xref: /openbmc/qemu/hw/i386/intel_iommu.c (revision cae41fda)
1 /*
2  * QEMU emulation of an Intel IOMMU (VT-d)
3  *   (DMA Remapping device)
4  *
5  * Copyright (C) 2013 Knut Omang, Oracle <knut.omang@oracle.com>
6  * Copyright (C) 2014 Le Tan, <tamlokveer@gmail.com>
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License as published by
10  * the Free Software Foundation; either version 2 of the License, or
11  * (at your option) any later version.
12 
13  * This program is distributed in the hope that it will be useful,
14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  * GNU General Public License for more details.
17 
18  * You should have received a copy of the GNU General Public License along
19  * with this program; if not, see <http://www.gnu.org/licenses/>.
20  */
21 
22 #include "qemu/osdep.h"
23 #include "qemu/error-report.h"
24 #include "qapi/error.h"
25 #include "hw/sysbus.h"
26 #include "exec/address-spaces.h"
27 #include "intel_iommu_internal.h"
28 #include "hw/pci/pci.h"
29 #include "hw/pci/pci_bus.h"
30 #include "hw/i386/pc.h"
31 #include "hw/i386/apic-msidef.h"
32 #include "hw/boards.h"
33 #include "hw/i386/x86-iommu.h"
34 #include "hw/pci-host/q35.h"
35 #include "sysemu/kvm.h"
36 #include "hw/i386/apic_internal.h"
37 #include "kvm_i386.h"
38 
39 /*#define DEBUG_INTEL_IOMMU*/
40 #ifdef DEBUG_INTEL_IOMMU
41 enum {
42     DEBUG_GENERAL, DEBUG_CSR, DEBUG_INV, DEBUG_MMU, DEBUG_FLOG,
43     DEBUG_CACHE, DEBUG_IR,
44 };
45 #define VTD_DBGBIT(x)   (1 << DEBUG_##x)
46 static int vtd_dbgflags = VTD_DBGBIT(GENERAL) | VTD_DBGBIT(CSR);
47 
48 #define VTD_DPRINTF(what, fmt, ...) do { \
49     if (vtd_dbgflags & VTD_DBGBIT(what)) { \
50         fprintf(stderr, "(vtd)%s: " fmt "\n", __func__, \
51                 ## __VA_ARGS__); } \
52     } while (0)
53 #else
54 #define VTD_DPRINTF(what, fmt, ...) do {} while (0)
55 #endif
56 
57 static void vtd_define_quad(IntelIOMMUState *s, hwaddr addr, uint64_t val,
58                             uint64_t wmask, uint64_t w1cmask)
59 {
60     stq_le_p(&s->csr[addr], val);
61     stq_le_p(&s->wmask[addr], wmask);
62     stq_le_p(&s->w1cmask[addr], w1cmask);
63 }
64 
65 static void vtd_define_quad_wo(IntelIOMMUState *s, hwaddr addr, uint64_t mask)
66 {
67     stq_le_p(&s->womask[addr], mask);
68 }
69 
70 static void vtd_define_long(IntelIOMMUState *s, hwaddr addr, uint32_t val,
71                             uint32_t wmask, uint32_t w1cmask)
72 {
73     stl_le_p(&s->csr[addr], val);
74     stl_le_p(&s->wmask[addr], wmask);
75     stl_le_p(&s->w1cmask[addr], w1cmask);
76 }
77 
78 static void vtd_define_long_wo(IntelIOMMUState *s, hwaddr addr, uint32_t mask)
79 {
80     stl_le_p(&s->womask[addr], mask);
81 }
82 
83 /* "External" get/set operations */
84 static void vtd_set_quad(IntelIOMMUState *s, hwaddr addr, uint64_t val)
85 {
86     uint64_t oldval = ldq_le_p(&s->csr[addr]);
87     uint64_t wmask = ldq_le_p(&s->wmask[addr]);
88     uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
89     stq_le_p(&s->csr[addr],
90              ((oldval & ~wmask) | (val & wmask)) & ~(w1cmask & val));
91 }
92 
93 static void vtd_set_long(IntelIOMMUState *s, hwaddr addr, uint32_t val)
94 {
95     uint32_t oldval = ldl_le_p(&s->csr[addr]);
96     uint32_t wmask = ldl_le_p(&s->wmask[addr]);
97     uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
98     stl_le_p(&s->csr[addr],
99              ((oldval & ~wmask) | (val & wmask)) & ~(w1cmask & val));
100 }
101 
102 static uint64_t vtd_get_quad(IntelIOMMUState *s, hwaddr addr)
103 {
104     uint64_t val = ldq_le_p(&s->csr[addr]);
105     uint64_t womask = ldq_le_p(&s->womask[addr]);
106     return val & ~womask;
107 }
108 
109 static uint32_t vtd_get_long(IntelIOMMUState *s, hwaddr addr)
110 {
111     uint32_t val = ldl_le_p(&s->csr[addr]);
112     uint32_t womask = ldl_le_p(&s->womask[addr]);
113     return val & ~womask;
114 }
115 
116 /* "Internal" get/set operations */
117 static uint64_t vtd_get_quad_raw(IntelIOMMUState *s, hwaddr addr)
118 {
119     return ldq_le_p(&s->csr[addr]);
120 }
121 
122 static uint32_t vtd_get_long_raw(IntelIOMMUState *s, hwaddr addr)
123 {
124     return ldl_le_p(&s->csr[addr]);
125 }
126 
127 static void vtd_set_quad_raw(IntelIOMMUState *s, hwaddr addr, uint64_t val)
128 {
129     stq_le_p(&s->csr[addr], val);
130 }
131 
132 static uint32_t vtd_set_clear_mask_long(IntelIOMMUState *s, hwaddr addr,
133                                         uint32_t clear, uint32_t mask)
134 {
135     uint32_t new_val = (ldl_le_p(&s->csr[addr]) & ~clear) | mask;
136     stl_le_p(&s->csr[addr], new_val);
137     return new_val;
138 }
139 
140 static uint64_t vtd_set_clear_mask_quad(IntelIOMMUState *s, hwaddr addr,
141                                         uint64_t clear, uint64_t mask)
142 {
143     uint64_t new_val = (ldq_le_p(&s->csr[addr]) & ~clear) | mask;
144     stq_le_p(&s->csr[addr], new_val);
145     return new_val;
146 }
147 
148 /* GHashTable functions */
149 static gboolean vtd_uint64_equal(gconstpointer v1, gconstpointer v2)
150 {
151     return *((const uint64_t *)v1) == *((const uint64_t *)v2);
152 }
153 
154 static guint vtd_uint64_hash(gconstpointer v)
155 {
156     return (guint)*(const uint64_t *)v;
157 }
158 
159 static gboolean vtd_hash_remove_by_domain(gpointer key, gpointer value,
160                                           gpointer user_data)
161 {
162     VTDIOTLBEntry *entry = (VTDIOTLBEntry *)value;
163     uint16_t domain_id = *(uint16_t *)user_data;
164     return entry->domain_id == domain_id;
165 }
166 
167 /* The shift of an addr for a certain level of paging structure */
168 static inline uint32_t vtd_slpt_level_shift(uint32_t level)
169 {
170     return VTD_PAGE_SHIFT_4K + (level - 1) * VTD_SL_LEVEL_BITS;
171 }
172 
173 static inline uint64_t vtd_slpt_level_page_mask(uint32_t level)
174 {
175     return ~((1ULL << vtd_slpt_level_shift(level)) - 1);
176 }
177 
178 static gboolean vtd_hash_remove_by_page(gpointer key, gpointer value,
179                                         gpointer user_data)
180 {
181     VTDIOTLBEntry *entry = (VTDIOTLBEntry *)value;
182     VTDIOTLBPageInvInfo *info = (VTDIOTLBPageInvInfo *)user_data;
183     uint64_t gfn = (info->addr >> VTD_PAGE_SHIFT_4K) & info->mask;
184     uint64_t gfn_tlb = (info->addr & entry->mask) >> VTD_PAGE_SHIFT_4K;
185     return (entry->domain_id == info->domain_id) &&
186             (((entry->gfn & info->mask) == gfn) ||
187              (entry->gfn == gfn_tlb));
188 }
189 
190 /* Reset all the gen of VTDAddressSpace to zero and set the gen of
191  * IntelIOMMUState to 1.
192  */
193 static void vtd_reset_context_cache(IntelIOMMUState *s)
194 {
195     VTDAddressSpace *vtd_as;
196     VTDBus *vtd_bus;
197     GHashTableIter bus_it;
198     uint32_t devfn_it;
199 
200     g_hash_table_iter_init(&bus_it, s->vtd_as_by_busptr);
201 
202     VTD_DPRINTF(CACHE, "global context_cache_gen=1");
203     while (g_hash_table_iter_next (&bus_it, NULL, (void**)&vtd_bus)) {
204         for (devfn_it = 0; devfn_it < X86_IOMMU_PCI_DEVFN_MAX; ++devfn_it) {
205             vtd_as = vtd_bus->dev_as[devfn_it];
206             if (!vtd_as) {
207                 continue;
208             }
209             vtd_as->context_cache_entry.context_cache_gen = 0;
210         }
211     }
212     s->context_cache_gen = 1;
213 }
214 
215 static void vtd_reset_iotlb(IntelIOMMUState *s)
216 {
217     assert(s->iotlb);
218     g_hash_table_remove_all(s->iotlb);
219 }
220 
221 static uint64_t vtd_get_iotlb_key(uint64_t gfn, uint16_t source_id,
222                                   uint32_t level)
223 {
224     return gfn | ((uint64_t)(source_id) << VTD_IOTLB_SID_SHIFT) |
225            ((uint64_t)(level) << VTD_IOTLB_LVL_SHIFT);
226 }
227 
228 static uint64_t vtd_get_iotlb_gfn(hwaddr addr, uint32_t level)
229 {
230     return (addr & vtd_slpt_level_page_mask(level)) >> VTD_PAGE_SHIFT_4K;
231 }
232 
233 static VTDIOTLBEntry *vtd_lookup_iotlb(IntelIOMMUState *s, uint16_t source_id,
234                                        hwaddr addr)
235 {
236     VTDIOTLBEntry *entry;
237     uint64_t key;
238     int level;
239 
240     for (level = VTD_SL_PT_LEVEL; level < VTD_SL_PML4_LEVEL; level++) {
241         key = vtd_get_iotlb_key(vtd_get_iotlb_gfn(addr, level),
242                                 source_id, level);
243         entry = g_hash_table_lookup(s->iotlb, &key);
244         if (entry) {
245             goto out;
246         }
247     }
248 
249 out:
250     return entry;
251 }
252 
253 static void vtd_update_iotlb(IntelIOMMUState *s, uint16_t source_id,
254                              uint16_t domain_id, hwaddr addr, uint64_t slpte,
255                              bool read_flags, bool write_flags,
256                              uint32_t level)
257 {
258     VTDIOTLBEntry *entry = g_malloc(sizeof(*entry));
259     uint64_t *key = g_malloc(sizeof(*key));
260     uint64_t gfn = vtd_get_iotlb_gfn(addr, level);
261 
262     VTD_DPRINTF(CACHE, "update iotlb sid 0x%"PRIx16 " gpa 0x%"PRIx64
263                 " slpte 0x%"PRIx64 " did 0x%"PRIx16, source_id, addr, slpte,
264                 domain_id);
265     if (g_hash_table_size(s->iotlb) >= VTD_IOTLB_MAX_SIZE) {
266         VTD_DPRINTF(CACHE, "iotlb exceeds size limit, forced to reset");
267         vtd_reset_iotlb(s);
268     }
269 
270     entry->gfn = gfn;
271     entry->domain_id = domain_id;
272     entry->slpte = slpte;
273     entry->read_flags = read_flags;
274     entry->write_flags = write_flags;
275     entry->mask = vtd_slpt_level_page_mask(level);
276     *key = vtd_get_iotlb_key(gfn, source_id, level);
277     g_hash_table_replace(s->iotlb, key, entry);
278 }
279 
280 /* Given the reg addr of both the message data and address, generate an
281  * interrupt via MSI.
282  */
283 static void vtd_generate_interrupt(IntelIOMMUState *s, hwaddr mesg_addr_reg,
284                                    hwaddr mesg_data_reg)
285 {
286     MSIMessage msi;
287 
288     assert(mesg_data_reg < DMAR_REG_SIZE);
289     assert(mesg_addr_reg < DMAR_REG_SIZE);
290 
291     msi.address = vtd_get_long_raw(s, mesg_addr_reg);
292     msi.data = vtd_get_long_raw(s, mesg_data_reg);
293 
294     VTD_DPRINTF(FLOG, "msi: addr 0x%"PRIx64 " data 0x%"PRIx32,
295                 msi.address, msi.data);
296     apic_get_class()->send_msi(&msi);
297 }
298 
299 /* Generate a fault event to software via MSI if conditions are met.
300  * Notice that the value of FSTS_REG being passed to it should be the one
301  * before any update.
302  */
303 static void vtd_generate_fault_event(IntelIOMMUState *s, uint32_t pre_fsts)
304 {
305     if (pre_fsts & VTD_FSTS_PPF || pre_fsts & VTD_FSTS_PFO ||
306         pre_fsts & VTD_FSTS_IQE) {
307         VTD_DPRINTF(FLOG, "there are previous interrupt conditions "
308                     "to be serviced by software, fault event is not generated "
309                     "(FSTS_REG 0x%"PRIx32 ")", pre_fsts);
310         return;
311     }
312     vtd_set_clear_mask_long(s, DMAR_FECTL_REG, 0, VTD_FECTL_IP);
313     if (vtd_get_long_raw(s, DMAR_FECTL_REG) & VTD_FECTL_IM) {
314         VTD_DPRINTF(FLOG, "Interrupt Mask set, fault event is not generated");
315     } else {
316         vtd_generate_interrupt(s, DMAR_FEADDR_REG, DMAR_FEDATA_REG);
317         vtd_set_clear_mask_long(s, DMAR_FECTL_REG, VTD_FECTL_IP, 0);
318     }
319 }
320 
321 /* Check if the Fault (F) field of the Fault Recording Register referenced by
322  * @index is Set.
323  */
324 static bool vtd_is_frcd_set(IntelIOMMUState *s, uint16_t index)
325 {
326     /* Each reg is 128-bit */
327     hwaddr addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4);
328     addr += 8; /* Access the high 64-bit half */
329 
330     assert(index < DMAR_FRCD_REG_NR);
331 
332     return vtd_get_quad_raw(s, addr) & VTD_FRCD_F;
333 }
334 
335 /* Update the PPF field of Fault Status Register.
336  * Should be called whenever change the F field of any fault recording
337  * registers.
338  */
339 static void vtd_update_fsts_ppf(IntelIOMMUState *s)
340 {
341     uint32_t i;
342     uint32_t ppf_mask = 0;
343 
344     for (i = 0; i < DMAR_FRCD_REG_NR; i++) {
345         if (vtd_is_frcd_set(s, i)) {
346             ppf_mask = VTD_FSTS_PPF;
347             break;
348         }
349     }
350     vtd_set_clear_mask_long(s, DMAR_FSTS_REG, VTD_FSTS_PPF, ppf_mask);
351     VTD_DPRINTF(FLOG, "set PPF of FSTS_REG to %d", ppf_mask ? 1 : 0);
352 }
353 
354 static void vtd_set_frcd_and_update_ppf(IntelIOMMUState *s, uint16_t index)
355 {
356     /* Each reg is 128-bit */
357     hwaddr addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4);
358     addr += 8; /* Access the high 64-bit half */
359 
360     assert(index < DMAR_FRCD_REG_NR);
361 
362     vtd_set_clear_mask_quad(s, addr, 0, VTD_FRCD_F);
363     vtd_update_fsts_ppf(s);
364 }
365 
366 /* Must not update F field now, should be done later */
367 static void vtd_record_frcd(IntelIOMMUState *s, uint16_t index,
368                             uint16_t source_id, hwaddr addr,
369                             VTDFaultReason fault, bool is_write)
370 {
371     uint64_t hi = 0, lo;
372     hwaddr frcd_reg_addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4);
373 
374     assert(index < DMAR_FRCD_REG_NR);
375 
376     lo = VTD_FRCD_FI(addr);
377     hi = VTD_FRCD_SID(source_id) | VTD_FRCD_FR(fault);
378     if (!is_write) {
379         hi |= VTD_FRCD_T;
380     }
381     vtd_set_quad_raw(s, frcd_reg_addr, lo);
382     vtd_set_quad_raw(s, frcd_reg_addr + 8, hi);
383     VTD_DPRINTF(FLOG, "record to FRCD_REG #%"PRIu16 ": hi 0x%"PRIx64
384                 ", lo 0x%"PRIx64, index, hi, lo);
385 }
386 
387 /* Try to collapse multiple pending faults from the same requester */
388 static bool vtd_try_collapse_fault(IntelIOMMUState *s, uint16_t source_id)
389 {
390     uint32_t i;
391     uint64_t frcd_reg;
392     hwaddr addr = DMAR_FRCD_REG_OFFSET + 8; /* The high 64-bit half */
393 
394     for (i = 0; i < DMAR_FRCD_REG_NR; i++) {
395         frcd_reg = vtd_get_quad_raw(s, addr);
396         VTD_DPRINTF(FLOG, "frcd_reg #%d 0x%"PRIx64, i, frcd_reg);
397         if ((frcd_reg & VTD_FRCD_F) &&
398             ((frcd_reg & VTD_FRCD_SID_MASK) == source_id)) {
399             return true;
400         }
401         addr += 16; /* 128-bit for each */
402     }
403     return false;
404 }
405 
406 /* Log and report an DMAR (address translation) fault to software */
407 static void vtd_report_dmar_fault(IntelIOMMUState *s, uint16_t source_id,
408                                   hwaddr addr, VTDFaultReason fault,
409                                   bool is_write)
410 {
411     uint32_t fsts_reg = vtd_get_long_raw(s, DMAR_FSTS_REG);
412 
413     assert(fault < VTD_FR_MAX);
414 
415     if (fault == VTD_FR_RESERVED_ERR) {
416         /* This is not a normal fault reason case. Drop it. */
417         return;
418     }
419     VTD_DPRINTF(FLOG, "sid 0x%"PRIx16 ", fault %d, addr 0x%"PRIx64
420                 ", is_write %d", source_id, fault, addr, is_write);
421     if (fsts_reg & VTD_FSTS_PFO) {
422         VTD_DPRINTF(FLOG, "new fault is not recorded due to "
423                     "Primary Fault Overflow");
424         return;
425     }
426     if (vtd_try_collapse_fault(s, source_id)) {
427         VTD_DPRINTF(FLOG, "new fault is not recorded due to "
428                     "compression of faults");
429         return;
430     }
431     if (vtd_is_frcd_set(s, s->next_frcd_reg)) {
432         VTD_DPRINTF(FLOG, "Primary Fault Overflow and "
433                     "new fault is not recorded, set PFO field");
434         vtd_set_clear_mask_long(s, DMAR_FSTS_REG, 0, VTD_FSTS_PFO);
435         return;
436     }
437 
438     vtd_record_frcd(s, s->next_frcd_reg, source_id, addr, fault, is_write);
439 
440     if (fsts_reg & VTD_FSTS_PPF) {
441         VTD_DPRINTF(FLOG, "there are pending faults already, "
442                     "fault event is not generated");
443         vtd_set_frcd_and_update_ppf(s, s->next_frcd_reg);
444         s->next_frcd_reg++;
445         if (s->next_frcd_reg == DMAR_FRCD_REG_NR) {
446             s->next_frcd_reg = 0;
447         }
448     } else {
449         vtd_set_clear_mask_long(s, DMAR_FSTS_REG, VTD_FSTS_FRI_MASK,
450                                 VTD_FSTS_FRI(s->next_frcd_reg));
451         vtd_set_frcd_and_update_ppf(s, s->next_frcd_reg); /* Will set PPF */
452         s->next_frcd_reg++;
453         if (s->next_frcd_reg == DMAR_FRCD_REG_NR) {
454             s->next_frcd_reg = 0;
455         }
456         /* This case actually cause the PPF to be Set.
457          * So generate fault event (interrupt).
458          */
459          vtd_generate_fault_event(s, fsts_reg);
460     }
461 }
462 
463 /* Handle Invalidation Queue Errors of queued invalidation interface error
464  * conditions.
465  */
466 static void vtd_handle_inv_queue_error(IntelIOMMUState *s)
467 {
468     uint32_t fsts_reg = vtd_get_long_raw(s, DMAR_FSTS_REG);
469 
470     vtd_set_clear_mask_long(s, DMAR_FSTS_REG, 0, VTD_FSTS_IQE);
471     vtd_generate_fault_event(s, fsts_reg);
472 }
473 
474 /* Set the IWC field and try to generate an invalidation completion interrupt */
475 static void vtd_generate_completion_event(IntelIOMMUState *s)
476 {
477     VTD_DPRINTF(INV, "completes an invalidation wait command with "
478                 "Interrupt Flag");
479     if (vtd_get_long_raw(s, DMAR_ICS_REG) & VTD_ICS_IWC) {
480         VTD_DPRINTF(INV, "there is a previous interrupt condition to be "
481                     "serviced by software, "
482                     "new invalidation event is not generated");
483         return;
484     }
485     vtd_set_clear_mask_long(s, DMAR_ICS_REG, 0, VTD_ICS_IWC);
486     vtd_set_clear_mask_long(s, DMAR_IECTL_REG, 0, VTD_IECTL_IP);
487     if (vtd_get_long_raw(s, DMAR_IECTL_REG) & VTD_IECTL_IM) {
488         VTD_DPRINTF(INV, "IM filed in IECTL_REG is set, new invalidation "
489                     "event is not generated");
490         return;
491     } else {
492         /* Generate the interrupt event */
493         vtd_generate_interrupt(s, DMAR_IEADDR_REG, DMAR_IEDATA_REG);
494         vtd_set_clear_mask_long(s, DMAR_IECTL_REG, VTD_IECTL_IP, 0);
495     }
496 }
497 
498 static inline bool vtd_root_entry_present(VTDRootEntry *root)
499 {
500     return root->val & VTD_ROOT_ENTRY_P;
501 }
502 
503 static int vtd_get_root_entry(IntelIOMMUState *s, uint8_t index,
504                               VTDRootEntry *re)
505 {
506     dma_addr_t addr;
507 
508     addr = s->root + index * sizeof(*re);
509     if (dma_memory_read(&address_space_memory, addr, re, sizeof(*re))) {
510         VTD_DPRINTF(GENERAL, "error: fail to access root-entry at 0x%"PRIx64
511                     " + %"PRIu8, s->root, index);
512         re->val = 0;
513         return -VTD_FR_ROOT_TABLE_INV;
514     }
515     re->val = le64_to_cpu(re->val);
516     return 0;
517 }
518 
519 static inline bool vtd_context_entry_present(VTDContextEntry *context)
520 {
521     return context->lo & VTD_CONTEXT_ENTRY_P;
522 }
523 
524 static int vtd_get_context_entry_from_root(VTDRootEntry *root, uint8_t index,
525                                            VTDContextEntry *ce)
526 {
527     dma_addr_t addr;
528 
529     if (!vtd_root_entry_present(root)) {
530         VTD_DPRINTF(GENERAL, "error: root-entry is not present");
531         return -VTD_FR_ROOT_ENTRY_P;
532     }
533     addr = (root->val & VTD_ROOT_ENTRY_CTP) + index * sizeof(*ce);
534     if (dma_memory_read(&address_space_memory, addr, ce, sizeof(*ce))) {
535         VTD_DPRINTF(GENERAL, "error: fail to access context-entry at 0x%"PRIx64
536                     " + %"PRIu8,
537                     (uint64_t)(root->val & VTD_ROOT_ENTRY_CTP), index);
538         return -VTD_FR_CONTEXT_TABLE_INV;
539     }
540     ce->lo = le64_to_cpu(ce->lo);
541     ce->hi = le64_to_cpu(ce->hi);
542     return 0;
543 }
544 
545 static inline dma_addr_t vtd_get_slpt_base_from_context(VTDContextEntry *ce)
546 {
547     return ce->lo & VTD_CONTEXT_ENTRY_SLPTPTR;
548 }
549 
550 static inline uint64_t vtd_get_slpte_addr(uint64_t slpte)
551 {
552     return slpte & VTD_SL_PT_BASE_ADDR_MASK;
553 }
554 
555 /* Whether the pte indicates the address of the page frame */
556 static inline bool vtd_is_last_slpte(uint64_t slpte, uint32_t level)
557 {
558     return level == VTD_SL_PT_LEVEL || (slpte & VTD_SL_PT_PAGE_SIZE_MASK);
559 }
560 
561 /* Get the content of a spte located in @base_addr[@index] */
562 static uint64_t vtd_get_slpte(dma_addr_t base_addr, uint32_t index)
563 {
564     uint64_t slpte;
565 
566     assert(index < VTD_SL_PT_ENTRY_NR);
567 
568     if (dma_memory_read(&address_space_memory,
569                         base_addr + index * sizeof(slpte), &slpte,
570                         sizeof(slpte))) {
571         slpte = (uint64_t)-1;
572         return slpte;
573     }
574     slpte = le64_to_cpu(slpte);
575     return slpte;
576 }
577 
578 /* Given a gpa and the level of paging structure, return the offset of current
579  * level.
580  */
581 static inline uint32_t vtd_gpa_level_offset(uint64_t gpa, uint32_t level)
582 {
583     return (gpa >> vtd_slpt_level_shift(level)) &
584             ((1ULL << VTD_SL_LEVEL_BITS) - 1);
585 }
586 
587 /* Check Capability Register to see if the @level of page-table is supported */
588 static inline bool vtd_is_level_supported(IntelIOMMUState *s, uint32_t level)
589 {
590     return VTD_CAP_SAGAW_MASK & s->cap &
591            (1ULL << (level - 2 + VTD_CAP_SAGAW_SHIFT));
592 }
593 
594 /* Get the page-table level that hardware should use for the second-level
595  * page-table walk from the Address Width field of context-entry.
596  */
597 static inline uint32_t vtd_get_level_from_context_entry(VTDContextEntry *ce)
598 {
599     return 2 + (ce->hi & VTD_CONTEXT_ENTRY_AW);
600 }
601 
602 static inline uint32_t vtd_get_agaw_from_context_entry(VTDContextEntry *ce)
603 {
604     return 30 + (ce->hi & VTD_CONTEXT_ENTRY_AW) * 9;
605 }
606 
607 static const uint64_t vtd_paging_entry_rsvd_field[] = {
608     [0] = ~0ULL,
609     /* For not large page */
610     [1] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
611     [2] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
612     [3] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
613     [4] = 0x880ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
614     /* For large page */
615     [5] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
616     [6] = 0x1ff800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
617     [7] = 0x3ffff800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
618     [8] = 0x880ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
619 };
620 
621 static bool vtd_slpte_nonzero_rsvd(uint64_t slpte, uint32_t level)
622 {
623     if (slpte & VTD_SL_PT_PAGE_SIZE_MASK) {
624         /* Maybe large page */
625         return slpte & vtd_paging_entry_rsvd_field[level + 4];
626     } else {
627         return slpte & vtd_paging_entry_rsvd_field[level];
628     }
629 }
630 
631 /* Given the @gpa, get relevant @slptep. @slpte_level will be the last level
632  * of the translation, can be used for deciding the size of large page.
633  */
634 static int vtd_gpa_to_slpte(VTDContextEntry *ce, uint64_t gpa, bool is_write,
635                             uint64_t *slptep, uint32_t *slpte_level,
636                             bool *reads, bool *writes)
637 {
638     dma_addr_t addr = vtd_get_slpt_base_from_context(ce);
639     uint32_t level = vtd_get_level_from_context_entry(ce);
640     uint32_t offset;
641     uint64_t slpte;
642     uint32_t ce_agaw = vtd_get_agaw_from_context_entry(ce);
643     uint64_t access_right_check;
644 
645     /* Check if @gpa is above 2^X-1, where X is the minimum of MGAW in CAP_REG
646      * and AW in context-entry.
647      */
648     if (gpa & ~((1ULL << MIN(ce_agaw, VTD_MGAW)) - 1)) {
649         VTD_DPRINTF(GENERAL, "error: gpa 0x%"PRIx64 " exceeds limits", gpa);
650         return -VTD_FR_ADDR_BEYOND_MGAW;
651     }
652 
653     /* FIXME: what is the Atomics request here? */
654     access_right_check = is_write ? VTD_SL_W : VTD_SL_R;
655 
656     while (true) {
657         offset = vtd_gpa_level_offset(gpa, level);
658         slpte = vtd_get_slpte(addr, offset);
659 
660         if (slpte == (uint64_t)-1) {
661             VTD_DPRINTF(GENERAL, "error: fail to access second-level paging "
662                         "entry at level %"PRIu32 " for gpa 0x%"PRIx64,
663                         level, gpa);
664             if (level == vtd_get_level_from_context_entry(ce)) {
665                 /* Invalid programming of context-entry */
666                 return -VTD_FR_CONTEXT_ENTRY_INV;
667             } else {
668                 return -VTD_FR_PAGING_ENTRY_INV;
669             }
670         }
671         *reads = (*reads) && (slpte & VTD_SL_R);
672         *writes = (*writes) && (slpte & VTD_SL_W);
673         if (!(slpte & access_right_check)) {
674             VTD_DPRINTF(GENERAL, "error: lack of %s permission for "
675                         "gpa 0x%"PRIx64 " slpte 0x%"PRIx64,
676                         (is_write ? "write" : "read"), gpa, slpte);
677             return is_write ? -VTD_FR_WRITE : -VTD_FR_READ;
678         }
679         if (vtd_slpte_nonzero_rsvd(slpte, level)) {
680             VTD_DPRINTF(GENERAL, "error: non-zero reserved field in second "
681                         "level paging entry level %"PRIu32 " slpte 0x%"PRIx64,
682                         level, slpte);
683             return -VTD_FR_PAGING_ENTRY_RSVD;
684         }
685 
686         if (vtd_is_last_slpte(slpte, level)) {
687             *slptep = slpte;
688             *slpte_level = level;
689             return 0;
690         }
691         addr = vtd_get_slpte_addr(slpte);
692         level--;
693     }
694 }
695 
696 /* Map a device to its corresponding domain (context-entry) */
697 static int vtd_dev_to_context_entry(IntelIOMMUState *s, uint8_t bus_num,
698                                     uint8_t devfn, VTDContextEntry *ce)
699 {
700     VTDRootEntry re;
701     int ret_fr;
702 
703     ret_fr = vtd_get_root_entry(s, bus_num, &re);
704     if (ret_fr) {
705         return ret_fr;
706     }
707 
708     if (!vtd_root_entry_present(&re)) {
709         VTD_DPRINTF(GENERAL, "error: root-entry #%"PRIu8 " is not present",
710                     bus_num);
711         return -VTD_FR_ROOT_ENTRY_P;
712     } else if (re.rsvd || (re.val & VTD_ROOT_ENTRY_RSVD)) {
713         VTD_DPRINTF(GENERAL, "error: non-zero reserved field in root-entry "
714                     "hi 0x%"PRIx64 " lo 0x%"PRIx64, re.rsvd, re.val);
715         return -VTD_FR_ROOT_ENTRY_RSVD;
716     }
717 
718     ret_fr = vtd_get_context_entry_from_root(&re, devfn, ce);
719     if (ret_fr) {
720         return ret_fr;
721     }
722 
723     if (!vtd_context_entry_present(ce)) {
724         VTD_DPRINTF(GENERAL,
725                     "error: context-entry #%"PRIu8 "(bus #%"PRIu8 ") "
726                     "is not present", devfn, bus_num);
727         return -VTD_FR_CONTEXT_ENTRY_P;
728     } else if ((ce->hi & VTD_CONTEXT_ENTRY_RSVD_HI) ||
729                (ce->lo & VTD_CONTEXT_ENTRY_RSVD_LO)) {
730         VTD_DPRINTF(GENERAL,
731                     "error: non-zero reserved field in context-entry "
732                     "hi 0x%"PRIx64 " lo 0x%"PRIx64, ce->hi, ce->lo);
733         return -VTD_FR_CONTEXT_ENTRY_RSVD;
734     }
735     /* Check if the programming of context-entry is valid */
736     if (!vtd_is_level_supported(s, vtd_get_level_from_context_entry(ce))) {
737         VTD_DPRINTF(GENERAL, "error: unsupported Address Width value in "
738                     "context-entry hi 0x%"PRIx64 " lo 0x%"PRIx64,
739                     ce->hi, ce->lo);
740         return -VTD_FR_CONTEXT_ENTRY_INV;
741     } else if (ce->lo & VTD_CONTEXT_ENTRY_TT) {
742         VTD_DPRINTF(GENERAL, "error: unsupported Translation Type in "
743                     "context-entry hi 0x%"PRIx64 " lo 0x%"PRIx64,
744                     ce->hi, ce->lo);
745         return -VTD_FR_CONTEXT_ENTRY_INV;
746     }
747     return 0;
748 }
749 
750 static inline uint16_t vtd_make_source_id(uint8_t bus_num, uint8_t devfn)
751 {
752     return ((bus_num & 0xffUL) << 8) | (devfn & 0xffUL);
753 }
754 
755 static const bool vtd_qualified_faults[] = {
756     [VTD_FR_RESERVED] = false,
757     [VTD_FR_ROOT_ENTRY_P] = false,
758     [VTD_FR_CONTEXT_ENTRY_P] = true,
759     [VTD_FR_CONTEXT_ENTRY_INV] = true,
760     [VTD_FR_ADDR_BEYOND_MGAW] = true,
761     [VTD_FR_WRITE] = true,
762     [VTD_FR_READ] = true,
763     [VTD_FR_PAGING_ENTRY_INV] = true,
764     [VTD_FR_ROOT_TABLE_INV] = false,
765     [VTD_FR_CONTEXT_TABLE_INV] = false,
766     [VTD_FR_ROOT_ENTRY_RSVD] = false,
767     [VTD_FR_PAGING_ENTRY_RSVD] = true,
768     [VTD_FR_CONTEXT_ENTRY_TT] = true,
769     [VTD_FR_RESERVED_ERR] = false,
770     [VTD_FR_MAX] = false,
771 };
772 
773 /* To see if a fault condition is "qualified", which is reported to software
774  * only if the FPD field in the context-entry used to process the faulting
775  * request is 0.
776  */
777 static inline bool vtd_is_qualified_fault(VTDFaultReason fault)
778 {
779     return vtd_qualified_faults[fault];
780 }
781 
782 static inline bool vtd_is_interrupt_addr(hwaddr addr)
783 {
784     return VTD_INTERRUPT_ADDR_FIRST <= addr && addr <= VTD_INTERRUPT_ADDR_LAST;
785 }
786 
787 /* Map dev to context-entry then do a paging-structures walk to do a iommu
788  * translation.
789  *
790  * Called from RCU critical section.
791  *
792  * @bus_num: The bus number
793  * @devfn: The devfn, which is the  combined of device and function number
794  * @is_write: The access is a write operation
795  * @entry: IOMMUTLBEntry that contain the addr to be translated and result
796  */
797 static void vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
798                                    uint8_t devfn, hwaddr addr, bool is_write,
799                                    IOMMUTLBEntry *entry)
800 {
801     IntelIOMMUState *s = vtd_as->iommu_state;
802     VTDContextEntry ce;
803     uint8_t bus_num = pci_bus_num(bus);
804     VTDContextCacheEntry *cc_entry = &vtd_as->context_cache_entry;
805     uint64_t slpte, page_mask;
806     uint32_t level;
807     uint16_t source_id = vtd_make_source_id(bus_num, devfn);
808     int ret_fr;
809     bool is_fpd_set = false;
810     bool reads = true;
811     bool writes = true;
812     VTDIOTLBEntry *iotlb_entry;
813 
814     /* Check if the request is in interrupt address range */
815     if (vtd_is_interrupt_addr(addr)) {
816         if (is_write) {
817             /* FIXME: since we don't know the length of the access here, we
818              * treat Non-DWORD length write requests without PASID as
819              * interrupt requests, too. Withoud interrupt remapping support,
820              * we just use 1:1 mapping.
821              */
822             VTD_DPRINTF(MMU, "write request to interrupt address "
823                         "gpa 0x%"PRIx64, addr);
824             entry->iova = addr & VTD_PAGE_MASK_4K;
825             entry->translated_addr = addr & VTD_PAGE_MASK_4K;
826             entry->addr_mask = ~VTD_PAGE_MASK_4K;
827             entry->perm = IOMMU_WO;
828             return;
829         } else {
830             VTD_DPRINTF(GENERAL, "error: read request from interrupt address "
831                         "gpa 0x%"PRIx64, addr);
832             vtd_report_dmar_fault(s, source_id, addr, VTD_FR_READ, is_write);
833             return;
834         }
835     }
836     /* Try to fetch slpte form IOTLB */
837     iotlb_entry = vtd_lookup_iotlb(s, source_id, addr);
838     if (iotlb_entry) {
839         VTD_DPRINTF(CACHE, "hit iotlb sid 0x%"PRIx16 " gpa 0x%"PRIx64
840                     " slpte 0x%"PRIx64 " did 0x%"PRIx16, source_id, addr,
841                     iotlb_entry->slpte, iotlb_entry->domain_id);
842         slpte = iotlb_entry->slpte;
843         reads = iotlb_entry->read_flags;
844         writes = iotlb_entry->write_flags;
845         page_mask = iotlb_entry->mask;
846         goto out;
847     }
848     /* Try to fetch context-entry from cache first */
849     if (cc_entry->context_cache_gen == s->context_cache_gen) {
850         VTD_DPRINTF(CACHE, "hit context-cache bus %d devfn %d "
851                     "(hi %"PRIx64 " lo %"PRIx64 " gen %"PRIu32 ")",
852                     bus_num, devfn, cc_entry->context_entry.hi,
853                     cc_entry->context_entry.lo, cc_entry->context_cache_gen);
854         ce = cc_entry->context_entry;
855         is_fpd_set = ce.lo & VTD_CONTEXT_ENTRY_FPD;
856     } else {
857         ret_fr = vtd_dev_to_context_entry(s, bus_num, devfn, &ce);
858         is_fpd_set = ce.lo & VTD_CONTEXT_ENTRY_FPD;
859         if (ret_fr) {
860             ret_fr = -ret_fr;
861             if (is_fpd_set && vtd_is_qualified_fault(ret_fr)) {
862                 VTD_DPRINTF(FLOG, "fault processing is disabled for DMA "
863                             "requests through this context-entry "
864                             "(with FPD Set)");
865             } else {
866                 vtd_report_dmar_fault(s, source_id, addr, ret_fr, is_write);
867             }
868             return;
869         }
870         /* Update context-cache */
871         VTD_DPRINTF(CACHE, "update context-cache bus %d devfn %d "
872                     "(hi %"PRIx64 " lo %"PRIx64 " gen %"PRIu32 "->%"PRIu32 ")",
873                     bus_num, devfn, ce.hi, ce.lo,
874                     cc_entry->context_cache_gen, s->context_cache_gen);
875         cc_entry->context_entry = ce;
876         cc_entry->context_cache_gen = s->context_cache_gen;
877     }
878 
879     ret_fr = vtd_gpa_to_slpte(&ce, addr, is_write, &slpte, &level,
880                               &reads, &writes);
881     if (ret_fr) {
882         ret_fr = -ret_fr;
883         if (is_fpd_set && vtd_is_qualified_fault(ret_fr)) {
884             VTD_DPRINTF(FLOG, "fault processing is disabled for DMA requests "
885                         "through this context-entry (with FPD Set)");
886         } else {
887             vtd_report_dmar_fault(s, source_id, addr, ret_fr, is_write);
888         }
889         return;
890     }
891 
892     page_mask = vtd_slpt_level_page_mask(level);
893     vtd_update_iotlb(s, source_id, VTD_CONTEXT_ENTRY_DID(ce.hi), addr, slpte,
894                      reads, writes, level);
895 out:
896     entry->iova = addr & page_mask;
897     entry->translated_addr = vtd_get_slpte_addr(slpte) & page_mask;
898     entry->addr_mask = ~page_mask;
899     entry->perm = (writes ? 2 : 0) + (reads ? 1 : 0);
900 }
901 
902 static void vtd_root_table_setup(IntelIOMMUState *s)
903 {
904     s->root = vtd_get_quad_raw(s, DMAR_RTADDR_REG);
905     s->root_extended = s->root & VTD_RTADDR_RTT;
906     s->root &= VTD_RTADDR_ADDR_MASK;
907 
908     VTD_DPRINTF(CSR, "root_table addr 0x%"PRIx64 " %s", s->root,
909                 (s->root_extended ? "(extended)" : ""));
910 }
911 
912 static void vtd_iec_notify_all(IntelIOMMUState *s, bool global,
913                                uint32_t index, uint32_t mask)
914 {
915     x86_iommu_iec_notify_all(X86_IOMMU_DEVICE(s), global, index, mask);
916 }
917 
918 static void vtd_interrupt_remap_table_setup(IntelIOMMUState *s)
919 {
920     uint64_t value = 0;
921     value = vtd_get_quad_raw(s, DMAR_IRTA_REG);
922     s->intr_size = 1UL << ((value & VTD_IRTA_SIZE_MASK) + 1);
923     s->intr_root = value & VTD_IRTA_ADDR_MASK;
924     s->intr_eime = value & VTD_IRTA_EIME;
925 
926     /* Notify global invalidation */
927     vtd_iec_notify_all(s, true, 0, 0);
928 
929     VTD_DPRINTF(CSR, "int remap table addr 0x%"PRIx64 " size %"PRIu32,
930                 s->intr_root, s->intr_size);
931 }
932 
933 static void vtd_context_global_invalidate(IntelIOMMUState *s)
934 {
935     s->context_cache_gen++;
936     if (s->context_cache_gen == VTD_CONTEXT_CACHE_GEN_MAX) {
937         vtd_reset_context_cache(s);
938     }
939 }
940 
941 
942 /* Find the VTD address space currently associated with a given bus number,
943  */
944 static VTDBus *vtd_find_as_from_bus_num(IntelIOMMUState *s, uint8_t bus_num)
945 {
946     VTDBus *vtd_bus = s->vtd_as_by_bus_num[bus_num];
947     if (!vtd_bus) {
948         /* Iterate over the registered buses to find the one
949          * which currently hold this bus number, and update the bus_num lookup table:
950          */
951         GHashTableIter iter;
952 
953         g_hash_table_iter_init(&iter, s->vtd_as_by_busptr);
954         while (g_hash_table_iter_next (&iter, NULL, (void**)&vtd_bus)) {
955             if (pci_bus_num(vtd_bus->bus) == bus_num) {
956                 s->vtd_as_by_bus_num[bus_num] = vtd_bus;
957                 return vtd_bus;
958             }
959         }
960     }
961     return vtd_bus;
962 }
963 
964 /* Do a context-cache device-selective invalidation.
965  * @func_mask: FM field after shifting
966  */
967 static void vtd_context_device_invalidate(IntelIOMMUState *s,
968                                           uint16_t source_id,
969                                           uint16_t func_mask)
970 {
971     uint16_t mask;
972     VTDBus *vtd_bus;
973     VTDAddressSpace *vtd_as;
974     uint16_t devfn;
975     uint16_t devfn_it;
976 
977     switch (func_mask & 3) {
978     case 0:
979         mask = 0;   /* No bits in the SID field masked */
980         break;
981     case 1:
982         mask = 4;   /* Mask bit 2 in the SID field */
983         break;
984     case 2:
985         mask = 6;   /* Mask bit 2:1 in the SID field */
986         break;
987     case 3:
988         mask = 7;   /* Mask bit 2:0 in the SID field */
989         break;
990     }
991     VTD_DPRINTF(INV, "device-selective invalidation source 0x%"PRIx16
992                     " mask %"PRIu16, source_id, mask);
993     vtd_bus = vtd_find_as_from_bus_num(s, VTD_SID_TO_BUS(source_id));
994     if (vtd_bus) {
995         devfn = VTD_SID_TO_DEVFN(source_id);
996         for (devfn_it = 0; devfn_it < X86_IOMMU_PCI_DEVFN_MAX; ++devfn_it) {
997             vtd_as = vtd_bus->dev_as[devfn_it];
998             if (vtd_as && ((devfn_it & mask) == (devfn & mask))) {
999                 VTD_DPRINTF(INV, "invalidate context-cahce of devfn 0x%"PRIx16,
1000                             devfn_it);
1001                 vtd_as->context_cache_entry.context_cache_gen = 0;
1002             }
1003         }
1004     }
1005 }
1006 
1007 /* Context-cache invalidation
1008  * Returns the Context Actual Invalidation Granularity.
1009  * @val: the content of the CCMD_REG
1010  */
1011 static uint64_t vtd_context_cache_invalidate(IntelIOMMUState *s, uint64_t val)
1012 {
1013     uint64_t caig;
1014     uint64_t type = val & VTD_CCMD_CIRG_MASK;
1015 
1016     switch (type) {
1017     case VTD_CCMD_DOMAIN_INVL:
1018         VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1019                     (uint16_t)VTD_CCMD_DID(val));
1020         /* Fall through */
1021     case VTD_CCMD_GLOBAL_INVL:
1022         VTD_DPRINTF(INV, "global invalidation");
1023         caig = VTD_CCMD_GLOBAL_INVL_A;
1024         vtd_context_global_invalidate(s);
1025         break;
1026 
1027     case VTD_CCMD_DEVICE_INVL:
1028         caig = VTD_CCMD_DEVICE_INVL_A;
1029         vtd_context_device_invalidate(s, VTD_CCMD_SID(val), VTD_CCMD_FM(val));
1030         break;
1031 
1032     default:
1033         VTD_DPRINTF(GENERAL, "error: invalid granularity");
1034         caig = 0;
1035     }
1036     return caig;
1037 }
1038 
1039 static void vtd_iotlb_global_invalidate(IntelIOMMUState *s)
1040 {
1041     vtd_reset_iotlb(s);
1042 }
1043 
1044 static void vtd_iotlb_domain_invalidate(IntelIOMMUState *s, uint16_t domain_id)
1045 {
1046     g_hash_table_foreach_remove(s->iotlb, vtd_hash_remove_by_domain,
1047                                 &domain_id);
1048 }
1049 
1050 static void vtd_iotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
1051                                       hwaddr addr, uint8_t am)
1052 {
1053     VTDIOTLBPageInvInfo info;
1054 
1055     assert(am <= VTD_MAMV);
1056     info.domain_id = domain_id;
1057     info.addr = addr;
1058     info.mask = ~((1 << am) - 1);
1059     g_hash_table_foreach_remove(s->iotlb, vtd_hash_remove_by_page, &info);
1060 }
1061 
1062 /* Flush IOTLB
1063  * Returns the IOTLB Actual Invalidation Granularity.
1064  * @val: the content of the IOTLB_REG
1065  */
1066 static uint64_t vtd_iotlb_flush(IntelIOMMUState *s, uint64_t val)
1067 {
1068     uint64_t iaig;
1069     uint64_t type = val & VTD_TLB_FLUSH_GRANU_MASK;
1070     uint16_t domain_id;
1071     hwaddr addr;
1072     uint8_t am;
1073 
1074     switch (type) {
1075     case VTD_TLB_GLOBAL_FLUSH:
1076         VTD_DPRINTF(INV, "global invalidation");
1077         iaig = VTD_TLB_GLOBAL_FLUSH_A;
1078         vtd_iotlb_global_invalidate(s);
1079         break;
1080 
1081     case VTD_TLB_DSI_FLUSH:
1082         domain_id = VTD_TLB_DID(val);
1083         VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1084                     domain_id);
1085         iaig = VTD_TLB_DSI_FLUSH_A;
1086         vtd_iotlb_domain_invalidate(s, domain_id);
1087         break;
1088 
1089     case VTD_TLB_PSI_FLUSH:
1090         domain_id = VTD_TLB_DID(val);
1091         addr = vtd_get_quad_raw(s, DMAR_IVA_REG);
1092         am = VTD_IVA_AM(addr);
1093         addr = VTD_IVA_ADDR(addr);
1094         VTD_DPRINTF(INV, "page-selective invalidation domain 0x%"PRIx16
1095                     " addr 0x%"PRIx64 " mask %"PRIu8, domain_id, addr, am);
1096         if (am > VTD_MAMV) {
1097             VTD_DPRINTF(GENERAL, "error: supported max address mask value is "
1098                         "%"PRIu8, (uint8_t)VTD_MAMV);
1099             iaig = 0;
1100             break;
1101         }
1102         iaig = VTD_TLB_PSI_FLUSH_A;
1103         vtd_iotlb_page_invalidate(s, domain_id, addr, am);
1104         break;
1105 
1106     default:
1107         VTD_DPRINTF(GENERAL, "error: invalid granularity");
1108         iaig = 0;
1109     }
1110     return iaig;
1111 }
1112 
1113 static inline bool vtd_queued_inv_enable_check(IntelIOMMUState *s)
1114 {
1115     return s->iq_tail == 0;
1116 }
1117 
1118 static inline bool vtd_queued_inv_disable_check(IntelIOMMUState *s)
1119 {
1120     return s->qi_enabled && (s->iq_tail == s->iq_head) &&
1121            (s->iq_last_desc_type == VTD_INV_DESC_WAIT);
1122 }
1123 
1124 static void vtd_handle_gcmd_qie(IntelIOMMUState *s, bool en)
1125 {
1126     uint64_t iqa_val = vtd_get_quad_raw(s, DMAR_IQA_REG);
1127 
1128     VTD_DPRINTF(INV, "Queued Invalidation Enable %s", (en ? "on" : "off"));
1129     if (en) {
1130         if (vtd_queued_inv_enable_check(s)) {
1131             s->iq = iqa_val & VTD_IQA_IQA_MASK;
1132             /* 2^(x+8) entries */
1133             s->iq_size = 1UL << ((iqa_val & VTD_IQA_QS) + 8);
1134             s->qi_enabled = true;
1135             VTD_DPRINTF(INV, "DMAR_IQA_REG 0x%"PRIx64, iqa_val);
1136             VTD_DPRINTF(INV, "Invalidation Queue addr 0x%"PRIx64 " size %d",
1137                         s->iq, s->iq_size);
1138             /* Ok - report back to driver */
1139             vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_QIES);
1140         } else {
1141             VTD_DPRINTF(GENERAL, "error: can't enable Queued Invalidation: "
1142                         "tail %"PRIu16, s->iq_tail);
1143         }
1144     } else {
1145         if (vtd_queued_inv_disable_check(s)) {
1146             /* disable Queued Invalidation */
1147             vtd_set_quad_raw(s, DMAR_IQH_REG, 0);
1148             s->iq_head = 0;
1149             s->qi_enabled = false;
1150             /* Ok - report back to driver */
1151             vtd_set_clear_mask_long(s, DMAR_GSTS_REG, VTD_GSTS_QIES, 0);
1152         } else {
1153             VTD_DPRINTF(GENERAL, "error: can't disable Queued Invalidation: "
1154                         "head %"PRIu16 ", tail %"PRIu16
1155                         ", last_descriptor %"PRIu8,
1156                         s->iq_head, s->iq_tail, s->iq_last_desc_type);
1157         }
1158     }
1159 }
1160 
1161 /* Set Root Table Pointer */
1162 static void vtd_handle_gcmd_srtp(IntelIOMMUState *s)
1163 {
1164     VTD_DPRINTF(CSR, "set Root Table Pointer");
1165 
1166     vtd_root_table_setup(s);
1167     /* Ok - report back to driver */
1168     vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_RTPS);
1169 }
1170 
1171 /* Set Interrupt Remap Table Pointer */
1172 static void vtd_handle_gcmd_sirtp(IntelIOMMUState *s)
1173 {
1174     VTD_DPRINTF(CSR, "set Interrupt Remap Table Pointer");
1175 
1176     vtd_interrupt_remap_table_setup(s);
1177     /* Ok - report back to driver */
1178     vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_IRTPS);
1179 }
1180 
1181 /* Handle Translation Enable/Disable */
1182 static void vtd_handle_gcmd_te(IntelIOMMUState *s, bool en)
1183 {
1184     VTD_DPRINTF(CSR, "Translation Enable %s", (en ? "on" : "off"));
1185 
1186     if (en) {
1187         s->dmar_enabled = true;
1188         /* Ok - report back to driver */
1189         vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_TES);
1190     } else {
1191         s->dmar_enabled = false;
1192 
1193         /* Clear the index of Fault Recording Register */
1194         s->next_frcd_reg = 0;
1195         /* Ok - report back to driver */
1196         vtd_set_clear_mask_long(s, DMAR_GSTS_REG, VTD_GSTS_TES, 0);
1197     }
1198 }
1199 
1200 /* Handle Interrupt Remap Enable/Disable */
1201 static void vtd_handle_gcmd_ire(IntelIOMMUState *s, bool en)
1202 {
1203     VTD_DPRINTF(CSR, "Interrupt Remap Enable %s", (en ? "on" : "off"));
1204 
1205     if (en) {
1206         s->intr_enabled = true;
1207         /* Ok - report back to driver */
1208         vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_IRES);
1209     } else {
1210         s->intr_enabled = false;
1211         /* Ok - report back to driver */
1212         vtd_set_clear_mask_long(s, DMAR_GSTS_REG, VTD_GSTS_IRES, 0);
1213     }
1214 }
1215 
1216 /* Handle write to Global Command Register */
1217 static void vtd_handle_gcmd_write(IntelIOMMUState *s)
1218 {
1219     uint32_t status = vtd_get_long_raw(s, DMAR_GSTS_REG);
1220     uint32_t val = vtd_get_long_raw(s, DMAR_GCMD_REG);
1221     uint32_t changed = status ^ val;
1222 
1223     VTD_DPRINTF(CSR, "value 0x%"PRIx32 " status 0x%"PRIx32, val, status);
1224     if (changed & VTD_GCMD_TE) {
1225         /* Translation enable/disable */
1226         vtd_handle_gcmd_te(s, val & VTD_GCMD_TE);
1227     }
1228     if (val & VTD_GCMD_SRTP) {
1229         /* Set/update the root-table pointer */
1230         vtd_handle_gcmd_srtp(s);
1231     }
1232     if (changed & VTD_GCMD_QIE) {
1233         /* Queued Invalidation Enable */
1234         vtd_handle_gcmd_qie(s, val & VTD_GCMD_QIE);
1235     }
1236     if (val & VTD_GCMD_SIRTP) {
1237         /* Set/update the interrupt remapping root-table pointer */
1238         vtd_handle_gcmd_sirtp(s);
1239     }
1240     if (changed & VTD_GCMD_IRE) {
1241         /* Interrupt remap enable/disable */
1242         vtd_handle_gcmd_ire(s, val & VTD_GCMD_IRE);
1243     }
1244 }
1245 
1246 /* Handle write to Context Command Register */
1247 static void vtd_handle_ccmd_write(IntelIOMMUState *s)
1248 {
1249     uint64_t ret;
1250     uint64_t val = vtd_get_quad_raw(s, DMAR_CCMD_REG);
1251 
1252     /* Context-cache invalidation request */
1253     if (val & VTD_CCMD_ICC) {
1254         if (s->qi_enabled) {
1255             VTD_DPRINTF(GENERAL, "error: Queued Invalidation enabled, "
1256                         "should not use register-based invalidation");
1257             return;
1258         }
1259         ret = vtd_context_cache_invalidate(s, val);
1260         /* Invalidation completed. Change something to show */
1261         vtd_set_clear_mask_quad(s, DMAR_CCMD_REG, VTD_CCMD_ICC, 0ULL);
1262         ret = vtd_set_clear_mask_quad(s, DMAR_CCMD_REG, VTD_CCMD_CAIG_MASK,
1263                                       ret);
1264         VTD_DPRINTF(INV, "CCMD_REG write-back val: 0x%"PRIx64, ret);
1265     }
1266 }
1267 
1268 /* Handle write to IOTLB Invalidation Register */
1269 static void vtd_handle_iotlb_write(IntelIOMMUState *s)
1270 {
1271     uint64_t ret;
1272     uint64_t val = vtd_get_quad_raw(s, DMAR_IOTLB_REG);
1273 
1274     /* IOTLB invalidation request */
1275     if (val & VTD_TLB_IVT) {
1276         if (s->qi_enabled) {
1277             VTD_DPRINTF(GENERAL, "error: Queued Invalidation enabled, "
1278                         "should not use register-based invalidation");
1279             return;
1280         }
1281         ret = vtd_iotlb_flush(s, val);
1282         /* Invalidation completed. Change something to show */
1283         vtd_set_clear_mask_quad(s, DMAR_IOTLB_REG, VTD_TLB_IVT, 0ULL);
1284         ret = vtd_set_clear_mask_quad(s, DMAR_IOTLB_REG,
1285                                       VTD_TLB_FLUSH_GRANU_MASK_A, ret);
1286         VTD_DPRINTF(INV, "IOTLB_REG write-back val: 0x%"PRIx64, ret);
1287     }
1288 }
1289 
1290 /* Fetch an Invalidation Descriptor from the Invalidation Queue */
1291 static bool vtd_get_inv_desc(dma_addr_t base_addr, uint32_t offset,
1292                              VTDInvDesc *inv_desc)
1293 {
1294     dma_addr_t addr = base_addr + offset * sizeof(*inv_desc);
1295     if (dma_memory_read(&address_space_memory, addr, inv_desc,
1296         sizeof(*inv_desc))) {
1297         VTD_DPRINTF(GENERAL, "error: fail to fetch Invalidation Descriptor "
1298                     "base_addr 0x%"PRIx64 " offset %"PRIu32, base_addr, offset);
1299         inv_desc->lo = 0;
1300         inv_desc->hi = 0;
1301 
1302         return false;
1303     }
1304     inv_desc->lo = le64_to_cpu(inv_desc->lo);
1305     inv_desc->hi = le64_to_cpu(inv_desc->hi);
1306     return true;
1307 }
1308 
1309 static bool vtd_process_wait_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
1310 {
1311     if ((inv_desc->hi & VTD_INV_DESC_WAIT_RSVD_HI) ||
1312         (inv_desc->lo & VTD_INV_DESC_WAIT_RSVD_LO)) {
1313         VTD_DPRINTF(GENERAL, "error: non-zero reserved field in Invalidation "
1314                     "Wait Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1315                     inv_desc->hi, inv_desc->lo);
1316         return false;
1317     }
1318     if (inv_desc->lo & VTD_INV_DESC_WAIT_SW) {
1319         /* Status Write */
1320         uint32_t status_data = (uint32_t)(inv_desc->lo >>
1321                                VTD_INV_DESC_WAIT_DATA_SHIFT);
1322 
1323         assert(!(inv_desc->lo & VTD_INV_DESC_WAIT_IF));
1324 
1325         /* FIXME: need to be masked with HAW? */
1326         dma_addr_t status_addr = inv_desc->hi;
1327         VTD_DPRINTF(INV, "status data 0x%x, status addr 0x%"PRIx64,
1328                     status_data, status_addr);
1329         status_data = cpu_to_le32(status_data);
1330         if (dma_memory_write(&address_space_memory, status_addr, &status_data,
1331                              sizeof(status_data))) {
1332             VTD_DPRINTF(GENERAL, "error: fail to perform a coherent write");
1333             return false;
1334         }
1335     } else if (inv_desc->lo & VTD_INV_DESC_WAIT_IF) {
1336         /* Interrupt flag */
1337         VTD_DPRINTF(INV, "Invalidation Wait Descriptor interrupt completion");
1338         vtd_generate_completion_event(s);
1339     } else {
1340         VTD_DPRINTF(GENERAL, "error: invalid Invalidation Wait Descriptor: "
1341                     "hi 0x%"PRIx64 " lo 0x%"PRIx64, inv_desc->hi, inv_desc->lo);
1342         return false;
1343     }
1344     return true;
1345 }
1346 
1347 static bool vtd_process_context_cache_desc(IntelIOMMUState *s,
1348                                            VTDInvDesc *inv_desc)
1349 {
1350     if ((inv_desc->lo & VTD_INV_DESC_CC_RSVD) || inv_desc->hi) {
1351         VTD_DPRINTF(GENERAL, "error: non-zero reserved field in Context-cache "
1352                     "Invalidate Descriptor");
1353         return false;
1354     }
1355     switch (inv_desc->lo & VTD_INV_DESC_CC_G) {
1356     case VTD_INV_DESC_CC_DOMAIN:
1357         VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1358                     (uint16_t)VTD_INV_DESC_CC_DID(inv_desc->lo));
1359         /* Fall through */
1360     case VTD_INV_DESC_CC_GLOBAL:
1361         VTD_DPRINTF(INV, "global invalidation");
1362         vtd_context_global_invalidate(s);
1363         break;
1364 
1365     case VTD_INV_DESC_CC_DEVICE:
1366         vtd_context_device_invalidate(s, VTD_INV_DESC_CC_SID(inv_desc->lo),
1367                                       VTD_INV_DESC_CC_FM(inv_desc->lo));
1368         break;
1369 
1370     default:
1371         VTD_DPRINTF(GENERAL, "error: invalid granularity in Context-cache "
1372                     "Invalidate Descriptor hi 0x%"PRIx64  " lo 0x%"PRIx64,
1373                     inv_desc->hi, inv_desc->lo);
1374         return false;
1375     }
1376     return true;
1377 }
1378 
1379 static bool vtd_process_iotlb_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
1380 {
1381     uint16_t domain_id;
1382     uint8_t am;
1383     hwaddr addr;
1384 
1385     if ((inv_desc->lo & VTD_INV_DESC_IOTLB_RSVD_LO) ||
1386         (inv_desc->hi & VTD_INV_DESC_IOTLB_RSVD_HI)) {
1387         VTD_DPRINTF(GENERAL, "error: non-zero reserved field in IOTLB "
1388                     "Invalidate Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1389                     inv_desc->hi, inv_desc->lo);
1390         return false;
1391     }
1392 
1393     switch (inv_desc->lo & VTD_INV_DESC_IOTLB_G) {
1394     case VTD_INV_DESC_IOTLB_GLOBAL:
1395         VTD_DPRINTF(INV, "global invalidation");
1396         vtd_iotlb_global_invalidate(s);
1397         break;
1398 
1399     case VTD_INV_DESC_IOTLB_DOMAIN:
1400         domain_id = VTD_INV_DESC_IOTLB_DID(inv_desc->lo);
1401         VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1402                     domain_id);
1403         vtd_iotlb_domain_invalidate(s, domain_id);
1404         break;
1405 
1406     case VTD_INV_DESC_IOTLB_PAGE:
1407         domain_id = VTD_INV_DESC_IOTLB_DID(inv_desc->lo);
1408         addr = VTD_INV_DESC_IOTLB_ADDR(inv_desc->hi);
1409         am = VTD_INV_DESC_IOTLB_AM(inv_desc->hi);
1410         VTD_DPRINTF(INV, "page-selective invalidation domain 0x%"PRIx16
1411                     " addr 0x%"PRIx64 " mask %"PRIu8, domain_id, addr, am);
1412         if (am > VTD_MAMV) {
1413             VTD_DPRINTF(GENERAL, "error: supported max address mask value is "
1414                         "%"PRIu8, (uint8_t)VTD_MAMV);
1415             return false;
1416         }
1417         vtd_iotlb_page_invalidate(s, domain_id, addr, am);
1418         break;
1419 
1420     default:
1421         VTD_DPRINTF(GENERAL, "error: invalid granularity in IOTLB Invalidate "
1422                     "Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1423                     inv_desc->hi, inv_desc->lo);
1424         return false;
1425     }
1426     return true;
1427 }
1428 
1429 static bool vtd_process_inv_iec_desc(IntelIOMMUState *s,
1430                                      VTDInvDesc *inv_desc)
1431 {
1432     VTD_DPRINTF(INV, "inv ir glob %d index %d mask %d",
1433                 inv_desc->iec.granularity,
1434                 inv_desc->iec.index,
1435                 inv_desc->iec.index_mask);
1436 
1437     vtd_iec_notify_all(s, !inv_desc->iec.granularity,
1438                        inv_desc->iec.index,
1439                        inv_desc->iec.index_mask);
1440 
1441     return true;
1442 }
1443 
1444 static bool vtd_process_inv_desc(IntelIOMMUState *s)
1445 {
1446     VTDInvDesc inv_desc;
1447     uint8_t desc_type;
1448 
1449     VTD_DPRINTF(INV, "iq head %"PRIu16, s->iq_head);
1450     if (!vtd_get_inv_desc(s->iq, s->iq_head, &inv_desc)) {
1451         s->iq_last_desc_type = VTD_INV_DESC_NONE;
1452         return false;
1453     }
1454     desc_type = inv_desc.lo & VTD_INV_DESC_TYPE;
1455     /* FIXME: should update at first or at last? */
1456     s->iq_last_desc_type = desc_type;
1457 
1458     switch (desc_type) {
1459     case VTD_INV_DESC_CC:
1460         VTD_DPRINTF(INV, "Context-cache Invalidate Descriptor hi 0x%"PRIx64
1461                     " lo 0x%"PRIx64, inv_desc.hi, inv_desc.lo);
1462         if (!vtd_process_context_cache_desc(s, &inv_desc)) {
1463             return false;
1464         }
1465         break;
1466 
1467     case VTD_INV_DESC_IOTLB:
1468         VTD_DPRINTF(INV, "IOTLB Invalidate Descriptor hi 0x%"PRIx64
1469                     " lo 0x%"PRIx64, inv_desc.hi, inv_desc.lo);
1470         if (!vtd_process_iotlb_desc(s, &inv_desc)) {
1471             return false;
1472         }
1473         break;
1474 
1475     case VTD_INV_DESC_WAIT:
1476         VTD_DPRINTF(INV, "Invalidation Wait Descriptor hi 0x%"PRIx64
1477                     " lo 0x%"PRIx64, inv_desc.hi, inv_desc.lo);
1478         if (!vtd_process_wait_desc(s, &inv_desc)) {
1479             return false;
1480         }
1481         break;
1482 
1483     case VTD_INV_DESC_IEC:
1484         VTD_DPRINTF(INV, "Invalidation Interrupt Entry Cache "
1485                     "Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1486                     inv_desc.hi, inv_desc.lo);
1487         if (!vtd_process_inv_iec_desc(s, &inv_desc)) {
1488             return false;
1489         }
1490         break;
1491 
1492     default:
1493         VTD_DPRINTF(GENERAL, "error: unkonw Invalidation Descriptor type "
1494                     "hi 0x%"PRIx64 " lo 0x%"PRIx64 " type %"PRIu8,
1495                     inv_desc.hi, inv_desc.lo, desc_type);
1496         return false;
1497     }
1498     s->iq_head++;
1499     if (s->iq_head == s->iq_size) {
1500         s->iq_head = 0;
1501     }
1502     return true;
1503 }
1504 
1505 /* Try to fetch and process more Invalidation Descriptors */
1506 static void vtd_fetch_inv_desc(IntelIOMMUState *s)
1507 {
1508     VTD_DPRINTF(INV, "fetch Invalidation Descriptors");
1509     if (s->iq_tail >= s->iq_size) {
1510         /* Detects an invalid Tail pointer */
1511         VTD_DPRINTF(GENERAL, "error: iq_tail is %"PRIu16
1512                     " while iq_size is %"PRIu16, s->iq_tail, s->iq_size);
1513         vtd_handle_inv_queue_error(s);
1514         return;
1515     }
1516     while (s->iq_head != s->iq_tail) {
1517         if (!vtd_process_inv_desc(s)) {
1518             /* Invalidation Queue Errors */
1519             vtd_handle_inv_queue_error(s);
1520             break;
1521         }
1522         /* Must update the IQH_REG in time */
1523         vtd_set_quad_raw(s, DMAR_IQH_REG,
1524                          (((uint64_t)(s->iq_head)) << VTD_IQH_QH_SHIFT) &
1525                          VTD_IQH_QH_MASK);
1526     }
1527 }
1528 
1529 /* Handle write to Invalidation Queue Tail Register */
1530 static void vtd_handle_iqt_write(IntelIOMMUState *s)
1531 {
1532     uint64_t val = vtd_get_quad_raw(s, DMAR_IQT_REG);
1533 
1534     s->iq_tail = VTD_IQT_QT(val);
1535     VTD_DPRINTF(INV, "set iq tail %"PRIu16, s->iq_tail);
1536     if (s->qi_enabled && !(vtd_get_long_raw(s, DMAR_FSTS_REG) & VTD_FSTS_IQE)) {
1537         /* Process Invalidation Queue here */
1538         vtd_fetch_inv_desc(s);
1539     }
1540 }
1541 
1542 static void vtd_handle_fsts_write(IntelIOMMUState *s)
1543 {
1544     uint32_t fsts_reg = vtd_get_long_raw(s, DMAR_FSTS_REG);
1545     uint32_t fectl_reg = vtd_get_long_raw(s, DMAR_FECTL_REG);
1546     uint32_t status_fields = VTD_FSTS_PFO | VTD_FSTS_PPF | VTD_FSTS_IQE;
1547 
1548     if ((fectl_reg & VTD_FECTL_IP) && !(fsts_reg & status_fields)) {
1549         vtd_set_clear_mask_long(s, DMAR_FECTL_REG, VTD_FECTL_IP, 0);
1550         VTD_DPRINTF(FLOG, "all pending interrupt conditions serviced, clear "
1551                     "IP field of FECTL_REG");
1552     }
1553     /* FIXME: when IQE is Clear, should we try to fetch some Invalidation
1554      * Descriptors if there are any when Queued Invalidation is enabled?
1555      */
1556 }
1557 
1558 static void vtd_handle_fectl_write(IntelIOMMUState *s)
1559 {
1560     uint32_t fectl_reg;
1561     /* FIXME: when software clears the IM field, check the IP field. But do we
1562      * need to compare the old value and the new value to conclude that
1563      * software clears the IM field? Or just check if the IM field is zero?
1564      */
1565     fectl_reg = vtd_get_long_raw(s, DMAR_FECTL_REG);
1566     if ((fectl_reg & VTD_FECTL_IP) && !(fectl_reg & VTD_FECTL_IM)) {
1567         vtd_generate_interrupt(s, DMAR_FEADDR_REG, DMAR_FEDATA_REG);
1568         vtd_set_clear_mask_long(s, DMAR_FECTL_REG, VTD_FECTL_IP, 0);
1569         VTD_DPRINTF(FLOG, "IM field is cleared, generate "
1570                     "fault event interrupt");
1571     }
1572 }
1573 
1574 static void vtd_handle_ics_write(IntelIOMMUState *s)
1575 {
1576     uint32_t ics_reg = vtd_get_long_raw(s, DMAR_ICS_REG);
1577     uint32_t iectl_reg = vtd_get_long_raw(s, DMAR_IECTL_REG);
1578 
1579     if ((iectl_reg & VTD_IECTL_IP) && !(ics_reg & VTD_ICS_IWC)) {
1580         vtd_set_clear_mask_long(s, DMAR_IECTL_REG, VTD_IECTL_IP, 0);
1581         VTD_DPRINTF(INV, "pending completion interrupt condition serviced, "
1582                     "clear IP field of IECTL_REG");
1583     }
1584 }
1585 
1586 static void vtd_handle_iectl_write(IntelIOMMUState *s)
1587 {
1588     uint32_t iectl_reg;
1589     /* FIXME: when software clears the IM field, check the IP field. But do we
1590      * need to compare the old value and the new value to conclude that
1591      * software clears the IM field? Or just check if the IM field is zero?
1592      */
1593     iectl_reg = vtd_get_long_raw(s, DMAR_IECTL_REG);
1594     if ((iectl_reg & VTD_IECTL_IP) && !(iectl_reg & VTD_IECTL_IM)) {
1595         vtd_generate_interrupt(s, DMAR_IEADDR_REG, DMAR_IEDATA_REG);
1596         vtd_set_clear_mask_long(s, DMAR_IECTL_REG, VTD_IECTL_IP, 0);
1597         VTD_DPRINTF(INV, "IM field is cleared, generate "
1598                     "invalidation event interrupt");
1599     }
1600 }
1601 
1602 static uint64_t vtd_mem_read(void *opaque, hwaddr addr, unsigned size)
1603 {
1604     IntelIOMMUState *s = opaque;
1605     uint64_t val;
1606 
1607     if (addr + size > DMAR_REG_SIZE) {
1608         VTD_DPRINTF(GENERAL, "error: addr outside region: max 0x%"PRIx64
1609                     ", got 0x%"PRIx64 " %d",
1610                     (uint64_t)DMAR_REG_SIZE, addr, size);
1611         return (uint64_t)-1;
1612     }
1613 
1614     switch (addr) {
1615     /* Root Table Address Register, 64-bit */
1616     case DMAR_RTADDR_REG:
1617         if (size == 4) {
1618             val = s->root & ((1ULL << 32) - 1);
1619         } else {
1620             val = s->root;
1621         }
1622         break;
1623 
1624     case DMAR_RTADDR_REG_HI:
1625         assert(size == 4);
1626         val = s->root >> 32;
1627         break;
1628 
1629     /* Invalidation Queue Address Register, 64-bit */
1630     case DMAR_IQA_REG:
1631         val = s->iq | (vtd_get_quad(s, DMAR_IQA_REG) & VTD_IQA_QS);
1632         if (size == 4) {
1633             val = val & ((1ULL << 32) - 1);
1634         }
1635         break;
1636 
1637     case DMAR_IQA_REG_HI:
1638         assert(size == 4);
1639         val = s->iq >> 32;
1640         break;
1641 
1642     default:
1643         if (size == 4) {
1644             val = vtd_get_long(s, addr);
1645         } else {
1646             val = vtd_get_quad(s, addr);
1647         }
1648     }
1649     VTD_DPRINTF(CSR, "addr 0x%"PRIx64 " size %d val 0x%"PRIx64,
1650                 addr, size, val);
1651     return val;
1652 }
1653 
1654 static void vtd_mem_write(void *opaque, hwaddr addr,
1655                           uint64_t val, unsigned size)
1656 {
1657     IntelIOMMUState *s = opaque;
1658 
1659     if (addr + size > DMAR_REG_SIZE) {
1660         VTD_DPRINTF(GENERAL, "error: addr outside region: max 0x%"PRIx64
1661                     ", got 0x%"PRIx64 " %d",
1662                     (uint64_t)DMAR_REG_SIZE, addr, size);
1663         return;
1664     }
1665 
1666     switch (addr) {
1667     /* Global Command Register, 32-bit */
1668     case DMAR_GCMD_REG:
1669         VTD_DPRINTF(CSR, "DMAR_GCMD_REG write addr 0x%"PRIx64
1670                     ", size %d, val 0x%"PRIx64, addr, size, val);
1671         vtd_set_long(s, addr, val);
1672         vtd_handle_gcmd_write(s);
1673         break;
1674 
1675     /* Context Command Register, 64-bit */
1676     case DMAR_CCMD_REG:
1677         VTD_DPRINTF(CSR, "DMAR_CCMD_REG write addr 0x%"PRIx64
1678                     ", size %d, val 0x%"PRIx64, addr, size, val);
1679         if (size == 4) {
1680             vtd_set_long(s, addr, val);
1681         } else {
1682             vtd_set_quad(s, addr, val);
1683             vtd_handle_ccmd_write(s);
1684         }
1685         break;
1686 
1687     case DMAR_CCMD_REG_HI:
1688         VTD_DPRINTF(CSR, "DMAR_CCMD_REG_HI write addr 0x%"PRIx64
1689                     ", size %d, val 0x%"PRIx64, addr, size, val);
1690         assert(size == 4);
1691         vtd_set_long(s, addr, val);
1692         vtd_handle_ccmd_write(s);
1693         break;
1694 
1695     /* IOTLB Invalidation Register, 64-bit */
1696     case DMAR_IOTLB_REG:
1697         VTD_DPRINTF(INV, "DMAR_IOTLB_REG write addr 0x%"PRIx64
1698                     ", size %d, val 0x%"PRIx64, addr, size, val);
1699         if (size == 4) {
1700             vtd_set_long(s, addr, val);
1701         } else {
1702             vtd_set_quad(s, addr, val);
1703             vtd_handle_iotlb_write(s);
1704         }
1705         break;
1706 
1707     case DMAR_IOTLB_REG_HI:
1708         VTD_DPRINTF(INV, "DMAR_IOTLB_REG_HI write addr 0x%"PRIx64
1709                     ", size %d, val 0x%"PRIx64, addr, size, val);
1710         assert(size == 4);
1711         vtd_set_long(s, addr, val);
1712         vtd_handle_iotlb_write(s);
1713         break;
1714 
1715     /* Invalidate Address Register, 64-bit */
1716     case DMAR_IVA_REG:
1717         VTD_DPRINTF(INV, "DMAR_IVA_REG write addr 0x%"PRIx64
1718                     ", size %d, val 0x%"PRIx64, addr, size, val);
1719         if (size == 4) {
1720             vtd_set_long(s, addr, val);
1721         } else {
1722             vtd_set_quad(s, addr, val);
1723         }
1724         break;
1725 
1726     case DMAR_IVA_REG_HI:
1727         VTD_DPRINTF(INV, "DMAR_IVA_REG_HI write addr 0x%"PRIx64
1728                     ", size %d, val 0x%"PRIx64, addr, size, val);
1729         assert(size == 4);
1730         vtd_set_long(s, addr, val);
1731         break;
1732 
1733     /* Fault Status Register, 32-bit */
1734     case DMAR_FSTS_REG:
1735         VTD_DPRINTF(FLOG, "DMAR_FSTS_REG write addr 0x%"PRIx64
1736                     ", size %d, val 0x%"PRIx64, addr, size, val);
1737         assert(size == 4);
1738         vtd_set_long(s, addr, val);
1739         vtd_handle_fsts_write(s);
1740         break;
1741 
1742     /* Fault Event Control Register, 32-bit */
1743     case DMAR_FECTL_REG:
1744         VTD_DPRINTF(FLOG, "DMAR_FECTL_REG write addr 0x%"PRIx64
1745                     ", size %d, val 0x%"PRIx64, addr, size, val);
1746         assert(size == 4);
1747         vtd_set_long(s, addr, val);
1748         vtd_handle_fectl_write(s);
1749         break;
1750 
1751     /* Fault Event Data Register, 32-bit */
1752     case DMAR_FEDATA_REG:
1753         VTD_DPRINTF(FLOG, "DMAR_FEDATA_REG write addr 0x%"PRIx64
1754                     ", size %d, val 0x%"PRIx64, addr, size, val);
1755         assert(size == 4);
1756         vtd_set_long(s, addr, val);
1757         break;
1758 
1759     /* Fault Event Address Register, 32-bit */
1760     case DMAR_FEADDR_REG:
1761         VTD_DPRINTF(FLOG, "DMAR_FEADDR_REG write addr 0x%"PRIx64
1762                     ", size %d, val 0x%"PRIx64, addr, size, val);
1763         assert(size == 4);
1764         vtd_set_long(s, addr, val);
1765         break;
1766 
1767     /* Fault Event Upper Address Register, 32-bit */
1768     case DMAR_FEUADDR_REG:
1769         VTD_DPRINTF(FLOG, "DMAR_FEUADDR_REG write addr 0x%"PRIx64
1770                     ", size %d, val 0x%"PRIx64, addr, size, val);
1771         assert(size == 4);
1772         vtd_set_long(s, addr, val);
1773         break;
1774 
1775     /* Protected Memory Enable Register, 32-bit */
1776     case DMAR_PMEN_REG:
1777         VTD_DPRINTF(CSR, "DMAR_PMEN_REG write addr 0x%"PRIx64
1778                     ", size %d, val 0x%"PRIx64, addr, size, val);
1779         assert(size == 4);
1780         vtd_set_long(s, addr, val);
1781         break;
1782 
1783     /* Root Table Address Register, 64-bit */
1784     case DMAR_RTADDR_REG:
1785         VTD_DPRINTF(CSR, "DMAR_RTADDR_REG write addr 0x%"PRIx64
1786                     ", size %d, val 0x%"PRIx64, addr, size, val);
1787         if (size == 4) {
1788             vtd_set_long(s, addr, val);
1789         } else {
1790             vtd_set_quad(s, addr, val);
1791         }
1792         break;
1793 
1794     case DMAR_RTADDR_REG_HI:
1795         VTD_DPRINTF(CSR, "DMAR_RTADDR_REG_HI write addr 0x%"PRIx64
1796                     ", size %d, val 0x%"PRIx64, addr, size, val);
1797         assert(size == 4);
1798         vtd_set_long(s, addr, val);
1799         break;
1800 
1801     /* Invalidation Queue Tail Register, 64-bit */
1802     case DMAR_IQT_REG:
1803         VTD_DPRINTF(INV, "DMAR_IQT_REG write addr 0x%"PRIx64
1804                     ", size %d, val 0x%"PRIx64, addr, size, val);
1805         if (size == 4) {
1806             vtd_set_long(s, addr, val);
1807         } else {
1808             vtd_set_quad(s, addr, val);
1809         }
1810         vtd_handle_iqt_write(s);
1811         break;
1812 
1813     case DMAR_IQT_REG_HI:
1814         VTD_DPRINTF(INV, "DMAR_IQT_REG_HI write addr 0x%"PRIx64
1815                     ", size %d, val 0x%"PRIx64, addr, size, val);
1816         assert(size == 4);
1817         vtd_set_long(s, addr, val);
1818         /* 19:63 of IQT_REG is RsvdZ, do nothing here */
1819         break;
1820 
1821     /* Invalidation Queue Address Register, 64-bit */
1822     case DMAR_IQA_REG:
1823         VTD_DPRINTF(INV, "DMAR_IQA_REG write addr 0x%"PRIx64
1824                     ", size %d, val 0x%"PRIx64, addr, size, val);
1825         if (size == 4) {
1826             vtd_set_long(s, addr, val);
1827         } else {
1828             vtd_set_quad(s, addr, val);
1829         }
1830         break;
1831 
1832     case DMAR_IQA_REG_HI:
1833         VTD_DPRINTF(INV, "DMAR_IQA_REG_HI write addr 0x%"PRIx64
1834                     ", size %d, val 0x%"PRIx64, addr, size, val);
1835         assert(size == 4);
1836         vtd_set_long(s, addr, val);
1837         break;
1838 
1839     /* Invalidation Completion Status Register, 32-bit */
1840     case DMAR_ICS_REG:
1841         VTD_DPRINTF(INV, "DMAR_ICS_REG write addr 0x%"PRIx64
1842                     ", size %d, val 0x%"PRIx64, addr, size, val);
1843         assert(size == 4);
1844         vtd_set_long(s, addr, val);
1845         vtd_handle_ics_write(s);
1846         break;
1847 
1848     /* Invalidation Event Control Register, 32-bit */
1849     case DMAR_IECTL_REG:
1850         VTD_DPRINTF(INV, "DMAR_IECTL_REG write addr 0x%"PRIx64
1851                     ", size %d, val 0x%"PRIx64, addr, size, val);
1852         assert(size == 4);
1853         vtd_set_long(s, addr, val);
1854         vtd_handle_iectl_write(s);
1855         break;
1856 
1857     /* Invalidation Event Data Register, 32-bit */
1858     case DMAR_IEDATA_REG:
1859         VTD_DPRINTF(INV, "DMAR_IEDATA_REG write addr 0x%"PRIx64
1860                     ", size %d, val 0x%"PRIx64, addr, size, val);
1861         assert(size == 4);
1862         vtd_set_long(s, addr, val);
1863         break;
1864 
1865     /* Invalidation Event Address Register, 32-bit */
1866     case DMAR_IEADDR_REG:
1867         VTD_DPRINTF(INV, "DMAR_IEADDR_REG write addr 0x%"PRIx64
1868                     ", size %d, val 0x%"PRIx64, addr, size, val);
1869         assert(size == 4);
1870         vtd_set_long(s, addr, val);
1871         break;
1872 
1873     /* Invalidation Event Upper Address Register, 32-bit */
1874     case DMAR_IEUADDR_REG:
1875         VTD_DPRINTF(INV, "DMAR_IEUADDR_REG write addr 0x%"PRIx64
1876                     ", size %d, val 0x%"PRIx64, addr, size, val);
1877         assert(size == 4);
1878         vtd_set_long(s, addr, val);
1879         break;
1880 
1881     /* Fault Recording Registers, 128-bit */
1882     case DMAR_FRCD_REG_0_0:
1883         VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_0 write addr 0x%"PRIx64
1884                     ", size %d, val 0x%"PRIx64, addr, size, val);
1885         if (size == 4) {
1886             vtd_set_long(s, addr, val);
1887         } else {
1888             vtd_set_quad(s, addr, val);
1889         }
1890         break;
1891 
1892     case DMAR_FRCD_REG_0_1:
1893         VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_1 write addr 0x%"PRIx64
1894                     ", size %d, val 0x%"PRIx64, addr, size, val);
1895         assert(size == 4);
1896         vtd_set_long(s, addr, val);
1897         break;
1898 
1899     case DMAR_FRCD_REG_0_2:
1900         VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_2 write addr 0x%"PRIx64
1901                     ", size %d, val 0x%"PRIx64, addr, size, val);
1902         if (size == 4) {
1903             vtd_set_long(s, addr, val);
1904         } else {
1905             vtd_set_quad(s, addr, val);
1906             /* May clear bit 127 (Fault), update PPF */
1907             vtd_update_fsts_ppf(s);
1908         }
1909         break;
1910 
1911     case DMAR_FRCD_REG_0_3:
1912         VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_3 write addr 0x%"PRIx64
1913                     ", size %d, val 0x%"PRIx64, addr, size, val);
1914         assert(size == 4);
1915         vtd_set_long(s, addr, val);
1916         /* May clear bit 127 (Fault), update PPF */
1917         vtd_update_fsts_ppf(s);
1918         break;
1919 
1920     case DMAR_IRTA_REG:
1921         VTD_DPRINTF(IR, "DMAR_IRTA_REG write addr 0x%"PRIx64
1922                     ", size %d, val 0x%"PRIx64, addr, size, val);
1923         if (size == 4) {
1924             vtd_set_long(s, addr, val);
1925         } else {
1926             vtd_set_quad(s, addr, val);
1927         }
1928         break;
1929 
1930     case DMAR_IRTA_REG_HI:
1931         VTD_DPRINTF(IR, "DMAR_IRTA_REG_HI write addr 0x%"PRIx64
1932                     ", size %d, val 0x%"PRIx64, addr, size, val);
1933         assert(size == 4);
1934         vtd_set_long(s, addr, val);
1935         break;
1936 
1937     default:
1938         VTD_DPRINTF(GENERAL, "error: unhandled reg write addr 0x%"PRIx64
1939                     ", size %d, val 0x%"PRIx64, addr, size, val);
1940         if (size == 4) {
1941             vtd_set_long(s, addr, val);
1942         } else {
1943             vtd_set_quad(s, addr, val);
1944         }
1945     }
1946 }
1947 
1948 static IOMMUTLBEntry vtd_iommu_translate(MemoryRegion *iommu, hwaddr addr,
1949                                          bool is_write)
1950 {
1951     VTDAddressSpace *vtd_as = container_of(iommu, VTDAddressSpace, iommu);
1952     IntelIOMMUState *s = vtd_as->iommu_state;
1953     IOMMUTLBEntry ret = {
1954         .target_as = &address_space_memory,
1955         .iova = addr,
1956         .translated_addr = 0,
1957         .addr_mask = ~(hwaddr)0,
1958         .perm = IOMMU_NONE,
1959     };
1960 
1961     if (!s->dmar_enabled) {
1962         /* DMAR disabled, passthrough, use 4k-page*/
1963         ret.iova = addr & VTD_PAGE_MASK_4K;
1964         ret.translated_addr = addr & VTD_PAGE_MASK_4K;
1965         ret.addr_mask = ~VTD_PAGE_MASK_4K;
1966         ret.perm = IOMMU_RW;
1967         return ret;
1968     }
1969 
1970     vtd_do_iommu_translate(vtd_as, vtd_as->bus, vtd_as->devfn, addr,
1971                            is_write, &ret);
1972     VTD_DPRINTF(MMU,
1973                 "bus %"PRIu8 " slot %"PRIu8 " func %"PRIu8 " devfn %"PRIu8
1974                 " gpa 0x%"PRIx64 " hpa 0x%"PRIx64, pci_bus_num(vtd_as->bus),
1975                 VTD_PCI_SLOT(vtd_as->devfn), VTD_PCI_FUNC(vtd_as->devfn),
1976                 vtd_as->devfn, addr, ret.translated_addr);
1977     return ret;
1978 }
1979 
1980 static void vtd_iommu_notify_flag_changed(MemoryRegion *iommu,
1981                                           IOMMUNotifierFlag old,
1982                                           IOMMUNotifierFlag new)
1983 {
1984     VTDAddressSpace *vtd_as = container_of(iommu, VTDAddressSpace, iommu);
1985 
1986     if (new & IOMMU_NOTIFIER_MAP) {
1987         error_report("Device at bus %s addr %02x.%d requires iommu "
1988                      "notifier which is currently not supported by "
1989                      "intel-iommu emulation",
1990                      vtd_as->bus->qbus.name, PCI_SLOT(vtd_as->devfn),
1991                      PCI_FUNC(vtd_as->devfn));
1992         exit(1);
1993     }
1994 }
1995 
1996 static const VMStateDescription vtd_vmstate = {
1997     .name = "iommu-intel",
1998     .unmigratable = 1,
1999 };
2000 
2001 static const MemoryRegionOps vtd_mem_ops = {
2002     .read = vtd_mem_read,
2003     .write = vtd_mem_write,
2004     .endianness = DEVICE_LITTLE_ENDIAN,
2005     .impl = {
2006         .min_access_size = 4,
2007         .max_access_size = 8,
2008     },
2009     .valid = {
2010         .min_access_size = 4,
2011         .max_access_size = 8,
2012     },
2013 };
2014 
2015 static Property vtd_properties[] = {
2016     DEFINE_PROP_UINT32("version", IntelIOMMUState, version, 0),
2017     DEFINE_PROP_ON_OFF_AUTO("eim", IntelIOMMUState, intr_eim,
2018                             ON_OFF_AUTO_AUTO),
2019     DEFINE_PROP_BOOL("x-buggy-eim", IntelIOMMUState, buggy_eim, false),
2020     DEFINE_PROP_END_OF_LIST(),
2021 };
2022 
2023 /* Read IRTE entry with specific index */
2024 static int vtd_irte_get(IntelIOMMUState *iommu, uint16_t index,
2025                         VTD_IR_TableEntry *entry, uint16_t sid)
2026 {
2027     static const uint16_t vtd_svt_mask[VTD_SQ_MAX] = \
2028         {0xffff, 0xfffb, 0xfff9, 0xfff8};
2029     dma_addr_t addr = 0x00;
2030     uint16_t mask, source_id;
2031     uint8_t bus, bus_max, bus_min;
2032 
2033     addr = iommu->intr_root + index * sizeof(*entry);
2034     if (dma_memory_read(&address_space_memory, addr, entry,
2035                         sizeof(*entry))) {
2036         VTD_DPRINTF(GENERAL, "error: fail to access IR root at 0x%"PRIx64
2037                     " + %"PRIu16, iommu->intr_root, index);
2038         return -VTD_FR_IR_ROOT_INVAL;
2039     }
2040 
2041     if (!entry->irte.present) {
2042         VTD_DPRINTF(GENERAL, "error: present flag not set in IRTE"
2043                     " entry index %u value 0x%"PRIx64 " 0x%"PRIx64,
2044                     index, le64_to_cpu(entry->data[1]),
2045                     le64_to_cpu(entry->data[0]));
2046         return -VTD_FR_IR_ENTRY_P;
2047     }
2048 
2049     if (entry->irte.__reserved_0 || entry->irte.__reserved_1 ||
2050         entry->irte.__reserved_2) {
2051         VTD_DPRINTF(GENERAL, "error: IRTE entry index %"PRIu16
2052                     " reserved fields non-zero: 0x%"PRIx64 " 0x%"PRIx64,
2053                     index, le64_to_cpu(entry->data[1]),
2054                     le64_to_cpu(entry->data[0]));
2055         return -VTD_FR_IR_IRTE_RSVD;
2056     }
2057 
2058     if (sid != X86_IOMMU_SID_INVALID) {
2059         /* Validate IRTE SID */
2060         source_id = le32_to_cpu(entry->irte.source_id);
2061         switch (entry->irte.sid_vtype) {
2062         case VTD_SVT_NONE:
2063             VTD_DPRINTF(IR, "No SID validation for IRTE index %d", index);
2064             break;
2065 
2066         case VTD_SVT_ALL:
2067             mask = vtd_svt_mask[entry->irte.sid_q];
2068             if ((source_id & mask) != (sid & mask)) {
2069                 VTD_DPRINTF(GENERAL, "SID validation for IRTE index "
2070                             "%d failed (reqid 0x%04x sid 0x%04x)", index,
2071                             sid, source_id);
2072                 return -VTD_FR_IR_SID_ERR;
2073             }
2074             break;
2075 
2076         case VTD_SVT_BUS:
2077             bus_max = source_id >> 8;
2078             bus_min = source_id & 0xff;
2079             bus = sid >> 8;
2080             if (bus > bus_max || bus < bus_min) {
2081                 VTD_DPRINTF(GENERAL, "SID validation for IRTE index %d "
2082                             "failed (bus %d outside %d-%d)", index, bus,
2083                             bus_min, bus_max);
2084                 return -VTD_FR_IR_SID_ERR;
2085             }
2086             break;
2087 
2088         default:
2089             VTD_DPRINTF(GENERAL, "Invalid SVT bits (0x%x) in IRTE index "
2090                         "%d", entry->irte.sid_vtype, index);
2091             /* Take this as verification failure. */
2092             return -VTD_FR_IR_SID_ERR;
2093             break;
2094         }
2095     }
2096 
2097     return 0;
2098 }
2099 
2100 /* Fetch IRQ information of specific IR index */
2101 static int vtd_remap_irq_get(IntelIOMMUState *iommu, uint16_t index,
2102                              VTDIrq *irq, uint16_t sid)
2103 {
2104     VTD_IR_TableEntry irte = {};
2105     int ret = 0;
2106 
2107     ret = vtd_irte_get(iommu, index, &irte, sid);
2108     if (ret) {
2109         return ret;
2110     }
2111 
2112     irq->trigger_mode = irte.irte.trigger_mode;
2113     irq->vector = irte.irte.vector;
2114     irq->delivery_mode = irte.irte.delivery_mode;
2115     irq->dest = le32_to_cpu(irte.irte.dest_id);
2116     if (!iommu->intr_eime) {
2117 #define  VTD_IR_APIC_DEST_MASK         (0xff00ULL)
2118 #define  VTD_IR_APIC_DEST_SHIFT        (8)
2119         irq->dest = (irq->dest & VTD_IR_APIC_DEST_MASK) >>
2120             VTD_IR_APIC_DEST_SHIFT;
2121     }
2122     irq->dest_mode = irte.irte.dest_mode;
2123     irq->redir_hint = irte.irte.redir_hint;
2124 
2125     VTD_DPRINTF(IR, "remapping interrupt index %d: trig:%u,vec:%u,"
2126                 "deliver:%u,dest:%u,dest_mode:%u", index,
2127                 irq->trigger_mode, irq->vector, irq->delivery_mode,
2128                 irq->dest, irq->dest_mode);
2129 
2130     return 0;
2131 }
2132 
2133 /* Generate one MSI message from VTDIrq info */
2134 static void vtd_generate_msi_message(VTDIrq *irq, MSIMessage *msg_out)
2135 {
2136     VTD_MSIMessage msg = {};
2137 
2138     /* Generate address bits */
2139     msg.dest_mode = irq->dest_mode;
2140     msg.redir_hint = irq->redir_hint;
2141     msg.dest = irq->dest;
2142     msg.__addr_hi = irq->dest & 0xffffff00;
2143     msg.__addr_head = cpu_to_le32(0xfee);
2144     /* Keep this from original MSI address bits */
2145     msg.__not_used = irq->msi_addr_last_bits;
2146 
2147     /* Generate data bits */
2148     msg.vector = irq->vector;
2149     msg.delivery_mode = irq->delivery_mode;
2150     msg.level = 1;
2151     msg.trigger_mode = irq->trigger_mode;
2152 
2153     msg_out->address = msg.msi_addr;
2154     msg_out->data = msg.msi_data;
2155 }
2156 
2157 /* Interrupt remapping for MSI/MSI-X entry */
2158 static int vtd_interrupt_remap_msi(IntelIOMMUState *iommu,
2159                                    MSIMessage *origin,
2160                                    MSIMessage *translated,
2161                                    uint16_t sid)
2162 {
2163     int ret = 0;
2164     VTD_IR_MSIAddress addr;
2165     uint16_t index;
2166     VTDIrq irq = {};
2167 
2168     assert(origin && translated);
2169 
2170     if (!iommu || !iommu->intr_enabled) {
2171         goto do_not_translate;
2172     }
2173 
2174     if (origin->address & VTD_MSI_ADDR_HI_MASK) {
2175         VTD_DPRINTF(GENERAL, "error: MSI addr high 32 bits nonzero"
2176                     " during interrupt remapping: 0x%"PRIx32,
2177                     (uint32_t)((origin->address & VTD_MSI_ADDR_HI_MASK) >> \
2178                     VTD_MSI_ADDR_HI_SHIFT));
2179         return -VTD_FR_IR_REQ_RSVD;
2180     }
2181 
2182     addr.data = origin->address & VTD_MSI_ADDR_LO_MASK;
2183     if (addr.addr.__head != 0xfee) {
2184         VTD_DPRINTF(GENERAL, "error: MSI addr low 32 bits invalid: "
2185                     "0x%"PRIx32, addr.data);
2186         return -VTD_FR_IR_REQ_RSVD;
2187     }
2188 
2189     /* This is compatible mode. */
2190     if (addr.addr.int_mode != VTD_IR_INT_FORMAT_REMAP) {
2191         goto do_not_translate;
2192     }
2193 
2194     index = addr.addr.index_h << 15 | le16_to_cpu(addr.addr.index_l);
2195 
2196 #define  VTD_IR_MSI_DATA_SUBHANDLE       (0x0000ffff)
2197 #define  VTD_IR_MSI_DATA_RESERVED        (0xffff0000)
2198 
2199     if (addr.addr.sub_valid) {
2200         /* See VT-d spec 5.1.2.2 and 5.1.3 on subhandle */
2201         index += origin->data & VTD_IR_MSI_DATA_SUBHANDLE;
2202     }
2203 
2204     ret = vtd_remap_irq_get(iommu, index, &irq, sid);
2205     if (ret) {
2206         return ret;
2207     }
2208 
2209     if (addr.addr.sub_valid) {
2210         VTD_DPRINTF(IR, "received MSI interrupt");
2211         if (origin->data & VTD_IR_MSI_DATA_RESERVED) {
2212             VTD_DPRINTF(GENERAL, "error: MSI data bits non-zero for "
2213                         "interrupt remappable entry: 0x%"PRIx32,
2214                         origin->data);
2215             return -VTD_FR_IR_REQ_RSVD;
2216         }
2217     } else {
2218         uint8_t vector = origin->data & 0xff;
2219         uint8_t trigger_mode = (origin->data >> MSI_DATA_TRIGGER_SHIFT) & 0x1;
2220 
2221         VTD_DPRINTF(IR, "received IOAPIC interrupt");
2222         /* IOAPIC entry vector should be aligned with IRTE vector
2223          * (see vt-d spec 5.1.5.1). */
2224         if (vector != irq.vector) {
2225             VTD_DPRINTF(GENERAL, "IOAPIC vector inconsistent: "
2226                         "entry: %d, IRTE: %d, index: %d",
2227                         vector, irq.vector, index);
2228         }
2229 
2230         /* The Trigger Mode field must match the Trigger Mode in the IRTE.
2231          * (see vt-d spec 5.1.5.1). */
2232         if (trigger_mode != irq.trigger_mode) {
2233             VTD_DPRINTF(GENERAL, "IOAPIC trigger mode inconsistent: "
2234                         "entry: %u, IRTE: %u, index: %d",
2235                         trigger_mode, irq.trigger_mode, index);
2236         }
2237 
2238     }
2239 
2240     /*
2241      * We'd better keep the last two bits, assuming that guest OS
2242      * might modify it. Keep it does not hurt after all.
2243      */
2244     irq.msi_addr_last_bits = addr.addr.__not_care;
2245 
2246     /* Translate VTDIrq to MSI message */
2247     vtd_generate_msi_message(&irq, translated);
2248 
2249     VTD_DPRINTF(IR, "mapping MSI 0x%"PRIx64":0x%"PRIx32 " -> "
2250                 "0x%"PRIx64":0x%"PRIx32, origin->address, origin->data,
2251                 translated->address, translated->data);
2252     return 0;
2253 
2254 do_not_translate:
2255     memcpy(translated, origin, sizeof(*origin));
2256     return 0;
2257 }
2258 
2259 static int vtd_int_remap(X86IOMMUState *iommu, MSIMessage *src,
2260                          MSIMessage *dst, uint16_t sid)
2261 {
2262     return vtd_interrupt_remap_msi(INTEL_IOMMU_DEVICE(iommu),
2263                                    src, dst, sid);
2264 }
2265 
2266 static MemTxResult vtd_mem_ir_read(void *opaque, hwaddr addr,
2267                                    uint64_t *data, unsigned size,
2268                                    MemTxAttrs attrs)
2269 {
2270     return MEMTX_OK;
2271 }
2272 
2273 static MemTxResult vtd_mem_ir_write(void *opaque, hwaddr addr,
2274                                     uint64_t value, unsigned size,
2275                                     MemTxAttrs attrs)
2276 {
2277     int ret = 0;
2278     MSIMessage from = {}, to = {};
2279     uint16_t sid = X86_IOMMU_SID_INVALID;
2280 
2281     from.address = (uint64_t) addr + VTD_INTERRUPT_ADDR_FIRST;
2282     from.data = (uint32_t) value;
2283 
2284     if (!attrs.unspecified) {
2285         /* We have explicit Source ID */
2286         sid = attrs.requester_id;
2287     }
2288 
2289     ret = vtd_interrupt_remap_msi(opaque, &from, &to, sid);
2290     if (ret) {
2291         /* TODO: report error */
2292         VTD_DPRINTF(GENERAL, "int remap fail for addr 0x%"PRIx64
2293                     " data 0x%"PRIx32, from.address, from.data);
2294         /* Drop this interrupt */
2295         return MEMTX_ERROR;
2296     }
2297 
2298     VTD_DPRINTF(IR, "delivering MSI 0x%"PRIx64":0x%"PRIx32
2299                 " for device sid 0x%04x",
2300                 to.address, to.data, sid);
2301 
2302     apic_get_class()->send_msi(&to);
2303 
2304     return MEMTX_OK;
2305 }
2306 
2307 static const MemoryRegionOps vtd_mem_ir_ops = {
2308     .read_with_attrs = vtd_mem_ir_read,
2309     .write_with_attrs = vtd_mem_ir_write,
2310     .endianness = DEVICE_LITTLE_ENDIAN,
2311     .impl = {
2312         .min_access_size = 4,
2313         .max_access_size = 4,
2314     },
2315     .valid = {
2316         .min_access_size = 4,
2317         .max_access_size = 4,
2318     },
2319 };
2320 
2321 VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus, int devfn)
2322 {
2323     uintptr_t key = (uintptr_t)bus;
2324     VTDBus *vtd_bus = g_hash_table_lookup(s->vtd_as_by_busptr, &key);
2325     VTDAddressSpace *vtd_dev_as;
2326 
2327     if (!vtd_bus) {
2328         /* No corresponding free() */
2329         vtd_bus = g_malloc0(sizeof(VTDBus) + sizeof(VTDAddressSpace *) * \
2330                             X86_IOMMU_PCI_DEVFN_MAX);
2331         vtd_bus->bus = bus;
2332         key = (uintptr_t)bus;
2333         g_hash_table_insert(s->vtd_as_by_busptr, &key, vtd_bus);
2334     }
2335 
2336     vtd_dev_as = vtd_bus->dev_as[devfn];
2337 
2338     if (!vtd_dev_as) {
2339         vtd_bus->dev_as[devfn] = vtd_dev_as = g_malloc0(sizeof(VTDAddressSpace));
2340 
2341         vtd_dev_as->bus = bus;
2342         vtd_dev_as->devfn = (uint8_t)devfn;
2343         vtd_dev_as->iommu_state = s;
2344         vtd_dev_as->context_cache_entry.context_cache_gen = 0;
2345         memory_region_init_iommu(&vtd_dev_as->iommu, OBJECT(s),
2346                                  &s->iommu_ops, "intel_iommu", UINT64_MAX);
2347         memory_region_init_io(&vtd_dev_as->iommu_ir, OBJECT(s),
2348                               &vtd_mem_ir_ops, s, "intel_iommu_ir",
2349                               VTD_INTERRUPT_ADDR_SIZE);
2350         memory_region_add_subregion(&vtd_dev_as->iommu, VTD_INTERRUPT_ADDR_FIRST,
2351                                     &vtd_dev_as->iommu_ir);
2352         address_space_init(&vtd_dev_as->as,
2353                            &vtd_dev_as->iommu, "intel_iommu");
2354     }
2355     return vtd_dev_as;
2356 }
2357 
2358 /* Do the initialization. It will also be called when reset, so pay
2359  * attention when adding new initialization stuff.
2360  */
2361 static void vtd_init(IntelIOMMUState *s)
2362 {
2363     X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
2364 
2365     memset(s->csr, 0, DMAR_REG_SIZE);
2366     memset(s->wmask, 0, DMAR_REG_SIZE);
2367     memset(s->w1cmask, 0, DMAR_REG_SIZE);
2368     memset(s->womask, 0, DMAR_REG_SIZE);
2369 
2370     s->iommu_ops.translate = vtd_iommu_translate;
2371     s->iommu_ops.notify_flag_changed = vtd_iommu_notify_flag_changed;
2372     s->root = 0;
2373     s->root_extended = false;
2374     s->dmar_enabled = false;
2375     s->iq_head = 0;
2376     s->iq_tail = 0;
2377     s->iq = 0;
2378     s->iq_size = 0;
2379     s->qi_enabled = false;
2380     s->iq_last_desc_type = VTD_INV_DESC_NONE;
2381     s->next_frcd_reg = 0;
2382     s->cap = VTD_CAP_FRO | VTD_CAP_NFR | VTD_CAP_ND | VTD_CAP_MGAW |
2383              VTD_CAP_SAGAW | VTD_CAP_MAMV | VTD_CAP_PSI | VTD_CAP_SLLPS;
2384     s->ecap = VTD_ECAP_QI | VTD_ECAP_IRO;
2385 
2386     if (x86_iommu->intr_supported) {
2387         s->ecap |= VTD_ECAP_IR | VTD_ECAP_MHMV;
2388         if (s->intr_eim == ON_OFF_AUTO_ON) {
2389             s->ecap |= VTD_ECAP_EIM;
2390         }
2391         assert(s->intr_eim != ON_OFF_AUTO_AUTO);
2392     }
2393 
2394     vtd_reset_context_cache(s);
2395     vtd_reset_iotlb(s);
2396 
2397     /* Define registers with default values and bit semantics */
2398     vtd_define_long(s, DMAR_VER_REG, 0x10UL, 0, 0);
2399     vtd_define_quad(s, DMAR_CAP_REG, s->cap, 0, 0);
2400     vtd_define_quad(s, DMAR_ECAP_REG, s->ecap, 0, 0);
2401     vtd_define_long(s, DMAR_GCMD_REG, 0, 0xff800000UL, 0);
2402     vtd_define_long_wo(s, DMAR_GCMD_REG, 0xff800000UL);
2403     vtd_define_long(s, DMAR_GSTS_REG, 0, 0, 0);
2404     vtd_define_quad(s, DMAR_RTADDR_REG, 0, 0xfffffffffffff000ULL, 0);
2405     vtd_define_quad(s, DMAR_CCMD_REG, 0, 0xe0000003ffffffffULL, 0);
2406     vtd_define_quad_wo(s, DMAR_CCMD_REG, 0x3ffff0000ULL);
2407 
2408     /* Advanced Fault Logging not supported */
2409     vtd_define_long(s, DMAR_FSTS_REG, 0, 0, 0x11UL);
2410     vtd_define_long(s, DMAR_FECTL_REG, 0x80000000UL, 0x80000000UL, 0);
2411     vtd_define_long(s, DMAR_FEDATA_REG, 0, 0x0000ffffUL, 0);
2412     vtd_define_long(s, DMAR_FEADDR_REG, 0, 0xfffffffcUL, 0);
2413 
2414     /* Treated as RsvdZ when EIM in ECAP_REG is not supported
2415      * vtd_define_long(s, DMAR_FEUADDR_REG, 0, 0xffffffffUL, 0);
2416      */
2417     vtd_define_long(s, DMAR_FEUADDR_REG, 0, 0, 0);
2418 
2419     /* Treated as RO for implementations that PLMR and PHMR fields reported
2420      * as Clear in the CAP_REG.
2421      * vtd_define_long(s, DMAR_PMEN_REG, 0, 0x80000000UL, 0);
2422      */
2423     vtd_define_long(s, DMAR_PMEN_REG, 0, 0, 0);
2424 
2425     vtd_define_quad(s, DMAR_IQH_REG, 0, 0, 0);
2426     vtd_define_quad(s, DMAR_IQT_REG, 0, 0x7fff0ULL, 0);
2427     vtd_define_quad(s, DMAR_IQA_REG, 0, 0xfffffffffffff007ULL, 0);
2428     vtd_define_long(s, DMAR_ICS_REG, 0, 0, 0x1UL);
2429     vtd_define_long(s, DMAR_IECTL_REG, 0x80000000UL, 0x80000000UL, 0);
2430     vtd_define_long(s, DMAR_IEDATA_REG, 0, 0xffffffffUL, 0);
2431     vtd_define_long(s, DMAR_IEADDR_REG, 0, 0xfffffffcUL, 0);
2432     /* Treadted as RsvdZ when EIM in ECAP_REG is not supported */
2433     vtd_define_long(s, DMAR_IEUADDR_REG, 0, 0, 0);
2434 
2435     /* IOTLB registers */
2436     vtd_define_quad(s, DMAR_IOTLB_REG, 0, 0Xb003ffff00000000ULL, 0);
2437     vtd_define_quad(s, DMAR_IVA_REG, 0, 0xfffffffffffff07fULL, 0);
2438     vtd_define_quad_wo(s, DMAR_IVA_REG, 0xfffffffffffff07fULL);
2439 
2440     /* Fault Recording Registers, 128-bit */
2441     vtd_define_quad(s, DMAR_FRCD_REG_0_0, 0, 0, 0);
2442     vtd_define_quad(s, DMAR_FRCD_REG_0_2, 0, 0, 0x8000000000000000ULL);
2443 
2444     /*
2445      * Interrupt remapping registers.
2446      */
2447     vtd_define_quad(s, DMAR_IRTA_REG, 0, 0xfffffffffffff80fULL, 0);
2448 }
2449 
2450 /* Should not reset address_spaces when reset because devices will still use
2451  * the address space they got at first (won't ask the bus again).
2452  */
2453 static void vtd_reset(DeviceState *dev)
2454 {
2455     IntelIOMMUState *s = INTEL_IOMMU_DEVICE(dev);
2456 
2457     VTD_DPRINTF(GENERAL, "");
2458     vtd_init(s);
2459 }
2460 
2461 static AddressSpace *vtd_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
2462 {
2463     IntelIOMMUState *s = opaque;
2464     VTDAddressSpace *vtd_as;
2465 
2466     assert(0 <= devfn && devfn < X86_IOMMU_PCI_DEVFN_MAX);
2467 
2468     vtd_as = vtd_find_add_as(s, bus, devfn);
2469     return &vtd_as->as;
2470 }
2471 
2472 static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)
2473 {
2474     X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
2475 
2476     /* Currently Intel IOMMU IR only support "kernel-irqchip={off|split}" */
2477     if (x86_iommu->intr_supported && kvm_irqchip_in_kernel() &&
2478         !kvm_irqchip_is_split()) {
2479         error_setg(errp, "Intel Interrupt Remapping cannot work with "
2480                          "kernel-irqchip=on, please use 'split|off'.");
2481         return false;
2482     }
2483     if (s->intr_eim == ON_OFF_AUTO_ON && !x86_iommu->intr_supported) {
2484         error_setg(errp, "eim=on cannot be selected without intremap=on");
2485         return false;
2486     }
2487 
2488     if (s->intr_eim == ON_OFF_AUTO_AUTO) {
2489         s->intr_eim = (kvm_irqchip_in_kernel() || s->buggy_eim)
2490                       && x86_iommu->intr_supported ?
2491                                               ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
2492     }
2493     if (s->intr_eim == ON_OFF_AUTO_ON && !s->buggy_eim) {
2494         if (!kvm_irqchip_in_kernel()) {
2495             error_setg(errp, "eim=on requires accel=kvm,kernel-irqchip=split");
2496             return false;
2497         }
2498         if (!kvm_enable_x2apic()) {
2499             error_setg(errp, "eim=on requires support on the KVM side"
2500                              "(X2APIC_API, first shipped in v4.7)");
2501             return false;
2502         }
2503     }
2504 
2505     return true;
2506 }
2507 
2508 static void vtd_realize(DeviceState *dev, Error **errp)
2509 {
2510     PCMachineState *pcms = PC_MACHINE(qdev_get_machine());
2511     PCIBus *bus = pcms->bus;
2512     IntelIOMMUState *s = INTEL_IOMMU_DEVICE(dev);
2513     X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(dev);
2514 
2515     VTD_DPRINTF(GENERAL, "");
2516     x86_iommu->type = TYPE_INTEL;
2517 
2518     if (!vtd_decide_config(s, errp)) {
2519         return;
2520     }
2521 
2522     memset(s->vtd_as_by_bus_num, 0, sizeof(s->vtd_as_by_bus_num));
2523     memory_region_init_io(&s->csrmem, OBJECT(s), &vtd_mem_ops, s,
2524                           "intel_iommu", DMAR_REG_SIZE);
2525     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->csrmem);
2526     /* No corresponding destroy */
2527     s->iotlb = g_hash_table_new_full(vtd_uint64_hash, vtd_uint64_equal,
2528                                      g_free, g_free);
2529     s->vtd_as_by_busptr = g_hash_table_new_full(vtd_uint64_hash, vtd_uint64_equal,
2530                                               g_free, g_free);
2531     vtd_init(s);
2532     sysbus_mmio_map(SYS_BUS_DEVICE(s), 0, Q35_HOST_BRIDGE_IOMMU_ADDR);
2533     pci_setup_iommu(bus, vtd_host_dma_iommu, dev);
2534     /* Pseudo address space under root PCI bus. */
2535     pcms->ioapic_as = vtd_host_dma_iommu(bus, s, Q35_PSEUDO_DEVFN_IOAPIC);
2536 }
2537 
2538 static void vtd_class_init(ObjectClass *klass, void *data)
2539 {
2540     DeviceClass *dc = DEVICE_CLASS(klass);
2541     X86IOMMUClass *x86_class = X86_IOMMU_CLASS(klass);
2542 
2543     dc->reset = vtd_reset;
2544     dc->vmsd = &vtd_vmstate;
2545     dc->props = vtd_properties;
2546     dc->hotpluggable = false;
2547     x86_class->realize = vtd_realize;
2548     x86_class->int_remap = vtd_int_remap;
2549 }
2550 
2551 static const TypeInfo vtd_info = {
2552     .name          = TYPE_INTEL_IOMMU_DEVICE,
2553     .parent        = TYPE_X86_IOMMU_DEVICE,
2554     .instance_size = sizeof(IntelIOMMUState),
2555     .class_init    = vtd_class_init,
2556 };
2557 
2558 static void vtd_register_types(void)
2559 {
2560     VTD_DPRINTF(GENERAL, "");
2561     type_register_static(&vtd_info);
2562 }
2563 
2564 type_init(vtd_register_types)
2565