1 /* 2 * ITS emulation for a GICv3-based system 3 * 4 * Copyright Linaro.org 2021 5 * 6 * Authors: 7 * Shashi Mallela <shashi.mallela@linaro.org> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or (at your 10 * option) any later version. See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 #include "qemu/log.h" 16 #include "trace.h" 17 #include "hw/qdev-properties.h" 18 #include "hw/intc/arm_gicv3_its_common.h" 19 #include "gicv3_internal.h" 20 #include "qom/object.h" 21 #include "qapi/error.h" 22 23 typedef struct GICv3ITSClass GICv3ITSClass; 24 /* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */ 25 DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass, 26 ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS) 27 28 struct GICv3ITSClass { 29 GICv3ITSCommonClass parent_class; 30 void (*parent_reset)(DeviceState *dev); 31 }; 32 33 /* 34 * This is an internal enum used to distinguish between LPI triggered 35 * via command queue and LPI triggered via gits_translater write. 36 */ 37 typedef enum ItsCmdType { 38 NONE = 0, /* internal indication for GITS_TRANSLATER write */ 39 CLEAR = 1, 40 DISCARD = 2, 41 INTERRUPT = 3, 42 } ItsCmdType; 43 44 typedef struct { 45 uint32_t iteh; 46 uint64_t itel; 47 } IteEntry; 48 49 /* 50 * The ITS spec permits a range of CONSTRAINED UNPREDICTABLE options 51 * if a command parameter is not correct. These include both "stall 52 * processing of the command queue" and "ignore this command, and 53 * keep processing the queue". In our implementation we choose that 54 * memory transaction errors reading the command packet provoke a 55 * stall, but errors in parameters cause us to ignore the command 56 * and continue processing. 57 * The process_* functions which handle individual ITS commands all 58 * return an ItsCmdResult which tells process_cmdq() whether it should 59 * stall or keep going. 60 */ 61 typedef enum ItsCmdResult { 62 CMD_STALL = 0, 63 CMD_CONTINUE = 1, 64 } ItsCmdResult; 65 66 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz) 67 { 68 uint64_t result = 0; 69 70 switch (page_sz) { 71 case GITS_PAGE_SIZE_4K: 72 case GITS_PAGE_SIZE_16K: 73 result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12; 74 break; 75 76 case GITS_PAGE_SIZE_64K: 77 result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16; 78 result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48; 79 break; 80 81 default: 82 break; 83 } 84 return result; 85 } 86 87 static uint64_t table_entry_addr(GICv3ITSState *s, TableDesc *td, 88 uint32_t idx, MemTxResult *res) 89 { 90 /* 91 * Given a TableDesc describing one of the ITS in-guest-memory 92 * tables and an index into it, return the guest address 93 * corresponding to that table entry. 94 * If there was a memory error reading the L1 table of an 95 * indirect table, *res is set accordingly, and we return -1. 96 * If the L1 table entry is marked not valid, we return -1 with 97 * *res set to MEMTX_OK. 98 * 99 * The specification defines the format of level 1 entries of a 100 * 2-level table, but the format of level 2 entries and the format 101 * of flat-mapped tables is IMPDEF. 102 */ 103 AddressSpace *as = &s->gicv3->dma_as; 104 uint32_t l2idx; 105 uint64_t l2; 106 uint32_t num_l2_entries; 107 108 *res = MEMTX_OK; 109 110 if (!td->indirect) { 111 /* Single level table */ 112 return td->base_addr + idx * td->entry_sz; 113 } 114 115 /* Two level table */ 116 l2idx = idx / (td->page_sz / L1TABLE_ENTRY_SIZE); 117 118 l2 = address_space_ldq_le(as, 119 td->base_addr + (l2idx * L1TABLE_ENTRY_SIZE), 120 MEMTXATTRS_UNSPECIFIED, res); 121 if (*res != MEMTX_OK) { 122 return -1; 123 } 124 if (!(l2 & L2_TABLE_VALID_MASK)) { 125 return -1; 126 } 127 128 num_l2_entries = td->page_sz / td->entry_sz; 129 return (l2 & ((1ULL << 51) - 1)) + (idx % num_l2_entries) * td->entry_sz; 130 } 131 132 static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte, 133 MemTxResult *res) 134 { 135 AddressSpace *as = &s->gicv3->dma_as; 136 uint64_t entry_addr = table_entry_addr(s, &s->ct, icid, res); 137 138 if (entry_addr == -1) { 139 return false; /* not valid */ 140 } 141 142 *cte = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, res); 143 return FIELD_EX64(*cte, CTE, VALID); 144 } 145 146 static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte, 147 IteEntry ite) 148 { 149 AddressSpace *as = &s->gicv3->dma_as; 150 uint64_t itt_addr; 151 MemTxResult res = MEMTX_OK; 152 153 itt_addr = FIELD_EX64(dte, DTE, ITTADDR); 154 itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */ 155 156 address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) + 157 sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED, 158 &res); 159 160 if (res == MEMTX_OK) { 161 address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) + 162 sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh, 163 MEMTXATTRS_UNSPECIFIED, &res); 164 } 165 if (res != MEMTX_OK) { 166 return false; 167 } else { 168 return true; 169 } 170 } 171 172 static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte, 173 uint16_t *icid, uint32_t *pIntid, MemTxResult *res) 174 { 175 AddressSpace *as = &s->gicv3->dma_as; 176 uint64_t itt_addr; 177 bool status = false; 178 IteEntry ite = {}; 179 180 itt_addr = FIELD_EX64(dte, DTE, ITTADDR); 181 itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */ 182 183 ite.itel = address_space_ldq_le(as, itt_addr + 184 (eventid * (sizeof(uint64_t) + 185 sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED, 186 res); 187 188 if (*res == MEMTX_OK) { 189 ite.iteh = address_space_ldl_le(as, itt_addr + 190 (eventid * (sizeof(uint64_t) + 191 sizeof(uint32_t))) + sizeof(uint32_t), 192 MEMTXATTRS_UNSPECIFIED, res); 193 194 if (*res == MEMTX_OK) { 195 if (FIELD_EX64(ite.itel, ITE_L, VALID)) { 196 int inttype = FIELD_EX64(ite.itel, ITE_L, INTTYPE); 197 if (inttype == ITE_INTTYPE_PHYSICAL) { 198 *pIntid = FIELD_EX64(ite.itel, ITE_L, INTID); 199 *icid = FIELD_EX32(ite.iteh, ITE_H, ICID); 200 status = true; 201 } 202 } 203 } 204 } 205 return status; 206 } 207 208 static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res) 209 { 210 AddressSpace *as = &s->gicv3->dma_as; 211 uint64_t entry_addr = table_entry_addr(s, &s->dt, devid, res); 212 213 if (entry_addr == -1) { 214 return 0; /* a DTE entry with the Valid bit clear */ 215 } 216 return address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, res); 217 } 218 219 /* 220 * This function handles the processing of following commands based on 221 * the ItsCmdType parameter passed:- 222 * 1. triggering of lpi interrupt translation via ITS INT command 223 * 2. triggering of lpi interrupt translation via gits_translater register 224 * 3. handling of ITS CLEAR command 225 * 4. handling of ITS DISCARD command 226 */ 227 static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value, 228 uint32_t offset, ItsCmdType cmd) 229 { 230 AddressSpace *as = &s->gicv3->dma_as; 231 uint32_t devid, eventid; 232 MemTxResult res = MEMTX_OK; 233 bool dte_valid; 234 uint64_t dte = 0; 235 uint64_t num_eventids; 236 uint16_t icid = 0; 237 uint32_t pIntid = 0; 238 bool ite_valid = false; 239 uint64_t cte = 0; 240 bool cte_valid = false; 241 uint64_t rdbase; 242 243 if (cmd == NONE) { 244 devid = offset; 245 } else { 246 devid = ((value & DEVID_MASK) >> DEVID_SHIFT); 247 248 offset += NUM_BYTES_IN_DW; 249 value = address_space_ldq_le(as, s->cq.base_addr + offset, 250 MEMTXATTRS_UNSPECIFIED, &res); 251 } 252 253 if (res != MEMTX_OK) { 254 return CMD_STALL; 255 } 256 257 eventid = (value & EVENTID_MASK); 258 259 if (devid >= s->dt.num_ids) { 260 qemu_log_mask(LOG_GUEST_ERROR, 261 "%s: invalid command attributes: devid %d>=%d", 262 __func__, devid, s->dt.num_ids); 263 return CMD_CONTINUE; 264 } 265 266 dte = get_dte(s, devid, &res); 267 268 if (res != MEMTX_OK) { 269 return CMD_STALL; 270 } 271 dte_valid = FIELD_EX64(dte, DTE, VALID); 272 273 if (!dte_valid) { 274 qemu_log_mask(LOG_GUEST_ERROR, 275 "%s: invalid command attributes: " 276 "invalid dte: %"PRIx64" for %d\n", 277 __func__, dte, devid); 278 return CMD_CONTINUE; 279 } 280 281 num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1); 282 283 if (eventid >= num_eventids) { 284 qemu_log_mask(LOG_GUEST_ERROR, 285 "%s: invalid command attributes: eventid %d >= %" 286 PRId64 "\n", 287 __func__, eventid, num_eventids); 288 return CMD_CONTINUE; 289 } 290 291 ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res); 292 if (res != MEMTX_OK) { 293 return CMD_STALL; 294 } 295 296 if (!ite_valid) { 297 qemu_log_mask(LOG_GUEST_ERROR, 298 "%s: invalid command attributes: invalid ITE\n", 299 __func__); 300 return CMD_CONTINUE; 301 } 302 303 if (icid >= s->ct.num_ids) { 304 qemu_log_mask(LOG_GUEST_ERROR, 305 "%s: invalid ICID 0x%x in ITE (table corrupted?)\n", 306 __func__, icid); 307 return CMD_CONTINUE; 308 } 309 310 cte_valid = get_cte(s, icid, &cte, &res); 311 if (res != MEMTX_OK) { 312 return CMD_STALL; 313 } 314 if (!cte_valid) { 315 qemu_log_mask(LOG_GUEST_ERROR, 316 "%s: invalid command attributes: " 317 "invalid cte: %"PRIx64"\n", 318 __func__, cte); 319 return CMD_CONTINUE; 320 } 321 322 /* 323 * Current implementation only supports rdbase == procnum 324 * Hence rdbase physical address is ignored 325 */ 326 rdbase = FIELD_EX64(cte, CTE, RDBASE); 327 328 if (rdbase >= s->gicv3->num_cpu) { 329 return CMD_CONTINUE; 330 } 331 332 if ((cmd == CLEAR) || (cmd == DISCARD)) { 333 gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0); 334 } else { 335 gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1); 336 } 337 338 if (cmd == DISCARD) { 339 IteEntry ite = {}; 340 /* remove mapping from interrupt translation table */ 341 return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL; 342 } 343 return CMD_CONTINUE; 344 } 345 346 static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value, 347 uint32_t offset, bool ignore_pInt) 348 { 349 AddressSpace *as = &s->gicv3->dma_as; 350 uint32_t devid, eventid; 351 uint32_t pIntid = 0; 352 uint64_t num_eventids; 353 uint32_t num_intids; 354 bool dte_valid; 355 MemTxResult res = MEMTX_OK; 356 uint16_t icid = 0; 357 uint64_t dte = 0; 358 IteEntry ite = {}; 359 360 devid = ((value & DEVID_MASK) >> DEVID_SHIFT); 361 offset += NUM_BYTES_IN_DW; 362 value = address_space_ldq_le(as, s->cq.base_addr + offset, 363 MEMTXATTRS_UNSPECIFIED, &res); 364 365 if (res != MEMTX_OK) { 366 return CMD_STALL; 367 } 368 369 eventid = (value & EVENTID_MASK); 370 371 if (ignore_pInt) { 372 pIntid = eventid; 373 } else { 374 pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT); 375 } 376 377 offset += NUM_BYTES_IN_DW; 378 value = address_space_ldq_le(as, s->cq.base_addr + offset, 379 MEMTXATTRS_UNSPECIFIED, &res); 380 381 if (res != MEMTX_OK) { 382 return CMD_STALL; 383 } 384 385 icid = value & ICID_MASK; 386 387 if (devid >= s->dt.num_ids) { 388 qemu_log_mask(LOG_GUEST_ERROR, 389 "%s: invalid command attributes: devid %d>=%d", 390 __func__, devid, s->dt.num_ids); 391 return CMD_CONTINUE; 392 } 393 394 dte = get_dte(s, devid, &res); 395 396 if (res != MEMTX_OK) { 397 return CMD_STALL; 398 } 399 dte_valid = FIELD_EX64(dte, DTE, VALID); 400 num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1); 401 num_intids = 1ULL << (GICD_TYPER_IDBITS + 1); 402 403 if ((icid >= s->ct.num_ids) 404 || !dte_valid || (eventid >= num_eventids) || 405 (((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) && 406 (pIntid != INTID_SPURIOUS))) { 407 qemu_log_mask(LOG_GUEST_ERROR, 408 "%s: invalid command attributes " 409 "icid %d or eventid %d or pIntid %d or" 410 "unmapped dte %d\n", __func__, icid, eventid, 411 pIntid, dte_valid); 412 /* 413 * in this implementation, in case of error 414 * we ignore this command and move onto the next 415 * command in the queue 416 */ 417 return CMD_CONTINUE; 418 } 419 420 /* add ite entry to interrupt translation table */ 421 ite.itel = FIELD_DP64(ite.itel, ITE_L, VALID, dte_valid); 422 ite.itel = FIELD_DP64(ite.itel, ITE_L, INTTYPE, ITE_INTTYPE_PHYSICAL); 423 ite.itel = FIELD_DP64(ite.itel, ITE_L, INTID, pIntid); 424 ite.itel = FIELD_DP64(ite.itel, ITE_L, DOORBELL, INTID_SPURIOUS); 425 ite.iteh = FIELD_DP32(ite.iteh, ITE_H, ICID, icid); 426 427 return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL; 428 } 429 430 static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid, 431 uint64_t rdbase) 432 { 433 AddressSpace *as = &s->gicv3->dma_as; 434 uint64_t entry_addr; 435 uint64_t cte = 0; 436 MemTxResult res = MEMTX_OK; 437 438 if (!s->ct.valid) { 439 return true; 440 } 441 442 if (valid) { 443 /* add mapping entry to collection table */ 444 cte = FIELD_DP64(cte, CTE, VALID, 1); 445 cte = FIELD_DP64(cte, CTE, RDBASE, rdbase); 446 } 447 448 entry_addr = table_entry_addr(s, &s->ct, icid, &res); 449 if (res != MEMTX_OK) { 450 /* memory access error: stall */ 451 return false; 452 } 453 if (entry_addr == -1) { 454 /* No L2 table for this index: discard write and continue */ 455 return true; 456 } 457 458 address_space_stq_le(as, entry_addr, cte, MEMTXATTRS_UNSPECIFIED, &res); 459 return res == MEMTX_OK; 460 } 461 462 static ItsCmdResult process_mapc(GICv3ITSState *s, uint32_t offset) 463 { 464 AddressSpace *as = &s->gicv3->dma_as; 465 uint16_t icid; 466 uint64_t rdbase; 467 bool valid; 468 MemTxResult res = MEMTX_OK; 469 uint64_t value; 470 471 offset += NUM_BYTES_IN_DW; 472 offset += NUM_BYTES_IN_DW; 473 474 value = address_space_ldq_le(as, s->cq.base_addr + offset, 475 MEMTXATTRS_UNSPECIFIED, &res); 476 477 if (res != MEMTX_OK) { 478 return CMD_STALL; 479 } 480 481 icid = value & ICID_MASK; 482 483 rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT; 484 rdbase &= RDBASE_PROCNUM_MASK; 485 486 valid = (value & CMD_FIELD_VALID_MASK); 487 488 if ((icid >= s->ct.num_ids) || (rdbase >= s->gicv3->num_cpu)) { 489 qemu_log_mask(LOG_GUEST_ERROR, 490 "ITS MAPC: invalid collection table attributes " 491 "icid %d rdbase %" PRIu64 "\n", icid, rdbase); 492 /* 493 * in this implementation, in case of error 494 * we ignore this command and move onto the next 495 * command in the queue 496 */ 497 return CMD_CONTINUE; 498 } 499 500 return update_cte(s, icid, valid, rdbase) ? CMD_CONTINUE : CMD_STALL; 501 } 502 503 static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid, 504 uint8_t size, uint64_t itt_addr) 505 { 506 AddressSpace *as = &s->gicv3->dma_as; 507 uint64_t entry_addr; 508 uint64_t dte = 0; 509 MemTxResult res = MEMTX_OK; 510 511 if (s->dt.valid) { 512 if (valid) { 513 /* add mapping entry to device table */ 514 dte = FIELD_DP64(dte, DTE, VALID, 1); 515 dte = FIELD_DP64(dte, DTE, SIZE, size); 516 dte = FIELD_DP64(dte, DTE, ITTADDR, itt_addr); 517 } 518 } else { 519 return true; 520 } 521 522 entry_addr = table_entry_addr(s, &s->dt, devid, &res); 523 if (res != MEMTX_OK) { 524 /* memory access error: stall */ 525 return false; 526 } 527 if (entry_addr == -1) { 528 /* No L2 table for this index: discard write and continue */ 529 return true; 530 } 531 address_space_stq_le(as, entry_addr, dte, MEMTXATTRS_UNSPECIFIED, &res); 532 return res == MEMTX_OK; 533 } 534 535 static ItsCmdResult process_mapd(GICv3ITSState *s, uint64_t value, 536 uint32_t offset) 537 { 538 AddressSpace *as = &s->gicv3->dma_as; 539 uint32_t devid; 540 uint8_t size; 541 uint64_t itt_addr; 542 bool valid; 543 MemTxResult res = MEMTX_OK; 544 545 devid = ((value & DEVID_MASK) >> DEVID_SHIFT); 546 547 offset += NUM_BYTES_IN_DW; 548 value = address_space_ldq_le(as, s->cq.base_addr + offset, 549 MEMTXATTRS_UNSPECIFIED, &res); 550 551 if (res != MEMTX_OK) { 552 return CMD_STALL; 553 } 554 555 size = (value & SIZE_MASK); 556 557 offset += NUM_BYTES_IN_DW; 558 value = address_space_ldq_le(as, s->cq.base_addr + offset, 559 MEMTXATTRS_UNSPECIFIED, &res); 560 561 if (res != MEMTX_OK) { 562 return CMD_STALL; 563 } 564 565 itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT; 566 567 valid = (value & CMD_FIELD_VALID_MASK); 568 569 if ((devid >= s->dt.num_ids) || 570 (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) { 571 qemu_log_mask(LOG_GUEST_ERROR, 572 "ITS MAPD: invalid device table attributes " 573 "devid %d or size %d\n", devid, size); 574 /* 575 * in this implementation, in case of error 576 * we ignore this command and move onto the next 577 * command in the queue 578 */ 579 return CMD_CONTINUE; 580 } 581 582 return update_dte(s, devid, valid, size, itt_addr) ? CMD_CONTINUE : CMD_STALL; 583 } 584 585 /* 586 * Current implementation blocks until all 587 * commands are processed 588 */ 589 static void process_cmdq(GICv3ITSState *s) 590 { 591 uint32_t wr_offset = 0; 592 uint32_t rd_offset = 0; 593 uint32_t cq_offset = 0; 594 uint64_t data; 595 AddressSpace *as = &s->gicv3->dma_as; 596 MemTxResult res = MEMTX_OK; 597 uint8_t cmd; 598 int i; 599 600 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 601 return; 602 } 603 604 wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET); 605 606 if (wr_offset >= s->cq.num_entries) { 607 qemu_log_mask(LOG_GUEST_ERROR, 608 "%s: invalid write offset " 609 "%d\n", __func__, wr_offset); 610 return; 611 } 612 613 rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET); 614 615 if (rd_offset >= s->cq.num_entries) { 616 qemu_log_mask(LOG_GUEST_ERROR, 617 "%s: invalid read offset " 618 "%d\n", __func__, rd_offset); 619 return; 620 } 621 622 while (wr_offset != rd_offset) { 623 ItsCmdResult result = CMD_CONTINUE; 624 625 cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE); 626 data = address_space_ldq_le(as, s->cq.base_addr + cq_offset, 627 MEMTXATTRS_UNSPECIFIED, &res); 628 if (res != MEMTX_OK) { 629 s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1); 630 qemu_log_mask(LOG_GUEST_ERROR, 631 "%s: could not read command at 0x%" PRIx64 "\n", 632 __func__, s->cq.base_addr + cq_offset); 633 break; 634 } 635 636 cmd = (data & CMD_MASK); 637 638 trace_gicv3_its_process_command(rd_offset, cmd); 639 640 switch (cmd) { 641 case GITS_CMD_INT: 642 result = process_its_cmd(s, data, cq_offset, INTERRUPT); 643 break; 644 case GITS_CMD_CLEAR: 645 result = process_its_cmd(s, data, cq_offset, CLEAR); 646 break; 647 case GITS_CMD_SYNC: 648 /* 649 * Current implementation makes a blocking synchronous call 650 * for every command issued earlier, hence the internal state 651 * is already consistent by the time SYNC command is executed. 652 * Hence no further processing is required for SYNC command. 653 */ 654 break; 655 case GITS_CMD_MAPD: 656 result = process_mapd(s, data, cq_offset); 657 break; 658 case GITS_CMD_MAPC: 659 result = process_mapc(s, cq_offset); 660 break; 661 case GITS_CMD_MAPTI: 662 result = process_mapti(s, data, cq_offset, false); 663 break; 664 case GITS_CMD_MAPI: 665 result = process_mapti(s, data, cq_offset, true); 666 break; 667 case GITS_CMD_DISCARD: 668 result = process_its_cmd(s, data, cq_offset, DISCARD); 669 break; 670 case GITS_CMD_INV: 671 case GITS_CMD_INVALL: 672 /* 673 * Current implementation doesn't cache any ITS tables, 674 * but the calculated lpi priority information. We only 675 * need to trigger lpi priority re-calculation to be in 676 * sync with LPI config table or pending table changes. 677 */ 678 for (i = 0; i < s->gicv3->num_cpu; i++) { 679 gicv3_redist_update_lpi(&s->gicv3->cpu[i]); 680 } 681 break; 682 default: 683 break; 684 } 685 if (result == CMD_CONTINUE) { 686 rd_offset++; 687 rd_offset %= s->cq.num_entries; 688 s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset); 689 } else { 690 /* CMD_STALL */ 691 s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1); 692 qemu_log_mask(LOG_GUEST_ERROR, 693 "%s: 0x%x cmd processing failed, stalling\n", 694 __func__, cmd); 695 break; 696 } 697 } 698 } 699 700 /* 701 * This function extracts the ITS Device and Collection table specific 702 * parameters (like base_addr, size etc) from GITS_BASER register. 703 * It is called during ITS enable and also during post_load migration 704 */ 705 static void extract_table_params(GICv3ITSState *s) 706 { 707 uint16_t num_pages = 0; 708 uint8_t page_sz_type; 709 uint8_t type; 710 uint32_t page_sz = 0; 711 uint64_t value; 712 713 for (int i = 0; i < 8; i++) { 714 TableDesc *td; 715 int idbits; 716 717 value = s->baser[i]; 718 719 if (!value) { 720 continue; 721 } 722 723 page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE); 724 725 switch (page_sz_type) { 726 case 0: 727 page_sz = GITS_PAGE_SIZE_4K; 728 break; 729 730 case 1: 731 page_sz = GITS_PAGE_SIZE_16K; 732 break; 733 734 case 2: 735 case 3: 736 page_sz = GITS_PAGE_SIZE_64K; 737 break; 738 739 default: 740 g_assert_not_reached(); 741 } 742 743 num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1; 744 745 type = FIELD_EX64(value, GITS_BASER, TYPE); 746 747 switch (type) { 748 case GITS_BASER_TYPE_DEVICE: 749 td = &s->dt; 750 idbits = FIELD_EX64(s->typer, GITS_TYPER, DEVBITS) + 1; 751 break; 752 case GITS_BASER_TYPE_COLLECTION: 753 td = &s->ct; 754 if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) { 755 idbits = FIELD_EX64(s->typer, GITS_TYPER, CIDBITS) + 1; 756 } else { 757 /* 16-bit CollectionId supported when CIL == 0 */ 758 idbits = 16; 759 } 760 break; 761 default: 762 /* 763 * GITS_BASER<n>.TYPE is read-only, so GITS_BASER_RO_MASK 764 * ensures we will only see type values corresponding to 765 * the values set up in gicv3_its_reset(). 766 */ 767 g_assert_not_reached(); 768 } 769 770 memset(td, 0, sizeof(*td)); 771 td->valid = FIELD_EX64(value, GITS_BASER, VALID); 772 /* 773 * If GITS_BASER<n>.Valid is 0 for any <n> then we will not process 774 * interrupts. (GITS_TYPER.HCC is 0 for this implementation, so we 775 * do not have a special case where the GITS_BASER<n>.Valid bit is 0 776 * for the register corresponding to the Collection table but we 777 * still have to process interrupts using non-memory-backed 778 * Collection table entries.) 779 */ 780 if (!td->valid) { 781 continue; 782 } 783 td->page_sz = page_sz; 784 td->indirect = FIELD_EX64(value, GITS_BASER, INDIRECT); 785 td->entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE) + 1; 786 td->base_addr = baser_base_addr(value, page_sz); 787 if (!td->indirect) { 788 td->num_entries = (num_pages * page_sz) / td->entry_sz; 789 } else { 790 td->num_entries = (((num_pages * page_sz) / 791 L1TABLE_ENTRY_SIZE) * 792 (page_sz / td->entry_sz)); 793 } 794 td->num_ids = 1ULL << idbits; 795 } 796 } 797 798 static void extract_cmdq_params(GICv3ITSState *s) 799 { 800 uint16_t num_pages = 0; 801 uint64_t value = s->cbaser; 802 803 num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1; 804 805 memset(&s->cq, 0 , sizeof(s->cq)); 806 s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID); 807 808 if (s->cq.valid) { 809 s->cq.num_entries = (num_pages * GITS_PAGE_SIZE_4K) / 810 GITS_CMDQ_ENTRY_SIZE; 811 s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR); 812 s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT; 813 } 814 } 815 816 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset, 817 uint64_t data, unsigned size, 818 MemTxAttrs attrs) 819 { 820 GICv3ITSState *s = (GICv3ITSState *)opaque; 821 bool result = true; 822 uint32_t devid = 0; 823 824 trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id); 825 826 switch (offset) { 827 case GITS_TRANSLATER: 828 if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) { 829 devid = attrs.requester_id; 830 result = process_its_cmd(s, data, devid, NONE); 831 } 832 break; 833 default: 834 break; 835 } 836 837 if (result) { 838 return MEMTX_OK; 839 } else { 840 return MEMTX_ERROR; 841 } 842 } 843 844 static bool its_writel(GICv3ITSState *s, hwaddr offset, 845 uint64_t value, MemTxAttrs attrs) 846 { 847 bool result = true; 848 int index; 849 850 switch (offset) { 851 case GITS_CTLR: 852 if (value & R_GITS_CTLR_ENABLED_MASK) { 853 s->ctlr |= R_GITS_CTLR_ENABLED_MASK; 854 extract_table_params(s); 855 extract_cmdq_params(s); 856 process_cmdq(s); 857 } else { 858 s->ctlr &= ~R_GITS_CTLR_ENABLED_MASK; 859 } 860 break; 861 case GITS_CBASER: 862 /* 863 * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is 864 * already enabled 865 */ 866 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 867 s->cbaser = deposit64(s->cbaser, 0, 32, value); 868 s->creadr = 0; 869 } 870 break; 871 case GITS_CBASER + 4: 872 /* 873 * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is 874 * already enabled 875 */ 876 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 877 s->cbaser = deposit64(s->cbaser, 32, 32, value); 878 s->creadr = 0; 879 } 880 break; 881 case GITS_CWRITER: 882 s->cwriter = deposit64(s->cwriter, 0, 32, 883 (value & ~R_GITS_CWRITER_RETRY_MASK)); 884 if (s->cwriter != s->creadr) { 885 process_cmdq(s); 886 } 887 break; 888 case GITS_CWRITER + 4: 889 s->cwriter = deposit64(s->cwriter, 32, 32, value); 890 break; 891 case GITS_CREADR: 892 if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) { 893 s->creadr = deposit64(s->creadr, 0, 32, 894 (value & ~R_GITS_CREADR_STALLED_MASK)); 895 } else { 896 /* RO register, ignore the write */ 897 qemu_log_mask(LOG_GUEST_ERROR, 898 "%s: invalid guest write to RO register at offset " 899 TARGET_FMT_plx "\n", __func__, offset); 900 } 901 break; 902 case GITS_CREADR + 4: 903 if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) { 904 s->creadr = deposit64(s->creadr, 32, 32, value); 905 } else { 906 /* RO register, ignore the write */ 907 qemu_log_mask(LOG_GUEST_ERROR, 908 "%s: invalid guest write to RO register at offset " 909 TARGET_FMT_plx "\n", __func__, offset); 910 } 911 break; 912 case GITS_BASER ... GITS_BASER + 0x3f: 913 /* 914 * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is 915 * already enabled 916 */ 917 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 918 index = (offset - GITS_BASER) / 8; 919 920 if (offset & 7) { 921 value <<= 32; 922 value &= ~GITS_BASER_RO_MASK; 923 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32); 924 s->baser[index] |= value; 925 } else { 926 value &= ~GITS_BASER_RO_MASK; 927 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32); 928 s->baser[index] |= value; 929 } 930 } 931 break; 932 case GITS_IIDR: 933 case GITS_IDREGS ... GITS_IDREGS + 0x2f: 934 /* RO registers, ignore the write */ 935 qemu_log_mask(LOG_GUEST_ERROR, 936 "%s: invalid guest write to RO register at offset " 937 TARGET_FMT_plx "\n", __func__, offset); 938 break; 939 default: 940 result = false; 941 break; 942 } 943 return result; 944 } 945 946 static bool its_readl(GICv3ITSState *s, hwaddr offset, 947 uint64_t *data, MemTxAttrs attrs) 948 { 949 bool result = true; 950 int index; 951 952 switch (offset) { 953 case GITS_CTLR: 954 *data = s->ctlr; 955 break; 956 case GITS_IIDR: 957 *data = gicv3_iidr(); 958 break; 959 case GITS_IDREGS ... GITS_IDREGS + 0x2f: 960 /* ID registers */ 961 *data = gicv3_idreg(offset - GITS_IDREGS); 962 break; 963 case GITS_TYPER: 964 *data = extract64(s->typer, 0, 32); 965 break; 966 case GITS_TYPER + 4: 967 *data = extract64(s->typer, 32, 32); 968 break; 969 case GITS_CBASER: 970 *data = extract64(s->cbaser, 0, 32); 971 break; 972 case GITS_CBASER + 4: 973 *data = extract64(s->cbaser, 32, 32); 974 break; 975 case GITS_CREADR: 976 *data = extract64(s->creadr, 0, 32); 977 break; 978 case GITS_CREADR + 4: 979 *data = extract64(s->creadr, 32, 32); 980 break; 981 case GITS_CWRITER: 982 *data = extract64(s->cwriter, 0, 32); 983 break; 984 case GITS_CWRITER + 4: 985 *data = extract64(s->cwriter, 32, 32); 986 break; 987 case GITS_BASER ... GITS_BASER + 0x3f: 988 index = (offset - GITS_BASER) / 8; 989 if (offset & 7) { 990 *data = extract64(s->baser[index], 32, 32); 991 } else { 992 *data = extract64(s->baser[index], 0, 32); 993 } 994 break; 995 default: 996 result = false; 997 break; 998 } 999 return result; 1000 } 1001 1002 static bool its_writell(GICv3ITSState *s, hwaddr offset, 1003 uint64_t value, MemTxAttrs attrs) 1004 { 1005 bool result = true; 1006 int index; 1007 1008 switch (offset) { 1009 case GITS_BASER ... GITS_BASER + 0x3f: 1010 /* 1011 * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is 1012 * already enabled 1013 */ 1014 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 1015 index = (offset - GITS_BASER) / 8; 1016 s->baser[index] &= GITS_BASER_RO_MASK; 1017 s->baser[index] |= (value & ~GITS_BASER_RO_MASK); 1018 } 1019 break; 1020 case GITS_CBASER: 1021 /* 1022 * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is 1023 * already enabled 1024 */ 1025 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 1026 s->cbaser = value; 1027 s->creadr = 0; 1028 } 1029 break; 1030 case GITS_CWRITER: 1031 s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK; 1032 if (s->cwriter != s->creadr) { 1033 process_cmdq(s); 1034 } 1035 break; 1036 case GITS_CREADR: 1037 if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) { 1038 s->creadr = value & ~R_GITS_CREADR_STALLED_MASK; 1039 } else { 1040 /* RO register, ignore the write */ 1041 qemu_log_mask(LOG_GUEST_ERROR, 1042 "%s: invalid guest write to RO register at offset " 1043 TARGET_FMT_plx "\n", __func__, offset); 1044 } 1045 break; 1046 case GITS_TYPER: 1047 /* RO registers, ignore the write */ 1048 qemu_log_mask(LOG_GUEST_ERROR, 1049 "%s: invalid guest write to RO register at offset " 1050 TARGET_FMT_plx "\n", __func__, offset); 1051 break; 1052 default: 1053 result = false; 1054 break; 1055 } 1056 return result; 1057 } 1058 1059 static bool its_readll(GICv3ITSState *s, hwaddr offset, 1060 uint64_t *data, MemTxAttrs attrs) 1061 { 1062 bool result = true; 1063 int index; 1064 1065 switch (offset) { 1066 case GITS_TYPER: 1067 *data = s->typer; 1068 break; 1069 case GITS_BASER ... GITS_BASER + 0x3f: 1070 index = (offset - GITS_BASER) / 8; 1071 *data = s->baser[index]; 1072 break; 1073 case GITS_CBASER: 1074 *data = s->cbaser; 1075 break; 1076 case GITS_CREADR: 1077 *data = s->creadr; 1078 break; 1079 case GITS_CWRITER: 1080 *data = s->cwriter; 1081 break; 1082 default: 1083 result = false; 1084 break; 1085 } 1086 return result; 1087 } 1088 1089 static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data, 1090 unsigned size, MemTxAttrs attrs) 1091 { 1092 GICv3ITSState *s = (GICv3ITSState *)opaque; 1093 bool result; 1094 1095 switch (size) { 1096 case 4: 1097 result = its_readl(s, offset, data, attrs); 1098 break; 1099 case 8: 1100 result = its_readll(s, offset, data, attrs); 1101 break; 1102 default: 1103 result = false; 1104 break; 1105 } 1106 1107 if (!result) { 1108 qemu_log_mask(LOG_GUEST_ERROR, 1109 "%s: invalid guest read at offset " TARGET_FMT_plx 1110 "size %u\n", __func__, offset, size); 1111 trace_gicv3_its_badread(offset, size); 1112 /* 1113 * The spec requires that reserved registers are RAZ/WI; 1114 * so use false returns from leaf functions as a way to 1115 * trigger the guest-error logging but don't return it to 1116 * the caller, or we'll cause a spurious guest data abort. 1117 */ 1118 *data = 0; 1119 } else { 1120 trace_gicv3_its_read(offset, *data, size); 1121 } 1122 return MEMTX_OK; 1123 } 1124 1125 static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data, 1126 unsigned size, MemTxAttrs attrs) 1127 { 1128 GICv3ITSState *s = (GICv3ITSState *)opaque; 1129 bool result; 1130 1131 switch (size) { 1132 case 4: 1133 result = its_writel(s, offset, data, attrs); 1134 break; 1135 case 8: 1136 result = its_writell(s, offset, data, attrs); 1137 break; 1138 default: 1139 result = false; 1140 break; 1141 } 1142 1143 if (!result) { 1144 qemu_log_mask(LOG_GUEST_ERROR, 1145 "%s: invalid guest write at offset " TARGET_FMT_plx 1146 "size %u\n", __func__, offset, size); 1147 trace_gicv3_its_badwrite(offset, data, size); 1148 /* 1149 * The spec requires that reserved registers are RAZ/WI; 1150 * so use false returns from leaf functions as a way to 1151 * trigger the guest-error logging but don't return it to 1152 * the caller, or we'll cause a spurious guest data abort. 1153 */ 1154 } else { 1155 trace_gicv3_its_write(offset, data, size); 1156 } 1157 return MEMTX_OK; 1158 } 1159 1160 static const MemoryRegionOps gicv3_its_control_ops = { 1161 .read_with_attrs = gicv3_its_read, 1162 .write_with_attrs = gicv3_its_write, 1163 .valid.min_access_size = 4, 1164 .valid.max_access_size = 8, 1165 .impl.min_access_size = 4, 1166 .impl.max_access_size = 8, 1167 .endianness = DEVICE_NATIVE_ENDIAN, 1168 }; 1169 1170 static const MemoryRegionOps gicv3_its_translation_ops = { 1171 .write_with_attrs = gicv3_its_translation_write, 1172 .valid.min_access_size = 2, 1173 .valid.max_access_size = 4, 1174 .impl.min_access_size = 2, 1175 .impl.max_access_size = 4, 1176 .endianness = DEVICE_NATIVE_ENDIAN, 1177 }; 1178 1179 static void gicv3_arm_its_realize(DeviceState *dev, Error **errp) 1180 { 1181 GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev); 1182 int i; 1183 1184 for (i = 0; i < s->gicv3->num_cpu; i++) { 1185 if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) { 1186 error_setg(errp, "Physical LPI not supported by CPU %d", i); 1187 return; 1188 } 1189 } 1190 1191 gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops); 1192 1193 /* set the ITS default features supported */ 1194 s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1); 1195 s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE, 1196 ITS_ITT_ENTRY_SIZE - 1); 1197 s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS); 1198 s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS); 1199 s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1); 1200 s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS); 1201 } 1202 1203 static void gicv3_its_reset(DeviceState *dev) 1204 { 1205 GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev); 1206 GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s); 1207 1208 c->parent_reset(dev); 1209 1210 /* Quiescent bit reset to 1 */ 1211 s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1); 1212 1213 /* 1214 * setting GITS_BASER0.Type = 0b001 (Device) 1215 * GITS_BASER1.Type = 0b100 (Collection Table) 1216 * GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented) 1217 * GITS_BASER<0,1>.Page_Size = 64KB 1218 * and default translation table entry size to 16 bytes 1219 */ 1220 s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE, 1221 GITS_BASER_TYPE_DEVICE); 1222 s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE, 1223 GITS_BASER_PAGESIZE_64K); 1224 s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE, 1225 GITS_DTE_SIZE - 1); 1226 1227 s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE, 1228 GITS_BASER_TYPE_COLLECTION); 1229 s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE, 1230 GITS_BASER_PAGESIZE_64K); 1231 s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE, 1232 GITS_CTE_SIZE - 1); 1233 } 1234 1235 static void gicv3_its_post_load(GICv3ITSState *s) 1236 { 1237 if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) { 1238 extract_table_params(s); 1239 extract_cmdq_params(s); 1240 } 1241 } 1242 1243 static Property gicv3_its_props[] = { 1244 DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3", 1245 GICv3State *), 1246 DEFINE_PROP_END_OF_LIST(), 1247 }; 1248 1249 static void gicv3_its_class_init(ObjectClass *klass, void *data) 1250 { 1251 DeviceClass *dc = DEVICE_CLASS(klass); 1252 GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass); 1253 GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass); 1254 1255 dc->realize = gicv3_arm_its_realize; 1256 device_class_set_props(dc, gicv3_its_props); 1257 device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset); 1258 icc->post_load = gicv3_its_post_load; 1259 } 1260 1261 static const TypeInfo gicv3_its_info = { 1262 .name = TYPE_ARM_GICV3_ITS, 1263 .parent = TYPE_ARM_GICV3_ITS_COMMON, 1264 .instance_size = sizeof(GICv3ITSState), 1265 .class_init = gicv3_its_class_init, 1266 .class_size = sizeof(GICv3ITSClass), 1267 }; 1268 1269 static void gicv3_its_register_types(void) 1270 { 1271 type_register_static(&gicv3_its_info); 1272 } 1273 1274 type_init(gicv3_its_register_types) 1275