1 /* 2 * Copyright (C) 2014-2016 Broadcom Corporation 3 * Copyright (c) 2017 Red Hat, Inc. 4 * Written by Prem Mallappa, Eric Auger 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License along 16 * with this program; if not, see <http://www.gnu.org/licenses/>. 17 */ 18 19 #include "qemu/osdep.h" 20 #include "qemu/bitops.h" 21 #include "hw/irq.h" 22 #include "hw/sysbus.h" 23 #include "migration/vmstate.h" 24 #include "hw/qdev-core.h" 25 #include "hw/pci/pci.h" 26 #include "cpu.h" 27 #include "trace.h" 28 #include "qemu/log.h" 29 #include "qemu/error-report.h" 30 #include "qapi/error.h" 31 32 #include "hw/arm/smmuv3.h" 33 #include "smmuv3-internal.h" 34 #include "smmu-internal.h" 35 36 /** 37 * smmuv3_trigger_irq - pulse @irq if enabled and update 38 * GERROR register in case of GERROR interrupt 39 * 40 * @irq: irq type 41 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR) 42 */ 43 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, 44 uint32_t gerror_mask) 45 { 46 47 bool pulse = false; 48 49 switch (irq) { 50 case SMMU_IRQ_EVTQ: 51 pulse = smmuv3_eventq_irq_enabled(s); 52 break; 53 case SMMU_IRQ_PRIQ: 54 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n"); 55 break; 56 case SMMU_IRQ_CMD_SYNC: 57 pulse = true; 58 break; 59 case SMMU_IRQ_GERROR: 60 { 61 uint32_t pending = s->gerror ^ s->gerrorn; 62 uint32_t new_gerrors = ~pending & gerror_mask; 63 64 if (!new_gerrors) { 65 /* only toggle non pending errors */ 66 return; 67 } 68 s->gerror ^= new_gerrors; 69 trace_smmuv3_write_gerror(new_gerrors, s->gerror); 70 71 pulse = smmuv3_gerror_irq_enabled(s); 72 break; 73 } 74 } 75 if (pulse) { 76 trace_smmuv3_trigger_irq(irq); 77 qemu_irq_pulse(s->irq[irq]); 78 } 79 } 80 81 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn) 82 { 83 uint32_t pending = s->gerror ^ s->gerrorn; 84 uint32_t toggled = s->gerrorn ^ new_gerrorn; 85 86 if (toggled & ~pending) { 87 qemu_log_mask(LOG_GUEST_ERROR, 88 "guest toggles non pending errors = 0x%x\n", 89 toggled & ~pending); 90 } 91 92 /* 93 * We do not raise any error in case guest toggles bits corresponding 94 * to not active IRQs (CONSTRAINED UNPREDICTABLE) 95 */ 96 s->gerrorn = new_gerrorn; 97 98 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn); 99 } 100 101 static inline MemTxResult queue_read(SMMUQueue *q, void *data) 102 { 103 dma_addr_t addr = Q_CONS_ENTRY(q); 104 105 return dma_memory_read(&address_space_memory, addr, data, q->entry_size, 106 MEMTXATTRS_UNSPECIFIED); 107 } 108 109 static MemTxResult queue_write(SMMUQueue *q, void *data) 110 { 111 dma_addr_t addr = Q_PROD_ENTRY(q); 112 MemTxResult ret; 113 114 ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size, 115 MEMTXATTRS_UNSPECIFIED); 116 if (ret != MEMTX_OK) { 117 return ret; 118 } 119 120 queue_prod_incr(q); 121 return MEMTX_OK; 122 } 123 124 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt) 125 { 126 SMMUQueue *q = &s->eventq; 127 MemTxResult r; 128 129 if (!smmuv3_eventq_enabled(s)) { 130 return MEMTX_ERROR; 131 } 132 133 if (smmuv3_q_full(q)) { 134 return MEMTX_ERROR; 135 } 136 137 r = queue_write(q, evt); 138 if (r != MEMTX_OK) { 139 return r; 140 } 141 142 if (!smmuv3_q_empty(q)) { 143 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0); 144 } 145 return MEMTX_OK; 146 } 147 148 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info) 149 { 150 Evt evt = {}; 151 MemTxResult r; 152 153 if (!smmuv3_eventq_enabled(s)) { 154 return; 155 } 156 157 EVT_SET_TYPE(&evt, info->type); 158 EVT_SET_SID(&evt, info->sid); 159 160 switch (info->type) { 161 case SMMU_EVT_NONE: 162 return; 163 case SMMU_EVT_F_UUT: 164 EVT_SET_SSID(&evt, info->u.f_uut.ssid); 165 EVT_SET_SSV(&evt, info->u.f_uut.ssv); 166 EVT_SET_ADDR(&evt, info->u.f_uut.addr); 167 EVT_SET_RNW(&evt, info->u.f_uut.rnw); 168 EVT_SET_PNU(&evt, info->u.f_uut.pnu); 169 EVT_SET_IND(&evt, info->u.f_uut.ind); 170 break; 171 case SMMU_EVT_C_BAD_STREAMID: 172 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid); 173 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv); 174 break; 175 case SMMU_EVT_F_STE_FETCH: 176 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid); 177 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv); 178 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr); 179 break; 180 case SMMU_EVT_C_BAD_STE: 181 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid); 182 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv); 183 break; 184 case SMMU_EVT_F_STREAM_DISABLED: 185 break; 186 case SMMU_EVT_F_TRANS_FORBIDDEN: 187 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr); 188 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw); 189 break; 190 case SMMU_EVT_C_BAD_SUBSTREAMID: 191 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid); 192 break; 193 case SMMU_EVT_F_CD_FETCH: 194 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid); 195 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv); 196 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr); 197 break; 198 case SMMU_EVT_C_BAD_CD: 199 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid); 200 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv); 201 break; 202 case SMMU_EVT_F_WALK_EABT: 203 case SMMU_EVT_F_TRANSLATION: 204 case SMMU_EVT_F_ADDR_SIZE: 205 case SMMU_EVT_F_ACCESS: 206 case SMMU_EVT_F_PERMISSION: 207 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall); 208 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag); 209 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid); 210 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv); 211 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2); 212 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr); 213 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw); 214 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu); 215 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind); 216 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class); 217 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2); 218 break; 219 case SMMU_EVT_F_CFG_CONFLICT: 220 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid); 221 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv); 222 break; 223 /* rest is not implemented */ 224 case SMMU_EVT_F_BAD_ATS_TREQ: 225 case SMMU_EVT_F_TLB_CONFLICT: 226 case SMMU_EVT_E_PAGE_REQ: 227 default: 228 g_assert_not_reached(); 229 } 230 231 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid); 232 r = smmuv3_write_eventq(s, &evt); 233 if (r != MEMTX_OK) { 234 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK); 235 } 236 info->recorded = true; 237 } 238 239 static void smmuv3_init_regs(SMMUv3State *s) 240 { 241 /** 242 * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID, 243 * multi-level stream table 244 */ 245 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */ 246 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */ 247 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */ 248 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */ 249 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */ 250 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */ 251 /* terminated transaction will always be aborted/error returned */ 252 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1); 253 /* 2-level stream table supported */ 254 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1); 255 256 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE); 257 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS); 258 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS); 259 260 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1); 261 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1); 262 263 /* 4K, 16K and 64K granule support */ 264 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1); 265 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1); 266 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1); 267 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */ 268 269 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS); 270 s->cmdq.prod = 0; 271 s->cmdq.cons = 0; 272 s->cmdq.entry_size = sizeof(struct Cmd); 273 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS); 274 s->eventq.prod = 0; 275 s->eventq.cons = 0; 276 s->eventq.entry_size = sizeof(struct Evt); 277 278 s->features = 0; 279 s->sid_split = 0; 280 s->aidr = 0x1; 281 } 282 283 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf, 284 SMMUEventInfo *event) 285 { 286 int ret; 287 288 trace_smmuv3_get_ste(addr); 289 /* TODO: guarantee 64-bit single-copy atomicity */ 290 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf), 291 MEMTXATTRS_UNSPECIFIED); 292 if (ret != MEMTX_OK) { 293 qemu_log_mask(LOG_GUEST_ERROR, 294 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 295 event->type = SMMU_EVT_F_STE_FETCH; 296 event->u.f_ste_fetch.addr = addr; 297 return -EINVAL; 298 } 299 return 0; 300 301 } 302 303 /* @ssid > 0 not supported yet */ 304 static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid, 305 CD *buf, SMMUEventInfo *event) 306 { 307 dma_addr_t addr = STE_CTXPTR(ste); 308 int ret; 309 310 trace_smmuv3_get_cd(addr); 311 /* TODO: guarantee 64-bit single-copy atomicity */ 312 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf), 313 MEMTXATTRS_UNSPECIFIED); 314 if (ret != MEMTX_OK) { 315 qemu_log_mask(LOG_GUEST_ERROR, 316 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 317 event->type = SMMU_EVT_F_CD_FETCH; 318 event->u.f_ste_fetch.addr = addr; 319 return -EINVAL; 320 } 321 return 0; 322 } 323 324 /* Returns < 0 in case of invalid STE, 0 otherwise */ 325 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg, 326 STE *ste, SMMUEventInfo *event) 327 { 328 uint32_t config; 329 330 if (!STE_VALID(ste)) { 331 if (!event->inval_ste_allowed) { 332 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n"); 333 } 334 goto bad_ste; 335 } 336 337 config = STE_CONFIG(ste); 338 339 if (STE_CFG_ABORT(config)) { 340 cfg->aborted = true; 341 return 0; 342 } 343 344 if (STE_CFG_BYPASS(config)) { 345 cfg->bypassed = true; 346 return 0; 347 } 348 349 if (STE_CFG_S2_ENABLED(config)) { 350 qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n"); 351 goto bad_ste; 352 } 353 354 if (STE_S1CDMAX(ste) != 0) { 355 qemu_log_mask(LOG_UNIMP, 356 "SMMUv3 does not support multiple context descriptors yet\n"); 357 goto bad_ste; 358 } 359 360 if (STE_S1STALLD(ste)) { 361 qemu_log_mask(LOG_UNIMP, 362 "SMMUv3 S1 stalling fault model not allowed yet\n"); 363 goto bad_ste; 364 } 365 return 0; 366 367 bad_ste: 368 event->type = SMMU_EVT_C_BAD_STE; 369 return -EINVAL; 370 } 371 372 /** 373 * smmu_find_ste - Return the stream table entry associated 374 * to the sid 375 * 376 * @s: smmuv3 handle 377 * @sid: stream ID 378 * @ste: returned stream table entry 379 * @event: handle to an event info 380 * 381 * Supports linear and 2-level stream table 382 * Return 0 on success, -EINVAL otherwise 383 */ 384 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, 385 SMMUEventInfo *event) 386 { 387 dma_addr_t addr, strtab_base; 388 uint32_t log2size; 389 int strtab_size_shift; 390 int ret; 391 392 trace_smmuv3_find_ste(sid, s->features, s->sid_split); 393 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE); 394 /* 395 * Check SID range against both guest-configured and implementation limits 396 */ 397 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) { 398 event->type = SMMU_EVT_C_BAD_STREAMID; 399 return -EINVAL; 400 } 401 if (s->features & SMMU_FEATURE_2LVL_STE) { 402 int l1_ste_offset, l2_ste_offset, max_l2_ste, span; 403 dma_addr_t l1ptr, l2ptr; 404 STEDesc l1std; 405 406 /* 407 * Align strtab base address to table size. For this purpose, assume it 408 * is not bounded by SMMU_IDR1_SIDSIZE. 409 */ 410 strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3); 411 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & 412 ~MAKE_64BIT_MASK(0, strtab_size_shift); 413 l1_ste_offset = sid >> s->sid_split; 414 l2_ste_offset = sid & ((1 << s->sid_split) - 1); 415 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std)); 416 /* TODO: guarantee 64-bit single-copy atomicity */ 417 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std, 418 sizeof(l1std), MEMTXATTRS_UNSPECIFIED); 419 if (ret != MEMTX_OK) { 420 qemu_log_mask(LOG_GUEST_ERROR, 421 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr); 422 event->type = SMMU_EVT_F_STE_FETCH; 423 event->u.f_ste_fetch.addr = l1ptr; 424 return -EINVAL; 425 } 426 427 span = L1STD_SPAN(&l1std); 428 429 if (!span) { 430 /* l2ptr is not valid */ 431 if (!event->inval_ste_allowed) { 432 qemu_log_mask(LOG_GUEST_ERROR, 433 "invalid sid=%d (L1STD span=0)\n", sid); 434 } 435 event->type = SMMU_EVT_C_BAD_STREAMID; 436 return -EINVAL; 437 } 438 max_l2_ste = (1 << span) - 1; 439 l2ptr = l1std_l2ptr(&l1std); 440 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, 441 l2ptr, l2_ste_offset, max_l2_ste); 442 if (l2_ste_offset > max_l2_ste) { 443 qemu_log_mask(LOG_GUEST_ERROR, 444 "l2_ste_offset=%d > max_l2_ste=%d\n", 445 l2_ste_offset, max_l2_ste); 446 event->type = SMMU_EVT_C_BAD_STE; 447 return -EINVAL; 448 } 449 addr = l2ptr + l2_ste_offset * sizeof(*ste); 450 } else { 451 strtab_size_shift = log2size + 5; 452 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & 453 ~MAKE_64BIT_MASK(0, strtab_size_shift); 454 addr = strtab_base + sid * sizeof(*ste); 455 } 456 457 if (smmu_get_ste(s, addr, ste, event)) { 458 return -EINVAL; 459 } 460 461 return 0; 462 } 463 464 static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event) 465 { 466 int ret = -EINVAL; 467 int i; 468 469 if (!CD_VALID(cd) || !CD_AARCH64(cd)) { 470 goto bad_cd; 471 } 472 if (!CD_A(cd)) { 473 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */ 474 } 475 if (CD_S(cd)) { 476 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */ 477 } 478 if (CD_HA(cd) || CD_HD(cd)) { 479 goto bad_cd; /* HTTU = 0 */ 480 } 481 482 /* we support only those at the moment */ 483 cfg->aa64 = true; 484 cfg->stage = 1; 485 486 cfg->oas = oas2bits(CD_IPS(cd)); 487 cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas); 488 cfg->tbi = CD_TBI(cd); 489 cfg->asid = CD_ASID(cd); 490 491 trace_smmuv3_decode_cd(cfg->oas); 492 493 /* decode data dependent on TT */ 494 for (i = 0; i <= 1; i++) { 495 int tg, tsz; 496 SMMUTransTableInfo *tt = &cfg->tt[i]; 497 498 cfg->tt[i].disabled = CD_EPD(cd, i); 499 if (cfg->tt[i].disabled) { 500 continue; 501 } 502 503 tsz = CD_TSZ(cd, i); 504 if (tsz < 16 || tsz > 39) { 505 goto bad_cd; 506 } 507 508 tg = CD_TG(cd, i); 509 tt->granule_sz = tg2granule(tg, i); 510 if ((tt->granule_sz != 12 && tt->granule_sz != 14 && 511 tt->granule_sz != 16) || CD_ENDI(cd)) { 512 goto bad_cd; 513 } 514 515 tt->tsz = tsz; 516 tt->ttb = CD_TTB(cd, i); 517 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) { 518 goto bad_cd; 519 } 520 tt->had = CD_HAD(cd, i); 521 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had); 522 } 523 524 event->record_trans_faults = CD_R(cd); 525 526 return 0; 527 528 bad_cd: 529 event->type = SMMU_EVT_C_BAD_CD; 530 return ret; 531 } 532 533 /** 534 * smmuv3_decode_config - Prepare the translation configuration 535 * for the @mr iommu region 536 * @mr: iommu memory region the translation config must be prepared for 537 * @cfg: output translation configuration which is populated through 538 * the different configuration decoding steps 539 * @event: must be zero'ed by the caller 540 * 541 * return < 0 in case of config decoding error (@event is filled 542 * accordingly). Return 0 otherwise. 543 */ 544 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg, 545 SMMUEventInfo *event) 546 { 547 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 548 uint32_t sid = smmu_get_sid(sdev); 549 SMMUv3State *s = sdev->smmu; 550 int ret; 551 STE ste; 552 CD cd; 553 554 ret = smmu_find_ste(s, sid, &ste, event); 555 if (ret) { 556 return ret; 557 } 558 559 ret = decode_ste(s, cfg, &ste, event); 560 if (ret) { 561 return ret; 562 } 563 564 if (cfg->aborted || cfg->bypassed) { 565 return 0; 566 } 567 568 ret = smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event); 569 if (ret) { 570 return ret; 571 } 572 573 return decode_cd(cfg, &cd, event); 574 } 575 576 /** 577 * smmuv3_get_config - Look up for a cached copy of configuration data for 578 * @sdev and on cache miss performs a configuration structure decoding from 579 * guest RAM. 580 * 581 * @sdev: SMMUDevice handle 582 * @event: output event info 583 * 584 * The configuration cache contains data resulting from both STE and CD 585 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed 586 * by the SMMUDevice handle. 587 */ 588 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event) 589 { 590 SMMUv3State *s = sdev->smmu; 591 SMMUState *bc = &s->smmu_state; 592 SMMUTransCfg *cfg; 593 594 cfg = g_hash_table_lookup(bc->configs, sdev); 595 if (cfg) { 596 sdev->cfg_cache_hits++; 597 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev), 598 sdev->cfg_cache_hits, sdev->cfg_cache_misses, 599 100 * sdev->cfg_cache_hits / 600 (sdev->cfg_cache_hits + sdev->cfg_cache_misses)); 601 } else { 602 sdev->cfg_cache_misses++; 603 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev), 604 sdev->cfg_cache_hits, sdev->cfg_cache_misses, 605 100 * sdev->cfg_cache_hits / 606 (sdev->cfg_cache_hits + sdev->cfg_cache_misses)); 607 cfg = g_new0(SMMUTransCfg, 1); 608 609 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) { 610 g_hash_table_insert(bc->configs, sdev, cfg); 611 } else { 612 g_free(cfg); 613 cfg = NULL; 614 } 615 } 616 return cfg; 617 } 618 619 static void smmuv3_flush_config(SMMUDevice *sdev) 620 { 621 SMMUv3State *s = sdev->smmu; 622 SMMUState *bc = &s->smmu_state; 623 624 trace_smmuv3_config_cache_inv(smmu_get_sid(sdev)); 625 g_hash_table_remove(bc->configs, sdev); 626 } 627 628 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr, 629 IOMMUAccessFlags flag, int iommu_idx) 630 { 631 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 632 SMMUv3State *s = sdev->smmu; 633 uint32_t sid = smmu_get_sid(sdev); 634 SMMUEventInfo event = {.type = SMMU_EVT_NONE, 635 .sid = sid, 636 .inval_ste_allowed = false}; 637 SMMUPTWEventInfo ptw_info = {}; 638 SMMUTranslationStatus status; 639 SMMUState *bs = ARM_SMMU(s); 640 uint64_t page_mask, aligned_addr; 641 SMMUTLBEntry *cached_entry = NULL; 642 SMMUTransTableInfo *tt; 643 SMMUTransCfg *cfg = NULL; 644 IOMMUTLBEntry entry = { 645 .target_as = &address_space_memory, 646 .iova = addr, 647 .translated_addr = addr, 648 .addr_mask = ~(hwaddr)0, 649 .perm = IOMMU_NONE, 650 }; 651 652 qemu_mutex_lock(&s->mutex); 653 654 if (!smmu_enabled(s)) { 655 status = SMMU_TRANS_DISABLE; 656 goto epilogue; 657 } 658 659 cfg = smmuv3_get_config(sdev, &event); 660 if (!cfg) { 661 status = SMMU_TRANS_ERROR; 662 goto epilogue; 663 } 664 665 if (cfg->aborted) { 666 status = SMMU_TRANS_ABORT; 667 goto epilogue; 668 } 669 670 if (cfg->bypassed) { 671 status = SMMU_TRANS_BYPASS; 672 goto epilogue; 673 } 674 675 tt = select_tt(cfg, addr); 676 if (!tt) { 677 if (event.record_trans_faults) { 678 event.type = SMMU_EVT_F_TRANSLATION; 679 event.u.f_translation.addr = addr; 680 event.u.f_translation.rnw = flag & 0x1; 681 } 682 status = SMMU_TRANS_ERROR; 683 goto epilogue; 684 } 685 686 page_mask = (1ULL << (tt->granule_sz)) - 1; 687 aligned_addr = addr & ~page_mask; 688 689 cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr); 690 if (cached_entry) { 691 if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) { 692 status = SMMU_TRANS_ERROR; 693 if (event.record_trans_faults) { 694 event.type = SMMU_EVT_F_PERMISSION; 695 event.u.f_permission.addr = addr; 696 event.u.f_permission.rnw = flag & 0x1; 697 } 698 } else { 699 status = SMMU_TRANS_SUCCESS; 700 } 701 goto epilogue; 702 } 703 704 cached_entry = g_new0(SMMUTLBEntry, 1); 705 706 if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) { 707 g_free(cached_entry); 708 switch (ptw_info.type) { 709 case SMMU_PTW_ERR_WALK_EABT: 710 event.type = SMMU_EVT_F_WALK_EABT; 711 event.u.f_walk_eabt.addr = addr; 712 event.u.f_walk_eabt.rnw = flag & 0x1; 713 event.u.f_walk_eabt.class = 0x1; 714 event.u.f_walk_eabt.addr2 = ptw_info.addr; 715 break; 716 case SMMU_PTW_ERR_TRANSLATION: 717 if (event.record_trans_faults) { 718 event.type = SMMU_EVT_F_TRANSLATION; 719 event.u.f_translation.addr = addr; 720 event.u.f_translation.rnw = flag & 0x1; 721 } 722 break; 723 case SMMU_PTW_ERR_ADDR_SIZE: 724 if (event.record_trans_faults) { 725 event.type = SMMU_EVT_F_ADDR_SIZE; 726 event.u.f_addr_size.addr = addr; 727 event.u.f_addr_size.rnw = flag & 0x1; 728 } 729 break; 730 case SMMU_PTW_ERR_ACCESS: 731 if (event.record_trans_faults) { 732 event.type = SMMU_EVT_F_ACCESS; 733 event.u.f_access.addr = addr; 734 event.u.f_access.rnw = flag & 0x1; 735 } 736 break; 737 case SMMU_PTW_ERR_PERMISSION: 738 if (event.record_trans_faults) { 739 event.type = SMMU_EVT_F_PERMISSION; 740 event.u.f_permission.addr = addr; 741 event.u.f_permission.rnw = flag & 0x1; 742 } 743 break; 744 default: 745 g_assert_not_reached(); 746 } 747 status = SMMU_TRANS_ERROR; 748 } else { 749 smmu_iotlb_insert(bs, cfg, cached_entry); 750 status = SMMU_TRANS_SUCCESS; 751 } 752 753 epilogue: 754 qemu_mutex_unlock(&s->mutex); 755 switch (status) { 756 case SMMU_TRANS_SUCCESS: 757 entry.perm = flag; 758 entry.translated_addr = cached_entry->entry.translated_addr + 759 (addr & cached_entry->entry.addr_mask); 760 entry.addr_mask = cached_entry->entry.addr_mask; 761 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr, 762 entry.translated_addr, entry.perm); 763 break; 764 case SMMU_TRANS_DISABLE: 765 entry.perm = flag; 766 entry.addr_mask = ~TARGET_PAGE_MASK; 767 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr, 768 entry.perm); 769 break; 770 case SMMU_TRANS_BYPASS: 771 entry.perm = flag; 772 entry.addr_mask = ~TARGET_PAGE_MASK; 773 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr, 774 entry.perm); 775 break; 776 case SMMU_TRANS_ABORT: 777 /* no event is recorded on abort */ 778 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr, 779 entry.perm); 780 break; 781 case SMMU_TRANS_ERROR: 782 qemu_log_mask(LOG_GUEST_ERROR, 783 "%s translation failed for iova=0x%"PRIx64"(%s)\n", 784 mr->parent_obj.name, addr, smmu_event_string(event.type)); 785 smmuv3_record_event(s, &event); 786 break; 787 } 788 789 return entry; 790 } 791 792 /** 793 * smmuv3_notify_iova - call the notifier @n for a given 794 * @asid and @iova tuple. 795 * 796 * @mr: IOMMU mr region handle 797 * @n: notifier to be called 798 * @asid: address space ID or negative value if we don't care 799 * @iova: iova 800 * @tg: translation granule (if communicated through range invalidation) 801 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1 802 */ 803 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr, 804 IOMMUNotifier *n, 805 int asid, dma_addr_t iova, 806 uint8_t tg, uint64_t num_pages) 807 { 808 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 809 IOMMUTLBEvent event; 810 uint8_t granule; 811 812 if (!tg) { 813 SMMUEventInfo event = {.inval_ste_allowed = true}; 814 SMMUTransCfg *cfg = smmuv3_get_config(sdev, &event); 815 SMMUTransTableInfo *tt; 816 817 if (!cfg) { 818 return; 819 } 820 821 if (asid >= 0 && cfg->asid != asid) { 822 return; 823 } 824 825 tt = select_tt(cfg, iova); 826 if (!tt) { 827 return; 828 } 829 granule = tt->granule_sz; 830 } else { 831 granule = tg * 2 + 10; 832 } 833 834 event.type = IOMMU_NOTIFIER_UNMAP; 835 event.entry.target_as = &address_space_memory; 836 event.entry.iova = iova; 837 event.entry.addr_mask = num_pages * (1 << granule) - 1; 838 event.entry.perm = IOMMU_NONE; 839 840 memory_region_notify_iommu_one(n, &event); 841 } 842 843 /* invalidate an asid/iova range tuple in all mr's */ 844 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova, 845 uint8_t tg, uint64_t num_pages) 846 { 847 SMMUDevice *sdev; 848 849 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) { 850 IOMMUMemoryRegion *mr = &sdev->iommu; 851 IOMMUNotifier *n; 852 853 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova, 854 tg, num_pages); 855 856 IOMMU_NOTIFIER_FOREACH(n, mr) { 857 smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages); 858 } 859 } 860 } 861 862 static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd) 863 { 864 dma_addr_t end, addr = CMD_ADDR(cmd); 865 uint8_t type = CMD_TYPE(cmd); 866 uint16_t vmid = CMD_VMID(cmd); 867 uint8_t scale = CMD_SCALE(cmd); 868 uint8_t num = CMD_NUM(cmd); 869 uint8_t ttl = CMD_TTL(cmd); 870 bool leaf = CMD_LEAF(cmd); 871 uint8_t tg = CMD_TG(cmd); 872 uint64_t num_pages; 873 uint8_t granule; 874 int asid = -1; 875 876 if (type == SMMU_CMD_TLBI_NH_VA) { 877 asid = CMD_ASID(cmd); 878 } 879 880 if (!tg) { 881 trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf); 882 smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1); 883 smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl); 884 return; 885 } 886 887 /* RIL in use */ 888 889 num_pages = (num + 1) * BIT_ULL(scale); 890 granule = tg * 2 + 10; 891 892 /* Split invalidations into ^2 range invalidations */ 893 end = addr + (num_pages << granule) - 1; 894 895 while (addr != end + 1) { 896 uint64_t mask = dma_aligned_pow2_mask(addr, end, 64); 897 898 num_pages = (mask + 1) >> granule; 899 trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf); 900 smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages); 901 smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl); 902 addr += mask + 1; 903 } 904 } 905 906 static gboolean 907 smmuv3_invalidate_ste(gpointer key, gpointer value, gpointer user_data) 908 { 909 SMMUDevice *sdev = (SMMUDevice *)key; 910 uint32_t sid = smmu_get_sid(sdev); 911 SMMUSIDRange *sid_range = (SMMUSIDRange *)user_data; 912 913 if (sid < sid_range->start || sid > sid_range->end) { 914 return false; 915 } 916 trace_smmuv3_config_cache_inv(sid); 917 return true; 918 } 919 920 static int smmuv3_cmdq_consume(SMMUv3State *s) 921 { 922 SMMUState *bs = ARM_SMMU(s); 923 SMMUCmdError cmd_error = SMMU_CERROR_NONE; 924 SMMUQueue *q = &s->cmdq; 925 SMMUCommandType type = 0; 926 927 if (!smmuv3_cmdq_enabled(s)) { 928 return 0; 929 } 930 /* 931 * some commands depend on register values, typically CR0. In case those 932 * register values change while handling the command, spec says it 933 * is UNPREDICTABLE whether the command is interpreted under the new 934 * or old value. 935 */ 936 937 while (!smmuv3_q_empty(q)) { 938 uint32_t pending = s->gerror ^ s->gerrorn; 939 Cmd cmd; 940 941 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q), 942 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 943 944 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) { 945 break; 946 } 947 948 if (queue_read(q, &cmd) != MEMTX_OK) { 949 cmd_error = SMMU_CERROR_ABT; 950 break; 951 } 952 953 type = CMD_TYPE(&cmd); 954 955 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type)); 956 957 qemu_mutex_lock(&s->mutex); 958 switch (type) { 959 case SMMU_CMD_SYNC: 960 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) { 961 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0); 962 } 963 break; 964 case SMMU_CMD_PREFETCH_CONFIG: 965 case SMMU_CMD_PREFETCH_ADDR: 966 break; 967 case SMMU_CMD_CFGI_STE: 968 { 969 uint32_t sid = CMD_SID(&cmd); 970 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid); 971 SMMUDevice *sdev; 972 973 if (CMD_SSEC(&cmd)) { 974 cmd_error = SMMU_CERROR_ILL; 975 break; 976 } 977 978 if (!mr) { 979 break; 980 } 981 982 trace_smmuv3_cmdq_cfgi_ste(sid); 983 sdev = container_of(mr, SMMUDevice, iommu); 984 smmuv3_flush_config(sdev); 985 986 break; 987 } 988 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */ 989 { 990 uint32_t sid = CMD_SID(&cmd), mask; 991 uint8_t range = CMD_STE_RANGE(&cmd); 992 SMMUSIDRange sid_range; 993 994 if (CMD_SSEC(&cmd)) { 995 cmd_error = SMMU_CERROR_ILL; 996 break; 997 } 998 999 mask = (1ULL << (range + 1)) - 1; 1000 sid_range.start = sid & ~mask; 1001 sid_range.end = sid_range.start + mask; 1002 1003 trace_smmuv3_cmdq_cfgi_ste_range(sid_range.start, sid_range.end); 1004 g_hash_table_foreach_remove(bs->configs, smmuv3_invalidate_ste, 1005 &sid_range); 1006 break; 1007 } 1008 case SMMU_CMD_CFGI_CD: 1009 case SMMU_CMD_CFGI_CD_ALL: 1010 { 1011 uint32_t sid = CMD_SID(&cmd); 1012 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid); 1013 SMMUDevice *sdev; 1014 1015 if (CMD_SSEC(&cmd)) { 1016 cmd_error = SMMU_CERROR_ILL; 1017 break; 1018 } 1019 1020 if (!mr) { 1021 break; 1022 } 1023 1024 trace_smmuv3_cmdq_cfgi_cd(sid); 1025 sdev = container_of(mr, SMMUDevice, iommu); 1026 smmuv3_flush_config(sdev); 1027 break; 1028 } 1029 case SMMU_CMD_TLBI_NH_ASID: 1030 { 1031 uint16_t asid = CMD_ASID(&cmd); 1032 1033 trace_smmuv3_cmdq_tlbi_nh_asid(asid); 1034 smmu_inv_notifiers_all(&s->smmu_state); 1035 smmu_iotlb_inv_asid(bs, asid); 1036 break; 1037 } 1038 case SMMU_CMD_TLBI_NH_ALL: 1039 case SMMU_CMD_TLBI_NSNH_ALL: 1040 trace_smmuv3_cmdq_tlbi_nh(); 1041 smmu_inv_notifiers_all(&s->smmu_state); 1042 smmu_iotlb_inv_all(bs); 1043 break; 1044 case SMMU_CMD_TLBI_NH_VAA: 1045 case SMMU_CMD_TLBI_NH_VA: 1046 smmuv3_s1_range_inval(bs, &cmd); 1047 break; 1048 case SMMU_CMD_TLBI_EL3_ALL: 1049 case SMMU_CMD_TLBI_EL3_VA: 1050 case SMMU_CMD_TLBI_EL2_ALL: 1051 case SMMU_CMD_TLBI_EL2_ASID: 1052 case SMMU_CMD_TLBI_EL2_VA: 1053 case SMMU_CMD_TLBI_EL2_VAA: 1054 case SMMU_CMD_TLBI_S12_VMALL: 1055 case SMMU_CMD_TLBI_S2_IPA: 1056 case SMMU_CMD_ATC_INV: 1057 case SMMU_CMD_PRI_RESP: 1058 case SMMU_CMD_RESUME: 1059 case SMMU_CMD_STALL_TERM: 1060 trace_smmuv3_unhandled_cmd(type); 1061 break; 1062 default: 1063 cmd_error = SMMU_CERROR_ILL; 1064 qemu_log_mask(LOG_GUEST_ERROR, 1065 "Illegal command type: %d\n", CMD_TYPE(&cmd)); 1066 break; 1067 } 1068 qemu_mutex_unlock(&s->mutex); 1069 if (cmd_error) { 1070 break; 1071 } 1072 /* 1073 * We only increment the cons index after the completion of 1074 * the command. We do that because the SYNC returns immediately 1075 * and does not check the completion of previous commands 1076 */ 1077 queue_cons_incr(q); 1078 } 1079 1080 if (cmd_error) { 1081 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error); 1082 smmu_write_cmdq_err(s, cmd_error); 1083 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK); 1084 } 1085 1086 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q), 1087 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 1088 1089 return 0; 1090 } 1091 1092 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset, 1093 uint64_t data, MemTxAttrs attrs) 1094 { 1095 switch (offset) { 1096 case A_GERROR_IRQ_CFG0: 1097 s->gerror_irq_cfg0 = data; 1098 return MEMTX_OK; 1099 case A_STRTAB_BASE: 1100 s->strtab_base = data; 1101 return MEMTX_OK; 1102 case A_CMDQ_BASE: 1103 s->cmdq.base = data; 1104 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 1105 if (s->cmdq.log2size > SMMU_CMDQS) { 1106 s->cmdq.log2size = SMMU_CMDQS; 1107 } 1108 return MEMTX_OK; 1109 case A_EVENTQ_BASE: 1110 s->eventq.base = data; 1111 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 1112 if (s->eventq.log2size > SMMU_EVENTQS) { 1113 s->eventq.log2size = SMMU_EVENTQS; 1114 } 1115 return MEMTX_OK; 1116 case A_EVENTQ_IRQ_CFG0: 1117 s->eventq_irq_cfg0 = data; 1118 return MEMTX_OK; 1119 default: 1120 qemu_log_mask(LOG_UNIMP, 1121 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n", 1122 __func__, offset); 1123 return MEMTX_OK; 1124 } 1125 } 1126 1127 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset, 1128 uint64_t data, MemTxAttrs attrs) 1129 { 1130 switch (offset) { 1131 case A_CR0: 1132 s->cr[0] = data; 1133 s->cr0ack = data & ~SMMU_CR0_RESERVED; 1134 /* in case the command queue has been enabled */ 1135 smmuv3_cmdq_consume(s); 1136 return MEMTX_OK; 1137 case A_CR1: 1138 s->cr[1] = data; 1139 return MEMTX_OK; 1140 case A_CR2: 1141 s->cr[2] = data; 1142 return MEMTX_OK; 1143 case A_IRQ_CTRL: 1144 s->irq_ctrl = data; 1145 return MEMTX_OK; 1146 case A_GERRORN: 1147 smmuv3_write_gerrorn(s, data); 1148 /* 1149 * By acknowledging the CMDQ_ERR, SW may notify cmds can 1150 * be processed again 1151 */ 1152 smmuv3_cmdq_consume(s); 1153 return MEMTX_OK; 1154 case A_GERROR_IRQ_CFG0: /* 64b */ 1155 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data); 1156 return MEMTX_OK; 1157 case A_GERROR_IRQ_CFG0 + 4: 1158 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data); 1159 return MEMTX_OK; 1160 case A_GERROR_IRQ_CFG1: 1161 s->gerror_irq_cfg1 = data; 1162 return MEMTX_OK; 1163 case A_GERROR_IRQ_CFG2: 1164 s->gerror_irq_cfg2 = data; 1165 return MEMTX_OK; 1166 case A_STRTAB_BASE: /* 64b */ 1167 s->strtab_base = deposit64(s->strtab_base, 0, 32, data); 1168 return MEMTX_OK; 1169 case A_STRTAB_BASE + 4: 1170 s->strtab_base = deposit64(s->strtab_base, 32, 32, data); 1171 return MEMTX_OK; 1172 case A_STRTAB_BASE_CFG: 1173 s->strtab_base_cfg = data; 1174 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) { 1175 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); 1176 s->features |= SMMU_FEATURE_2LVL_STE; 1177 } 1178 return MEMTX_OK; 1179 case A_CMDQ_BASE: /* 64b */ 1180 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data); 1181 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 1182 if (s->cmdq.log2size > SMMU_CMDQS) { 1183 s->cmdq.log2size = SMMU_CMDQS; 1184 } 1185 return MEMTX_OK; 1186 case A_CMDQ_BASE + 4: /* 64b */ 1187 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data); 1188 return MEMTX_OK; 1189 case A_CMDQ_PROD: 1190 s->cmdq.prod = data; 1191 smmuv3_cmdq_consume(s); 1192 return MEMTX_OK; 1193 case A_CMDQ_CONS: 1194 s->cmdq.cons = data; 1195 return MEMTX_OK; 1196 case A_EVENTQ_BASE: /* 64b */ 1197 s->eventq.base = deposit64(s->eventq.base, 0, 32, data); 1198 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 1199 if (s->eventq.log2size > SMMU_EVENTQS) { 1200 s->eventq.log2size = SMMU_EVENTQS; 1201 } 1202 return MEMTX_OK; 1203 case A_EVENTQ_BASE + 4: 1204 s->eventq.base = deposit64(s->eventq.base, 32, 32, data); 1205 return MEMTX_OK; 1206 case A_EVENTQ_PROD: 1207 s->eventq.prod = data; 1208 return MEMTX_OK; 1209 case A_EVENTQ_CONS: 1210 s->eventq.cons = data; 1211 return MEMTX_OK; 1212 case A_EVENTQ_IRQ_CFG0: /* 64b */ 1213 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data); 1214 return MEMTX_OK; 1215 case A_EVENTQ_IRQ_CFG0 + 4: 1216 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data); 1217 return MEMTX_OK; 1218 case A_EVENTQ_IRQ_CFG1: 1219 s->eventq_irq_cfg1 = data; 1220 return MEMTX_OK; 1221 case A_EVENTQ_IRQ_CFG2: 1222 s->eventq_irq_cfg2 = data; 1223 return MEMTX_OK; 1224 default: 1225 qemu_log_mask(LOG_UNIMP, 1226 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n", 1227 __func__, offset); 1228 return MEMTX_OK; 1229 } 1230 } 1231 1232 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data, 1233 unsigned size, MemTxAttrs attrs) 1234 { 1235 SMMUState *sys = opaque; 1236 SMMUv3State *s = ARM_SMMUV3(sys); 1237 MemTxResult r; 1238 1239 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1240 offset &= ~0x10000; 1241 1242 switch (size) { 1243 case 8: 1244 r = smmu_writell(s, offset, data, attrs); 1245 break; 1246 case 4: 1247 r = smmu_writel(s, offset, data, attrs); 1248 break; 1249 default: 1250 r = MEMTX_ERROR; 1251 break; 1252 } 1253 1254 trace_smmuv3_write_mmio(offset, data, size, r); 1255 return r; 1256 } 1257 1258 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset, 1259 uint64_t *data, MemTxAttrs attrs) 1260 { 1261 switch (offset) { 1262 case A_GERROR_IRQ_CFG0: 1263 *data = s->gerror_irq_cfg0; 1264 return MEMTX_OK; 1265 case A_STRTAB_BASE: 1266 *data = s->strtab_base; 1267 return MEMTX_OK; 1268 case A_CMDQ_BASE: 1269 *data = s->cmdq.base; 1270 return MEMTX_OK; 1271 case A_EVENTQ_BASE: 1272 *data = s->eventq.base; 1273 return MEMTX_OK; 1274 default: 1275 *data = 0; 1276 qemu_log_mask(LOG_UNIMP, 1277 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n", 1278 __func__, offset); 1279 return MEMTX_OK; 1280 } 1281 } 1282 1283 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset, 1284 uint64_t *data, MemTxAttrs attrs) 1285 { 1286 switch (offset) { 1287 case A_IDREGS ... A_IDREGS + 0x2f: 1288 *data = smmuv3_idreg(offset - A_IDREGS); 1289 return MEMTX_OK; 1290 case A_IDR0 ... A_IDR5: 1291 *data = s->idr[(offset - A_IDR0) / 4]; 1292 return MEMTX_OK; 1293 case A_IIDR: 1294 *data = s->iidr; 1295 return MEMTX_OK; 1296 case A_AIDR: 1297 *data = s->aidr; 1298 return MEMTX_OK; 1299 case A_CR0: 1300 *data = s->cr[0]; 1301 return MEMTX_OK; 1302 case A_CR0ACK: 1303 *data = s->cr0ack; 1304 return MEMTX_OK; 1305 case A_CR1: 1306 *data = s->cr[1]; 1307 return MEMTX_OK; 1308 case A_CR2: 1309 *data = s->cr[2]; 1310 return MEMTX_OK; 1311 case A_STATUSR: 1312 *data = s->statusr; 1313 return MEMTX_OK; 1314 case A_IRQ_CTRL: 1315 case A_IRQ_CTRL_ACK: 1316 *data = s->irq_ctrl; 1317 return MEMTX_OK; 1318 case A_GERROR: 1319 *data = s->gerror; 1320 return MEMTX_OK; 1321 case A_GERRORN: 1322 *data = s->gerrorn; 1323 return MEMTX_OK; 1324 case A_GERROR_IRQ_CFG0: /* 64b */ 1325 *data = extract64(s->gerror_irq_cfg0, 0, 32); 1326 return MEMTX_OK; 1327 case A_GERROR_IRQ_CFG0 + 4: 1328 *data = extract64(s->gerror_irq_cfg0, 32, 32); 1329 return MEMTX_OK; 1330 case A_GERROR_IRQ_CFG1: 1331 *data = s->gerror_irq_cfg1; 1332 return MEMTX_OK; 1333 case A_GERROR_IRQ_CFG2: 1334 *data = s->gerror_irq_cfg2; 1335 return MEMTX_OK; 1336 case A_STRTAB_BASE: /* 64b */ 1337 *data = extract64(s->strtab_base, 0, 32); 1338 return MEMTX_OK; 1339 case A_STRTAB_BASE + 4: /* 64b */ 1340 *data = extract64(s->strtab_base, 32, 32); 1341 return MEMTX_OK; 1342 case A_STRTAB_BASE_CFG: 1343 *data = s->strtab_base_cfg; 1344 return MEMTX_OK; 1345 case A_CMDQ_BASE: /* 64b */ 1346 *data = extract64(s->cmdq.base, 0, 32); 1347 return MEMTX_OK; 1348 case A_CMDQ_BASE + 4: 1349 *data = extract64(s->cmdq.base, 32, 32); 1350 return MEMTX_OK; 1351 case A_CMDQ_PROD: 1352 *data = s->cmdq.prod; 1353 return MEMTX_OK; 1354 case A_CMDQ_CONS: 1355 *data = s->cmdq.cons; 1356 return MEMTX_OK; 1357 case A_EVENTQ_BASE: /* 64b */ 1358 *data = extract64(s->eventq.base, 0, 32); 1359 return MEMTX_OK; 1360 case A_EVENTQ_BASE + 4: /* 64b */ 1361 *data = extract64(s->eventq.base, 32, 32); 1362 return MEMTX_OK; 1363 case A_EVENTQ_PROD: 1364 *data = s->eventq.prod; 1365 return MEMTX_OK; 1366 case A_EVENTQ_CONS: 1367 *data = s->eventq.cons; 1368 return MEMTX_OK; 1369 default: 1370 *data = 0; 1371 qemu_log_mask(LOG_UNIMP, 1372 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n", 1373 __func__, offset); 1374 return MEMTX_OK; 1375 } 1376 } 1377 1378 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data, 1379 unsigned size, MemTxAttrs attrs) 1380 { 1381 SMMUState *sys = opaque; 1382 SMMUv3State *s = ARM_SMMUV3(sys); 1383 MemTxResult r; 1384 1385 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1386 offset &= ~0x10000; 1387 1388 switch (size) { 1389 case 8: 1390 r = smmu_readll(s, offset, data, attrs); 1391 break; 1392 case 4: 1393 r = smmu_readl(s, offset, data, attrs); 1394 break; 1395 default: 1396 r = MEMTX_ERROR; 1397 break; 1398 } 1399 1400 trace_smmuv3_read_mmio(offset, *data, size, r); 1401 return r; 1402 } 1403 1404 static const MemoryRegionOps smmu_mem_ops = { 1405 .read_with_attrs = smmu_read_mmio, 1406 .write_with_attrs = smmu_write_mmio, 1407 .endianness = DEVICE_LITTLE_ENDIAN, 1408 .valid = { 1409 .min_access_size = 4, 1410 .max_access_size = 8, 1411 }, 1412 .impl = { 1413 .min_access_size = 4, 1414 .max_access_size = 8, 1415 }, 1416 }; 1417 1418 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev) 1419 { 1420 int i; 1421 1422 for (i = 0; i < ARRAY_SIZE(s->irq); i++) { 1423 sysbus_init_irq(dev, &s->irq[i]); 1424 } 1425 } 1426 1427 static void smmu_reset(DeviceState *dev) 1428 { 1429 SMMUv3State *s = ARM_SMMUV3(dev); 1430 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1431 1432 c->parent_reset(dev); 1433 1434 smmuv3_init_regs(s); 1435 } 1436 1437 static void smmu_realize(DeviceState *d, Error **errp) 1438 { 1439 SMMUState *sys = ARM_SMMU(d); 1440 SMMUv3State *s = ARM_SMMUV3(sys); 1441 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1442 SysBusDevice *dev = SYS_BUS_DEVICE(d); 1443 Error *local_err = NULL; 1444 1445 c->parent_realize(d, &local_err); 1446 if (local_err) { 1447 error_propagate(errp, local_err); 1448 return; 1449 } 1450 1451 qemu_mutex_init(&s->mutex); 1452 1453 memory_region_init_io(&sys->iomem, OBJECT(s), 1454 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000); 1455 1456 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION; 1457 1458 sysbus_init_mmio(dev, &sys->iomem); 1459 1460 smmu_init_irq(s, dev); 1461 } 1462 1463 static const VMStateDescription vmstate_smmuv3_queue = { 1464 .name = "smmuv3_queue", 1465 .version_id = 1, 1466 .minimum_version_id = 1, 1467 .fields = (VMStateField[]) { 1468 VMSTATE_UINT64(base, SMMUQueue), 1469 VMSTATE_UINT32(prod, SMMUQueue), 1470 VMSTATE_UINT32(cons, SMMUQueue), 1471 VMSTATE_UINT8(log2size, SMMUQueue), 1472 VMSTATE_END_OF_LIST(), 1473 }, 1474 }; 1475 1476 static const VMStateDescription vmstate_smmuv3 = { 1477 .name = "smmuv3", 1478 .version_id = 1, 1479 .minimum_version_id = 1, 1480 .priority = MIG_PRI_IOMMU, 1481 .fields = (VMStateField[]) { 1482 VMSTATE_UINT32(features, SMMUv3State), 1483 VMSTATE_UINT8(sid_size, SMMUv3State), 1484 VMSTATE_UINT8(sid_split, SMMUv3State), 1485 1486 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3), 1487 VMSTATE_UINT32(cr0ack, SMMUv3State), 1488 VMSTATE_UINT32(statusr, SMMUv3State), 1489 VMSTATE_UINT32(irq_ctrl, SMMUv3State), 1490 VMSTATE_UINT32(gerror, SMMUv3State), 1491 VMSTATE_UINT32(gerrorn, SMMUv3State), 1492 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State), 1493 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State), 1494 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State), 1495 VMSTATE_UINT64(strtab_base, SMMUv3State), 1496 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State), 1497 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State), 1498 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State), 1499 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State), 1500 1501 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1502 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1503 1504 VMSTATE_END_OF_LIST(), 1505 }, 1506 }; 1507 1508 static void smmuv3_instance_init(Object *obj) 1509 { 1510 /* Nothing much to do here as of now */ 1511 } 1512 1513 static void smmuv3_class_init(ObjectClass *klass, void *data) 1514 { 1515 DeviceClass *dc = DEVICE_CLASS(klass); 1516 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass); 1517 1518 dc->vmsd = &vmstate_smmuv3; 1519 device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset); 1520 c->parent_realize = dc->realize; 1521 dc->realize = smmu_realize; 1522 } 1523 1524 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu, 1525 IOMMUNotifierFlag old, 1526 IOMMUNotifierFlag new, 1527 Error **errp) 1528 { 1529 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu); 1530 SMMUv3State *s3 = sdev->smmu; 1531 SMMUState *s = &(s3->smmu_state); 1532 1533 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) { 1534 error_setg(errp, "SMMUv3 does not support dev-iotlb yet"); 1535 return -EINVAL; 1536 } 1537 1538 if (new & IOMMU_NOTIFIER_MAP) { 1539 error_setg(errp, 1540 "device %02x.%02x.%x requires iommu MAP notifier which is " 1541 "not currently supported", pci_bus_num(sdev->bus), 1542 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn)); 1543 return -EINVAL; 1544 } 1545 1546 if (old == IOMMU_NOTIFIER_NONE) { 1547 trace_smmuv3_notify_flag_add(iommu->parent_obj.name); 1548 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next); 1549 } else if (new == IOMMU_NOTIFIER_NONE) { 1550 trace_smmuv3_notify_flag_del(iommu->parent_obj.name); 1551 QLIST_REMOVE(sdev, next); 1552 } 1553 return 0; 1554 } 1555 1556 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass, 1557 void *data) 1558 { 1559 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 1560 1561 imrc->translate = smmuv3_translate; 1562 imrc->notify_flag_changed = smmuv3_notify_flag_changed; 1563 } 1564 1565 static const TypeInfo smmuv3_type_info = { 1566 .name = TYPE_ARM_SMMUV3, 1567 .parent = TYPE_ARM_SMMU, 1568 .instance_size = sizeof(SMMUv3State), 1569 .instance_init = smmuv3_instance_init, 1570 .class_size = sizeof(SMMUv3Class), 1571 .class_init = smmuv3_class_init, 1572 }; 1573 1574 static const TypeInfo smmuv3_iommu_memory_region_info = { 1575 .parent = TYPE_IOMMU_MEMORY_REGION, 1576 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION, 1577 .class_init = smmuv3_iommu_memory_region_class_init, 1578 }; 1579 1580 static void smmuv3_register_types(void) 1581 { 1582 type_register(&smmuv3_type_info); 1583 type_register(&smmuv3_iommu_memory_region_info); 1584 } 1585 1586 type_init(smmuv3_register_types) 1587 1588