1 /* 2 * Copyright (C) 2014-2016 Broadcom Corporation 3 * Copyright (c) 2017 Red Hat, Inc. 4 * Written by Prem Mallappa, Eric Auger 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License along 16 * with this program; if not, see <http://www.gnu.org/licenses/>. 17 */ 18 19 #include "qemu/osdep.h" 20 #include "qemu/bitops.h" 21 #include "hw/irq.h" 22 #include "hw/sysbus.h" 23 #include "migration/vmstate.h" 24 #include "hw/qdev-core.h" 25 #include "hw/pci/pci.h" 26 #include "exec/address-spaces.h" 27 #include "cpu.h" 28 #include "trace.h" 29 #include "qemu/log.h" 30 #include "qemu/error-report.h" 31 #include "qapi/error.h" 32 33 #include "hw/arm/smmuv3.h" 34 #include "smmuv3-internal.h" 35 36 /** 37 * smmuv3_trigger_irq - pulse @irq if enabled and update 38 * GERROR register in case of GERROR interrupt 39 * 40 * @irq: irq type 41 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR) 42 */ 43 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, 44 uint32_t gerror_mask) 45 { 46 47 bool pulse = false; 48 49 switch (irq) { 50 case SMMU_IRQ_EVTQ: 51 pulse = smmuv3_eventq_irq_enabled(s); 52 break; 53 case SMMU_IRQ_PRIQ: 54 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n"); 55 break; 56 case SMMU_IRQ_CMD_SYNC: 57 pulse = true; 58 break; 59 case SMMU_IRQ_GERROR: 60 { 61 uint32_t pending = s->gerror ^ s->gerrorn; 62 uint32_t new_gerrors = ~pending & gerror_mask; 63 64 if (!new_gerrors) { 65 /* only toggle non pending errors */ 66 return; 67 } 68 s->gerror ^= new_gerrors; 69 trace_smmuv3_write_gerror(new_gerrors, s->gerror); 70 71 pulse = smmuv3_gerror_irq_enabled(s); 72 break; 73 } 74 } 75 if (pulse) { 76 trace_smmuv3_trigger_irq(irq); 77 qemu_irq_pulse(s->irq[irq]); 78 } 79 } 80 81 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn) 82 { 83 uint32_t pending = s->gerror ^ s->gerrorn; 84 uint32_t toggled = s->gerrorn ^ new_gerrorn; 85 86 if (toggled & ~pending) { 87 qemu_log_mask(LOG_GUEST_ERROR, 88 "guest toggles non pending errors = 0x%x\n", 89 toggled & ~pending); 90 } 91 92 /* 93 * We do not raise any error in case guest toggles bits corresponding 94 * to not active IRQs (CONSTRAINED UNPREDICTABLE) 95 */ 96 s->gerrorn = new_gerrorn; 97 98 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn); 99 } 100 101 static inline MemTxResult queue_read(SMMUQueue *q, void *data) 102 { 103 dma_addr_t addr = Q_CONS_ENTRY(q); 104 105 return dma_memory_read(&address_space_memory, addr, data, q->entry_size); 106 } 107 108 static MemTxResult queue_write(SMMUQueue *q, void *data) 109 { 110 dma_addr_t addr = Q_PROD_ENTRY(q); 111 MemTxResult ret; 112 113 ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size); 114 if (ret != MEMTX_OK) { 115 return ret; 116 } 117 118 queue_prod_incr(q); 119 return MEMTX_OK; 120 } 121 122 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt) 123 { 124 SMMUQueue *q = &s->eventq; 125 MemTxResult r; 126 127 if (!smmuv3_eventq_enabled(s)) { 128 return MEMTX_ERROR; 129 } 130 131 if (smmuv3_q_full(q)) { 132 return MEMTX_ERROR; 133 } 134 135 r = queue_write(q, evt); 136 if (r != MEMTX_OK) { 137 return r; 138 } 139 140 if (!smmuv3_q_empty(q)) { 141 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0); 142 } 143 return MEMTX_OK; 144 } 145 146 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info) 147 { 148 Evt evt = {}; 149 MemTxResult r; 150 151 if (!smmuv3_eventq_enabled(s)) { 152 return; 153 } 154 155 EVT_SET_TYPE(&evt, info->type); 156 EVT_SET_SID(&evt, info->sid); 157 158 switch (info->type) { 159 case SMMU_EVT_NONE: 160 return; 161 case SMMU_EVT_F_UUT: 162 EVT_SET_SSID(&evt, info->u.f_uut.ssid); 163 EVT_SET_SSV(&evt, info->u.f_uut.ssv); 164 EVT_SET_ADDR(&evt, info->u.f_uut.addr); 165 EVT_SET_RNW(&evt, info->u.f_uut.rnw); 166 EVT_SET_PNU(&evt, info->u.f_uut.pnu); 167 EVT_SET_IND(&evt, info->u.f_uut.ind); 168 break; 169 case SMMU_EVT_C_BAD_STREAMID: 170 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid); 171 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv); 172 break; 173 case SMMU_EVT_F_STE_FETCH: 174 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid); 175 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv); 176 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr); 177 break; 178 case SMMU_EVT_C_BAD_STE: 179 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid); 180 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv); 181 break; 182 case SMMU_EVT_F_STREAM_DISABLED: 183 break; 184 case SMMU_EVT_F_TRANS_FORBIDDEN: 185 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr); 186 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw); 187 break; 188 case SMMU_EVT_C_BAD_SUBSTREAMID: 189 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid); 190 break; 191 case SMMU_EVT_F_CD_FETCH: 192 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid); 193 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv); 194 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr); 195 break; 196 case SMMU_EVT_C_BAD_CD: 197 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid); 198 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv); 199 break; 200 case SMMU_EVT_F_WALK_EABT: 201 case SMMU_EVT_F_TRANSLATION: 202 case SMMU_EVT_F_ADDR_SIZE: 203 case SMMU_EVT_F_ACCESS: 204 case SMMU_EVT_F_PERMISSION: 205 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall); 206 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag); 207 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid); 208 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv); 209 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2); 210 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr); 211 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw); 212 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu); 213 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind); 214 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class); 215 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2); 216 break; 217 case SMMU_EVT_F_CFG_CONFLICT: 218 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid); 219 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv); 220 break; 221 /* rest is not implemented */ 222 case SMMU_EVT_F_BAD_ATS_TREQ: 223 case SMMU_EVT_F_TLB_CONFLICT: 224 case SMMU_EVT_E_PAGE_REQ: 225 default: 226 g_assert_not_reached(); 227 } 228 229 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid); 230 r = smmuv3_write_eventq(s, &evt); 231 if (r != MEMTX_OK) { 232 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK); 233 } 234 info->recorded = true; 235 } 236 237 static void smmuv3_init_regs(SMMUv3State *s) 238 { 239 /** 240 * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID, 241 * multi-level stream table 242 */ 243 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */ 244 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */ 245 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */ 246 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */ 247 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */ 248 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */ 249 /* terminated transaction will always be aborted/error returned */ 250 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1); 251 /* 2-level stream table supported */ 252 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1); 253 254 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE); 255 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS); 256 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS); 257 258 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1); 259 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1); 260 261 /* 4K and 64K granule support */ 262 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1); 263 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1); 264 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */ 265 266 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS); 267 s->cmdq.prod = 0; 268 s->cmdq.cons = 0; 269 s->cmdq.entry_size = sizeof(struct Cmd); 270 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS); 271 s->eventq.prod = 0; 272 s->eventq.cons = 0; 273 s->eventq.entry_size = sizeof(struct Evt); 274 275 s->features = 0; 276 s->sid_split = 0; 277 s->aidr = 0x1; 278 } 279 280 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf, 281 SMMUEventInfo *event) 282 { 283 int ret; 284 285 trace_smmuv3_get_ste(addr); 286 /* TODO: guarantee 64-bit single-copy atomicity */ 287 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf)); 288 if (ret != MEMTX_OK) { 289 qemu_log_mask(LOG_GUEST_ERROR, 290 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 291 event->type = SMMU_EVT_F_STE_FETCH; 292 event->u.f_ste_fetch.addr = addr; 293 return -EINVAL; 294 } 295 return 0; 296 297 } 298 299 /* @ssid > 0 not supported yet */ 300 static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid, 301 CD *buf, SMMUEventInfo *event) 302 { 303 dma_addr_t addr = STE_CTXPTR(ste); 304 int ret; 305 306 trace_smmuv3_get_cd(addr); 307 /* TODO: guarantee 64-bit single-copy atomicity */ 308 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf)); 309 if (ret != MEMTX_OK) { 310 qemu_log_mask(LOG_GUEST_ERROR, 311 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 312 event->type = SMMU_EVT_F_CD_FETCH; 313 event->u.f_ste_fetch.addr = addr; 314 return -EINVAL; 315 } 316 return 0; 317 } 318 319 /* Returns < 0 in case of invalid STE, 0 otherwise */ 320 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg, 321 STE *ste, SMMUEventInfo *event) 322 { 323 uint32_t config; 324 325 if (!STE_VALID(ste)) { 326 if (!event->inval_ste_allowed) { 327 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n"); 328 } 329 goto bad_ste; 330 } 331 332 config = STE_CONFIG(ste); 333 334 if (STE_CFG_ABORT(config)) { 335 cfg->aborted = true; 336 return 0; 337 } 338 339 if (STE_CFG_BYPASS(config)) { 340 cfg->bypassed = true; 341 return 0; 342 } 343 344 if (STE_CFG_S2_ENABLED(config)) { 345 qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n"); 346 goto bad_ste; 347 } 348 349 if (STE_S1CDMAX(ste) != 0) { 350 qemu_log_mask(LOG_UNIMP, 351 "SMMUv3 does not support multiple context descriptors yet\n"); 352 goto bad_ste; 353 } 354 355 if (STE_S1STALLD(ste)) { 356 qemu_log_mask(LOG_UNIMP, 357 "SMMUv3 S1 stalling fault model not allowed yet\n"); 358 goto bad_ste; 359 } 360 return 0; 361 362 bad_ste: 363 event->type = SMMU_EVT_C_BAD_STE; 364 return -EINVAL; 365 } 366 367 /** 368 * smmu_find_ste - Return the stream table entry associated 369 * to the sid 370 * 371 * @s: smmuv3 handle 372 * @sid: stream ID 373 * @ste: returned stream table entry 374 * @event: handle to an event info 375 * 376 * Supports linear and 2-level stream table 377 * Return 0 on success, -EINVAL otherwise 378 */ 379 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, 380 SMMUEventInfo *event) 381 { 382 dma_addr_t addr, strtab_base; 383 uint32_t log2size; 384 int strtab_size_shift; 385 int ret; 386 387 trace_smmuv3_find_ste(sid, s->features, s->sid_split); 388 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE); 389 /* 390 * Check SID range against both guest-configured and implementation limits 391 */ 392 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) { 393 event->type = SMMU_EVT_C_BAD_STREAMID; 394 return -EINVAL; 395 } 396 if (s->features & SMMU_FEATURE_2LVL_STE) { 397 int l1_ste_offset, l2_ste_offset, max_l2_ste, span; 398 dma_addr_t l1ptr, l2ptr; 399 STEDesc l1std; 400 401 /* 402 * Align strtab base address to table size. For this purpose, assume it 403 * is not bounded by SMMU_IDR1_SIDSIZE. 404 */ 405 strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3); 406 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & 407 ~MAKE_64BIT_MASK(0, strtab_size_shift); 408 l1_ste_offset = sid >> s->sid_split; 409 l2_ste_offset = sid & ((1 << s->sid_split) - 1); 410 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std)); 411 /* TODO: guarantee 64-bit single-copy atomicity */ 412 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std, 413 sizeof(l1std)); 414 if (ret != MEMTX_OK) { 415 qemu_log_mask(LOG_GUEST_ERROR, 416 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr); 417 event->type = SMMU_EVT_F_STE_FETCH; 418 event->u.f_ste_fetch.addr = l1ptr; 419 return -EINVAL; 420 } 421 422 span = L1STD_SPAN(&l1std); 423 424 if (!span) { 425 /* l2ptr is not valid */ 426 if (!event->inval_ste_allowed) { 427 qemu_log_mask(LOG_GUEST_ERROR, 428 "invalid sid=%d (L1STD span=0)\n", sid); 429 } 430 event->type = SMMU_EVT_C_BAD_STREAMID; 431 return -EINVAL; 432 } 433 max_l2_ste = (1 << span) - 1; 434 l2ptr = l1std_l2ptr(&l1std); 435 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, 436 l2ptr, l2_ste_offset, max_l2_ste); 437 if (l2_ste_offset > max_l2_ste) { 438 qemu_log_mask(LOG_GUEST_ERROR, 439 "l2_ste_offset=%d > max_l2_ste=%d\n", 440 l2_ste_offset, max_l2_ste); 441 event->type = SMMU_EVT_C_BAD_STE; 442 return -EINVAL; 443 } 444 addr = l2ptr + l2_ste_offset * sizeof(*ste); 445 } else { 446 strtab_size_shift = log2size + 5; 447 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & 448 ~MAKE_64BIT_MASK(0, strtab_size_shift); 449 addr = strtab_base + sid * sizeof(*ste); 450 } 451 452 if (smmu_get_ste(s, addr, ste, event)) { 453 return -EINVAL; 454 } 455 456 return 0; 457 } 458 459 static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event) 460 { 461 int ret = -EINVAL; 462 int i; 463 464 if (!CD_VALID(cd) || !CD_AARCH64(cd)) { 465 goto bad_cd; 466 } 467 if (!CD_A(cd)) { 468 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */ 469 } 470 if (CD_S(cd)) { 471 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */ 472 } 473 if (CD_HA(cd) || CD_HD(cd)) { 474 goto bad_cd; /* HTTU = 0 */ 475 } 476 477 /* we support only those at the moment */ 478 cfg->aa64 = true; 479 cfg->stage = 1; 480 481 cfg->oas = oas2bits(CD_IPS(cd)); 482 cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas); 483 cfg->tbi = CD_TBI(cd); 484 cfg->asid = CD_ASID(cd); 485 486 trace_smmuv3_decode_cd(cfg->oas); 487 488 /* decode data dependent on TT */ 489 for (i = 0; i <= 1; i++) { 490 int tg, tsz; 491 SMMUTransTableInfo *tt = &cfg->tt[i]; 492 493 cfg->tt[i].disabled = CD_EPD(cd, i); 494 if (cfg->tt[i].disabled) { 495 continue; 496 } 497 498 tsz = CD_TSZ(cd, i); 499 if (tsz < 16 || tsz > 39) { 500 goto bad_cd; 501 } 502 503 tg = CD_TG(cd, i); 504 tt->granule_sz = tg2granule(tg, i); 505 if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) { 506 goto bad_cd; 507 } 508 509 tt->tsz = tsz; 510 tt->ttb = CD_TTB(cd, i); 511 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) { 512 goto bad_cd; 513 } 514 tt->had = CD_HAD(cd, i); 515 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had); 516 } 517 518 event->record_trans_faults = CD_R(cd); 519 520 return 0; 521 522 bad_cd: 523 event->type = SMMU_EVT_C_BAD_CD; 524 return ret; 525 } 526 527 /** 528 * smmuv3_decode_config - Prepare the translation configuration 529 * for the @mr iommu region 530 * @mr: iommu memory region the translation config must be prepared for 531 * @cfg: output translation configuration which is populated through 532 * the different configuration decoding steps 533 * @event: must be zero'ed by the caller 534 * 535 * return < 0 in case of config decoding error (@event is filled 536 * accordingly). Return 0 otherwise. 537 */ 538 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg, 539 SMMUEventInfo *event) 540 { 541 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 542 uint32_t sid = smmu_get_sid(sdev); 543 SMMUv3State *s = sdev->smmu; 544 int ret; 545 STE ste; 546 CD cd; 547 548 ret = smmu_find_ste(s, sid, &ste, event); 549 if (ret) { 550 return ret; 551 } 552 553 ret = decode_ste(s, cfg, &ste, event); 554 if (ret) { 555 return ret; 556 } 557 558 if (cfg->aborted || cfg->bypassed) { 559 return 0; 560 } 561 562 ret = smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event); 563 if (ret) { 564 return ret; 565 } 566 567 return decode_cd(cfg, &cd, event); 568 } 569 570 /** 571 * smmuv3_get_config - Look up for a cached copy of configuration data for 572 * @sdev and on cache miss performs a configuration structure decoding from 573 * guest RAM. 574 * 575 * @sdev: SMMUDevice handle 576 * @event: output event info 577 * 578 * The configuration cache contains data resulting from both STE and CD 579 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed 580 * by the SMMUDevice handle. 581 */ 582 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event) 583 { 584 SMMUv3State *s = sdev->smmu; 585 SMMUState *bc = &s->smmu_state; 586 SMMUTransCfg *cfg; 587 588 cfg = g_hash_table_lookup(bc->configs, sdev); 589 if (cfg) { 590 sdev->cfg_cache_hits++; 591 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev), 592 sdev->cfg_cache_hits, sdev->cfg_cache_misses, 593 100 * sdev->cfg_cache_hits / 594 (sdev->cfg_cache_hits + sdev->cfg_cache_misses)); 595 } else { 596 sdev->cfg_cache_misses++; 597 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev), 598 sdev->cfg_cache_hits, sdev->cfg_cache_misses, 599 100 * sdev->cfg_cache_hits / 600 (sdev->cfg_cache_hits + sdev->cfg_cache_misses)); 601 cfg = g_new0(SMMUTransCfg, 1); 602 603 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) { 604 g_hash_table_insert(bc->configs, sdev, cfg); 605 } else { 606 g_free(cfg); 607 cfg = NULL; 608 } 609 } 610 return cfg; 611 } 612 613 static void smmuv3_flush_config(SMMUDevice *sdev) 614 { 615 SMMUv3State *s = sdev->smmu; 616 SMMUState *bc = &s->smmu_state; 617 618 trace_smmuv3_config_cache_inv(smmu_get_sid(sdev)); 619 g_hash_table_remove(bc->configs, sdev); 620 } 621 622 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr, 623 IOMMUAccessFlags flag, int iommu_idx) 624 { 625 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 626 SMMUv3State *s = sdev->smmu; 627 uint32_t sid = smmu_get_sid(sdev); 628 SMMUEventInfo event = {.type = SMMU_EVT_NONE, 629 .sid = sid, 630 .inval_ste_allowed = false}; 631 SMMUPTWEventInfo ptw_info = {}; 632 SMMUTranslationStatus status; 633 SMMUState *bs = ARM_SMMU(s); 634 uint64_t page_mask, aligned_addr; 635 SMMUTLBEntry *cached_entry = NULL; 636 SMMUTransTableInfo *tt; 637 SMMUTransCfg *cfg = NULL; 638 IOMMUTLBEntry entry = { 639 .target_as = &address_space_memory, 640 .iova = addr, 641 .translated_addr = addr, 642 .addr_mask = ~(hwaddr)0, 643 .perm = IOMMU_NONE, 644 }; 645 646 qemu_mutex_lock(&s->mutex); 647 648 if (!smmu_enabled(s)) { 649 status = SMMU_TRANS_DISABLE; 650 goto epilogue; 651 } 652 653 cfg = smmuv3_get_config(sdev, &event); 654 if (!cfg) { 655 status = SMMU_TRANS_ERROR; 656 goto epilogue; 657 } 658 659 if (cfg->aborted) { 660 status = SMMU_TRANS_ABORT; 661 goto epilogue; 662 } 663 664 if (cfg->bypassed) { 665 status = SMMU_TRANS_BYPASS; 666 goto epilogue; 667 } 668 669 tt = select_tt(cfg, addr); 670 if (!tt) { 671 if (event.record_trans_faults) { 672 event.type = SMMU_EVT_F_TRANSLATION; 673 event.u.f_translation.addr = addr; 674 event.u.f_translation.rnw = flag & 0x1; 675 } 676 status = SMMU_TRANS_ERROR; 677 goto epilogue; 678 } 679 680 page_mask = (1ULL << (tt->granule_sz)) - 1; 681 aligned_addr = addr & ~page_mask; 682 683 cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr); 684 if (cached_entry) { 685 if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) { 686 status = SMMU_TRANS_ERROR; 687 if (event.record_trans_faults) { 688 event.type = SMMU_EVT_F_PERMISSION; 689 event.u.f_permission.addr = addr; 690 event.u.f_permission.rnw = flag & 0x1; 691 } 692 } else { 693 status = SMMU_TRANS_SUCCESS; 694 } 695 goto epilogue; 696 } 697 698 cached_entry = g_new0(SMMUTLBEntry, 1); 699 700 if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) { 701 g_free(cached_entry); 702 switch (ptw_info.type) { 703 case SMMU_PTW_ERR_WALK_EABT: 704 event.type = SMMU_EVT_F_WALK_EABT; 705 event.u.f_walk_eabt.addr = addr; 706 event.u.f_walk_eabt.rnw = flag & 0x1; 707 event.u.f_walk_eabt.class = 0x1; 708 event.u.f_walk_eabt.addr2 = ptw_info.addr; 709 break; 710 case SMMU_PTW_ERR_TRANSLATION: 711 if (event.record_trans_faults) { 712 event.type = SMMU_EVT_F_TRANSLATION; 713 event.u.f_translation.addr = addr; 714 event.u.f_translation.rnw = flag & 0x1; 715 } 716 break; 717 case SMMU_PTW_ERR_ADDR_SIZE: 718 if (event.record_trans_faults) { 719 event.type = SMMU_EVT_F_ADDR_SIZE; 720 event.u.f_addr_size.addr = addr; 721 event.u.f_addr_size.rnw = flag & 0x1; 722 } 723 break; 724 case SMMU_PTW_ERR_ACCESS: 725 if (event.record_trans_faults) { 726 event.type = SMMU_EVT_F_ACCESS; 727 event.u.f_access.addr = addr; 728 event.u.f_access.rnw = flag & 0x1; 729 } 730 break; 731 case SMMU_PTW_ERR_PERMISSION: 732 if (event.record_trans_faults) { 733 event.type = SMMU_EVT_F_PERMISSION; 734 event.u.f_permission.addr = addr; 735 event.u.f_permission.rnw = flag & 0x1; 736 } 737 break; 738 default: 739 g_assert_not_reached(); 740 } 741 status = SMMU_TRANS_ERROR; 742 } else { 743 smmu_iotlb_insert(bs, cfg, cached_entry); 744 status = SMMU_TRANS_SUCCESS; 745 } 746 747 epilogue: 748 qemu_mutex_unlock(&s->mutex); 749 switch (status) { 750 case SMMU_TRANS_SUCCESS: 751 entry.perm = flag; 752 entry.translated_addr = cached_entry->entry.translated_addr + 753 (addr & cached_entry->entry.addr_mask); 754 entry.addr_mask = cached_entry->entry.addr_mask; 755 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr, 756 entry.translated_addr, entry.perm); 757 break; 758 case SMMU_TRANS_DISABLE: 759 entry.perm = flag; 760 entry.addr_mask = ~TARGET_PAGE_MASK; 761 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr, 762 entry.perm); 763 break; 764 case SMMU_TRANS_BYPASS: 765 entry.perm = flag; 766 entry.addr_mask = ~TARGET_PAGE_MASK; 767 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr, 768 entry.perm); 769 break; 770 case SMMU_TRANS_ABORT: 771 /* no event is recorded on abort */ 772 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr, 773 entry.perm); 774 break; 775 case SMMU_TRANS_ERROR: 776 qemu_log_mask(LOG_GUEST_ERROR, 777 "%s translation failed for iova=0x%"PRIx64"(%s)\n", 778 mr->parent_obj.name, addr, smmu_event_string(event.type)); 779 smmuv3_record_event(s, &event); 780 break; 781 } 782 783 return entry; 784 } 785 786 /** 787 * smmuv3_notify_iova - call the notifier @n for a given 788 * @asid and @iova tuple. 789 * 790 * @mr: IOMMU mr region handle 791 * @n: notifier to be called 792 * @asid: address space ID or negative value if we don't care 793 * @iova: iova 794 * @tg: translation granule (if communicated through range invalidation) 795 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1 796 */ 797 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr, 798 IOMMUNotifier *n, 799 int asid, dma_addr_t iova, 800 uint8_t tg, uint64_t num_pages) 801 { 802 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 803 IOMMUTLBEvent event; 804 uint8_t granule; 805 806 if (!tg) { 807 SMMUEventInfo event = {.inval_ste_allowed = true}; 808 SMMUTransCfg *cfg = smmuv3_get_config(sdev, &event); 809 SMMUTransTableInfo *tt; 810 811 if (!cfg) { 812 return; 813 } 814 815 if (asid >= 0 && cfg->asid != asid) { 816 return; 817 } 818 819 tt = select_tt(cfg, iova); 820 if (!tt) { 821 return; 822 } 823 granule = tt->granule_sz; 824 } else { 825 granule = tg * 2 + 10; 826 } 827 828 event.type = IOMMU_NOTIFIER_UNMAP; 829 event.entry.target_as = &address_space_memory; 830 event.entry.iova = iova; 831 event.entry.addr_mask = num_pages * (1 << granule) - 1; 832 event.entry.perm = IOMMU_NONE; 833 834 memory_region_notify_iommu_one(n, &event); 835 } 836 837 /* invalidate an asid/iova range tuple in all mr's */ 838 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova, 839 uint8_t tg, uint64_t num_pages) 840 { 841 SMMUDevice *sdev; 842 843 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) { 844 IOMMUMemoryRegion *mr = &sdev->iommu; 845 IOMMUNotifier *n; 846 847 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova, 848 tg, num_pages); 849 850 IOMMU_NOTIFIER_FOREACH(n, mr) { 851 smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages); 852 } 853 } 854 } 855 856 static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd) 857 { 858 uint8_t scale = 0, num = 0, ttl = 0; 859 dma_addr_t addr = CMD_ADDR(cmd); 860 uint8_t type = CMD_TYPE(cmd); 861 uint16_t vmid = CMD_VMID(cmd); 862 bool leaf = CMD_LEAF(cmd); 863 uint8_t tg = CMD_TG(cmd); 864 hwaddr num_pages = 1; 865 int asid = -1; 866 867 if (tg) { 868 scale = CMD_SCALE(cmd); 869 num = CMD_NUM(cmd); 870 ttl = CMD_TTL(cmd); 871 num_pages = (num + 1) * BIT_ULL(scale); 872 } 873 874 if (type == SMMU_CMD_TLBI_NH_VA) { 875 asid = CMD_ASID(cmd); 876 } 877 trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf); 878 smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages); 879 smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl); 880 } 881 882 static int smmuv3_cmdq_consume(SMMUv3State *s) 883 { 884 SMMUState *bs = ARM_SMMU(s); 885 SMMUCmdError cmd_error = SMMU_CERROR_NONE; 886 SMMUQueue *q = &s->cmdq; 887 SMMUCommandType type = 0; 888 889 if (!smmuv3_cmdq_enabled(s)) { 890 return 0; 891 } 892 /* 893 * some commands depend on register values, typically CR0. In case those 894 * register values change while handling the command, spec says it 895 * is UNPREDICTABLE whether the command is interpreted under the new 896 * or old value. 897 */ 898 899 while (!smmuv3_q_empty(q)) { 900 uint32_t pending = s->gerror ^ s->gerrorn; 901 Cmd cmd; 902 903 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q), 904 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 905 906 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) { 907 break; 908 } 909 910 if (queue_read(q, &cmd) != MEMTX_OK) { 911 cmd_error = SMMU_CERROR_ABT; 912 break; 913 } 914 915 type = CMD_TYPE(&cmd); 916 917 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type)); 918 919 qemu_mutex_lock(&s->mutex); 920 switch (type) { 921 case SMMU_CMD_SYNC: 922 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) { 923 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0); 924 } 925 break; 926 case SMMU_CMD_PREFETCH_CONFIG: 927 case SMMU_CMD_PREFETCH_ADDR: 928 break; 929 case SMMU_CMD_CFGI_STE: 930 { 931 uint32_t sid = CMD_SID(&cmd); 932 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid); 933 SMMUDevice *sdev; 934 935 if (CMD_SSEC(&cmd)) { 936 cmd_error = SMMU_CERROR_ILL; 937 break; 938 } 939 940 if (!mr) { 941 break; 942 } 943 944 trace_smmuv3_cmdq_cfgi_ste(sid); 945 sdev = container_of(mr, SMMUDevice, iommu); 946 smmuv3_flush_config(sdev); 947 948 break; 949 } 950 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */ 951 { 952 uint32_t start = CMD_SID(&cmd), end, i; 953 uint8_t range = CMD_STE_RANGE(&cmd); 954 955 if (CMD_SSEC(&cmd)) { 956 cmd_error = SMMU_CERROR_ILL; 957 break; 958 } 959 960 end = start + (1 << (range + 1)) - 1; 961 trace_smmuv3_cmdq_cfgi_ste_range(start, end); 962 963 for (i = start; i <= end; i++) { 964 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, i); 965 SMMUDevice *sdev; 966 967 if (!mr) { 968 continue; 969 } 970 sdev = container_of(mr, SMMUDevice, iommu); 971 smmuv3_flush_config(sdev); 972 } 973 break; 974 } 975 case SMMU_CMD_CFGI_CD: 976 case SMMU_CMD_CFGI_CD_ALL: 977 { 978 uint32_t sid = CMD_SID(&cmd); 979 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid); 980 SMMUDevice *sdev; 981 982 if (CMD_SSEC(&cmd)) { 983 cmd_error = SMMU_CERROR_ILL; 984 break; 985 } 986 987 if (!mr) { 988 break; 989 } 990 991 trace_smmuv3_cmdq_cfgi_cd(sid); 992 sdev = container_of(mr, SMMUDevice, iommu); 993 smmuv3_flush_config(sdev); 994 break; 995 } 996 case SMMU_CMD_TLBI_NH_ASID: 997 { 998 uint16_t asid = CMD_ASID(&cmd); 999 1000 trace_smmuv3_cmdq_tlbi_nh_asid(asid); 1001 smmu_inv_notifiers_all(&s->smmu_state); 1002 smmu_iotlb_inv_asid(bs, asid); 1003 break; 1004 } 1005 case SMMU_CMD_TLBI_NH_ALL: 1006 case SMMU_CMD_TLBI_NSNH_ALL: 1007 trace_smmuv3_cmdq_tlbi_nh(); 1008 smmu_inv_notifiers_all(&s->smmu_state); 1009 smmu_iotlb_inv_all(bs); 1010 break; 1011 case SMMU_CMD_TLBI_NH_VAA: 1012 case SMMU_CMD_TLBI_NH_VA: 1013 smmuv3_s1_range_inval(bs, &cmd); 1014 break; 1015 case SMMU_CMD_TLBI_EL3_ALL: 1016 case SMMU_CMD_TLBI_EL3_VA: 1017 case SMMU_CMD_TLBI_EL2_ALL: 1018 case SMMU_CMD_TLBI_EL2_ASID: 1019 case SMMU_CMD_TLBI_EL2_VA: 1020 case SMMU_CMD_TLBI_EL2_VAA: 1021 case SMMU_CMD_TLBI_S12_VMALL: 1022 case SMMU_CMD_TLBI_S2_IPA: 1023 case SMMU_CMD_ATC_INV: 1024 case SMMU_CMD_PRI_RESP: 1025 case SMMU_CMD_RESUME: 1026 case SMMU_CMD_STALL_TERM: 1027 trace_smmuv3_unhandled_cmd(type); 1028 break; 1029 default: 1030 cmd_error = SMMU_CERROR_ILL; 1031 qemu_log_mask(LOG_GUEST_ERROR, 1032 "Illegal command type: %d\n", CMD_TYPE(&cmd)); 1033 break; 1034 } 1035 qemu_mutex_unlock(&s->mutex); 1036 if (cmd_error) { 1037 break; 1038 } 1039 /* 1040 * We only increment the cons index after the completion of 1041 * the command. We do that because the SYNC returns immediately 1042 * and does not check the completion of previous commands 1043 */ 1044 queue_cons_incr(q); 1045 } 1046 1047 if (cmd_error) { 1048 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error); 1049 smmu_write_cmdq_err(s, cmd_error); 1050 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK); 1051 } 1052 1053 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q), 1054 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 1055 1056 return 0; 1057 } 1058 1059 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset, 1060 uint64_t data, MemTxAttrs attrs) 1061 { 1062 switch (offset) { 1063 case A_GERROR_IRQ_CFG0: 1064 s->gerror_irq_cfg0 = data; 1065 return MEMTX_OK; 1066 case A_STRTAB_BASE: 1067 s->strtab_base = data; 1068 return MEMTX_OK; 1069 case A_CMDQ_BASE: 1070 s->cmdq.base = data; 1071 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 1072 if (s->cmdq.log2size > SMMU_CMDQS) { 1073 s->cmdq.log2size = SMMU_CMDQS; 1074 } 1075 return MEMTX_OK; 1076 case A_EVENTQ_BASE: 1077 s->eventq.base = data; 1078 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 1079 if (s->eventq.log2size > SMMU_EVENTQS) { 1080 s->eventq.log2size = SMMU_EVENTQS; 1081 } 1082 return MEMTX_OK; 1083 case A_EVENTQ_IRQ_CFG0: 1084 s->eventq_irq_cfg0 = data; 1085 return MEMTX_OK; 1086 default: 1087 qemu_log_mask(LOG_UNIMP, 1088 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n", 1089 __func__, offset); 1090 return MEMTX_OK; 1091 } 1092 } 1093 1094 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset, 1095 uint64_t data, MemTxAttrs attrs) 1096 { 1097 switch (offset) { 1098 case A_CR0: 1099 s->cr[0] = data; 1100 s->cr0ack = data & ~SMMU_CR0_RESERVED; 1101 /* in case the command queue has been enabled */ 1102 smmuv3_cmdq_consume(s); 1103 return MEMTX_OK; 1104 case A_CR1: 1105 s->cr[1] = data; 1106 return MEMTX_OK; 1107 case A_CR2: 1108 s->cr[2] = data; 1109 return MEMTX_OK; 1110 case A_IRQ_CTRL: 1111 s->irq_ctrl = data; 1112 return MEMTX_OK; 1113 case A_GERRORN: 1114 smmuv3_write_gerrorn(s, data); 1115 /* 1116 * By acknowledging the CMDQ_ERR, SW may notify cmds can 1117 * be processed again 1118 */ 1119 smmuv3_cmdq_consume(s); 1120 return MEMTX_OK; 1121 case A_GERROR_IRQ_CFG0: /* 64b */ 1122 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data); 1123 return MEMTX_OK; 1124 case A_GERROR_IRQ_CFG0 + 4: 1125 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data); 1126 return MEMTX_OK; 1127 case A_GERROR_IRQ_CFG1: 1128 s->gerror_irq_cfg1 = data; 1129 return MEMTX_OK; 1130 case A_GERROR_IRQ_CFG2: 1131 s->gerror_irq_cfg2 = data; 1132 return MEMTX_OK; 1133 case A_STRTAB_BASE: /* 64b */ 1134 s->strtab_base = deposit64(s->strtab_base, 0, 32, data); 1135 return MEMTX_OK; 1136 case A_STRTAB_BASE + 4: 1137 s->strtab_base = deposit64(s->strtab_base, 32, 32, data); 1138 return MEMTX_OK; 1139 case A_STRTAB_BASE_CFG: 1140 s->strtab_base_cfg = data; 1141 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) { 1142 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); 1143 s->features |= SMMU_FEATURE_2LVL_STE; 1144 } 1145 return MEMTX_OK; 1146 case A_CMDQ_BASE: /* 64b */ 1147 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data); 1148 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 1149 if (s->cmdq.log2size > SMMU_CMDQS) { 1150 s->cmdq.log2size = SMMU_CMDQS; 1151 } 1152 return MEMTX_OK; 1153 case A_CMDQ_BASE + 4: /* 64b */ 1154 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data); 1155 return MEMTX_OK; 1156 case A_CMDQ_PROD: 1157 s->cmdq.prod = data; 1158 smmuv3_cmdq_consume(s); 1159 return MEMTX_OK; 1160 case A_CMDQ_CONS: 1161 s->cmdq.cons = data; 1162 return MEMTX_OK; 1163 case A_EVENTQ_BASE: /* 64b */ 1164 s->eventq.base = deposit64(s->eventq.base, 0, 32, data); 1165 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 1166 if (s->eventq.log2size > SMMU_EVENTQS) { 1167 s->eventq.log2size = SMMU_EVENTQS; 1168 } 1169 return MEMTX_OK; 1170 case A_EVENTQ_BASE + 4: 1171 s->eventq.base = deposit64(s->eventq.base, 32, 32, data); 1172 return MEMTX_OK; 1173 case A_EVENTQ_PROD: 1174 s->eventq.prod = data; 1175 return MEMTX_OK; 1176 case A_EVENTQ_CONS: 1177 s->eventq.cons = data; 1178 return MEMTX_OK; 1179 case A_EVENTQ_IRQ_CFG0: /* 64b */ 1180 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data); 1181 return MEMTX_OK; 1182 case A_EVENTQ_IRQ_CFG0 + 4: 1183 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data); 1184 return MEMTX_OK; 1185 case A_EVENTQ_IRQ_CFG1: 1186 s->eventq_irq_cfg1 = data; 1187 return MEMTX_OK; 1188 case A_EVENTQ_IRQ_CFG2: 1189 s->eventq_irq_cfg2 = data; 1190 return MEMTX_OK; 1191 default: 1192 qemu_log_mask(LOG_UNIMP, 1193 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n", 1194 __func__, offset); 1195 return MEMTX_OK; 1196 } 1197 } 1198 1199 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data, 1200 unsigned size, MemTxAttrs attrs) 1201 { 1202 SMMUState *sys = opaque; 1203 SMMUv3State *s = ARM_SMMUV3(sys); 1204 MemTxResult r; 1205 1206 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1207 offset &= ~0x10000; 1208 1209 switch (size) { 1210 case 8: 1211 r = smmu_writell(s, offset, data, attrs); 1212 break; 1213 case 4: 1214 r = smmu_writel(s, offset, data, attrs); 1215 break; 1216 default: 1217 r = MEMTX_ERROR; 1218 break; 1219 } 1220 1221 trace_smmuv3_write_mmio(offset, data, size, r); 1222 return r; 1223 } 1224 1225 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset, 1226 uint64_t *data, MemTxAttrs attrs) 1227 { 1228 switch (offset) { 1229 case A_GERROR_IRQ_CFG0: 1230 *data = s->gerror_irq_cfg0; 1231 return MEMTX_OK; 1232 case A_STRTAB_BASE: 1233 *data = s->strtab_base; 1234 return MEMTX_OK; 1235 case A_CMDQ_BASE: 1236 *data = s->cmdq.base; 1237 return MEMTX_OK; 1238 case A_EVENTQ_BASE: 1239 *data = s->eventq.base; 1240 return MEMTX_OK; 1241 default: 1242 *data = 0; 1243 qemu_log_mask(LOG_UNIMP, 1244 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n", 1245 __func__, offset); 1246 return MEMTX_OK; 1247 } 1248 } 1249 1250 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset, 1251 uint64_t *data, MemTxAttrs attrs) 1252 { 1253 switch (offset) { 1254 case A_IDREGS ... A_IDREGS + 0x2f: 1255 *data = smmuv3_idreg(offset - A_IDREGS); 1256 return MEMTX_OK; 1257 case A_IDR0 ... A_IDR5: 1258 *data = s->idr[(offset - A_IDR0) / 4]; 1259 return MEMTX_OK; 1260 case A_IIDR: 1261 *data = s->iidr; 1262 return MEMTX_OK; 1263 case A_AIDR: 1264 *data = s->aidr; 1265 return MEMTX_OK; 1266 case A_CR0: 1267 *data = s->cr[0]; 1268 return MEMTX_OK; 1269 case A_CR0ACK: 1270 *data = s->cr0ack; 1271 return MEMTX_OK; 1272 case A_CR1: 1273 *data = s->cr[1]; 1274 return MEMTX_OK; 1275 case A_CR2: 1276 *data = s->cr[2]; 1277 return MEMTX_OK; 1278 case A_STATUSR: 1279 *data = s->statusr; 1280 return MEMTX_OK; 1281 case A_IRQ_CTRL: 1282 case A_IRQ_CTRL_ACK: 1283 *data = s->irq_ctrl; 1284 return MEMTX_OK; 1285 case A_GERROR: 1286 *data = s->gerror; 1287 return MEMTX_OK; 1288 case A_GERRORN: 1289 *data = s->gerrorn; 1290 return MEMTX_OK; 1291 case A_GERROR_IRQ_CFG0: /* 64b */ 1292 *data = extract64(s->gerror_irq_cfg0, 0, 32); 1293 return MEMTX_OK; 1294 case A_GERROR_IRQ_CFG0 + 4: 1295 *data = extract64(s->gerror_irq_cfg0, 32, 32); 1296 return MEMTX_OK; 1297 case A_GERROR_IRQ_CFG1: 1298 *data = s->gerror_irq_cfg1; 1299 return MEMTX_OK; 1300 case A_GERROR_IRQ_CFG2: 1301 *data = s->gerror_irq_cfg2; 1302 return MEMTX_OK; 1303 case A_STRTAB_BASE: /* 64b */ 1304 *data = extract64(s->strtab_base, 0, 32); 1305 return MEMTX_OK; 1306 case A_STRTAB_BASE + 4: /* 64b */ 1307 *data = extract64(s->strtab_base, 32, 32); 1308 return MEMTX_OK; 1309 case A_STRTAB_BASE_CFG: 1310 *data = s->strtab_base_cfg; 1311 return MEMTX_OK; 1312 case A_CMDQ_BASE: /* 64b */ 1313 *data = extract64(s->cmdq.base, 0, 32); 1314 return MEMTX_OK; 1315 case A_CMDQ_BASE + 4: 1316 *data = extract64(s->cmdq.base, 32, 32); 1317 return MEMTX_OK; 1318 case A_CMDQ_PROD: 1319 *data = s->cmdq.prod; 1320 return MEMTX_OK; 1321 case A_CMDQ_CONS: 1322 *data = s->cmdq.cons; 1323 return MEMTX_OK; 1324 case A_EVENTQ_BASE: /* 64b */ 1325 *data = extract64(s->eventq.base, 0, 32); 1326 return MEMTX_OK; 1327 case A_EVENTQ_BASE + 4: /* 64b */ 1328 *data = extract64(s->eventq.base, 32, 32); 1329 return MEMTX_OK; 1330 case A_EVENTQ_PROD: 1331 *data = s->eventq.prod; 1332 return MEMTX_OK; 1333 case A_EVENTQ_CONS: 1334 *data = s->eventq.cons; 1335 return MEMTX_OK; 1336 default: 1337 *data = 0; 1338 qemu_log_mask(LOG_UNIMP, 1339 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n", 1340 __func__, offset); 1341 return MEMTX_OK; 1342 } 1343 } 1344 1345 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data, 1346 unsigned size, MemTxAttrs attrs) 1347 { 1348 SMMUState *sys = opaque; 1349 SMMUv3State *s = ARM_SMMUV3(sys); 1350 MemTxResult r; 1351 1352 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1353 offset &= ~0x10000; 1354 1355 switch (size) { 1356 case 8: 1357 r = smmu_readll(s, offset, data, attrs); 1358 break; 1359 case 4: 1360 r = smmu_readl(s, offset, data, attrs); 1361 break; 1362 default: 1363 r = MEMTX_ERROR; 1364 break; 1365 } 1366 1367 trace_smmuv3_read_mmio(offset, *data, size, r); 1368 return r; 1369 } 1370 1371 static const MemoryRegionOps smmu_mem_ops = { 1372 .read_with_attrs = smmu_read_mmio, 1373 .write_with_attrs = smmu_write_mmio, 1374 .endianness = DEVICE_LITTLE_ENDIAN, 1375 .valid = { 1376 .min_access_size = 4, 1377 .max_access_size = 8, 1378 }, 1379 .impl = { 1380 .min_access_size = 4, 1381 .max_access_size = 8, 1382 }, 1383 }; 1384 1385 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev) 1386 { 1387 int i; 1388 1389 for (i = 0; i < ARRAY_SIZE(s->irq); i++) { 1390 sysbus_init_irq(dev, &s->irq[i]); 1391 } 1392 } 1393 1394 static void smmu_reset(DeviceState *dev) 1395 { 1396 SMMUv3State *s = ARM_SMMUV3(dev); 1397 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1398 1399 c->parent_reset(dev); 1400 1401 smmuv3_init_regs(s); 1402 } 1403 1404 static void smmu_realize(DeviceState *d, Error **errp) 1405 { 1406 SMMUState *sys = ARM_SMMU(d); 1407 SMMUv3State *s = ARM_SMMUV3(sys); 1408 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1409 SysBusDevice *dev = SYS_BUS_DEVICE(d); 1410 Error *local_err = NULL; 1411 1412 c->parent_realize(d, &local_err); 1413 if (local_err) { 1414 error_propagate(errp, local_err); 1415 return; 1416 } 1417 1418 qemu_mutex_init(&s->mutex); 1419 1420 memory_region_init_io(&sys->iomem, OBJECT(s), 1421 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000); 1422 1423 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION; 1424 1425 sysbus_init_mmio(dev, &sys->iomem); 1426 1427 smmu_init_irq(s, dev); 1428 } 1429 1430 static const VMStateDescription vmstate_smmuv3_queue = { 1431 .name = "smmuv3_queue", 1432 .version_id = 1, 1433 .minimum_version_id = 1, 1434 .fields = (VMStateField[]) { 1435 VMSTATE_UINT64(base, SMMUQueue), 1436 VMSTATE_UINT32(prod, SMMUQueue), 1437 VMSTATE_UINT32(cons, SMMUQueue), 1438 VMSTATE_UINT8(log2size, SMMUQueue), 1439 VMSTATE_END_OF_LIST(), 1440 }, 1441 }; 1442 1443 static const VMStateDescription vmstate_smmuv3 = { 1444 .name = "smmuv3", 1445 .version_id = 1, 1446 .minimum_version_id = 1, 1447 .priority = MIG_PRI_IOMMU, 1448 .fields = (VMStateField[]) { 1449 VMSTATE_UINT32(features, SMMUv3State), 1450 VMSTATE_UINT8(sid_size, SMMUv3State), 1451 VMSTATE_UINT8(sid_split, SMMUv3State), 1452 1453 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3), 1454 VMSTATE_UINT32(cr0ack, SMMUv3State), 1455 VMSTATE_UINT32(statusr, SMMUv3State), 1456 VMSTATE_UINT32(irq_ctrl, SMMUv3State), 1457 VMSTATE_UINT32(gerror, SMMUv3State), 1458 VMSTATE_UINT32(gerrorn, SMMUv3State), 1459 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State), 1460 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State), 1461 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State), 1462 VMSTATE_UINT64(strtab_base, SMMUv3State), 1463 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State), 1464 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State), 1465 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State), 1466 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State), 1467 1468 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1469 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1470 1471 VMSTATE_END_OF_LIST(), 1472 }, 1473 }; 1474 1475 static void smmuv3_instance_init(Object *obj) 1476 { 1477 /* Nothing much to do here as of now */ 1478 } 1479 1480 static void smmuv3_class_init(ObjectClass *klass, void *data) 1481 { 1482 DeviceClass *dc = DEVICE_CLASS(klass); 1483 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass); 1484 1485 dc->vmsd = &vmstate_smmuv3; 1486 device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset); 1487 c->parent_realize = dc->realize; 1488 dc->realize = smmu_realize; 1489 } 1490 1491 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu, 1492 IOMMUNotifierFlag old, 1493 IOMMUNotifierFlag new, 1494 Error **errp) 1495 { 1496 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu); 1497 SMMUv3State *s3 = sdev->smmu; 1498 SMMUState *s = &(s3->smmu_state); 1499 1500 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) { 1501 error_setg(errp, "SMMUv3 does not support dev-iotlb yet"); 1502 return -EINVAL; 1503 } 1504 1505 if (new & IOMMU_NOTIFIER_MAP) { 1506 error_setg(errp, 1507 "device %02x.%02x.%x requires iommu MAP notifier which is " 1508 "not currently supported", pci_bus_num(sdev->bus), 1509 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn)); 1510 return -EINVAL; 1511 } 1512 1513 if (old == IOMMU_NOTIFIER_NONE) { 1514 trace_smmuv3_notify_flag_add(iommu->parent_obj.name); 1515 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next); 1516 } else if (new == IOMMU_NOTIFIER_NONE) { 1517 trace_smmuv3_notify_flag_del(iommu->parent_obj.name); 1518 QLIST_REMOVE(sdev, next); 1519 } 1520 return 0; 1521 } 1522 1523 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass, 1524 void *data) 1525 { 1526 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 1527 1528 imrc->translate = smmuv3_translate; 1529 imrc->notify_flag_changed = smmuv3_notify_flag_changed; 1530 } 1531 1532 static const TypeInfo smmuv3_type_info = { 1533 .name = TYPE_ARM_SMMUV3, 1534 .parent = TYPE_ARM_SMMU, 1535 .instance_size = sizeof(SMMUv3State), 1536 .instance_init = smmuv3_instance_init, 1537 .class_size = sizeof(SMMUv3Class), 1538 .class_init = smmuv3_class_init, 1539 }; 1540 1541 static const TypeInfo smmuv3_iommu_memory_region_info = { 1542 .parent = TYPE_IOMMU_MEMORY_REGION, 1543 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION, 1544 .class_init = smmuv3_iommu_memory_region_class_init, 1545 }; 1546 1547 static void smmuv3_register_types(void) 1548 { 1549 type_register(&smmuv3_type_info); 1550 type_register(&smmuv3_iommu_memory_region_info); 1551 } 1552 1553 type_init(smmuv3_register_types) 1554 1555