spapr.c · samitouri/QOSamiQemu · siGit Code & Deploy

Code Commits Issues Pulls Sessions CI/CD

master

c 5,024 lines 161 KB

Raw

1	/*
2	* QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
3	*
4	* Copyright (c) 2004-2007 Fabrice Bellard
5	* Copyright (c) 2007 Jocelyn Mayer
6	* Copyright (c) 2010 David Gibson, IBM Corporation.
7	* Copyright (c) 2010-2024, IBM Corporation..
8	*
9	* SPDX-License-Identifier: GPL-2.0-or-later
10	*
11	* Permission is hereby granted, free of charge, to any person obtaining a copy
12	* of this software and associated documentation files (the "Software"), to deal
13	* in the Software without restriction, including without limitation the rights
14	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
15	* copies of the Software, and to permit persons to whom the Software is
16	* furnished to do so, subject to the following conditions:
17	*
18	* The above copyright notice and this permission notice shall be included in
19	* all copies or substantial portions of the Software.
20	*
21	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
22	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
23	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
24	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
25	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
26	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27	* THE SOFTWARE.
28	*/
29
30	#include "qemu/osdep.h"
31	#include "qemu/datadir.h"
32	#include "qemu/memalign.h"
33	#include "qemu/guest-random.h"
34	#include "qapi/error.h"
35	#include "qapi/qapi-events-machine.h"
36	#include "qapi/qapi-events-qdev.h"
37	#include "qapi/visitor.h"
38	#include "system/system.h"
39	#include "system/hostmem.h"
40	#include "system/numa.h"
41	#include "system/physmem.h"
42	#include "system/tcg.h"
43	#include "system/qtest.h"
44	#include "system/reset.h"
45	#include "system/runstate.h"
46	#include "qemu/log.h"
47	#include "exec/cpu-common.h"
48	#include "hw/core/fw-path-provider.h"
49	#include "elf.h"
50	#include "net/net.h"
51	#include "system/device_tree.h"
52	#include "system/cpus.h"
53	#include "system/hw_accel.h"
54	#include "kvm_ppc.h"
55	#include "migration/misc.h"
56	#include "migration/qemu-file-types.h"
57	#include "migration/global_state.h"
58	#include "migration/register.h"
59	#include "migration/blocker.h"
60	#include "mmu-hash64.h"
61	#include "mmu-book3s-v3.h"
62	#include "cpu-models.h"
63	#include "hw/core/cpu.h"
64
65	#include "hw/ppc/ppc.h"
66	#include "hw/core/loader.h"
67
68	#include "hw/ppc/fdt.h"
69	#include "hw/ppc/spapr.h"
70	#include "hw/ppc/spapr_nested.h"
71	#include "hw/ppc/spapr_vio.h"
72	#include "hw/ppc/vof.h"
73	#include "hw/core/qdev-properties.h"
74	#include "hw/pci-host/spapr.h"
75	#include "hw/pci/msi.h"
76
77	#include "hw/pci/pci.h"
78	#include "hw/scsi/scsi.h"
79	#include "hw/virtio/virtio-scsi.h"
80	#include "hw/virtio/vhost-scsi-common.h"
81
82	#include "system/confidential-guest-support.h"
83	#include "hw/usb/usb.h"
84	#include "qemu/config-file.h"
85	#include "qemu/error-report.h"
86	#include "trace.h"
87	#include "hw/core/nmi.h"
88	#include "hw/intc/intc.h"
89
90	#include "hw/ppc/spapr_cpu_core.h"
91	#include "hw/mem/memory-device.h"
92	#include "hw/ppc/spapr_tpm_proxy.h"
93	#include "hw/ppc/spapr_nvdimm.h"
94	#include "hw/ppc/spapr_numa.h"
95
96	#include <libfdt.h>
97
98	/* SLOF memory layout:
99	*
100	* SLOF raw image loaded at 0, copies its romfs right below the flat
101	* device-tree, then position SLOF itself 31M below that
102	*
103	* So we set FW_OVERHEAD to 40MB which should account for all of that
104	* and more
105	*
106	* We load our kernel at 4M, leaving space for SLOF initial image
107	*/
108	#define FDT_MAX_ADDR 0x80000000 /* FDT must stay below that */
109	#define FW_MAX_SIZE 0x400000
110	#define FW_FILE_NAME "slof.bin"
111	#define FW_FILE_NAME_VOF "vof.bin"
112	#define FW_OVERHEAD 0x2800000
113	#define KERNEL_LOAD_ADDR FW_MAX_SIZE
114
115	#define MIN_RMA_SLOF (128 * MiB)
116
117	#define PHANDLE_INTC 0x00001111
118
119	/* These two functions implement the VCPU id numbering: one to compute them
120	* all and one to identify thread 0 of a VCORE. Any change to the first one
121	* is likely to have an impact on the second one, so let's keep them close.
122	*/
123	static int spapr_vcpu_id(SpaprMachineState *spapr, int cpu_index)
124	{
125	MachineState *ms = MACHINE(spapr);
126	unsigned int smp_threads = ms->smp.threads;
127
128	assert(spapr->vsmt);
129	return
130	(cpu_index / smp_threads) * spapr->vsmt + cpu_index % smp_threads;
131	}
132	static bool spapr_is_thread0_in_vcore(SpaprMachineState *spapr,
133	PowerPCCPU *cpu)
134	{
135	assert(spapr->vsmt);
136	return spapr_get_vcpu_id(cpu) % spapr->vsmt == 0;
137	}
138
139	int spapr_max_server_number(SpaprMachineState *spapr)
140	{
141	MachineState *ms = MACHINE(spapr);
142
143	assert(spapr->vsmt);
144	return DIV_ROUND_UP(ms->smp.max_cpus * spapr->vsmt, ms->smp.threads);
145	}
146
147	static int spapr_fixup_cpu_smt_dt(void fdt, int offset, PowerPCCPU cpu,
148	int smt_threads)
149	{
150	int i, ret = 0;
151	g_autofree uint32_t *servers_prop = g_new(uint32_t, smt_threads);
152	g_autofree uint32_t gservers_prop = g_new(uint32_t, smt_threads 2);
153	int index = spapr_get_vcpu_id(cpu);
154
155	if (cpu->compat_pvr) {
156	ret = fdt_setprop_cell(fdt, offset, "cpu-version", cpu->compat_pvr);
157	if (ret < 0) {
158	return ret;
159	}
160	}
161
162	/* Build interrupt servers and gservers properties */
163	for (i = 0; i < smt_threads; i++) {
164	servers_prop[i] = cpu_to_be32(index + i);
165	/* Hack, direct the group queues back to cpu 0 */
166	gservers_prop[i*2] = cpu_to_be32(index + i);
167	gservers_prop[i*2 + 1] = 0;
168	}
169	ret = fdt_setprop(fdt, offset, "ibm,ppc-interrupt-server#s",
170	servers_prop, sizeof(servers_prop) smt_threads);
171	if (ret < 0) {
172	return ret;
173	}
174	ret = fdt_setprop(fdt, offset, "ibm,ppc-interrupt-gserver#s",
175	gservers_prop, sizeof(gservers_prop) smt_threads * 2);
176
177	return ret;
178	}
179
180	static void spapr_dt_pa_features(SpaprMachineState *spapr,
181	PowerPCCPU *cpu,
182	void *fdt, int offset)
183	{
184	/*
185	* SSO (SAO) ordering is supported on KVM and thread=single hosts,
186	* but not MTTCG, so disable it. To advertise it, a cap would have
187	* to be added, or support implemented for MTTCG.
188	*
189	* Copy/paste is not supported by TCG, so it is not advertised. KVM
190	* can execute them but it has no accelerator drivers which are usable,
191	* so there isn't much need for it anyway.
192	*/
193
194	/* These should be kept in sync with pnv */
195	uint8_t pa_features_206[] = { 6, 0,
196	0xf6, 0x1f, 0xc7, 0x00, 0x00, 0xc0 };
197	uint8_t pa_features_207[] = { 24, 0,
198	0xf6, 0x1f, 0xc7, 0xc0, 0x00, 0xf0,
199	0x80, 0x00, 0x00, 0x00, 0x00, 0x00,
200	0x00, 0x00, 0x00, 0x00, 0x80, 0x00,
201	0x80, 0x00, 0x80, 0x00, 0x00, 0x00 };
202	uint8_t pa_features_300[] = { 66, 0,
203	/* 0: MMU\|FPU\|SLB\|RUN\|DABR\|NX, 1: fri[nzpm]\|DABRX\|SPRG3\|SLB0\|PP110 */
204	/* 2: VPM\|DS205\|PPR\|DS202\|DS206, 3: LSD\|URG, 5: LE\|CFAR\|EB\|LSQ */
205	0xf6, 0x1f, 0xc7, 0xc0, 0x00, 0xf0, /* 0 - 5 */
206	/* 6: DS207 */
207	0x80, 0x00, 0x00, 0x00, 0x00, 0x00, /* 6 - 11 */
208	/* 16: Vector */
209	0x00, 0x00, 0x00, 0x00, 0x80, 0x00, /* 12 - 17 */
210	/* 18: Vec. Scalar, 20: Vec. XOR */
211	0x80, 0x00, 0x80, 0x00, 0x00, 0x00, /* 18 - 23 */
212	/* 24: Ext. Dec, 26: 64 bit ftrs, 28: PM ftrs */
213	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 24 - 29 */
214	/* 32: LE atomic, 34: EBB + ext EBB */
215	0x00, 0x00, 0x80, 0x00, 0xC0, 0x00, /* 30 - 35 */
216	/* 40: Radix MMU */
217	0x00, 0x00, 0x00, 0x00, 0x80, 0x00, /* 36 - 41 */
218	/* 42: PM, 44: PC RA, 46: SC vec'd */
219	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 42 - 47 */
220	/* 48: SIMD, 50: QP BFP, 52: String */
221	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 48 - 53 */
222	/* 54: DecFP, 56: DecI, 58: SHA */
223	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 54 - 59 */
224	/* 60: NM atomic, 62: RNG */
225	0x80, 0x00, 0x80, 0x00, 0x00, 0x00, /* 60 - 65 */
226	};
227	/* 3.1 removes SAO, HTM support */
228	uint8_t pa_features_31[] = { 74, 0,
229	/* 0: MMU\|FPU\|SLB\|RUN\|DABR\|NX, 1: fri[nzpm]\|DABRX\|SPRG3\|SLB0\|PP110 */
230	/* 2: VPM\|DS205\|PPR\|DS202\|DS206, 3: LSD\|URG, 5: LE\|CFAR\|EB\|LSQ */
231	0xf6, 0x1f, 0xc7, 0xc0, 0x00, 0xf0, /* 0 - 5 */
232	/* 6: DS207 */
233	0x80, 0x00, 0x00, 0x00, 0x00, 0x00, /* 6 - 11 */
234	/* 16: Vector */
235	0x00, 0x00, 0x00, 0x00, 0x80, 0x00, /* 12 - 17 */
236	/* 18: Vec. Scalar, 20: Vec. XOR */
237	0x80, 0x00, 0x80, 0x00, 0x00, 0x00, /* 18 - 23 */
238	/* 24: Ext. Dec, 26: 64 bit ftrs, 28: PM ftrs */
239	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 24 - 29 */
240	/* 32: LE atomic, 34: EBB + ext EBB */
241	0x00, 0x00, 0x80, 0x00, 0xC0, 0x00, /* 30 - 35 */
242	/* 40: Radix MMU */
243	0x00, 0x00, 0x00, 0x00, 0x80, 0x00, /* 36 - 41 */
244	/* 42: PM, 44: PC RA, 46: SC vec'd */
245	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 42 - 47 */
246	/* 48: SIMD, 50: QP BFP, 52: String */
247	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 48 - 53 */
248	/* 54: DecFP, 56: DecI, 58: SHA */
249	0x80, 0x00, 0x80, 0x00, 0x80, 0x00, /* 54 - 59 */
250	/* 60: NM atomic, 62: RNG, 64: DAWR1 (ISA 3.1) */
251	0x80, 0x00, 0x80, 0x00, 0x00, 0x00, /* 60 - 65 */
252	/* 68: DEXCR[SBHE\|IBRTPDUS\|SRAPD\|NPHIE\|PHIE] */
253	0x00, 0x00, 0xce, 0x00, 0x00, 0x00, /* 66 - 71 */
254	/* 72: [P]HASHST/[P]HASHCHK */
255	0x80, 0x00, /* 72 - 73 */
256	};
257	uint8_t *pa_features = NULL;
258	size_t pa_size;
259
260	if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_2_06, 0, cpu->compat_pvr)) {
261	pa_features = pa_features_206;
262	pa_size = sizeof(pa_features_206);
263	}
264	if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_2_07, 0, cpu->compat_pvr)) {
265	pa_features = pa_features_207;
266	pa_size = sizeof(pa_features_207);
267	}
268	if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_3_00, 0, cpu->compat_pvr)) {
269	pa_features = pa_features_300;
270	pa_size = sizeof(pa_features_300);
271	}
272	if (ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_3_10, 0, cpu->compat_pvr)) {
273	pa_features = pa_features_31;
274	pa_size = sizeof(pa_features_31);
275	}
276	if (!pa_features) {
277	return;
278	}
279
280	if (ppc_hash64_has(cpu, PPC_HASH64_CI_LARGEPAGE)) {
281	/*
282	* Note: we keep CI large pages off by default because a 64K capable
283	* guest provisioned with large pages might otherwise try to map a qemu
284	* framebuffer (or other kind of memory mapped PCI BAR) using 64K pages
285	* even if that qemu runs on a 4k host.
286	* We dd this bit back here if we are confident this is not an issue
287	*/
288	pa_features[3] \|= 0x20;
289	}
290	if ((spapr_get_cap(spapr, SPAPR_CAP_HTM) != 0) && pa_size > 24) {
291	pa_features[24] \|= 0x80; /* Transactional memory support */
292	}
293	if (spapr->cas_pre_isa3_guest && pa_size > 40) {
294	/* Workaround for broken kernels that attempt (guest) radix
295	* mode when they can't handle it, if they see the radix bit set
296	* in pa-features. So hide it from them. */
297	pa_features[40 + 2] &= ~0x80; /* Radix MMU */
298	}
299	if (spapr_get_cap(spapr, SPAPR_CAP_DAWR1)) {
300	g_assert(pa_size > 66);
301	pa_features[66] \|= 0x80;
302	}
303
304	_FDT((fdt_setprop(fdt, offset, "ibm,pa-features", pa_features, pa_size)));
305	}
306
307	static void spapr_dt_pi_features(SpaprMachineState *spapr,
308	PowerPCCPU *cpu,
309	void *fdt, int offset)
310	{
311	uint8_t pi_features[] = { 1, 0,
312	0x00 };
313
314	if (kvm_enabled() && ppc_check_compat(cpu, CPU_POWERPC_LOGICAL_3_00,
315	0, cpu->compat_pvr)) {
316	/*
317	* POWER9 and later CPUs with KVM run in LPAR-per-thread mode where
318	* all threads are essentially independent CPUs, and msgsndp does not
319	* work (because it is physically-addressed) and therefore is
320	* emulated by KVM, so disable it here to ensure XIVE will be used.
321	* This is both KVM and CPU implementation-specific behaviour so a KVM
322	* cap would be cleanest, but for now this works. If KVM ever permits
323	* native msgsndp execution by guests, a cap could be added at that
324	* time.
325	*/
326	pi_features[2] \|= 0x08; /* 4: No msgsndp */
327	}
328
329	_FDT((fdt_setprop(fdt, offset, "ibm,pi-features", pi_features,
330	sizeof(pi_features))));
331	}
332
333	static hwaddr spapr_node0_size(MachineState *machine)
334	{
335	if (machine->numa_state->num_nodes) {
336	int i;
337	for (i = 0; i < machine->numa_state->num_nodes; ++i) {
338	if (machine->numa_state->nodes[i].node_mem) {
339	return MIN(pow2floor(machine->numa_state->nodes[i].node_mem),
340	machine->ram_size);
341	}
342	}
343	}
344	return machine->ram_size;
345	}
346
347	static void add_str(GString s, const gchar s1)
348	{
349	g_string_append_len(s, s1, strlen(s1) + 1);
350	}
351
352	static int spapr_dt_memory_node(SpaprMachineState spapr, void fdt, int nodeid,
353	hwaddr start, hwaddr size)
354	{
355	char mem_name[32];
356	uint64_t mem_reg_property[2];
357	int off;
358
359	mem_reg_property[0] = cpu_to_be64(start);
360	mem_reg_property[1] = cpu_to_be64(size);
361
362	sprintf(mem_name, "memory@%" HWADDR_PRIx, start);
363	off = fdt_add_subnode(fdt, 0, mem_name);
364	_FDT(off);
365	_FDT((fdt_setprop_string(fdt, off, "device_type", "memory")));
366	_FDT((fdt_setprop(fdt, off, "reg", mem_reg_property,
367	sizeof(mem_reg_property))));
368	spapr_numa_write_associativity_dt(spapr, fdt, off, nodeid);
369	return off;
370	}
371
372	static uint32_t spapr_pc_dimm_node(MemoryDeviceInfoList *list, ram_addr_t addr)
373	{
374	MemoryDeviceInfoList *info;
375
376	for (info = list; info; info = info->next) {
377	MemoryDeviceInfo *value = info->value;
378
379	if (value && value->type == MEMORY_DEVICE_INFO_KIND_DIMM) {
380	PCDIMMDeviceInfo *pcdimm_info = value->u.dimm.data;
381
382	if (addr >= pcdimm_info->addr &&
383	addr < (pcdimm_info->addr + pcdimm_info->size)) {
384	return pcdimm_info->node;
385	}
386	}
387	}
388
389	return -1;
390	}
391
392	struct sPAPRDrconfCellV2 {
393	uint32_t seq_lmbs;
394	uint64_t base_addr;
395	uint32_t drc_index;
396	uint32_t aa_index;
397	uint32_t flags;
398	} QEMU_PACKED;
399
400	typedef struct DrconfCellQueue {
401	struct sPAPRDrconfCellV2 cell;
402	QSIMPLEQ_ENTRY(DrconfCellQueue) entry;
403	} DrconfCellQueue;
404
405	static DrconfCellQueue *
406	spapr_get_drconf_cell(uint32_t seq_lmbs, uint64_t base_addr,
407	uint32_t drc_index, uint32_t aa_index,
408	uint32_t flags)
409	{
410	DrconfCellQueue *elem;
411
412	elem = g_malloc0(sizeof(*elem));
413	elem->cell.seq_lmbs = cpu_to_be32(seq_lmbs);
414	elem->cell.base_addr = cpu_to_be64(base_addr);
415	elem->cell.drc_index = cpu_to_be32(drc_index);
416	elem->cell.aa_index = cpu_to_be32(aa_index);
417	elem->cell.flags = cpu_to_be32(flags);
418
419	return elem;
420	}
421
422	static int spapr_dt_dynamic_memory_v2(SpaprMachineState spapr, void fdt,
423	int offset, MemoryDeviceInfoList *dimms)
424	{
425	MachineState *machine = MACHINE(spapr);
426	uint8_t int_buf, cur_index;
427	int ret;
428	uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
429	uint64_t addr, cur_addr, size;
430	uint32_t nr_boot_lmbs = (machine->device_memory->base / lmb_size);
431	uint64_t mem_end = machine->device_memory->base +
432	memory_region_size(&machine->device_memory->mr);
433	uint32_t node, buf_len, nr_entries = 0;
434	SpaprDrc *drc;
435	DrconfCellQueue elem, next;
436	MemoryDeviceInfoList *info;
437	QSIMPLEQ_HEAD(, DrconfCellQueue) drconf_queue
438	= QSIMPLEQ_HEAD_INITIALIZER(drconf_queue);
439
440	/* Entry to cover RAM and the gap area */
441	elem = spapr_get_drconf_cell(nr_boot_lmbs, 0, 0, -1,
442	SPAPR_LMB_FLAGS_RESERVED \|
443	SPAPR_LMB_FLAGS_DRC_INVALID);
444	QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
445	nr_entries++;
446
447	cur_addr = machine->device_memory->base;
448	for (info = dimms; info; info = info->next) {
449	PCDIMMDeviceInfo *di = info->value->u.dimm.data;
450
451	addr = di->addr;
452	size = di->size;
453	node = di->node;
454
455	/*
456	* The NVDIMM area is hotpluggable after the NVDIMM is unplugged. The
457	* area is marked hotpluggable in the next iteration for the bigger
458	* chunk including the NVDIMM occupied area.
459	*/
460	if (info->value->type == MEMORY_DEVICE_INFO_KIND_NVDIMM)
461	continue;
462
463	/* Entry for hot-pluggable area */
464	if (cur_addr < addr) {
465	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, cur_addr / lmb_size);
466	g_assert(drc);
467	elem = spapr_get_drconf_cell((addr - cur_addr) / lmb_size,
468	cur_addr, spapr_drc_index(drc), -1, 0);
469	QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
470	nr_entries++;
471	}
472
473	/* Entry for DIMM */
474	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, addr / lmb_size);
475	g_assert(drc);
476	elem = spapr_get_drconf_cell(size / lmb_size, addr,
477	spapr_drc_index(drc), node,
478	(SPAPR_LMB_FLAGS_ASSIGNED \|
479	SPAPR_LMB_FLAGS_HOTREMOVABLE));
480	QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
481	nr_entries++;
482	cur_addr = addr + size;
483	}
484
485	/* Entry for remaining hotpluggable area */
486	if (cur_addr < mem_end) {
487	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, cur_addr / lmb_size);
488	g_assert(drc);
489	elem = spapr_get_drconf_cell((mem_end - cur_addr) / lmb_size,
490	cur_addr, spapr_drc_index(drc), -1, 0);
491	QSIMPLEQ_INSERT_TAIL(&drconf_queue, elem, entry);
492	nr_entries++;
493	}
494
495	buf_len = nr_entries * sizeof(struct sPAPRDrconfCellV2) + sizeof(uint32_t);
496	int_buf = cur_index = g_malloc0(buf_len);
497	(uint32_t )int_buf = cpu_to_be32(nr_entries);
498	cur_index += sizeof(nr_entries);
499
500	QSIMPLEQ_FOREACH_SAFE(elem, &drconf_queue, entry, next) {
501	memcpy(cur_index, &elem->cell, sizeof(elem->cell));
502	cur_index += sizeof(elem->cell);
503	QSIMPLEQ_REMOVE(&drconf_queue, elem, DrconfCellQueue, entry);
504	g_free(elem);
505	}
506
507	ret = fdt_setprop(fdt, offset, "ibm,dynamic-memory-v2", int_buf, buf_len);
508	g_free(int_buf);
509	if (ret < 0) {
510	return -1;
511	}
512	return 0;
513	}
514
515	static int spapr_dt_dynamic_memory(SpaprMachineState spapr, void fdt,
516	int offset, MemoryDeviceInfoList *dimms)
517	{
518	MachineState *machine = MACHINE(spapr);
519	int i, ret;
520	uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
521	uint32_t device_lmb_start = machine->device_memory->base / lmb_size;
522	uint32_t nr_lmbs = (machine->device_memory->base +
523	memory_region_size(&machine->device_memory->mr)) /
524	lmb_size;
525	uint32_t int_buf, cur_index, buf_len;
526
527	/*
528	* Allocate enough buffer size to fit in ibm,dynamic-memory
529	*/
530	buf_len = (nr_lmbs * SPAPR_DR_LMB_LIST_ENTRY_SIZE + 1) * sizeof(uint32_t);
531	cur_index = int_buf = g_malloc0(buf_len);
532	int_buf[0] = cpu_to_be32(nr_lmbs);
533	cur_index++;
534	for (i = 0; i < nr_lmbs; i++) {
535	uint64_t addr = i * lmb_size;
536	uint32_t *dynamic_memory = cur_index;
537
538	if (i >= device_lmb_start) {
539	SpaprDrc *drc;
540
541	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB, i);
542	g_assert(drc);
543
544	dynamic_memory[0] = cpu_to_be32(addr >> 32);
545	dynamic_memory[1] = cpu_to_be32(addr & 0xffffffff);
546	dynamic_memory[2] = cpu_to_be32(spapr_drc_index(drc));
547	dynamic_memory[3] = cpu_to_be32(0); /* reserved */
548	dynamic_memory[4] = cpu_to_be32(spapr_pc_dimm_node(dimms, addr));
549	if (memory_region_present(get_system_memory(), addr)) {
550	dynamic_memory[5] = cpu_to_be32(SPAPR_LMB_FLAGS_ASSIGNED);
551	} else {
552	dynamic_memory[5] = cpu_to_be32(0);
553	}
554	} else {
555	/*
556	* LMB information for RMA, boot time RAM and gap b/n RAM and
557	* device memory region -- all these are marked as reserved
558	* and as having no valid DRC.
559	*/
560	dynamic_memory[0] = cpu_to_be32(addr >> 32);
561	dynamic_memory[1] = cpu_to_be32(addr & 0xffffffff);
562	dynamic_memory[2] = cpu_to_be32(0);
563	dynamic_memory[3] = cpu_to_be32(0); /* reserved */
564	dynamic_memory[4] = cpu_to_be32(-1);
565	dynamic_memory[5] = cpu_to_be32(SPAPR_LMB_FLAGS_RESERVED \|
566	SPAPR_LMB_FLAGS_DRC_INVALID);
567	}
568
569	cur_index += SPAPR_DR_LMB_LIST_ENTRY_SIZE;
570	}
571	ret = fdt_setprop(fdt, offset, "ibm,dynamic-memory", int_buf, buf_len);
572	g_free(int_buf);
573	if (ret < 0) {
574	return -1;
575	}
576	return 0;
577	}
578
579	/*
580	* Adds ibm,dynamic-reconfiguration-memory node.
581	* Refer to docs/specs/ppc-spapr-hotplug.rst for the documentation
582	* of this device tree node.
583	*/
584	static int spapr_dt_dynamic_reconfiguration_memory(SpaprMachineState *spapr,
585	void *fdt)
586	{
587	MachineState *machine = MACHINE(spapr);
588	int ret, offset;
589	uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
590	uint32_t prop_lmb_size[] = {cpu_to_be32(lmb_size >> 32),
591	cpu_to_be32(lmb_size & 0xffffffff)};
592	MemoryDeviceInfoList *dimms = NULL;
593
594	/* Don't create the node if there is no device memory. */
595	if (!machine->device_memory) {
596	return 0;
597	}
598
599	offset = fdt_add_subnode(fdt, 0, "ibm,dynamic-reconfiguration-memory");
600
601	ret = fdt_setprop(fdt, offset, "ibm,lmb-size", prop_lmb_size,
602	sizeof(prop_lmb_size));
603	if (ret < 0) {
604	return ret;
605	}
606
607	ret = fdt_setprop_cell(fdt, offset, "ibm,memory-flags-mask", 0xff);
608	if (ret < 0) {
609	return ret;
610	}
611
612	ret = fdt_setprop_cell(fdt, offset, "ibm,memory-preservation-time", 0x0);
613	if (ret < 0) {
614	return ret;
615	}
616
617	/* ibm,dynamic-memory or ibm,dynamic-memory-v2 */
618	dimms = qmp_memory_device_list();
619	if (spapr_ovec_test(spapr->ov5_cas, OV5_DRMEM_V2)) {
620	ret = spapr_dt_dynamic_memory_v2(spapr, fdt, offset, dimms);
621	} else {
622	ret = spapr_dt_dynamic_memory(spapr, fdt, offset, dimms);
623	}
624	qapi_free_MemoryDeviceInfoList(dimms);
625
626	if (ret < 0) {
627	return ret;
628	}
629
630	ret = spapr_numa_write_assoc_lookup_arrays(spapr, fdt, offset);
631
632	return ret;
633	}
634
635	static int spapr_dt_memory(SpaprMachineState spapr, void fdt)
636	{
637	MachineState *machine = MACHINE(spapr);
638	hwaddr mem_start, node_size;
639	int i, nb_nodes = machine->numa_state->num_nodes;
640	NodeInfo *nodes = machine->numa_state->nodes;
641
642	for (i = 0, mem_start = 0; i < nb_nodes; ++i) {
643	if (!nodes[i].node_mem) {
644	continue;
645	}
646	if (mem_start >= machine->ram_size) {
647	node_size = 0;
648	} else {
649	node_size = nodes[i].node_mem;
650	if (node_size > machine->ram_size - mem_start) {
651	node_size = machine->ram_size - mem_start;
652	}
653	}
654	if (!mem_start) {
655	/* spapr_machine_init() checks for rma_size <= node0_size
656	* already */
657	spapr_dt_memory_node(spapr, fdt, i, 0, spapr->rma_size);
658	mem_start += spapr->rma_size;
659	node_size -= spapr->rma_size;
660	}
661	for ( ; node_size; ) {
662	hwaddr sizetmp = pow2floor(node_size);
663
664	/* mem_start != 0 here */
665	if (ctzl(mem_start) < ctzl(sizetmp)) {
666	sizetmp = 1ULL << ctzl(mem_start);
667	}
668
669	spapr_dt_memory_node(spapr, fdt, i, mem_start, sizetmp);
670	node_size -= sizetmp;
671	mem_start += sizetmp;
672	}
673	}
674
675	/* Generate ibm,dynamic-reconfiguration-memory node if required */
676	if (spapr_ovec_test(spapr->ov5_cas, OV5_DRCONF_MEMORY)) {
677	int ret;
678
679	ret = spapr_dt_dynamic_reconfiguration_memory(spapr, fdt);
680	if (ret) {
681	return ret;
682	}
683	}
684
685	return 0;
686	}
687
688	static void spapr_dt_cpu(CPUState cs, void fdt, int offset,
689	SpaprMachineState *spapr)
690	{
691	MachineState *ms = MACHINE(spapr);
692	PowerPCCPU *cpu = POWERPC_CPU(cs);
693	CPUPPCState *env = &cpu->env;
694	PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cs);
695	int index = spapr_get_vcpu_id(cpu);
696	uint32_t segs[] = {cpu_to_be32(28), cpu_to_be32(40),
697	0xffffffff, 0xffffffff};
698	uint32_t tbfreq = kvm_enabled() ? kvmppc_get_tbfreq()
699	: SPAPR_TIMEBASE_FREQ;
700	uint32_t cpufreq = kvm_enabled() ? kvmppc_get_clockfreq() : 1000000000;
701	uint32_t page_sizes_prop[64];
702	size_t page_sizes_prop_size;
703	unsigned int smp_threads = ms->smp.threads;
704	uint32_t vcpus_per_socket = smp_threads * ms->smp.cores;
705	uint32_t pft_size_prop[] = {0, cpu_to_be32(spapr->htab_shift)};
706	int compat_smt = MIN(smp_threads, ppc_compat_max_vthreads(cpu));
707	SpaprDrc *drc;
708	int drc_index;
709	uint32_t radix_AP_encodings[PPC_PAGE_SIZES_MAX_SZ];
710	int i;
711
712	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_CPU, env->core_index);
713	if (drc) {
714	drc_index = spapr_drc_index(drc);
715	_FDT((fdt_setprop_cell(fdt, offset, "ibm,my-drc-index", drc_index)));
716	}
717
718	_FDT((fdt_setprop_cell(fdt, offset, "reg", index)));
719	_FDT((fdt_setprop_string(fdt, offset, "device_type", "cpu")));
720
721	_FDT((fdt_setprop_cell(fdt, offset, "cpu-version", env->spr[SPR_PVR])));
722	_FDT((fdt_setprop_cell(fdt, offset, "d-cache-block-size",
723	env->dcache_line_size)));
724	_FDT((fdt_setprop_cell(fdt, offset, "d-cache-line-size",
725	env->dcache_line_size)));
726	_FDT((fdt_setprop_cell(fdt, offset, "i-cache-block-size",
727	env->icache_line_size)));
728	_FDT((fdt_setprop_cell(fdt, offset, "i-cache-line-size",
729	env->icache_line_size)));
730
731	if (pcc->l1_dcache_size) {
732	_FDT((fdt_setprop_cell(fdt, offset, "d-cache-size",
733	pcc->l1_dcache_size)));
734	} else {
735	warn_report("Unknown L1 dcache size for cpu");
736	}
737	if (pcc->l1_icache_size) {
738	_FDT((fdt_setprop_cell(fdt, offset, "i-cache-size",
739	pcc->l1_icache_size)));
740	} else {
741	warn_report("Unknown L1 icache size for cpu");
742	}
743
744	_FDT((fdt_setprop_cell(fdt, offset, "timebase-frequency", tbfreq)));
745	_FDT((fdt_setprop_cell(fdt, offset, "clock-frequency", cpufreq)));
746	_FDT((fdt_setprop_cell(fdt, offset, "slb-size", cpu->hash64_opts->slb_size)));
747	_FDT((fdt_setprop_cell(fdt, offset, "ibm,slb-size", cpu->hash64_opts->slb_size)));
748	_FDT((fdt_setprop_string(fdt, offset, "status", "okay")));
749	_FDT((fdt_setprop(fdt, offset, "64-bit", NULL, 0)));
750
751	if (ppc_has_spr(cpu, SPR_PURR)) {
752	_FDT((fdt_setprop_cell(fdt, offset, "ibm,purr", 1)));
753	}
754	if (ppc_has_spr(cpu, SPR_PURR)) {
755	_FDT((fdt_setprop_cell(fdt, offset, "ibm,spurr", 1)));
756	}
757
758	if (ppc_hash64_has(cpu, PPC_HASH64_1TSEG)) {
759	_FDT((fdt_setprop(fdt, offset, "ibm,processor-segment-sizes",
760	segs, sizeof(segs))));
761	}
762
763	/* Advertise VSX (vector extensions) if available
764	* 1 == VMX / Altivec available
765	* 2 == VSX available
766	*
767	* Only CPUs for which we create core types in spapr_cpu_core.c
768	* are possible, and all of those have VMX */
769	if (env->insns_flags & PPC_ALTIVEC) {
770	if (spapr_get_cap(spapr, SPAPR_CAP_VSX) != 0) {
771	_FDT((fdt_setprop_cell(fdt, offset, "ibm,vmx", 2)));
772	} else {
773	_FDT((fdt_setprop_cell(fdt, offset, "ibm,vmx", 1)));
774	}
775	}
776
777	/* Advertise DFP (Decimal Floating Point) if available
778	* 0 / no property == no DFP
779	* 1 == DFP available */
780	if (spapr_get_cap(spapr, SPAPR_CAP_DFP) != 0) {
781	_FDT((fdt_setprop_cell(fdt, offset, "ibm,dfp", 1)));
782	}
783
784	page_sizes_prop_size = ppc_create_page_sizes_prop(cpu, page_sizes_prop,
785	sizeof(page_sizes_prop));
786	if (page_sizes_prop_size) {
787	_FDT((fdt_setprop(fdt, offset, "ibm,segment-page-sizes",
788	page_sizes_prop, page_sizes_prop_size)));
789	}
790
791	spapr_dt_pa_features(spapr, cpu, fdt, offset);
792
793	spapr_dt_pi_features(spapr, cpu, fdt, offset);
794
795	_FDT((fdt_setprop_cell(fdt, offset, "ibm,chip-id",
796	cs->cpu_index / vcpus_per_socket)));
797
798	_FDT((fdt_setprop(fdt, offset, "ibm,pft-size",
799	pft_size_prop, sizeof(pft_size_prop))));
800
801	if (ms->numa_state->num_nodes > 1) {
802	_FDT(spapr_numa_fixup_cpu_dt(spapr, fdt, offset, cpu));
803	}
804
805	_FDT(spapr_fixup_cpu_smt_dt(fdt, offset, cpu, compat_smt));
806
807	if (pcc->radix_page_info) {
808	for (i = 0; i < pcc->radix_page_info->count; i++) {
809	radix_AP_encodings[i] =
810	cpu_to_be32(pcc->radix_page_info->entries[i]);
811	}
812	_FDT((fdt_setprop(fdt, offset, "ibm,processor-radix-AP-encodings",
813	radix_AP_encodings,
814	pcc->radix_page_info->count *
815	sizeof(radix_AP_encodings[0]))));
816	}
817
818	/*
819	* We set this property to let the guest know that it can use the large
820	* decrementer and its width in bits.
821	*/
822	if (spapr_get_cap(spapr, SPAPR_CAP_LARGE_DECREMENTER) != SPAPR_CAP_OFF)
823	_FDT((fdt_setprop_u32(fdt, offset, "ibm,dec-bits",
824	pcc->lrg_decr_bits)));
825	}
826
827	static void spapr_dt_one_cpu(void fdt, SpaprMachineState spapr, CPUState *cs,
828	int cpus_offset)
829	{
830	PowerPCCPU *cpu = POWERPC_CPU(cs);
831	int index = spapr_get_vcpu_id(cpu);
832	DeviceClass *dc = DEVICE_GET_CLASS(cs);
833	g_autofree char *nodename = NULL;
834	int offset;
835
836	if (!spapr_is_thread0_in_vcore(spapr, cpu)) {
837	return;
838	}
839
840	nodename = g_strdup_printf("%s@%x", dc->fw_name, index);
841	offset = fdt_add_subnode(fdt, cpus_offset, nodename);
842	_FDT(offset);
843	spapr_dt_cpu(cs, fdt, offset, spapr);
844	}
845
846
847	static void spapr_dt_cpus(void fdt, SpaprMachineState spapr)
848	{
849	CPUState **rev;
850	CPUState *cs;
851	int n_cpus;
852	int cpus_offset;
853	int i;
854
855	cpus_offset = fdt_add_subnode(fdt, 0, "cpus");
856	_FDT(cpus_offset);
857	_FDT((fdt_setprop_cell(fdt, cpus_offset, "#address-cells", 0x1)));
858	_FDT((fdt_setprop_cell(fdt, cpus_offset, "#size-cells", 0x0)));
859
860	/*
861	* We walk the CPUs in reverse order to ensure that CPU DT nodes
862	* created by fdt_add_subnode() end up in the right order in FDT
863	* for the guest kernel the enumerate the CPUs correctly.
864	*
865	* The CPU list cannot be traversed in reverse order, so we need
866	* to do extra work.
867	*/
868	n_cpus = 0;
869	rev = NULL;
870	CPU_FOREACH(cs) {
871	rev = g_renew(CPUState *, rev, n_cpus + 1);
872	rev[n_cpus++] = cs;
873	}
874
875	for (i = n_cpus - 1; i >= 0; i--) {
876	spapr_dt_one_cpu(fdt, spapr, rev[i], cpus_offset);
877	}
878
879	g_free(rev);
880	}
881
882	static int spapr_dt_rng(void *fdt)
883	{
884	int node;
885	int ret;
886
887	node = qemu_fdt_add_subnode(fdt, "/ibm,platform-facilities");
888	if (node <= 0) {
889	return -1;
890	}
891	ret = fdt_setprop_string(fdt, node, "device_type",
892	"ibm,platform-facilities");
893	ret \|= fdt_setprop_cell(fdt, node, "#address-cells", 0x1);
894	ret \|= fdt_setprop_cell(fdt, node, "#size-cells", 0x0);
895
896	node = fdt_add_subnode(fdt, node, "ibm,random-v1");
897	if (node <= 0) {
898	return -1;
899	}
900	ret \|= fdt_setprop_string(fdt, node, "compatible", "ibm,random");
901
902	return ret ? -1 : 0;
903	}
904
905	static void spapr_dt_rtas_fadump(SpaprMachineState spapr, void fdt, int rtas)
906	{
907	MachineState *ms = MACHINE(spapr);
908	MachineClass *mc = MACHINE_GET_CLASS(ms);
909	FadumpMemStruct *fdm = &spapr->registered_fdm;
910	uint16_t dump_status_flag;
911
912	uint32_t max_possible_cpus = mc->possible_cpu_arch_ids(ms)->len;
913	uint64_t fadump_cpu_state_size = 0;
914	uint16_t fadump_versions[2] = {
915	FADUMP_VERSION /* min supported version */,
916	FADUMP_VERSION /* max supported version */
917	};
918	uint32_t fadump_rgn_sizes[2][3] = {
919	{
920	cpu_to_be32(FADUMP_CPU_STATE_DATA),
921	0, 0 /* Calculated later */
922	},
923	{
924	cpu_to_be32(FADUMP_HPTE_REGION),
925	0, 0 /* HPTE region not implemented */
926	}
927	};
928
929	/*
930	* CPU State Data contains multiple fields such as header, num_cpus and
931	* register entries
932	*
933	* Calculate the maximum CPU State Data size, according to maximum
934	* possible CPUs the QEMU VM can have
935	*
936	* This calculation must match the 'cpu_state_len' calculation done in
937	* 'populate_cpu_state_data' in spapr_fadump.c
938	*/
939	fadump_cpu_state_size += sizeof(struct FadumpRegSaveAreaHeader);
940	fadump_cpu_state_size += 0xc; /* padding as in PAPR */
941	fadump_cpu_state_size += sizeof(uint32_t); /* num_cpus */
942	fadump_cpu_state_size += max_possible_cpus * /* reg entries */
943	FADUMP_PER_CPU_REG_ENTRIES *
944	sizeof(struct FadumpRegEntry);
945
946	/* Set maximum size for CPU state data region */
947	assert(fadump_rgn_sizes[0][0] == cpu_to_be32(FADUMP_CPU_STATE_DATA));
948
949	/* Upper 32 bits of size, usually 0 */
950	fadump_rgn_sizes[0][1] = cpu_to_be32(fadump_cpu_state_size >> 32);
951
952	/* Lower 32 bits of size */
953	fadump_rgn_sizes[0][2] = cpu_to_be32(fadump_cpu_state_size & 0xffffffff);
954
955	/* Add device tree properties required from platform for fadump */
956	_FDT((fdt_setprop(fdt, rtas, "ibm,configure-kernel-dump-version",
957	fadump_versions, sizeof(fadump_versions))));
958	_FDT((fdt_setprop(fdt, rtas, "ibm,configure-kernel-dump-sizes",
959	fadump_rgn_sizes, sizeof(fadump_rgn_sizes))));
960
961	dump_status_flag = be16_to_cpu(fdm->header.dump_status_flag);
962	if (dump_status_flag & FADUMP_STATUS_DUMP_TRIGGERED) {
963	uint64_t fdm_size =
964	sizeof(struct FadumpSectionHeader) +
965	(be16_to_cpu(fdm->header.dump_num_sections) *
966	sizeof(struct FadumpSection));
967
968	_FDT((fdt_setprop(fdt, rtas, "ibm,kernel-dump", fdm, fdm_size)));
969	}
970	}
971
972	static void spapr_dt_rtas(SpaprMachineState spapr, void fdt)
973	{
974	MachineState *ms = MACHINE(spapr);
975	int rtas;
976	GString *hypertas = g_string_sized_new(256);
977	GString *qemu_hypertas = g_string_sized_new(256);
978	uint64_t max_device_addr = 0;
979	uint32_t lrdr_capacity[] = {
980	0,
981	0,
982	cpu_to_be32(SPAPR_MEMORY_BLOCK_SIZE >> 32),
983	cpu_to_be32(SPAPR_MEMORY_BLOCK_SIZE & 0xffffffff),
984	cpu_to_be32(ms->smp.max_cpus / ms->smp.threads),
985	};
986
987	/* Do we have device memory? */
988	if (MACHINE(spapr)->device_memory) {
989	max_device_addr = MACHINE(spapr)->device_memory->base +
990	memory_region_size(&MACHINE(spapr)->device_memory->mr);
991	} else if (ms->ram_size == ms->maxram_size) {
992	max_device_addr = ms->ram_size;
993	}
994
995	lrdr_capacity[0] = cpu_to_be32(max_device_addr >> 32);
996	lrdr_capacity[1] = cpu_to_be32(max_device_addr & 0xffffffff);
997
998	_FDT(rtas = fdt_add_subnode(fdt, 0, "rtas"));
999
1000	/* hypertas */
1001	add_str(hypertas, "hcall-pft");
1002	add_str(hypertas, "hcall-term");
1003	add_str(hypertas, "hcall-dabr");
1004	add_str(hypertas, "hcall-interrupt");
1005	add_str(hypertas, "hcall-tce");
1006	add_str(hypertas, "hcall-vio");
1007	add_str(hypertas, "hcall-splpar");
1008	add_str(hypertas, "hcall-join");
1009	add_str(hypertas, "hcall-bulk");
1010	add_str(hypertas, "hcall-set-mode");
1011	add_str(hypertas, "hcall-sprg0");
1012	add_str(hypertas, "hcall-copy");
1013	add_str(hypertas, "hcall-debug");
1014	add_str(hypertas, "hcall-vphn");
1015	if (spapr_get_cap(spapr, SPAPR_CAP_RPT_INVALIDATE) == SPAPR_CAP_ON) {
1016	add_str(hypertas, "hcall-rpt-invalidate");
1017	}
1018
1019	add_str(qemu_hypertas, "hcall-memop1");
1020
1021	if (!kvm_enabled() \|\| kvmppc_spapr_use_multitce()) {
1022	add_str(hypertas, "hcall-multi-tce");
1023	}
1024
1025	if (spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) {
1026	add_str(hypertas, "hcall-hpt-resize");
1027	}
1028
1029	add_str(hypertas, "hcall-watchdog");
1030
1031	_FDT(fdt_setprop(fdt, rtas, "ibm,hypertas-functions",
1032	hypertas->str, hypertas->len));
1033	g_string_free(hypertas, TRUE);
1034	_FDT(fdt_setprop(fdt, rtas, "qemu,hypertas-functions",
1035	qemu_hypertas->str, qemu_hypertas->len));
1036	g_string_free(qemu_hypertas, TRUE);
1037
1038	spapr_numa_write_rtas_dt(spapr, fdt, rtas);
1039
1040	/*
1041	* FWNMI reserves RTAS_ERROR_LOG_MAX for the machine check error log,
1042	* and 16 bytes per CPU for system reset error log plus an extra 8 bytes.
1043	*
1044	* The system reset requirements are driven by existing Linux and PowerVM
1045	* implementation which (contrary to PAPR) saves r3 in the error log
1046	* structure like machine check, so Linux expects to find the saved r3
1047	* value at the address in r3 upon FWNMI-enabled sreset interrupt (and
1048	* does not look at the error value).
1049	*
1050	* System reset interrupts are not subject to interlock like machine
1051	* check, so this memory area could be corrupted if the sreset is
1052	* interrupted by a machine check (or vice versa) if it was shared. To
1053	* prevent this, system reset uses per-CPU areas for the sreset save
1054	* area. A system reset that interrupts a system reset handler could
1055	* still overwrite this area, but Linux doesn't try to recover in that
1056	* case anyway.
1057	*
1058	* The extra 8 bytes is required because Linux's FWNMI error log check
1059	* is off-by-one.
1060	*
1061	* RTAS_MIN_SIZE is required for the RTAS blob itself.
1062	*/
1063	_FDT(fdt_setprop_cell(fdt, rtas, "rtas-size", RTAS_MIN_SIZE +
1064	RTAS_ERROR_LOG_MAX +
1065	ms->smp.max_cpus * sizeof(uint64_t) * 2 +
1066	sizeof(uint64_t)));
1067	_FDT(fdt_setprop_cell(fdt, rtas, "rtas-error-log-max",
1068	RTAS_ERROR_LOG_MAX));
1069	_FDT(fdt_setprop_cell(fdt, rtas, "rtas-event-scan-rate",
1070	RTAS_EVENT_SCAN_RATE));
1071
1072	g_assert(msi_nonbroken);
1073	_FDT(fdt_setprop(fdt, rtas, "ibm,change-msix-capable", NULL, 0));
1074
1075	/*
1076	* According to PAPR, rtas ibm,os-term does not guarantee a return
1077	* back to the guest cpu.
1078	*
1079	* While an additional ibm,extended-os-term property indicates
1080	* that rtas call return will always occur. Set this property.
1081	*/
1082	_FDT(fdt_setprop(fdt, rtas, "ibm,extended-os-term", NULL, 0));
1083
1084	_FDT(fdt_setprop(fdt, rtas, "ibm,lrdr-capacity",
1085	lrdr_capacity, sizeof(lrdr_capacity)));
1086
1087	spapr_dt_rtas_fadump(spapr, fdt, rtas);
1088
1089	spapr_dt_rtas_tokens(fdt, rtas);
1090	}
1091
1092	/*
1093	* Prepare ibm,arch-vec-5-platform-support, which indicates the MMU
1094	* and the XIVE features that the guest may request and thus the valid
1095	* values for bytes 23..26 of option vector 5:
1096	*/
1097	static void spapr_dt_ov5_platform_support(SpaprMachineState spapr, void fdt,
1098	int chosen)
1099	{
1100	PowerPCCPU *first_ppc_cpu = POWERPC_CPU(first_cpu);
1101
1102	char val[2 * 4] = {
1103	23, 0x00, /* XICS / XIVE mode */
1104	24, 0x00, /* Hash/Radix, filled in below. */
1105	25, 0x00, /* Hash options: Segment Tables == no, GTSE == no. */
1106	26, 0x40, /* Radix options: GTSE == yes. */
1107	};
1108
1109	if (spapr->irq->xics && spapr->irq->xive) {
1110	val[1] = SPAPR_OV5_XIVE_BOTH;
1111	} else if (spapr->irq->xive) {
1112	val[1] = SPAPR_OV5_XIVE_EXPLOIT;
1113	} else {
1114	assert(spapr->irq->xics);
1115	val[1] = SPAPR_OV5_XIVE_LEGACY;
1116	}
1117
1118	if (!ppc_check_compat(first_ppc_cpu, CPU_POWERPC_LOGICAL_3_00, 0,
1119	first_ppc_cpu->compat_pvr)) {
1120	/*
1121	* If we're in a pre POWER9 compat mode then the guest should
1122	* do hash and use the legacy interrupt mode
1123	*/
1124	val[1] = SPAPR_OV5_XIVE_LEGACY; /* XICS */
1125	val[3] = 0x00; /* Hash */
1126	spapr_check_mmu_mode(false);
1127	} else if (kvm_enabled()) {
1128	if (kvmppc_has_cap_mmu_radix() && kvmppc_has_cap_mmu_hash_v3()) {
1129	val[3] = 0x80; /* OV5_MMU_BOTH */
1130	} else if (kvmppc_has_cap_mmu_radix()) {
1131	val[3] = 0x40; /* OV5_MMU_RADIX_300 */
1132	} else {
1133	val[3] = 0x00; /* Hash */
1134	}
1135	} else {
1136	/* V3 MMU supports both hash and radix in tcg (with dynamic switching) */
1137	val[3] = 0xC0;
1138	}
1139	_FDT(fdt_setprop(fdt, chosen, "ibm,arch-vec-5-platform-support",
1140	val, sizeof(val)));
1141	}
1142
1143	static void spapr_dt_chosen(SpaprMachineState spapr, void fdt, bool reset)
1144	{
1145	MachineState *machine = MACHINE(spapr);
1146	int chosen;
1147
1148	_FDT(chosen = fdt_add_subnode(fdt, 0, "chosen"));
1149
1150	if (reset) {
1151	const char *boot_device = spapr->boot_device;
1152	g_autofree char *stdout_path = spapr_vio_stdout_path(spapr->vio_bus);
1153	size_t cb = 0;
1154	g_autofree char *bootlist = get_boot_devices_list(&cb);
1155
1156	if (machine->kernel_cmdline && machine->kernel_cmdline[0]) {
1157	_FDT(fdt_setprop_string(fdt, chosen, "bootargs",
1158	machine->kernel_cmdline));
1159	}
1160
1161	if (spapr->initrd_size) {
1162	_FDT(fdt_setprop_cell(fdt, chosen, "linux,initrd-start",
1163	spapr->initrd_base));
1164	_FDT(fdt_setprop_cell(fdt, chosen, "linux,initrd-end",
1165	spapr->initrd_base + spapr->initrd_size));
1166	}
1167
1168	if (spapr->kernel_size) {
1169	uint64_t kprop[2] = { cpu_to_be64(spapr->kernel_addr),
1170	cpu_to_be64(spapr->kernel_size) };
1171
1172	_FDT(fdt_setprop(fdt, chosen, "qemu,boot-kernel",
1173	&kprop, sizeof(kprop)));
1174	if (spapr->kernel_le) {
1175	_FDT(fdt_setprop(fdt, chosen, "qemu,boot-kernel-le", NULL, 0));
1176	}
1177	}
1178	if (machine->boot_config.has_menu && machine->boot_config.menu) {
1179	_FDT((fdt_setprop_cell(fdt, chosen, "qemu,boot-menu", true)));
1180	}
1181	if (!graphic_width) {
1182	graphic_width = 800;
1183	}
1184	if (!graphic_height) {
1185	graphic_height = 600;
1186	}
1187	if (!graphic_depth) {
1188	graphic_depth = 32;
1189	}
1190	_FDT(fdt_setprop_cell(fdt, chosen, "qemu,graphic-width", graphic_width));
1191	_FDT(fdt_setprop_cell(fdt, chosen, "qemu,graphic-height", graphic_height));
1192	_FDT(fdt_setprop_cell(fdt, chosen, "qemu,graphic-depth", graphic_depth));
1193
1194	if (cb && bootlist) {
1195	int i;
1196
1197	for (i = 0; i < cb; i++) {
1198	if (bootlist[i] == '\n') {
1199	bootlist[i] = ' ';
1200	}
1201	}
1202	_FDT(fdt_setprop_string(fdt, chosen, "qemu,boot-list", bootlist));
1203	}
1204
1205	if (boot_device && strlen(boot_device)) {
1206	_FDT(fdt_setprop_string(fdt, chosen, "qemu,boot-device", boot_device));
1207	}
1208
1209	if (spapr->want_stdout_path && stdout_path) {
1210	/*
1211	* "linux,stdout-path" and "stdout" properties are
1212	* deprecated by linux kernel. New platforms should only
1213	* use the "stdout-path" property. Set the new property
1214	* and continue using older property to remain compatible
1215	* with the existing firmware.
1216	*/
1217	_FDT(fdt_setprop_string(fdt, chosen, "linux,stdout-path", stdout_path));
1218	_FDT(fdt_setprop_string(fdt, chosen, "stdout-path", stdout_path));
1219	}
1220
1221	/*
1222	* We can deal with BAR reallocation just fine, advertise it
1223	* to the guest
1224	*/
1225	_FDT(fdt_setprop_cell(fdt, chosen, "linux,pci-probe-only", 0));
1226
1227	spapr_dt_ov5_platform_support(spapr, fdt, chosen);
1228	}
1229
1230	_FDT(fdt_setprop(fdt, chosen, "rng-seed", spapr->fdt_rng_seed, 32));
1231
1232	_FDT(spapr_dt_ovec(fdt, chosen, spapr->ov5_cas, "ibm,architecture-vec-5"));
1233	}
1234
1235	static void spapr_dt_hypervisor(SpaprMachineState spapr, void fdt)
1236	{
1237	/* The /hypervisor node isn't in PAPR - this is a hack to allow PR
1238	* KVM to work under pHyp with some guest co-operation */
1239	int hypervisor;
1240	uint8_t hypercall[16];
1241
1242	_FDT(hypervisor = fdt_add_subnode(fdt, 0, "hypervisor"));
1243	/* indicate KVM hypercall interface */
1244	_FDT(fdt_setprop_string(fdt, hypervisor, "compatible", "linux,kvm"));
1245	if (kvmppc_has_cap_fixup_hcalls()) {
1246	/*
1247	* Older KVM versions with older guest kernels were broken
1248	* with the magic page, don't allow the guest to map it.
1249	*/
1250	if (!kvmppc_get_hypercall(cpu_env(first_cpu), hypercall,
1251	sizeof(hypercall))) {
1252	_FDT(fdt_setprop(fdt, hypervisor, "hcall-instructions",
1253	hypercall, sizeof(hypercall)));
1254	}
1255	}
1256	}
1257
1258	void spapr_build_fdt(SpaprMachineState spapr, bool reset, size_t space)
1259	{
1260	MachineState *machine = MACHINE(spapr);
1261	MachineClass *mc = MACHINE_GET_CLASS(machine);
1262	uint32_t root_drc_type_mask = 0;
1263	int ret;
1264	void *fdt;
1265	SpaprPhbState *phb;
1266	char *buf;
1267
1268	fdt = g_malloc0(space);
1269	_FDT((fdt_create_empty_tree(fdt, space)));
1270
1271	/* Root node */
1272	_FDT(fdt_setprop_string(fdt, 0, "device_type", "chrp"));
1273	_FDT(fdt_setprop_string(fdt, 0, "model", "IBM pSeries (emulated by qemu)"));
1274	_FDT(fdt_setprop_string(fdt, 0, "compatible", "qemu,pseries"));
1275
1276	/* Guest UUID & Name*/
1277	buf = qemu_uuid_unparse_strdup(&qemu_uuid);
1278	_FDT(fdt_setprop_string(fdt, 0, "vm,uuid", buf));
1279	if (qemu_uuid_set) {
1280	_FDT(fdt_setprop_string(fdt, 0, "system-id", buf));
1281	}
1282	g_free(buf);
1283
1284	if (qemu_get_vm_name()) {
1285	_FDT(fdt_setprop_string(fdt, 0, "ibm,partition-name",
1286	qemu_get_vm_name()));
1287	}
1288
1289	/* Host Model & Serial Number */
1290	if (spapr->host_model) {
1291	_FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model));
1292	}
1293
1294	if (spapr->host_serial) {
1295	_FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial));
1296	}
1297
1298	_FDT(fdt_setprop_cell(fdt, 0, "#address-cells", 2));
1299	_FDT(fdt_setprop_cell(fdt, 0, "#size-cells", 2));
1300
1301	/* /interrupt controller */
1302	spapr_irq_dt(spapr, spapr_max_server_number(spapr), fdt, PHANDLE_INTC);
1303
1304	ret = spapr_dt_memory(spapr, fdt);
1305	if (ret < 0) {
1306	error_report("couldn't setup memory nodes in fdt");
1307	exit(1);
1308	}
1309
1310	/* /vdevice */
1311	spapr_dt_vdevice(spapr->vio_bus, fdt);
1312
1313	if (object_resolve_path_type("", TYPE_SPAPR_RNG, NULL)) {
1314	ret = spapr_dt_rng(fdt);
1315	if (ret < 0) {
1316	error_report("could not set up rng device in the fdt");
1317	exit(1);
1318	}
1319	}
1320
1321	QLIST_FOREACH(phb, &spapr->phbs, list) {
1322	ret = spapr_dt_phb(spapr, phb, PHANDLE_INTC, fdt, NULL);
1323	if (ret < 0) {
1324	error_report("couldn't setup PCI devices in fdt");
1325	exit(1);
1326	}
1327	}
1328
1329	spapr_dt_cpus(fdt, spapr);
1330
1331	/* ibm,drc-indexes and friends */
1332	root_drc_type_mask \|= SPAPR_DR_CONNECTOR_TYPE_LMB;
1333	root_drc_type_mask \|= SPAPR_DR_CONNECTOR_TYPE_PHB;
1334
1335	if (mc->nvdimm_supported) {
1336	root_drc_type_mask \|= SPAPR_DR_CONNECTOR_TYPE_PMEM;
1337	}
1338	if (root_drc_type_mask) {
1339	_FDT(spapr_dt_drc(fdt, 0, NULL, root_drc_type_mask));
1340	}
1341
1342	if (mc->has_hotpluggable_cpus) {
1343	int offset = fdt_path_offset(fdt, "/cpus");
1344	ret = spapr_dt_drc(fdt, offset, NULL, SPAPR_DR_CONNECTOR_TYPE_CPU);
1345	if (ret < 0) {
1346	error_report("Couldn't set up CPU DR device tree properties");
1347	exit(1);
1348	}
1349	}
1350
1351	/* /event-sources */
1352	spapr_dt_events(spapr, fdt);
1353
1354	/* /rtas */
1355	spapr_dt_rtas(spapr, fdt);
1356
1357	/* /chosen */
1358	spapr_dt_chosen(spapr, fdt, reset);
1359
1360	/* /hypervisor */
1361	if (kvm_enabled()) {
1362	spapr_dt_hypervisor(spapr, fdt);
1363	}
1364
1365	/* Build memory reserve map */
1366	if (reset) {
1367	if (spapr->kernel_size) {
1368	_FDT((fdt_add_mem_rsv(fdt, spapr->kernel_addr,
1369	spapr->kernel_size)));
1370	}
1371	if (spapr->initrd_size) {
1372	_FDT((fdt_add_mem_rsv(fdt, spapr->initrd_base,
1373	spapr->initrd_size)));
1374	}
1375	}
1376
1377	/* NVDIMM devices */
1378	if (mc->nvdimm_supported) {
1379	spapr_dt_persistent_memory(spapr, fdt);
1380	}
1381
1382	return fdt;
1383	}
1384
1385	static uint64_t translate_kernel_address(void *opaque, uint64_t addr)
1386	{
1387	SpaprMachineState *spapr = opaque;
1388
1389	return (addr & 0x0fffffff) + spapr->kernel_addr;
1390	}
1391
1392	static void emulate_spapr_hypercall(PPCVirtualHypervisor *vhyp,
1393	PowerPCCPU *cpu)
1394	{
1395	CPUPPCState *env = &cpu->env;
1396
1397	/* The TCG path should also be holding the BQL at this point */
1398	g_assert(bql_locked());
1399
1400	g_assert(!vhyp_cpu_in_nested(cpu));
1401
1402	if (FIELD_EX64(env->msr, MSR, PR)) {
1403	hcall_dprintf("Hypercall made with MSR[PR]=1\n");
1404	env->gpr[3] = H_PRIVILEGE;
1405	} else {
1406	env->gpr[3] = spapr_hypercall(cpu, env->gpr[3], &env->gpr[4]);
1407	}
1408	}
1409
1410	struct LPCRSyncState {
1411	target_ulong value;
1412	target_ulong mask;
1413	};
1414
1415	static void do_lpcr_sync(CPUState *cs, run_on_cpu_data arg)
1416	{
1417	struct LPCRSyncState *s = arg.host_ptr;
1418	PowerPCCPU *cpu = POWERPC_CPU(cs);
1419	CPUPPCState *env = &cpu->env;
1420	target_ulong lpcr;
1421
1422	cpu_synchronize_state(cs);
1423	lpcr = env->spr[SPR_LPCR];
1424	lpcr &= ~s->mask;
1425	lpcr \|= s->value;
1426	ppc_store_lpcr(cpu, lpcr);
1427	}
1428
1429	void spapr_set_all_lpcrs(target_ulong value, target_ulong mask)
1430	{
1431	CPUState *cs;
1432	struct LPCRSyncState s = {
1433	.value = value,
1434	.mask = mask
1435	};
1436	CPU_FOREACH(cs) {
1437	run_on_cpu(cs, do_lpcr_sync, RUN_ON_CPU_HOST_PTR(&s));
1438	}
1439	}
1440
1441	/* May be used when the machine is not running */
1442	void spapr_init_all_lpcrs(target_ulong value, target_ulong mask)
1443	{
1444	CPUState *cs;
1445	CPU_FOREACH(cs) {
1446	PowerPCCPU *cpu = POWERPC_CPU(cs);
1447	CPUPPCState *env = &cpu->env;
1448	target_ulong lpcr;
1449
1450	lpcr = env->spr[SPR_LPCR];
1451	lpcr &= ~(LPCR_HR \| LPCR_UPRT);
1452	ppc_store_lpcr(cpu, lpcr);
1453	}
1454	}
1455
1456	static bool spapr_get_pate(PPCVirtualHypervisor vhyp, PowerPCCPU cpu,
1457	target_ulong lpid, ppc_v3_pate_t *entry)
1458	{
1459	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1460	SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
1461
1462	if (!spapr_cpu->in_nested) {
1463	assert(lpid == 0);
1464
1465	/* Copy PATE1:GR into PATE0:HR */
1466	entry->dw0 = spapr->patb_entry & PATE0_HR;
1467	entry->dw1 = spapr->patb_entry;
1468	return true;
1469	} else {
1470	if (spapr_nested_api(spapr) == NESTED_API_KVM_HV) {
1471	return spapr_get_pate_nested_hv(spapr, cpu, lpid, entry);
1472	} else if (spapr_nested_api(spapr) == NESTED_API_PAPR) {
1473	return spapr_get_pate_nested_papr(spapr, cpu, lpid, entry);
1474	} else {
1475	g_assert_not_reached();
1476	}
1477	}
1478	}
1479
1480	static uint64_t hpte_get_ptr(SpaprMachineState s, unsigned index)
1481	{
1482	uint64_t *table = s->htab;
1483
1484	return &table[2 * index];
1485	}
1486
1487	static bool hpte_is_valid(SpaprMachineState *s, unsigned index)
1488	{
1489	return ldq_be_p(hpte_get_ptr(s, index)) & HPTE64_V_VALID;
1490	}
1491
1492	static bool hpte_is_dirty(SpaprMachineState *s, unsigned index)
1493	{
1494	return ldq_be_p(hpte_get_ptr(s, index)) & HPTE64_V_HPTE_DIRTY;
1495	}
1496
1497	static void hpte_set_clean(SpaprMachineState *s, unsigned index)
1498	{
1499	stq_be_p(hpte_get_ptr(s, index),
1500	ldq_be_p(hpte_get_ptr(s, index)) & ~HPTE64_V_HPTE_DIRTY);
1501	}
1502
1503	static void hpte_set_dirty(SpaprMachineState *s, unsigned index)
1504	{
1505	stq_be_p(hpte_get_ptr(s, index),
1506	ldq_be_p(hpte_get_ptr(s, index)) \| HPTE64_V_HPTE_DIRTY);
1507	}
1508
1509	/*
1510	* Get the fd to access the kernel htab, re-opening it if necessary
1511	*/
1512	static int get_htab_fd(SpaprMachineState *spapr)
1513	{
1514	Error *local_err = NULL;
1515
1516	if (spapr->htab_fd >= 0) {
1517	return spapr->htab_fd;
1518	}
1519
1520	spapr->htab_fd = kvmppc_get_htab_fd(false, 0, &local_err);
1521	if (spapr->htab_fd < 0) {
1522	error_report_err(local_err);
1523	}
1524
1525	return spapr->htab_fd;
1526	}
1527
1528	void close_htab_fd(SpaprMachineState *spapr)
1529	{
1530	if (spapr->htab_fd >= 0) {
1531	close(spapr->htab_fd);
1532	}
1533	spapr->htab_fd = -1;
1534	}
1535
1536	static hwaddr spapr_hpt_mask(PPCVirtualHypervisor *vhyp)
1537	{
1538	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1539
1540	return HTAB_SIZE(spapr) / HASH_PTEG_SIZE_64 - 1;
1541	}
1542
1543	static target_ulong spapr_encode_hpt_for_kvm_pr(PPCVirtualHypervisor *vhyp)
1544	{
1545	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1546
1547	assert(kvm_enabled());
1548
1549	if (!spapr->htab) {
1550	return 0;
1551	}
1552
1553	return (target_ulong)(uintptr_t)spapr->htab \| (spapr->htab_shift - 18);
1554	}
1555
1556	static const ppc_hash_pte64_t spapr_map_hptes(PPCVirtualHypervisor vhyp,
1557	hwaddr ptex, int n)
1558	{
1559	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1560	hwaddr pte_offset = ptex * HASH_PTE_SIZE_64;
1561
1562	if (!spapr->htab) {
1563	/*
1564	* HTAB is controlled by KVM. Fetch into temporary buffer
1565	*/
1566	ppc_hash_pte64_t hptes = g_malloc(n HASH_PTE_SIZE_64);
1567	kvmppc_read_hptes(hptes, ptex, n);
1568	return hptes;
1569	}
1570
1571	/*
1572	* HTAB is controlled by QEMU. Just point to the internally
1573	* accessible PTEG.
1574	*/
1575	return (const ppc_hash_pte64_t *)(spapr->htab + pte_offset);
1576	}
1577
1578	static void spapr_unmap_hptes(PPCVirtualHypervisor *vhyp,
1579	const ppc_hash_pte64_t *hptes,
1580	hwaddr ptex, int n)
1581	{
1582	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1583
1584	if (!spapr->htab) {
1585	g_free((void *)hptes);
1586	}
1587
1588	/* Nothing to do for qemu managed HPT */
1589	}
1590
1591	void spapr_store_hpte(PowerPCCPU *cpu, hwaddr ptex,
1592	uint64_t pte0, uint64_t pte1)
1593	{
1594	SpaprMachineState *spapr = SPAPR_MACHINE(cpu->vhyp);
1595	hwaddr offset = ptex * HASH_PTE_SIZE_64;
1596
1597	if (!spapr->htab) {
1598	kvmppc_write_hpte(ptex, pte0, pte1);
1599	} else {
1600	if (pte0 & HPTE64_V_VALID) {
1601	stq_p(spapr->htab + offset + HPTE64_DW1, pte1);
1602	/*
1603	* When setting valid, we write PTE1 first. This ensures
1604	* proper synchronization with the reading code in
1605	* ppc_hash64_pteg_search()
1606	*/
1607	smp_wmb();
1608	stq_p(spapr->htab + offset, pte0);
1609	} else {
1610	stq_p(spapr->htab + offset, pte0);
1611	/*
1612	* When clearing it we set PTE0 first. This ensures proper
1613	* synchronization with the reading code in
1614	* ppc_hash64_pteg_search()
1615	*/
1616	smp_wmb();
1617	stq_p(spapr->htab + offset + HPTE64_DW1, pte1);
1618	}
1619	}
1620	}
1621
1622	static void spapr_hpte_set_c(PPCVirtualHypervisor *vhyp, hwaddr ptex,
1623	uint64_t pte1)
1624	{
1625	hwaddr offset = ptex * HASH_PTE_SIZE_64 + HPTE64_DW1_C;
1626	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1627
1628	if (!spapr->htab) {
1629	/* There should always be a hash table when this is called */
1630	error_report("spapr_hpte_set_c called with no hash table !");
1631	return;
1632	}
1633
1634	/* The HW performs a non-atomic byte update */
1635	stb_p(spapr->htab + offset, (pte1 & 0xff) \| 0x80);
1636	}
1637
1638	static void spapr_hpte_set_r(PPCVirtualHypervisor *vhyp, hwaddr ptex,
1639	uint64_t pte1)
1640	{
1641	hwaddr offset = ptex * HASH_PTE_SIZE_64 + HPTE64_DW1_R;
1642	SpaprMachineState *spapr = SPAPR_MACHINE(vhyp);
1643
1644	if (!spapr->htab) {
1645	/* There should always be a hash table when this is called */
1646	error_report("spapr_hpte_set_r called with no hash table !");
1647	return;
1648	}
1649
1650	/* The HW performs a non-atomic byte update */
1651	stb_p(spapr->htab + offset, ((pte1 >> 8) & 0xff) \| 0x01);
1652	}
1653
1654	int spapr_hpt_shift_for_ramsize(uint64_t ramsize)
1655	{
1656	int shift;
1657
1658	/* We aim for a hash table of size 1/128 the size of RAM (rounded
1659	* up). The PAPR recommendation is actually 1/64 of RAM size, but
1660	* that's much more than is needed for Linux guests */
1661	shift = ctz64(pow2ceil(ramsize)) - 7;
1662	shift = MAX(shift, 18); /* Minimum architected size */
1663	shift = MIN(shift, 46); /* Maximum architected size */
1664	return shift;
1665	}
1666
1667	void spapr_free_hpt(SpaprMachineState *spapr)
1668	{
1669	qemu_vfree(spapr->htab);
1670	spapr->htab = NULL;
1671	spapr->htab_shift = 0;
1672	close_htab_fd(spapr);
1673	}
1674
1675	int spapr_reallocate_hpt(SpaprMachineState spapr, int shift, Error *errp)
1676	{
1677	ERRP_GUARD();
1678	long rc;
1679
1680	/* Clean up any HPT info from a previous boot */
1681	spapr_free_hpt(spapr);
1682
1683	rc = kvmppc_reset_htab(shift);
1684
1685	if (rc == -EOPNOTSUPP) {
1686	error_setg(errp, "HPT not supported in nested guests");
1687	return -EOPNOTSUPP;
1688	}
1689
1690	if (rc < 0) {
1691	/* kernel-side HPT needed, but couldn't allocate one */
1692	error_setg_errno(errp, errno, "Failed to allocate KVM HPT of order %d",
1693	shift);
1694	error_append_hint(errp, "Try smaller maxmem?\n");
1695	return -errno;
1696	} else if (rc > 0) {
1697	/* kernel-side HPT allocated */
1698	if (rc != shift) {
1699	error_setg(errp,
1700	"Requested order %d HPT, but kernel allocated order %ld",
1701	shift, rc);
1702	error_append_hint(errp, "Try smaller maxmem?\n");
1703	return -ENOSPC;
1704	}
1705
1706	spapr->htab_shift = shift;
1707	spapr->htab = NULL;
1708	} else {
1709	/* kernel-side HPT not needed, allocate in userspace instead */
1710	size_t size = 1ULL << shift;
1711	int i;
1712
1713	spapr->htab = qemu_memalign(size, size);
1714	memset(spapr->htab, 0, size);
1715	spapr->htab_shift = shift;
1716
1717	for (i = 0; i < size / HASH_PTE_SIZE_64; i++) {
1718	hpte_set_dirty(spapr, i);
1719	}
1720	}
1721	/* We're setting up a hash table, so that means we're not radix */
1722	spapr->patb_entry = 0;
1723	spapr_init_all_lpcrs(0, LPCR_HR \| LPCR_UPRT);
1724	return 0;
1725	}
1726
1727	void spapr_setup_hpt(SpaprMachineState *spapr)
1728	{
1729	int hpt_shift;
1730
1731	if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DISABLED) {
1732	hpt_shift = spapr_hpt_shift_for_ramsize(MACHINE(spapr)->maxram_size);
1733	} else {
1734	uint64_t current_ram_size;
1735
1736	current_ram_size = MACHINE(spapr)->ram_size + get_plugged_memory_size();
1737	hpt_shift = spapr_hpt_shift_for_ramsize(current_ram_size);
1738	}
1739	spapr_reallocate_hpt(spapr, hpt_shift, &error_fatal);
1740
1741	if (kvm_enabled()) {
1742	hwaddr vrma_limit = kvmppc_vrma_limit(spapr->htab_shift);
1743
1744	/* Check our RMA fits in the possible VRMA */
1745	if (vrma_limit < spapr->rma_size) {
1746	error_report("Unable to create %" HWADDR_PRIu
1747	"MiB RMA (VRMA only allows %" HWADDR_PRIu "MiB",
1748	spapr->rma_size / MiB, vrma_limit / MiB);
1749	exit(EXIT_FAILURE);
1750	}
1751	}
1752	}
1753
1754	void spapr_check_mmu_mode(bool guest_radix)
1755	{
1756	if (guest_radix) {
1757	if (kvm_enabled() && !kvmppc_has_cap_mmu_radix()) {
1758	error_report("Guest requested unavailable MMU mode (radix).");
1759	exit(EXIT_FAILURE);
1760	}
1761	} else {
1762	if (kvm_enabled() && kvmppc_has_cap_mmu_radix()
1763	&& !kvmppc_has_cap_mmu_hash_v3()) {
1764	error_report("Guest requested unavailable MMU mode (hash).");
1765	exit(EXIT_FAILURE);
1766	}
1767	}
1768	}
1769
1770	static void spapr_machine_reset(MachineState *machine, ResetType type)
1771	{
1772	SpaprMachineState *spapr = SPAPR_MACHINE(machine);
1773	PowerPCCPU *first_ppc_cpu;
1774	hwaddr fdt_addr;
1775	void *fdt;
1776	int rc;
1777
1778	if (type != RESET_TYPE_SNAPSHOT_LOAD) {
1779	/*
1780	* Record-replay snapshot load must not consume random, this was
1781	* already replayed from initial machine reset.
1782	*/
1783	qemu_guest_getrandom_nofail(spapr->fdt_rng_seed, 32);
1784	}
1785
1786	if (machine->cgs) {
1787	confidential_guest_kvm_reset(machine->cgs, &error_fatal);
1788	}
1789	spapr_caps_apply(spapr);
1790	spapr_nested_reset(spapr);
1791
1792	first_ppc_cpu = POWERPC_CPU(first_cpu);
1793	if (kvm_enabled() && kvmppc_has_cap_mmu_radix() &&
1794	ppc_type_check_compat(machine->cpu_type, CPU_POWERPC_LOGICAL_3_00, 0,
1795	spapr->max_compat_pvr)) {
1796	/*
1797	* If using KVM with radix mode available, VCPUs can be started
1798	* without a HPT because KVM will start them in radix mode.
1799	* Set the GR bit in PATE so that we know there is no HPT.
1800	*/
1801	spapr->patb_entry = PATE1_GR;
1802	spapr_set_all_lpcrs(LPCR_HR \| LPCR_UPRT, LPCR_HR \| LPCR_UPRT);
1803	} else {
1804	spapr_setup_hpt(spapr);
1805	}
1806
1807	qemu_devices_reset(type);
1808
1809	spapr_ovec_cleanup(spapr->ov5_cas);
1810	spapr->ov5_cas = spapr_ovec_new();
1811
1812	ppc_init_compat_all(spapr->max_compat_pvr, &error_fatal);
1813
1814	/*
1815	* This is fixing some of the default configuration of the XIVE
1816	* devices. To be called after the reset of the machine devices.
1817	*/
1818	spapr_irq_reset(spapr, &error_fatal);
1819
1820	/*
1821	* There is no CAS under qtest. Simulate one to please the code that
1822	* depends on spapr->ov5_cas. This is especially needed to test device
1823	* unplug, so we do that before resetting the DRCs.
1824	*/
1825	if (qtest_enabled()) {
1826	spapr_ovec_cleanup(spapr->ov5_cas);
1827	spapr->ov5_cas = spapr_ovec_clone(spapr->ov5);
1828	}
1829
1830	spapr_nvdimm_finish_flushes();
1831
1832	/* DRC reset may cause a device to be unplugged. This will cause troubles
1833	* if this device is used by another device (eg, a running vhost backend
1834	* will crash QEMU if the DIMM holding the vring goes away). To avoid such
1835	* situations, we reset DRCs after all devices have been reset.
1836	*/
1837	spapr_drc_reset_all(spapr);
1838
1839	spapr_clear_pending_events(spapr);
1840
1841	/*
1842	* We place the device tree just below either the top of the RMA,
1843	* or just below 2GB, whichever is lower, so that it can be
1844	* processed with 32-bit real mode code if necessary
1845	*/
1846	fdt_addr = MIN(spapr->rma_size, FDT_MAX_ADDR) - FDT_MAX_SIZE;
1847
1848	fdt = spapr_build_fdt(spapr, true, FDT_MAX_SIZE);
1849	if (spapr->vof) {
1850	spapr_vof_reset(spapr, fdt, &error_fatal);
1851	/*
1852	* Do not pack the FDT as the client may change properties.
1853	* VOF client does not expect the FDT so we do not load it to the VM.
1854	*/
1855	} else {
1856	rc = fdt_pack(fdt);
1857	/* Should only fail if we've built a corrupted tree */
1858	assert(rc == 0);
1859
1860	spapr_cpu_set_entry_state(first_ppc_cpu, SPAPR_ENTRY_POINT,
1861	0, fdt_addr, 0);
1862	physical_memory_write(fdt_addr, fdt, fdt_totalsize(fdt));
1863	}
1864
1865	g_free(spapr->fdt_blob);
1866	spapr->fdt_size = fdt_totalsize(fdt);
1867	spapr->fdt_initial_size = spapr->fdt_size;
1868	spapr->fdt_blob = fdt;
1869
1870	/* Set machine->fdt for 'dumpdtb' QMP/HMP command */
1871	machine->fdt = fdt;
1872
1873	/* Set up the entry state */
1874	first_ppc_cpu->env.gpr[5] = 0;
1875
1876	spapr->fwnmi_system_reset_addr = -1;
1877	spapr->fwnmi_machine_check_addr = -1;
1878	spapr->fwnmi_machine_check_interlock = -1;
1879
1880	/* Signal all vCPUs waiting on this condition */
1881	qemu_cond_broadcast(&spapr->fwnmi_machine_check_interlock_cond);
1882
1883	migrate_del_blocker(&spapr->fwnmi_migration_blocker);
1884	}
1885
1886	static void spapr_create_nvram(SpaprMachineState *spapr)
1887	{
1888	DeviceState *dev = qdev_new("spapr-nvram");
1889	DriveInfo *dinfo = drive_get(IF_PFLASH, 0, 0);
1890
1891	if (dinfo) {
1892	qdev_prop_set_drive_err(dev, "drive", blk_by_legacy_dinfo(dinfo),
1893	&error_fatal);
1894	}
1895
1896	qdev_realize_and_unref(dev, &spapr->vio_bus->bus, &error_fatal);
1897
1898	spapr->nvram = (struct SpaprNvram *)dev;
1899	}
1900
1901	static void spapr_rtc_create(SpaprMachineState *spapr)
1902	{
1903	object_initialize_child_with_props(OBJECT(spapr), "rtc", &spapr->rtc,
1904	sizeof(spapr->rtc), TYPE_SPAPR_RTC,
1905	&error_fatal, NULL);
1906	qdev_realize(DEVICE(&spapr->rtc), NULL, &error_fatal);
1907	object_property_add_alias(OBJECT(spapr), "rtc-time", OBJECT(&spapr->rtc),
1908	"date");
1909	}
1910
1911	/* Returns whether we want to use VGA or not */
1912	static bool spapr_vga_init(PCIBus pci_bus, Error *errp)
1913	{
1914	vga_interface_created = true;
1915	switch (vga_interface_type) {
1916	case VGA_NONE:
1917	return false;
1918	case VGA_DEVICE:
1919	return true;
1920	case VGA_STD:
1921	case VGA_VIRTIO:
1922	case VGA_CIRRUS:
1923	return pci_vga_init(pci_bus) != NULL;
1924	default:
1925	error_setg(errp,
1926	"Unsupported VGA mode, only -vga std or -vga virtio is supported");
1927	return false;
1928	}
1929	}
1930
1931	static int spapr_pre_load(void *opaque)
1932	{
1933	int rc;
1934
1935	rc = spapr_caps_pre_load(opaque);
1936	if (rc) {
1937	return rc;
1938	}
1939
1940	return 0;
1941	}
1942
1943	static int spapr_post_load(void *opaque, int version_id)
1944	{
1945	SpaprMachineState spapr = (SpaprMachineState )opaque;
1946	int err = 0;
1947
1948	err = spapr_caps_post_migration(spapr);
1949	if (err) {
1950	return err;
1951	}
1952
1953	/*
1954	* In earlier versions, there was no separate qdev for the PAPR
1955	* RTC, so the RTC offset was stored directly in sPAPREnvironment.
1956	* So when migrating from those versions, poke the incoming offset
1957	* value into the RTC device
1958	*/
1959	if (version_id < 3) {
1960	err = spapr_rtc_import_offset(&spapr->rtc, spapr->rtc_offset);
1961	if (err) {
1962	return err;
1963	}
1964	}
1965
1966	if (kvm_enabled() && spapr->patb_entry) {
1967	PowerPCCPU *cpu = POWERPC_CPU(first_cpu);
1968	bool radix = !!(spapr->patb_entry & PATE1_GR);
1969	bool gtse = !!(cpu->env.spr[SPR_LPCR] & LPCR_GTSE);
1970
1971	/*
1972	* Update LPCR:HR and UPRT as they may not be set properly in
1973	* the stream
1974	*/
1975	spapr_set_all_lpcrs(radix ? (LPCR_HR \| LPCR_UPRT) : 0,
1976	LPCR_HR \| LPCR_UPRT);
1977
1978	err = kvmppc_configure_v3_mmu(cpu, radix, gtse, spapr->patb_entry);
1979	if (err) {
1980	error_report("Process table config unsupported by the host");
1981	return -EINVAL;
1982	}
1983	}
1984
1985	err = spapr_irq_post_load(spapr, version_id);
1986	if (err) {
1987	return err;
1988	}
1989
1990	return err;
1991	}
1992
1993	static int spapr_pre_save(void *opaque)
1994	{
1995	int rc;
1996
1997	rc = spapr_caps_pre_save(opaque);
1998	if (rc) {
1999	return rc;
2000	}
2001
2002	return 0;
2003	}
2004
2005	static bool version_before_3(void *opaque, int version_id)
2006	{
2007	return version_id < 3;
2008	}
2009
2010	static bool spapr_pending_events_needed(void *opaque)
2011	{
2012	SpaprMachineState spapr = (SpaprMachineState )opaque;
2013	return !QTAILQ_EMPTY(&spapr->pending_events);
2014	}
2015
2016	static const VMStateDescription vmstate_spapr_event_entry = {
2017	.name = "spapr_event_log_entry",
2018	.version_id = 1,
2019	.minimum_version_id = 1,
2020	.fields = (const VMStateField[]) {
2021	VMSTATE_UINT32(summary, SpaprEventLogEntry),
2022	VMSTATE_UINT32(extended_length, SpaprEventLogEntry),
2023	VMSTATE_VBUFFER_ALLOC_UINT32(extended_log, SpaprEventLogEntry, 0,
2024	NULL, extended_length),
2025	VMSTATE_END_OF_LIST()
2026	},
2027	};
2028
2029	static const VMStateDescription vmstate_spapr_pending_events = {
2030	.name = "spapr_pending_events",
2031	.version_id = 1,
2032	.minimum_version_id = 1,
2033	.needed = spapr_pending_events_needed,
2034	.fields = (const VMStateField[]) {
2035	VMSTATE_QTAILQ_V(pending_events, SpaprMachineState, 1,
2036	vmstate_spapr_event_entry, SpaprEventLogEntry, next),
2037	VMSTATE_END_OF_LIST()
2038	},
2039	};
2040
2041	static bool spapr_ov5_cas_needed(void *opaque)
2042	{
2043	SpaprMachineState *spapr = opaque;
2044	SpaprOptionVector *ov5_mask = spapr_ovec_new();
2045	bool cas_needed;
2046
2047	/* Prior to the introduction of SpaprOptionVector, we had two option
2048	* vectors we dealt with: OV5_FORM1_AFFINITY, and OV5_DRCONF_MEMORY.
2049	* Both of these options encode machine topology into the device-tree
2050	* in such a way that the now-booted OS should still be able to interact
2051	* appropriately with QEMU regardless of what options were actually
2052	* negotiatied on the source side.
2053	*
2054	* As such, we can avoid migrating the CAS-negotiated options if these
2055	* are the only options available on the current machine/platform.
2056	* Since these are the only options available for pseries-2.7 and
2057	* earlier, this allows us to maintain old->new/new->old migration
2058	* compatibility.
2059	*
2060	* For QEMU 2.8+, there are additional CAS-negotiatable options available
2061	* via default pseries-2.8 machines and explicit command-line parameters.
2062	* Some of these options, like OV5_HP_EVT, do require QEMU to be aware
2063	* of the actual CAS-negotiated values to continue working properly. For
2064	* example, availability of memory unplug depends on knowing whether
2065	* OV5_HP_EVT was negotiated via CAS.
2066	*
2067	* Thus, for any cases where the set of available CAS-negotiatable
2068	* options extends beyond OV5_FORM1_AFFINITY and OV5_DRCONF_MEMORY, we
2069	* include the CAS-negotiated options in the migration stream, unless
2070	* if they affect boot time behaviour only.
2071	*/
2072	spapr_ovec_set(ov5_mask, OV5_FORM1_AFFINITY);
2073	spapr_ovec_set(ov5_mask, OV5_DRCONF_MEMORY);
2074	spapr_ovec_set(ov5_mask, OV5_DRMEM_V2);
2075
2076	/* We need extra information if we have any bits outside the mask
2077	* defined above */
2078	cas_needed = !spapr_ovec_subset(spapr->ov5, ov5_mask);
2079
2080	spapr_ovec_cleanup(ov5_mask);
2081
2082	return cas_needed;
2083	}
2084
2085	static const VMStateDescription vmstate_spapr_ov5_cas = {
2086	.name = "spapr_option_vector_ov5_cas",
2087	.version_id = 1,
2088	.minimum_version_id = 1,
2089	.needed = spapr_ov5_cas_needed,
2090	.fields = (const VMStateField[]) {
2091	VMSTATE_STRUCT_POINTER_V(ov5_cas, SpaprMachineState, 1,
2092	vmstate_spapr_ovec, SpaprOptionVector),
2093	VMSTATE_END_OF_LIST()
2094	},
2095	};
2096
2097	static bool spapr_patb_entry_needed(void *opaque)
2098	{
2099	SpaprMachineState *spapr = opaque;
2100
2101	return !!spapr->patb_entry;
2102	}
2103
2104	static const VMStateDescription vmstate_spapr_patb_entry = {
2105	.name = "spapr_patb_entry",
2106	.version_id = 1,
2107	.minimum_version_id = 1,
2108	.needed = spapr_patb_entry_needed,
2109	.fields = (const VMStateField[]) {
2110	VMSTATE_UINT64(patb_entry, SpaprMachineState),
2111	VMSTATE_END_OF_LIST()
2112	},
2113	};
2114
2115	static bool spapr_irq_map_needed(void *opaque)
2116	{
2117	SpaprMachineState *spapr = opaque;
2118
2119	return spapr->irq_map && !bitmap_empty(spapr->irq_map, spapr->irq_map_nr);
2120	}
2121
2122	static const VMStateDescription vmstate_spapr_irq_map = {
2123	.name = "spapr_irq_map",
2124	.version_id = 1,
2125	.minimum_version_id = 1,
2126	.needed = spapr_irq_map_needed,
2127	.fields = (const VMStateField[]) {
2128	VMSTATE_BITMAP(irq_map, SpaprMachineState, 0, irq_map_nr),
2129	VMSTATE_END_OF_LIST()
2130	},
2131	};
2132
2133	static int spapr_dtb_pre_load(void *opaque)
2134	{
2135	SpaprMachineState spapr = (SpaprMachineState )opaque;
2136
2137	g_free(spapr->fdt_blob);
2138	spapr->fdt_blob = NULL;
2139	spapr->fdt_size = 0;
2140
2141	return 0;
2142	}
2143
2144	static const VMStateDescription vmstate_spapr_dtb = {
2145	.name = "spapr_dtb",
2146	.version_id = 1,
2147	.minimum_version_id = 1,
2148	.pre_load = spapr_dtb_pre_load,
2149	.fields = (const VMStateField[]) {
2150	VMSTATE_UINT32(fdt_initial_size, SpaprMachineState),
2151	VMSTATE_UINT32(fdt_size, SpaprMachineState),
2152	VMSTATE_VBUFFER_ALLOC_UINT32(fdt_blob, SpaprMachineState, 0, NULL,
2153	fdt_size),
2154	VMSTATE_END_OF_LIST()
2155	},
2156	};
2157
2158	static bool spapr_fwnmi_needed(void *opaque)
2159	{
2160	SpaprMachineState spapr = (SpaprMachineState )opaque;
2161
2162	return spapr->fwnmi_machine_check_addr != -1;
2163	}
2164
2165	static int spapr_fwnmi_pre_save(void *opaque)
2166	{
2167	SpaprMachineState spapr = (SpaprMachineState )opaque;
2168
2169	/*
2170	* Check if machine check handling is in progress and print a
2171	* warning message.
2172	*/
2173	if (spapr->fwnmi_machine_check_interlock != -1) {
2174	warn_report("A machine check is being handled during migration. The"
2175	"handler may run and log hardware error on the destination");
2176	}
2177
2178	return 0;
2179	}
2180
2181	static const VMStateDescription vmstate_spapr_fwnmi = {
2182	.name = "spapr_fwnmi",
2183	.version_id = 1,
2184	.minimum_version_id = 1,
2185	.needed = spapr_fwnmi_needed,
2186	.pre_save = spapr_fwnmi_pre_save,
2187	.fields = (const VMStateField[]) {
2188	VMSTATE_UINT64(fwnmi_system_reset_addr, SpaprMachineState),
2189	VMSTATE_UINT64(fwnmi_machine_check_addr, SpaprMachineState),
2190	VMSTATE_INT32(fwnmi_machine_check_interlock, SpaprMachineState),
2191	VMSTATE_END_OF_LIST()
2192	},
2193	};
2194
2195	static const VMStateDescription vmstate_spapr = {
2196	.name = "spapr",
2197	.version_id = 3,
2198	.minimum_version_id = 1,
2199	.pre_load = spapr_pre_load,
2200	.post_load = spapr_post_load,
2201	.pre_save = spapr_pre_save,
2202	.fields = (const VMStateField[]) {
2203	/* used to be @next_irq */
2204	VMSTATE_UNUSED_BUFFER(version_before_3, 0, 4),
2205
2206	/* RTC offset */
2207	VMSTATE_UINT64_TEST(rtc_offset, SpaprMachineState, version_before_3),
2208
2209	VMSTATE_PPC_TIMEBASE_V(tb, SpaprMachineState, 2),
2210	VMSTATE_END_OF_LIST()
2211	},
2212	.subsections = (const VMStateDescription * const []) {
2213	&vmstate_spapr_ov5_cas,
2214	&vmstate_spapr_patb_entry,
2215	&vmstate_spapr_pending_events,
2216	&vmstate_spapr_cap_htm,
2217	&vmstate_spapr_cap_vsx,
2218	&vmstate_spapr_cap_dfp,
2219	&vmstate_spapr_cap_cfpc,
2220	&vmstate_spapr_cap_sbbc,
2221	&vmstate_spapr_cap_ibs,
2222	&vmstate_spapr_cap_hpt_maxpagesize,
2223	&vmstate_spapr_irq_map,
2224	&vmstate_spapr_cap_nested_kvm_hv,
2225	&vmstate_spapr_dtb,
2226	&vmstate_spapr_cap_large_decr,
2227	&vmstate_spapr_cap_ccf_assist,
2228	&vmstate_spapr_cap_fwnmi,
2229	&vmstate_spapr_fwnmi,
2230	&vmstate_spapr_cap_rpt_invalidate,
2231	&vmstate_spapr_cap_ail_mode_3,
2232	&vmstate_spapr_cap_nested_papr,
2233	&vmstate_spapr_cap_dawr1,
2234	NULL
2235	}
2236	};
2237
2238	static int htab_save_setup(QEMUFile f, void opaque, Error **errp)
2239	{
2240	SpaprMachineState *spapr = opaque;
2241
2242	/* "Iteration" header */
2243	if (!spapr->htab_shift) {
2244	qemu_put_be32(f, -1);
2245	} else {
2246	qemu_put_be32(f, spapr->htab_shift);
2247	}
2248
2249	if (spapr->htab) {
2250	spapr->htab_save_index = 0;
2251	spapr->htab_first_pass = true;
2252	} else {
2253	if (spapr->htab_shift) {
2254	assert(kvm_enabled());
2255	}
2256	}
2257
2258
2259	return 0;
2260	}
2261
2262	static void htab_save_chunk(QEMUFile f, SpaprMachineState spapr,
2263	int chunkstart, int n_valid, int n_invalid)
2264	{
2265	qemu_put_be32(f, chunkstart);
2266	qemu_put_be16(f, n_valid);
2267	qemu_put_be16(f, n_invalid);
2268	qemu_put_buffer(f, (void *)hpte_get_ptr(spapr, chunkstart),
2269	HASH_PTE_SIZE_64 * n_valid);
2270	}
2271
2272	static void htab_save_end_marker(QEMUFile *f)
2273	{
2274	qemu_put_be32(f, 0);
2275	qemu_put_be16(f, 0);
2276	qemu_put_be16(f, 0);
2277	}
2278
2279	static void htab_save_first_pass(QEMUFile f, SpaprMachineState spapr,
2280	int64_t max_ns)
2281	{
2282	bool has_timeout = max_ns != -1;
2283	int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
2284	int index = spapr->htab_save_index;
2285	int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
2286
2287	assert(spapr->htab_first_pass);
2288
2289	do {
2290	int chunkstart;
2291
2292	/* Consume invalid HPTEs */
2293	while ((index < htabslots)
2294	&& !hpte_is_valid(spapr, index)) {
2295	hpte_set_clean(spapr, index);
2296	index++;
2297	}
2298
2299	/* Consume valid HPTEs */
2300	chunkstart = index;
2301	while ((index < htabslots) && (index - chunkstart < USHRT_MAX)
2302	&& hpte_is_valid(spapr, index)) {
2303	hpte_set_clean(spapr, index);
2304	index++;
2305	}
2306
2307	if (index > chunkstart) {
2308	int n_valid = index - chunkstart;
2309
2310	htab_save_chunk(f, spapr, chunkstart, n_valid, 0);
2311
2312	if (has_timeout &&
2313	(qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - starttime) > max_ns) {
2314	break;
2315	}
2316	}
2317	} while ((index < htabslots) && !migration_rate_exceeded(f));
2318
2319	if (index >= htabslots) {
2320	assert(index == htabslots);
2321	index = 0;
2322	spapr->htab_first_pass = false;
2323	}
2324	spapr->htab_save_index = index;
2325	}
2326
2327	static int htab_save_later_pass(QEMUFile f, SpaprMachineState spapr,
2328	int64_t max_ns)
2329	{
2330	bool final = max_ns < 0;
2331	int htabslots = HTAB_SIZE(spapr) / HASH_PTE_SIZE_64;
2332	int examined = 0, sent = 0;
2333	int index = spapr->htab_save_index;
2334	int64_t starttime = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
2335
2336	assert(!spapr->htab_first_pass);
2337
2338	do {
2339	int chunkstart, invalidstart;
2340
2341	/* Consume non-dirty HPTEs */
2342	while ((index < htabslots)
2343	&& !hpte_is_dirty(spapr, index)) {
2344	index++;
2345	examined++;
2346	}
2347
2348	chunkstart = index;
2349	/* Consume valid dirty HPTEs */
2350	while ((index < htabslots) && (index - chunkstart < USHRT_MAX)
2351	&& hpte_is_dirty(spapr, index)
2352	&& hpte_is_valid(spapr, index)) {
2353	hpte_set_clean(spapr, index);
2354	index++;
2355	examined++;
2356	}
2357
2358	invalidstart = index;
2359	/* Consume invalid dirty HPTEs */
2360	while ((index < htabslots) && (index - invalidstart < USHRT_MAX)
2361	&& hpte_is_dirty(spapr, index)
2362	&& !hpte_is_valid(spapr, index)) {
2363	hpte_set_clean(spapr, index);
2364	index++;
2365	examined++;
2366	}
2367
2368	if (index > chunkstart) {
2369	int n_valid = invalidstart - chunkstart;
2370	int n_invalid = index - invalidstart;
2371
2372	htab_save_chunk(f, spapr, chunkstart, n_valid, n_invalid);
2373	sent += index - chunkstart;
2374
2375	if (!final && (qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - starttime) > max_ns) {
2376	break;
2377	}
2378	}
2379
2380	if (examined >= htabslots) {
2381	break;
2382	}
2383
2384	if (index >= htabslots) {
2385	assert(index == htabslots);
2386	index = 0;
2387	}
2388	} while ((examined < htabslots) && (!migration_rate_exceeded(f) \|\| final));
2389
2390	if (index >= htabslots) {
2391	assert(index == htabslots);
2392	index = 0;
2393	}
2394
2395	spapr->htab_save_index = index;
2396
2397	return (examined >= htabslots) && (sent == 0) ? 1 : 0;
2398	}
2399
2400	#define MAX_ITERATION_NS 5000000 /* 5 ms */
2401	#define MAX_KVM_BUF_SIZE 2048
2402
2403	static int htab_save_iterate(QEMUFile f, void opaque)
2404	{
2405	SpaprMachineState *spapr = opaque;
2406	int fd;
2407	int rc = 0;
2408
2409	/* Iteration header */
2410	if (!spapr->htab_shift) {
2411	qemu_put_be32(f, -1);
2412	return 1;
2413	} else {
2414	qemu_put_be32(f, 0);
2415	}
2416
2417	if (!spapr->htab) {
2418	assert(kvm_enabled());
2419
2420	fd = get_htab_fd(spapr);
2421	if (fd < 0) {
2422	return fd;
2423	}
2424
2425	rc = kvmppc_save_htab(f, fd, MAX_KVM_BUF_SIZE, MAX_ITERATION_NS);
2426	if (rc < 0) {
2427	return rc;
2428	}
2429	} else if (spapr->htab_first_pass) {
2430	htab_save_first_pass(f, spapr, MAX_ITERATION_NS);
2431	} else {
2432	rc = htab_save_later_pass(f, spapr, MAX_ITERATION_NS);
2433	}
2434
2435	htab_save_end_marker(f);
2436
2437	return rc;
2438	}
2439
2440	static int htab_save_complete(QEMUFile f, void opaque)
2441	{
2442	SpaprMachineState *spapr = opaque;
2443	int fd;
2444
2445	/* Iteration header */
2446	if (!spapr->htab_shift) {
2447	qemu_put_be32(f, -1);
2448	return 0;
2449	} else {
2450	qemu_put_be32(f, 0);
2451	}
2452
2453	if (!spapr->htab) {
2454	int rc;
2455
2456	assert(kvm_enabled());
2457
2458	fd = get_htab_fd(spapr);
2459	if (fd < 0) {
2460	return fd;
2461	}
2462
2463	rc = kvmppc_save_htab(f, fd, MAX_KVM_BUF_SIZE, -1);
2464	if (rc < 0) {
2465	return rc;
2466	}
2467	} else {
2468	if (spapr->htab_first_pass) {
2469	htab_save_first_pass(f, spapr, -1);
2470	}
2471	htab_save_later_pass(f, spapr, -1);
2472	}
2473
2474	/* End marker */
2475	htab_save_end_marker(f);
2476
2477	return 0;
2478	}
2479
2480	static int htab_load(QEMUFile f, void opaque, int version_id)
2481	{
2482	SpaprMachineState *spapr = opaque;
2483	uint32_t section_hdr;
2484	int fd = -1;
2485	Error *local_err = NULL;
2486
2487	if (version_id < 1 \|\| version_id > 1) {
2488	error_report("htab_load() bad version");
2489	return -EINVAL;
2490	}
2491
2492	section_hdr = qemu_get_be32(f);
2493
2494	if (section_hdr == -1) {
2495	spapr_free_hpt(spapr);
2496	return 0;
2497	}
2498
2499	if (section_hdr) {
2500	int ret;
2501
2502	/* First section gives the htab size */
2503	ret = spapr_reallocate_hpt(spapr, section_hdr, &local_err);
2504	if (ret < 0) {
2505	error_report_err(local_err);
2506	return ret;
2507	}
2508	return 0;
2509	}
2510
2511	if (!spapr->htab) {
2512	assert(kvm_enabled());
2513
2514	fd = kvmppc_get_htab_fd(true, 0, &local_err);
2515	if (fd < 0) {
2516	error_report_err(local_err);
2517	return fd;
2518	}
2519	}
2520
2521	while (true) {
2522	uint32_t index;
2523	uint16_t n_valid, n_invalid;
2524
2525	index = qemu_get_be32(f);
2526	n_valid = qemu_get_be16(f);
2527	n_invalid = qemu_get_be16(f);
2528
2529	if ((index == 0) && (n_valid == 0) && (n_invalid == 0)) {
2530	/* End of Stream */
2531	break;
2532	}
2533
2534	if ((index + n_valid + n_invalid) >
2535	(HTAB_SIZE(spapr) / HASH_PTE_SIZE_64)) {
2536	/* Bad index in stream */
2537	error_report(
2538	"htab_load() bad index %d (%hd+%hd entries) in htab stream (htab_shift=%d)",
2539	index, n_valid, n_invalid, spapr->htab_shift);
2540	return -EINVAL;
2541	}
2542
2543	if (spapr->htab) {
2544	if (n_valid) {
2545	qemu_get_buffer(f, (void *)hpte_get_ptr(spapr, index),
2546	HASH_PTE_SIZE_64 * n_valid);
2547	}
2548	if (n_invalid) {
2549	memset(hpte_get_ptr(spapr, index + n_valid), 0,
2550	HASH_PTE_SIZE_64 * n_invalid);
2551	}
2552	} else {
2553	int rc;
2554
2555	assert(fd >= 0);
2556
2557	rc = kvmppc_load_htab_chunk(f, fd, index, n_valid, n_invalid,
2558	&local_err);
2559	if (rc < 0) {
2560	error_report_err(local_err);
2561	return rc;
2562	}
2563	}
2564	}
2565
2566	if (!spapr->htab) {
2567	assert(fd >= 0);
2568	close(fd);
2569	}
2570
2571	return 0;
2572	}
2573
2574	static void htab_save_cleanup(void *opaque)
2575	{
2576	SpaprMachineState *spapr = opaque;
2577
2578	close_htab_fd(spapr);
2579	}
2580
2581	static SaveVMHandlers savevm_htab_handlers = {
2582	.save_setup = htab_save_setup,
2583	.save_live_iterate = htab_save_iterate,
2584	.save_complete = htab_save_complete,
2585	.save_cleanup = htab_save_cleanup,
2586	.load_state = htab_load,
2587	};
2588
2589	static void spapr_boot_set(void opaque, const char boot_device,
2590	Error **errp)
2591	{
2592	SpaprMachineState *spapr = SPAPR_MACHINE(opaque);
2593
2594	g_free(spapr->boot_device);
2595	spapr->boot_device = g_strdup(boot_device);
2596	}
2597
2598	static void spapr_create_lmb_dr_connectors(SpaprMachineState *spapr)
2599	{
2600	MachineState *machine = MACHINE(spapr);
2601	uint64_t lmb_size = SPAPR_MEMORY_BLOCK_SIZE;
2602	uint32_t nr_lmbs = (machine->maxram_size - machine->ram_size)/lmb_size;
2603	int i;
2604
2605	g_assert(!nr_lmbs \|\| machine->device_memory);
2606	for (i = 0; i < nr_lmbs; i++) {
2607	uint64_t addr;
2608
2609	addr = i * lmb_size + machine->device_memory->base;
2610	spapr_dr_connector_new(OBJECT(spapr), TYPE_SPAPR_DRC_LMB,
2611	addr / lmb_size);
2612	}
2613	}
2614
2615	/*
2616	* If RAM size, maxmem size and individual node mem sizes aren't aligned
2617	* to SPAPR_MEMORY_BLOCK_SIZE(256MB), then refuse to start the guest
2618	* since we can't support such unaligned sizes with DRCONF_MEMORY.
2619	*/
2620	static void spapr_validate_node_memory(MachineState machine, Error *errp)
2621	{
2622	int i;
2623
2624	if (machine->ram_size % SPAPR_MEMORY_BLOCK_SIZE) {
2625	error_setg(errp, "Memory size 0x" RAM_ADDR_FMT
2626	" is not aligned to %" PRIu64 " MiB",
2627	machine->ram_size,
2628	SPAPR_MEMORY_BLOCK_SIZE / MiB);
2629	return;
2630	}
2631
2632	if (machine->maxram_size % SPAPR_MEMORY_BLOCK_SIZE) {
2633	error_setg(errp, "Maximum memory size 0x" RAM_ADDR_FMT
2634	" is not aligned to %" PRIu64 " MiB",
2635	machine->ram_size,
2636	SPAPR_MEMORY_BLOCK_SIZE / MiB);
2637	return;
2638	}
2639
2640	for (i = 0; i < machine->numa_state->num_nodes; i++) {
2641	if (machine->numa_state->nodes[i].node_mem % SPAPR_MEMORY_BLOCK_SIZE) {
2642	error_setg(errp,
2643	"Node %d memory size 0x%" PRIx64
2644	" is not aligned to %" PRIu64 " MiB",
2645	i, machine->numa_state->nodes[i].node_mem,
2646	SPAPR_MEMORY_BLOCK_SIZE / MiB);
2647	return;
2648	}
2649	}
2650	}
2651
2652	/* find cpu slot in machine->possible_cpus by core_id */
2653	static CPUArchId spapr_find_cpu_slot(MachineState ms, uint32_t id, int *idx)
2654	{
2655	int index = id / ms->smp.threads;
2656
2657	if (index >= ms->possible_cpus->len) {
2658	return NULL;
2659	}
2660	if (idx) {
2661	*idx = index;
2662	}
2663	return &ms->possible_cpus->cpus[index];
2664	}
2665
2666	static void spapr_set_vsmt_mode(SpaprMachineState spapr, Error *errp)
2667	{
2668	MachineState *ms = MACHINE(spapr);
2669	Error *local_err = NULL;
2670	bool vsmt_user = !!spapr->vsmt;
2671	int kvm_smt = kvmppc_smt_threads();
2672	int ret;
2673	unsigned int smp_threads = ms->smp.threads;
2674
2675	if (tcg_enabled()) {
2676	if (smp_threads > 1 &&
2677	!ppc_type_check_compat(ms->cpu_type, CPU_POWERPC_LOGICAL_2_07, 0,
2678	spapr->max_compat_pvr)) {
2679	error_setg(errp, "TCG only supports SMT on POWER8 or newer CPUs");
2680	return;
2681	}
2682
2683	if (smp_threads > 8) {
2684	error_setg(errp, "TCG cannot support more than 8 threads/core "
2685	"on a pseries machine");
2686	return;
2687	}
2688	}
2689	if (!is_power_of_2(smp_threads)) {
2690	error_setg(errp, "Cannot support %d threads/core on a pseries "
2691	"machine because it must be a power of 2", smp_threads);
2692	return;
2693	}
2694
2695	/* Determine the VSMT mode to use: */
2696	if (vsmt_user) {
2697	if (spapr->vsmt < smp_threads) {
2698	error_setg(errp, "Cannot support VSMT mode %d"
2699	" because it must be >= threads/core (%d)",
2700	spapr->vsmt, smp_threads);
2701	return;
2702	}
2703	/* In this case, spapr->vsmt has been set by the command line */
2704	} else {
2705	spapr->vsmt = smp_threads;
2706	}
2707
2708	/* KVM: If necessary, set the SMT mode: */
2709	if (kvm_enabled() && (spapr->vsmt != kvm_smt)) {
2710	ret = kvmppc_set_smt_threads(spapr->vsmt);
2711	if (ret) {
2712	/* Looks like KVM isn't able to change VSMT mode */
2713	error_setg_errno(&local_err, -ret,
2714	"Failed to set KVM's VSMT mode to %d",
2715	spapr->vsmt);
2716	/* We can live with that if the default one is big enough
2717	* for the number of threads, and a submultiple of the one
2718	* we want. In this case we'll waste some vcpu ids, but
2719	* behaviour will be correct */
2720	if ((kvm_smt >= smp_threads) && ((spapr->vsmt % kvm_smt) == 0)) {
2721	warn_report_err(local_err);
2722	} else {
2723	if (!vsmt_user) {
2724	error_append_hint(&local_err,
2725	"On PPC, a VM with %d threads/core"
2726	" on a host with %d threads/core"
2727	" requires the use of VSMT mode %d.\n",
2728	smp_threads, kvm_smt, spapr->vsmt);
2729	}
2730	kvmppc_error_append_smt_possible_hint(&local_err);
2731	error_propagate(errp, local_err);
2732	}
2733	}
2734	}
2735	/* else TCG: nothing to do currently */
2736	}
2737
2738	static void spapr_init_cpus(SpaprMachineState *spapr)
2739	{
2740	MachineState *machine = MACHINE(spapr);
2741	MachineClass *mc = MACHINE_GET_CLASS(machine);
2742	const char *type = spapr_get_cpu_core_type(machine->cpu_type);
2743	const CPUArchIdList *possible_cpus;
2744	unsigned int smp_cpus = machine->smp.cpus;
2745	unsigned int smp_threads = machine->smp.threads;
2746	unsigned int max_cpus = machine->smp.max_cpus;
2747	int boot_cores_nr = smp_cpus / smp_threads;
2748	int i;
2749
2750	possible_cpus = mc->possible_cpu_arch_ids(machine);
2751	if (mc->has_hotpluggable_cpus) {
2752	if (smp_cpus % smp_threads) {
2753	error_report("smp_cpus (%u) must be multiple of threads (%u)",
2754	smp_cpus, smp_threads);
2755	exit(1);
2756	}
2757	if (max_cpus % smp_threads) {
2758	error_report("max_cpus (%u) must be multiple of threads (%u)",
2759	max_cpus, smp_threads);
2760	exit(1);
2761	}
2762	} else {
2763	if (max_cpus != smp_cpus) {
2764	error_report("This machine version does not support CPU hotplug");
2765	exit(1);
2766	}
2767	boot_cores_nr = possible_cpus->len;
2768	}
2769
2770	for (i = 0; i < possible_cpus->len; i++) {
2771	int core_id = i * smp_threads;
2772
2773	if (mc->has_hotpluggable_cpus) {
2774	spapr_dr_connector_new(OBJECT(spapr), TYPE_SPAPR_DRC_CPU,
2775	spapr_vcpu_id(spapr, core_id));
2776	}
2777
2778	if (i < boot_cores_nr) {
2779	Object *core = object_new(type);
2780	int nr_threads = smp_threads;
2781
2782	/* Handle the partially filled core for older machine types */
2783	if ((i + 1) * smp_threads >= smp_cpus) {
2784	nr_threads = smp_cpus - i * smp_threads;
2785	}
2786
2787	object_property_set_int(core, "nr-threads", nr_threads,
2788	&error_fatal);
2789	object_property_set_int(core, CPU_CORE_PROP_CORE_ID, core_id,
2790	&error_fatal);
2791	qdev_realize(DEVICE(core), NULL, &error_fatal);
2792
2793	object_unref(core);
2794	}
2795	}
2796	}
2797
2798	static PCIHostState *spapr_create_default_phb(void)
2799	{
2800	DeviceState *dev;
2801
2802	dev = qdev_new(TYPE_SPAPR_PCI_HOST_BRIDGE);
2803	qdev_prop_set_uint32(dev, "index", 0);
2804	sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
2805
2806	return PCI_HOST_BRIDGE(dev);
2807	}
2808
2809	static hwaddr spapr_rma_size(SpaprMachineState spapr, Error *errp)
2810	{
2811	MachineState *machine = MACHINE(spapr);
2812	hwaddr rma_size = machine->ram_size;
2813	hwaddr node0_size = spapr_node0_size(machine);
2814
2815	/* RMA has to fit in the first NUMA node */
2816	rma_size = MIN(rma_size, node0_size);
2817
2818	/*
2819	* VRMA access is via a special 1TiB SLB mapping, so the RMA can
2820	* never exceed that
2821	*/
2822	rma_size = MIN(rma_size, 1 * TiB);
2823
2824	if (rma_size < MIN_RMA_SLOF) {
2825	error_setg(errp,
2826	"pSeries SLOF firmware requires >= %" HWADDR_PRIx
2827	"ldMiB guest RMA (Real Mode Area memory)",
2828	MIN_RMA_SLOF / MiB);
2829	return 0;
2830	}
2831
2832	return rma_size;
2833	}
2834
2835	static void spapr_create_nvdimm_dr_connectors(SpaprMachineState *spapr)
2836	{
2837	MachineState *machine = MACHINE(spapr);
2838	int i;
2839
2840	for (i = 0; i < machine->ram_slots; i++) {
2841	spapr_dr_connector_new(OBJECT(spapr), TYPE_SPAPR_DRC_PMEM, i);
2842	}
2843	}
2844
2845	/* pSeries LPAR / sPAPR hardware init */
2846	static void spapr_machine_init(MachineState *machine)
2847	{
2848	SpaprMachineState *spapr = SPAPR_MACHINE(machine);
2849	SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(machine);
2850	MachineClass *mc = MACHINE_GET_CLASS(machine);
2851	const char *bios_default = spapr->vof ? FW_FILE_NAME_VOF : FW_FILE_NAME;
2852	const char *bios_name = machine->firmware ?: bios_default;
2853	g_autofree char *filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
2854	const char *kernel_filename = machine->kernel_filename;
2855	const char *initrd_filename = machine->initrd_filename;
2856	PCIHostState *phb;
2857	bool has_vga;
2858	int i;
2859	MemoryRegion *sysmem = get_system_memory();
2860	long load_limit, fw_size;
2861	Error *err = NULL;
2862	NICInfo *nd;
2863
2864	if (!filename) {
2865	error_report("Could not find LPAR firmware '%s'", bios_name);
2866	exit(1);
2867	}
2868	fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE, &error_fatal);
2869
2870	/*
2871	* if Secure VM (PEF) support is configured, then initialize it
2872	*/
2873	if (machine->cgs) {
2874	confidential_guest_kvm_init(machine->cgs, &error_fatal);
2875	}
2876
2877	msi_nonbroken = true;
2878
2879	QLIST_INIT(&spapr->phbs);
2880	QTAILQ_INIT(&spapr->pending_dimm_unplugs);
2881
2882	/* Determine capabilities to run with */
2883	spapr_caps_init(spapr);
2884
2885	kvmppc_check_papr_resize_hpt(&err);
2886	if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DEFAULT) {
2887	/*
2888	* If the user explicitly requested a mode we should either
2889	* supply it, or fail completely (which we do below). But if
2890	* it's not set explicitly, we reset our mode to something
2891	* that works
2892	*/
2893	if (err) {
2894	spapr->resize_hpt = SPAPR_RESIZE_HPT_DISABLED;
2895	error_free(err);
2896	err = NULL;
2897	} else {
2898	spapr->resize_hpt = smc->resize_hpt_default;
2899	}
2900	}
2901
2902	assert(spapr->resize_hpt != SPAPR_RESIZE_HPT_DEFAULT);
2903
2904	if ((spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) && err) {
2905	/*
2906	* User requested HPT resize, but this host can't supply it. Bail out
2907	*/
2908	error_report_err(err);
2909	exit(1);
2910	}
2911	error_free(err);
2912
2913	spapr->rma_size = spapr_rma_size(spapr, &error_fatal);
2914
2915	/* Setup a load limit for the ramdisk leaving room for SLOF and FDT */
2916	load_limit = MIN(spapr->rma_size, FDT_MAX_ADDR) - FW_OVERHEAD;
2917
2918	/*
2919	* VSMT must be set in order to be able to compute VCPU ids, ie to
2920	* call spapr_max_server_number() or spapr_vcpu_id().
2921	*/
2922	spapr_set_vsmt_mode(spapr, &error_fatal);
2923
2924	/* Set up Interrupt Controller before we create the VCPUs */
2925	spapr_irq_init(spapr, &error_fatal);
2926
2927	/* Set up containers for ibm,client-architecture-support negotiated options
2928	*/
2929	spapr->ov5 = spapr_ovec_new();
2930	spapr->ov5_cas = spapr_ovec_new();
2931
2932	spapr_ovec_set(spapr->ov5, OV5_DRCONF_MEMORY);
2933	spapr_validate_node_memory(machine, &error_fatal);
2934
2935	spapr_ovec_set(spapr->ov5, OV5_FORM1_AFFINITY);
2936
2937	/* Do not advertise FORM2 NUMA support for pseries-6.1 and older */
2938	if (!smc->pre_6_2_numa_affinity) {
2939	spapr_ovec_set(spapr->ov5, OV5_FORM2_AFFINITY);
2940	}
2941
2942	/* advertise support for dedicated HP event source to guests */
2943	if (spapr->use_hotplug_event_source) {
2944	spapr_ovec_set(spapr->ov5, OV5_HP_EVT);
2945	}
2946
2947	/* advertise support for HPT resizing */
2948	if (spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) {
2949	spapr_ovec_set(spapr->ov5, OV5_HPT_RESIZE);
2950	}
2951
2952	/* advertise support for ibm,dyamic-memory-v2 */
2953	spapr_ovec_set(spapr->ov5, OV5_DRMEM_V2);
2954
2955	/* advertise XIVE on POWER9 machines */
2956	if (spapr->irq->xive) {
2957	spapr_ovec_set(spapr->ov5, OV5_XIVE_EXPLOIT);
2958	}
2959
2960	qemu_guest_getrandom_nofail(&spapr->hashpkey_val,
2961	sizeof(spapr->hashpkey_val));
2962
2963	/* init CPUs */
2964	spapr_init_cpus(spapr);
2965
2966	/* Init numa_assoc_array */
2967	spapr_numa_associativity_init(spapr, machine);
2968
2969	if ((!kvm_enabled() \|\| kvmppc_has_cap_mmu_radix()) &&
2970	ppc_type_check_compat(machine->cpu_type, CPU_POWERPC_LOGICAL_3_00, 0,
2971	spapr->max_compat_pvr)) {
2972	spapr_ovec_set(spapr->ov5, OV5_MMU_RADIX_300);
2973	/* KVM and TCG always allow GTSE with radix... */
2974	spapr_ovec_set(spapr->ov5, OV5_MMU_RADIX_GTSE);
2975	}
2976	/* ... but not with hash (currently). */
2977
2978	if (kvm_enabled()) {
2979	/* Enable H_LOGICAL_CI_* so SLOF can talk to in-kernel devices */
2980	kvmppc_enable_logical_ci_hcalls();
2981	kvmppc_enable_set_mode_hcall();
2982
2983	/* H_CLEAR_MOD/_REF are mandatory in PAPR, but off by default */
2984	kvmppc_enable_clear_ref_mod_hcalls();
2985
2986	/* Enable H_PAGE_INIT */
2987	kvmppc_enable_h_page_init();
2988	}
2989
2990	/* map RAM */
2991	memory_region_add_subregion(sysmem, 0, machine->ram);
2992
2993	/* initialize hotplug memory address space */
2994	if (machine->ram_size < machine->maxram_size) {
2995	ram_addr_t device_mem_size = machine->maxram_size - machine->ram_size;
2996	hwaddr device_mem_base;
2997
2998	/*
2999	* Limit the number of hotpluggable memory slots to half the number
3000	* slots that KVM supports, leaving the other half for PCI and other
3001	* devices. However ensure that number of slots doesn't drop below 32.
3002	*/
3003	int max_memslots = kvm_enabled() ? kvm_get_max_memslots() / 2 :
3004	SPAPR_MAX_RAM_SLOTS;
3005
3006	if (max_memslots < SPAPR_MAX_RAM_SLOTS) {
3007	max_memslots = SPAPR_MAX_RAM_SLOTS;
3008	}
3009	if (machine->ram_slots > max_memslots) {
3010	error_report("Specified number of memory slots %"
3011	PRIu64" exceeds max supported %d",
3012	machine->ram_slots, max_memslots);
3013	exit(1);
3014	}
3015
3016	device_mem_base = ROUND_UP(machine->ram_size, SPAPR_DEVICE_MEM_ALIGN);
3017	machine_memory_devices_init(machine, device_mem_base, device_mem_size);
3018	}
3019
3020	spapr_create_lmb_dr_connectors(spapr);
3021
3022	if (mc->nvdimm_supported) {
3023	spapr_create_nvdimm_dr_connectors(spapr);
3024	}
3025
3026	/* Set up RTAS event infrastructure */
3027	spapr_events_init(spapr);
3028
3029	/* Set up the RTC RTAS interfaces */
3030	spapr_rtc_create(spapr);
3031
3032	/* Set up VIO bus */
3033	spapr->vio_bus = spapr_vio_bus_init();
3034
3035	for (i = 0; serial_hd(i); i++) {
3036	spapr_vty_create(spapr->vio_bus, serial_hd(i));
3037	}
3038
3039	/* We always have at least the nvram device on VIO */
3040	spapr_create_nvram(spapr);
3041
3042	/*
3043	* Setup hotplug / dynamic-reconfiguration connectors. top-level
3044	* connectors (described in root DT node's "ibm,drc-types" property)
3045	* are pre-initialized here. additional child connectors (such as
3046	* connectors for a PHBs PCI slots) are added as needed during their
3047	* parent's realization.
3048	*/
3049	for (i = 0; i < SPAPR_MAX_PHBS; i++) {
3050	spapr_dr_connector_new(OBJECT(machine), TYPE_SPAPR_DRC_PHB, i);
3051	}
3052
3053	/* Set up PCI */
3054	spapr_pci_rtas_init();
3055
3056	phb = spapr_create_default_phb();
3057
3058	while ((nd = qemu_find_nic_info("spapr-vlan", true, "ibmveth"))) {
3059	spapr_vlan_create(spapr->vio_bus, nd);
3060	}
3061
3062	pci_init_nic_devices(phb->bus, NULL);
3063
3064	for (i = 0; i <= drive_get_max_bus(IF_SCSI); i++) {
3065	spapr_vscsi_create(spapr->vio_bus);
3066	}
3067
3068	/* Graphics */
3069	has_vga = spapr_vga_init(phb->bus, &error_fatal);
3070	if (has_vga) {
3071	spapr->want_stdout_path = !machine->enable_graphics;
3072	machine->usb \|= defaults_enabled() && !machine->usb_disabled;
3073	} else {
3074	spapr->want_stdout_path = true;
3075	}
3076
3077	if (machine->usb) {
3078	pci_create_simple(phb->bus, -1, "nec-usb-xhci");
3079
3080	if (has_vga) {
3081	USBBus *usb_bus;
3082
3083	usb_bus = USB_BUS(object_resolve_type_unambiguous(TYPE_USB_BUS,
3084	&error_abort));
3085	usb_create_simple(usb_bus, "usb-kbd");
3086	usb_create_simple(usb_bus, "usb-mouse");
3087	}
3088	}
3089
3090	if (kernel_filename) {
3091	uint64_t loaded_addr = 0;
3092
3093	spapr->kernel_size = load_elf(kernel_filename, NULL,
3094	translate_kernel_address, spapr,
3095	NULL, &loaded_addr, NULL, NULL,
3096	ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
3097	if (spapr->kernel_size == ELF_LOAD_WRONG_ENDIAN) {
3098	spapr->kernel_size = load_elf(kernel_filename, NULL,
3099	translate_kernel_address, spapr,
3100	NULL, &loaded_addr, NULL, NULL,
3101	ELFDATA2LSB, PPC_ELF_MACHINE, 0, 0);
3102	spapr->kernel_le = spapr->kernel_size > 0;
3103	}
3104	if (spapr->kernel_size < 0) {
3105	error_report("error loading %s: %s", kernel_filename,
3106	load_elf_strerror(spapr->kernel_size));
3107	exit(1);
3108	}
3109
3110	if (spapr->kernel_addr != loaded_addr) {
3111	warn_report("spapr: kernel_addr changed from 0x%"PRIx64
3112	" to 0x%"PRIx64,
3113	spapr->kernel_addr, loaded_addr);
3114	spapr->kernel_addr = loaded_addr;
3115	}
3116
3117	/* load initrd */
3118	if (initrd_filename) {
3119	/* Try to locate the initrd in the gap between the kernel
3120	* and the firmware. Add a bit of space just in case
3121	*/
3122	spapr->initrd_base = (spapr->kernel_addr + spapr->kernel_size
3123	+ 0x1ffff) & ~0xffff;
3124	spapr->initrd_size = load_image_targphys(initrd_filename,
3125	spapr->initrd_base,
3126	load_limit - spapr->initrd_base,
3127	&error_fatal);
3128	}
3129	}
3130
3131	/* FIXME: Should register things through the MachineState's qdev
3132	* interface, this is a legacy from the sPAPREnvironment structure
3133	* which predated MachineState but had a similar function */
3134	vmstate_register(NULL, 0, &vmstate_spapr, spapr);
3135	register_savevm_live("spapr/htab", VMSTATE_INSTANCE_ID_ANY, 1,
3136	&savevm_htab_handlers, spapr);
3137
3138	qbus_set_hotplug_handler(sysbus_get_default(), OBJECT(machine));
3139
3140	qemu_register_boot_set(spapr_boot_set, spapr);
3141
3142	/*
3143	* Nothing needs to be done to resume a suspended guest because
3144	* suspending does not change the machine state, so no need for
3145	* a ->wakeup method.
3146	*/
3147	qemu_register_wakeup_support();
3148
3149	if (kvm_enabled()) {
3150	/* to stop and start vmclock */
3151	qemu_add_vm_change_state_handler(cpu_ppc_clock_vm_state_change,
3152	&spapr->tb);
3153
3154	kvmppc_spapr_enable_inkernel_multitce();
3155	}
3156
3157	qemu_cond_init(&spapr->fwnmi_machine_check_interlock_cond);
3158	if (spapr->vof) {
3159	spapr->vof->fw_size = fw_size; /* for claim() on itself */
3160	spapr_register_hypercall(KVMPPC_H_VOF_CLIENT, spapr_h_vof_client);
3161	}
3162
3163	spapr_watchdog_init(spapr);
3164	}
3165
3166	#define DEFAULT_KVM_TYPE "auto"
3167	static int spapr_kvm_type(MachineState machine, const char vm_type)
3168	{
3169	/*
3170	* The use of g_ascii_strcasecmp() for 'hv' and 'pr' is to
3171	* accommodate the 'HV' and 'PV' formats that exists in the
3172	* wild. The 'auto' mode is being introduced already as
3173	* lower-case, thus we don't need to bother checking for
3174	* "AUTO".
3175	*/
3176	if (!vm_type \|\| !strcmp(vm_type, DEFAULT_KVM_TYPE)) {
3177	return 0;
3178	}
3179
3180	if (!g_ascii_strcasecmp(vm_type, "hv")) {
3181	return 1;
3182	}
3183
3184	if (!g_ascii_strcasecmp(vm_type, "pr")) {
3185	return 2;
3186	}
3187
3188	error_report("Unknown kvm-type specified '%s'", vm_type);
3189	return -1;
3190	}
3191
3192	/*
3193	* Implementation of an interface to adjust firmware path
3194	* for the bootindex property handling.
3195	*/
3196	static char spapr_get_fw_dev_path(FWPathProvider p, BusState *bus,
3197	DeviceState *dev)
3198	{
3199	#define CAST(type, obj, name) \
3200	((type *)object_dynamic_cast(OBJECT(obj), (name)))
3201	SCSIDevice *d = CAST(SCSIDevice, dev, TYPE_SCSI_DEVICE);
3202	SpaprPhbState *phb = CAST(SpaprPhbState, dev, TYPE_SPAPR_PCI_HOST_BRIDGE);
3203	VHostSCSICommon *vsc = CAST(VHostSCSICommon, dev, TYPE_VHOST_SCSI_COMMON);
3204	PCIDevice *pcidev = CAST(PCIDevice, dev, TYPE_PCI_DEVICE);
3205
3206	if (d && bus) {
3207	void *spapr = CAST(void, bus->parent, "spapr-vscsi");
3208	VirtIOSCSI *virtio = CAST(VirtIOSCSI, bus->parent, TYPE_VIRTIO_SCSI);
3209	USBDevice *usb = CAST(USBDevice, bus->parent, TYPE_USB_DEVICE);
3210
3211	if (spapr) {
3212	/*
3213	* Replace "channel@0/disk@0,0" with "disk@8000000000000000":
3214	* In the top 16 bits of the 64-bit LUN, we use SRP luns of the form
3215	* 0x8000 \| (target << 8) \| (bus << 5) \| lun
3216	* (see the "Logical unit addressing format" table in SAM5)
3217	*/
3218	unsigned id = 0x8000 \| (d->id << 8) \| (d->channel << 5) \| d->lun;
3219	return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
3220	(uint64_t)id << 48);
3221	} else if (virtio) {
3222	/*
3223	* We use SRP luns of the form 01000000 \| (target << 8) \| lun
3224	* in the top 32 bits of the 64-bit LUN
3225	* Note: the quote above is from SLOF and it is wrong,
3226	* the actual binding is:
3227	* swap 0100 or 10 << or 20 << ( target lun-id -- srplun )
3228	*/
3229	unsigned id = 0x1000000 \| (d->id << 16) \| d->lun;
3230	if (d->lun >= 256) {
3231	/* Use the LUN "flat space addressing method" */
3232	id \|= 0x4000;
3233	}
3234	return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
3235	(uint64_t)id << 32);
3236	} else if (usb) {
3237	/*
3238	* We use SRP luns of the form 01000000 \| (usb-port << 16) \| lun
3239	* in the top 32 bits of the 64-bit LUN
3240	*/
3241	unsigned usb_port = atoi(usb->port->path);
3242	unsigned id = 0x1000000 \| (usb_port << 16) \| d->lun;
3243	return g_strdup_printf("%s@%"PRIX64, qdev_fw_name(dev),
3244	(uint64_t)id << 32);
3245	}
3246	}
3247
3248	/*
3249	* SLOF probes the USB devices, and if it recognizes that the device is a
3250	* storage device, it changes its name to "storage" instead of "usb-host",
3251	* and additionally adds a child node for the SCSI LUN, so the correct
3252	* boot path in SLOF is something like .../storage@1/disk@xxx" instead.
3253	*/
3254	if (strcmp("usb-host", qdev_fw_name(dev)) == 0) {
3255	USBDevice *usbdev = CAST(USBDevice, dev, TYPE_USB_DEVICE);
3256	if (usb_device_is_scsi_storage(usbdev)) {
3257	return g_strdup_printf("storage@%s/disk", usbdev->port->path);
3258	}
3259	}
3260
3261	if (phb) {
3262	/* Replace "pci" with "pci@800000020000000" */
3263	return g_strdup_printf("pci@%"PRIX64, phb->buid);
3264	}
3265
3266	if (vsc) {
3267	/* Same logic as virtio above */
3268	unsigned id = 0x1000000 \| (vsc->target << 16) \| vsc->lun;
3269	return g_strdup_printf("disk@%"PRIX64, (uint64_t)id << 32);
3270	}
3271
3272	if (g_str_equal("pci-bridge", qdev_fw_name(dev))) {
3273	/* SLOF uses "pci" instead of "pci-bridge" for PCI bridges */
3274	PCIDevice *pdev = CAST(PCIDevice, dev, TYPE_PCI_DEVICE);
3275	return g_strdup_printf("pci@%x", PCI_SLOT(pdev->devfn));
3276	}
3277
3278	if (pcidev) {
3279	return spapr_pci_fw_dev_name(pcidev);
3280	}
3281
3282	return NULL;
3283	}
3284
3285	static char spapr_get_kvm_type(Object obj, Error **errp)
3286	{
3287	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3288
3289	return g_strdup(spapr->kvm_type);
3290	}
3291
3292	static void spapr_set_kvm_type(Object obj, const char value, Error **errp)
3293	{
3294	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3295
3296	g_free(spapr->kvm_type);
3297	spapr->kvm_type = g_strdup(value);
3298	}
3299
3300	static bool spapr_get_modern_hotplug_events(Object obj, Error *errp)
3301	{
3302	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3303
3304	return spapr->use_hotplug_event_source;
3305	}
3306
3307	static void spapr_set_modern_hotplug_events(Object *obj, bool value,
3308	Error **errp)
3309	{
3310	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3311
3312	spapr->use_hotplug_event_source = value;
3313	}
3314
3315	static bool spapr_get_msix_emulation(Object obj, Error *errp)
3316	{
3317	return true;
3318	}
3319
3320	static char spapr_get_resize_hpt(Object obj, Error **errp)
3321	{
3322	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3323
3324	switch (spapr->resize_hpt) {
3325	case SPAPR_RESIZE_HPT_DEFAULT:
3326	return g_strdup("default");
3327	case SPAPR_RESIZE_HPT_DISABLED:
3328	return g_strdup("disabled");
3329	case SPAPR_RESIZE_HPT_ENABLED:
3330	return g_strdup("enabled");
3331	case SPAPR_RESIZE_HPT_REQUIRED:
3332	return g_strdup("required");
3333	}
3334	g_assert_not_reached();
3335	}
3336
3337	static void spapr_set_resize_hpt(Object obj, const char value, Error **errp)
3338	{
3339	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3340
3341	if (strcmp(value, "default") == 0) {
3342	spapr->resize_hpt = SPAPR_RESIZE_HPT_DEFAULT;
3343	} else if (strcmp(value, "disabled") == 0) {
3344	spapr->resize_hpt = SPAPR_RESIZE_HPT_DISABLED;
3345	} else if (strcmp(value, "enabled") == 0) {
3346	spapr->resize_hpt = SPAPR_RESIZE_HPT_ENABLED;
3347	} else if (strcmp(value, "required") == 0) {
3348	spapr->resize_hpt = SPAPR_RESIZE_HPT_REQUIRED;
3349	} else {
3350	error_setg(errp, "Bad value for \"resize-hpt\" property");
3351	}
3352	}
3353
3354	static bool spapr_get_vof(Object obj, Error *errp)
3355	{
3356	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3357
3358	return spapr->vof != NULL;
3359	}
3360
3361	static void spapr_set_vof(Object obj, bool value, Error *errp)
3362	{
3363	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3364
3365	if (spapr->vof) {
3366	vof_cleanup(spapr->vof);
3367	g_free(spapr->vof);
3368	spapr->vof = NULL;
3369	}
3370	if (!value) {
3371	return;
3372	}
3373	spapr->vof = g_malloc0(sizeof(*spapr->vof));
3374	}
3375
3376	static char spapr_get_ic_mode(Object obj, Error **errp)
3377	{
3378	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3379
3380	if (spapr->irq == &spapr_irq_xics) {
3381	return g_strdup("xics");
3382	} else if (spapr->irq == &spapr_irq_xive) {
3383	return g_strdup("xive");
3384	} else if (spapr->irq == &spapr_irq_dual) {
3385	return g_strdup("dual");
3386	}
3387	g_assert_not_reached();
3388	}
3389
3390	static void spapr_set_ic_mode(Object obj, const char value, Error **errp)
3391	{
3392	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3393
3394	/* The legacy IRQ backend can not be set */
3395	if (strcmp(value, "xics") == 0) {
3396	spapr->irq = &spapr_irq_xics;
3397	} else if (strcmp(value, "xive") == 0) {
3398	spapr->irq = &spapr_irq_xive;
3399	} else if (strcmp(value, "dual") == 0) {
3400	spapr->irq = &spapr_irq_dual;
3401	} else {
3402	error_setg(errp, "Bad value for \"ic-mode\" property");
3403	}
3404	}
3405
3406	static char spapr_get_host_model(Object obj, Error **errp)
3407	{
3408	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3409
3410	return g_strdup(spapr->host_model);
3411	}
3412
3413	static void spapr_set_host_model(Object obj, const char value, Error **errp)
3414	{
3415	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3416
3417	g_free(spapr->host_model);
3418	spapr->host_model = g_strdup(value);
3419	}
3420
3421	static char spapr_get_host_serial(Object obj, Error **errp)
3422	{
3423	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3424
3425	return g_strdup(spapr->host_serial);
3426	}
3427
3428	static void spapr_set_host_serial(Object obj, const char value, Error **errp)
3429	{
3430	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3431
3432	g_free(spapr->host_serial);
3433	spapr->host_serial = g_strdup(value);
3434	}
3435
3436	static void spapr_instance_init(Object *obj)
3437	{
3438	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3439	SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
3440	MachineState *ms = MACHINE(spapr);
3441	MachineClass *mc = MACHINE_GET_CLASS(ms);
3442
3443	/*
3444	* NVDIMM support went live in 5.1 without considering that, in
3445	* other archs, the user needs to enable NVDIMM support with the
3446	* 'nvdimm' machine option and the default behavior is NVDIMM
3447	* support disabled. It is too late to roll back to the standard
3448	* behavior without breaking 5.1 guests.
3449	*/
3450	if (mc->nvdimm_supported) {
3451	ms->nvdimms_state->is_enabled = true;
3452	}
3453
3454	spapr->htab_fd = -1;
3455	spapr->use_hotplug_event_source = true;
3456	spapr->kvm_type = g_strdup(DEFAULT_KVM_TYPE);
3457	object_property_add_str(obj, "kvm-type",
3458	spapr_get_kvm_type, spapr_set_kvm_type);
3459	object_property_set_description(obj, "kvm-type",
3460	"Specifies the KVM virtualization mode (auto,"
3461	" hv, pr). Defaults to 'auto'. This mode will use"
3462	" any available KVM module loaded in the host,"
3463	" where kvm_hv takes precedence if both kvm_hv and"
3464	" kvm_pr are loaded.");
3465	object_property_add_bool(obj, "modern-hotplug-events",
3466	spapr_get_modern_hotplug_events,
3467	spapr_set_modern_hotplug_events);
3468	object_property_set_description(obj, "modern-hotplug-events",
3469	"Use dedicated hotplug event mechanism in"
3470	" place of standard EPOW events when possible"
3471	" (required for memory hot-unplug support)");
3472	ppc_compat_add_property(obj, "max-cpu-compat", &spapr->max_compat_pvr,
3473	"Maximum permitted CPU compatibility mode");
3474
3475	object_property_add_str(obj, "resize-hpt",
3476	spapr_get_resize_hpt, spapr_set_resize_hpt);
3477	object_property_set_description(obj, "resize-hpt",
3478	"Resizing of the Hash Page Table (enabled, disabled, required)");
3479	object_property_add_uint32_ptr(obj, "vsmt",
3480	&spapr->vsmt, OBJ_PROP_FLAG_READWRITE);
3481	object_property_set_description(obj, "vsmt",
3482	"Virtual SMT: KVM behaves as if this were"
3483	" the host's SMT mode");
3484
3485	object_property_add_bool(obj, "vfio-no-msix-emulation",
3486	spapr_get_msix_emulation, NULL);
3487
3488	object_property_add_uint64_ptr(obj, "kernel-addr",
3489	&spapr->kernel_addr, OBJ_PROP_FLAG_READWRITE);
3490	object_property_set_description(obj, "kernel-addr",
3491	stringify(KERNEL_LOAD_ADDR)
3492	" for -kernel is the default");
3493	spapr->kernel_addr = KERNEL_LOAD_ADDR;
3494
3495	object_property_add_bool(obj, "x-vof", spapr_get_vof, spapr_set_vof);
3496	object_property_set_description(obj, "x-vof",
3497	"Enable Virtual Open Firmware (experimental)");
3498
3499	/* The machine class defines the default interrupt controller mode */
3500	spapr->irq = smc->irq;
3501	object_property_add_str(obj, "ic-mode", spapr_get_ic_mode,
3502	spapr_set_ic_mode);
3503	object_property_set_description(obj, "ic-mode",
3504	"Specifies the interrupt controller mode (xics, xive, dual)");
3505
3506	object_property_add_str(obj, "host-model",
3507	spapr_get_host_model, spapr_set_host_model);
3508	object_property_set_description(obj, "host-model",
3509	"Host model to advertise in guest device tree");
3510	object_property_add_str(obj, "host-serial",
3511	spapr_get_host_serial, spapr_set_host_serial);
3512	object_property_set_description(obj, "host-serial",
3513	"Host serial number to advertise in guest device tree");
3514	}
3515
3516	static void spapr_machine_finalizefn(Object *obj)
3517	{
3518	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
3519
3520	g_free(spapr->kvm_type);
3521	g_free(spapr->host_model);
3522	g_free(spapr->host_serial);
3523	}
3524
3525	void spapr_do_system_reset_on_cpu(CPUState *cs, run_on_cpu_data arg)
3526	{
3527	SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
3528	CPUPPCState *env = cpu_env(cs);
3529
3530	cpu_synchronize_state(cs);
3531	/* If FWNMI is inactive, addr will be -1, which will deliver to 0x100 */
3532	if (spapr->fwnmi_system_reset_addr != -1) {
3533	uint64_t rtas_addr, addr;
3534
3535	/* get rtas addr from fdt */
3536	rtas_addr = spapr_get_rtas_addr();
3537	if (!rtas_addr) {
3538	qemu_system_guest_panicked(NULL);
3539	return;
3540	}
3541
3542	addr = rtas_addr + RTAS_ERROR_LOG_MAX + cs->cpu_index * sizeof(uint64_t)*2;
3543	stq_be_phys(&address_space_memory, addr, env->gpr[3]);
3544	stq_be_phys(&address_space_memory, addr + sizeof(uint64_t), 0);
3545	env->gpr[3] = addr;
3546	}
3547	ppc_cpu_do_system_reset(cs);
3548	if (spapr->fwnmi_system_reset_addr != -1) {
3549	env->nip = spapr->fwnmi_system_reset_addr;
3550	}
3551	}
3552
3553	static void spapr_nmi(NMIState *ns)
3554	{
3555	CPUState *cs;
3556
3557	CPU_FOREACH(cs) {
3558	async_run_on_cpu(cs, spapr_do_system_reset_on_cpu, RUN_ON_CPU_NULL);
3559	}
3560	}
3561
3562	int spapr_lmb_dt_populate(SpaprDrc drc, SpaprMachineState spapr,
3563	void fdt, int fdt_start_offset, Error **errp)
3564	{
3565	uint64_t addr;
3566	uint32_t node;
3567
3568	addr = spapr_drc_index(drc) * SPAPR_MEMORY_BLOCK_SIZE;
3569	node = object_property_get_uint(OBJECT(drc->dev), PC_DIMM_NODE_PROP,
3570	&error_abort);
3571	*fdt_start_offset = spapr_dt_memory_node(spapr, fdt, node, addr,
3572	SPAPR_MEMORY_BLOCK_SIZE);
3573	return 0;
3574	}
3575
3576	static void spapr_add_lmbs(DeviceState *dev, uint64_t addr_start, uint64_t size,
3577	bool dedicated_hp_event_source)
3578	{
3579	SpaprDrc *drc;
3580	uint32_t nr_lmbs = size/SPAPR_MEMORY_BLOCK_SIZE;
3581	int i;
3582	uint64_t addr = addr_start;
3583	bool hotplugged = spapr_drc_hotplugged(dev);
3584
3585	for (i = 0; i < nr_lmbs; i++) {
3586	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3587	addr / SPAPR_MEMORY_BLOCK_SIZE);
3588	g_assert(drc);
3589
3590	/*
3591	* memory_device_get_free_addr() provided a range of free addresses
3592	* that doesn't overlap with any existing mapping at pre-plug. The
3593	* corresponding LMB DRCs are thus assumed to be all attachable.
3594	*/
3595	spapr_drc_attach(drc, dev);
3596	if (!hotplugged) {
3597	spapr_drc_reset(drc);
3598	}
3599	addr += SPAPR_MEMORY_BLOCK_SIZE;
3600	}
3601	/* send hotplug notification to the
3602	* guest only in case of hotplugged memory
3603	*/
3604	if (hotplugged) {
3605	if (dedicated_hp_event_source) {
3606	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3607	addr_start / SPAPR_MEMORY_BLOCK_SIZE);
3608	g_assert(drc);
3609	spapr_hotplug_req_add_by_count_indexed(SPAPR_DR_CONNECTOR_TYPE_LMB,
3610	nr_lmbs,
3611	spapr_drc_index(drc));
3612	} else {
3613	spapr_hotplug_req_add_by_count(SPAPR_DR_CONNECTOR_TYPE_LMB,
3614	nr_lmbs);
3615	}
3616	}
3617	}
3618
3619	static void spapr_memory_plug(HotplugHandler hotplug_dev, DeviceState dev)
3620	{
3621	SpaprMachineState *ms = SPAPR_MACHINE(hotplug_dev);
3622	PCDIMMDevice *dimm = PC_DIMM(dev);
3623	uint64_t size, addr;
3624	int64_t slot;
3625	bool is_nvdimm = object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM);
3626
3627	size = memory_device_get_region_size(MEMORY_DEVICE(dev), &error_abort);
3628
3629	pc_dimm_plug(dimm, MACHINE(ms));
3630
3631	if (!is_nvdimm) {
3632	addr = object_property_get_uint(OBJECT(dimm),
3633	PC_DIMM_ADDR_PROP, &error_abort);
3634	spapr_add_lmbs(dev, addr, size,
3635	spapr_ovec_test(ms->ov5_cas, OV5_HP_EVT));
3636	} else {
3637	slot = object_property_get_int(OBJECT(dimm),
3638	PC_DIMM_SLOT_PROP, &error_abort);
3639	/* We should have valid slot number at this point */
3640	g_assert(slot >= 0);
3641	spapr_add_nvdimm(dev, slot);
3642	}
3643	}
3644
3645	static void spapr_memory_pre_plug(HotplugHandler hotplug_dev, DeviceState dev,
3646	Error **errp)
3647	{
3648	SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_dev);
3649	bool is_nvdimm = object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM);
3650	PCDIMMDevice *dimm = PC_DIMM(dev);
3651	Error *local_err = NULL;
3652	uint64_t size;
3653	Object *memdev;
3654	hwaddr pagesize;
3655
3656	size = memory_device_get_region_size(MEMORY_DEVICE(dimm), &local_err);
3657	if (local_err) {
3658	error_propagate(errp, local_err);
3659	return;
3660	}
3661
3662	if (is_nvdimm) {
3663	if (!spapr_nvdimm_validate(hotplug_dev, NVDIMM(dev), size, errp)) {
3664	return;
3665	}
3666	} else if (size % SPAPR_MEMORY_BLOCK_SIZE) {
3667	error_setg(errp, "Hotplugged memory size must be a multiple of "
3668	"%" PRIu64 " MB", SPAPR_MEMORY_BLOCK_SIZE / MiB);
3669	return;
3670	}
3671
3672	memdev = object_property_get_link(OBJECT(dimm), PC_DIMM_MEMDEV_PROP,
3673	&error_abort);
3674	pagesize = host_memory_backend_pagesize(MEMORY_BACKEND(memdev));
3675	if (!spapr_check_pagesize(spapr, pagesize, errp)) {
3676	return;
3677	}
3678
3679	pc_dimm_pre_plug(dimm, MACHINE(hotplug_dev), errp);
3680	}
3681
3682	struct SpaprDimmState {
3683	PCDIMMDevice *dimm;
3684	uint32_t nr_lmbs;
3685	QTAILQ_ENTRY(SpaprDimmState) next;
3686	};
3687
3688	static SpaprDimmState spapr_pending_dimm_unplugs_find(SpaprMachineState s,
3689	PCDIMMDevice *dimm)
3690	{
3691	SpaprDimmState *dimm_state;
3692
3693	QTAILQ_FOREACH(dimm_state, &s->pending_dimm_unplugs, next) {
3694	if (dimm_state->dimm == dimm) {
3695	break;
3696	}
3697	}
3698	return dimm_state;
3699	}
3700
3701	static SpaprDimmState spapr_pending_dimm_unplugs_add(SpaprMachineState spapr,
3702	uint32_t nr_lmbs,
3703	PCDIMMDevice *dimm)
3704	{
3705	SpaprDimmState *ds = NULL;
3706
3707	/*
3708	* If this request is for a DIMM whose removal had failed earlier
3709	* (due to guest's refusal to remove the LMBs), we would have this
3710	* dimm already in the pending_dimm_unplugs list. In that
3711	* case don't add again.
3712	*/
3713	ds = spapr_pending_dimm_unplugs_find(spapr, dimm);
3714	if (!ds) {
3715	ds = g_new0(SpaprDimmState, 1);
3716	ds->nr_lmbs = nr_lmbs;
3717	ds->dimm = dimm;
3718	QTAILQ_INSERT_HEAD(&spapr->pending_dimm_unplugs, ds, next);
3719	}
3720	return ds;
3721	}
3722
3723	static void spapr_pending_dimm_unplugs_remove(SpaprMachineState *spapr,
3724	SpaprDimmState *dimm_state)
3725	{
3726	QTAILQ_REMOVE(&spapr->pending_dimm_unplugs, dimm_state, next);
3727	g_free(dimm_state);
3728	}
3729
3730	static SpaprDimmState spapr_recover_pending_dimm_state(SpaprMachineState ms,
3731	PCDIMMDevice *dimm)
3732	{
3733	SpaprDrc *drc;
3734	uint64_t size = memory_device_get_region_size(MEMORY_DEVICE(dimm),
3735	&error_abort);
3736	uint32_t nr_lmbs = size / SPAPR_MEMORY_BLOCK_SIZE;
3737	uint32_t avail_lmbs = 0;
3738	uint64_t addr_start, addr;
3739	int i;
3740
3741	addr_start = object_property_get_uint(OBJECT(dimm), PC_DIMM_ADDR_PROP,
3742	&error_abort);
3743
3744	addr = addr_start;
3745	for (i = 0; i < nr_lmbs; i++) {
3746	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3747	addr / SPAPR_MEMORY_BLOCK_SIZE);
3748	g_assert(drc);
3749	if (drc->dev) {
3750	avail_lmbs++;
3751	}
3752	addr += SPAPR_MEMORY_BLOCK_SIZE;
3753	}
3754
3755	return spapr_pending_dimm_unplugs_add(ms, avail_lmbs, dimm);
3756	}
3757
3758	void spapr_memory_unplug_rollback(SpaprMachineState spapr, DeviceState dev)
3759	{
3760	SpaprDimmState *ds;
3761	PCDIMMDevice *dimm;
3762	SpaprDrc *drc;
3763	uint32_t nr_lmbs;
3764	uint64_t size, addr_start, addr;
3765	int i;
3766
3767	if (!dev) {
3768	return;
3769	}
3770
3771	dimm = PC_DIMM(dev);
3772	ds = spapr_pending_dimm_unplugs_find(spapr, dimm);
3773
3774	/*
3775	* 'ds == NULL' would mean that the DIMM doesn't have a pending
3776	* unplug state, but one of its DRC is marked as unplug_requested.
3777	* This is bad and weird enough to g_assert() out.
3778	*/
3779	g_assert(ds);
3780
3781	spapr_pending_dimm_unplugs_remove(spapr, ds);
3782
3783	size = memory_device_get_region_size(MEMORY_DEVICE(dimm), &error_abort);
3784	nr_lmbs = size / SPAPR_MEMORY_BLOCK_SIZE;
3785
3786	addr_start = object_property_get_uint(OBJECT(dimm), PC_DIMM_ADDR_PROP,
3787	&error_abort);
3788
3789	addr = addr_start;
3790	for (i = 0; i < nr_lmbs; i++) {
3791	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3792	addr / SPAPR_MEMORY_BLOCK_SIZE);
3793	g_assert(drc);
3794
3795	drc->unplug_requested = false;
3796	addr += SPAPR_MEMORY_BLOCK_SIZE;
3797	}
3798
3799	/*
3800	* Tell QAPI that something happened and the memory
3801	* hotunplug wasn't successful.
3802	*/
3803	qapi_event_send_device_unplug_guest_error(dev->id,
3804	dev->canonical_path);
3805	}
3806
3807	/* Callback to be called during DRC release. */
3808	void spapr_lmb_release(DeviceState *dev)
3809	{
3810	HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);
3811	SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_ctrl);
3812	SpaprDimmState *ds = spapr_pending_dimm_unplugs_find(spapr, PC_DIMM(dev));
3813
3814	/* This information will get lost if a migration occurs
3815	* during the unplug process. In this case recover it. */
3816	if (ds == NULL) {
3817	ds = spapr_recover_pending_dimm_state(spapr, PC_DIMM(dev));
3818	g_assert(ds);
3819	/* The DRC being examined by the caller at least must be counted */
3820	g_assert(ds->nr_lmbs);
3821	}
3822
3823	if (--ds->nr_lmbs) {
3824	return;
3825	}
3826
3827	/*
3828	* Now that all the LMBs have been removed by the guest, call the
3829	* unplug handler chain. This can never fail.
3830	*/
3831	hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);
3832	object_unparent(OBJECT(dev));
3833	}
3834
3835	static void spapr_memory_unplug(HotplugHandler hotplug_dev, DeviceState dev)
3836	{
3837	SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_dev);
3838	SpaprDimmState *ds = spapr_pending_dimm_unplugs_find(spapr, PC_DIMM(dev));
3839
3840	/* We really shouldn't get this far without anything to unplug */
3841	g_assert(ds);
3842
3843	pc_dimm_unplug(PC_DIMM(dev), MACHINE(hotplug_dev));
3844	qdev_unrealize(dev);
3845	spapr_pending_dimm_unplugs_remove(spapr, ds);
3846	}
3847
3848	static void spapr_memory_unplug_request(HotplugHandler *hotplug_dev,
3849	DeviceState dev, Error *errp)
3850	{
3851	SpaprMachineState *spapr = SPAPR_MACHINE(hotplug_dev);
3852	PCDIMMDevice *dimm = PC_DIMM(dev);
3853	uint32_t nr_lmbs;
3854	uint64_t size, addr_start, addr;
3855	int i;
3856	SpaprDrc *drc;
3857
3858	if (object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM)) {
3859	error_setg(errp, "nvdimm device hot unplug is not supported yet.");
3860	return;
3861	}
3862
3863	size = memory_device_get_region_size(MEMORY_DEVICE(dimm), &error_abort);
3864	nr_lmbs = size / SPAPR_MEMORY_BLOCK_SIZE;
3865
3866	addr_start = object_property_get_uint(OBJECT(dimm), PC_DIMM_ADDR_PROP,
3867	&error_abort);
3868
3869	/*
3870	* An existing pending dimm state for this DIMM means that there is an
3871	* unplug operation in progress, waiting for the spapr_lmb_release
3872	* callback to complete the job (BQL can't cover that far). In this case,
3873	* bail out to avoid detaching DRCs that were already released.
3874	*/
3875	if (spapr_pending_dimm_unplugs_find(spapr, dimm)) {
3876	error_setg(errp, "Memory unplug already in progress for device %s",
3877	dev->id);
3878	return;
3879	}
3880
3881	spapr_pending_dimm_unplugs_add(spapr, nr_lmbs, dimm);
3882
3883	addr = addr_start;
3884	for (i = 0; i < nr_lmbs; i++) {
3885	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3886	addr / SPAPR_MEMORY_BLOCK_SIZE);
3887	g_assert(drc);
3888
3889	spapr_drc_unplug_request(drc);
3890	addr += SPAPR_MEMORY_BLOCK_SIZE;
3891	}
3892
3893	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_LMB,
3894	addr_start / SPAPR_MEMORY_BLOCK_SIZE);
3895	spapr_hotplug_req_remove_by_count_indexed(SPAPR_DR_CONNECTOR_TYPE_LMB,
3896	nr_lmbs, spapr_drc_index(drc));
3897	}
3898
3899	/* Callback to be called during DRC release. */
3900	void spapr_core_release(DeviceState *dev)
3901	{
3902	HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);
3903
3904	/* Call the unplug handler chain. This can never fail. */
3905	hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);
3906	object_unparent(OBJECT(dev));
3907	}
3908
3909	static void spapr_core_unplug(HotplugHandler hotplug_dev, DeviceState dev)
3910	{
3911	MachineState *ms = MACHINE(hotplug_dev);
3912	CPUCore *cc = CPU_CORE(dev);
3913	CPUArchId *core_slot = spapr_find_cpu_slot(ms, cc->core_id, NULL);
3914
3915	assert(core_slot);
3916	core_slot->cpu = NULL;
3917	qdev_unrealize(dev);
3918	}
3919
3920	static
3921	void spapr_core_unplug_request(HotplugHandler hotplug_dev, DeviceState dev,
3922	Error **errp)
3923	{
3924	SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
3925	int index;
3926	SpaprDrc *drc;
3927	CPUCore *cc = CPU_CORE(dev);
3928
3929	if (!spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index)) {
3930	error_setg(errp, "Unable to find CPU core with core-id: %d",
3931	cc->core_id);
3932	return;
3933	}
3934	if (index == 0) {
3935	error_setg(errp, "Boot CPU core may not be unplugged");
3936	return;
3937	}
3938
3939	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_CPU,
3940	spapr_vcpu_id(spapr, cc->core_id));
3941	g_assert(drc);
3942
3943	if (!spapr_drc_unplug_requested(drc)) {
3944	spapr_drc_unplug_request(drc);
3945	}
3946
3947	/*
3948	* spapr_hotplug_req_remove_by_index is left unguarded, out of the
3949	* "!spapr_drc_unplug_requested" check, to allow for multiple IRQ
3950	* pulses removing the same CPU. Otherwise, in an failed hotunplug
3951	* attempt (e.g. the kernel will refuse to remove the last online
3952	* CPU), we will never attempt it again because unplug_requested
3953	* will still be 'true' in that case.
3954	*/
3955	spapr_hotplug_req_remove_by_index(drc);
3956	}
3957
3958	int spapr_core_dt_populate(SpaprDrc drc, SpaprMachineState spapr,
3959	void fdt, int fdt_start_offset, Error **errp)
3960	{
3961	SpaprCpuCore *core = SPAPR_CPU_CORE(drc->dev);
3962	CPUState *cs = CPU(core->threads[0]);
3963	PowerPCCPU *cpu = POWERPC_CPU(cs);
3964	DeviceClass *dc = DEVICE_GET_CLASS(cs);
3965	int id = spapr_get_vcpu_id(cpu);
3966	g_autofree char *nodename = NULL;
3967	int offset;
3968
3969	nodename = g_strdup_printf("%s@%x", dc->fw_name, id);
3970	offset = fdt_add_subnode(fdt, 0, nodename);
3971
3972	spapr_dt_cpu(cs, fdt, offset, spapr);
3973
3974	/*
3975	* spapr_dt_cpu() does not fill the 'name' property in the
3976	* CPU node. The function is called during boot process, before
3977	* and after CAS, and overwriting the 'name' property written
3978	* by SLOF is not allowed.
3979	*
3980	* Write it manually after spapr_dt_cpu(). This makes the hotplug
3981	* CPUs more compatible with the coldplugged ones, which have
3982	* the 'name' property. Linux Kernel also relies on this
3983	* property to identify CPU nodes.
3984	*/
3985	_FDT((fdt_setprop_string(fdt, offset, "name", nodename)));
3986
3987	*fdt_start_offset = offset;
3988	return 0;
3989	}
3990
3991	static void spapr_core_plug(HotplugHandler hotplug_dev, DeviceState dev)
3992	{
3993	SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
3994	MachineClass *mc = MACHINE_GET_CLASS(spapr);
3995	SpaprCpuCore *core = SPAPR_CPU_CORE(OBJECT(dev));
3996	CPUCore *cc = CPU_CORE(dev);
3997	SpaprDrc *drc;
3998	CPUArchId *core_slot;
3999	int index;
4000	bool hotplugged = spapr_drc_hotplugged(dev);
4001	int i;
4002
4003	core_slot = spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index);
4004	g_assert(core_slot); /* Already checked in spapr_core_pre_plug() */
4005
4006	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_CPU,
4007	spapr_vcpu_id(spapr, cc->core_id));
4008
4009	g_assert(drc \|\| !mc->has_hotpluggable_cpus);
4010
4011	if (drc) {
4012	/*
4013	* spapr_core_pre_plug() already buys us this is a brand new
4014	* core being plugged into a free slot. Nothing should already
4015	* be attached to the corresponding DRC.
4016	*/
4017	spapr_drc_attach(drc, dev);
4018
4019	if (hotplugged) {
4020	/*
4021	* Send hotplug notification interrupt to the guest only
4022	* in case of hotplugged CPUs.
4023	*/
4024	spapr_hotplug_req_add_by_index(drc);
4025	} else {
4026	spapr_drc_reset(drc);
4027	}
4028	}
4029
4030	core_slot->cpu = CPU(dev);
4031
4032	/*
4033	* Set compatibility mode to match the boot CPU, which was either set
4034	* by the machine reset code or by CAS. This really shouldn't fail at
4035	* this point.
4036	*/
4037	if (hotplugged) {
4038	for (i = 0; i < cc->nr_threads; i++) {
4039	ppc_set_compat(core->threads[i], POWERPC_CPU(first_cpu)->compat_pvr,
4040	&error_abort);
4041	}
4042	}
4043
4044	}
4045
4046	static void spapr_core_pre_plug(HotplugHandler hotplug_dev, DeviceState dev,
4047	Error **errp)
4048	{
4049	MachineState *machine = MACHINE(OBJECT(hotplug_dev));
4050	MachineClass *mc = MACHINE_GET_CLASS(hotplug_dev);
4051	CPUCore *cc = CPU_CORE(dev);
4052	const char *base_core_type = spapr_get_cpu_core_type(machine->cpu_type);
4053	const char *type = object_get_typename(OBJECT(dev));
4054	CPUArchId *core_slot;
4055	int index;
4056	unsigned int smp_threads = machine->smp.threads;
4057
4058	if (dev->hotplugged && !mc->has_hotpluggable_cpus) {
4059	error_setg(errp, "CPU hotplug not supported for this machine");
4060	return;
4061	}
4062
4063	if (strcmp(base_core_type, type)) {
4064	error_setg(errp, "CPU core type should be %s", base_core_type);
4065	return;
4066	}
4067
4068	if (cc->core_id % smp_threads) {
4069	error_setg(errp, "invalid core id %d", cc->core_id);
4070	return;
4071	}
4072
4073	/*
4074	* In general we should have homogeneous threads-per-core, but old
4075	* (pre hotplug support) machine types allow the last core to have
4076	* reduced threads as a compatibility hack for when we allowed
4077	* total vcpus not a multiple of threads-per-core.
4078	*/
4079	if (mc->has_hotpluggable_cpus && (cc->nr_threads != smp_threads)) {
4080	error_setg(errp, "invalid nr-threads %d, must be %d", cc->nr_threads,
4081	smp_threads);
4082	return;
4083	}
4084
4085	core_slot = spapr_find_cpu_slot(MACHINE(hotplug_dev), cc->core_id, &index);
4086	if (!core_slot) {
4087	error_setg(errp, "core id %d out of range", cc->core_id);
4088	return;
4089	}
4090
4091	if (core_slot->cpu) {
4092	error_setg(errp, "core %d already populated", cc->core_id);
4093	return;
4094	}
4095
4096	numa_cpu_pre_plug(core_slot, dev, errp);
4097	}
4098
4099	int spapr_phb_dt_populate(SpaprDrc drc, SpaprMachineState spapr,
4100	void fdt, int fdt_start_offset, Error **errp)
4101	{
4102	SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(drc->dev);
4103	int intc_phandle;
4104
4105	intc_phandle = spapr_irq_get_phandle(spapr, spapr->fdt_blob, errp);
4106	if (intc_phandle <= 0) {
4107	return -1;
4108	}
4109
4110	if (spapr_dt_phb(spapr, sphb, intc_phandle, fdt, fdt_start_offset)) {
4111	error_setg(errp, "unable to create FDT node for PHB %d", sphb->index);
4112	return -1;
4113	}
4114
4115	/* generally SLOF creates these, for hotplug it's up to QEMU */
4116	_FDT(fdt_setprop_string(fdt, *fdt_start_offset, "name", "pci"));
4117
4118	return 0;
4119	}
4120
4121	static bool spapr_phb_placement(SpaprMachineState *spapr, uint32_t index,
4122	uint64_t buid, hwaddr pio,
4123	hwaddr mmio32, hwaddr mmio64,
4124	unsigned n_dma, uint32_t liobns, Error *errp)
4125	{
4126	/*
4127	* New-style PHB window placement.
4128	*
4129	* Goals: Gives large (1TiB), naturally aligned 64-bit MMIO window
4130	* for each PHB, in addition to 2GiB 32-bit MMIO and 64kiB PIO
4131	* windows.
4132	*
4133	* Some guest kernels can't work with MMIO windows above 1<<46
4134	* (64TiB), so we place up to 31 PHBs in the area 32TiB..64TiB
4135	*
4136	* 32TiB..(33TiB+1984kiB) contains the 64kiB PIO windows for each
4137	* PHB stacked together. (32TiB+2GiB)..(32TiB+64GiB) contains the
4138	* 2GiB 32-bit MMIO windows for each PHB. Then 33..64TiB has the
4139	* 1TiB 64-bit MMIO windows for each PHB.
4140	*/
4141	const uint64_t base_buid = 0x800000020000000ULL;
4142	int i;
4143
4144	/* Sanity check natural alignments */
4145	QEMU_BUILD_BUG_ON((SPAPR_PCI_BASE % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
4146	QEMU_BUILD_BUG_ON((SPAPR_PCI_LIMIT % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
4147	QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM64_WIN_SIZE % SPAPR_PCI_MEM32_WIN_SIZE) != 0);
4148	QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM32_WIN_SIZE % SPAPR_PCI_IO_WIN_SIZE) != 0);
4149	/* Sanity check bounds */
4150	QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_IO_WIN_SIZE) >
4151	SPAPR_PCI_MEM32_WIN_SIZE);
4152	QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_MEM32_WIN_SIZE) >
4153	SPAPR_PCI_MEM64_WIN_SIZE);
4154
4155	if (index >= SPAPR_MAX_PHBS) {
4156	error_setg(errp, "\"index\" for PAPR PHB is too large (max %llu)",
4157	SPAPR_MAX_PHBS - 1);
4158	return false;
4159	}
4160
4161	*buid = base_buid + index;
4162	for (i = 0; i < n_dma; ++i) {
4163	liobns[i] = SPAPR_PCI_LIOBN(index, i);
4164	}
4165
4166	pio = SPAPR_PCI_BASE + index SPAPR_PCI_IO_WIN_SIZE;
4167	mmio32 = SPAPR_PCI_BASE + (index + 1) SPAPR_PCI_MEM32_WIN_SIZE;
4168	mmio64 = SPAPR_PCI_BASE + (index + 1) SPAPR_PCI_MEM64_WIN_SIZE;
4169	return true;
4170	}
4171
4172	static bool spapr_phb_pre_plug(HotplugHandler hotplug_dev, DeviceState dev,
4173	Error **errp)
4174	{
4175	SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
4176	SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
4177	const unsigned windows_supported = spapr_phb_windows_supported(sphb);
4178	SpaprDrc *drc;
4179
4180	if (sphb->index == (uint32_t)-1) {
4181	error_setg(errp, "\"index\" for PAPR PHB is mandatory");
4182	return false;
4183	}
4184
4185	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_PHB, sphb->index);
4186	if (drc && drc->dev) {
4187	error_setg(errp, "PHB %d already attached", sphb->index);
4188	return false;
4189	}
4190
4191	/*
4192	* This will check that sphb->index doesn't exceed the maximum number of
4193	* PHBs for the current machine type.
4194	*/
4195	return spapr_phb_placement(spapr, sphb->index,
4196	&sphb->buid, &sphb->io_win_addr,
4197	&sphb->mem_win_addr, &sphb->mem64_win_addr,
4198	windows_supported, sphb->dma_liobn, errp);
4199	}
4200
4201	static void spapr_phb_plug(HotplugHandler hotplug_dev, DeviceState dev)
4202	{
4203	SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
4204	SpaprDrc *drc;
4205	bool hotplugged = spapr_drc_hotplugged(dev);
4206
4207	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_PHB, sphb->index);
4208	/* hotplug hooks should check it's enabled before getting this far */
4209	assert(drc);
4210
4211	/* spapr_phb_pre_plug() already checked the DRC is attachable */
4212	spapr_drc_attach(drc, dev);
4213
4214	if (hotplugged) {
4215	spapr_hotplug_req_add_by_index(drc);
4216	} else {
4217	spapr_drc_reset(drc);
4218	}
4219	}
4220
4221	void spapr_phb_release(DeviceState *dev)
4222	{
4223	HotplugHandler *hotplug_ctrl = qdev_get_hotplug_handler(dev);
4224
4225	hotplug_handler_unplug(hotplug_ctrl, dev, &error_abort);
4226	object_unparent(OBJECT(dev));
4227	}
4228
4229	static void spapr_phb_unplug(HotplugHandler hotplug_dev, DeviceState dev)
4230	{
4231	qdev_unrealize(dev);
4232	}
4233
4234	static void spapr_phb_unplug_request(HotplugHandler *hotplug_dev,
4235	DeviceState dev, Error *errp)
4236	{
4237	SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
4238	SpaprDrc *drc;
4239
4240	drc = spapr_drc_by_id(TYPE_SPAPR_DRC_PHB, sphb->index);
4241	assert(drc);
4242
4243	if (!spapr_drc_unplug_requested(drc)) {
4244	spapr_drc_unplug_request(drc);
4245	spapr_hotplug_req_remove_by_index(drc);
4246	} else {
4247	error_setg(errp,
4248	"PCI Host Bridge unplug already in progress for device %s",
4249	dev->id);
4250	}
4251	}
4252
4253	static
4254	bool spapr_tpm_proxy_pre_plug(HotplugHandler hotplug_dev, DeviceState dev,
4255	Error **errp)
4256	{
4257	SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
4258
4259	if (spapr->tpm_proxy != NULL) {
4260	error_setg(errp, "Only one TPM proxy can be specified for this machine");
4261	return false;
4262	}
4263
4264	return true;
4265	}
4266
4267	static void spapr_tpm_proxy_plug(HotplugHandler hotplug_dev, DeviceState dev)
4268	{
4269	SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
4270	SpaprTpmProxy *tpm_proxy = SPAPR_TPM_PROXY(dev);
4271
4272	/* Already checked in spapr_tpm_proxy_pre_plug() */
4273	g_assert(spapr->tpm_proxy == NULL);
4274
4275	spapr->tpm_proxy = tpm_proxy;
4276	}
4277
4278	static void spapr_tpm_proxy_unplug(HotplugHandler hotplug_dev, DeviceState dev)
4279	{
4280	SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
4281
4282	qdev_unrealize(dev);
4283	object_unparent(OBJECT(dev));
4284	spapr->tpm_proxy = NULL;
4285	}
4286
4287	static void spapr_machine_device_plug(HotplugHandler *hotplug_dev,
4288	DeviceState dev, Error *errp)
4289	{
4290	if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4291	spapr_memory_plug(hotplug_dev, dev);
4292	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4293	spapr_core_plug(hotplug_dev, dev);
4294	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4295	spapr_phb_plug(hotplug_dev, dev);
4296	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_TPM_PROXY)) {
4297	spapr_tpm_proxy_plug(hotplug_dev, dev);
4298	}
4299	}
4300
4301	static void spapr_machine_device_unplug(HotplugHandler *hotplug_dev,
4302	DeviceState dev, Error *errp)
4303	{
4304	if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4305	spapr_memory_unplug(hotplug_dev, dev);
4306	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4307	spapr_core_unplug(hotplug_dev, dev);
4308	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4309	spapr_phb_unplug(hotplug_dev, dev);
4310	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_TPM_PROXY)) {
4311	spapr_tpm_proxy_unplug(hotplug_dev, dev);
4312	}
4313	}
4314
4315	bool spapr_memory_hot_unplug_supported(SpaprMachineState *spapr)
4316	{
4317	return spapr_ovec_test(spapr->ov5_cas, OV5_HP_EVT) \|\|
4318	/*
4319	* CAS will process all pending unplug requests.
4320	*
4321	* HACK: a guest could theoretically have cleared all bits in OV5,
4322	* but none of the guests we care for do.
4323	*/
4324	spapr_ovec_empty(spapr->ov5_cas);
4325	}
4326
4327	static void spapr_machine_device_unplug_request(HotplugHandler *hotplug_dev,
4328	DeviceState dev, Error *errp)
4329	{
4330	SpaprMachineState *sms = SPAPR_MACHINE(OBJECT(hotplug_dev));
4331	MachineClass *mc = MACHINE_GET_CLASS(sms);
4332
4333	if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4334	if (spapr_memory_hot_unplug_supported(sms)) {
4335	spapr_memory_unplug_request(hotplug_dev, dev, errp);
4336	} else {
4337	error_setg(errp, "Memory hot unplug not supported for this guest");
4338	}
4339	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4340	if (!mc->has_hotpluggable_cpus) {
4341	error_setg(errp, "CPU hot unplug not supported on this machine");
4342	return;
4343	}
4344	spapr_core_unplug_request(hotplug_dev, dev, errp);
4345	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4346	spapr_phb_unplug_request(hotplug_dev, dev, errp);
4347	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_TPM_PROXY)) {
4348	spapr_tpm_proxy_unplug(hotplug_dev, dev);
4349	}
4350	}
4351
4352	static void spapr_machine_device_pre_plug(HotplugHandler *hotplug_dev,
4353	DeviceState dev, Error *errp)
4354	{
4355	if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
4356	spapr_memory_pre_plug(hotplug_dev, dev, errp);
4357	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE)) {
4358	spapr_core_pre_plug(hotplug_dev, dev, errp);
4359	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
4360	spapr_phb_pre_plug(hotplug_dev, dev, errp);
4361	} else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_TPM_PROXY)) {
4362	spapr_tpm_proxy_pre_plug(hotplug_dev, dev, errp);
4363	}
4364	}
4365
4366	static HotplugHandler spapr_get_hotplug_handler(MachineState machine,
4367	DeviceState *dev)
4368	{
4369	if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) \|\|
4370	object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_CPU_CORE) \|\|
4371	object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE) \|\|
4372	object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_TPM_PROXY)) {
4373	return HOTPLUG_HANDLER(machine);
4374	}
4375	if (object_dynamic_cast(OBJECT(dev), TYPE_PCI_DEVICE)) {
4376	PCIDevice *pcidev = PCI_DEVICE(dev);
4377	PCIBus *root = pci_device_root_bus(pcidev);
4378	SpaprPhbState *phb =
4379	(SpaprPhbState *)object_dynamic_cast(OBJECT(BUS(root)->parent),
4380	TYPE_SPAPR_PCI_HOST_BRIDGE);
4381
4382	if (phb) {
4383	return HOTPLUG_HANDLER(phb);
4384	}
4385	}
4386	return NULL;
4387	}
4388
4389	static CpuInstanceProperties
4390	spapr_cpu_index_to_props(MachineState *machine, unsigned cpu_index)
4391	{
4392	CPUArchId *core_slot;
4393	MachineClass *mc = MACHINE_GET_CLASS(machine);
4394
4395	/* make sure possible_cpu are initialized */
4396	mc->possible_cpu_arch_ids(machine);
4397	/* get CPU core slot containing thread that matches cpu_index */
4398	core_slot = spapr_find_cpu_slot(machine, cpu_index, NULL);
4399	assert(core_slot);
4400	return core_slot->props;
4401	}
4402
4403	static int64_t spapr_get_default_cpu_node_id(const MachineState *ms, int idx)
4404	{
4405	return idx / ms->smp.cores % ms->numa_state->num_nodes;
4406	}
4407
4408	static const CPUArchIdList spapr_possible_cpu_arch_ids(MachineState machine)
4409	{
4410	int i;
4411	unsigned int smp_threads = machine->smp.threads;
4412	unsigned int smp_cpus = machine->smp.cpus;
4413	const char *core_type;
4414	int spapr_max_cores = machine->smp.max_cpus / smp_threads;
4415	MachineClass *mc = MACHINE_GET_CLASS(machine);
4416
4417	if (!mc->has_hotpluggable_cpus) {
4418	spapr_max_cores = QEMU_ALIGN_UP(smp_cpus, smp_threads) / smp_threads;
4419	}
4420	if (machine->possible_cpus) {
4421	assert(machine->possible_cpus->len == spapr_max_cores);
4422	return machine->possible_cpus;
4423	}
4424
4425	core_type = spapr_get_cpu_core_type(machine->cpu_type);
4426	if (!core_type) {
4427	error_report("Unable to find sPAPR CPU Core definition");
4428	exit(1);
4429	}
4430
4431	machine->possible_cpus = g_malloc0(sizeof(CPUArchIdList) +
4432	sizeof(CPUArchId) * spapr_max_cores);
4433	machine->possible_cpus->len = spapr_max_cores;
4434	for (i = 0; i < machine->possible_cpus->len; i++) {
4435	int core_id = i * smp_threads;
4436
4437	machine->possible_cpus->cpus[i].type = core_type;
4438	machine->possible_cpus->cpus[i].vcpus_count = smp_threads;
4439	machine->possible_cpus->cpus[i].arch_id = core_id;
4440	machine->possible_cpus->cpus[i].props.has_core_id = true;
4441	machine->possible_cpus->cpus[i].props.core_id = core_id;
4442	}
4443	return machine->possible_cpus;
4444	}
4445
4446	static ICSState spapr_ics_get(XICSFabric dev, int irq)
4447	{
4448	SpaprMachineState *spapr = SPAPR_MACHINE(dev);
4449
4450	return ics_valid_irq(spapr->ics, irq) ? spapr->ics : NULL;
4451	}
4452
4453	static void spapr_ics_resend(XICSFabric *dev)
4454	{
4455	SpaprMachineState *spapr = SPAPR_MACHINE(dev);
4456
4457	ics_resend(spapr->ics);
4458	}
4459
4460	static ICPState spapr_icp_get(XICSFabric xi, int vcpu_id)
4461	{
4462	PowerPCCPU *cpu = spapr_find_cpu(vcpu_id);
4463
4464	return cpu ? spapr_cpu_state(cpu)->icp : NULL;
4465	}
4466
4467	static void spapr_pic_print_info(InterruptStatsProvider obj, GString buf)
4468	{
4469	SpaprMachineState *spapr = SPAPR_MACHINE(obj);
4470
4471	spapr_irq_print_info(spapr, buf);
4472	g_string_append_printf(buf, "irqchip: %s\n",
4473	kvm_irqchip_in_kernel() ? "in-kernel" : "emulated");
4474	}
4475
4476	/*
4477	* This is a XIVE only operation
4478	*/
4479	static bool spapr_match_nvt(XiveFabric *xfb, uint8_t format,
4480	uint8_t nvt_blk, uint32_t nvt_idx,
4481	bool crowd, bool cam_ignore, uint8_t priority,
4482	uint32_t logic_serv, XiveTCTXMatch *match)
4483	{
4484	SpaprMachineState *spapr = SPAPR_MACHINE(xfb);
4485	XivePresenter *xptr = XIVE_PRESENTER(spapr->active_intc);
4486	XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
4487
4488	/*
4489	* When we implement the save and restore of the thread interrupt
4490	* contexts in the enter/exit CPU handlers of the machine and the
4491	* escalations in QEMU, we should be able to handle non dispatched
4492	* vCPUs.
4493	*
4494	* Until this is done, the sPAPR machine should find at least one
4495	* matching context always.
4496	*/
4497	if (!xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd, cam_ignore,
4498	priority, logic_serv, match)) {
4499	qemu_log_mask(LOG_GUEST_ERROR, "XIVE: NVT %x/%x is not dispatched\n",
4500	nvt_blk, nvt_idx);
4501	return false;
4502	}
4503
4504	return true;
4505	}
4506
4507	int spapr_get_vcpu_id(PowerPCCPU *cpu)
4508	{
4509	return cpu->vcpu_id;
4510	}
4511
4512	bool spapr_set_vcpu_id(PowerPCCPU cpu, int cpu_index, Error *errp)
4513	{
4514	SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
4515	MachineState *ms = MACHINE(spapr);
4516	int vcpu_id;
4517
4518	vcpu_id = spapr_vcpu_id(spapr, cpu_index);
4519
4520	if (kvm_enabled() && !kvm_vcpu_id_is_valid(vcpu_id)) {
4521	error_setg(errp, "Can't create CPU with id %d in KVM", vcpu_id);
4522	error_append_hint(errp, "Adjust the number of cpus to %d "
4523	"or try to raise the number of threads per core\n",
4524	vcpu_id * ms->smp.threads / spapr->vsmt);
4525	return false;
4526	}
4527
4528	cpu->vcpu_id = vcpu_id;
4529	return true;
4530	}
4531
4532	PowerPCCPU *spapr_find_cpu(int vcpu_id)
4533	{
4534	CPUState *cs;
4535
4536	CPU_FOREACH(cs) {
4537	PowerPCCPU *cpu = POWERPC_CPU(cs);
4538
4539	if (spapr_get_vcpu_id(cpu) == vcpu_id) {
4540	return cpu;
4541	}
4542	}
4543
4544	return NULL;
4545	}
4546
4547	static bool spapr_cpu_in_nested(PowerPCCPU *cpu)
4548	{
4549	SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
4550
4551	return spapr_cpu->in_nested;
4552	}
4553
4554	static void spapr_cpu_exec_enter(PPCVirtualHypervisor vhyp, PowerPCCPU cpu)
4555	{
4556	SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
4557
4558	/* These are only called by TCG, KVM maintains dispatch state */
4559
4560	spapr_cpu->prod = false;
4561	if (spapr_cpu->vpa_addr) {
4562	CPUState *cs = CPU(cpu);
4563	uint32_t dispatch;
4564
4565	dispatch = ldl_be_phys(cs->as,
4566	spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
4567	dispatch++;
4568	if ((dispatch & 1) != 0) {
4569	qemu_log_mask(LOG_GUEST_ERROR,
4570	"VPA: incorrect dispatch counter value for "
4571	"dispatched partition %u, correcting.\n", dispatch);
4572	dispatch++;
4573	}
4574	stl_be_phys(cs->as,
4575	spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER, dispatch);
4576	}
4577	}
4578
4579	static void spapr_cpu_exec_exit(PPCVirtualHypervisor vhyp, PowerPCCPU cpu)
4580	{
4581	SpaprCpuState *spapr_cpu = spapr_cpu_state(cpu);
4582
4583	if (spapr_cpu->vpa_addr) {
4584	CPUState *cs = CPU(cpu);
4585	uint32_t dispatch;
4586
4587	dispatch = ldl_be_phys(cs->as,
4588	spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER);
4589	dispatch++;
4590	if ((dispatch & 1) != 1) {
4591	qemu_log_mask(LOG_GUEST_ERROR,
4592	"VPA: incorrect dispatch counter value for "
4593	"preempted partition %u, correcting.\n", dispatch);
4594	dispatch++;
4595	}
4596	stl_be_phys(cs->as,
4597	spapr_cpu->vpa_addr + VPA_DISPATCH_COUNTER, dispatch);
4598	}
4599	}
4600
4601	static void spapr_machine_class_init(ObjectClass oc, const void data)
4602	{
4603	MachineClass *mc = MACHINE_CLASS(oc);
4604	SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(oc);
4605	FWPathProviderClass *fwc = FW_PATH_PROVIDER_CLASS(oc);
4606	NMIClass *nc = NMI_CLASS(oc);
4607	HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
4608	PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(oc);
4609	XICSFabricClass *xic = XICS_FABRIC_CLASS(oc);
4610	InterruptStatsProviderClass *ispc = INTERRUPT_STATS_PROVIDER_CLASS(oc);
4611	XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
4612	VofMachineIfClass *vmc = VOF_MACHINE_CLASS(oc);
4613
4614	mc->desc = "pSeries Logical Partition (PAPR compliant)";
4615	mc->ignore_boot_device_suffixes = true;
4616
4617	/*
4618	* We set up the default / latest behaviour here. The class_init
4619	* functions for the specific versioned machine types can override
4620	* these details for backwards compatibility
4621	*/
4622	mc->init = spapr_machine_init;
4623	mc->reset = spapr_machine_reset;
4624	mc->block_default_type = IF_SCSI;
4625
4626	/*
4627	* While KVM determines max cpus in kvm_init() using kvm_max_vcpus(),
4628	* In TCG the limit is restricted by the range of CPU IPIs available.
4629	*/
4630	mc->max_cpus = SPAPR_IRQ_NR_IPIS;
4631
4632	mc->no_parallel = 1;
4633	mc->default_boot_order = "";
4634	mc->default_ram_size = 512 * MiB;
4635	mc->default_ram_id = "ppc_spapr.ram";
4636	mc->default_display = "std";
4637	mc->kvm_type = spapr_kvm_type;
4638	machine_class_allow_dynamic_sysbus_dev(mc, TYPE_SPAPR_PCI_HOST_BRIDGE);
4639	mc->pci_allow_0_address = true;
4640	assert(!mc->get_hotplug_handler);
4641	mc->get_hotplug_handler = spapr_get_hotplug_handler;
4642	hc->pre_plug = spapr_machine_device_pre_plug;
4643	hc->plug = spapr_machine_device_plug;
4644	mc->cpu_index_to_instance_props = spapr_cpu_index_to_props;
4645	mc->get_default_cpu_node_id = spapr_get_default_cpu_node_id;
4646	mc->possible_cpu_arch_ids = spapr_possible_cpu_arch_ids;
4647	hc->unplug_request = spapr_machine_device_unplug_request;
4648	hc->unplug = spapr_machine_device_unplug;
4649
4650	mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power11_v2.0");
4651	mc->has_hotpluggable_cpus = true;
4652	mc->nvdimm_supported = true;
4653	smc->resize_hpt_default = SPAPR_RESIZE_HPT_ENABLED;
4654	fwc->get_dev_path = spapr_get_fw_dev_path;
4655	nc->raise_nmi = spapr_nmi;
4656	vhc->cpu_in_nested = spapr_cpu_in_nested;
4657	vhc->deliver_hv_excp = spapr_exit_nested;
4658	vhc->hypercall = emulate_spapr_hypercall;
4659	vhc->hpt_mask = spapr_hpt_mask;
4660	vhc->map_hptes = spapr_map_hptes;
4661	vhc->unmap_hptes = spapr_unmap_hptes;
4662	vhc->hpte_set_c = spapr_hpte_set_c;
4663	vhc->hpte_set_r = spapr_hpte_set_r;
4664	vhc->get_pate = spapr_get_pate;
4665	vhc->encode_hpt_for_kvm_pr = spapr_encode_hpt_for_kvm_pr;
4666	vhc->cpu_exec_enter = spapr_cpu_exec_enter;
4667	vhc->cpu_exec_exit = spapr_cpu_exec_exit;
4668	xic->ics_get = spapr_ics_get;
4669	xic->ics_resend = spapr_ics_resend;
4670	xic->icp_get = spapr_icp_get;
4671	ispc->print_info = spapr_pic_print_info;
4672	/* Force NUMA node memory size to be a multiple of
4673	* SPAPR_MEMORY_BLOCK_SIZE (256M) since that's the granularity
4674	* in which LMBs are represented and hot-added
4675	*/
4676	mc->numa_mem_align_shift = 28;
4677	mc->auto_enable_numa = true;
4678
4679	smc->default_caps.caps[SPAPR_CAP_HTM] = SPAPR_CAP_OFF;
4680	smc->default_caps.caps[SPAPR_CAP_VSX] = SPAPR_CAP_ON;
4681	smc->default_caps.caps[SPAPR_CAP_DFP] = SPAPR_CAP_ON;
4682	smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_WORKAROUND;
4683	smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_WORKAROUND;
4684	smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_WORKAROUND;
4685	smc->default_caps.caps[SPAPR_CAP_HPT_MAXPAGESIZE] = 16; /* 64kiB */
4686	smc->default_caps.caps[SPAPR_CAP_NESTED_KVM_HV] = SPAPR_CAP_OFF;
4687	smc->default_caps.caps[SPAPR_CAP_NESTED_PAPR] = SPAPR_CAP_OFF;
4688	smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_ON;
4689	smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_ON;
4690	smc->default_caps.caps[SPAPR_CAP_FWNMI] = SPAPR_CAP_ON;
4691	smc->default_caps.caps[SPAPR_CAP_RPT_INVALIDATE] = SPAPR_CAP_OFF;
4692	smc->default_caps.caps[SPAPR_CAP_DAWR1] = SPAPR_CAP_ON;
4693
4694	/*
4695	* This cap specifies whether the AIL 3 mode for
4696	* H_SET_RESOURCE is supported. The default is modified
4697	* by default_caps_with_cpu().
4698	*/
4699	smc->default_caps.caps[SPAPR_CAP_AIL_MODE_3] = SPAPR_CAP_ON;
4700	spapr_caps_add_properties(smc);
4701	smc->irq = &spapr_irq_dual;
4702	xfc->match_nvt = spapr_match_nvt;
4703	vmc->client_architecture_support = spapr_vof_client_architecture_support;
4704	vmc->quiesce = spapr_vof_quiesce;
4705	vmc->setprop = spapr_vof_setprop;
4706	}
4707
4708	static const TypeInfo spapr_machine_info = {
4709	.name = TYPE_SPAPR_MACHINE,
4710	.parent = TYPE_MACHINE,
4711	.abstract = true,
4712	.instance_size = sizeof(SpaprMachineState),
4713	.instance_init = spapr_instance_init,
4714	.instance_finalize = spapr_machine_finalizefn,
4715	.class_size = sizeof(SpaprMachineClass),
4716	.class_init = spapr_machine_class_init,
4717	.interfaces = (const InterfaceInfo[]) {
4718	{ TYPE_FW_PATH_PROVIDER },
4719	{ TYPE_NMI },
4720	{ TYPE_HOTPLUG_HANDLER },
4721	{ TYPE_PPC_VIRTUAL_HYPERVISOR },
4722	{ TYPE_XICS_FABRIC },
4723	{ TYPE_INTERRUPT_STATS_PROVIDER },
4724	{ TYPE_XIVE_FABRIC },
4725	{ TYPE_VOF_MACHINE_IF },
4726	{ }
4727	},
4728	};
4729
4730	static void spapr_machine_latest_class_options(MachineClass *mc)
4731	{
4732	mc->alias = "pseries";
4733	mc->is_default = true;
4734	}
4735
4736	#define DEFINE_SPAPR_MACHINE_IMPL(latest, ...) \
4737	static void MACHINE_VER_SYM(class_init, spapr, __VA_ARGS__)( \
4738	ObjectClass *oc, \
4739	const void *data) \
4740	{ \
4741	MachineClass *mc = MACHINE_CLASS(oc); \
4742	MACHINE_VER_SYM(class_options, spapr, __VA_ARGS__)(mc); \
4743	MACHINE_VER_DEPRECATION(__VA_ARGS__); \
4744	if (latest) { \
4745	spapr_machine_latest_class_options(mc); \
4746	} \
4747	} \
4748	static const TypeInfo MACHINE_VER_SYM(info, spapr, __VA_ARGS__) = \
4749	{ \
4750	.name = MACHINE_VER_TYPE_NAME("pseries", __VA_ARGS__), \
4751	.parent = TYPE_SPAPR_MACHINE, \
4752	.class_init = MACHINE_VER_SYM(class_init, spapr, __VA_ARGS__), \
4753	}; \
4754	static void MACHINE_VER_SYM(register, spapr, __VA_ARGS__)(void) \
4755	{ \
4756	MACHINE_VER_DELETION(__VA_ARGS__); \
4757	type_register_static(&MACHINE_VER_SYM(info, spapr, __VA_ARGS__)); \
4758	} \
4759	type_init(MACHINE_VER_SYM(register, spapr, __VA_ARGS__))
4760
4761	#define DEFINE_SPAPR_MACHINE_AS_LATEST(major, minor) \
4762	DEFINE_SPAPR_MACHINE_IMPL(true, major, minor)
4763	#define DEFINE_SPAPR_MACHINE(major, minor) \
4764	DEFINE_SPAPR_MACHINE_IMPL(false, major, minor)
4765
4766	/*
4767	* pseries-11.2
4768	*/
4769	static void spapr_machine_11_2_class_options(MachineClass *mc)
4770	{
4771	/* Defaults for the latest behaviour inherited from the base class */
4772	}
4773
4774	DEFINE_SPAPR_MACHINE_AS_LATEST(11, 2);
4775
4776	/*
4777	* pseries-11.1
4778	*/
4779	static void spapr_machine_11_1_class_options(MachineClass *mc)
4780	{
4781	spapr_machine_11_2_class_options(mc);
4782	compat_props_add(mc->compat_props, hw_compat_11_1, hw_compat_11_1_len);
4783	}
4784
4785	DEFINE_SPAPR_MACHINE(11, 1);
4786
4787	/*
4788	* pseries-11.0
4789	*/
4790	static void spapr_machine_11_0_class_options(MachineClass *mc)
4791	{
4792	spapr_machine_11_1_class_options(mc);
4793	compat_props_add(mc->compat_props, hw_compat_11_0, hw_compat_11_0_len);
4794	mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power10_v2.0");
4795	}
4796
4797	DEFINE_SPAPR_MACHINE(11, 0);
4798
4799	/*
4800	* pseries-10.2
4801	*/
4802	static void spapr_machine_10_2_class_options(MachineClass *mc)
4803	{
4804	spapr_machine_11_0_class_options(mc);
4805	compat_props_add(mc->compat_props, hw_compat_10_2, hw_compat_10_2_len);
4806	}
4807
4808	DEFINE_SPAPR_MACHINE(10, 2);
4809
4810	/*
4811	* pseries-10.1
4812	*/
4813	static void spapr_machine_10_1_class_options(MachineClass *mc)
4814	{
4815	spapr_machine_10_2_class_options(mc);
4816	compat_props_add(mc->compat_props, hw_compat_10_1, hw_compat_10_1_len);
4817	}
4818
4819	DEFINE_SPAPR_MACHINE(10, 1);
4820
4821	/*
4822	* pseries-10.0
4823	*/
4824	static void spapr_machine_10_0_class_options(MachineClass *mc)
4825	{
4826	static GlobalProperty spapr_compat_10_0[] = {
4827	{ TYPE_POWERPC_CPU, "rtas-stopped-state", "false" },
4828	};
4829
4830	spapr_machine_10_1_class_options(mc);
4831	compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
4832	compat_props_add(mc->compat_props, spapr_compat_10_0,
4833	G_N_ELEMENTS(spapr_compat_10_0));
4834	}
4835
4836	DEFINE_SPAPR_MACHINE(10, 0);
4837
4838	/*
4839	* pseries-9.2
4840	*/
4841	static void spapr_machine_9_2_class_options(MachineClass *mc)
4842	{
4843	spapr_machine_10_0_class_options(mc);
4844	compat_props_add(mc->compat_props, hw_compat_9_2, hw_compat_9_2_len);
4845	}
4846
4847	DEFINE_SPAPR_MACHINE(9, 2);
4848
4849	/*
4850	* pseries-9.1
4851	*/
4852	static void spapr_machine_9_1_class_options(MachineClass *mc)
4853	{
4854	spapr_machine_9_2_class_options(mc);
4855	compat_props_add(mc->compat_props, hw_compat_9_1, hw_compat_9_1_len);
4856	}
4857
4858	DEFINE_SPAPR_MACHINE(9, 1);
4859
4860	/*
4861	* pseries-9.0
4862	*/
4863	static void spapr_machine_9_0_class_options(MachineClass *mc)
4864	{
4865	spapr_machine_9_1_class_options(mc);
4866	compat_props_add(mc->compat_props, hw_compat_9_0, hw_compat_9_0_len);
4867	}
4868
4869	DEFINE_SPAPR_MACHINE(9, 0);
4870
4871	/*
4872	* pseries-8.2
4873	*/
4874	static void spapr_machine_8_2_class_options(MachineClass *mc)
4875	{
4876	spapr_machine_9_0_class_options(mc);
4877	compat_props_add(mc->compat_props, hw_compat_8_2, hw_compat_8_2_len);
4878	mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power9_v2.2");
4879	}
4880
4881	DEFINE_SPAPR_MACHINE(8, 2);
4882
4883	/*
4884	* pseries-8.1
4885	*/
4886	static void spapr_machine_8_1_class_options(MachineClass *mc)
4887	{
4888	spapr_machine_8_2_class_options(mc);
4889	compat_props_add(mc->compat_props, hw_compat_8_1, hw_compat_8_1_len);
4890	}
4891
4892	DEFINE_SPAPR_MACHINE(8, 1);
4893
4894	/*
4895	* pseries-8.0
4896	*/
4897	static void spapr_machine_8_0_class_options(MachineClass *mc)
4898	{
4899	spapr_machine_8_1_class_options(mc);
4900	compat_props_add(mc->compat_props, hw_compat_8_0, hw_compat_8_0_len);
4901	}
4902
4903	DEFINE_SPAPR_MACHINE(8, 0);
4904
4905	/*
4906	* pseries-7.2
4907	*/
4908	static void spapr_machine_7_2_class_options(MachineClass *mc)
4909	{
4910	spapr_machine_8_0_class_options(mc);
4911	compat_props_add(mc->compat_props, hw_compat_7_2, hw_compat_7_2_len);
4912	}
4913
4914	DEFINE_SPAPR_MACHINE(7, 2);
4915
4916	/*
4917	* pseries-7.1
4918	*/
4919	static void spapr_machine_7_1_class_options(MachineClass *mc)
4920	{
4921	spapr_machine_7_2_class_options(mc);
4922	compat_props_add(mc->compat_props, hw_compat_7_1, hw_compat_7_1_len);
4923	}
4924
4925	DEFINE_SPAPR_MACHINE(7, 1);
4926
4927	/*
4928	* pseries-7.0
4929	*/
4930	static void spapr_machine_7_0_class_options(MachineClass *mc)
4931	{
4932	spapr_machine_7_1_class_options(mc);
4933	compat_props_add(mc->compat_props, hw_compat_7_0, hw_compat_7_0_len);
4934	}
4935
4936	DEFINE_SPAPR_MACHINE(7, 0);
4937
4938	/*
4939	* pseries-6.2
4940	*/
4941	static void spapr_machine_6_2_class_options(MachineClass *mc)
4942	{
4943	spapr_machine_7_0_class_options(mc);
4944	compat_props_add(mc->compat_props, hw_compat_6_2, hw_compat_6_2_len);
4945	}
4946
4947	DEFINE_SPAPR_MACHINE(6, 2);
4948
4949	/*
4950	* pseries-6.1
4951	*/
4952	static void spapr_machine_6_1_class_options(MachineClass *mc)
4953	{
4954	SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4955
4956	spapr_machine_6_2_class_options(mc);
4957	compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
4958	smc->pre_6_2_numa_affinity = true;
4959	mc->smp_props.prefer_sockets = true;
4960	}
4961
4962	DEFINE_SPAPR_MACHINE(6, 1);
4963
4964	/*
4965	* pseries-6.0
4966	*/
4967	static void spapr_machine_6_0_class_options(MachineClass *mc)
4968	{
4969	spapr_machine_6_1_class_options(mc);
4970	compat_props_add(mc->compat_props, hw_compat_6_0, hw_compat_6_0_len);
4971	}
4972
4973	DEFINE_SPAPR_MACHINE(6, 0);
4974
4975	/*
4976	* pseries-5.2
4977	*/
4978	static void spapr_machine_5_2_class_options(MachineClass *mc)
4979	{
4980	spapr_machine_6_0_class_options(mc);
4981	compat_props_add(mc->compat_props, hw_compat_5_2, hw_compat_5_2_len);
4982	}
4983
4984	DEFINE_SPAPR_MACHINE(5, 2);
4985
4986	/*
4987	* pseries-5.1
4988	*/
4989	static void spapr_machine_5_1_class_options(MachineClass *mc)
4990	{
4991	SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
4992
4993	spapr_machine_5_2_class_options(mc);
4994	compat_props_add(mc->compat_props, hw_compat_5_1, hw_compat_5_1_len);
4995	smc->pre_5_2_numa_associativity = true;
4996	}
4997
4998	DEFINE_SPAPR_MACHINE(5, 1);
4999
5000	/*

Showing first 5,000 of 5,024 lines. View raw