1 /*
2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include "qemu/osdep.h"
20 #include "qemu/bitops.h"
21 #include "hw/irq.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "hw/qdev-properties.h"
25 #include "hw/qdev-core.h"
26 #include "hw/pci/pci.h"
27 #include "cpu.h"
28 #include "exec/target_page.h"
29 #include "trace.h"
30 #include "qemu/log.h"
31 #include "qemu/error-report.h"
32 #include "qapi/error.h"
33
34 #include "hw/arm/smmuv3.h"
35 #include "smmuv3-internal.h"
36 #include "smmu-internal.h"
37
38 #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
39 (cfg)->record_faults) || \
40 ((ptw_info).stage == SMMU_STAGE_2 && \
41 (cfg)->s2cfg.record_faults))
42
43 /**
44 * smmuv3_trigger_irq - pulse @irq if enabled and update
45 * GERROR register in case of GERROR interrupt
46 *
47 * @irq: irq type
48 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
49 */
smmuv3_trigger_irq(SMMUv3State * s,SMMUIrq irq,uint32_t gerror_mask)50 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
51 uint32_t gerror_mask)
52 {
53
54 bool pulse = false;
55
56 switch (irq) {
57 case SMMU_IRQ_EVTQ:
58 pulse = smmuv3_eventq_irq_enabled(s);
59 break;
60 case SMMU_IRQ_PRIQ:
61 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
62 break;
63 case SMMU_IRQ_CMD_SYNC:
64 pulse = true;
65 break;
66 case SMMU_IRQ_GERROR:
67 {
68 uint32_t pending = s->gerror ^ s->gerrorn;
69 uint32_t new_gerrors = ~pending & gerror_mask;
70
71 if (!new_gerrors) {
72 /* only toggle non pending errors */
73 return;
74 }
75 s->gerror ^= new_gerrors;
76 trace_smmuv3_write_gerror(new_gerrors, s->gerror);
77
78 pulse = smmuv3_gerror_irq_enabled(s);
79 break;
80 }
81 }
82 if (pulse) {
83 trace_smmuv3_trigger_irq(irq);
84 qemu_irq_pulse(s->irq[irq]);
85 }
86 }
87
smmuv3_write_gerrorn(SMMUv3State * s,uint32_t new_gerrorn)88 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
89 {
90 uint32_t pending = s->gerror ^ s->gerrorn;
91 uint32_t toggled = s->gerrorn ^ new_gerrorn;
92
93 if (toggled & ~pending) {
94 qemu_log_mask(LOG_GUEST_ERROR,
95 "guest toggles non pending errors = 0x%x\n",
96 toggled & ~pending);
97 }
98
99 /*
100 * We do not raise any error in case guest toggles bits corresponding
101 * to not active IRQs (CONSTRAINED UNPREDICTABLE)
102 */
103 s->gerrorn = new_gerrorn;
104
105 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
106 }
107
queue_read(SMMUQueue * q,Cmd * cmd)108 static inline MemTxResult queue_read(SMMUQueue *q, Cmd *cmd)
109 {
110 dma_addr_t addr = Q_CONS_ENTRY(q);
111 MemTxResult ret;
112 int i;
113
114 ret = dma_memory_read(&address_space_memory, addr, cmd, sizeof(Cmd),
115 MEMTXATTRS_UNSPECIFIED);
116 if (ret != MEMTX_OK) {
117 return ret;
118 }
119 for (i = 0; i < ARRAY_SIZE(cmd->word); i++) {
120 le32_to_cpus(&cmd->word[i]);
121 }
122 return ret;
123 }
124
queue_write(SMMUQueue * q,Evt * evt_in)125 static MemTxResult queue_write(SMMUQueue *q, Evt *evt_in)
126 {
127 dma_addr_t addr = Q_PROD_ENTRY(q);
128 MemTxResult ret;
129 Evt evt = *evt_in;
130 int i;
131
132 for (i = 0; i < ARRAY_SIZE(evt.word); i++) {
133 cpu_to_le32s(&evt.word[i]);
134 }
135 ret = dma_memory_write(&address_space_memory, addr, &evt, sizeof(Evt),
136 MEMTXATTRS_UNSPECIFIED);
137 if (ret != MEMTX_OK) {
138 return ret;
139 }
140
141 queue_prod_incr(q);
142 return MEMTX_OK;
143 }
144
smmuv3_write_eventq(SMMUv3State * s,Evt * evt)145 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
146 {
147 SMMUQueue *q = &s->eventq;
148 MemTxResult r;
149
150 if (!smmuv3_eventq_enabled(s)) {
151 return MEMTX_ERROR;
152 }
153
154 if (smmuv3_q_full(q)) {
155 return MEMTX_ERROR;
156 }
157
158 r = queue_write(q, evt);
159 if (r != MEMTX_OK) {
160 return r;
161 }
162
163 if (!smmuv3_q_empty(q)) {
164 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
165 }
166 return MEMTX_OK;
167 }
168
smmuv3_record_event(SMMUv3State * s,SMMUEventInfo * info)169 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
170 {
171 Evt evt = {};
172 MemTxResult r;
173
174 if (!smmuv3_eventq_enabled(s)) {
175 return;
176 }
177
178 EVT_SET_TYPE(&evt, info->type);
179 EVT_SET_SID(&evt, info->sid);
180
181 switch (info->type) {
182 case SMMU_EVT_NONE:
183 return;
184 case SMMU_EVT_F_UUT:
185 EVT_SET_SSID(&evt, info->u.f_uut.ssid);
186 EVT_SET_SSV(&evt, info->u.f_uut.ssv);
187 EVT_SET_ADDR(&evt, info->u.f_uut.addr);
188 EVT_SET_RNW(&evt, info->u.f_uut.rnw);
189 EVT_SET_PNU(&evt, info->u.f_uut.pnu);
190 EVT_SET_IND(&evt, info->u.f_uut.ind);
191 break;
192 case SMMU_EVT_C_BAD_STREAMID:
193 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
194 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv);
195 break;
196 case SMMU_EVT_F_STE_FETCH:
197 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
198 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv);
199 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
200 break;
201 case SMMU_EVT_C_BAD_STE:
202 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
203 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv);
204 break;
205 case SMMU_EVT_F_STREAM_DISABLED:
206 break;
207 case SMMU_EVT_F_TRANS_FORBIDDEN:
208 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
209 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
210 break;
211 case SMMU_EVT_C_BAD_SUBSTREAMID:
212 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
213 break;
214 case SMMU_EVT_F_CD_FETCH:
215 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
216 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv);
217 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
218 break;
219 case SMMU_EVT_C_BAD_CD:
220 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
221 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv);
222 break;
223 case SMMU_EVT_F_WALK_EABT:
224 case SMMU_EVT_F_TRANSLATION:
225 case SMMU_EVT_F_ADDR_SIZE:
226 case SMMU_EVT_F_ACCESS:
227 case SMMU_EVT_F_PERMISSION:
228 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
229 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
230 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
231 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
232 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
233 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
234 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
235 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
236 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
237 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
238 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
239 break;
240 case SMMU_EVT_F_CFG_CONFLICT:
241 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
242 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv);
243 break;
244 /* rest is not implemented */
245 case SMMU_EVT_F_BAD_ATS_TREQ:
246 case SMMU_EVT_F_TLB_CONFLICT:
247 case SMMU_EVT_E_PAGE_REQ:
248 default:
249 g_assert_not_reached();
250 }
251
252 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
253 r = smmuv3_write_eventq(s, &evt);
254 if (r != MEMTX_OK) {
255 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
256 }
257 info->recorded = true;
258 }
259
smmuv3_init_regs(SMMUv3State * s)260 static void smmuv3_init_regs(SMMUv3State *s)
261 {
262 /* Based on sys property, the stages supported in smmu will be advertised.*/
263 if (s->stage && !strcmp("2", s->stage)) {
264 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
265 } else if (s->stage && !strcmp("nested", s->stage)) {
266 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
267 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
268 } else {
269 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
270 }
271
272 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
273 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
274 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
275 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
276 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
277 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
278 /* terminated transaction will always be aborted/error returned */
279 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
280 /* 2-level stream table supported */
281 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
282
283 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
284 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
285 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS);
286
287 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
288 if (FIELD_EX32(s->idr[0], IDR0, S2P)) {
289 /* XNX is a stage-2-specific feature */
290 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, XNX, 1);
291 }
292 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
293 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2);
294
295 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
296 /* 4K, 16K and 64K granule support */
297 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
298 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1);
299 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
300
301 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
302 s->cmdq.prod = 0;
303 s->cmdq.cons = 0;
304 s->cmdq.entry_size = sizeof(struct Cmd);
305 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
306 s->eventq.prod = 0;
307 s->eventq.cons = 0;
308 s->eventq.entry_size = sizeof(struct Evt);
309
310 s->features = 0;
311 s->sid_split = 0;
312 s->aidr = 0x1;
313 s->cr[0] = 0;
314 s->cr0ack = 0;
315 s->irq_ctrl = 0;
316 s->gerror = 0;
317 s->gerrorn = 0;
318 s->statusr = 0;
319 s->gbpa = SMMU_GBPA_RESET_VAL;
320 }
321
smmu_get_ste(SMMUv3State * s,dma_addr_t addr,STE * buf,SMMUEventInfo * event)322 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
323 SMMUEventInfo *event)
324 {
325 int ret, i;
326
327 trace_smmuv3_get_ste(addr);
328 /* TODO: guarantee 64-bit single-copy atomicity */
329 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf),
330 MEMTXATTRS_UNSPECIFIED);
331 if (ret != MEMTX_OK) {
332 qemu_log_mask(LOG_GUEST_ERROR,
333 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
334 event->type = SMMU_EVT_F_STE_FETCH;
335 event->u.f_ste_fetch.addr = addr;
336 return -EINVAL;
337 }
338 for (i = 0; i < ARRAY_SIZE(buf->word); i++) {
339 le32_to_cpus(&buf->word[i]);
340 }
341 return 0;
342
343 }
344
345 static SMMUTranslationStatus smmuv3_do_translate(SMMUv3State *s, hwaddr addr,
346 SMMUTransCfg *cfg,
347 SMMUEventInfo *event,
348 IOMMUAccessFlags flag,
349 SMMUTLBEntry **out_entry,
350 SMMUTranslationClass class);
351 /* @ssid > 0 not supported yet */
smmu_get_cd(SMMUv3State * s,STE * ste,SMMUTransCfg * cfg,uint32_t ssid,CD * buf,SMMUEventInfo * event)352 static int smmu_get_cd(SMMUv3State *s, STE *ste, SMMUTransCfg *cfg,
353 uint32_t ssid, CD *buf, SMMUEventInfo *event)
354 {
355 dma_addr_t addr = STE_CTXPTR(ste);
356 int ret, i;
357 SMMUTranslationStatus status;
358 SMMUTLBEntry *entry;
359
360 trace_smmuv3_get_cd(addr);
361
362 if (cfg->stage == SMMU_NESTED) {
363 status = smmuv3_do_translate(s, addr, cfg, event,
364 IOMMU_RO, &entry, SMMU_CLASS_CD);
365
366 /* Same PTW faults are reported but with CLASS = CD. */
367 if (status != SMMU_TRANS_SUCCESS) {
368 return -EINVAL;
369 }
370
371 addr = CACHED_ENTRY_TO_ADDR(entry, addr);
372 }
373
374 /* TODO: guarantee 64-bit single-copy atomicity */
375 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf),
376 MEMTXATTRS_UNSPECIFIED);
377 if (ret != MEMTX_OK) {
378 qemu_log_mask(LOG_GUEST_ERROR,
379 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
380 event->type = SMMU_EVT_F_CD_FETCH;
381 event->u.f_cd_fetch.addr = addr;
382 return -EINVAL;
383 }
384 for (i = 0; i < ARRAY_SIZE(buf->word); i++) {
385 le32_to_cpus(&buf->word[i]);
386 }
387 return 0;
388 }
389
390 /*
391 * Max valid value is 39 when SMMU_IDR3.STT == 0.
392 * In architectures after SMMUv3.0:
393 * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
394 * field is MAX(16, 64-IAS)
395 * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
396 * is (64-IAS).
397 * As we only support AA64, IAS = OAS.
398 */
s2t0sz_valid(SMMUTransCfg * cfg)399 static bool s2t0sz_valid(SMMUTransCfg *cfg)
400 {
401 if (cfg->s2cfg.tsz > 39) {
402 return false;
403 }
404
405 if (cfg->s2cfg.granule_sz == 16) {
406 return (cfg->s2cfg.tsz >= 64 - cfg->s2cfg.eff_ps);
407 }
408
409 return (cfg->s2cfg.tsz >= MAX(64 - cfg->s2cfg.eff_ps, 16));
410 }
411
412 /*
413 * Return true if s2 page table config is valid.
414 * This checks with the configured start level, ias_bits and granularity we can
415 * have a valid page table as described in ARM ARM D8.2 Translation process.
416 * The idea here is to see for the highest possible number of IPA bits, how
417 * many concatenated tables we would need, if it is more than 16, then this is
418 * not possible.
419 */
s2_pgtable_config_valid(uint8_t sl0,uint8_t t0sz,uint8_t gran)420 static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
421 {
422 int level = get_start_level(sl0, gran);
423 uint64_t ipa_bits = 64 - t0sz;
424 uint64_t max_ipa = (1ULL << ipa_bits) - 1;
425 int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
426
427 return nr_concat <= VMSA_MAX_S2_CONCAT;
428 }
429
decode_ste_s2_cfg(SMMUv3State * s,SMMUTransCfg * cfg,STE * ste)430 static int decode_ste_s2_cfg(SMMUv3State *s, SMMUTransCfg *cfg,
431 STE *ste)
432 {
433 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS);
434
435 if (STE_S2AA64(ste) == 0x0) {
436 qemu_log_mask(LOG_UNIMP,
437 "SMMUv3 AArch32 tables not supported\n");
438 g_assert_not_reached();
439 }
440
441 switch (STE_S2TG(ste)) {
442 case 0x0: /* 4KB */
443 cfg->s2cfg.granule_sz = 12;
444 break;
445 case 0x1: /* 64KB */
446 cfg->s2cfg.granule_sz = 16;
447 break;
448 case 0x2: /* 16KB */
449 cfg->s2cfg.granule_sz = 14;
450 break;
451 default:
452 qemu_log_mask(LOG_GUEST_ERROR,
453 "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
454 goto bad_ste;
455 }
456
457 cfg->s2cfg.vttb = STE_S2TTB(ste);
458
459 cfg->s2cfg.sl0 = STE_S2SL0(ste);
460 /* FEAT_TTST not supported. */
461 if (cfg->s2cfg.sl0 == 0x3) {
462 qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
463 goto bad_ste;
464 }
465
466 /* For AA64, The effective S2PS size is capped to the OAS. */
467 cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), oas));
468 /*
469 * For SMMUv3.1 and later, when OAS == IAS == 52, the stage 2 input
470 * range is further limited to 48 bits unless STE.S2TG indicates a
471 * 64KB granule.
472 */
473 if (cfg->s2cfg.granule_sz != 16) {
474 cfg->s2cfg.eff_ps = MIN(cfg->s2cfg.eff_ps, 48);
475 }
476 /*
477 * It is ILLEGAL for the address in S2TTB to be outside the range
478 * described by the effective S2PS value.
479 */
480 if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
481 qemu_log_mask(LOG_GUEST_ERROR,
482 "SMMUv3 S2TTB too large 0x%" PRIx64
483 ", effective PS %d bits\n",
484 cfg->s2cfg.vttb, cfg->s2cfg.eff_ps);
485 goto bad_ste;
486 }
487
488 cfg->s2cfg.tsz = STE_S2T0SZ(ste);
489
490 if (!s2t0sz_valid(cfg)) {
491 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
492 cfg->s2cfg.tsz);
493 goto bad_ste;
494 }
495
496 if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
497 cfg->s2cfg.granule_sz)) {
498 qemu_log_mask(LOG_GUEST_ERROR,
499 "SMMUv3 STE stage 2 config not valid!\n");
500 goto bad_ste;
501 }
502
503 /* Only LE supported(IDR0.TTENDIAN). */
504 if (STE_S2ENDI(ste)) {
505 qemu_log_mask(LOG_GUEST_ERROR,
506 "SMMUv3 STE_S2ENDI only supports LE!\n");
507 goto bad_ste;
508 }
509
510 cfg->s2cfg.affd = STE_S2AFFD(ste);
511
512 cfg->s2cfg.record_faults = STE_S2R(ste);
513 /* As stall is not supported. */
514 if (STE_S2S(ste)) {
515 qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
516 goto bad_ste;
517 }
518
519 return 0;
520
521 bad_ste:
522 return -EINVAL;
523 }
524
decode_ste_config(SMMUTransCfg * cfg,uint32_t config)525 static void decode_ste_config(SMMUTransCfg *cfg, uint32_t config)
526 {
527
528 if (STE_CFG_ABORT(config)) {
529 cfg->aborted = true;
530 return;
531 }
532 if (STE_CFG_BYPASS(config)) {
533 cfg->bypassed = true;
534 return;
535 }
536
537 if (STE_CFG_S1_ENABLED(config)) {
538 cfg->stage = SMMU_STAGE_1;
539 }
540
541 if (STE_CFG_S2_ENABLED(config)) {
542 cfg->stage |= SMMU_STAGE_2;
543 }
544 }
545
546 /* Returns < 0 in case of invalid STE, 0 otherwise */
decode_ste(SMMUv3State * s,SMMUTransCfg * cfg,STE * ste,SMMUEventInfo * event)547 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
548 STE *ste, SMMUEventInfo *event)
549 {
550 uint32_t config;
551 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS);
552 int ret;
553
554 if (!STE_VALID(ste)) {
555 if (!event->inval_ste_allowed) {
556 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n");
557 }
558 goto bad_ste;
559 }
560
561 config = STE_CONFIG(ste);
562
563 decode_ste_config(cfg, config);
564
565 if (cfg->aborted || cfg->bypassed) {
566 return 0;
567 }
568
569 /*
570 * If a stage is enabled in SW while not advertised, throw bad ste
571 * according to user manual(IHI0070E) "5.2 Stream Table Entry".
572 */
573 if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
574 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
575 goto bad_ste;
576 }
577 if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
578 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
579 goto bad_ste;
580 }
581
582 if (STAGE2_SUPPORTED(s)) {
583 /* VMID is considered even if s2 is disabled. */
584 cfg->s2cfg.vmid = STE_S2VMID(ste);
585 } else {
586 /* Default to -1 */
587 cfg->s2cfg.vmid = -1;
588 }
589
590 if (STE_CFG_S2_ENABLED(config)) {
591 /*
592 * Stage-1 OAS defaults to OAS even if not enabled as it would be used
593 * in input address check for stage-2.
594 */
595 cfg->oas = oas2bits(oas);
596 ret = decode_ste_s2_cfg(s, cfg, ste);
597 if (ret) {
598 goto bad_ste;
599 }
600 }
601
602 if (STE_S1CDMAX(ste) != 0) {
603 qemu_log_mask(LOG_UNIMP,
604 "SMMUv3 does not support multiple context descriptors yet\n");
605 goto bad_ste;
606 }
607
608 if (STE_S1STALLD(ste)) {
609 qemu_log_mask(LOG_UNIMP,
610 "SMMUv3 S1 stalling fault model not allowed yet\n");
611 goto bad_ste;
612 }
613 return 0;
614
615 bad_ste:
616 event->type = SMMU_EVT_C_BAD_STE;
617 return -EINVAL;
618 }
619
620 /**
621 * smmu_find_ste - Return the stream table entry associated
622 * to the sid
623 *
624 * @s: smmuv3 handle
625 * @sid: stream ID
626 * @ste: returned stream table entry
627 * @event: handle to an event info
628 *
629 * Supports linear and 2-level stream table
630 * Return 0 on success, -EINVAL otherwise
631 */
smmu_find_ste(SMMUv3State * s,uint32_t sid,STE * ste,SMMUEventInfo * event)632 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
633 SMMUEventInfo *event)
634 {
635 dma_addr_t addr, strtab_base;
636 uint32_t log2size;
637 int strtab_size_shift;
638 int ret;
639
640 trace_smmuv3_find_ste(sid, s->features, s->sid_split);
641 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
642 /*
643 * Check SID range against both guest-configured and implementation limits
644 */
645 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
646 event->type = SMMU_EVT_C_BAD_STREAMID;
647 return -EINVAL;
648 }
649 if (s->features & SMMU_FEATURE_2LVL_STE) {
650 int l1_ste_offset, l2_ste_offset, max_l2_ste, span, i;
651 dma_addr_t l1ptr, l2ptr;
652 STEDesc l1std;
653
654 /*
655 * Align strtab base address to table size. For this purpose, assume it
656 * is not bounded by SMMU_IDR1_SIDSIZE.
657 */
658 strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
659 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
660 ~MAKE_64BIT_MASK(0, strtab_size_shift);
661 l1_ste_offset = sid >> s->sid_split;
662 l2_ste_offset = sid & ((1 << s->sid_split) - 1);
663 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
664 /* TODO: guarantee 64-bit single-copy atomicity */
665 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std,
666 sizeof(l1std), MEMTXATTRS_UNSPECIFIED);
667 if (ret != MEMTX_OK) {
668 qemu_log_mask(LOG_GUEST_ERROR,
669 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
670 event->type = SMMU_EVT_F_STE_FETCH;
671 event->u.f_ste_fetch.addr = l1ptr;
672 return -EINVAL;
673 }
674 for (i = 0; i < ARRAY_SIZE(l1std.word); i++) {
675 le32_to_cpus(&l1std.word[i]);
676 }
677
678 span = L1STD_SPAN(&l1std);
679
680 if (!span) {
681 /* l2ptr is not valid */
682 if (!event->inval_ste_allowed) {
683 qemu_log_mask(LOG_GUEST_ERROR,
684 "invalid sid=%d (L1STD span=0)\n", sid);
685 }
686 event->type = SMMU_EVT_C_BAD_STREAMID;
687 return -EINVAL;
688 }
689 max_l2_ste = (1 << span) - 1;
690 l2ptr = l1std_l2ptr(&l1std);
691 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
692 l2ptr, l2_ste_offset, max_l2_ste);
693 if (l2_ste_offset > max_l2_ste) {
694 qemu_log_mask(LOG_GUEST_ERROR,
695 "l2_ste_offset=%d > max_l2_ste=%d\n",
696 l2_ste_offset, max_l2_ste);
697 event->type = SMMU_EVT_C_BAD_STE;
698 return -EINVAL;
699 }
700 addr = l2ptr + l2_ste_offset * sizeof(*ste);
701 } else {
702 strtab_size_shift = log2size + 5;
703 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
704 ~MAKE_64BIT_MASK(0, strtab_size_shift);
705 addr = strtab_base + sid * sizeof(*ste);
706 }
707
708 if (smmu_get_ste(s, addr, ste, event)) {
709 return -EINVAL;
710 }
711
712 return 0;
713 }
714
decode_cd(SMMUv3State * s,SMMUTransCfg * cfg,CD * cd,SMMUEventInfo * event)715 static int decode_cd(SMMUv3State *s, SMMUTransCfg *cfg,
716 CD *cd, SMMUEventInfo *event)
717 {
718 int ret = -EINVAL;
719 int i;
720 SMMUTranslationStatus status;
721 SMMUTLBEntry *entry;
722 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS);
723
724 if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
725 goto bad_cd;
726 }
727 if (!CD_A(cd)) {
728 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
729 }
730 if (CD_S(cd)) {
731 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
732 }
733 if (CD_HA(cd) || CD_HD(cd)) {
734 goto bad_cd; /* HTTU = 0 */
735 }
736
737 /* we support only those at the moment */
738 cfg->aa64 = true;
739
740 cfg->oas = oas2bits(CD_IPS(cd));
741 cfg->oas = MIN(oas2bits(oas), cfg->oas);
742 cfg->tbi = CD_TBI(cd);
743 cfg->asid = CD_ASID(cd);
744 cfg->affd = CD_AFFD(cd);
745
746 trace_smmuv3_decode_cd(cfg->oas);
747
748 /* decode data dependent on TT */
749 for (i = 0; i <= 1; i++) {
750 int tg, tsz;
751 SMMUTransTableInfo *tt = &cfg->tt[i];
752
753 cfg->tt[i].disabled = CD_EPD(cd, i);
754 if (cfg->tt[i].disabled) {
755 continue;
756 }
757
758 tsz = CD_TSZ(cd, i);
759 if (tsz < 16 || tsz > 39) {
760 goto bad_cd;
761 }
762
763 tg = CD_TG(cd, i);
764 tt->granule_sz = tg2granule(tg, i);
765 if ((tt->granule_sz != 12 && tt->granule_sz != 14 &&
766 tt->granule_sz != 16) || CD_ENDI(cd)) {
767 goto bad_cd;
768 }
769
770 /*
771 * An address greater than 48 bits in size can only be output from a
772 * TTD when, in SMMUv3.1 and later, the effective IPS is 52 and a 64KB
773 * granule is in use for that translation table
774 */
775 if (tt->granule_sz != 16) {
776 cfg->oas = MIN(cfg->oas, 48);
777 }
778 tt->tsz = tsz;
779 tt->ttb = CD_TTB(cd, i);
780
781 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
782 goto bad_cd;
783 }
784
785 /* Translate the TTBx, from IPA to PA if nesting is enabled. */
786 if (cfg->stage == SMMU_NESTED) {
787 status = smmuv3_do_translate(s, tt->ttb, cfg, event, IOMMU_RO,
788 &entry, SMMU_CLASS_TT);
789 /*
790 * Same PTW faults are reported but with CLASS = TT.
791 * If TTBx is larger than the effective stage 1 output addres
792 * size, it reports C_BAD_CD, which is handled by the above case.
793 */
794 if (status != SMMU_TRANS_SUCCESS) {
795 return -EINVAL;
796 }
797 tt->ttb = CACHED_ENTRY_TO_ADDR(entry, tt->ttb);
798 }
799
800 tt->had = CD_HAD(cd, i);
801 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had);
802 }
803
804 cfg->record_faults = CD_R(cd);
805
806 return 0;
807
808 bad_cd:
809 event->type = SMMU_EVT_C_BAD_CD;
810 return ret;
811 }
812
813 /**
814 * smmuv3_decode_config - Prepare the translation configuration
815 * for the @mr iommu region
816 * @mr: iommu memory region the translation config must be prepared for
817 * @cfg: output translation configuration which is populated through
818 * the different configuration decoding steps
819 * @event: must be zero'ed by the caller
820 *
821 * return < 0 in case of config decoding error (@event is filled
822 * accordingly). Return 0 otherwise.
823 */
smmuv3_decode_config(IOMMUMemoryRegion * mr,SMMUTransCfg * cfg,SMMUEventInfo * event)824 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
825 SMMUEventInfo *event)
826 {
827 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
828 uint32_t sid = smmu_get_sid(sdev);
829 SMMUv3State *s = sdev->smmu;
830 int ret;
831 STE ste;
832 CD cd;
833
834 /* ASID defaults to -1 (if s1 is not supported). */
835 cfg->asid = -1;
836
837 ret = smmu_find_ste(s, sid, &ste, event);
838 if (ret) {
839 return ret;
840 }
841
842 ret = decode_ste(s, cfg, &ste, event);
843 if (ret) {
844 return ret;
845 }
846
847 if (cfg->aborted || cfg->bypassed || (cfg->stage == SMMU_STAGE_2)) {
848 return 0;
849 }
850
851 ret = smmu_get_cd(s, &ste, cfg, 0 /* ssid */, &cd, event);
852 if (ret) {
853 return ret;
854 }
855
856 return decode_cd(s, cfg, &cd, event);
857 }
858
859 /**
860 * smmuv3_get_config - Look up for a cached copy of configuration data for
861 * @sdev and on cache miss performs a configuration structure decoding from
862 * guest RAM.
863 *
864 * @sdev: SMMUDevice handle
865 * @event: output event info
866 *
867 * The configuration cache contains data resulting from both STE and CD
868 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed
869 * by the SMMUDevice handle.
870 */
smmuv3_get_config(SMMUDevice * sdev,SMMUEventInfo * event)871 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event)
872 {
873 SMMUv3State *s = sdev->smmu;
874 SMMUState *bc = &s->smmu_state;
875 SMMUTransCfg *cfg;
876
877 cfg = g_hash_table_lookup(bc->configs, sdev);
878 if (cfg) {
879 sdev->cfg_cache_hits++;
880 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev),
881 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
882 100 * sdev->cfg_cache_hits /
883 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
884 } else {
885 sdev->cfg_cache_misses++;
886 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev),
887 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
888 100 * sdev->cfg_cache_hits /
889 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
890 cfg = g_new0(SMMUTransCfg, 1);
891
892 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) {
893 g_hash_table_insert(bc->configs, sdev, cfg);
894 } else {
895 g_free(cfg);
896 cfg = NULL;
897 }
898 }
899 return cfg;
900 }
901
smmuv3_flush_config(SMMUDevice * sdev)902 static void smmuv3_flush_config(SMMUDevice *sdev)
903 {
904 SMMUv3State *s = sdev->smmu;
905 SMMUState *bc = &s->smmu_state;
906
907 trace_smmu_config_cache_inv(smmu_get_sid(sdev));
908 g_hash_table_remove(bc->configs, sdev);
909 }
910
911 /* Do translation with TLB lookup. */
smmuv3_do_translate(SMMUv3State * s,hwaddr addr,SMMUTransCfg * cfg,SMMUEventInfo * event,IOMMUAccessFlags flag,SMMUTLBEntry ** out_entry,SMMUTranslationClass class)912 static SMMUTranslationStatus smmuv3_do_translate(SMMUv3State *s, hwaddr addr,
913 SMMUTransCfg *cfg,
914 SMMUEventInfo *event,
915 IOMMUAccessFlags flag,
916 SMMUTLBEntry **out_entry,
917 SMMUTranslationClass class)
918 {
919 SMMUPTWEventInfo ptw_info = {};
920 SMMUState *bs = ARM_SMMU(s);
921 SMMUTLBEntry *cached_entry = NULL;
922 int asid, stage;
923 bool desc_s2_translation = class != SMMU_CLASS_IN;
924
925 /*
926 * The function uses the argument class to identify which stage is used:
927 * - CLASS = IN: Means an input translation, determine the stage from STE.
928 * - CLASS = CD: Means the addr is an IPA of the CD, and it would be
929 * translated using the stage-2.
930 * - CLASS = TT: Means the addr is an IPA of the stage-1 translation table
931 * and it would be translated using the stage-2.
932 * For the last 2 cases instead of having intrusive changes in the common
933 * logic, we modify the cfg to be a stage-2 translation only in case of
934 * nested, and then restore it after.
935 */
936 if (desc_s2_translation) {
937 asid = cfg->asid;
938 stage = cfg->stage;
939 cfg->asid = -1;
940 cfg->stage = SMMU_STAGE_2;
941 }
942
943 cached_entry = smmu_translate(bs, cfg, addr, flag, &ptw_info);
944
945 if (desc_s2_translation) {
946 cfg->asid = asid;
947 cfg->stage = stage;
948 }
949
950 if (!cached_entry) {
951 /* All faults from PTW has S2 field. */
952 event->u.f_walk_eabt.s2 = (ptw_info.stage == SMMU_STAGE_2);
953 /*
954 * Fault class is set as follows based on "class" input to
955 * the function and to "ptw_info" from "smmu_translate()"
956 * For stage-1:
957 * - EABT => CLASS_TT (hardcoded)
958 * - other events => CLASS_IN (input to function)
959 * For stage-2 => CLASS_IN (input to function)
960 * For nested, for all events:
961 * - CD fetch => CLASS_CD (input to function)
962 * - walking stage 1 translation table => CLASS_TT (from
963 * is_ipa_descriptor or input in case of TTBx)
964 * - s2 translation => CLASS_IN (input to function)
965 */
966 class = ptw_info.is_ipa_descriptor ? SMMU_CLASS_TT : class;
967 switch (ptw_info.type) {
968 case SMMU_PTW_ERR_WALK_EABT:
969 event->type = SMMU_EVT_F_WALK_EABT;
970 event->u.f_walk_eabt.rnw = flag & 0x1;
971 event->u.f_walk_eabt.class = (ptw_info.stage == SMMU_STAGE_2) ?
972 class : SMMU_CLASS_TT;
973 event->u.f_walk_eabt.addr2 = ptw_info.addr;
974 break;
975 case SMMU_PTW_ERR_TRANSLATION:
976 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
977 event->type = SMMU_EVT_F_TRANSLATION;
978 event->u.f_translation.addr2 = ptw_info.addr;
979 event->u.f_translation.class = class;
980 event->u.f_translation.rnw = flag & 0x1;
981 }
982 break;
983 case SMMU_PTW_ERR_ADDR_SIZE:
984 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
985 event->type = SMMU_EVT_F_ADDR_SIZE;
986 event->u.f_addr_size.addr2 = ptw_info.addr;
987 event->u.f_addr_size.class = class;
988 event->u.f_addr_size.rnw = flag & 0x1;
989 }
990 break;
991 case SMMU_PTW_ERR_ACCESS:
992 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
993 event->type = SMMU_EVT_F_ACCESS;
994 event->u.f_access.addr2 = ptw_info.addr;
995 event->u.f_access.class = class;
996 event->u.f_access.rnw = flag & 0x1;
997 }
998 break;
999 case SMMU_PTW_ERR_PERMISSION:
1000 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
1001 event->type = SMMU_EVT_F_PERMISSION;
1002 event->u.f_permission.addr2 = ptw_info.addr;
1003 event->u.f_permission.class = class;
1004 event->u.f_permission.rnw = flag & 0x1;
1005 }
1006 break;
1007 default:
1008 g_assert_not_reached();
1009 }
1010 return SMMU_TRANS_ERROR;
1011 }
1012 *out_entry = cached_entry;
1013 return SMMU_TRANS_SUCCESS;
1014 }
1015
1016 /*
1017 * Sets the InputAddr for an SMMU_TRANS_ERROR, as it can't be
1018 * set from all contexts, as smmuv3_get_config() can return
1019 * translation faults in case of nested translation (for CD
1020 * and TTBx). But in that case the iova is not known.
1021 */
smmuv3_fixup_event(SMMUEventInfo * event,hwaddr iova)1022 static void smmuv3_fixup_event(SMMUEventInfo *event, hwaddr iova)
1023 {
1024 switch (event->type) {
1025 case SMMU_EVT_F_WALK_EABT:
1026 case SMMU_EVT_F_TRANSLATION:
1027 case SMMU_EVT_F_ADDR_SIZE:
1028 case SMMU_EVT_F_ACCESS:
1029 case SMMU_EVT_F_PERMISSION:
1030 event->u.f_walk_eabt.addr = iova;
1031 break;
1032 default:
1033 break;
1034 }
1035 }
1036
1037 /* Entry point to SMMU, does everything. */
smmuv3_translate(IOMMUMemoryRegion * mr,hwaddr addr,IOMMUAccessFlags flag,int iommu_idx)1038 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
1039 IOMMUAccessFlags flag, int iommu_idx)
1040 {
1041 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
1042 SMMUv3State *s = sdev->smmu;
1043 uint32_t sid = smmu_get_sid(sdev);
1044 SMMUEventInfo event = {.type = SMMU_EVT_NONE,
1045 .sid = sid,
1046 .inval_ste_allowed = false};
1047 SMMUTranslationStatus status;
1048 SMMUTransCfg *cfg = NULL;
1049 IOMMUTLBEntry entry = {
1050 .target_as = &address_space_memory,
1051 .iova = addr,
1052 .translated_addr = addr,
1053 .addr_mask = ~(hwaddr)0,
1054 .perm = IOMMU_NONE,
1055 };
1056 SMMUTLBEntry *cached_entry = NULL;
1057
1058 qemu_mutex_lock(&s->mutex);
1059
1060 if (!smmu_enabled(s)) {
1061 if (FIELD_EX32(s->gbpa, GBPA, ABORT)) {
1062 status = SMMU_TRANS_ABORT;
1063 } else {
1064 status = SMMU_TRANS_DISABLE;
1065 }
1066 goto epilogue;
1067 }
1068
1069 cfg = smmuv3_get_config(sdev, &event);
1070 if (!cfg) {
1071 status = SMMU_TRANS_ERROR;
1072 goto epilogue;
1073 }
1074
1075 if (cfg->aborted) {
1076 status = SMMU_TRANS_ABORT;
1077 goto epilogue;
1078 }
1079
1080 if (cfg->bypassed) {
1081 status = SMMU_TRANS_BYPASS;
1082 goto epilogue;
1083 }
1084
1085 status = smmuv3_do_translate(s, addr, cfg, &event, flag,
1086 &cached_entry, SMMU_CLASS_IN);
1087
1088 epilogue:
1089 qemu_mutex_unlock(&s->mutex);
1090 switch (status) {
1091 case SMMU_TRANS_SUCCESS:
1092 entry.perm = cached_entry->entry.perm;
1093 entry.translated_addr = CACHED_ENTRY_TO_ADDR(cached_entry, addr);
1094 entry.addr_mask = cached_entry->entry.addr_mask;
1095 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr,
1096 entry.translated_addr, entry.perm,
1097 cfg->stage);
1098 break;
1099 case SMMU_TRANS_DISABLE:
1100 entry.perm = flag;
1101 entry.addr_mask = ~TARGET_PAGE_MASK;
1102 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr,
1103 entry.perm);
1104 break;
1105 case SMMU_TRANS_BYPASS:
1106 entry.perm = flag;
1107 entry.addr_mask = ~TARGET_PAGE_MASK;
1108 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr,
1109 entry.perm);
1110 break;
1111 case SMMU_TRANS_ABORT:
1112 /* no event is recorded on abort */
1113 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr,
1114 entry.perm);
1115 break;
1116 case SMMU_TRANS_ERROR:
1117 smmuv3_fixup_event(&event, addr);
1118 qemu_log_mask(LOG_GUEST_ERROR,
1119 "%s translation failed for iova=0x%"PRIx64" (%s)\n",
1120 mr->parent_obj.name, addr, smmu_event_string(event.type));
1121 smmuv3_record_event(s, &event);
1122 break;
1123 }
1124
1125 return entry;
1126 }
1127
1128 /**
1129 * smmuv3_notify_iova - call the notifier @n for a given
1130 * @asid and @iova tuple.
1131 *
1132 * @mr: IOMMU mr region handle
1133 * @n: notifier to be called
1134 * @asid: address space ID or negative value if we don't care
1135 * @vmid: virtual machine ID or negative value if we don't care
1136 * @iova: iova
1137 * @tg: translation granule (if communicated through range invalidation)
1138 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
1139 * @stage: Which stage(1 or 2) is used
1140 */
smmuv3_notify_iova(IOMMUMemoryRegion * mr,IOMMUNotifier * n,int asid,int vmid,dma_addr_t iova,uint8_t tg,uint64_t num_pages,int stage)1141 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
1142 IOMMUNotifier *n,
1143 int asid, int vmid,
1144 dma_addr_t iova, uint8_t tg,
1145 uint64_t num_pages, int stage)
1146 {
1147 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
1148 SMMUEventInfo eventinfo = {.inval_ste_allowed = true};
1149 SMMUTransCfg *cfg = smmuv3_get_config(sdev, &eventinfo);
1150 IOMMUTLBEvent event;
1151 uint8_t granule;
1152
1153 if (!cfg) {
1154 return;
1155 }
1156
1157 /*
1158 * stage is passed from TLB invalidation commands which can be either
1159 * stage-1 or stage-2.
1160 * However, IOMMUTLBEvent only understands IOVA, for stage-1 or stage-2
1161 * SMMU instances we consider the input address as the IOVA, but when
1162 * nesting is used, we can't mix stage-1 and stage-2 addresses, so for
1163 * nesting only stage-1 is considered the IOVA and would be notified.
1164 */
1165 if ((stage == SMMU_STAGE_2) && (cfg->stage == SMMU_NESTED))
1166 return;
1167
1168 if (!tg) {
1169 SMMUTransTableInfo *tt;
1170
1171 if (asid >= 0 && cfg->asid != asid) {
1172 return;
1173 }
1174
1175 if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
1176 return;
1177 }
1178
1179 if (stage == SMMU_STAGE_1) {
1180 tt = select_tt(cfg, iova);
1181 if (!tt) {
1182 return;
1183 }
1184 granule = tt->granule_sz;
1185 } else {
1186 granule = cfg->s2cfg.granule_sz;
1187 }
1188
1189 } else {
1190 granule = tg * 2 + 10;
1191 }
1192
1193 event.type = IOMMU_NOTIFIER_UNMAP;
1194 event.entry.target_as = &address_space_memory;
1195 event.entry.iova = iova;
1196 event.entry.addr_mask = num_pages * (1 << granule) - 1;
1197 event.entry.perm = IOMMU_NONE;
1198
1199 memory_region_notify_iommu_one(n, &event);
1200 }
1201
1202 /* invalidate an asid/vmid/iova range tuple in all mr's */
smmuv3_inv_notifiers_iova(SMMUState * s,int asid,int vmid,dma_addr_t iova,uint8_t tg,uint64_t num_pages,int stage)1203 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
1204 dma_addr_t iova, uint8_t tg,
1205 uint64_t num_pages, int stage)
1206 {
1207 SMMUDevice *sdev;
1208
1209 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
1210 IOMMUMemoryRegion *mr = &sdev->iommu;
1211 IOMMUNotifier *n;
1212
1213 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
1214 iova, tg, num_pages, stage);
1215
1216 IOMMU_NOTIFIER_FOREACH(n, mr) {
1217 smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages, stage);
1218 }
1219 }
1220 }
1221
smmuv3_range_inval(SMMUState * s,Cmd * cmd,SMMUStage stage)1222 static void smmuv3_range_inval(SMMUState *s, Cmd *cmd, SMMUStage stage)
1223 {
1224 dma_addr_t end, addr = CMD_ADDR(cmd);
1225 uint8_t type = CMD_TYPE(cmd);
1226 int vmid = -1;
1227 uint8_t scale = CMD_SCALE(cmd);
1228 uint8_t num = CMD_NUM(cmd);
1229 uint8_t ttl = CMD_TTL(cmd);
1230 bool leaf = CMD_LEAF(cmd);
1231 uint8_t tg = CMD_TG(cmd);
1232 uint64_t num_pages;
1233 uint8_t granule;
1234 int asid = -1;
1235 SMMUv3State *smmuv3 = ARM_SMMUV3(s);
1236
1237 /* Only consider VMID if stage-2 is supported. */
1238 if (STAGE2_SUPPORTED(smmuv3)) {
1239 vmid = CMD_VMID(cmd);
1240 }
1241
1242 if (type == SMMU_CMD_TLBI_NH_VA) {
1243 asid = CMD_ASID(cmd);
1244 }
1245
1246 if (!tg) {
1247 trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf, stage);
1248 smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1, stage);
1249 if (stage == SMMU_STAGE_1) {
1250 smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
1251 } else {
1252 smmu_iotlb_inv_ipa(s, vmid, addr, tg, 1, ttl);
1253 }
1254 return;
1255 }
1256
1257 /* RIL in use */
1258
1259 num_pages = (num + 1) * BIT_ULL(scale);
1260 granule = tg * 2 + 10;
1261
1262 /* Split invalidations into ^2 range invalidations */
1263 end = addr + (num_pages << granule) - 1;
1264
1265 while (addr != end + 1) {
1266 uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
1267
1268 num_pages = (mask + 1) >> granule;
1269 trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages,
1270 ttl, leaf, stage);
1271 smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages, stage);
1272 if (stage == SMMU_STAGE_1) {
1273 smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
1274 } else {
1275 smmu_iotlb_inv_ipa(s, vmid, addr, tg, num_pages, ttl);
1276 }
1277 addr += mask + 1;
1278 }
1279 }
1280
smmuv3_cmdq_consume(SMMUv3State * s)1281 static int smmuv3_cmdq_consume(SMMUv3State *s)
1282 {
1283 SMMUState *bs = ARM_SMMU(s);
1284 SMMUCmdError cmd_error = SMMU_CERROR_NONE;
1285 SMMUQueue *q = &s->cmdq;
1286 SMMUCommandType type = 0;
1287
1288 if (!smmuv3_cmdq_enabled(s)) {
1289 return 0;
1290 }
1291 /*
1292 * some commands depend on register values, typically CR0. In case those
1293 * register values change while handling the command, spec says it
1294 * is UNPREDICTABLE whether the command is interpreted under the new
1295 * or old value.
1296 */
1297
1298 while (!smmuv3_q_empty(q)) {
1299 uint32_t pending = s->gerror ^ s->gerrorn;
1300 Cmd cmd;
1301
1302 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
1303 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1304
1305 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
1306 break;
1307 }
1308
1309 if (queue_read(q, &cmd) != MEMTX_OK) {
1310 cmd_error = SMMU_CERROR_ABT;
1311 break;
1312 }
1313
1314 type = CMD_TYPE(&cmd);
1315
1316 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
1317
1318 qemu_mutex_lock(&s->mutex);
1319 switch (type) {
1320 case SMMU_CMD_SYNC:
1321 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
1322 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
1323 }
1324 break;
1325 case SMMU_CMD_PREFETCH_CONFIG:
1326 case SMMU_CMD_PREFETCH_ADDR:
1327 break;
1328 case SMMU_CMD_CFGI_STE:
1329 {
1330 uint32_t sid = CMD_SID(&cmd);
1331 SMMUDevice *sdev = smmu_find_sdev(bs, sid);
1332
1333 if (CMD_SSEC(&cmd)) {
1334 cmd_error = SMMU_CERROR_ILL;
1335 break;
1336 }
1337
1338 if (!sdev) {
1339 break;
1340 }
1341
1342 trace_smmuv3_cmdq_cfgi_ste(sid);
1343 smmuv3_flush_config(sdev);
1344
1345 break;
1346 }
1347 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
1348 {
1349 uint32_t sid = CMD_SID(&cmd), mask;
1350 uint8_t range = CMD_STE_RANGE(&cmd);
1351 SMMUSIDRange sid_range;
1352
1353 if (CMD_SSEC(&cmd)) {
1354 cmd_error = SMMU_CERROR_ILL;
1355 break;
1356 }
1357
1358 mask = (1ULL << (range + 1)) - 1;
1359 sid_range.start = sid & ~mask;
1360 sid_range.end = sid_range.start + mask;
1361
1362 trace_smmuv3_cmdq_cfgi_ste_range(sid_range.start, sid_range.end);
1363 smmu_configs_inv_sid_range(bs, sid_range);
1364 break;
1365 }
1366 case SMMU_CMD_CFGI_CD:
1367 case SMMU_CMD_CFGI_CD_ALL:
1368 {
1369 uint32_t sid = CMD_SID(&cmd);
1370 SMMUDevice *sdev = smmu_find_sdev(bs, sid);
1371
1372 if (CMD_SSEC(&cmd)) {
1373 cmd_error = SMMU_CERROR_ILL;
1374 break;
1375 }
1376
1377 if (!sdev) {
1378 break;
1379 }
1380
1381 trace_smmuv3_cmdq_cfgi_cd(sid);
1382 smmuv3_flush_config(sdev);
1383 break;
1384 }
1385 case SMMU_CMD_TLBI_NH_ASID:
1386 {
1387 int asid = CMD_ASID(&cmd);
1388 int vmid = -1;
1389
1390 if (!STAGE1_SUPPORTED(s)) {
1391 cmd_error = SMMU_CERROR_ILL;
1392 break;
1393 }
1394
1395 /*
1396 * VMID is only matched when stage 2 is supported, otherwise set it
1397 * to -1 as the value used for stage-1 only VMIDs.
1398 */
1399 if (STAGE2_SUPPORTED(s)) {
1400 vmid = CMD_VMID(&cmd);
1401 }
1402
1403 trace_smmuv3_cmdq_tlbi_nh_asid(asid);
1404 smmu_inv_notifiers_all(&s->smmu_state);
1405 smmu_iotlb_inv_asid_vmid(bs, asid, vmid);
1406 break;
1407 }
1408 case SMMU_CMD_TLBI_NH_ALL:
1409 {
1410 int vmid = -1;
1411
1412 if (!STAGE1_SUPPORTED(s)) {
1413 cmd_error = SMMU_CERROR_ILL;
1414 break;
1415 }
1416
1417 /*
1418 * If stage-2 is supported, invalidate for this VMID only, otherwise
1419 * invalidate the whole thing.
1420 */
1421 if (STAGE2_SUPPORTED(s)) {
1422 vmid = CMD_VMID(&cmd);
1423 trace_smmuv3_cmdq_tlbi_nh(vmid);
1424 smmu_iotlb_inv_vmid_s1(bs, vmid);
1425 break;
1426 }
1427 QEMU_FALLTHROUGH;
1428 }
1429 case SMMU_CMD_TLBI_NSNH_ALL:
1430 trace_smmuv3_cmdq_tlbi_nsnh();
1431 smmu_inv_notifiers_all(&s->smmu_state);
1432 smmu_iotlb_inv_all(bs);
1433 break;
1434 case SMMU_CMD_TLBI_NH_VAA:
1435 case SMMU_CMD_TLBI_NH_VA:
1436 if (!STAGE1_SUPPORTED(s)) {
1437 cmd_error = SMMU_CERROR_ILL;
1438 break;
1439 }
1440 smmuv3_range_inval(bs, &cmd, SMMU_STAGE_1);
1441 break;
1442 case SMMU_CMD_TLBI_S12_VMALL:
1443 {
1444 int vmid = CMD_VMID(&cmd);
1445
1446 if (!STAGE2_SUPPORTED(s)) {
1447 cmd_error = SMMU_CERROR_ILL;
1448 break;
1449 }
1450
1451 trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
1452 smmu_inv_notifiers_all(&s->smmu_state);
1453 smmu_iotlb_inv_vmid(bs, vmid);
1454 break;
1455 }
1456 case SMMU_CMD_TLBI_S2_IPA:
1457 if (!STAGE2_SUPPORTED(s)) {
1458 cmd_error = SMMU_CERROR_ILL;
1459 break;
1460 }
1461 /*
1462 * As currently only either s1 or s2 are supported
1463 * we can reuse same function for s2.
1464 */
1465 smmuv3_range_inval(bs, &cmd, SMMU_STAGE_2);
1466 break;
1467 case SMMU_CMD_TLBI_EL3_ALL:
1468 case SMMU_CMD_TLBI_EL3_VA:
1469 case SMMU_CMD_TLBI_EL2_ALL:
1470 case SMMU_CMD_TLBI_EL2_ASID:
1471 case SMMU_CMD_TLBI_EL2_VA:
1472 case SMMU_CMD_TLBI_EL2_VAA:
1473 case SMMU_CMD_ATC_INV:
1474 case SMMU_CMD_PRI_RESP:
1475 case SMMU_CMD_RESUME:
1476 case SMMU_CMD_STALL_TERM:
1477 trace_smmuv3_unhandled_cmd(type);
1478 break;
1479 default:
1480 cmd_error = SMMU_CERROR_ILL;
1481 break;
1482 }
1483 qemu_mutex_unlock(&s->mutex);
1484 if (cmd_error) {
1485 if (cmd_error == SMMU_CERROR_ILL) {
1486 qemu_log_mask(LOG_GUEST_ERROR,
1487 "Illegal command type: %d\n", CMD_TYPE(&cmd));
1488 }
1489 break;
1490 }
1491 /*
1492 * We only increment the cons index after the completion of
1493 * the command. We do that because the SYNC returns immediately
1494 * and does not check the completion of previous commands
1495 */
1496 queue_cons_incr(q);
1497 }
1498
1499 if (cmd_error) {
1500 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
1501 smmu_write_cmdq_err(s, cmd_error);
1502 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
1503 }
1504
1505 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
1506 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1507
1508 return 0;
1509 }
1510
smmu_writell(SMMUv3State * s,hwaddr offset,uint64_t data,MemTxAttrs attrs)1511 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
1512 uint64_t data, MemTxAttrs attrs)
1513 {
1514 switch (offset) {
1515 case A_GERROR_IRQ_CFG0:
1516 s->gerror_irq_cfg0 = data;
1517 return MEMTX_OK;
1518 case A_STRTAB_BASE:
1519 s->strtab_base = data;
1520 return MEMTX_OK;
1521 case A_CMDQ_BASE:
1522 s->cmdq.base = data;
1523 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1524 if (s->cmdq.log2size > SMMU_CMDQS) {
1525 s->cmdq.log2size = SMMU_CMDQS;
1526 }
1527 return MEMTX_OK;
1528 case A_EVENTQ_BASE:
1529 s->eventq.base = data;
1530 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1531 if (s->eventq.log2size > SMMU_EVENTQS) {
1532 s->eventq.log2size = SMMU_EVENTQS;
1533 }
1534 return MEMTX_OK;
1535 case A_EVENTQ_IRQ_CFG0:
1536 s->eventq_irq_cfg0 = data;
1537 return MEMTX_OK;
1538 default:
1539 qemu_log_mask(LOG_UNIMP,
1540 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
1541 __func__, offset);
1542 return MEMTX_OK;
1543 }
1544 }
1545
smmu_writel(SMMUv3State * s,hwaddr offset,uint64_t data,MemTxAttrs attrs)1546 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
1547 uint64_t data, MemTxAttrs attrs)
1548 {
1549 switch (offset) {
1550 case A_CR0:
1551 s->cr[0] = data;
1552 s->cr0ack = data & ~SMMU_CR0_RESERVED;
1553 /* in case the command queue has been enabled */
1554 smmuv3_cmdq_consume(s);
1555 return MEMTX_OK;
1556 case A_CR1:
1557 s->cr[1] = data;
1558 return MEMTX_OK;
1559 case A_CR2:
1560 s->cr[2] = data;
1561 return MEMTX_OK;
1562 case A_IRQ_CTRL:
1563 s->irq_ctrl = data;
1564 return MEMTX_OK;
1565 case A_GERRORN:
1566 smmuv3_write_gerrorn(s, data);
1567 /*
1568 * By acknowledging the CMDQ_ERR, SW may notify cmds can
1569 * be processed again
1570 */
1571 smmuv3_cmdq_consume(s);
1572 return MEMTX_OK;
1573 case A_GERROR_IRQ_CFG0: /* 64b */
1574 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
1575 return MEMTX_OK;
1576 case A_GERROR_IRQ_CFG0 + 4:
1577 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
1578 return MEMTX_OK;
1579 case A_GERROR_IRQ_CFG1:
1580 s->gerror_irq_cfg1 = data;
1581 return MEMTX_OK;
1582 case A_GERROR_IRQ_CFG2:
1583 s->gerror_irq_cfg2 = data;
1584 return MEMTX_OK;
1585 case A_GBPA:
1586 /*
1587 * If UPDATE is not set, the write is ignored. This is the only
1588 * permitted behavior in SMMUv3.2 and later.
1589 */
1590 if (data & R_GBPA_UPDATE_MASK) {
1591 /* Ignore update bit as write is synchronous. */
1592 s->gbpa = data & ~R_GBPA_UPDATE_MASK;
1593 }
1594 return MEMTX_OK;
1595 case A_STRTAB_BASE: /* 64b */
1596 s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
1597 return MEMTX_OK;
1598 case A_STRTAB_BASE + 4:
1599 s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
1600 return MEMTX_OK;
1601 case A_STRTAB_BASE_CFG:
1602 s->strtab_base_cfg = data;
1603 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
1604 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
1605 s->features |= SMMU_FEATURE_2LVL_STE;
1606 }
1607 return MEMTX_OK;
1608 case A_CMDQ_BASE: /* 64b */
1609 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
1610 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1611 if (s->cmdq.log2size > SMMU_CMDQS) {
1612 s->cmdq.log2size = SMMU_CMDQS;
1613 }
1614 return MEMTX_OK;
1615 case A_CMDQ_BASE + 4: /* 64b */
1616 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
1617 return MEMTX_OK;
1618 case A_CMDQ_PROD:
1619 s->cmdq.prod = data;
1620 smmuv3_cmdq_consume(s);
1621 return MEMTX_OK;
1622 case A_CMDQ_CONS:
1623 s->cmdq.cons = data;
1624 return MEMTX_OK;
1625 case A_EVENTQ_BASE: /* 64b */
1626 s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
1627 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1628 if (s->eventq.log2size > SMMU_EVENTQS) {
1629 s->eventq.log2size = SMMU_EVENTQS;
1630 }
1631 return MEMTX_OK;
1632 case A_EVENTQ_BASE + 4:
1633 s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
1634 return MEMTX_OK;
1635 case A_EVENTQ_PROD:
1636 s->eventq.prod = data;
1637 return MEMTX_OK;
1638 case A_EVENTQ_CONS:
1639 s->eventq.cons = data;
1640 return MEMTX_OK;
1641 case A_EVENTQ_IRQ_CFG0: /* 64b */
1642 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
1643 return MEMTX_OK;
1644 case A_EVENTQ_IRQ_CFG0 + 4:
1645 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
1646 return MEMTX_OK;
1647 case A_EVENTQ_IRQ_CFG1:
1648 s->eventq_irq_cfg1 = data;
1649 return MEMTX_OK;
1650 case A_EVENTQ_IRQ_CFG2:
1651 s->eventq_irq_cfg2 = data;
1652 return MEMTX_OK;
1653 default:
1654 qemu_log_mask(LOG_UNIMP,
1655 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
1656 __func__, offset);
1657 return MEMTX_OK;
1658 }
1659 }
1660
smmu_write_mmio(void * opaque,hwaddr offset,uint64_t data,unsigned size,MemTxAttrs attrs)1661 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
1662 unsigned size, MemTxAttrs attrs)
1663 {
1664 SMMUState *sys = opaque;
1665 SMMUv3State *s = ARM_SMMUV3(sys);
1666 MemTxResult r;
1667
1668 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1669 offset &= ~0x10000;
1670
1671 switch (size) {
1672 case 8:
1673 r = smmu_writell(s, offset, data, attrs);
1674 break;
1675 case 4:
1676 r = smmu_writel(s, offset, data, attrs);
1677 break;
1678 default:
1679 r = MEMTX_ERROR;
1680 break;
1681 }
1682
1683 trace_smmuv3_write_mmio(offset, data, size, r);
1684 return r;
1685 }
1686
smmu_readll(SMMUv3State * s,hwaddr offset,uint64_t * data,MemTxAttrs attrs)1687 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
1688 uint64_t *data, MemTxAttrs attrs)
1689 {
1690 switch (offset) {
1691 case A_GERROR_IRQ_CFG0:
1692 *data = s->gerror_irq_cfg0;
1693 return MEMTX_OK;
1694 case A_STRTAB_BASE:
1695 *data = s->strtab_base;
1696 return MEMTX_OK;
1697 case A_CMDQ_BASE:
1698 *data = s->cmdq.base;
1699 return MEMTX_OK;
1700 case A_EVENTQ_BASE:
1701 *data = s->eventq.base;
1702 return MEMTX_OK;
1703 default:
1704 *data = 0;
1705 qemu_log_mask(LOG_UNIMP,
1706 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
1707 __func__, offset);
1708 return MEMTX_OK;
1709 }
1710 }
1711
smmu_readl(SMMUv3State * s,hwaddr offset,uint64_t * data,MemTxAttrs attrs)1712 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
1713 uint64_t *data, MemTxAttrs attrs)
1714 {
1715 switch (offset) {
1716 case A_IDREGS ... A_IDREGS + 0x2f:
1717 *data = smmuv3_idreg(offset - A_IDREGS);
1718 return MEMTX_OK;
1719 case A_IDR0 ... A_IDR5:
1720 *data = s->idr[(offset - A_IDR0) / 4];
1721 return MEMTX_OK;
1722 case A_IIDR:
1723 *data = s->iidr;
1724 return MEMTX_OK;
1725 case A_AIDR:
1726 *data = s->aidr;
1727 return MEMTX_OK;
1728 case A_CR0:
1729 *data = s->cr[0];
1730 return MEMTX_OK;
1731 case A_CR0ACK:
1732 *data = s->cr0ack;
1733 return MEMTX_OK;
1734 case A_CR1:
1735 *data = s->cr[1];
1736 return MEMTX_OK;
1737 case A_CR2:
1738 *data = s->cr[2];
1739 return MEMTX_OK;
1740 case A_STATUSR:
1741 *data = s->statusr;
1742 return MEMTX_OK;
1743 case A_GBPA:
1744 *data = s->gbpa;
1745 return MEMTX_OK;
1746 case A_IRQ_CTRL:
1747 case A_IRQ_CTRL_ACK:
1748 *data = s->irq_ctrl;
1749 return MEMTX_OK;
1750 case A_GERROR:
1751 *data = s->gerror;
1752 return MEMTX_OK;
1753 case A_GERRORN:
1754 *data = s->gerrorn;
1755 return MEMTX_OK;
1756 case A_GERROR_IRQ_CFG0: /* 64b */
1757 *data = extract64(s->gerror_irq_cfg0, 0, 32);
1758 return MEMTX_OK;
1759 case A_GERROR_IRQ_CFG0 + 4:
1760 *data = extract64(s->gerror_irq_cfg0, 32, 32);
1761 return MEMTX_OK;
1762 case A_GERROR_IRQ_CFG1:
1763 *data = s->gerror_irq_cfg1;
1764 return MEMTX_OK;
1765 case A_GERROR_IRQ_CFG2:
1766 *data = s->gerror_irq_cfg2;
1767 return MEMTX_OK;
1768 case A_STRTAB_BASE: /* 64b */
1769 *data = extract64(s->strtab_base, 0, 32);
1770 return MEMTX_OK;
1771 case A_STRTAB_BASE + 4: /* 64b */
1772 *data = extract64(s->strtab_base, 32, 32);
1773 return MEMTX_OK;
1774 case A_STRTAB_BASE_CFG:
1775 *data = s->strtab_base_cfg;
1776 return MEMTX_OK;
1777 case A_CMDQ_BASE: /* 64b */
1778 *data = extract64(s->cmdq.base, 0, 32);
1779 return MEMTX_OK;
1780 case A_CMDQ_BASE + 4:
1781 *data = extract64(s->cmdq.base, 32, 32);
1782 return MEMTX_OK;
1783 case A_CMDQ_PROD:
1784 *data = s->cmdq.prod;
1785 return MEMTX_OK;
1786 case A_CMDQ_CONS:
1787 *data = s->cmdq.cons;
1788 return MEMTX_OK;
1789 case A_EVENTQ_BASE: /* 64b */
1790 *data = extract64(s->eventq.base, 0, 32);
1791 return MEMTX_OK;
1792 case A_EVENTQ_BASE + 4: /* 64b */
1793 *data = extract64(s->eventq.base, 32, 32);
1794 return MEMTX_OK;
1795 case A_EVENTQ_PROD:
1796 *data = s->eventq.prod;
1797 return MEMTX_OK;
1798 case A_EVENTQ_CONS:
1799 *data = s->eventq.cons;
1800 return MEMTX_OK;
1801 default:
1802 *data = 0;
1803 qemu_log_mask(LOG_UNIMP,
1804 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
1805 __func__, offset);
1806 return MEMTX_OK;
1807 }
1808 }
1809
smmu_read_mmio(void * opaque,hwaddr offset,uint64_t * data,unsigned size,MemTxAttrs attrs)1810 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
1811 unsigned size, MemTxAttrs attrs)
1812 {
1813 SMMUState *sys = opaque;
1814 SMMUv3State *s = ARM_SMMUV3(sys);
1815 MemTxResult r;
1816
1817 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1818 offset &= ~0x10000;
1819
1820 switch (size) {
1821 case 8:
1822 r = smmu_readll(s, offset, data, attrs);
1823 break;
1824 case 4:
1825 r = smmu_readl(s, offset, data, attrs);
1826 break;
1827 default:
1828 r = MEMTX_ERROR;
1829 break;
1830 }
1831
1832 trace_smmuv3_read_mmio(offset, *data, size, r);
1833 return r;
1834 }
1835
1836 static const MemoryRegionOps smmu_mem_ops = {
1837 .read_with_attrs = smmu_read_mmio,
1838 .write_with_attrs = smmu_write_mmio,
1839 .endianness = DEVICE_LITTLE_ENDIAN,
1840 .valid = {
1841 .min_access_size = 4,
1842 .max_access_size = 8,
1843 },
1844 .impl = {
1845 .min_access_size = 4,
1846 .max_access_size = 8,
1847 },
1848 };
1849
smmu_init_irq(SMMUv3State * s,SysBusDevice * dev)1850 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
1851 {
1852 int i;
1853
1854 for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
1855 sysbus_init_irq(dev, &s->irq[i]);
1856 }
1857 }
1858
1859 /*
1860 * Make sure the IOMMU is reset in 'exit' phase after
1861 * all outstanding DMA requests have been quiesced during
1862 * the 'enter' or 'hold' reset phases
1863 */
smmu_reset_exit(Object * obj,ResetType type)1864 static void smmu_reset_exit(Object *obj, ResetType type)
1865 {
1866 SMMUv3State *s = ARM_SMMUV3(obj);
1867 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1868
1869 trace_smmu_reset_exit();
1870 if (c->parent_phases.exit) {
1871 c->parent_phases.exit(obj, type);
1872 }
1873
1874 smmuv3_init_regs(s);
1875 }
1876
smmu_realize(DeviceState * d,Error ** errp)1877 static void smmu_realize(DeviceState *d, Error **errp)
1878 {
1879 SMMUState *sys = ARM_SMMU(d);
1880 SMMUv3State *s = ARM_SMMUV3(sys);
1881 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1882 SysBusDevice *dev = SYS_BUS_DEVICE(d);
1883 Error *local_err = NULL;
1884
1885 c->parent_realize(d, &local_err);
1886 if (local_err) {
1887 error_propagate(errp, local_err);
1888 return;
1889 }
1890
1891 qemu_mutex_init(&s->mutex);
1892
1893 memory_region_init_io(&sys->iomem, OBJECT(s),
1894 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
1895
1896 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
1897
1898 sysbus_init_mmio(dev, &sys->iomem);
1899
1900 smmu_init_irq(s, dev);
1901 }
1902
1903 static const VMStateDescription vmstate_smmuv3_queue = {
1904 .name = "smmuv3_queue",
1905 .version_id = 1,
1906 .minimum_version_id = 1,
1907 .fields = (const VMStateField[]) {
1908 VMSTATE_UINT64(base, SMMUQueue),
1909 VMSTATE_UINT32(prod, SMMUQueue),
1910 VMSTATE_UINT32(cons, SMMUQueue),
1911 VMSTATE_UINT8(log2size, SMMUQueue),
1912 VMSTATE_END_OF_LIST(),
1913 },
1914 };
1915
smmuv3_gbpa_needed(void * opaque)1916 static bool smmuv3_gbpa_needed(void *opaque)
1917 {
1918 SMMUv3State *s = opaque;
1919
1920 /* Only migrate GBPA if it has different reset value. */
1921 return s->gbpa != SMMU_GBPA_RESET_VAL;
1922 }
1923
1924 static const VMStateDescription vmstate_gbpa = {
1925 .name = "smmuv3/gbpa",
1926 .version_id = 1,
1927 .minimum_version_id = 1,
1928 .needed = smmuv3_gbpa_needed,
1929 .fields = (const VMStateField[]) {
1930 VMSTATE_UINT32(gbpa, SMMUv3State),
1931 VMSTATE_END_OF_LIST()
1932 }
1933 };
1934
1935 static const VMStateDescription vmstate_smmuv3 = {
1936 .name = "smmuv3",
1937 .version_id = 1,
1938 .minimum_version_id = 1,
1939 .priority = MIG_PRI_IOMMU,
1940 .fields = (const VMStateField[]) {
1941 VMSTATE_UINT32(features, SMMUv3State),
1942 VMSTATE_UINT8(sid_size, SMMUv3State),
1943 VMSTATE_UINT8(sid_split, SMMUv3State),
1944
1945 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
1946 VMSTATE_UINT32(cr0ack, SMMUv3State),
1947 VMSTATE_UINT32(statusr, SMMUv3State),
1948 VMSTATE_UINT32(irq_ctrl, SMMUv3State),
1949 VMSTATE_UINT32(gerror, SMMUv3State),
1950 VMSTATE_UINT32(gerrorn, SMMUv3State),
1951 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
1952 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
1953 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
1954 VMSTATE_UINT64(strtab_base, SMMUv3State),
1955 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
1956 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
1957 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
1958 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
1959
1960 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1961 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1962
1963 VMSTATE_END_OF_LIST(),
1964 },
1965 .subsections = (const VMStateDescription * const []) {
1966 &vmstate_gbpa,
1967 NULL
1968 }
1969 };
1970
1971 static const Property smmuv3_properties[] = {
1972 /*
1973 * Stages of translation advertised.
1974 * "1": Stage 1
1975 * "2": Stage 2
1976 * "nested": Both stage 1 and stage 2
1977 * Defaults to stage 1
1978 */
1979 DEFINE_PROP_STRING("stage", SMMUv3State, stage),
1980 };
1981
smmuv3_instance_init(Object * obj)1982 static void smmuv3_instance_init(Object *obj)
1983 {
1984 /* Nothing much to do here as of now */
1985 }
1986
smmuv3_class_init(ObjectClass * klass,const void * data)1987 static void smmuv3_class_init(ObjectClass *klass, const void *data)
1988 {
1989 DeviceClass *dc = DEVICE_CLASS(klass);
1990 ResettableClass *rc = RESETTABLE_CLASS(klass);
1991 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
1992
1993 dc->vmsd = &vmstate_smmuv3;
1994 resettable_class_set_parent_phases(rc, NULL, NULL, smmu_reset_exit,
1995 &c->parent_phases);
1996 device_class_set_parent_realize(dc, smmu_realize,
1997 &c->parent_realize);
1998 device_class_set_props(dc, smmuv3_properties);
1999 }
2000
smmuv3_notify_flag_changed(IOMMUMemoryRegion * iommu,IOMMUNotifierFlag old,IOMMUNotifierFlag new,Error ** errp)2001 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
2002 IOMMUNotifierFlag old,
2003 IOMMUNotifierFlag new,
2004 Error **errp)
2005 {
2006 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu);
2007 SMMUv3State *s3 = sdev->smmu;
2008 SMMUState *s = &(s3->smmu_state);
2009
2010 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
2011 error_setg(errp, "SMMUv3 does not support dev-iotlb yet");
2012 return -EINVAL;
2013 }
2014
2015 if (new & IOMMU_NOTIFIER_MAP) {
2016 error_setg(errp,
2017 "device %02x.%02x.%x requires iommu MAP notifier which is "
2018 "not currently supported", pci_bus_num(sdev->bus),
2019 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn));
2020 return -EINVAL;
2021 }
2022
2023 if (old == IOMMU_NOTIFIER_NONE) {
2024 trace_smmuv3_notify_flag_add(iommu->parent_obj.name);
2025 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next);
2026 } else if (new == IOMMU_NOTIFIER_NONE) {
2027 trace_smmuv3_notify_flag_del(iommu->parent_obj.name);
2028 QLIST_REMOVE(sdev, next);
2029 }
2030 return 0;
2031 }
2032
smmuv3_iommu_memory_region_class_init(ObjectClass * klass,const void * data)2033 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
2034 const void *data)
2035 {
2036 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
2037
2038 imrc->translate = smmuv3_translate;
2039 imrc->notify_flag_changed = smmuv3_notify_flag_changed;
2040 }
2041
2042 static const TypeInfo smmuv3_type_info = {
2043 .name = TYPE_ARM_SMMUV3,
2044 .parent = TYPE_ARM_SMMU,
2045 .instance_size = sizeof(SMMUv3State),
2046 .instance_init = smmuv3_instance_init,
2047 .class_size = sizeof(SMMUv3Class),
2048 .class_init = smmuv3_class_init,
2049 };
2050
2051 static const TypeInfo smmuv3_iommu_memory_region_info = {
2052 .parent = TYPE_IOMMU_MEMORY_REGION,
2053 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
2054 .class_init = smmuv3_iommu_memory_region_class_init,
2055 };
2056
smmuv3_register_types(void)2057 static void smmuv3_register_types(void)
2058 {
2059 type_register_static(&smmuv3_type_info);
2060 type_register_static(&smmuv3_iommu_memory_region_info);
2061 }
2062
2063 type_init(smmuv3_register_types)
2064
2065