1 /* 2 * ITS emulation for a GICv3-based system 3 * 4 * Copyright Linaro.org 2021 5 * 6 * Authors: 7 * Shashi Mallela <shashi.mallela@linaro.org> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or (at your 10 * option) any later version. See the COPYING file in the top-level directory. 11 * 12 */ 13 14 #include "qemu/osdep.h" 15 #include "qemu/log.h" 16 #include "trace.h" 17 #include "hw/qdev-properties.h" 18 #include "hw/intc/arm_gicv3_its_common.h" 19 #include "gicv3_internal.h" 20 #include "qom/object.h" 21 #include "qapi/error.h" 22 23 typedef struct GICv3ITSClass GICv3ITSClass; 24 /* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */ 25 DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass, 26 ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS) 27 28 struct GICv3ITSClass { 29 GICv3ITSCommonClass parent_class; 30 void (*parent_reset)(DeviceState *dev); 31 }; 32 33 /* 34 * This is an internal enum used to distinguish between LPI triggered 35 * via command queue and LPI triggered via gits_translater write. 36 */ 37 typedef enum ItsCmdType { 38 NONE = 0, /* internal indication for GITS_TRANSLATER write */ 39 CLEAR = 1, 40 DISCARD = 2, 41 INTERRUPT = 3, 42 } ItsCmdType; 43 44 typedef struct { 45 uint32_t iteh; 46 uint64_t itel; 47 } IteEntry; 48 49 /* 50 * The ITS spec permits a range of CONSTRAINED UNPREDICTABLE options 51 * if a command parameter is not correct. These include both "stall 52 * processing of the command queue" and "ignore this command, and 53 * keep processing the queue". In our implementation we choose that 54 * memory transaction errors reading the command packet provoke a 55 * stall, but errors in parameters cause us to ignore the command 56 * and continue processing. 57 * The process_* functions which handle individual ITS commands all 58 * return an ItsCmdResult which tells process_cmdq() whether it should 59 * stall or keep going. 60 */ 61 typedef enum ItsCmdResult { 62 CMD_STALL = 0, 63 CMD_CONTINUE = 1, 64 } ItsCmdResult; 65 66 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz) 67 { 68 uint64_t result = 0; 69 70 switch (page_sz) { 71 case GITS_PAGE_SIZE_4K: 72 case GITS_PAGE_SIZE_16K: 73 result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12; 74 break; 75 76 case GITS_PAGE_SIZE_64K: 77 result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16; 78 result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48; 79 break; 80 81 default: 82 break; 83 } 84 return result; 85 } 86 87 static uint64_t table_entry_addr(GICv3ITSState *s, TableDesc *td, 88 uint32_t idx, MemTxResult *res) 89 { 90 /* 91 * Given a TableDesc describing one of the ITS in-guest-memory 92 * tables and an index into it, return the guest address 93 * corresponding to that table entry. 94 * If there was a memory error reading the L1 table of an 95 * indirect table, *res is set accordingly, and we return -1. 96 * If the L1 table entry is marked not valid, we return -1 with 97 * *res set to MEMTX_OK. 98 * 99 * The specification defines the format of level 1 entries of a 100 * 2-level table, but the format of level 2 entries and the format 101 * of flat-mapped tables is IMPDEF. 102 */ 103 AddressSpace *as = &s->gicv3->dma_as; 104 uint32_t l2idx; 105 uint64_t l2; 106 uint32_t num_l2_entries; 107 108 *res = MEMTX_OK; 109 110 if (!td->indirect) { 111 /* Single level table */ 112 return td->base_addr + idx * td->entry_sz; 113 } 114 115 /* Two level table */ 116 l2idx = idx / (td->page_sz / L1TABLE_ENTRY_SIZE); 117 118 l2 = address_space_ldq_le(as, 119 td->base_addr + (l2idx * L1TABLE_ENTRY_SIZE), 120 MEMTXATTRS_UNSPECIFIED, res); 121 if (*res != MEMTX_OK) { 122 return -1; 123 } 124 if (!(l2 & L2_TABLE_VALID_MASK)) { 125 return -1; 126 } 127 128 num_l2_entries = td->page_sz / td->entry_sz; 129 return (l2 & ((1ULL << 51) - 1)) + (idx % num_l2_entries) * td->entry_sz; 130 } 131 132 static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte, 133 MemTxResult *res) 134 { 135 AddressSpace *as = &s->gicv3->dma_as; 136 uint64_t entry_addr = table_entry_addr(s, &s->ct, icid, res); 137 138 if (entry_addr == -1) { 139 return false; /* not valid */ 140 } 141 142 *cte = address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, res); 143 return FIELD_EX64(*cte, CTE, VALID); 144 } 145 146 static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte, 147 IteEntry ite) 148 { 149 AddressSpace *as = &s->gicv3->dma_as; 150 uint64_t itt_addr; 151 MemTxResult res = MEMTX_OK; 152 153 itt_addr = FIELD_EX64(dte, DTE, ITTADDR); 154 itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */ 155 156 address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) + 157 sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED, 158 &res); 159 160 if (res == MEMTX_OK) { 161 address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) + 162 sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh, 163 MEMTXATTRS_UNSPECIFIED, &res); 164 } 165 if (res != MEMTX_OK) { 166 return false; 167 } else { 168 return true; 169 } 170 } 171 172 static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte, 173 uint16_t *icid, uint32_t *pIntid, MemTxResult *res) 174 { 175 AddressSpace *as = &s->gicv3->dma_as; 176 uint64_t itt_addr; 177 bool status = false; 178 IteEntry ite = {}; 179 180 itt_addr = FIELD_EX64(dte, DTE, ITTADDR); 181 itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */ 182 183 ite.itel = address_space_ldq_le(as, itt_addr + 184 (eventid * (sizeof(uint64_t) + 185 sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED, 186 res); 187 188 if (*res == MEMTX_OK) { 189 ite.iteh = address_space_ldl_le(as, itt_addr + 190 (eventid * (sizeof(uint64_t) + 191 sizeof(uint32_t))) + sizeof(uint32_t), 192 MEMTXATTRS_UNSPECIFIED, res); 193 194 if (*res == MEMTX_OK) { 195 if (FIELD_EX64(ite.itel, ITE_L, VALID)) { 196 int inttype = FIELD_EX64(ite.itel, ITE_L, INTTYPE); 197 if (inttype == ITE_INTTYPE_PHYSICAL) { 198 *pIntid = FIELD_EX64(ite.itel, ITE_L, INTID); 199 *icid = FIELD_EX32(ite.iteh, ITE_H, ICID); 200 status = true; 201 } 202 } 203 } 204 } 205 return status; 206 } 207 208 static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res) 209 { 210 AddressSpace *as = &s->gicv3->dma_as; 211 uint64_t entry_addr = table_entry_addr(s, &s->dt, devid, res); 212 213 if (entry_addr == -1) { 214 return 0; /* a DTE entry with the Valid bit clear */ 215 } 216 return address_space_ldq_le(as, entry_addr, MEMTXATTRS_UNSPECIFIED, res); 217 } 218 219 /* 220 * This function handles the processing of following commands based on 221 * the ItsCmdType parameter passed:- 222 * 1. triggering of lpi interrupt translation via ITS INT command 223 * 2. triggering of lpi interrupt translation via gits_translater register 224 * 3. handling of ITS CLEAR command 225 * 4. handling of ITS DISCARD command 226 */ 227 static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value, 228 uint32_t offset, ItsCmdType cmd) 229 { 230 AddressSpace *as = &s->gicv3->dma_as; 231 uint32_t devid, eventid; 232 MemTxResult res = MEMTX_OK; 233 bool dte_valid; 234 uint64_t dte = 0; 235 uint64_t num_eventids; 236 uint16_t icid = 0; 237 uint32_t pIntid = 0; 238 bool ite_valid = false; 239 uint64_t cte = 0; 240 bool cte_valid = false; 241 uint64_t rdbase; 242 243 if (cmd == NONE) { 244 devid = offset; 245 } else { 246 devid = ((value & DEVID_MASK) >> DEVID_SHIFT); 247 248 offset += NUM_BYTES_IN_DW; 249 value = address_space_ldq_le(as, s->cq.base_addr + offset, 250 MEMTXATTRS_UNSPECIFIED, &res); 251 } 252 253 if (res != MEMTX_OK) { 254 return CMD_STALL; 255 } 256 257 eventid = (value & EVENTID_MASK); 258 259 if (devid >= s->dt.num_ids) { 260 qemu_log_mask(LOG_GUEST_ERROR, 261 "%s: invalid command attributes: devid %d>=%d", 262 __func__, devid, s->dt.num_ids); 263 return CMD_CONTINUE; 264 } 265 266 dte = get_dte(s, devid, &res); 267 268 if (res != MEMTX_OK) { 269 return CMD_STALL; 270 } 271 dte_valid = FIELD_EX64(dte, DTE, VALID); 272 273 if (!dte_valid) { 274 qemu_log_mask(LOG_GUEST_ERROR, 275 "%s: invalid command attributes: " 276 "invalid dte: %"PRIx64" for %d\n", 277 __func__, dte, devid); 278 return CMD_CONTINUE; 279 } 280 281 num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1); 282 283 if (eventid >= num_eventids) { 284 qemu_log_mask(LOG_GUEST_ERROR, 285 "%s: invalid command attributes: eventid %d >= %" 286 PRId64 "\n", 287 __func__, eventid, num_eventids); 288 return CMD_CONTINUE; 289 } 290 291 ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res); 292 if (res != MEMTX_OK) { 293 return CMD_STALL; 294 } 295 296 if (!ite_valid) { 297 qemu_log_mask(LOG_GUEST_ERROR, 298 "%s: invalid command attributes: invalid ITE\n", 299 __func__); 300 return CMD_CONTINUE; 301 } 302 303 if (icid >= s->ct.num_ids) { 304 qemu_log_mask(LOG_GUEST_ERROR, 305 "%s: invalid ICID 0x%x in ITE (table corrupted?)\n", 306 __func__, icid); 307 return CMD_CONTINUE; 308 } 309 310 cte_valid = get_cte(s, icid, &cte, &res); 311 if (res != MEMTX_OK) { 312 return CMD_STALL; 313 } 314 if (!cte_valid) { 315 qemu_log_mask(LOG_GUEST_ERROR, 316 "%s: invalid command attributes: " 317 "invalid cte: %"PRIx64"\n", 318 __func__, cte); 319 return CMD_CONTINUE; 320 } 321 322 /* 323 * Current implementation only supports rdbase == procnum 324 * Hence rdbase physical address is ignored 325 */ 326 rdbase = FIELD_EX64(cte, CTE, RDBASE); 327 328 if (rdbase >= s->gicv3->num_cpu) { 329 return CMD_CONTINUE; 330 } 331 332 if ((cmd == CLEAR) || (cmd == DISCARD)) { 333 gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0); 334 } else { 335 gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1); 336 } 337 338 if (cmd == DISCARD) { 339 IteEntry ite = {}; 340 /* remove mapping from interrupt translation table */ 341 return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL; 342 } 343 return CMD_CONTINUE; 344 } 345 346 static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value, 347 uint32_t offset, bool ignore_pInt) 348 { 349 AddressSpace *as = &s->gicv3->dma_as; 350 uint32_t devid, eventid; 351 uint32_t pIntid = 0; 352 uint64_t num_eventids; 353 uint32_t num_intids; 354 bool dte_valid; 355 MemTxResult res = MEMTX_OK; 356 uint16_t icid = 0; 357 uint64_t dte = 0; 358 IteEntry ite = {}; 359 360 devid = ((value & DEVID_MASK) >> DEVID_SHIFT); 361 offset += NUM_BYTES_IN_DW; 362 value = address_space_ldq_le(as, s->cq.base_addr + offset, 363 MEMTXATTRS_UNSPECIFIED, &res); 364 365 if (res != MEMTX_OK) { 366 return CMD_STALL; 367 } 368 369 eventid = (value & EVENTID_MASK); 370 371 if (ignore_pInt) { 372 pIntid = eventid; 373 } else { 374 pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT); 375 } 376 377 offset += NUM_BYTES_IN_DW; 378 value = address_space_ldq_le(as, s->cq.base_addr + offset, 379 MEMTXATTRS_UNSPECIFIED, &res); 380 381 if (res != MEMTX_OK) { 382 return CMD_STALL; 383 } 384 385 icid = value & ICID_MASK; 386 387 if (devid >= s->dt.num_ids) { 388 qemu_log_mask(LOG_GUEST_ERROR, 389 "%s: invalid command attributes: devid %d>=%d", 390 __func__, devid, s->dt.num_ids); 391 return CMD_CONTINUE; 392 } 393 394 dte = get_dte(s, devid, &res); 395 396 if (res != MEMTX_OK) { 397 return CMD_STALL; 398 } 399 dte_valid = FIELD_EX64(dte, DTE, VALID); 400 num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1); 401 num_intids = 1ULL << (GICD_TYPER_IDBITS + 1); 402 403 if ((icid >= s->ct.num_ids) 404 || !dte_valid || (eventid >= num_eventids) || 405 (((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) && 406 (pIntid != INTID_SPURIOUS))) { 407 qemu_log_mask(LOG_GUEST_ERROR, 408 "%s: invalid command attributes " 409 "icid %d or eventid %d or pIntid %d or" 410 "unmapped dte %d\n", __func__, icid, eventid, 411 pIntid, dte_valid); 412 /* 413 * in this implementation, in case of error 414 * we ignore this command and move onto the next 415 * command in the queue 416 */ 417 return CMD_CONTINUE; 418 } 419 420 /* add ite entry to interrupt translation table */ 421 ite.itel = FIELD_DP64(ite.itel, ITE_L, VALID, dte_valid); 422 ite.itel = FIELD_DP64(ite.itel, ITE_L, INTTYPE, ITE_INTTYPE_PHYSICAL); 423 ite.itel = FIELD_DP64(ite.itel, ITE_L, INTID, pIntid); 424 ite.itel = FIELD_DP64(ite.itel, ITE_L, DOORBELL, INTID_SPURIOUS); 425 ite.iteh = FIELD_DP32(ite.iteh, ITE_H, ICID, icid); 426 427 return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL; 428 } 429 430 static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid, 431 uint64_t rdbase) 432 { 433 AddressSpace *as = &s->gicv3->dma_as; 434 uint64_t entry_addr; 435 uint64_t cte = 0; 436 MemTxResult res = MEMTX_OK; 437 438 if (!s->ct.valid) { 439 return true; 440 } 441 442 if (valid) { 443 /* add mapping entry to collection table */ 444 cte = FIELD_DP64(cte, CTE, VALID, 1); 445 cte = FIELD_DP64(cte, CTE, RDBASE, rdbase); 446 } 447 448 entry_addr = table_entry_addr(s, &s->ct, icid, &res); 449 if (res != MEMTX_OK) { 450 /* memory access error: stall */ 451 return false; 452 } 453 if (entry_addr == -1) { 454 /* No L2 table for this index: discard write and continue */ 455 return true; 456 } 457 458 address_space_stq_le(as, entry_addr, cte, MEMTXATTRS_UNSPECIFIED, &res); 459 return res == MEMTX_OK; 460 } 461 462 static ItsCmdResult process_mapc(GICv3ITSState *s, uint32_t offset) 463 { 464 AddressSpace *as = &s->gicv3->dma_as; 465 uint16_t icid; 466 uint64_t rdbase; 467 bool valid; 468 MemTxResult res = MEMTX_OK; 469 uint64_t value; 470 471 offset += NUM_BYTES_IN_DW; 472 offset += NUM_BYTES_IN_DW; 473 474 value = address_space_ldq_le(as, s->cq.base_addr + offset, 475 MEMTXATTRS_UNSPECIFIED, &res); 476 477 if (res != MEMTX_OK) { 478 return CMD_STALL; 479 } 480 481 icid = value & ICID_MASK; 482 483 rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT; 484 rdbase &= RDBASE_PROCNUM_MASK; 485 486 valid = (value & CMD_FIELD_VALID_MASK); 487 488 if ((icid >= s->ct.num_ids) || (rdbase >= s->gicv3->num_cpu)) { 489 qemu_log_mask(LOG_GUEST_ERROR, 490 "ITS MAPC: invalid collection table attributes " 491 "icid %d rdbase %" PRIu64 "\n", icid, rdbase); 492 /* 493 * in this implementation, in case of error 494 * we ignore this command and move onto the next 495 * command in the queue 496 */ 497 return CMD_CONTINUE; 498 } 499 500 return update_cte(s, icid, valid, rdbase) ? CMD_CONTINUE : CMD_STALL; 501 } 502 503 static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid, 504 uint8_t size, uint64_t itt_addr) 505 { 506 AddressSpace *as = &s->gicv3->dma_as; 507 uint64_t entry_addr; 508 uint64_t dte = 0; 509 MemTxResult res = MEMTX_OK; 510 511 if (s->dt.valid) { 512 if (valid) { 513 /* add mapping entry to device table */ 514 dte = FIELD_DP64(dte, DTE, VALID, 1); 515 dte = FIELD_DP64(dte, DTE, SIZE, size); 516 dte = FIELD_DP64(dte, DTE, ITTADDR, itt_addr); 517 } 518 } else { 519 return true; 520 } 521 522 entry_addr = table_entry_addr(s, &s->dt, devid, &res); 523 if (res != MEMTX_OK) { 524 /* memory access error: stall */ 525 return false; 526 } 527 if (entry_addr == -1) { 528 /* No L2 table for this index: discard write and continue */ 529 return true; 530 } 531 address_space_stq_le(as, entry_addr, dte, MEMTXATTRS_UNSPECIFIED, &res); 532 return res == MEMTX_OK; 533 } 534 535 static ItsCmdResult process_mapd(GICv3ITSState *s, uint64_t value, 536 uint32_t offset) 537 { 538 AddressSpace *as = &s->gicv3->dma_as; 539 uint32_t devid; 540 uint8_t size; 541 uint64_t itt_addr; 542 bool valid; 543 MemTxResult res = MEMTX_OK; 544 545 devid = ((value & DEVID_MASK) >> DEVID_SHIFT); 546 547 offset += NUM_BYTES_IN_DW; 548 value = address_space_ldq_le(as, s->cq.base_addr + offset, 549 MEMTXATTRS_UNSPECIFIED, &res); 550 551 if (res != MEMTX_OK) { 552 return CMD_STALL; 553 } 554 555 size = (value & SIZE_MASK); 556 557 offset += NUM_BYTES_IN_DW; 558 value = address_space_ldq_le(as, s->cq.base_addr + offset, 559 MEMTXATTRS_UNSPECIFIED, &res); 560 561 if (res != MEMTX_OK) { 562 return CMD_STALL; 563 } 564 565 itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT; 566 567 valid = (value & CMD_FIELD_VALID_MASK); 568 569 if ((devid >= s->dt.num_ids) || 570 (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) { 571 qemu_log_mask(LOG_GUEST_ERROR, 572 "ITS MAPD: invalid device table attributes " 573 "devid %d or size %d\n", devid, size); 574 /* 575 * in this implementation, in case of error 576 * we ignore this command and move onto the next 577 * command in the queue 578 */ 579 return CMD_CONTINUE; 580 } 581 582 return update_dte(s, devid, valid, size, itt_addr) ? CMD_CONTINUE : CMD_STALL; 583 } 584 585 /* 586 * Current implementation blocks until all 587 * commands are processed 588 */ 589 static void process_cmdq(GICv3ITSState *s) 590 { 591 uint32_t wr_offset = 0; 592 uint32_t rd_offset = 0; 593 uint32_t cq_offset = 0; 594 uint64_t data; 595 AddressSpace *as = &s->gicv3->dma_as; 596 MemTxResult res = MEMTX_OK; 597 uint8_t cmd; 598 int i; 599 600 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 601 return; 602 } 603 604 wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET); 605 606 if (wr_offset >= s->cq.num_entries) { 607 qemu_log_mask(LOG_GUEST_ERROR, 608 "%s: invalid write offset " 609 "%d\n", __func__, wr_offset); 610 return; 611 } 612 613 rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET); 614 615 if (rd_offset >= s->cq.num_entries) { 616 qemu_log_mask(LOG_GUEST_ERROR, 617 "%s: invalid read offset " 618 "%d\n", __func__, rd_offset); 619 return; 620 } 621 622 while (wr_offset != rd_offset) { 623 ItsCmdResult result = CMD_CONTINUE; 624 625 cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE); 626 data = address_space_ldq_le(as, s->cq.base_addr + cq_offset, 627 MEMTXATTRS_UNSPECIFIED, &res); 628 if (res != MEMTX_OK) { 629 s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1); 630 qemu_log_mask(LOG_GUEST_ERROR, 631 "%s: could not read command at 0x%" PRIx64 "\n", 632 __func__, s->cq.base_addr + cq_offset); 633 break; 634 } 635 636 cmd = (data & CMD_MASK); 637 638 trace_gicv3_its_process_command(rd_offset, cmd); 639 640 switch (cmd) { 641 case GITS_CMD_INT: 642 result = process_its_cmd(s, data, cq_offset, INTERRUPT); 643 break; 644 case GITS_CMD_CLEAR: 645 result = process_its_cmd(s, data, cq_offset, CLEAR); 646 break; 647 case GITS_CMD_SYNC: 648 /* 649 * Current implementation makes a blocking synchronous call 650 * for every command issued earlier, hence the internal state 651 * is already consistent by the time SYNC command is executed. 652 * Hence no further processing is required for SYNC command. 653 */ 654 break; 655 case GITS_CMD_MAPD: 656 result = process_mapd(s, data, cq_offset); 657 break; 658 case GITS_CMD_MAPC: 659 result = process_mapc(s, cq_offset); 660 break; 661 case GITS_CMD_MAPTI: 662 result = process_mapti(s, data, cq_offset, false); 663 break; 664 case GITS_CMD_MAPI: 665 result = process_mapti(s, data, cq_offset, true); 666 break; 667 case GITS_CMD_DISCARD: 668 result = process_its_cmd(s, data, cq_offset, DISCARD); 669 break; 670 case GITS_CMD_INV: 671 case GITS_CMD_INVALL: 672 /* 673 * Current implementation doesn't cache any ITS tables, 674 * but the calculated lpi priority information. We only 675 * need to trigger lpi priority re-calculation to be in 676 * sync with LPI config table or pending table changes. 677 */ 678 for (i = 0; i < s->gicv3->num_cpu; i++) { 679 gicv3_redist_update_lpi(&s->gicv3->cpu[i]); 680 } 681 break; 682 default: 683 break; 684 } 685 if (result == CMD_CONTINUE) { 686 rd_offset++; 687 rd_offset %= s->cq.num_entries; 688 s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset); 689 } else { 690 /* CMD_STALL */ 691 s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1); 692 qemu_log_mask(LOG_GUEST_ERROR, 693 "%s: 0x%x cmd processing failed, stalling\n", 694 __func__, cmd); 695 break; 696 } 697 } 698 } 699 700 /* 701 * This function extracts the ITS Device and Collection table specific 702 * parameters (like base_addr, size etc) from GITS_BASER register. 703 * It is called during ITS enable and also during post_load migration 704 */ 705 static void extract_table_params(GICv3ITSState *s) 706 { 707 uint16_t num_pages = 0; 708 uint8_t page_sz_type; 709 uint8_t type; 710 uint32_t page_sz = 0; 711 uint64_t value; 712 713 for (int i = 0; i < 8; i++) { 714 TableDesc *td; 715 int idbits; 716 717 value = s->baser[i]; 718 719 if (!value) { 720 continue; 721 } 722 723 page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE); 724 725 switch (page_sz_type) { 726 case 0: 727 page_sz = GITS_PAGE_SIZE_4K; 728 break; 729 730 case 1: 731 page_sz = GITS_PAGE_SIZE_16K; 732 break; 733 734 case 2: 735 case 3: 736 page_sz = GITS_PAGE_SIZE_64K; 737 break; 738 739 default: 740 g_assert_not_reached(); 741 } 742 743 num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1; 744 745 type = FIELD_EX64(value, GITS_BASER, TYPE); 746 747 switch (type) { 748 case GITS_BASER_TYPE_DEVICE: 749 td = &s->dt; 750 idbits = FIELD_EX64(s->typer, GITS_TYPER, DEVBITS) + 1; 751 break; 752 case GITS_BASER_TYPE_COLLECTION: 753 td = &s->ct; 754 if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) { 755 idbits = FIELD_EX64(s->typer, GITS_TYPER, CIDBITS) + 1; 756 } else { 757 /* 16-bit CollectionId supported when CIL == 0 */ 758 idbits = 16; 759 } 760 break; 761 default: 762 /* 763 * GITS_BASER<n>.TYPE is read-only, so GITS_BASER_RO_MASK 764 * ensures we will only see type values corresponding to 765 * the values set up in gicv3_its_reset(). 766 */ 767 g_assert_not_reached(); 768 } 769 770 memset(td, 0, sizeof(*td)); 771 td->valid = FIELD_EX64(value, GITS_BASER, VALID); 772 /* 773 * If GITS_BASER<n>.Valid is 0 for any <n> then we will not process 774 * interrupts. (GITS_TYPER.HCC is 0 for this implementation, so we 775 * do not have a special case where the GITS_BASER<n>.Valid bit is 0 776 * for the register corresponding to the Collection table but we 777 * still have to process interrupts using non-memory-backed 778 * Collection table entries.) 779 */ 780 if (!td->valid) { 781 continue; 782 } 783 td->page_sz = page_sz; 784 td->indirect = FIELD_EX64(value, GITS_BASER, INDIRECT); 785 td->entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE) + 1; 786 td->base_addr = baser_base_addr(value, page_sz); 787 if (!td->indirect) { 788 td->num_entries = (num_pages * page_sz) / td->entry_sz; 789 } else { 790 td->num_entries = (((num_pages * page_sz) / 791 L1TABLE_ENTRY_SIZE) * 792 (page_sz / td->entry_sz)); 793 } 794 td->num_ids = 1ULL << idbits; 795 } 796 } 797 798 static void extract_cmdq_params(GICv3ITSState *s) 799 { 800 uint16_t num_pages = 0; 801 uint64_t value = s->cbaser; 802 803 num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1; 804 805 memset(&s->cq, 0 , sizeof(s->cq)); 806 s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID); 807 808 if (s->cq.valid) { 809 s->cq.num_entries = (num_pages * GITS_PAGE_SIZE_4K) / 810 GITS_CMDQ_ENTRY_SIZE; 811 s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR); 812 s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT; 813 } 814 } 815 816 static MemTxResult gicv3_its_translation_read(void *opaque, hwaddr offset, 817 uint64_t *data, unsigned size, 818 MemTxAttrs attrs) 819 { 820 /* 821 * GITS_TRANSLATER is write-only, and all other addresses 822 * in the interrupt translation space frame are RES0. 823 */ 824 *data = 0; 825 return MEMTX_OK; 826 } 827 828 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset, 829 uint64_t data, unsigned size, 830 MemTxAttrs attrs) 831 { 832 GICv3ITSState *s = (GICv3ITSState *)opaque; 833 bool result = true; 834 uint32_t devid = 0; 835 836 trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id); 837 838 switch (offset) { 839 case GITS_TRANSLATER: 840 if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) { 841 devid = attrs.requester_id; 842 result = process_its_cmd(s, data, devid, NONE); 843 } 844 break; 845 default: 846 break; 847 } 848 849 if (result) { 850 return MEMTX_OK; 851 } else { 852 return MEMTX_ERROR; 853 } 854 } 855 856 static bool its_writel(GICv3ITSState *s, hwaddr offset, 857 uint64_t value, MemTxAttrs attrs) 858 { 859 bool result = true; 860 int index; 861 862 switch (offset) { 863 case GITS_CTLR: 864 if (value & R_GITS_CTLR_ENABLED_MASK) { 865 s->ctlr |= R_GITS_CTLR_ENABLED_MASK; 866 extract_table_params(s); 867 extract_cmdq_params(s); 868 process_cmdq(s); 869 } else { 870 s->ctlr &= ~R_GITS_CTLR_ENABLED_MASK; 871 } 872 break; 873 case GITS_CBASER: 874 /* 875 * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is 876 * already enabled 877 */ 878 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 879 s->cbaser = deposit64(s->cbaser, 0, 32, value); 880 s->creadr = 0; 881 } 882 break; 883 case GITS_CBASER + 4: 884 /* 885 * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is 886 * already enabled 887 */ 888 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 889 s->cbaser = deposit64(s->cbaser, 32, 32, value); 890 s->creadr = 0; 891 } 892 break; 893 case GITS_CWRITER: 894 s->cwriter = deposit64(s->cwriter, 0, 32, 895 (value & ~R_GITS_CWRITER_RETRY_MASK)); 896 if (s->cwriter != s->creadr) { 897 process_cmdq(s); 898 } 899 break; 900 case GITS_CWRITER + 4: 901 s->cwriter = deposit64(s->cwriter, 32, 32, value); 902 break; 903 case GITS_CREADR: 904 if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) { 905 s->creadr = deposit64(s->creadr, 0, 32, 906 (value & ~R_GITS_CREADR_STALLED_MASK)); 907 } else { 908 /* RO register, ignore the write */ 909 qemu_log_mask(LOG_GUEST_ERROR, 910 "%s: invalid guest write to RO register at offset " 911 TARGET_FMT_plx "\n", __func__, offset); 912 } 913 break; 914 case GITS_CREADR + 4: 915 if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) { 916 s->creadr = deposit64(s->creadr, 32, 32, value); 917 } else { 918 /* RO register, ignore the write */ 919 qemu_log_mask(LOG_GUEST_ERROR, 920 "%s: invalid guest write to RO register at offset " 921 TARGET_FMT_plx "\n", __func__, offset); 922 } 923 break; 924 case GITS_BASER ... GITS_BASER + 0x3f: 925 /* 926 * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is 927 * already enabled 928 */ 929 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 930 index = (offset - GITS_BASER) / 8; 931 932 if (offset & 7) { 933 value <<= 32; 934 value &= ~GITS_BASER_RO_MASK; 935 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32); 936 s->baser[index] |= value; 937 } else { 938 value &= ~GITS_BASER_RO_MASK; 939 s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32); 940 s->baser[index] |= value; 941 } 942 } 943 break; 944 case GITS_IIDR: 945 case GITS_IDREGS ... GITS_IDREGS + 0x2f: 946 /* RO registers, ignore the write */ 947 qemu_log_mask(LOG_GUEST_ERROR, 948 "%s: invalid guest write to RO register at offset " 949 TARGET_FMT_plx "\n", __func__, offset); 950 break; 951 default: 952 result = false; 953 break; 954 } 955 return result; 956 } 957 958 static bool its_readl(GICv3ITSState *s, hwaddr offset, 959 uint64_t *data, MemTxAttrs attrs) 960 { 961 bool result = true; 962 int index; 963 964 switch (offset) { 965 case GITS_CTLR: 966 *data = s->ctlr; 967 break; 968 case GITS_IIDR: 969 *data = gicv3_iidr(); 970 break; 971 case GITS_IDREGS ... GITS_IDREGS + 0x2f: 972 /* ID registers */ 973 *data = gicv3_idreg(offset - GITS_IDREGS); 974 break; 975 case GITS_TYPER: 976 *data = extract64(s->typer, 0, 32); 977 break; 978 case GITS_TYPER + 4: 979 *data = extract64(s->typer, 32, 32); 980 break; 981 case GITS_CBASER: 982 *data = extract64(s->cbaser, 0, 32); 983 break; 984 case GITS_CBASER + 4: 985 *data = extract64(s->cbaser, 32, 32); 986 break; 987 case GITS_CREADR: 988 *data = extract64(s->creadr, 0, 32); 989 break; 990 case GITS_CREADR + 4: 991 *data = extract64(s->creadr, 32, 32); 992 break; 993 case GITS_CWRITER: 994 *data = extract64(s->cwriter, 0, 32); 995 break; 996 case GITS_CWRITER + 4: 997 *data = extract64(s->cwriter, 32, 32); 998 break; 999 case GITS_BASER ... GITS_BASER + 0x3f: 1000 index = (offset - GITS_BASER) / 8; 1001 if (offset & 7) { 1002 *data = extract64(s->baser[index], 32, 32); 1003 } else { 1004 *data = extract64(s->baser[index], 0, 32); 1005 } 1006 break; 1007 default: 1008 result = false; 1009 break; 1010 } 1011 return result; 1012 } 1013 1014 static bool its_writell(GICv3ITSState *s, hwaddr offset, 1015 uint64_t value, MemTxAttrs attrs) 1016 { 1017 bool result = true; 1018 int index; 1019 1020 switch (offset) { 1021 case GITS_BASER ... GITS_BASER + 0x3f: 1022 /* 1023 * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is 1024 * already enabled 1025 */ 1026 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 1027 index = (offset - GITS_BASER) / 8; 1028 s->baser[index] &= GITS_BASER_RO_MASK; 1029 s->baser[index] |= (value & ~GITS_BASER_RO_MASK); 1030 } 1031 break; 1032 case GITS_CBASER: 1033 /* 1034 * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is 1035 * already enabled 1036 */ 1037 if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) { 1038 s->cbaser = value; 1039 s->creadr = 0; 1040 } 1041 break; 1042 case GITS_CWRITER: 1043 s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK; 1044 if (s->cwriter != s->creadr) { 1045 process_cmdq(s); 1046 } 1047 break; 1048 case GITS_CREADR: 1049 if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) { 1050 s->creadr = value & ~R_GITS_CREADR_STALLED_MASK; 1051 } else { 1052 /* RO register, ignore the write */ 1053 qemu_log_mask(LOG_GUEST_ERROR, 1054 "%s: invalid guest write to RO register at offset " 1055 TARGET_FMT_plx "\n", __func__, offset); 1056 } 1057 break; 1058 case GITS_TYPER: 1059 /* RO registers, ignore the write */ 1060 qemu_log_mask(LOG_GUEST_ERROR, 1061 "%s: invalid guest write to RO register at offset " 1062 TARGET_FMT_plx "\n", __func__, offset); 1063 break; 1064 default: 1065 result = false; 1066 break; 1067 } 1068 return result; 1069 } 1070 1071 static bool its_readll(GICv3ITSState *s, hwaddr offset, 1072 uint64_t *data, MemTxAttrs attrs) 1073 { 1074 bool result = true; 1075 int index; 1076 1077 switch (offset) { 1078 case GITS_TYPER: 1079 *data = s->typer; 1080 break; 1081 case GITS_BASER ... GITS_BASER + 0x3f: 1082 index = (offset - GITS_BASER) / 8; 1083 *data = s->baser[index]; 1084 break; 1085 case GITS_CBASER: 1086 *data = s->cbaser; 1087 break; 1088 case GITS_CREADR: 1089 *data = s->creadr; 1090 break; 1091 case GITS_CWRITER: 1092 *data = s->cwriter; 1093 break; 1094 default: 1095 result = false; 1096 break; 1097 } 1098 return result; 1099 } 1100 1101 static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data, 1102 unsigned size, MemTxAttrs attrs) 1103 { 1104 GICv3ITSState *s = (GICv3ITSState *)opaque; 1105 bool result; 1106 1107 switch (size) { 1108 case 4: 1109 result = its_readl(s, offset, data, attrs); 1110 break; 1111 case 8: 1112 result = its_readll(s, offset, data, attrs); 1113 break; 1114 default: 1115 result = false; 1116 break; 1117 } 1118 1119 if (!result) { 1120 qemu_log_mask(LOG_GUEST_ERROR, 1121 "%s: invalid guest read at offset " TARGET_FMT_plx 1122 "size %u\n", __func__, offset, size); 1123 trace_gicv3_its_badread(offset, size); 1124 /* 1125 * The spec requires that reserved registers are RAZ/WI; 1126 * so use false returns from leaf functions as a way to 1127 * trigger the guest-error logging but don't return it to 1128 * the caller, or we'll cause a spurious guest data abort. 1129 */ 1130 *data = 0; 1131 } else { 1132 trace_gicv3_its_read(offset, *data, size); 1133 } 1134 return MEMTX_OK; 1135 } 1136 1137 static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data, 1138 unsigned size, MemTxAttrs attrs) 1139 { 1140 GICv3ITSState *s = (GICv3ITSState *)opaque; 1141 bool result; 1142 1143 switch (size) { 1144 case 4: 1145 result = its_writel(s, offset, data, attrs); 1146 break; 1147 case 8: 1148 result = its_writell(s, offset, data, attrs); 1149 break; 1150 default: 1151 result = false; 1152 break; 1153 } 1154 1155 if (!result) { 1156 qemu_log_mask(LOG_GUEST_ERROR, 1157 "%s: invalid guest write at offset " TARGET_FMT_plx 1158 "size %u\n", __func__, offset, size); 1159 trace_gicv3_its_badwrite(offset, data, size); 1160 /* 1161 * The spec requires that reserved registers are RAZ/WI; 1162 * so use false returns from leaf functions as a way to 1163 * trigger the guest-error logging but don't return it to 1164 * the caller, or we'll cause a spurious guest data abort. 1165 */ 1166 } else { 1167 trace_gicv3_its_write(offset, data, size); 1168 } 1169 return MEMTX_OK; 1170 } 1171 1172 static const MemoryRegionOps gicv3_its_control_ops = { 1173 .read_with_attrs = gicv3_its_read, 1174 .write_with_attrs = gicv3_its_write, 1175 .valid.min_access_size = 4, 1176 .valid.max_access_size = 8, 1177 .impl.min_access_size = 4, 1178 .impl.max_access_size = 8, 1179 .endianness = DEVICE_NATIVE_ENDIAN, 1180 }; 1181 1182 static const MemoryRegionOps gicv3_its_translation_ops = { 1183 .read_with_attrs = gicv3_its_translation_read, 1184 .write_with_attrs = gicv3_its_translation_write, 1185 .valid.min_access_size = 2, 1186 .valid.max_access_size = 4, 1187 .impl.min_access_size = 2, 1188 .impl.max_access_size = 4, 1189 .endianness = DEVICE_NATIVE_ENDIAN, 1190 }; 1191 1192 static void gicv3_arm_its_realize(DeviceState *dev, Error **errp) 1193 { 1194 GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev); 1195 int i; 1196 1197 for (i = 0; i < s->gicv3->num_cpu; i++) { 1198 if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) { 1199 error_setg(errp, "Physical LPI not supported by CPU %d", i); 1200 return; 1201 } 1202 } 1203 1204 gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops); 1205 1206 /* set the ITS default features supported */ 1207 s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1); 1208 s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE, 1209 ITS_ITT_ENTRY_SIZE - 1); 1210 s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS); 1211 s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS); 1212 s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1); 1213 s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS); 1214 } 1215 1216 static void gicv3_its_reset(DeviceState *dev) 1217 { 1218 GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev); 1219 GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s); 1220 1221 c->parent_reset(dev); 1222 1223 /* Quiescent bit reset to 1 */ 1224 s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1); 1225 1226 /* 1227 * setting GITS_BASER0.Type = 0b001 (Device) 1228 * GITS_BASER1.Type = 0b100 (Collection Table) 1229 * GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented) 1230 * GITS_BASER<0,1>.Page_Size = 64KB 1231 * and default translation table entry size to 16 bytes 1232 */ 1233 s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE, 1234 GITS_BASER_TYPE_DEVICE); 1235 s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE, 1236 GITS_BASER_PAGESIZE_64K); 1237 s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE, 1238 GITS_DTE_SIZE - 1); 1239 1240 s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE, 1241 GITS_BASER_TYPE_COLLECTION); 1242 s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE, 1243 GITS_BASER_PAGESIZE_64K); 1244 s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE, 1245 GITS_CTE_SIZE - 1); 1246 } 1247 1248 static void gicv3_its_post_load(GICv3ITSState *s) 1249 { 1250 if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) { 1251 extract_table_params(s); 1252 extract_cmdq_params(s); 1253 } 1254 } 1255 1256 static Property gicv3_its_props[] = { 1257 DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3", 1258 GICv3State *), 1259 DEFINE_PROP_END_OF_LIST(), 1260 }; 1261 1262 static void gicv3_its_class_init(ObjectClass *klass, void *data) 1263 { 1264 DeviceClass *dc = DEVICE_CLASS(klass); 1265 GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass); 1266 GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass); 1267 1268 dc->realize = gicv3_arm_its_realize; 1269 device_class_set_props(dc, gicv3_its_props); 1270 device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset); 1271 icc->post_load = gicv3_its_post_load; 1272 } 1273 1274 static const TypeInfo gicv3_its_info = { 1275 .name = TYPE_ARM_GICV3_ITS, 1276 .parent = TYPE_ARM_GICV3_ITS_COMMON, 1277 .instance_size = sizeof(GICv3ITSState), 1278 .class_init = gicv3_its_class_init, 1279 .class_size = sizeof(GICv3ITSClass), 1280 }; 1281 1282 static void gicv3_its_register_types(void) 1283 { 1284 type_register_static(&gicv3_its_info); 1285 } 1286 1287 type_init(gicv3_its_register_types) 1288