
1539         spapr_hcall_fn fn = svm_hypercall_table[(opcode - SVM_HCALL_BASE) / 4];
1540 
1541         if (fn) {
1542             return fn(cpu, spapr, opcode, args);
1543         }
1544     } else if ((opcode >= KVMPPC_HCALL_BASE) &&
1545                (opcode <= KVMPPC_HCALL_MAX)) {
1546         spapr_hcall_fn fn = kvmppc_hypercall_table[opcode - KVMPPC_HCALL_BASE];
1547 
1548         if (fn) {
1549             return fn(cpu, spapr, opcode, args);
1550         }
1551     }
1552 
1553     qemu_log_mask(LOG_UNIMP, "Unimplemented SPAPR hcall 0x" TARGET_FMT_lx "\n",
1554                   opcode);
1555     return H_FUNCTION;
1556 }
1557 
1558 #ifdef CONFIG_TCG
1559 static void hypercall_register_softmmu(void)
1560 {
1561     /* DO NOTHING */
1562 }
1563 #else
1564 static target_ulong h_softmmu(PowerPCCPU *cpu, SpaprMachineState *spapr,
1565                             target_ulong opcode, target_ulong *args)
1566 {
1567     g_assert_not_reached();
1568 }
1569 
1570 static void hypercall_register_softmmu(void)
1571 {
1572     /* hcall-pft */
1573     spapr_register_hypercall(H_ENTER, h_softmmu);
1574     spapr_register_hypercall(H_REMOVE, h_softmmu);
1575     spapr_register_hypercall(H_PROTECT, h_softmmu);
1576     spapr_register_hypercall(H_READ, h_softmmu);
1577 
1578     /* hcall-bulk */
1579     spapr_register_hypercall(H_BULK_REMOVE, h_softmmu);
1580 }
1581 #endif
1582 
1583 static void hypercall_register_types(void)
1584 {
1585     hypercall_register_softmmu();
1586 
1587     /* hcall-hpt-resize */
1588     spapr_register_hypercall(H_RESIZE_HPT_PREPARE, h_resize_hpt_prepare);
1589     spapr_register_hypercall(H_RESIZE_HPT_COMMIT, h_resize_hpt_commit);
1590 
1591     /* hcall-splpar */
1592     spapr_register_hypercall(H_REGISTER_VPA, h_register_vpa);
1593     spapr_register_hypercall(H_CEDE, h_cede);
1594     spapr_register_hypercall(H_CONFER, h_confer);
1595     spapr_register_hypercall(H_PROD, h_prod);
1596 
1597     /* hcall-join */
1598     spapr_register_hypercall(H_JOIN, h_join);
1599 
1600     spapr_register_hypercall(H_SIGNAL_SYS_RESET, h_signal_sys_reset);
1601 
1602     /* processor register resource access h-calls */
1603     spapr_register_hypercall(H_SET_SPRG0, h_set_sprg0);
1604     spapr_register_hypercall(H_SET_DABR, h_set_dabr);
1605     spapr_register_hypercall(H_SET_XDABR, h_set_xdabr);
1606     spapr_register_hypercall(H_PAGE_INIT, h_page_init);
1607     spapr_register_hypercall(H_SET_MODE, h_set_mode);
1608 
1609     /* In Memory Table MMU h-calls */
1610     spapr_register_hypercall(H_CLEAN_SLB, h_clean_slb);
1611     spapr_register_hypercall(H_INVALIDATE_PID, h_invalidate_pid);
1612     spapr_register_hypercall(H_REGISTER_PROC_TBL, h_register_process_table);
1613 
1614     /* hcall-get-cpu-characteristics */
1615     spapr_register_hypercall(H_GET_CPU_CHARACTERISTICS,
1616                              h_get_cpu_characteristics);
1617 
1618     /* "debugger" hcalls (also used by SLOF). Note: We do -not- differentiate
1619      * here between the "CI" and the "CACHE" variants, they will use whatever
1620      * mapping attributes qemu is using. When using KVM, the kernel will
1621      * enforce the attributes more strongly
1622      */
1623     spapr_register_hypercall(H_LOGICAL_CI_LOAD, h_logical_load);
1624     spapr_register_hypercall(H_LOGICAL_CI_STORE, h_logical_store);
1625     spapr_register_hypercall(H_LOGICAL_CACHE_LOAD, h_logical_load);
1626     spapr_register_hypercall(H_LOGICAL_CACHE_STORE, h_logical_store);
1627     spapr_register_hypercall(H_LOGICAL_ICBI, h_logical_icbi);
1628     spapr_register_hypercall(H_LOGICAL_DCBF, h_logical_dcbf);
1629     spapr_register_hypercall(KVMPPC_H_LOGICAL_MEMOP, h_logical_memop);
1630 
1631     /* qemu/KVM-PPC specific hcalls */
1632     spapr_register_hypercall(KVMPPC_H_RTAS, h_rtas);
1633 
1634     /* ibm,client-architecture-support support */
1635     spapr_register_hypercall(KVMPPC_H_CAS, h_client_architecture_support);
1636 
1637     spapr_register_hypercall(KVMPPC_H_UPDATE_DT, h_update_dt);
1638 
1639     spapr_register_nested();
1640 }
1641 
1642 type_init(hypercall_register_types)
1643