1 /* 2 * Copyright (C) 2014-2016 Broadcom Corporation 3 * Copyright (c) 2017 Red Hat, Inc. 4 * Written by Prem Mallappa, Eric Auger 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License along 16 * with this program; if not, see <http://www.gnu.org/licenses/>. 17 */ 18 19 #include "qemu/osdep.h" 20 #include "qemu/bitops.h" 21 #include "hw/irq.h" 22 #include "hw/sysbus.h" 23 #include "migration/vmstate.h" 24 #include "hw/qdev-properties.h" 25 #include "hw/qdev-core.h" 26 #include "hw/pci/pci.h" 27 #include "cpu.h" 28 #include "exec/target_page.h" 29 #include "trace.h" 30 #include "qemu/log.h" 31 #include "qemu/error-report.h" 32 #include "qapi/error.h" 33 34 #include "hw/arm/smmuv3.h" 35 #include "smmuv3-internal.h" 36 #include "smmu-internal.h" 37 38 #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \ 39 (cfg)->record_faults) || \ 40 ((ptw_info).stage == SMMU_STAGE_2 && \ 41 (cfg)->s2cfg.record_faults)) 42 43 /** 44 * smmuv3_trigger_irq - pulse @irq if enabled and update 45 * GERROR register in case of GERROR interrupt 46 * 47 * @irq: irq type 48 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR) 49 */ 50 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, 51 uint32_t gerror_mask) 52 { 53 54 bool pulse = false; 55 56 switch (irq) { 57 case SMMU_IRQ_EVTQ: 58 pulse = smmuv3_eventq_irq_enabled(s); 59 break; 60 case SMMU_IRQ_PRIQ: 61 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n"); 62 break; 63 case SMMU_IRQ_CMD_SYNC: 64 pulse = true; 65 break; 66 case SMMU_IRQ_GERROR: 67 { 68 uint32_t pending = s->gerror ^ s->gerrorn; 69 uint32_t new_gerrors = ~pending & gerror_mask; 70 71 if (!new_gerrors) { 72 /* only toggle non pending errors */ 73 return; 74 } 75 s->gerror ^= new_gerrors; 76 trace_smmuv3_write_gerror(new_gerrors, s->gerror); 77 78 pulse = smmuv3_gerror_irq_enabled(s); 79 break; 80 } 81 } 82 if (pulse) { 83 trace_smmuv3_trigger_irq(irq); 84 qemu_irq_pulse(s->irq[irq]); 85 } 86 } 87 88 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn) 89 { 90 uint32_t pending = s->gerror ^ s->gerrorn; 91 uint32_t toggled = s->gerrorn ^ new_gerrorn; 92 93 if (toggled & ~pending) { 94 qemu_log_mask(LOG_GUEST_ERROR, 95 "guest toggles non pending errors = 0x%x\n", 96 toggled & ~pending); 97 } 98 99 /* 100 * We do not raise any error in case guest toggles bits corresponding 101 * to not active IRQs (CONSTRAINED UNPREDICTABLE) 102 */ 103 s->gerrorn = new_gerrorn; 104 105 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn); 106 } 107 108 static inline MemTxResult queue_read(SMMUQueue *q, Cmd *cmd) 109 { 110 dma_addr_t addr = Q_CONS_ENTRY(q); 111 MemTxResult ret; 112 int i; 113 114 ret = dma_memory_read(&address_space_memory, addr, cmd, sizeof(Cmd), 115 MEMTXATTRS_UNSPECIFIED); 116 if (ret != MEMTX_OK) { 117 return ret; 118 } 119 for (i = 0; i < ARRAY_SIZE(cmd->word); i++) { 120 le32_to_cpus(&cmd->word[i]); 121 } 122 return ret; 123 } 124 125 static MemTxResult queue_write(SMMUQueue *q, Evt *evt_in) 126 { 127 dma_addr_t addr = Q_PROD_ENTRY(q); 128 MemTxResult ret; 129 Evt evt = *evt_in; 130 int i; 131 132 for (i = 0; i < ARRAY_SIZE(evt.word); i++) { 133 cpu_to_le32s(&evt.word[i]); 134 } 135 ret = dma_memory_write(&address_space_memory, addr, &evt, sizeof(Evt), 136 MEMTXATTRS_UNSPECIFIED); 137 if (ret != MEMTX_OK) { 138 return ret; 139 } 140 141 queue_prod_incr(q); 142 return MEMTX_OK; 143 } 144 145 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt) 146 { 147 SMMUQueue *q = &s->eventq; 148 MemTxResult r; 149 150 if (!smmuv3_eventq_enabled(s)) { 151 return MEMTX_ERROR; 152 } 153 154 if (smmuv3_q_full(q)) { 155 return MEMTX_ERROR; 156 } 157 158 r = queue_write(q, evt); 159 if (r != MEMTX_OK) { 160 return r; 161 } 162 163 if (!smmuv3_q_empty(q)) { 164 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0); 165 } 166 return MEMTX_OK; 167 } 168 169 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info) 170 { 171 Evt evt = {}; 172 MemTxResult r; 173 174 if (!smmuv3_eventq_enabled(s)) { 175 return; 176 } 177 178 EVT_SET_TYPE(&evt, info->type); 179 EVT_SET_SID(&evt, info->sid); 180 181 switch (info->type) { 182 case SMMU_EVT_NONE: 183 return; 184 case SMMU_EVT_F_UUT: 185 EVT_SET_SSID(&evt, info->u.f_uut.ssid); 186 EVT_SET_SSV(&evt, info->u.f_uut.ssv); 187 EVT_SET_ADDR(&evt, info->u.f_uut.addr); 188 EVT_SET_RNW(&evt, info->u.f_uut.rnw); 189 EVT_SET_PNU(&evt, info->u.f_uut.pnu); 190 EVT_SET_IND(&evt, info->u.f_uut.ind); 191 break; 192 case SMMU_EVT_C_BAD_STREAMID: 193 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid); 194 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv); 195 break; 196 case SMMU_EVT_F_STE_FETCH: 197 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid); 198 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv); 199 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr); 200 break; 201 case SMMU_EVT_C_BAD_STE: 202 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid); 203 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv); 204 break; 205 case SMMU_EVT_F_STREAM_DISABLED: 206 break; 207 case SMMU_EVT_F_TRANS_FORBIDDEN: 208 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr); 209 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw); 210 break; 211 case SMMU_EVT_C_BAD_SUBSTREAMID: 212 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid); 213 break; 214 case SMMU_EVT_F_CD_FETCH: 215 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid); 216 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv); 217 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr); 218 break; 219 case SMMU_EVT_C_BAD_CD: 220 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid); 221 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv); 222 break; 223 case SMMU_EVT_F_WALK_EABT: 224 case SMMU_EVT_F_TRANSLATION: 225 case SMMU_EVT_F_ADDR_SIZE: 226 case SMMU_EVT_F_ACCESS: 227 case SMMU_EVT_F_PERMISSION: 228 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall); 229 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag); 230 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid); 231 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv); 232 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2); 233 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr); 234 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw); 235 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu); 236 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind); 237 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class); 238 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2); 239 break; 240 case SMMU_EVT_F_CFG_CONFLICT: 241 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid); 242 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv); 243 break; 244 /* rest is not implemented */ 245 case SMMU_EVT_F_BAD_ATS_TREQ: 246 case SMMU_EVT_F_TLB_CONFLICT: 247 case SMMU_EVT_E_PAGE_REQ: 248 default: 249 g_assert_not_reached(); 250 } 251 252 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid); 253 r = smmuv3_write_eventq(s, &evt); 254 if (r != MEMTX_OK) { 255 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK); 256 } 257 info->recorded = true; 258 } 259 260 static void smmuv3_init_regs(SMMUv3State *s) 261 { 262 /* Based on sys property, the stages supported in smmu will be advertised.*/ 263 if (s->stage && !strcmp("2", s->stage)) { 264 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1); 265 } else if (s->stage && !strcmp("nested", s->stage)) { 266 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); 267 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1); 268 } else { 269 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); 270 } 271 272 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */ 273 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */ 274 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */ 275 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */ 276 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */ 277 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */ 278 /* terminated transaction will always be aborted/error returned */ 279 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1); 280 /* 2-level stream table supported */ 281 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1); 282 283 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE); 284 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS); 285 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS); 286 287 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1); 288 if (FIELD_EX32(s->idr[0], IDR0, S2P)) { 289 /* XNX is a stage-2-specific feature */ 290 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, XNX, 1); 291 } 292 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1); 293 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2); 294 295 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */ 296 /* 4K, 16K and 64K granule support */ 297 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1); 298 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1); 299 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1); 300 301 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS); 302 s->cmdq.prod = 0; 303 s->cmdq.cons = 0; 304 s->cmdq.entry_size = sizeof(struct Cmd); 305 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS); 306 s->eventq.prod = 0; 307 s->eventq.cons = 0; 308 s->eventq.entry_size = sizeof(struct Evt); 309 310 s->features = 0; 311 s->sid_split = 0; 312 s->aidr = 0x1; 313 s->cr[0] = 0; 314 s->cr0ack = 0; 315 s->irq_ctrl = 0; 316 s->gerror = 0; 317 s->gerrorn = 0; 318 s->statusr = 0; 319 s->gbpa = SMMU_GBPA_RESET_VAL; 320 } 321 322 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf, 323 SMMUEventInfo *event) 324 { 325 int ret, i; 326 327 trace_smmuv3_get_ste(addr); 328 /* TODO: guarantee 64-bit single-copy atomicity */ 329 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf), 330 MEMTXATTRS_UNSPECIFIED); 331 if (ret != MEMTX_OK) { 332 qemu_log_mask(LOG_GUEST_ERROR, 333 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 334 event->type = SMMU_EVT_F_STE_FETCH; 335 event->u.f_ste_fetch.addr = addr; 336 return -EINVAL; 337 } 338 for (i = 0; i < ARRAY_SIZE(buf->word); i++) { 339 le32_to_cpus(&buf->word[i]); 340 } 341 return 0; 342 343 } 344 345 static SMMUTranslationStatus smmuv3_do_translate(SMMUv3State *s, hwaddr addr, 346 SMMUTransCfg *cfg, 347 SMMUEventInfo *event, 348 IOMMUAccessFlags flag, 349 SMMUTLBEntry **out_entry, 350 SMMUTranslationClass class); 351 /* @ssid > 0 not supported yet */ 352 static int smmu_get_cd(SMMUv3State *s, STE *ste, SMMUTransCfg *cfg, 353 uint32_t ssid, CD *buf, SMMUEventInfo *event) 354 { 355 dma_addr_t addr = STE_CTXPTR(ste); 356 int ret, i; 357 SMMUTranslationStatus status; 358 SMMUTLBEntry *entry; 359 360 trace_smmuv3_get_cd(addr); 361 362 if (cfg->stage == SMMU_NESTED) { 363 status = smmuv3_do_translate(s, addr, cfg, event, 364 IOMMU_RO, &entry, SMMU_CLASS_CD); 365 366 /* Same PTW faults are reported but with CLASS = CD. */ 367 if (status != SMMU_TRANS_SUCCESS) { 368 return -EINVAL; 369 } 370 371 addr = CACHED_ENTRY_TO_ADDR(entry, addr); 372 } 373 374 /* TODO: guarantee 64-bit single-copy atomicity */ 375 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf), 376 MEMTXATTRS_UNSPECIFIED); 377 if (ret != MEMTX_OK) { 378 qemu_log_mask(LOG_GUEST_ERROR, 379 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 380 event->type = SMMU_EVT_F_CD_FETCH; 381 event->u.f_cd_fetch.addr = addr; 382 return -EINVAL; 383 } 384 for (i = 0; i < ARRAY_SIZE(buf->word); i++) { 385 le32_to_cpus(&buf->word[i]); 386 } 387 return 0; 388 } 389 390 /* 391 * Max valid value is 39 when SMMU_IDR3.STT == 0. 392 * In architectures after SMMUv3.0: 393 * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this 394 * field is MAX(16, 64-IAS) 395 * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field 396 * is (64-IAS). 397 * As we only support AA64, IAS = OAS. 398 */ 399 static bool s2t0sz_valid(SMMUTransCfg *cfg) 400 { 401 if (cfg->s2cfg.tsz > 39) { 402 return false; 403 } 404 405 if (cfg->s2cfg.granule_sz == 16) { 406 return (cfg->s2cfg.tsz >= 64 - cfg->s2cfg.eff_ps); 407 } 408 409 return (cfg->s2cfg.tsz >= MAX(64 - cfg->s2cfg.eff_ps, 16)); 410 } 411 412 /* 413 * Return true if s2 page table config is valid. 414 * This checks with the configured start level, ias_bits and granularity we can 415 * have a valid page table as described in ARM ARM D8.2 Translation process. 416 * The idea here is to see for the highest possible number of IPA bits, how 417 * many concatenated tables we would need, if it is more than 16, then this is 418 * not possible. 419 */ 420 static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran) 421 { 422 int level = get_start_level(sl0, gran); 423 uint64_t ipa_bits = 64 - t0sz; 424 uint64_t max_ipa = (1ULL << ipa_bits) - 1; 425 int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1; 426 427 return nr_concat <= VMSA_MAX_S2_CONCAT; 428 } 429 430 static int decode_ste_s2_cfg(SMMUv3State *s, SMMUTransCfg *cfg, 431 STE *ste) 432 { 433 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS); 434 435 if (STE_S2AA64(ste) == 0x0) { 436 qemu_log_mask(LOG_UNIMP, 437 "SMMUv3 AArch32 tables not supported\n"); 438 g_assert_not_reached(); 439 } 440 441 switch (STE_S2TG(ste)) { 442 case 0x0: /* 4KB */ 443 cfg->s2cfg.granule_sz = 12; 444 break; 445 case 0x1: /* 64KB */ 446 cfg->s2cfg.granule_sz = 16; 447 break; 448 case 0x2: /* 16KB */ 449 cfg->s2cfg.granule_sz = 14; 450 break; 451 default: 452 qemu_log_mask(LOG_GUEST_ERROR, 453 "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste)); 454 goto bad_ste; 455 } 456 457 cfg->s2cfg.vttb = STE_S2TTB(ste); 458 459 cfg->s2cfg.sl0 = STE_S2SL0(ste); 460 /* FEAT_TTST not supported. */ 461 if (cfg->s2cfg.sl0 == 0x3) { 462 qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n"); 463 goto bad_ste; 464 } 465 466 /* For AA64, The effective S2PS size is capped to the OAS. */ 467 cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), oas)); 468 /* 469 * For SMMUv3.1 and later, when OAS == IAS == 52, the stage 2 input 470 * range is further limited to 48 bits unless STE.S2TG indicates a 471 * 64KB granule. 472 */ 473 if (cfg->s2cfg.granule_sz != 16) { 474 cfg->s2cfg.eff_ps = MIN(cfg->s2cfg.eff_ps, 48); 475 } 476 /* 477 * It is ILLEGAL for the address in S2TTB to be outside the range 478 * described by the effective S2PS value. 479 */ 480 if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) { 481 qemu_log_mask(LOG_GUEST_ERROR, 482 "SMMUv3 S2TTB too large 0x%" PRIx64 483 ", effective PS %d bits\n", 484 cfg->s2cfg.vttb, cfg->s2cfg.eff_ps); 485 goto bad_ste; 486 } 487 488 cfg->s2cfg.tsz = STE_S2T0SZ(ste); 489 490 if (!s2t0sz_valid(cfg)) { 491 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n", 492 cfg->s2cfg.tsz); 493 goto bad_ste; 494 } 495 496 if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz, 497 cfg->s2cfg.granule_sz)) { 498 qemu_log_mask(LOG_GUEST_ERROR, 499 "SMMUv3 STE stage 2 config not valid!\n"); 500 goto bad_ste; 501 } 502 503 /* Only LE supported(IDR0.TTENDIAN). */ 504 if (STE_S2ENDI(ste)) { 505 qemu_log_mask(LOG_GUEST_ERROR, 506 "SMMUv3 STE_S2ENDI only supports LE!\n"); 507 goto bad_ste; 508 } 509 510 cfg->s2cfg.affd = STE_S2AFFD(ste); 511 512 cfg->s2cfg.record_faults = STE_S2R(ste); 513 /* As stall is not supported. */ 514 if (STE_S2S(ste)) { 515 qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n"); 516 goto bad_ste; 517 } 518 519 return 0; 520 521 bad_ste: 522 return -EINVAL; 523 } 524 525 static void decode_ste_config(SMMUTransCfg *cfg, uint32_t config) 526 { 527 528 if (STE_CFG_ABORT(config)) { 529 cfg->aborted = true; 530 return; 531 } 532 if (STE_CFG_BYPASS(config)) { 533 cfg->bypassed = true; 534 return; 535 } 536 537 if (STE_CFG_S1_ENABLED(config)) { 538 cfg->stage = SMMU_STAGE_1; 539 } 540 541 if (STE_CFG_S2_ENABLED(config)) { 542 cfg->stage |= SMMU_STAGE_2; 543 } 544 } 545 546 /* Returns < 0 in case of invalid STE, 0 otherwise */ 547 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg, 548 STE *ste, SMMUEventInfo *event) 549 { 550 uint32_t config; 551 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS); 552 int ret; 553 554 if (!STE_VALID(ste)) { 555 if (!event->inval_ste_allowed) { 556 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n"); 557 } 558 goto bad_ste; 559 } 560 561 config = STE_CONFIG(ste); 562 563 decode_ste_config(cfg, config); 564 565 if (cfg->aborted || cfg->bypassed) { 566 return 0; 567 } 568 569 /* 570 * If a stage is enabled in SW while not advertised, throw bad ste 571 * according to user manual(IHI0070E) "5.2 Stream Table Entry". 572 */ 573 if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) { 574 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n"); 575 goto bad_ste; 576 } 577 if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) { 578 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n"); 579 goto bad_ste; 580 } 581 582 if (STAGE2_SUPPORTED(s)) { 583 /* VMID is considered even if s2 is disabled. */ 584 cfg->s2cfg.vmid = STE_S2VMID(ste); 585 } else { 586 /* Default to -1 */ 587 cfg->s2cfg.vmid = -1; 588 } 589 590 if (STE_CFG_S2_ENABLED(config)) { 591 /* 592 * Stage-1 OAS defaults to OAS even if not enabled as it would be used 593 * in input address check for stage-2. 594 */ 595 cfg->oas = oas2bits(oas); 596 ret = decode_ste_s2_cfg(s, cfg, ste); 597 if (ret) { 598 goto bad_ste; 599 } 600 } 601 602 if (STE_S1CDMAX(ste) != 0) { 603 qemu_log_mask(LOG_UNIMP, 604 "SMMUv3 does not support multiple context descriptors yet\n"); 605 goto bad_ste; 606 } 607 608 if (STE_S1STALLD(ste)) { 609 qemu_log_mask(LOG_UNIMP, 610 "SMMUv3 S1 stalling fault model not allowed yet\n"); 611 goto bad_ste; 612 } 613 return 0; 614 615 bad_ste: 616 event->type = SMMU_EVT_C_BAD_STE; 617 return -EINVAL; 618 } 619 620 /** 621 * smmu_find_ste - Return the stream table entry associated 622 * to the sid 623 * 624 * @s: smmuv3 handle 625 * @sid: stream ID 626 * @ste: returned stream table entry 627 * @event: handle to an event info 628 * 629 * Supports linear and 2-level stream table 630 * Return 0 on success, -EINVAL otherwise 631 */ 632 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, 633 SMMUEventInfo *event) 634 { 635 dma_addr_t addr, strtab_base; 636 uint32_t log2size; 637 int strtab_size_shift; 638 int ret; 639 640 trace_smmuv3_find_ste(sid, s->features, s->sid_split); 641 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE); 642 /* 643 * Check SID range against both guest-configured and implementation limits 644 */ 645 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) { 646 event->type = SMMU_EVT_C_BAD_STREAMID; 647 return -EINVAL; 648 } 649 if (s->features & SMMU_FEATURE_2LVL_STE) { 650 int l1_ste_offset, l2_ste_offset, max_l2_ste, span, i; 651 dma_addr_t l1ptr, l2ptr; 652 STEDesc l1std; 653 654 /* 655 * Align strtab base address to table size. For this purpose, assume it 656 * is not bounded by SMMU_IDR1_SIDSIZE. 657 */ 658 strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3); 659 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & 660 ~MAKE_64BIT_MASK(0, strtab_size_shift); 661 l1_ste_offset = sid >> s->sid_split; 662 l2_ste_offset = sid & ((1 << s->sid_split) - 1); 663 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std)); 664 /* TODO: guarantee 64-bit single-copy atomicity */ 665 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std, 666 sizeof(l1std), MEMTXATTRS_UNSPECIFIED); 667 if (ret != MEMTX_OK) { 668 qemu_log_mask(LOG_GUEST_ERROR, 669 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr); 670 event->type = SMMU_EVT_F_STE_FETCH; 671 event->u.f_ste_fetch.addr = l1ptr; 672 return -EINVAL; 673 } 674 for (i = 0; i < ARRAY_SIZE(l1std.word); i++) { 675 le32_to_cpus(&l1std.word[i]); 676 } 677 678 span = L1STD_SPAN(&l1std); 679 680 if (!span) { 681 /* l2ptr is not valid */ 682 if (!event->inval_ste_allowed) { 683 qemu_log_mask(LOG_GUEST_ERROR, 684 "invalid sid=%d (L1STD span=0)\n", sid); 685 } 686 event->type = SMMU_EVT_C_BAD_STREAMID; 687 return -EINVAL; 688 } 689 max_l2_ste = (1 << span) - 1; 690 l2ptr = l1std_l2ptr(&l1std); 691 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, 692 l2ptr, l2_ste_offset, max_l2_ste); 693 if (l2_ste_offset > max_l2_ste) { 694 qemu_log_mask(LOG_GUEST_ERROR, 695 "l2_ste_offset=%d > max_l2_ste=%d\n", 696 l2_ste_offset, max_l2_ste); 697 event->type = SMMU_EVT_C_BAD_STE; 698 return -EINVAL; 699 } 700 addr = l2ptr + l2_ste_offset * sizeof(*ste); 701 } else { 702 strtab_size_shift = log2size + 5; 703 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & 704 ~MAKE_64BIT_MASK(0, strtab_size_shift); 705 addr = strtab_base + sid * sizeof(*ste); 706 } 707 708 if (smmu_get_ste(s, addr, ste, event)) { 709 return -EINVAL; 710 } 711 712 return 0; 713 } 714 715 static int decode_cd(SMMUv3State *s, SMMUTransCfg *cfg, 716 CD *cd, SMMUEventInfo *event) 717 { 718 int ret = -EINVAL; 719 int i; 720 SMMUTranslationStatus status; 721 SMMUTLBEntry *entry; 722 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS); 723 724 if (!CD_VALID(cd) || !CD_AARCH64(cd)) { 725 goto bad_cd; 726 } 727 if (!CD_A(cd)) { 728 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */ 729 } 730 if (CD_S(cd)) { 731 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */ 732 } 733 if (CD_HA(cd) || CD_HD(cd)) { 734 goto bad_cd; /* HTTU = 0 */ 735 } 736 737 /* we support only those at the moment */ 738 cfg->aa64 = true; 739 740 cfg->oas = oas2bits(CD_IPS(cd)); 741 cfg->oas = MIN(oas2bits(oas), cfg->oas); 742 cfg->tbi = CD_TBI(cd); 743 cfg->asid = CD_ASID(cd); 744 cfg->affd = CD_AFFD(cd); 745 746 trace_smmuv3_decode_cd(cfg->oas); 747 748 /* decode data dependent on TT */ 749 for (i = 0; i <= 1; i++) { 750 int tg, tsz; 751 SMMUTransTableInfo *tt = &cfg->tt[i]; 752 753 cfg->tt[i].disabled = CD_EPD(cd, i); 754 if (cfg->tt[i].disabled) { 755 continue; 756 } 757 758 tsz = CD_TSZ(cd, i); 759 if (tsz < 16 || tsz > 39) { 760 goto bad_cd; 761 } 762 763 tg = CD_TG(cd, i); 764 tt->granule_sz = tg2granule(tg, i); 765 if ((tt->granule_sz != 12 && tt->granule_sz != 14 && 766 tt->granule_sz != 16) || CD_ENDI(cd)) { 767 goto bad_cd; 768 } 769 770 /* 771 * An address greater than 48 bits in size can only be output from a 772 * TTD when, in SMMUv3.1 and later, the effective IPS is 52 and a 64KB 773 * granule is in use for that translation table 774 */ 775 if (tt->granule_sz != 16) { 776 cfg->oas = MIN(cfg->oas, 48); 777 } 778 tt->tsz = tsz; 779 tt->ttb = CD_TTB(cd, i); 780 781 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) { 782 goto bad_cd; 783 } 784 785 /* Translate the TTBx, from IPA to PA if nesting is enabled. */ 786 if (cfg->stage == SMMU_NESTED) { 787 status = smmuv3_do_translate(s, tt->ttb, cfg, event, IOMMU_RO, 788 &entry, SMMU_CLASS_TT); 789 /* 790 * Same PTW faults are reported but with CLASS = TT. 791 * If TTBx is larger than the effective stage 1 output addres 792 * size, it reports C_BAD_CD, which is handled by the above case. 793 */ 794 if (status != SMMU_TRANS_SUCCESS) { 795 return -EINVAL; 796 } 797 tt->ttb = CACHED_ENTRY_TO_ADDR(entry, tt->ttb); 798 } 799 800 tt->had = CD_HAD(cd, i); 801 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had); 802 } 803 804 cfg->record_faults = CD_R(cd); 805 806 return 0; 807 808 bad_cd: 809 event->type = SMMU_EVT_C_BAD_CD; 810 return ret; 811 } 812 813 /** 814 * smmuv3_decode_config - Prepare the translation configuration 815 * for the @mr iommu region 816 * @mr: iommu memory region the translation config must be prepared for 817 * @cfg: output translation configuration which is populated through 818 * the different configuration decoding steps 819 * @event: must be zero'ed by the caller 820 * 821 * return < 0 in case of config decoding error (@event is filled 822 * accordingly). Return 0 otherwise. 823 */ 824 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg, 825 SMMUEventInfo *event) 826 { 827 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 828 uint32_t sid = smmu_get_sid(sdev); 829 SMMUv3State *s = sdev->smmu; 830 int ret; 831 STE ste; 832 CD cd; 833 834 /* ASID defaults to -1 (if s1 is not supported). */ 835 cfg->asid = -1; 836 837 ret = smmu_find_ste(s, sid, &ste, event); 838 if (ret) { 839 return ret; 840 } 841 842 ret = decode_ste(s, cfg, &ste, event); 843 if (ret) { 844 return ret; 845 } 846 847 if (cfg->aborted || cfg->bypassed || (cfg->stage == SMMU_STAGE_2)) { 848 return 0; 849 } 850 851 ret = smmu_get_cd(s, &ste, cfg, 0 /* ssid */, &cd, event); 852 if (ret) { 853 return ret; 854 } 855 856 return decode_cd(s, cfg, &cd, event); 857 } 858 859 /** 860 * smmuv3_get_config - Look up for a cached copy of configuration data for 861 * @sdev and on cache miss performs a configuration structure decoding from 862 * guest RAM. 863 * 864 * @sdev: SMMUDevice handle 865 * @event: output event info 866 * 867 * The configuration cache contains data resulting from both STE and CD 868 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed 869 * by the SMMUDevice handle. 870 */ 871 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event) 872 { 873 SMMUv3State *s = sdev->smmu; 874 SMMUState *bc = &s->smmu_state; 875 SMMUTransCfg *cfg; 876 877 cfg = g_hash_table_lookup(bc->configs, sdev); 878 if (cfg) { 879 sdev->cfg_cache_hits++; 880 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev), 881 sdev->cfg_cache_hits, sdev->cfg_cache_misses, 882 100 * sdev->cfg_cache_hits / 883 (sdev->cfg_cache_hits + sdev->cfg_cache_misses)); 884 } else { 885 sdev->cfg_cache_misses++; 886 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev), 887 sdev->cfg_cache_hits, sdev->cfg_cache_misses, 888 100 * sdev->cfg_cache_hits / 889 (sdev->cfg_cache_hits + sdev->cfg_cache_misses)); 890 cfg = g_new0(SMMUTransCfg, 1); 891 892 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) { 893 g_hash_table_insert(bc->configs, sdev, cfg); 894 } else { 895 g_free(cfg); 896 cfg = NULL; 897 } 898 } 899 return cfg; 900 } 901 902 static void smmuv3_flush_config(SMMUDevice *sdev) 903 { 904 SMMUv3State *s = sdev->smmu; 905 SMMUState *bc = &s->smmu_state; 906 907 trace_smmu_config_cache_inv(smmu_get_sid(sdev)); 908 g_hash_table_remove(bc->configs, sdev); 909 } 910 911 /* Do translation with TLB lookup. */ 912 static SMMUTranslationStatus smmuv3_do_translate(SMMUv3State *s, hwaddr addr, 913 SMMUTransCfg *cfg, 914 SMMUEventInfo *event, 915 IOMMUAccessFlags flag, 916 SMMUTLBEntry **out_entry, 917 SMMUTranslationClass class) 918 { 919 SMMUPTWEventInfo ptw_info = {}; 920 SMMUState *bs = ARM_SMMU(s); 921 SMMUTLBEntry *cached_entry = NULL; 922 int asid, stage; 923 bool desc_s2_translation = class != SMMU_CLASS_IN; 924 925 /* 926 * The function uses the argument class to identify which stage is used: 927 * - CLASS = IN: Means an input translation, determine the stage from STE. 928 * - CLASS = CD: Means the addr is an IPA of the CD, and it would be 929 * translated using the stage-2. 930 * - CLASS = TT: Means the addr is an IPA of the stage-1 translation table 931 * and it would be translated using the stage-2. 932 * For the last 2 cases instead of having intrusive changes in the common 933 * logic, we modify the cfg to be a stage-2 translation only in case of 934 * nested, and then restore it after. 935 */ 936 if (desc_s2_translation) { 937 asid = cfg->asid; 938 stage = cfg->stage; 939 cfg->asid = -1; 940 cfg->stage = SMMU_STAGE_2; 941 } 942 943 cached_entry = smmu_translate(bs, cfg, addr, flag, &ptw_info); 944 945 if (desc_s2_translation) { 946 cfg->asid = asid; 947 cfg->stage = stage; 948 } 949 950 if (!cached_entry) { 951 /* All faults from PTW has S2 field. */ 952 event->u.f_walk_eabt.s2 = (ptw_info.stage == SMMU_STAGE_2); 953 /* 954 * Fault class is set as follows based on "class" input to 955 * the function and to "ptw_info" from "smmu_translate()" 956 * For stage-1: 957 * - EABT => CLASS_TT (hardcoded) 958 * - other events => CLASS_IN (input to function) 959 * For stage-2 => CLASS_IN (input to function) 960 * For nested, for all events: 961 * - CD fetch => CLASS_CD (input to function) 962 * - walking stage 1 translation table => CLASS_TT (from 963 * is_ipa_descriptor or input in case of TTBx) 964 * - s2 translation => CLASS_IN (input to function) 965 */ 966 class = ptw_info.is_ipa_descriptor ? SMMU_CLASS_TT : class; 967 switch (ptw_info.type) { 968 case SMMU_PTW_ERR_WALK_EABT: 969 event->type = SMMU_EVT_F_WALK_EABT; 970 event->u.f_walk_eabt.rnw = flag & 0x1; 971 event->u.f_walk_eabt.class = (ptw_info.stage == SMMU_STAGE_2) ? 972 class : SMMU_CLASS_TT; 973 event->u.f_walk_eabt.addr2 = ptw_info.addr; 974 break; 975 case SMMU_PTW_ERR_TRANSLATION: 976 if (PTW_RECORD_FAULT(ptw_info, cfg)) { 977 event->type = SMMU_EVT_F_TRANSLATION; 978 event->u.f_translation.addr2 = ptw_info.addr; 979 event->u.f_translation.class = class; 980 event->u.f_translation.rnw = flag & 0x1; 981 } 982 break; 983 case SMMU_PTW_ERR_ADDR_SIZE: 984 if (PTW_RECORD_FAULT(ptw_info, cfg)) { 985 event->type = SMMU_EVT_F_ADDR_SIZE; 986 event->u.f_addr_size.addr2 = ptw_info.addr; 987 event->u.f_addr_size.class = class; 988 event->u.f_addr_size.rnw = flag & 0x1; 989 } 990 break; 991 case SMMU_PTW_ERR_ACCESS: 992 if (PTW_RECORD_FAULT(ptw_info, cfg)) { 993 event->type = SMMU_EVT_F_ACCESS; 994 event->u.f_access.addr2 = ptw_info.addr; 995 event->u.f_access.class = class; 996 event->u.f_access.rnw = flag & 0x1; 997 } 998 break; 999 case SMMU_PTW_ERR_PERMISSION: 1000 if (PTW_RECORD_FAULT(ptw_info, cfg)) { 1001 event->type = SMMU_EVT_F_PERMISSION; 1002 event->u.f_permission.addr2 = ptw_info.addr; 1003 event->u.f_permission.class = class; 1004 event->u.f_permission.rnw = flag & 0x1; 1005 } 1006 break; 1007 default: 1008 g_assert_not_reached(); 1009 } 1010 return SMMU_TRANS_ERROR; 1011 } 1012 *out_entry = cached_entry; 1013 return SMMU_TRANS_SUCCESS; 1014 } 1015 1016 /* 1017 * Sets the InputAddr for an SMMU_TRANS_ERROR, as it can't be 1018 * set from all contexts, as smmuv3_get_config() can return 1019 * translation faults in case of nested translation (for CD 1020 * and TTBx). But in that case the iova is not known. 1021 */ 1022 static void smmuv3_fixup_event(SMMUEventInfo *event, hwaddr iova) 1023 { 1024 switch (event->type) { 1025 case SMMU_EVT_F_WALK_EABT: 1026 case SMMU_EVT_F_TRANSLATION: 1027 case SMMU_EVT_F_ADDR_SIZE: 1028 case SMMU_EVT_F_ACCESS: 1029 case SMMU_EVT_F_PERMISSION: 1030 event->u.f_walk_eabt.addr = iova; 1031 break; 1032 default: 1033 break; 1034 } 1035 } 1036 1037 /* Entry point to SMMU, does everything. */ 1038 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr, 1039 IOMMUAccessFlags flag, int iommu_idx) 1040 { 1041 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 1042 SMMUv3State *s = sdev->smmu; 1043 uint32_t sid = smmu_get_sid(sdev); 1044 SMMUEventInfo event = {.type = SMMU_EVT_NONE, 1045 .sid = sid, 1046 .inval_ste_allowed = false}; 1047 SMMUTranslationStatus status; 1048 SMMUTransCfg *cfg = NULL; 1049 IOMMUTLBEntry entry = { 1050 .target_as = &address_space_memory, 1051 .iova = addr, 1052 .translated_addr = addr, 1053 .addr_mask = ~(hwaddr)0, 1054 .perm = IOMMU_NONE, 1055 }; 1056 SMMUTLBEntry *cached_entry = NULL; 1057 1058 qemu_mutex_lock(&s->mutex); 1059 1060 if (!smmu_enabled(s)) { 1061 if (FIELD_EX32(s->gbpa, GBPA, ABORT)) { 1062 status = SMMU_TRANS_ABORT; 1063 } else { 1064 status = SMMU_TRANS_DISABLE; 1065 } 1066 goto epilogue; 1067 } 1068 1069 cfg = smmuv3_get_config(sdev, &event); 1070 if (!cfg) { 1071 status = SMMU_TRANS_ERROR; 1072 goto epilogue; 1073 } 1074 1075 if (cfg->aborted) { 1076 status = SMMU_TRANS_ABORT; 1077 goto epilogue; 1078 } 1079 1080 if (cfg->bypassed) { 1081 status = SMMU_TRANS_BYPASS; 1082 goto epilogue; 1083 } 1084 1085 status = smmuv3_do_translate(s, addr, cfg, &event, flag, 1086 &cached_entry, SMMU_CLASS_IN); 1087 1088 epilogue: 1089 qemu_mutex_unlock(&s->mutex); 1090 switch (status) { 1091 case SMMU_TRANS_SUCCESS: 1092 entry.perm = cached_entry->entry.perm; 1093 entry.translated_addr = CACHED_ENTRY_TO_ADDR(cached_entry, addr); 1094 entry.addr_mask = cached_entry->entry.addr_mask; 1095 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr, 1096 entry.translated_addr, entry.perm, 1097 cfg->stage); 1098 break; 1099 case SMMU_TRANS_DISABLE: 1100 entry.perm = flag; 1101 entry.addr_mask = ~TARGET_PAGE_MASK; 1102 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr, 1103 entry.perm); 1104 break; 1105 case SMMU_TRANS_BYPASS: 1106 entry.perm = flag; 1107 entry.addr_mask = ~TARGET_PAGE_MASK; 1108 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr, 1109 entry.perm); 1110 break; 1111 case SMMU_TRANS_ABORT: 1112 /* no event is recorded on abort */ 1113 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr, 1114 entry.perm); 1115 break; 1116 case SMMU_TRANS_ERROR: 1117 smmuv3_fixup_event(&event, addr); 1118 qemu_log_mask(LOG_GUEST_ERROR, 1119 "%s translation failed for iova=0x%"PRIx64" (%s)\n", 1120 mr->parent_obj.name, addr, smmu_event_string(event.type)); 1121 smmuv3_record_event(s, &event); 1122 break; 1123 } 1124 1125 return entry; 1126 } 1127 1128 /** 1129 * smmuv3_notify_iova - call the notifier @n for a given 1130 * @asid and @iova tuple. 1131 * 1132 * @mr: IOMMU mr region handle 1133 * @n: notifier to be called 1134 * @asid: address space ID or negative value if we don't care 1135 * @vmid: virtual machine ID or negative value if we don't care 1136 * @iova: iova 1137 * @tg: translation granule (if communicated through range invalidation) 1138 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1 1139 * @stage: Which stage(1 or 2) is used 1140 */ 1141 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr, 1142 IOMMUNotifier *n, 1143 int asid, int vmid, 1144 dma_addr_t iova, uint8_t tg, 1145 uint64_t num_pages, int stage) 1146 { 1147 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 1148 SMMUEventInfo eventinfo = {.inval_ste_allowed = true}; 1149 SMMUTransCfg *cfg = smmuv3_get_config(sdev, &eventinfo); 1150 IOMMUTLBEvent event; 1151 uint8_t granule; 1152 1153 if (!cfg) { 1154 return; 1155 } 1156 1157 /* 1158 * stage is passed from TLB invalidation commands which can be either 1159 * stage-1 or stage-2. 1160 * However, IOMMUTLBEvent only understands IOVA, for stage-1 or stage-2 1161 * SMMU instances we consider the input address as the IOVA, but when 1162 * nesting is used, we can't mix stage-1 and stage-2 addresses, so for 1163 * nesting only stage-1 is considered the IOVA and would be notified. 1164 */ 1165 if ((stage == SMMU_STAGE_2) && (cfg->stage == SMMU_NESTED)) 1166 return; 1167 1168 if (!tg) { 1169 SMMUTransTableInfo *tt; 1170 1171 if (asid >= 0 && cfg->asid != asid) { 1172 return; 1173 } 1174 1175 if (vmid >= 0 && cfg->s2cfg.vmid != vmid) { 1176 return; 1177 } 1178 1179 if (stage == SMMU_STAGE_1) { 1180 tt = select_tt(cfg, iova); 1181 if (!tt) { 1182 return; 1183 } 1184 granule = tt->granule_sz; 1185 } else { 1186 granule = cfg->s2cfg.granule_sz; 1187 } 1188 1189 } else { 1190 granule = tg * 2 + 10; 1191 } 1192 1193 event.type = IOMMU_NOTIFIER_UNMAP; 1194 event.entry.target_as = &address_space_memory; 1195 event.entry.iova = iova; 1196 event.entry.addr_mask = num_pages * (1 << granule) - 1; 1197 event.entry.perm = IOMMU_NONE; 1198 1199 memory_region_notify_iommu_one(n, &event); 1200 } 1201 1202 /* invalidate an asid/vmid/iova range tuple in all mr's */ 1203 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid, 1204 dma_addr_t iova, uint8_t tg, 1205 uint64_t num_pages, int stage) 1206 { 1207 SMMUDevice *sdev; 1208 1209 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) { 1210 IOMMUMemoryRegion *mr = &sdev->iommu; 1211 IOMMUNotifier *n; 1212 1213 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid, 1214 iova, tg, num_pages, stage); 1215 1216 IOMMU_NOTIFIER_FOREACH(n, mr) { 1217 smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages, stage); 1218 } 1219 } 1220 } 1221 1222 static void smmuv3_range_inval(SMMUState *s, Cmd *cmd, SMMUStage stage) 1223 { 1224 dma_addr_t end, addr = CMD_ADDR(cmd); 1225 uint8_t type = CMD_TYPE(cmd); 1226 int vmid = -1; 1227 uint8_t scale = CMD_SCALE(cmd); 1228 uint8_t num = CMD_NUM(cmd); 1229 uint8_t ttl = CMD_TTL(cmd); 1230 bool leaf = CMD_LEAF(cmd); 1231 uint8_t tg = CMD_TG(cmd); 1232 uint64_t num_pages; 1233 uint8_t granule; 1234 int asid = -1; 1235 SMMUv3State *smmuv3 = ARM_SMMUV3(s); 1236 1237 /* Only consider VMID if stage-2 is supported. */ 1238 if (STAGE2_SUPPORTED(smmuv3)) { 1239 vmid = CMD_VMID(cmd); 1240 } 1241 1242 if (type == SMMU_CMD_TLBI_NH_VA) { 1243 asid = CMD_ASID(cmd); 1244 } 1245 1246 if (!tg) { 1247 trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf, stage); 1248 smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1, stage); 1249 if (stage == SMMU_STAGE_1) { 1250 smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl); 1251 } else { 1252 smmu_iotlb_inv_ipa(s, vmid, addr, tg, 1, ttl); 1253 } 1254 return; 1255 } 1256 1257 /* RIL in use */ 1258 1259 num_pages = (num + 1) * BIT_ULL(scale); 1260 granule = tg * 2 + 10; 1261 1262 /* Split invalidations into ^2 range invalidations */ 1263 end = addr + (num_pages << granule) - 1; 1264 1265 while (addr != end + 1) { 1266 uint64_t mask = dma_aligned_pow2_mask(addr, end, 64); 1267 1268 num_pages = (mask + 1) >> granule; 1269 trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, 1270 ttl, leaf, stage); 1271 smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages, stage); 1272 if (stage == SMMU_STAGE_1) { 1273 smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl); 1274 } else { 1275 smmu_iotlb_inv_ipa(s, vmid, addr, tg, num_pages, ttl); 1276 } 1277 addr += mask + 1; 1278 } 1279 } 1280 1281 static int smmuv3_cmdq_consume(SMMUv3State *s) 1282 { 1283 SMMUState *bs = ARM_SMMU(s); 1284 SMMUCmdError cmd_error = SMMU_CERROR_NONE; 1285 SMMUQueue *q = &s->cmdq; 1286 SMMUCommandType type = 0; 1287 1288 if (!smmuv3_cmdq_enabled(s)) { 1289 return 0; 1290 } 1291 /* 1292 * some commands depend on register values, typically CR0. In case those 1293 * register values change while handling the command, spec says it 1294 * is UNPREDICTABLE whether the command is interpreted under the new 1295 * or old value. 1296 */ 1297 1298 while (!smmuv3_q_empty(q)) { 1299 uint32_t pending = s->gerror ^ s->gerrorn; 1300 Cmd cmd; 1301 1302 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q), 1303 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 1304 1305 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) { 1306 break; 1307 } 1308 1309 if (queue_read(q, &cmd) != MEMTX_OK) { 1310 cmd_error = SMMU_CERROR_ABT; 1311 break; 1312 } 1313 1314 type = CMD_TYPE(&cmd); 1315 1316 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type)); 1317 1318 qemu_mutex_lock(&s->mutex); 1319 switch (type) { 1320 case SMMU_CMD_SYNC: 1321 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) { 1322 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0); 1323 } 1324 break; 1325 case SMMU_CMD_PREFETCH_CONFIG: 1326 case SMMU_CMD_PREFETCH_ADDR: 1327 break; 1328 case SMMU_CMD_CFGI_STE: 1329 { 1330 uint32_t sid = CMD_SID(&cmd); 1331 SMMUDevice *sdev = smmu_find_sdev(bs, sid); 1332 1333 if (CMD_SSEC(&cmd)) { 1334 cmd_error = SMMU_CERROR_ILL; 1335 break; 1336 } 1337 1338 if (!sdev) { 1339 break; 1340 } 1341 1342 trace_smmuv3_cmdq_cfgi_ste(sid); 1343 smmuv3_flush_config(sdev); 1344 1345 break; 1346 } 1347 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */ 1348 { 1349 uint32_t sid = CMD_SID(&cmd), mask; 1350 uint8_t range = CMD_STE_RANGE(&cmd); 1351 SMMUSIDRange sid_range; 1352 1353 if (CMD_SSEC(&cmd)) { 1354 cmd_error = SMMU_CERROR_ILL; 1355 break; 1356 } 1357 1358 mask = (1ULL << (range + 1)) - 1; 1359 sid_range.start = sid & ~mask; 1360 sid_range.end = sid_range.start + mask; 1361 1362 trace_smmuv3_cmdq_cfgi_ste_range(sid_range.start, sid_range.end); 1363 smmu_configs_inv_sid_range(bs, sid_range); 1364 break; 1365 } 1366 case SMMU_CMD_CFGI_CD: 1367 case SMMU_CMD_CFGI_CD_ALL: 1368 { 1369 uint32_t sid = CMD_SID(&cmd); 1370 SMMUDevice *sdev = smmu_find_sdev(bs, sid); 1371 1372 if (CMD_SSEC(&cmd)) { 1373 cmd_error = SMMU_CERROR_ILL; 1374 break; 1375 } 1376 1377 if (!sdev) { 1378 break; 1379 } 1380 1381 trace_smmuv3_cmdq_cfgi_cd(sid); 1382 smmuv3_flush_config(sdev); 1383 break; 1384 } 1385 case SMMU_CMD_TLBI_NH_ASID: 1386 { 1387 int asid = CMD_ASID(&cmd); 1388 int vmid = -1; 1389 1390 if (!STAGE1_SUPPORTED(s)) { 1391 cmd_error = SMMU_CERROR_ILL; 1392 break; 1393 } 1394 1395 /* 1396 * VMID is only matched when stage 2 is supported, otherwise set it 1397 * to -1 as the value used for stage-1 only VMIDs. 1398 */ 1399 if (STAGE2_SUPPORTED(s)) { 1400 vmid = CMD_VMID(&cmd); 1401 } 1402 1403 trace_smmuv3_cmdq_tlbi_nh_asid(asid); 1404 smmu_inv_notifiers_all(&s->smmu_state); 1405 smmu_iotlb_inv_asid_vmid(bs, asid, vmid); 1406 break; 1407 } 1408 case SMMU_CMD_TLBI_NH_ALL: 1409 { 1410 int vmid = -1; 1411 1412 if (!STAGE1_SUPPORTED(s)) { 1413 cmd_error = SMMU_CERROR_ILL; 1414 break; 1415 } 1416 1417 /* 1418 * If stage-2 is supported, invalidate for this VMID only, otherwise 1419 * invalidate the whole thing. 1420 */ 1421 if (STAGE2_SUPPORTED(s)) { 1422 vmid = CMD_VMID(&cmd); 1423 trace_smmuv3_cmdq_tlbi_nh(vmid); 1424 smmu_iotlb_inv_vmid_s1(bs, vmid); 1425 break; 1426 } 1427 QEMU_FALLTHROUGH; 1428 } 1429 case SMMU_CMD_TLBI_NSNH_ALL: 1430 trace_smmuv3_cmdq_tlbi_nsnh(); 1431 smmu_inv_notifiers_all(&s->smmu_state); 1432 smmu_iotlb_inv_all(bs); 1433 break; 1434 case SMMU_CMD_TLBI_NH_VAA: 1435 case SMMU_CMD_TLBI_NH_VA: 1436 if (!STAGE1_SUPPORTED(s)) { 1437 cmd_error = SMMU_CERROR_ILL; 1438 break; 1439 } 1440 smmuv3_range_inval(bs, &cmd, SMMU_STAGE_1); 1441 break; 1442 case SMMU_CMD_TLBI_S12_VMALL: 1443 { 1444 int vmid = CMD_VMID(&cmd); 1445 1446 if (!STAGE2_SUPPORTED(s)) { 1447 cmd_error = SMMU_CERROR_ILL; 1448 break; 1449 } 1450 1451 trace_smmuv3_cmdq_tlbi_s12_vmid(vmid); 1452 smmu_inv_notifiers_all(&s->smmu_state); 1453 smmu_iotlb_inv_vmid(bs, vmid); 1454 break; 1455 } 1456 case SMMU_CMD_TLBI_S2_IPA: 1457 if (!STAGE2_SUPPORTED(s)) { 1458 cmd_error = SMMU_CERROR_ILL; 1459 break; 1460 } 1461 /* 1462 * As currently only either s1 or s2 are supported 1463 * we can reuse same function for s2. 1464 */ 1465 smmuv3_range_inval(bs, &cmd, SMMU_STAGE_2); 1466 break; 1467 case SMMU_CMD_TLBI_EL3_ALL: 1468 case SMMU_CMD_TLBI_EL3_VA: 1469 case SMMU_CMD_TLBI_EL2_ALL: 1470 case SMMU_CMD_TLBI_EL2_ASID: 1471 case SMMU_CMD_TLBI_EL2_VA: 1472 case SMMU_CMD_TLBI_EL2_VAA: 1473 case SMMU_CMD_ATC_INV: 1474 case SMMU_CMD_PRI_RESP: 1475 case SMMU_CMD_RESUME: 1476 case SMMU_CMD_STALL_TERM: 1477 trace_smmuv3_unhandled_cmd(type); 1478 break; 1479 default: 1480 cmd_error = SMMU_CERROR_ILL; 1481 break; 1482 } 1483 qemu_mutex_unlock(&s->mutex); 1484 if (cmd_error) { 1485 if (cmd_error == SMMU_CERROR_ILL) { 1486 qemu_log_mask(LOG_GUEST_ERROR, 1487 "Illegal command type: %d\n", CMD_TYPE(&cmd)); 1488 } 1489 break; 1490 } 1491 /* 1492 * We only increment the cons index after the completion of 1493 * the command. We do that because the SYNC returns immediately 1494 * and does not check the completion of previous commands 1495 */ 1496 queue_cons_incr(q); 1497 } 1498 1499 if (cmd_error) { 1500 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error); 1501 smmu_write_cmdq_err(s, cmd_error); 1502 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK); 1503 } 1504 1505 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q), 1506 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 1507 1508 return 0; 1509 } 1510 1511 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset, 1512 uint64_t data, MemTxAttrs attrs) 1513 { 1514 switch (offset) { 1515 case A_GERROR_IRQ_CFG0: 1516 s->gerror_irq_cfg0 = data; 1517 return MEMTX_OK; 1518 case A_STRTAB_BASE: 1519 s->strtab_base = data; 1520 return MEMTX_OK; 1521 case A_CMDQ_BASE: 1522 s->cmdq.base = data; 1523 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 1524 if (s->cmdq.log2size > SMMU_CMDQS) { 1525 s->cmdq.log2size = SMMU_CMDQS; 1526 } 1527 return MEMTX_OK; 1528 case A_EVENTQ_BASE: 1529 s->eventq.base = data; 1530 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 1531 if (s->eventq.log2size > SMMU_EVENTQS) { 1532 s->eventq.log2size = SMMU_EVENTQS; 1533 } 1534 return MEMTX_OK; 1535 case A_EVENTQ_IRQ_CFG0: 1536 s->eventq_irq_cfg0 = data; 1537 return MEMTX_OK; 1538 default: 1539 qemu_log_mask(LOG_UNIMP, 1540 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n", 1541 __func__, offset); 1542 return MEMTX_OK; 1543 } 1544 } 1545 1546 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset, 1547 uint64_t data, MemTxAttrs attrs) 1548 { 1549 switch (offset) { 1550 case A_CR0: 1551 s->cr[0] = data; 1552 s->cr0ack = data & ~SMMU_CR0_RESERVED; 1553 /* in case the command queue has been enabled */ 1554 smmuv3_cmdq_consume(s); 1555 return MEMTX_OK; 1556 case A_CR1: 1557 s->cr[1] = data; 1558 return MEMTX_OK; 1559 case A_CR2: 1560 s->cr[2] = data; 1561 return MEMTX_OK; 1562 case A_IRQ_CTRL: 1563 s->irq_ctrl = data; 1564 return MEMTX_OK; 1565 case A_GERRORN: 1566 smmuv3_write_gerrorn(s, data); 1567 /* 1568 * By acknowledging the CMDQ_ERR, SW may notify cmds can 1569 * be processed again 1570 */ 1571 smmuv3_cmdq_consume(s); 1572 return MEMTX_OK; 1573 case A_GERROR_IRQ_CFG0: /* 64b */ 1574 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data); 1575 return MEMTX_OK; 1576 case A_GERROR_IRQ_CFG0 + 4: 1577 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data); 1578 return MEMTX_OK; 1579 case A_GERROR_IRQ_CFG1: 1580 s->gerror_irq_cfg1 = data; 1581 return MEMTX_OK; 1582 case A_GERROR_IRQ_CFG2: 1583 s->gerror_irq_cfg2 = data; 1584 return MEMTX_OK; 1585 case A_GBPA: 1586 /* 1587 * If UPDATE is not set, the write is ignored. This is the only 1588 * permitted behavior in SMMUv3.2 and later. 1589 */ 1590 if (data & R_GBPA_UPDATE_MASK) { 1591 /* Ignore update bit as write is synchronous. */ 1592 s->gbpa = data & ~R_GBPA_UPDATE_MASK; 1593 } 1594 return MEMTX_OK; 1595 case A_STRTAB_BASE: /* 64b */ 1596 s->strtab_base = deposit64(s->strtab_base, 0, 32, data); 1597 return MEMTX_OK; 1598 case A_STRTAB_BASE + 4: 1599 s->strtab_base = deposit64(s->strtab_base, 32, 32, data); 1600 return MEMTX_OK; 1601 case A_STRTAB_BASE_CFG: 1602 s->strtab_base_cfg = data; 1603 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) { 1604 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); 1605 s->features |= SMMU_FEATURE_2LVL_STE; 1606 } 1607 return MEMTX_OK; 1608 case A_CMDQ_BASE: /* 64b */ 1609 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data); 1610 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 1611 if (s->cmdq.log2size > SMMU_CMDQS) { 1612 s->cmdq.log2size = SMMU_CMDQS; 1613 } 1614 return MEMTX_OK; 1615 case A_CMDQ_BASE + 4: /* 64b */ 1616 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data); 1617 return MEMTX_OK; 1618 case A_CMDQ_PROD: 1619 s->cmdq.prod = data; 1620 smmuv3_cmdq_consume(s); 1621 return MEMTX_OK; 1622 case A_CMDQ_CONS: 1623 s->cmdq.cons = data; 1624 return MEMTX_OK; 1625 case A_EVENTQ_BASE: /* 64b */ 1626 s->eventq.base = deposit64(s->eventq.base, 0, 32, data); 1627 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 1628 if (s->eventq.log2size > SMMU_EVENTQS) { 1629 s->eventq.log2size = SMMU_EVENTQS; 1630 } 1631 return MEMTX_OK; 1632 case A_EVENTQ_BASE + 4: 1633 s->eventq.base = deposit64(s->eventq.base, 32, 32, data); 1634 return MEMTX_OK; 1635 case A_EVENTQ_PROD: 1636 s->eventq.prod = data; 1637 return MEMTX_OK; 1638 case A_EVENTQ_CONS: 1639 s->eventq.cons = data; 1640 return MEMTX_OK; 1641 case A_EVENTQ_IRQ_CFG0: /* 64b */ 1642 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data); 1643 return MEMTX_OK; 1644 case A_EVENTQ_IRQ_CFG0 + 4: 1645 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data); 1646 return MEMTX_OK; 1647 case A_EVENTQ_IRQ_CFG1: 1648 s->eventq_irq_cfg1 = data; 1649 return MEMTX_OK; 1650 case A_EVENTQ_IRQ_CFG2: 1651 s->eventq_irq_cfg2 = data; 1652 return MEMTX_OK; 1653 default: 1654 qemu_log_mask(LOG_UNIMP, 1655 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n", 1656 __func__, offset); 1657 return MEMTX_OK; 1658 } 1659 } 1660 1661 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data, 1662 unsigned size, MemTxAttrs attrs) 1663 { 1664 SMMUState *sys = opaque; 1665 SMMUv3State *s = ARM_SMMUV3(sys); 1666 MemTxResult r; 1667 1668 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1669 offset &= ~0x10000; 1670 1671 switch (size) { 1672 case 8: 1673 r = smmu_writell(s, offset, data, attrs); 1674 break; 1675 case 4: 1676 r = smmu_writel(s, offset, data, attrs); 1677 break; 1678 default: 1679 r = MEMTX_ERROR; 1680 break; 1681 } 1682 1683 trace_smmuv3_write_mmio(offset, data, size, r); 1684 return r; 1685 } 1686 1687 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset, 1688 uint64_t *data, MemTxAttrs attrs) 1689 { 1690 switch (offset) { 1691 case A_GERROR_IRQ_CFG0: 1692 *data = s->gerror_irq_cfg0; 1693 return MEMTX_OK; 1694 case A_STRTAB_BASE: 1695 *data = s->strtab_base; 1696 return MEMTX_OK; 1697 case A_CMDQ_BASE: 1698 *data = s->cmdq.base; 1699 return MEMTX_OK; 1700 case A_EVENTQ_BASE: 1701 *data = s->eventq.base; 1702 return MEMTX_OK; 1703 default: 1704 *data = 0; 1705 qemu_log_mask(LOG_UNIMP, 1706 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n", 1707 __func__, offset); 1708 return MEMTX_OK; 1709 } 1710 } 1711 1712 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset, 1713 uint64_t *data, MemTxAttrs attrs) 1714 { 1715 switch (offset) { 1716 case A_IDREGS ... A_IDREGS + 0x2f: 1717 *data = smmuv3_idreg(offset - A_IDREGS); 1718 return MEMTX_OK; 1719 case A_IDR0 ... A_IDR5: 1720 *data = s->idr[(offset - A_IDR0) / 4]; 1721 return MEMTX_OK; 1722 case A_IIDR: 1723 *data = s->iidr; 1724 return MEMTX_OK; 1725 case A_AIDR: 1726 *data = s->aidr; 1727 return MEMTX_OK; 1728 case A_CR0: 1729 *data = s->cr[0]; 1730 return MEMTX_OK; 1731 case A_CR0ACK: 1732 *data = s->cr0ack; 1733 return MEMTX_OK; 1734 case A_CR1: 1735 *data = s->cr[1]; 1736 return MEMTX_OK; 1737 case A_CR2: 1738 *data = s->cr[2]; 1739 return MEMTX_OK; 1740 case A_STATUSR: 1741 *data = s->statusr; 1742 return MEMTX_OK; 1743 case A_GBPA: 1744 *data = s->gbpa; 1745 return MEMTX_OK; 1746 case A_IRQ_CTRL: 1747 case A_IRQ_CTRL_ACK: 1748 *data = s->irq_ctrl; 1749 return MEMTX_OK; 1750 case A_GERROR: 1751 *data = s->gerror; 1752 return MEMTX_OK; 1753 case A_GERRORN: 1754 *data = s->gerrorn; 1755 return MEMTX_OK; 1756 case A_GERROR_IRQ_CFG0: /* 64b */ 1757 *data = extract64(s->gerror_irq_cfg0, 0, 32); 1758 return MEMTX_OK; 1759 case A_GERROR_IRQ_CFG0 + 4: 1760 *data = extract64(s->gerror_irq_cfg0, 32, 32); 1761 return MEMTX_OK; 1762 case A_GERROR_IRQ_CFG1: 1763 *data = s->gerror_irq_cfg1; 1764 return MEMTX_OK; 1765 case A_GERROR_IRQ_CFG2: 1766 *data = s->gerror_irq_cfg2; 1767 return MEMTX_OK; 1768 case A_STRTAB_BASE: /* 64b */ 1769 *data = extract64(s->strtab_base, 0, 32); 1770 return MEMTX_OK; 1771 case A_STRTAB_BASE + 4: /* 64b */ 1772 *data = extract64(s->strtab_base, 32, 32); 1773 return MEMTX_OK; 1774 case A_STRTAB_BASE_CFG: 1775 *data = s->strtab_base_cfg; 1776 return MEMTX_OK; 1777 case A_CMDQ_BASE: /* 64b */ 1778 *data = extract64(s->cmdq.base, 0, 32); 1779 return MEMTX_OK; 1780 case A_CMDQ_BASE + 4: 1781 *data = extract64(s->cmdq.base, 32, 32); 1782 return MEMTX_OK; 1783 case A_CMDQ_PROD: 1784 *data = s->cmdq.prod; 1785 return MEMTX_OK; 1786 case A_CMDQ_CONS: 1787 *data = s->cmdq.cons; 1788 return MEMTX_OK; 1789 case A_EVENTQ_BASE: /* 64b */ 1790 *data = extract64(s->eventq.base, 0, 32); 1791 return MEMTX_OK; 1792 case A_EVENTQ_BASE + 4: /* 64b */ 1793 *data = extract64(s->eventq.base, 32, 32); 1794 return MEMTX_OK; 1795 case A_EVENTQ_PROD: 1796 *data = s->eventq.prod; 1797 return MEMTX_OK; 1798 case A_EVENTQ_CONS: 1799 *data = s->eventq.cons; 1800 return MEMTX_OK; 1801 default: 1802 *data = 0; 1803 qemu_log_mask(LOG_UNIMP, 1804 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n", 1805 __func__, offset); 1806 return MEMTX_OK; 1807 } 1808 } 1809 1810 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data, 1811 unsigned size, MemTxAttrs attrs) 1812 { 1813 SMMUState *sys = opaque; 1814 SMMUv3State *s = ARM_SMMUV3(sys); 1815 MemTxResult r; 1816 1817 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1818 offset &= ~0x10000; 1819 1820 switch (size) { 1821 case 8: 1822 r = smmu_readll(s, offset, data, attrs); 1823 break; 1824 case 4: 1825 r = smmu_readl(s, offset, data, attrs); 1826 break; 1827 default: 1828 r = MEMTX_ERROR; 1829 break; 1830 } 1831 1832 trace_smmuv3_read_mmio(offset, *data, size, r); 1833 return r; 1834 } 1835 1836 static const MemoryRegionOps smmu_mem_ops = { 1837 .read_with_attrs = smmu_read_mmio, 1838 .write_with_attrs = smmu_write_mmio, 1839 .endianness = DEVICE_LITTLE_ENDIAN, 1840 .valid = { 1841 .min_access_size = 4, 1842 .max_access_size = 8, 1843 }, 1844 .impl = { 1845 .min_access_size = 4, 1846 .max_access_size = 8, 1847 }, 1848 }; 1849 1850 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev) 1851 { 1852 int i; 1853 1854 for (i = 0; i < ARRAY_SIZE(s->irq); i++) { 1855 sysbus_init_irq(dev, &s->irq[i]); 1856 } 1857 } 1858 1859 /* 1860 * Make sure the IOMMU is reset in 'exit' phase after 1861 * all outstanding DMA requests have been quiesced during 1862 * the 'enter' or 'hold' reset phases 1863 */ 1864 static void smmu_reset_exit(Object *obj, ResetType type) 1865 { 1866 SMMUv3State *s = ARM_SMMUV3(obj); 1867 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1868 1869 trace_smmu_reset_exit(); 1870 if (c->parent_phases.exit) { 1871 c->parent_phases.exit(obj, type); 1872 } 1873 1874 smmuv3_init_regs(s); 1875 } 1876 1877 static void smmu_realize(DeviceState *d, Error **errp) 1878 { 1879 SMMUState *sys = ARM_SMMU(d); 1880 SMMUv3State *s = ARM_SMMUV3(sys); 1881 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1882 SysBusDevice *dev = SYS_BUS_DEVICE(d); 1883 Error *local_err = NULL; 1884 1885 c->parent_realize(d, &local_err); 1886 if (local_err) { 1887 error_propagate(errp, local_err); 1888 return; 1889 } 1890 1891 qemu_mutex_init(&s->mutex); 1892 1893 memory_region_init_io(&sys->iomem, OBJECT(s), 1894 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000); 1895 1896 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION; 1897 1898 sysbus_init_mmio(dev, &sys->iomem); 1899 1900 smmu_init_irq(s, dev); 1901 } 1902 1903 static const VMStateDescription vmstate_smmuv3_queue = { 1904 .name = "smmuv3_queue", 1905 .version_id = 1, 1906 .minimum_version_id = 1, 1907 .fields = (const VMStateField[]) { 1908 VMSTATE_UINT64(base, SMMUQueue), 1909 VMSTATE_UINT32(prod, SMMUQueue), 1910 VMSTATE_UINT32(cons, SMMUQueue), 1911 VMSTATE_UINT8(log2size, SMMUQueue), 1912 VMSTATE_END_OF_LIST(), 1913 }, 1914 }; 1915 1916 static bool smmuv3_gbpa_needed(void *opaque) 1917 { 1918 SMMUv3State *s = opaque; 1919 1920 /* Only migrate GBPA if it has different reset value. */ 1921 return s->gbpa != SMMU_GBPA_RESET_VAL; 1922 } 1923 1924 static const VMStateDescription vmstate_gbpa = { 1925 .name = "smmuv3/gbpa", 1926 .version_id = 1, 1927 .minimum_version_id = 1, 1928 .needed = smmuv3_gbpa_needed, 1929 .fields = (const VMStateField[]) { 1930 VMSTATE_UINT32(gbpa, SMMUv3State), 1931 VMSTATE_END_OF_LIST() 1932 } 1933 }; 1934 1935 static const VMStateDescription vmstate_smmuv3 = { 1936 .name = "smmuv3", 1937 .version_id = 1, 1938 .minimum_version_id = 1, 1939 .priority = MIG_PRI_IOMMU, 1940 .fields = (const VMStateField[]) { 1941 VMSTATE_UINT32(features, SMMUv3State), 1942 VMSTATE_UINT8(sid_size, SMMUv3State), 1943 VMSTATE_UINT8(sid_split, SMMUv3State), 1944 1945 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3), 1946 VMSTATE_UINT32(cr0ack, SMMUv3State), 1947 VMSTATE_UINT32(statusr, SMMUv3State), 1948 VMSTATE_UINT32(irq_ctrl, SMMUv3State), 1949 VMSTATE_UINT32(gerror, SMMUv3State), 1950 VMSTATE_UINT32(gerrorn, SMMUv3State), 1951 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State), 1952 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State), 1953 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State), 1954 VMSTATE_UINT64(strtab_base, SMMUv3State), 1955 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State), 1956 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State), 1957 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State), 1958 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State), 1959 1960 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1961 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1962 1963 VMSTATE_END_OF_LIST(), 1964 }, 1965 .subsections = (const VMStateDescription * const []) { 1966 &vmstate_gbpa, 1967 NULL 1968 } 1969 }; 1970 1971 static const Property smmuv3_properties[] = { 1972 /* 1973 * Stages of translation advertised. 1974 * "1": Stage 1 1975 * "2": Stage 2 1976 * "nested": Both stage 1 and stage 2 1977 * Defaults to stage 1 1978 */ 1979 DEFINE_PROP_STRING("stage", SMMUv3State, stage), 1980 }; 1981 1982 static void smmuv3_instance_init(Object *obj) 1983 { 1984 /* Nothing much to do here as of now */ 1985 } 1986 1987 static void smmuv3_class_init(ObjectClass *klass, void *data) 1988 { 1989 DeviceClass *dc = DEVICE_CLASS(klass); 1990 ResettableClass *rc = RESETTABLE_CLASS(klass); 1991 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass); 1992 1993 dc->vmsd = &vmstate_smmuv3; 1994 resettable_class_set_parent_phases(rc, NULL, NULL, smmu_reset_exit, 1995 &c->parent_phases); 1996 device_class_set_parent_realize(dc, smmu_realize, 1997 &c->parent_realize); 1998 device_class_set_props(dc, smmuv3_properties); 1999 } 2000 2001 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu, 2002 IOMMUNotifierFlag old, 2003 IOMMUNotifierFlag new, 2004 Error **errp) 2005 { 2006 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu); 2007 SMMUv3State *s3 = sdev->smmu; 2008 SMMUState *s = &(s3->smmu_state); 2009 2010 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) { 2011 error_setg(errp, "SMMUv3 does not support dev-iotlb yet"); 2012 return -EINVAL; 2013 } 2014 2015 if (new & IOMMU_NOTIFIER_MAP) { 2016 error_setg(errp, 2017 "device %02x.%02x.%x requires iommu MAP notifier which is " 2018 "not currently supported", pci_bus_num(sdev->bus), 2019 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn)); 2020 return -EINVAL; 2021 } 2022 2023 if (old == IOMMU_NOTIFIER_NONE) { 2024 trace_smmuv3_notify_flag_add(iommu->parent_obj.name); 2025 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next); 2026 } else if (new == IOMMU_NOTIFIER_NONE) { 2027 trace_smmuv3_notify_flag_del(iommu->parent_obj.name); 2028 QLIST_REMOVE(sdev, next); 2029 } 2030 return 0; 2031 } 2032 2033 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass, 2034 void *data) 2035 { 2036 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 2037 2038 imrc->translate = smmuv3_translate; 2039 imrc->notify_flag_changed = smmuv3_notify_flag_changed; 2040 } 2041 2042 static const TypeInfo smmuv3_type_info = { 2043 .name = TYPE_ARM_SMMUV3, 2044 .parent = TYPE_ARM_SMMU, 2045 .instance_size = sizeof(SMMUv3State), 2046 .instance_init = smmuv3_instance_init, 2047 .class_size = sizeof(SMMUv3Class), 2048 .class_init = smmuv3_class_init, 2049 }; 2050 2051 static const TypeInfo smmuv3_iommu_memory_region_info = { 2052 .parent = TYPE_IOMMU_MEMORY_REGION, 2053 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION, 2054 .class_init = smmuv3_iommu_memory_region_class_init, 2055 }; 2056 2057 static void smmuv3_register_types(void) 2058 { 2059 type_register_static(&smmuv3_type_info); 2060 type_register_static(&smmuv3_iommu_memory_region_info); 2061 } 2062 2063 type_init(smmuv3_register_types) 2064 2065