master
c 2,290 lines 70.8 KB
Raw
1 /*
2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include "qemu/osdep.h"
20 #include "qemu/bitops.h"
21 #include "hw/core/irq.h"
22 #include "hw/core/sysbus.h"
23 #include "hw/core/qdev-properties-system.h"
24 #include "migration/blocker.h"
25 #include "migration/vmstate.h"
26 #include "hw/core/qdev-properties.h"
27 #include "hw/core/qdev.h"
28 #include "hw/pci/pci.h"
29 #include "target/arm/cpu.h"
30 #include "exec/target_page.h"
31 #include "trace.h"
32 #include "qemu/log.h"
33 #include "qemu/error-report.h"
34 #include "qapi/error.h"
35
36 #include "hw/arm/smmuv3.h"
37 #include "smmuv3-accel.h"
38 #include "smmuv3-internal.h"
39 #include "smmu-internal.h"
40
41 #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
42 (cfg)->record_faults) || \
43 ((ptw_info).stage == SMMU_STAGE_2 && \
44 (cfg)->s2cfg.record_faults))
45
46 /**
47 * smmuv3_trigger_irq - pulse @irq if enabled and update
48 * GERROR register in case of GERROR interrupt
49 *
50 * @irq: irq type
51 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
52 */
53 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
54 uint32_t gerror_mask)
55 {
56
57 bool pulse = false;
58
59 switch (irq) {
60 case SMMU_IRQ_EVTQ:
61 pulse = smmuv3_eventq_irq_enabled(s);
62 break;
63 case SMMU_IRQ_PRIQ:
64 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
65 break;
66 case SMMU_IRQ_CMD_SYNC:
67 pulse = true;
68 break;
69 case SMMU_IRQ_GERROR:
70 {
71 uint32_t pending = s->gerror ^ s->gerrorn;
72 uint32_t new_gerrors = ~pending & gerror_mask;
73
74 if (!new_gerrors) {
75 /* only toggle non pending errors */
76 return;
77 }
78 s->gerror ^= new_gerrors;
79 trace_smmuv3_write_gerror(new_gerrors, s->gerror);
80
81 pulse = smmuv3_gerror_irq_enabled(s);
82 break;
83 }
84 }
85 if (pulse) {
86 trace_smmuv3_trigger_irq(irq);
87 qemu_irq_pulse(s->irq[irq]);
88 }
89 }
90
91 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
92 {
93 uint32_t pending = s->gerror ^ s->gerrorn;
94 uint32_t toggled = s->gerrorn ^ new_gerrorn;
95
96 if (toggled & ~pending) {
97 qemu_log_mask(LOG_GUEST_ERROR,
98 "guest toggles non pending errors = 0x%x\n",
99 toggled & ~pending);
100 }
101
102 /*
103 * We do not raise any error in case guest toggles bits corresponding
104 * to not active IRQs (CONSTRAINED UNPREDICTABLE)
105 */
106 s->gerrorn = new_gerrorn;
107
108 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
109 }
110
111 static inline MemTxResult queue_read(SMMUQueue *q, Cmd *cmd)
112 {
113 dma_addr_t addr = Q_CONS_ENTRY(q);
114 MemTxResult ret;
115 int i;
116
117 ret = dma_memory_read(&address_space_memory, addr, cmd, sizeof(Cmd),
118 MEMTXATTRS_UNSPECIFIED);
119 if (ret != MEMTX_OK) {
120 return ret;
121 }
122 for (i = 0; i < ARRAY_SIZE(cmd->word); i++) {
123 le32_to_cpus(&cmd->word[i]);
124 }
125 return ret;
126 }
127
128 static MemTxResult queue_write(SMMUQueue *q, Evt *evt_in)
129 {
130 dma_addr_t addr = Q_PROD_ENTRY(q);
131 MemTxResult ret;
132 Evt evt = *evt_in;
133 int i;
134
135 for (i = 0; i < ARRAY_SIZE(evt.word); i++) {
136 cpu_to_le32s(&evt.word[i]);
137 }
138 ret = dma_memory_write(&address_space_memory, addr, &evt, sizeof(Evt),
139 MEMTXATTRS_UNSPECIFIED);
140 if (ret != MEMTX_OK) {
141 return ret;
142 }
143
144 queue_prod_incr(q);
145 return MEMTX_OK;
146 }
147
148 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
149 {
150 SMMUQueue *q = &s->eventq;
151 MemTxResult r;
152
153 if (!smmuv3_eventq_enabled(s)) {
154 return MEMTX_ERROR;
155 }
156
157 if (smmuv3_q_full(q)) {
158 return MEMTX_ERROR;
159 }
160
161 r = queue_write(q, evt);
162 if (r != MEMTX_OK) {
163 return r;
164 }
165
166 if (!smmuv3_q_empty(q)) {
167 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
168 }
169 return MEMTX_OK;
170 }
171
172 void smmuv3_propagate_event(SMMUv3State *s, Evt *evt)
173 {
174 MemTxResult r;
175
176 trace_smmuv3_propagate_event(smmu_event_string(EVT_GET_TYPE(evt)),
177 EVT_GET_SID(evt));
178 QEMU_LOCK_GUARD(&s->mutex);
179 r = smmuv3_write_eventq(s, evt);
180 if (r != MEMTX_OK) {
181 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
182 }
183 }
184
185 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
186 {
187 Evt evt = {};
188
189 if (!smmuv3_eventq_enabled(s)) {
190 return;
191 }
192
193 EVT_SET_TYPE(&evt, info->type);
194 EVT_SET_SID(&evt, info->sid);
195
196 switch (info->type) {
197 case SMMU_EVT_NONE:
198 return;
199 case SMMU_EVT_F_UUT:
200 EVT_SET_SSID(&evt, info->u.f_uut.ssid);
201 EVT_SET_SSV(&evt, info->u.f_uut.ssv);
202 EVT_SET_ADDR(&evt, info->u.f_uut.addr);
203 EVT_SET_RNW(&evt, info->u.f_uut.rnw);
204 EVT_SET_PNU(&evt, info->u.f_uut.pnu);
205 EVT_SET_IND(&evt, info->u.f_uut.ind);
206 break;
207 case SMMU_EVT_C_BAD_STREAMID:
208 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
209 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv);
210 break;
211 case SMMU_EVT_F_STE_FETCH:
212 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
213 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv);
214 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
215 break;
216 case SMMU_EVT_C_BAD_STE:
217 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
218 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv);
219 break;
220 case SMMU_EVT_F_STREAM_DISABLED:
221 break;
222 case SMMU_EVT_F_TRANS_FORBIDDEN:
223 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
224 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
225 break;
226 case SMMU_EVT_C_BAD_SUBSTREAMID:
227 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
228 break;
229 case SMMU_EVT_F_CD_FETCH:
230 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
231 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv);
232 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
233 break;
234 case SMMU_EVT_C_BAD_CD:
235 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
236 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv);
237 break;
238 case SMMU_EVT_F_WALK_EABT:
239 case SMMU_EVT_F_TRANSLATION:
240 case SMMU_EVT_F_ADDR_SIZE:
241 case SMMU_EVT_F_ACCESS:
242 case SMMU_EVT_F_PERMISSION:
243 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
244 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
245 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
246 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
247 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
248 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
249 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
250 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
251 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
252 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
253 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
254 break;
255 case SMMU_EVT_F_CFG_CONFLICT:
256 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
257 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv);
258 break;
259 /* rest is not implemented */
260 case SMMU_EVT_F_BAD_ATS_TREQ:
261 case SMMU_EVT_F_TLB_CONFLICT:
262 case SMMU_EVT_E_PAGE_REQ:
263 default:
264 g_assert_not_reached();
265 }
266
267 smmuv3_propagate_event(s, &evt);
268 info->recorded = true;
269 }
270
271 /*
272 * Called during realize(), as the ID registers will be accessed early in the
273 * SMMUv3 accel path for feature compatibility checks. The remaining registers
274 * are initialized later in smmuv3_reset().
275 */
276 static void smmuv3_init_id_regs(SMMUv3State *s)
277 {
278 /* Based on sys property, the stages supported in smmu will be advertised.*/
279 if (s->stage && !strcmp("2", s->stage)) {
280 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
281 } else if (s->stage && !strcmp("nested", s->stage)) {
282 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
283 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
284 } else {
285 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
286 }
287
288 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
289 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
290 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
291 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
292 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
293 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
294 /* terminated transaction will always be aborted/error returned */
295 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
296 /* 2-level stream table supported */
297 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
298
299 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
300 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
301 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS);
302
303 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
304 if (FIELD_EX32(s->idr[0], IDR0, S2P)) {
305 /* XNX is a stage-2-specific feature */
306 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, XNX, 1);
307 }
308 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
309 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2);
310
311 /* OAS: 44 bits */
312 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS_44);
313 /* 4K, 16K and 64K granule support */
314 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
315 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1);
316 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
317 s->aidr = 0x1;
318 smmuv3_accel_idr_override(s);
319 }
320
321 bool smmuv3_ats_enabled(SMMUv3State *s)
322 {
323 return FIELD_EX32(s->idr[0], IDR0, ATS);
324 }
325
326 static void smmuv3_reset(SMMUv3State *s)
327 {
328 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
329 s->cmdq.prod = 0;
330 s->cmdq.cons = 0;
331 s->cmdq.entry_size = sizeof(struct Cmd);
332 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
333 s->eventq.prod = 0;
334 s->eventq.cons = 0;
335 s->eventq.entry_size = sizeof(struct Evt);
336
337 s->features = 0;
338 s->sid_split = 0;
339 s->cr[0] = 0;
340 s->cr0ack = 0;
341 s->irq_ctrl = 0;
342 s->gerror = 0;
343 s->gerrorn = 0;
344 s->statusr = 0;
345 s->gbpa = SMMU_GBPA_RESET_VAL;
346 }
347
348 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
349 SMMUEventInfo *event)
350 {
351 int ret, i;
352
353 trace_smmuv3_get_ste(addr);
354 /* TODO: guarantee 64-bit single-copy atomicity */
355 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf),
356 MEMTXATTRS_UNSPECIFIED);
357 if (ret != MEMTX_OK) {
358 qemu_log_mask(LOG_GUEST_ERROR,
359 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
360 event->type = SMMU_EVT_F_STE_FETCH;
361 event->u.f_ste_fetch.addr = addr;
362 return -EINVAL;
363 }
364 for (i = 0; i < ARRAY_SIZE(buf->word); i++) {
365 le32_to_cpus(&buf->word[i]);
366 }
367 return 0;
368
369 }
370
371 static SMMUTranslationStatus smmuv3_do_translate(SMMUv3State *s, hwaddr addr,
372 SMMUTransCfg *cfg,
373 SMMUEventInfo *event,
374 IOMMUAccessFlags flag,
375 SMMUTLBEntry **out_entry,
376 SMMUTranslationClass class);
377 /* @ssid > 0 not supported yet */
378 static int smmu_get_cd(SMMUv3State *s, STE *ste, SMMUTransCfg *cfg,
379 uint32_t ssid, CD *buf, SMMUEventInfo *event)
380 {
381 dma_addr_t addr = STE_CTXPTR(ste);
382 int ret, i;
383 SMMUTranslationStatus status;
384 SMMUTLBEntry *entry;
385
386 trace_smmuv3_get_cd(addr);
387
388 if (cfg->stage == SMMU_NESTED) {
389 status = smmuv3_do_translate(s, addr, cfg, event,
390 IOMMU_RO, &entry, SMMU_CLASS_CD);
391
392 /* Same PTW faults are reported but with CLASS = CD. */
393 if (status != SMMU_TRANS_SUCCESS) {
394 return -EINVAL;
395 }
396
397 addr = CACHED_ENTRY_TO_ADDR(entry, addr);
398 }
399
400 /* TODO: guarantee 64-bit single-copy atomicity */
401 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf),
402 MEMTXATTRS_UNSPECIFIED);
403 if (ret != MEMTX_OK) {
404 qemu_log_mask(LOG_GUEST_ERROR,
405 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
406 event->type = SMMU_EVT_F_CD_FETCH;
407 event->u.f_cd_fetch.addr = addr;
408 return -EINVAL;
409 }
410 for (i = 0; i < ARRAY_SIZE(buf->word); i++) {
411 le32_to_cpus(&buf->word[i]);
412 }
413 return 0;
414 }
415
416 /*
417 * Max valid value is 39 when SMMU_IDR3.STT == 0.
418 * In architectures after SMMUv3.0:
419 * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
420 * field is MAX(16, 64-IAS)
421 * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
422 * is (64-IAS).
423 * As we only support AA64, IAS = OAS.
424 */
425 static bool s2t0sz_valid(SMMUTransCfg *cfg)
426 {
427 if (cfg->s2cfg.tsz > 39) {
428 return false;
429 }
430
431 if (cfg->s2cfg.granule_sz == 16) {
432 return (cfg->s2cfg.tsz >= 64 - cfg->s2cfg.eff_ps);
433 }
434
435 return (cfg->s2cfg.tsz >= MAX(64 - cfg->s2cfg.eff_ps, 16));
436 }
437
438 /*
439 * Return true if s2 page table config is valid.
440 * This checks with the configured start level, ias_bits and granularity we can
441 * have a valid page table as described in ARM ARM D8.2 Translation process.
442 * The idea here is to see for the highest possible number of IPA bits, how
443 * many concatenated tables we would need, if it is more than 16, then this is
444 * not possible.
445 */
446 static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
447 {
448 int level = get_start_level(sl0, gran);
449 uint64_t ipa_bits = 64 - t0sz;
450 uint64_t max_ipa = (1ULL << ipa_bits) - 1;
451 int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
452
453 return nr_concat <= VMSA_MAX_S2_CONCAT;
454 }
455
456 static int decode_ste_s2_cfg(SMMUv3State *s, SMMUTransCfg *cfg,
457 STE *ste)
458 {
459 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS);
460
461 if (STE_S2AA64(ste) == 0x0) {
462 qemu_log_mask(LOG_UNIMP,
463 "SMMUv3 AArch32 tables not supported\n");
464 g_assert_not_reached();
465 }
466
467 switch (STE_S2TG(ste)) {
468 case 0x0: /* 4KB */
469 cfg->s2cfg.granule_sz = 12;
470 break;
471 case 0x1: /* 64KB */
472 cfg->s2cfg.granule_sz = 16;
473 break;
474 case 0x2: /* 16KB */
475 cfg->s2cfg.granule_sz = 14;
476 break;
477 default:
478 qemu_log_mask(LOG_GUEST_ERROR,
479 "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
480 goto bad_ste;
481 }
482
483 cfg->s2cfg.vttb = STE_S2TTB(ste);
484
485 cfg->s2cfg.sl0 = STE_S2SL0(ste);
486 /* FEAT_TTST not supported. */
487 if (cfg->s2cfg.sl0 == 0x3) {
488 qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
489 goto bad_ste;
490 }
491
492 /* For AA64, The effective S2PS size is capped to the OAS. */
493 cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), oas));
494 /*
495 * For SMMUv3.1 and later, when OAS == IAS == 52, the stage 2 input
496 * range is further limited to 48 bits unless STE.S2TG indicates a
497 * 64KB granule.
498 */
499 if (cfg->s2cfg.granule_sz != 16) {
500 cfg->s2cfg.eff_ps = MIN(cfg->s2cfg.eff_ps, 48);
501 }
502 /*
503 * It is ILLEGAL for the address in S2TTB to be outside the range
504 * described by the effective S2PS value.
505 */
506 if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
507 qemu_log_mask(LOG_GUEST_ERROR,
508 "SMMUv3 S2TTB too large 0x%" PRIx64
509 ", effective PS %d bits\n",
510 cfg->s2cfg.vttb, cfg->s2cfg.eff_ps);
511 goto bad_ste;
512 }
513
514 cfg->s2cfg.tsz = STE_S2T0SZ(ste);
515
516 if (!s2t0sz_valid(cfg)) {
517 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
518 cfg->s2cfg.tsz);
519 goto bad_ste;
520 }
521
522 if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
523 cfg->s2cfg.granule_sz)) {
524 qemu_log_mask(LOG_GUEST_ERROR,
525 "SMMUv3 STE stage 2 config not valid!\n");
526 goto bad_ste;
527 }
528
529 /* Only LE supported(IDR0.TTENDIAN). */
530 if (STE_S2ENDI(ste)) {
531 qemu_log_mask(LOG_GUEST_ERROR,
532 "SMMUv3 STE_S2ENDI only supports LE!\n");
533 goto bad_ste;
534 }
535
536 cfg->s2cfg.affd = STE_S2AFFD(ste);
537
538 cfg->s2cfg.record_faults = STE_S2R(ste);
539 /* As stall is not supported. */
540 if (STE_S2S(ste)) {
541 qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
542 goto bad_ste;
543 }
544
545 return 0;
546
547 bad_ste:
548 return -EINVAL;
549 }
550
551 static void decode_ste_config(SMMUTransCfg *cfg, uint32_t config)
552 {
553
554 if (STE_CFG_ABORT(config)) {
555 cfg->aborted = true;
556 return;
557 }
558 if (STE_CFG_BYPASS(config)) {
559 cfg->bypassed = true;
560 return;
561 }
562
563 if (STE_CFG_S1_ENABLED(config)) {
564 cfg->stage = SMMU_STAGE_1;
565 }
566
567 if (STE_CFG_S2_ENABLED(config)) {
568 cfg->stage |= SMMU_STAGE_2;
569 }
570 }
571
572 /* Returns < 0 in case of invalid STE, 0 otherwise */
573 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
574 STE *ste, SMMUEventInfo *event)
575 {
576 uint32_t config;
577 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS);
578 int ret;
579
580 if (!STE_VALID(ste)) {
581 if (!event->inval_ste_allowed) {
582 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n");
583 }
584 goto bad_ste;
585 }
586
587 config = STE_CONFIG(ste);
588
589 decode_ste_config(cfg, config);
590
591 if (cfg->aborted || cfg->bypassed) {
592 return 0;
593 }
594
595 /*
596 * If a stage is enabled in SW while not advertised, throw bad ste
597 * according to user manual(IHI0070E) "5.2 Stream Table Entry".
598 */
599 if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
600 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
601 goto bad_ste;
602 }
603 if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
604 qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
605 goto bad_ste;
606 }
607
608 if (STAGE2_SUPPORTED(s)) {
609 /* VMID is considered even if s2 is disabled. */
610 cfg->s2cfg.vmid = STE_S2VMID(ste);
611 } else {
612 /* Default to -1 */
613 cfg->s2cfg.vmid = -1;
614 }
615
616 if (STE_CFG_S2_ENABLED(config)) {
617 /*
618 * Stage-1 OAS defaults to OAS even if not enabled as it would be used
619 * in input address check for stage-2.
620 */
621 cfg->oas = oas2bits(oas);
622 ret = decode_ste_s2_cfg(s, cfg, ste);
623 if (ret) {
624 goto bad_ste;
625 }
626 }
627
628 /* Multiple context descriptors require SubstreamID support */
629 if ((s->ssidsize == SSID_SIZE_MODE_0 ||
630 (s->ssidsize == SSID_SIZE_MODE_AUTO &&
631 !FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) &&
632 STE_S1CDMAX(ste) != 0) {
633 qemu_log_mask(LOG_UNIMP,
634 "SMMUv3: multiple S1 context descriptors require SubstreamID support. "
635 "Configure ssidsize > 0 (requires accel=on)\n");
636 goto bad_ste;
637 }
638
639 if (STE_S1STALLD(ste)) {
640 qemu_log_mask(LOG_UNIMP,
641 "SMMUv3 S1 stalling fault model not allowed yet\n");
642 goto bad_ste;
643 }
644 return 0;
645
646 bad_ste:
647 event->type = SMMU_EVT_C_BAD_STE;
648 return -EINVAL;
649 }
650
651 /**
652 * smmu_find_ste - Return the stream table entry associated
653 * to the sid
654 *
655 * @s: smmuv3 handle
656 * @sid: stream ID
657 * @ste: returned stream table entry
658 * @event: handle to an event info
659 *
660 * Supports linear and 2-level stream table
661 * Return 0 on success, -EINVAL otherwise
662 */
663 int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
664 {
665 dma_addr_t addr, strtab_base;
666 uint32_t log2size;
667 int strtab_size;
668 int ret;
669
670 trace_smmuv3_find_ste(sid, s->features, s->sid_split);
671 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
672 /*
673 * Check SID range against both guest-configured and implementation limits
674 */
675 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
676 event->type = SMMU_EVT_C_BAD_STREAMID;
677 return -EINVAL;
678 }
679 if (s->features & SMMU_FEATURE_2LVL_STE) {
680 int l1_ste_offset, l2_ste_offset, max_l2_ste, span, i;
681 dma_addr_t l1ptr, l2ptr;
682 STEDesc l1std;
683
684 /*
685 * Align strtab base address to table size. For this purpose, assume it
686 * is not bounded by SMMU_IDR1_SIDSIZE.
687 */
688 strtab_size = MAX(6, (int)log2size - s->sid_split + L1STD_SIZE);
689 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
690 ~MAKE_64BIT_MASK(0, strtab_size);
691 l1_ste_offset = sid >> s->sid_split;
692 l2_ste_offset = sid & ((1 << s->sid_split) - 1);
693 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
694 /* TODO: guarantee 64-bit single-copy atomicity */
695 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std,
696 sizeof(l1std), MEMTXATTRS_UNSPECIFIED);
697 if (ret != MEMTX_OK) {
698 qemu_log_mask(LOG_GUEST_ERROR,
699 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
700 event->type = SMMU_EVT_F_STE_FETCH;
701 event->u.f_ste_fetch.addr = l1ptr;
702 return -EINVAL;
703 }
704 for (i = 0; i < ARRAY_SIZE(l1std.word); i++) {
705 le32_to_cpus(&l1std.word[i]);
706 }
707
708 span = L1STD_SPAN(&l1std);
709
710 if (!span || span > 11) {
711 /* l2ptr is not valid */
712 if (!event->inval_ste_allowed) {
713 qemu_log_mask(LOG_GUEST_ERROR,
714 "invalid sid=%d (L1STD span=0)\n", sid);
715 }
716 event->type = SMMU_EVT_C_BAD_STREAMID;
717 return -EINVAL;
718 }
719
720 if (span > s->sid_split + 1) {
721 if (!event->inval_ste_allowed) {
722 qemu_log_mask(LOG_GUEST_ERROR,
723 "invalid span (0x%x)\n", span);
724 }
725 event->type = SMMU_EVT_C_BAD_STREAMID;
726 return -EINVAL;
727 }
728
729 max_l2_ste = (1 << span) - 1;
730 l2ptr = l1std_l2ptr(&l1std);
731
732 l2ptr &= ~MAKE_64BIT_MASK(0, 6 + (span - 1));
733 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
734 l2ptr, l2_ste_offset, max_l2_ste);
735 if (l2_ste_offset > max_l2_ste) {
736 qemu_log_mask(LOG_GUEST_ERROR,
737 "l2_ste_offset=%d > max_l2_ste=%d\n",
738 l2_ste_offset, max_l2_ste);
739 event->type = SMMU_EVT_C_BAD_STE;
740 return -EINVAL;
741 }
742 addr = l2ptr + l2_ste_offset * sizeof(*ste);
743 } else {
744 strtab_size = log2size + STE_SIZE;
745 strtab_size = MIN(64, strtab_size);
746 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
747 ~MAKE_64BIT_MASK(0, strtab_size);
748 addr = strtab_base + sid * sizeof(*ste);
749 }
750
751 if (smmu_get_ste(s, addr, ste, event)) {
752 return -EINVAL;
753 }
754
755 return 0;
756 }
757
758 static int decode_cd(SMMUv3State *s, SMMUTransCfg *cfg,
759 CD *cd, SMMUEventInfo *event)
760 {
761 int ret = -EINVAL;
762 int i;
763 SMMUTranslationStatus status;
764 SMMUTLBEntry *entry;
765 uint8_t oas = FIELD_EX32(s->idr[5], IDR5, OAS);
766
767 if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
768 goto bad_cd;
769 }
770 if (!CD_A(cd)) {
771 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
772 }
773 if (CD_S(cd)) {
774 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
775 }
776 if (CD_HA(cd) || CD_HD(cd)) {
777 goto bad_cd; /* HTTU = 0 */
778 }
779
780 /* we support only those at the moment */
781 cfg->aa64 = true;
782
783 cfg->oas = oas2bits(CD_IPS(cd));
784 cfg->oas = MIN(oas2bits(oas), cfg->oas);
785 cfg->tbi = CD_TBI(cd);
786 cfg->asid = CD_ASID(cd);
787 cfg->affd = CD_AFFD(cd);
788
789 trace_smmuv3_decode_cd(cfg->oas);
790
791 /* decode data dependent on TT */
792 for (i = 0; i <= 1; i++) {
793 int tg, tsz;
794 SMMUTransTableInfo *tt = &cfg->tt[i];
795
796 cfg->tt[i].disabled = CD_EPD(cd, i);
797 if (cfg->tt[i].disabled) {
798 continue;
799 }
800
801 tsz = CD_TSZ(cd, i);
802 if (tsz < 16 || tsz > 39) {
803 goto bad_cd;
804 }
805
806 tg = CD_TG(cd, i);
807 tt->granule_sz = tg2granule(tg, i);
808 if ((tt->granule_sz != 12 && tt->granule_sz != 14 &&
809 tt->granule_sz != 16) || CD_ENDI(cd)) {
810 goto bad_cd;
811 }
812
813 /*
814 * An address greater than 48 bits in size can only be output from a
815 * TTD when, in SMMUv3.1 and later, the effective IPS is 52 and a 64KB
816 * granule is in use for that translation table
817 */
818 if (tt->granule_sz != 16) {
819 cfg->oas = MIN(cfg->oas, 48);
820 }
821 tt->tsz = tsz;
822 tt->ttb = CD_TTB(cd, i);
823
824 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
825 goto bad_cd;
826 }
827
828 /* Translate the TTBx, from IPA to PA if nesting is enabled. */
829 if (cfg->stage == SMMU_NESTED) {
830 status = smmuv3_do_translate(s, tt->ttb, cfg, event, IOMMU_RO,
831 &entry, SMMU_CLASS_TT);
832 /*
833 * Same PTW faults are reported but with CLASS = TT.
834 * If TTBx is larger than the effective stage 1 output addres
835 * size, it reports C_BAD_CD, which is handled by the above case.
836 */
837 if (status != SMMU_TRANS_SUCCESS) {
838 return -EINVAL;
839 }
840 tt->ttb = CACHED_ENTRY_TO_ADDR(entry, tt->ttb);
841 }
842
843 tt->had = CD_HAD(cd, i);
844 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had);
845 }
846
847 cfg->record_faults = CD_R(cd);
848
849 return 0;
850
851 bad_cd:
852 event->type = SMMU_EVT_C_BAD_CD;
853 return ret;
854 }
855
856 /**
857 * smmuv3_decode_config - Prepare the translation configuration
858 * for the @mr iommu region
859 * @mr: iommu memory region the translation config must be prepared for
860 * @cfg: output translation configuration which is populated through
861 * the different configuration decoding steps
862 * @event: must be zero'ed by the caller
863 *
864 * return < 0 in case of config decoding error (@event is filled
865 * accordingly). Return 0 otherwise.
866 */
867 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
868 SMMUEventInfo *event)
869 {
870 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
871 uint32_t sid = smmu_get_sid(sdev);
872 SMMUv3State *s = sdev->smmu;
873 int ret;
874 STE ste;
875 CD cd;
876
877 /* ASID defaults to -1 (if s1 is not supported). */
878 cfg->asid = -1;
879
880 ret = smmu_find_ste(s, sid, &ste, event);
881 if (ret) {
882 return ret;
883 }
884
885 ret = decode_ste(s, cfg, &ste, event);
886 if (ret) {
887 return ret;
888 }
889
890 if (cfg->aborted || cfg->bypassed || (cfg->stage == SMMU_STAGE_2)) {
891 return 0;
892 }
893
894 ret = smmu_get_cd(s, &ste, cfg, 0 /* ssid */, &cd, event);
895 if (ret) {
896 return ret;
897 }
898
899 return decode_cd(s, cfg, &cd, event);
900 }
901
902 /**
903 * smmuv3_get_config - Look up for a cached copy of configuration data for
904 * @sdev and on cache miss performs a configuration structure decoding from
905 * guest RAM.
906 *
907 * @sdev: SMMUDevice handle
908 * @event: output event info
909 *
910 * The configuration cache contains data resulting from both STE and CD
911 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed
912 * by the SMMUDevice handle.
913 */
914 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event)
915 {
916 SMMUv3State *s = sdev->smmu;
917 SMMUState *bc = &s->smmu_state;
918 SMMUTransCfg *cfg;
919
920 cfg = g_hash_table_lookup(bc->configs, sdev);
921 if (cfg) {
922 sdev->cfg_cache_hits++;
923 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev),
924 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
925 100 * sdev->cfg_cache_hits /
926 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
927 } else {
928 sdev->cfg_cache_misses++;
929 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev),
930 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
931 100 * sdev->cfg_cache_hits /
932 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
933 cfg = g_new0(SMMUTransCfg, 1);
934
935 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) {
936 g_hash_table_insert(bc->configs, sdev, cfg);
937 } else {
938 g_free(cfg);
939 cfg = NULL;
940 }
941 }
942 return cfg;
943 }
944
945 static void smmuv3_flush_config(SMMUDevice *sdev)
946 {
947 SMMUv3State *s = sdev->smmu;
948 SMMUState *bc = &s->smmu_state;
949
950 trace_smmu_config_cache_inv(smmu_get_sid(sdev));
951 g_hash_table_remove(bc->configs, sdev);
952 }
953
954 /* Do translation with TLB lookup. */
955 static SMMUTranslationStatus smmuv3_do_translate(SMMUv3State *s, hwaddr addr,
956 SMMUTransCfg *cfg,
957 SMMUEventInfo *event,
958 IOMMUAccessFlags flag,
959 SMMUTLBEntry **out_entry,
960 SMMUTranslationClass class)
961 {
962 SMMUPTWEventInfo ptw_info = {};
963 SMMUState *bs = ARM_SMMU(s);
964 SMMUTLBEntry *cached_entry = NULL;
965 int asid, stage;
966 bool desc_s2_translation = class != SMMU_CLASS_IN;
967
968 /*
969 * The function uses the argument class to identify which stage is used:
970 * - CLASS = IN: Means an input translation, determine the stage from STE.
971 * - CLASS = CD: Means the addr is an IPA of the CD, and it would be
972 * translated using the stage-2.
973 * - CLASS = TT: Means the addr is an IPA of the stage-1 translation table
974 * and it would be translated using the stage-2.
975 * For the last 2 cases instead of having intrusive changes in the common
976 * logic, we modify the cfg to be a stage-2 translation only in case of
977 * nested, and then restore it after.
978 */
979 if (desc_s2_translation) {
980 asid = cfg->asid;
981 stage = cfg->stage;
982 cfg->asid = -1;
983 cfg->stage = SMMU_STAGE_2;
984 }
985
986 cached_entry = smmu_translate(bs, cfg, addr, flag, &ptw_info);
987
988 if (desc_s2_translation) {
989 cfg->asid = asid;
990 cfg->stage = stage;
991 }
992
993 if (!cached_entry) {
994 /* All faults from PTW has S2 field. */
995 event->u.f_walk_eabt.s2 = (ptw_info.stage == SMMU_STAGE_2);
996 /*
997 * Fault class is set as follows based on "class" input to
998 * the function and to "ptw_info" from "smmu_translate()"
999 * For stage-1:
1000 * - EABT => CLASS_TT (hardcoded)
1001 * - other events => CLASS_IN (input to function)
1002 * For stage-2 => CLASS_IN (input to function)
1003 * For nested, for all events:
1004 * - CD fetch => CLASS_CD (input to function)
1005 * - walking stage 1 translation table => CLASS_TT (from
1006 * is_ipa_descriptor or input in case of TTBx)
1007 * - s2 translation => CLASS_IN (input to function)
1008 */
1009 class = ptw_info.is_ipa_descriptor ? SMMU_CLASS_TT : class;
1010 switch (ptw_info.type) {
1011 case SMMU_PTW_ERR_WALK_EABT:
1012 event->type = SMMU_EVT_F_WALK_EABT;
1013 event->u.f_walk_eabt.rnw = flag & 0x1;
1014 event->u.f_walk_eabt.class = (ptw_info.stage == SMMU_STAGE_2) ?
1015 class : SMMU_CLASS_TT;
1016 event->u.f_walk_eabt.addr2 = ptw_info.addr;
1017 break;
1018 case SMMU_PTW_ERR_TRANSLATION:
1019 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
1020 event->type = SMMU_EVT_F_TRANSLATION;
1021 event->u.f_translation.addr2 = ptw_info.addr;
1022 event->u.f_translation.class = class;
1023 event->u.f_translation.rnw = flag & 0x1;
1024 }
1025 break;
1026 case SMMU_PTW_ERR_ADDR_SIZE:
1027 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
1028 event->type = SMMU_EVT_F_ADDR_SIZE;
1029 event->u.f_addr_size.addr2 = ptw_info.addr;
1030 event->u.f_addr_size.class = class;
1031 event->u.f_addr_size.rnw = flag & 0x1;
1032 }
1033 break;
1034 case SMMU_PTW_ERR_ACCESS:
1035 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
1036 event->type = SMMU_EVT_F_ACCESS;
1037 event->u.f_access.addr2 = ptw_info.addr;
1038 event->u.f_access.class = class;
1039 event->u.f_access.rnw = flag & 0x1;
1040 }
1041 break;
1042 case SMMU_PTW_ERR_PERMISSION:
1043 if (PTW_RECORD_FAULT(ptw_info, cfg)) {
1044 event->type = SMMU_EVT_F_PERMISSION;
1045 event->u.f_permission.addr2 = ptw_info.addr;
1046 event->u.f_permission.class = class;
1047 event->u.f_permission.rnw = flag & 0x1;
1048 }
1049 break;
1050 default:
1051 g_assert_not_reached();
1052 }
1053 return SMMU_TRANS_ERROR;
1054 }
1055 *out_entry = cached_entry;
1056 return SMMU_TRANS_SUCCESS;
1057 }
1058
1059 /*
1060 * Sets the InputAddr for an SMMU_TRANS_ERROR, as it can't be
1061 * set from all contexts, as smmuv3_get_config() can return
1062 * translation faults in case of nested translation (for CD
1063 * and TTBx). But in that case the iova is not known.
1064 */
1065 static void smmuv3_fixup_event(SMMUEventInfo *event, hwaddr iova)
1066 {
1067 switch (event->type) {
1068 case SMMU_EVT_F_WALK_EABT:
1069 case SMMU_EVT_F_TRANSLATION:
1070 case SMMU_EVT_F_ADDR_SIZE:
1071 case SMMU_EVT_F_ACCESS:
1072 case SMMU_EVT_F_PERMISSION:
1073 event->u.f_walk_eabt.addr = iova;
1074 break;
1075 default:
1076 break;
1077 }
1078 }
1079
1080 /* Entry point to SMMU, does everything. */
1081 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
1082 IOMMUAccessFlags flag, int iommu_idx)
1083 {
1084 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
1085 SMMUv3State *s = sdev->smmu;
1086 uint32_t sid = smmu_get_sid(sdev);
1087 SMMUEventInfo event = {.type = SMMU_EVT_NONE,
1088 .sid = sid,
1089 .inval_ste_allowed = false};
1090 SMMUTranslationStatus status;
1091 SMMUTransCfg *cfg = NULL;
1092 IOMMUTLBEntry entry = {
1093 .target_as = &address_space_memory,
1094 .iova = addr,
1095 .translated_addr = addr,
1096 .addr_mask = ~(hwaddr)0,
1097 .perm = IOMMU_NONE,
1098 };
1099 SMMUTLBEntry *cached_entry = NULL;
1100
1101 qemu_mutex_lock(&s->mutex);
1102
1103 if (!smmu_enabled(s)) {
1104 if (FIELD_EX32(s->gbpa, GBPA, ABORT)) {
1105 status = SMMU_TRANS_ABORT;
1106 } else {
1107 status = SMMU_TRANS_DISABLE;
1108 }
1109 goto epilogue;
1110 }
1111
1112 cfg = smmuv3_get_config(sdev, &event);
1113 if (!cfg) {
1114 status = SMMU_TRANS_ERROR;
1115 goto epilogue;
1116 }
1117
1118 if (cfg->aborted) {
1119 status = SMMU_TRANS_ABORT;
1120 goto epilogue;
1121 }
1122
1123 if (cfg->bypassed) {
1124 status = SMMU_TRANS_BYPASS;
1125 goto epilogue;
1126 }
1127
1128 status = smmuv3_do_translate(s, addr, cfg, &event, flag,
1129 &cached_entry, SMMU_CLASS_IN);
1130
1131 epilogue:
1132 qemu_mutex_unlock(&s->mutex);
1133 switch (status) {
1134 case SMMU_TRANS_SUCCESS:
1135 entry.perm = cached_entry->entry.perm;
1136 entry.translated_addr = CACHED_ENTRY_TO_ADDR(cached_entry, addr);
1137 entry.addr_mask = cached_entry->entry.addr_mask;
1138 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr,
1139 entry.translated_addr, entry.perm,
1140 cfg->stage);
1141 break;
1142 case SMMU_TRANS_DISABLE:
1143 entry.perm = flag;
1144 entry.addr_mask = ~TARGET_PAGE_MASK;
1145 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr,
1146 entry.perm);
1147 break;
1148 case SMMU_TRANS_BYPASS:
1149 entry.perm = flag;
1150 entry.addr_mask = ~TARGET_PAGE_MASK;
1151 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr,
1152 entry.perm);
1153 break;
1154 case SMMU_TRANS_ABORT:
1155 /* no event is recorded on abort */
1156 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr,
1157 entry.perm);
1158 break;
1159 case SMMU_TRANS_ERROR:
1160 smmuv3_fixup_event(&event, addr);
1161 qemu_log_mask(LOG_GUEST_ERROR,
1162 "%s translation failed for iova=0x%"PRIx64" (%s)\n",
1163 mr->parent_obj.name, addr, smmu_event_string(event.type));
1164 smmuv3_record_event(s, &event);
1165 break;
1166 }
1167
1168 return entry;
1169 }
1170
1171 /**
1172 * smmuv3_notify_iova - call the notifier @n for a given
1173 * @asid and @iova tuple.
1174 *
1175 * @mr: IOMMU mr region handle
1176 * @n: notifier to be called
1177 * @asid: address space ID or negative value if we don't care
1178 * @vmid: virtual machine ID or negative value if we don't care
1179 * @iova: iova
1180 * @tg: translation granule (if communicated through range invalidation)
1181 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
1182 * @stage: Which stage(1 or 2) is used
1183 */
1184 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
1185 IOMMUNotifier *n,
1186 int asid, int vmid,
1187 dma_addr_t iova, uint8_t tg,
1188 uint64_t num_pages, int stage)
1189 {
1190 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
1191 SMMUEventInfo eventinfo = {.inval_ste_allowed = true};
1192 SMMUTransCfg *cfg = smmuv3_get_config(sdev, &eventinfo);
1193 IOMMUTLBEvent event;
1194 uint8_t granule;
1195
1196 if (!cfg) {
1197 return;
1198 }
1199
1200 /*
1201 * stage is passed from TLB invalidation commands which can be either
1202 * stage-1 or stage-2.
1203 * However, IOMMUTLBEvent only understands IOVA, for stage-1 or stage-2
1204 * SMMU instances we consider the input address as the IOVA, but when
1205 * nesting is used, we can't mix stage-1 and stage-2 addresses, so for
1206 * nesting only stage-1 is considered the IOVA and would be notified.
1207 */
1208 if ((stage == SMMU_STAGE_2) && (cfg->stage == SMMU_NESTED))
1209 return;
1210
1211 if (!tg) {
1212 SMMUTransTableInfo *tt;
1213
1214 if (asid >= 0 && cfg->asid != asid) {
1215 return;
1216 }
1217
1218 if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
1219 return;
1220 }
1221
1222 if (stage == SMMU_STAGE_1) {
1223 tt = select_tt(cfg, iova);
1224 if (!tt) {
1225 return;
1226 }
1227 granule = tt->granule_sz;
1228 } else {
1229 granule = cfg->s2cfg.granule_sz;
1230 }
1231
1232 } else {
1233 granule = tg * 2 + 10;
1234 }
1235
1236 event.type = IOMMU_NOTIFIER_UNMAP;
1237 event.entry.target_as = &address_space_memory;
1238 event.entry.iova = iova;
1239 event.entry.addr_mask = num_pages * (1 << granule) - 1;
1240 event.entry.perm = IOMMU_NONE;
1241
1242 memory_region_notify_iommu_one(n, &event);
1243 }
1244
1245 /* invalidate an asid/vmid/iova range tuple in all mr's */
1246 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
1247 dma_addr_t iova, uint8_t tg,
1248 uint64_t num_pages, int stage)
1249 {
1250 SMMUDevice *sdev;
1251
1252 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
1253 IOMMUMemoryRegion *mr = &sdev->iommu;
1254 IOMMUNotifier *n;
1255
1256 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
1257 iova, tg, num_pages, stage);
1258
1259 IOMMU_NOTIFIER_FOREACH(n, mr) {
1260 smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages, stage);
1261 }
1262 }
1263 }
1264
1265 static void smmuv3_range_inval(SMMUState *s, Cmd *cmd, SMMUStage stage)
1266 {
1267 dma_addr_t end, addr = CMD_ADDR(cmd);
1268 uint8_t type = CMD_TYPE(cmd);
1269 int vmid = -1;
1270 uint8_t scale = CMD_SCALE(cmd);
1271 uint8_t num = CMD_NUM(cmd);
1272 uint8_t ttl = CMD_TTL(cmd);
1273 bool leaf = CMD_LEAF(cmd);
1274 uint8_t tg = CMD_TG(cmd);
1275 uint64_t num_pages;
1276 uint8_t granule;
1277 int asid = -1;
1278 SMMUv3State *smmuv3 = ARM_SMMUV3(s);
1279
1280 /* Only consider VMID if stage-2 is supported. */
1281 if (STAGE2_SUPPORTED(smmuv3)) {
1282 vmid = CMD_VMID(cmd);
1283 }
1284
1285 if (type == SMMU_CMD_TLBI_NH_VA) {
1286 asid = CMD_ASID(cmd);
1287 }
1288
1289 if (!tg) {
1290 trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf, stage);
1291 smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1, stage);
1292 if (stage == SMMU_STAGE_1) {
1293 smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
1294 } else {
1295 smmu_iotlb_inv_ipa(s, vmid, addr, tg, 1, ttl);
1296 }
1297 return;
1298 }
1299
1300 /* RIL in use */
1301
1302 num_pages = (num + 1) * BIT_ULL(scale);
1303 granule = tg * 2 + 10;
1304
1305 /* Split invalidations into ^2 range invalidations */
1306 end = addr + (num_pages << granule) - 1;
1307
1308 while (addr != end + 1) {
1309 uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
1310
1311 num_pages = (mask + 1) >> granule;
1312 trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages,
1313 ttl, leaf, stage);
1314 smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages, stage);
1315 if (stage == SMMU_STAGE_1) {
1316 smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
1317 } else {
1318 smmu_iotlb_inv_ipa(s, vmid, addr, tg, num_pages, ttl);
1319 }
1320 addr += mask + 1;
1321 }
1322 }
1323
1324 static int smmuv3_cmdq_consume(SMMUv3State *s, Error **errp)
1325 {
1326 SMMUState *bs = ARM_SMMU(s);
1327 SMMUCmdError cmd_error = SMMU_CERROR_NONE;
1328 SMMUQueue *q = &s->cmdq;
1329 SMMUCommandType type = 0;
1330
1331 if (!smmuv3_cmdq_enabled(s)) {
1332 return 0;
1333 }
1334 /*
1335 * some commands depend on register values, typically CR0. In case those
1336 * register values change while handling the command, spec says it
1337 * is UNPREDICTABLE whether the command is interpreted under the new
1338 * or old value.
1339 */
1340
1341 while (!smmuv3_q_empty(q)) {
1342 uint32_t pending = s->gerror ^ s->gerrorn;
1343 Cmd cmd;
1344
1345 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
1346 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1347
1348 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
1349 break;
1350 }
1351
1352 if (queue_read(q, &cmd) != MEMTX_OK) {
1353 cmd_error = SMMU_CERROR_ABT;
1354 break;
1355 }
1356
1357 type = CMD_TYPE(&cmd);
1358
1359 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
1360
1361 qemu_mutex_lock(&s->mutex);
1362 switch (type) {
1363 case SMMU_CMD_SYNC:
1364 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
1365 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
1366 }
1367 break;
1368 case SMMU_CMD_PREFETCH_CONFIG:
1369 case SMMU_CMD_PREFETCH_ADDR:
1370 break;
1371 case SMMU_CMD_CFGI_STE:
1372 {
1373 uint32_t sid = CMD_SID(&cmd);
1374 SMMUDevice *sdev = smmu_find_sdev(bs, sid);
1375
1376 if (CMD_SSEC(&cmd)) {
1377 cmd_error = SMMU_CERROR_ILL;
1378 break;
1379 }
1380
1381 if (!sdev) {
1382 break;
1383 }
1384
1385 trace_smmuv3_cmdq_cfgi_ste(sid);
1386 if (!smmuv3_accel_install_ste(s, sdev, sid, errp)) {
1387 cmd_error = SMMU_CERROR_ILL;
1388 break;
1389 }
1390 smmuv3_flush_config(sdev);
1391
1392 break;
1393 }
1394 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
1395 {
1396 uint32_t sid = CMD_SID(&cmd), mask;
1397 uint8_t range = CMD_STE_RANGE(&cmd);
1398 SMMUSIDRange sid_range;
1399
1400 if (CMD_SSEC(&cmd)) {
1401 cmd_error = SMMU_CERROR_ILL;
1402 break;
1403 }
1404
1405 mask = (1ULL << (range + 1)) - 1;
1406 sid_range.start = sid & ~mask;
1407 sid_range.end = sid_range.start + mask;
1408
1409 trace_smmuv3_cmdq_cfgi_ste_range(sid_range.start, sid_range.end);
1410 if (!smmuv3_accel_install_ste_range(s, &sid_range, errp)) {
1411 cmd_error = SMMU_CERROR_ILL;
1412 break;
1413 }
1414 smmu_configs_inv_sid_range(bs, sid_range);
1415 break;
1416 }
1417 case SMMU_CMD_CFGI_CD:
1418 case SMMU_CMD_CFGI_CD_ALL:
1419 {
1420 uint32_t sid = CMD_SID(&cmd);
1421 SMMUDevice *sdev = smmu_find_sdev(bs, sid);
1422
1423 if (CMD_SSEC(&cmd)) {
1424 cmd_error = SMMU_CERROR_ILL;
1425 break;
1426 }
1427
1428 if (!sdev) {
1429 break;
1430 }
1431
1432 /*
1433 * This command raises CERROR_ILL when stage 1 is not implemented
1434 * according to (IHI 0070G.b) Page 176.
1435 */
1436 if (!STAGE1_SUPPORTED(s)) {
1437 cmd_error = SMMU_CERROR_ILL;
1438 break;
1439 }
1440
1441 trace_smmuv3_cmdq_cfgi_cd(sid);
1442 smmuv3_flush_config(sdev);
1443 if (!smmuv3_accel_issue_inv_cmd(s, &cmd, sdev, errp)) {
1444 cmd_error = SMMU_CERROR_ILL;
1445 break;
1446 }
1447 break;
1448 }
1449 case SMMU_CMD_TLBI_NH_ASID:
1450 {
1451 int asid = CMD_ASID(&cmd);
1452 int vmid = -1;
1453
1454 if (!STAGE1_SUPPORTED(s)) {
1455 cmd_error = SMMU_CERROR_ILL;
1456 break;
1457 }
1458
1459 /*
1460 * VMID is only matched when stage 2 is supported, otherwise set it
1461 * to -1 as the value used for stage-1 only VMIDs.
1462 */
1463 if (STAGE2_SUPPORTED(s)) {
1464 vmid = CMD_VMID(&cmd);
1465 }
1466
1467 trace_smmuv3_cmdq_tlbi_nh_asid(asid);
1468 smmu_inv_notifiers_all(&s->smmu_state);
1469 smmu_iotlb_inv_asid_vmid(bs, asid, vmid);
1470 if (!smmuv3_accel_issue_inv_cmd(s, &cmd, NULL, errp)) {
1471 cmd_error = SMMU_CERROR_ILL;
1472 break;
1473 }
1474 break;
1475 }
1476 case SMMU_CMD_TLBI_NH_ALL:
1477 {
1478 int vmid = -1;
1479
1480 if (!STAGE1_SUPPORTED(s)) {
1481 cmd_error = SMMU_CERROR_ILL;
1482 break;
1483 }
1484
1485 /*
1486 * If stage-2 is supported, invalidate for this VMID only, otherwise
1487 * invalidate the whole thing.
1488 */
1489 if (STAGE2_SUPPORTED(s)) {
1490 vmid = CMD_VMID(&cmd);
1491 trace_smmuv3_cmdq_tlbi_nh(vmid);
1492 smmu_iotlb_inv_vmid_s1(bs, vmid);
1493 break;
1494 }
1495 QEMU_FALLTHROUGH;
1496 }
1497 case SMMU_CMD_TLBI_NSNH_ALL:
1498 trace_smmuv3_cmdq_tlbi_nsnh();
1499 smmu_inv_notifiers_all(&s->smmu_state);
1500 smmu_iotlb_inv_all(bs);
1501 if (!smmuv3_accel_issue_inv_cmd(s, &cmd, NULL, errp)) {
1502 cmd_error = SMMU_CERROR_ILL;
1503 break;
1504 }
1505 break;
1506 case SMMU_CMD_TLBI_NH_VAA:
1507 case SMMU_CMD_TLBI_NH_VA:
1508 if (!STAGE1_SUPPORTED(s)) {
1509 cmd_error = SMMU_CERROR_ILL;
1510 break;
1511 }
1512 smmuv3_range_inval(bs, &cmd, SMMU_STAGE_1);
1513 if (!smmuv3_accel_issue_inv_cmd(s, &cmd, NULL, errp)) {
1514 cmd_error = SMMU_CERROR_ILL;
1515 break;
1516 }
1517 break;
1518 case SMMU_CMD_TLBI_S12_VMALL:
1519 {
1520 int vmid = CMD_VMID(&cmd);
1521
1522 if (!STAGE2_SUPPORTED(s)) {
1523 cmd_error = SMMU_CERROR_ILL;
1524 break;
1525 }
1526
1527 trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
1528 smmu_inv_notifiers_all(&s->smmu_state);
1529 smmu_iotlb_inv_vmid(bs, vmid);
1530 break;
1531 }
1532 case SMMU_CMD_TLBI_S2_IPA:
1533 if (!STAGE2_SUPPORTED(s)) {
1534 cmd_error = SMMU_CERROR_ILL;
1535 break;
1536 }
1537 /*
1538 * As currently only either s1 or s2 are supported
1539 * we can reuse same function for s2.
1540 */
1541 smmuv3_range_inval(bs, &cmd, SMMU_STAGE_2);
1542 break;
1543 case SMMU_CMD_ATC_INV:
1544 {
1545 SMMUDevice *sdev = smmu_find_sdev(bs, CMD_SID(&cmd));
1546
1547 if (!sdev || !smmuv3_ats_enabled(s)) {
1548 trace_smmuv3_unhandled_cmd(type);
1549 break;
1550 }
1551
1552 if (!smmuv3_accel_issue_inv_cmd(s, &cmd, sdev, errp)) {
1553 cmd_error = SMMU_CERROR_ILL;
1554 break;
1555 }
1556 break;
1557 }
1558 case SMMU_CMD_TLBI_EL3_ALL:
1559 case SMMU_CMD_TLBI_EL3_VA:
1560 case SMMU_CMD_TLBI_EL2_ALL:
1561 case SMMU_CMD_TLBI_EL2_ASID:
1562 case SMMU_CMD_TLBI_EL2_VA:
1563 case SMMU_CMD_TLBI_EL2_VAA:
1564 case SMMU_CMD_PRI_RESP:
1565 case SMMU_CMD_RESUME:
1566 case SMMU_CMD_STALL_TERM:
1567 trace_smmuv3_unhandled_cmd(type);
1568 break;
1569 default:
1570 cmd_error = SMMU_CERROR_ILL;
1571 break;
1572 }
1573 qemu_mutex_unlock(&s->mutex);
1574 if (cmd_error) {
1575 if (cmd_error == SMMU_CERROR_ILL) {
1576 qemu_log_mask(LOG_GUEST_ERROR,
1577 "Illegal command type: %d\n", CMD_TYPE(&cmd));
1578 }
1579 break;
1580 }
1581 /*
1582 * We only increment the cons index after the completion of
1583 * the command. We do that because the SYNC returns immediately
1584 * and does not check the completion of previous commands
1585 */
1586 queue_cons_incr(q);
1587 }
1588
1589 if (cmd_error) {
1590 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
1591 smmu_write_cmdq_err(s, cmd_error);
1592 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
1593 }
1594
1595 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
1596 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1597
1598 return 0;
1599 }
1600
1601 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
1602 uint64_t data, MemTxAttrs attrs)
1603 {
1604 switch (offset) {
1605 case A_GERROR_IRQ_CFG0:
1606 s->gerror_irq_cfg0 = data;
1607 return MEMTX_OK;
1608 case A_STRTAB_BASE:
1609 s->strtab_base = data;
1610 return MEMTX_OK;
1611 case A_CMDQ_BASE:
1612 s->cmdq.base = data;
1613 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1614 if (s->cmdq.log2size > SMMU_CMDQS) {
1615 s->cmdq.log2size = SMMU_CMDQS;
1616 }
1617 return MEMTX_OK;
1618 case A_EVENTQ_BASE:
1619 s->eventq.base = data;
1620 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1621 if (s->eventq.log2size > SMMU_EVENTQS) {
1622 s->eventq.log2size = SMMU_EVENTQS;
1623 }
1624 return MEMTX_OK;
1625 case A_EVENTQ_IRQ_CFG0:
1626 s->eventq_irq_cfg0 = data;
1627 return MEMTX_OK;
1628 default:
1629 qemu_log_mask(LOG_UNIMP,
1630 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
1631 __func__, offset);
1632 return MEMTX_OK;
1633 }
1634 }
1635
1636 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
1637 uint64_t data, MemTxAttrs attrs)
1638 {
1639 Error *local_err = NULL;
1640
1641 switch (offset) {
1642 case A_CR0:
1643 s->cr[0] = data;
1644 s->cr0ack = data & ~SMMU_CR0_RESERVED;
1645 /* in case the command queue has been enabled */
1646 smmuv3_cmdq_consume(s, &local_err);
1647 if (local_err) {
1648 error_report_err(local_err);
1649 local_err = NULL;
1650 }
1651 /* Allocate vEVENTQ if EVENTQ is enabled and a vIOMMU is available */
1652 smmuv3_accel_alloc_veventq(s, &local_err);
1653 break;
1654 case A_CR1:
1655 s->cr[1] = data;
1656 break;
1657 case A_CR2:
1658 s->cr[2] = data;
1659 break;
1660 case A_IRQ_CTRL:
1661 s->irq_ctrl = data;
1662 break;
1663 case A_GERRORN:
1664 smmuv3_write_gerrorn(s, data);
1665 /*
1666 * By acknowledging the CMDQ_ERR, SW may notify cmds can
1667 * be processed again
1668 */
1669 smmuv3_cmdq_consume(s, &local_err);
1670 break;
1671 case A_GERROR_IRQ_CFG0: /* 64b */
1672 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
1673 break;
1674 case A_GERROR_IRQ_CFG0 + 4:
1675 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
1676 break;
1677 case A_GERROR_IRQ_CFG1:
1678 s->gerror_irq_cfg1 = data;
1679 break;
1680 case A_GERROR_IRQ_CFG2:
1681 s->gerror_irq_cfg2 = data;
1682 break;
1683 case A_GBPA:
1684 /*
1685 * If UPDATE is not set, the write is ignored. This is the only
1686 * permitted behavior in SMMUv3.2 and later.
1687 */
1688 if (data & R_GBPA_UPDATE_MASK) {
1689 /* Ignore update bit as write is synchronous. */
1690 s->gbpa = data & ~R_GBPA_UPDATE_MASK;
1691 smmuv3_accel_attach_gbpa_hwpt(s, &local_err);
1692 }
1693 break;
1694 case A_STRTAB_BASE: /* 64b */
1695 s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
1696 break;
1697 case A_STRTAB_BASE + 4:
1698 s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
1699 break;
1700 case A_STRTAB_BASE_CFG:
1701 s->strtab_base_cfg = data;
1702 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
1703 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
1704 if (s->sid_split != 6 && s->sid_split != 8 && s->sid_split != 10) {
1705 /* Other values are reserved, behave as 6 */
1706 qemu_log_mask(LOG_GUEST_ERROR,
1707 "Invalid STRTAB_BASE_CFG.SPLIT=%u, use 6 instead\n",
1708 s->sid_split);
1709 s->sid_split = 6;
1710 }
1711 s->features |= SMMU_FEATURE_2LVL_STE;
1712 }
1713 break;
1714 case A_CMDQ_BASE: /* 64b */
1715 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
1716 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1717 if (s->cmdq.log2size > SMMU_CMDQS) {
1718 s->cmdq.log2size = SMMU_CMDQS;
1719 }
1720 break;
1721 case A_CMDQ_BASE + 4: /* 64b */
1722 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
1723 break;
1724 case A_CMDQ_PROD:
1725 s->cmdq.prod = data;
1726 smmuv3_cmdq_consume(s, &local_err);
1727 break;
1728 case A_CMDQ_CONS:
1729 s->cmdq.cons = data;
1730 break;
1731 case A_EVENTQ_BASE: /* 64b */
1732 s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
1733 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1734 if (s->eventq.log2size > SMMU_EVENTQS) {
1735 s->eventq.log2size = SMMU_EVENTQS;
1736 }
1737 break;
1738 case A_EVENTQ_BASE + 4:
1739 s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
1740 break;
1741 case A_EVENTQ_PROD:
1742 s->eventq.prod = data;
1743 break;
1744 case A_EVENTQ_CONS:
1745 s->eventq.cons = data;
1746 break;
1747 case A_EVENTQ_IRQ_CFG0: /* 64b */
1748 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
1749 break;
1750 case A_EVENTQ_IRQ_CFG0 + 4:
1751 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
1752 break;
1753 case A_EVENTQ_IRQ_CFG1:
1754 s->eventq_irq_cfg1 = data;
1755 break;
1756 case A_EVENTQ_IRQ_CFG2:
1757 s->eventq_irq_cfg2 = data;
1758 break;
1759 default:
1760 qemu_log_mask(LOG_UNIMP,
1761 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
1762 __func__, offset);
1763 break;
1764 }
1765
1766 if (local_err) {
1767 error_report_err(local_err);
1768 }
1769 return MEMTX_OK;
1770 }
1771
1772 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
1773 unsigned size, MemTxAttrs attrs)
1774 {
1775 SMMUState *sys = opaque;
1776 SMMUv3State *s = ARM_SMMUV3(sys);
1777 MemTxResult r;
1778
1779 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1780 offset &= ~0x10000;
1781
1782 switch (size) {
1783 case 8:
1784 r = smmu_writell(s, offset, data, attrs);
1785 break;
1786 case 4:
1787 r = smmu_writel(s, offset, data, attrs);
1788 break;
1789 default:
1790 r = MEMTX_ERROR;
1791 break;
1792 }
1793
1794 trace_smmuv3_write_mmio(offset, data, size, r);
1795 return r;
1796 }
1797
1798 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
1799 uint64_t *data, MemTxAttrs attrs)
1800 {
1801 switch (offset) {
1802 case A_GERROR_IRQ_CFG0:
1803 *data = s->gerror_irq_cfg0;
1804 return MEMTX_OK;
1805 case A_STRTAB_BASE:
1806 *data = s->strtab_base;
1807 return MEMTX_OK;
1808 case A_CMDQ_BASE:
1809 *data = s->cmdq.base;
1810 return MEMTX_OK;
1811 case A_EVENTQ_BASE:
1812 *data = s->eventq.base;
1813 return MEMTX_OK;
1814 default:
1815 *data = 0;
1816 qemu_log_mask(LOG_UNIMP,
1817 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
1818 __func__, offset);
1819 return MEMTX_OK;
1820 }
1821 }
1822
1823 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
1824 uint64_t *data, MemTxAttrs attrs)
1825 {
1826 switch (offset) {
1827 case A_IDREGS ... A_IDREGS + 0x2f:
1828 *data = smmuv3_idreg(offset - A_IDREGS);
1829 return MEMTX_OK;
1830 case A_IDR0 ... A_IDR5:
1831 *data = s->idr[(offset - A_IDR0) / 4];
1832 return MEMTX_OK;
1833 case A_IIDR:
1834 *data = s->iidr;
1835 return MEMTX_OK;
1836 case A_AIDR:
1837 *data = s->aidr;
1838 return MEMTX_OK;
1839 case A_CR0:
1840 *data = s->cr[0];
1841 return MEMTX_OK;
1842 case A_CR0ACK:
1843 *data = s->cr0ack;
1844 return MEMTX_OK;
1845 case A_CR1:
1846 *data = s->cr[1];
1847 return MEMTX_OK;
1848 case A_CR2:
1849 *data = s->cr[2];
1850 return MEMTX_OK;
1851 case A_STATUSR:
1852 *data = s->statusr;
1853 return MEMTX_OK;
1854 case A_GBPA:
1855 *data = s->gbpa;
1856 return MEMTX_OK;
1857 case A_IRQ_CTRL:
1858 case A_IRQ_CTRL_ACK:
1859 *data = s->irq_ctrl;
1860 return MEMTX_OK;
1861 case A_GERROR:
1862 *data = s->gerror;
1863 return MEMTX_OK;
1864 case A_GERRORN:
1865 *data = s->gerrorn;
1866 return MEMTX_OK;
1867 case A_GERROR_IRQ_CFG0: /* 64b */
1868 *data = extract64(s->gerror_irq_cfg0, 0, 32);
1869 return MEMTX_OK;
1870 case A_GERROR_IRQ_CFG0 + 4:
1871 *data = extract64(s->gerror_irq_cfg0, 32, 32);
1872 return MEMTX_OK;
1873 case A_GERROR_IRQ_CFG1:
1874 *data = s->gerror_irq_cfg1;
1875 return MEMTX_OK;
1876 case A_GERROR_IRQ_CFG2:
1877 *data = s->gerror_irq_cfg2;
1878 return MEMTX_OK;
1879 case A_STRTAB_BASE: /* 64b */
1880 *data = extract64(s->strtab_base, 0, 32);
1881 return MEMTX_OK;
1882 case A_STRTAB_BASE + 4: /* 64b */
1883 *data = extract64(s->strtab_base, 32, 32);
1884 return MEMTX_OK;
1885 case A_STRTAB_BASE_CFG:
1886 *data = s->strtab_base_cfg;
1887 return MEMTX_OK;
1888 case A_CMDQ_BASE: /* 64b */
1889 *data = extract64(s->cmdq.base, 0, 32);
1890 return MEMTX_OK;
1891 case A_CMDQ_BASE + 4:
1892 *data = extract64(s->cmdq.base, 32, 32);
1893 return MEMTX_OK;
1894 case A_CMDQ_PROD:
1895 *data = s->cmdq.prod;
1896 return MEMTX_OK;
1897 case A_CMDQ_CONS:
1898 *data = s->cmdq.cons;
1899 return MEMTX_OK;
1900 case A_EVENTQ_BASE: /* 64b */
1901 *data = extract64(s->eventq.base, 0, 32);
1902 return MEMTX_OK;
1903 case A_EVENTQ_BASE + 4: /* 64b */
1904 *data = extract64(s->eventq.base, 32, 32);
1905 return MEMTX_OK;
1906 case A_EVENTQ_PROD:
1907 *data = s->eventq.prod;
1908 return MEMTX_OK;
1909 case A_EVENTQ_CONS:
1910 *data = s->eventq.cons;
1911 return MEMTX_OK;
1912 default:
1913 *data = 0;
1914 qemu_log_mask(LOG_UNIMP,
1915 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
1916 __func__, offset);
1917 return MEMTX_OK;
1918 }
1919 }
1920
1921 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
1922 unsigned size, MemTxAttrs attrs)
1923 {
1924 SMMUState *sys = opaque;
1925 SMMUv3State *s = ARM_SMMUV3(sys);
1926 MemTxResult r;
1927
1928 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1929 offset &= ~0x10000;
1930
1931 switch (size) {
1932 case 8:
1933 r = smmu_readll(s, offset, data, attrs);
1934 break;
1935 case 4:
1936 r = smmu_readl(s, offset, data, attrs);
1937 break;
1938 default:
1939 r = MEMTX_ERROR;
1940 break;
1941 }
1942
1943 trace_smmuv3_read_mmio(offset, *data, size, r);
1944 return r;
1945 }
1946
1947 static const MemoryRegionOps smmu_mem_ops = {
1948 .read_with_attrs = smmu_read_mmio,
1949 .write_with_attrs = smmu_write_mmio,
1950 .endianness = DEVICE_LITTLE_ENDIAN,
1951 .valid = {
1952 .min_access_size = 4,
1953 .max_access_size = 8,
1954 },
1955 .impl = {
1956 .min_access_size = 4,
1957 .max_access_size = 8,
1958 },
1959 };
1960
1961 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
1962 {
1963 int i;
1964
1965 for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
1966 sysbus_init_irq(dev, &s->irq[i]);
1967 }
1968 }
1969
1970 /*
1971 * Make sure the IOMMU is reset in 'exit' phase after
1972 * all outstanding DMA requests have been quiesced during
1973 * the 'enter' or 'hold' reset phases
1974 */
1975 static void smmu_reset_exit(Object *obj, ResetType type)
1976 {
1977 SMMUv3State *s = ARM_SMMUV3(obj);
1978 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1979
1980 trace_smmu_reset_exit();
1981 if (c->parent_phases.exit) {
1982 c->parent_phases.exit(obj, type);
1983 }
1984
1985 smmuv3_reset(s);
1986 smmuv3_accel_reset(s);
1987 }
1988
1989 static bool smmu_validate_property(SMMUv3State *s, Error **errp)
1990 {
1991 if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
1992 s->oas != OAS_MODE_AUTO) {
1993 error_setg(errp, "QEMU SMMUv3 model only implements auto, "
1994 "44 bit, or 48 bit OAS. Other OasMode values are "
1995 "not supported.");
1996 return false;
1997 }
1998
1999 if (!s->accel) {
2000 if (s->ril == ON_OFF_AUTO_OFF) {
2001 error_setg(errp, "ril can only be disabled if accel=on");
2002 return false;
2003 }
2004 if (s->ats == ON_OFF_AUTO_ON) {
2005 error_setg(errp, "ats can only be enabled if accel=on");
2006 return false;
2007 }
2008 if (s->oas > OAS_MODE_44) {
2009 error_setg(errp, "oas must be 44 bits when accel=off");
2010 return false;
2011 }
2012 if (s->ssidsize > SSID_SIZE_MODE_0) {
2013 error_setg(errp, "ssidsize can only be greater than 0 "
2014 "bits if accel=on");
2015 return false;
2016 }
2017 if (s->cmdqv == ON_OFF_AUTO_ON) {
2018 error_setg(errp, "cmdqv can only be enabled if accel=on");
2019 return false;
2020 }
2021 return true;
2022 }
2023
2024 /* If no stage specified, SMMUv3 defaults to stage 1 */
2025 if (s->stage && strcmp(s->stage, "1")) {
2026 error_setg(errp,
2027 "Only stage1 is supported for SMMUv3 with accel=on");
2028 return false;
2029 }
2030
2031 return true;
2032 }
2033
2034 static void smmu_realize(DeviceState *d, Error **errp)
2035 {
2036 SMMUState *sys = ARM_SMMU(d);
2037 SMMUv3State *s = ARM_SMMUV3(sys);
2038 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
2039 SysBusDevice *dev = SYS_BUS_DEVICE(d);
2040 Error *local_err = NULL;
2041
2042 if (!smmu_validate_property(s, errp)) {
2043 return;
2044 }
2045
2046 if (s->accel) {
2047 if (!smmuv3_accel_init(s, errp)) {
2048 return;
2049 }
2050 error_setg(&s->migration_blocker, "Migration not supported with SMMUv3 "
2051 "accelerator mode enabled");
2052 if (migrate_add_blocker(&s->migration_blocker, errp) < 0) {
2053 return;
2054 }
2055 }
2056
2057 c->parent_realize(d, &local_err);
2058 if (local_err) {
2059 error_propagate(errp, local_err);
2060 return;
2061 }
2062
2063 qemu_mutex_init(&s->mutex);
2064
2065 memory_region_init_io(&sys->iomem, OBJECT(s),
2066 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
2067
2068 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
2069
2070 sysbus_init_mmio(dev, &sys->iomem);
2071
2072 smmu_init_irq(s, dev);
2073 smmuv3_init_id_regs(s);
2074 }
2075
2076 static const VMStateDescription vmstate_smmuv3_queue = {
2077 .name = "smmuv3_queue",
2078 .version_id = 1,
2079 .minimum_version_id = 1,
2080 .fields = (const VMStateField[]) {
2081 VMSTATE_UINT64(base, SMMUQueue),
2082 VMSTATE_UINT32(prod, SMMUQueue),
2083 VMSTATE_UINT32(cons, SMMUQueue),
2084 VMSTATE_UINT8(log2size, SMMUQueue),
2085 VMSTATE_END_OF_LIST(),
2086 },
2087 };
2088
2089 static bool smmuv3_gbpa_needed(void *opaque)
2090 {
2091 SMMUv3State *s = opaque;
2092
2093 /* Only migrate GBPA if it has different reset value. */
2094 return s->gbpa != SMMU_GBPA_RESET_VAL;
2095 }
2096
2097 static const VMStateDescription vmstate_gbpa = {
2098 .name = "smmuv3/gbpa",
2099 .version_id = 1,
2100 .minimum_version_id = 1,
2101 .needed = smmuv3_gbpa_needed,
2102 .fields = (const VMStateField[]) {
2103 VMSTATE_UINT32(gbpa, SMMUv3State),
2104 VMSTATE_END_OF_LIST()
2105 }
2106 };
2107
2108 static const VMStateDescription vmstate_smmuv3 = {
2109 .name = "smmuv3",
2110 .version_id = 1,
2111 .minimum_version_id = 1,
2112 .priority = MIG_PRI_IOMMU,
2113 .fields = (const VMStateField[]) {
2114 VMSTATE_UINT32(features, SMMUv3State),
2115 VMSTATE_UINT8(sid_size, SMMUv3State),
2116 VMSTATE_UINT8(sid_split, SMMUv3State),
2117
2118 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
2119 VMSTATE_UINT32(cr0ack, SMMUv3State),
2120 VMSTATE_UINT32(statusr, SMMUv3State),
2121 VMSTATE_UINT32(irq_ctrl, SMMUv3State),
2122 VMSTATE_UINT32(gerror, SMMUv3State),
2123 VMSTATE_UINT32(gerrorn, SMMUv3State),
2124 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
2125 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
2126 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
2127 VMSTATE_UINT64(strtab_base, SMMUv3State),
2128 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
2129 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
2130 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
2131 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
2132
2133 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
2134 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
2135
2136 VMSTATE_END_OF_LIST(),
2137 },
2138 .subsections = (const VMStateDescription * const []) {
2139 &vmstate_gbpa,
2140 NULL
2141 }
2142 };
2143
2144 static const Property smmuv3_properties[] = {
2145 /*
2146 * Stages of translation advertised.
2147 * "1": Stage 1
2148 * "2": Stage 2
2149 * "nested": Both stage 1 and stage 2
2150 * Defaults to stage 1
2151 */
2152 DEFINE_PROP_STRING("stage", SMMUv3State, stage),
2153 /* Identifier used for ACPI IORT SMMUv3 (and DSDT for CMDQV) generation */
2154 DEFINE_PROP_UINT8("identifier", SMMUv3State, identifier, 0),
2155 DEFINE_PROP_BOOL("accel", SMMUv3State, accel, false),
2156 /* GPA of MSI doorbell, for SMMUv3 accel use. */
2157 DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
2158 /*
2159 * AUTO values for accel=off will resolve to:
2160 * ril: on
2161 * ats: off
2162 * oas: 44
2163 * ssidsize: 0
2164 */
2165 /* RIL can be turned off for accel cases */
2166 DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_AUTO),
2167 DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
2168 DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_AUTO),
2169 DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
2170 SSID_SIZE_MODE_AUTO),
2171 DEFINE_PROP_ON_OFF_AUTO("cmdqv", SMMUv3State, cmdqv, ON_OFF_AUTO_AUTO),
2172 };
2173
2174 static void smmuv3_instance_init(Object *obj)
2175 {
2176 /* Nothing much to do here as of now */
2177 }
2178
2179 static void smmuv3_class_init(ObjectClass *klass, const void *data)
2180 {
2181 DeviceClass *dc = DEVICE_CLASS(klass);
2182 ResettableClass *rc = RESETTABLE_CLASS(klass);
2183 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
2184
2185 dc->vmsd = &vmstate_smmuv3;
2186 resettable_class_set_parent_phases(rc, NULL, NULL, smmu_reset_exit,
2187 &c->parent_phases);
2188 device_class_set_parent_realize(dc, smmu_realize,
2189 &c->parent_realize);
2190 device_class_set_props(dc, smmuv3_properties);
2191 dc->hotpluggable = false;
2192 dc->user_creatable = true;
2193
2194 object_class_property_set_description(klass, "accel",
2195 "Enable SMMUv3 accelerator support. Allows host SMMUv3 to be "
2196 "configured in nested mode for vfio-pci dev assignment. Please "
2197 "ensure the host SMMUv3 supports nested translation before "
2198 "enabling.");
2199 object_class_property_set_description(klass, "ril",
2200 "Enable/disable range invalidation support (for accel=on). "
2201 "Valid values are on, off, and auto. Defaults to auto. "
2202 "Any attempt to turn it 'on' while the host does not support "
2203 "it would fail.");
2204 object_class_property_set_description(klass, "ats",
2205 "Enable/disable ATS support (for accel=on). "
2206 "Valid values are on, off, and auto. Defaults to auto. "
2207 "Please ensure host platform supports ATS before setting it "
2208 "to on.");
2209 object_class_property_set_description(klass, "oas",
2210 "Set Output Address Size in bits (for accel=on). "
2211 "Valid values are 44, 48, and auto. Defaults to auto."
2212 "Please ensure the value does not exceed the maximum "
2213 "Output Address Size supported by the host platform.");
2214 object_class_property_set_description(klass, "ssidsize",
2215 "Set number of bits used to represent SubstreamIDs (SSIDs). "
2216 "Valid values are 0-20 and auto. Defaults to auto. "
2217 "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
2218 "A value of 0 disables SubstreamID support. A value greater "
2219 "than 0 is required to enable PASID support."
2220 "Please ensure the value does not exceed the maximum "
2221 "SubstreamID size supported by the host platform.");
2222 object_class_property_set_description(klass, "cmdqv",
2223 "Enable/disable CMDQV support (for accel=on). "
2224 "Valid values are on, off, and auto. Defaults to auto.");
2225 }
2226
2227 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
2228 IOMMUNotifierFlag old,
2229 IOMMUNotifierFlag new,
2230 Error **errp)
2231 {
2232 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu);
2233 SMMUv3State *s3 = sdev->smmu;
2234 SMMUState *s = &(s3->smmu_state);
2235
2236 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
2237 error_setg(errp, "SMMUv3 does not support dev-iotlb yet");
2238 return -EINVAL;
2239 }
2240
2241 if (new & IOMMU_NOTIFIER_MAP) {
2242 error_setg(errp,
2243 "device %02x.%02x.%x requires iommu MAP notifier which is "
2244 "not currently supported", pci_bus_num(sdev->bus),
2245 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn));
2246 return -EINVAL;
2247 }
2248
2249 if (old == IOMMU_NOTIFIER_NONE) {
2250 trace_smmuv3_notify_flag_add(iommu->parent_obj.name);
2251 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next);
2252 } else if (new == IOMMU_NOTIFIER_NONE) {
2253 trace_smmuv3_notify_flag_del(iommu->parent_obj.name);
2254 QLIST_REMOVE(sdev, next);
2255 }
2256 return 0;
2257 }
2258
2259 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
2260 const void *data)
2261 {
2262 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
2263
2264 imrc->translate = smmuv3_translate;
2265 imrc->notify_flag_changed = smmuv3_notify_flag_changed;
2266 }
2267
2268 static const TypeInfo smmuv3_type_info = {
2269 .name = TYPE_ARM_SMMUV3,
2270 .parent = TYPE_ARM_SMMU,
2271 .instance_size = sizeof(SMMUv3State),
2272 .instance_init = smmuv3_instance_init,
2273 .class_size = sizeof(SMMUv3Class),
2274 .class_init = smmuv3_class_init,
2275 };
2276
2277 static const TypeInfo smmuv3_iommu_memory_region_info = {
2278 .parent = TYPE_IOMMU_MEMORY_REGION,
2279 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
2280 .class_init = smmuv3_iommu_memory_region_class_init,
2281 };
2282
2283 static void smmuv3_register_types(void)
2284 {
2285 type_register_static(&smmuv3_type_info);
2286 type_register_static(&smmuv3_iommu_memory_region_info);
2287 }
2288
2289 type_init(smmuv3_register_types)
2290