?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
hw/timer/sse-timer: Model the SSE Subsystem System Timer
[qemu/ar7.git] / hw / arm / smmuv3.c
blobbd1f97000d99cc14dba1cd9ab63214c48cc6a796
1 /*
2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19 #include "qemu/osdep.h"
20 #include "qemu/bitops.h"
21 #include "hw/irq.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "hw/qdev-core.h"
25 #include "hw/pci/pci.h"
26 #include "exec/address-spaces.h"
27 #include "cpu.h"
28 #include "trace.h"
29 #include "qemu/log.h"
30 #include "qemu/error-report.h"
31 #include "qapi/error.h"
32
33 #include "hw/arm/smmuv3.h"
34 #include "smmuv3-internal.h"
35
36 /**
37 * smmuv3_trigger_irq - pulse @irq if enabled and update
38 * GERROR register in case of GERROR interrupt
39 *
40 * @irq: irq type
41 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
42 */
43 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
44 uint32_t gerror_mask)
45 {
46
47 bool pulse = false;
48
49 switch (irq) {
50 case SMMU_IRQ_EVTQ:
51 pulse = smmuv3_eventq_irq_enabled(s);
52 break;
53 case SMMU_IRQ_PRIQ:
54 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
55 break;
56 case SMMU_IRQ_CMD_SYNC:
57 pulse = true;
58 break;
59 case SMMU_IRQ_GERROR:
60 {
61 uint32_t pending = s->gerror ^ s->gerrorn;
62 uint32_t new_gerrors = ~pending & gerror_mask;
63
64 if (!new_gerrors) {
65 /* only toggle non pending errors */
66 return;
67 }
68 s->gerror ^= new_gerrors;
69 trace_smmuv3_write_gerror(new_gerrors, s->gerror);
70
71 pulse = smmuv3_gerror_irq_enabled(s);
72 break;
73 }
74 }
75 if (pulse) {
76 trace_smmuv3_trigger_irq(irq);
77 qemu_irq_pulse(s->irq[irq]);
78 }
79 }
80
81 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
82 {
83 uint32_t pending = s->gerror ^ s->gerrorn;
84 uint32_t toggled = s->gerrorn ^ new_gerrorn;
85
86 if (toggled & ~pending) {
87 qemu_log_mask(LOG_GUEST_ERROR,
88 "guest toggles non pending errors = 0x%x\n",
89 toggled & ~pending);
90 }
91
92 /*
93 * We do not raise any error in case guest toggles bits corresponding
94 * to not active IRQs (CONSTRAINED UNPREDICTABLE)
95 */
96 s->gerrorn = new_gerrorn;
97
98 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
99 }
100
101 static inline MemTxResult queue_read(SMMUQueue *q, void *data)
102 {
103 dma_addr_t addr = Q_CONS_ENTRY(q);
104
105 return dma_memory_read(&address_space_memory, addr, data, q->entry_size);
106 }
107
108 static MemTxResult queue_write(SMMUQueue *q, void *data)
109 {
110 dma_addr_t addr = Q_PROD_ENTRY(q);
111 MemTxResult ret;
112
113 ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size);
114 if (ret != MEMTX_OK) {
115 return ret;
116 }
117
118 queue_prod_incr(q);
119 return MEMTX_OK;
120 }
121
122 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
123 {
124 SMMUQueue *q = &s->eventq;
125 MemTxResult r;
126
127 if (!smmuv3_eventq_enabled(s)) {
128 return MEMTX_ERROR;
129 }
130
131 if (smmuv3_q_full(q)) {
132 return MEMTX_ERROR;
133 }
134
135 r = queue_write(q, evt);
136 if (r != MEMTX_OK) {
137 return r;
138 }
139
140 if (!smmuv3_q_empty(q)) {
141 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
142 }
143 return MEMTX_OK;
144 }
145
146 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
147 {
148 Evt evt = {};
149 MemTxResult r;
150
151 if (!smmuv3_eventq_enabled(s)) {
152 return;
153 }
154
155 EVT_SET_TYPE(&evt, info->type);
156 EVT_SET_SID(&evt, info->sid);
157
158 switch (info->type) {
159 case SMMU_EVT_NONE:
160 return;
161 case SMMU_EVT_F_UUT:
162 EVT_SET_SSID(&evt, info->u.f_uut.ssid);
163 EVT_SET_SSV(&evt, info->u.f_uut.ssv);
164 EVT_SET_ADDR(&evt, info->u.f_uut.addr);
165 EVT_SET_RNW(&evt, info->u.f_uut.rnw);
166 EVT_SET_PNU(&evt, info->u.f_uut.pnu);
167 EVT_SET_IND(&evt, info->u.f_uut.ind);
168 break;
169 case SMMU_EVT_C_BAD_STREAMID:
170 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
171 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv);
172 break;
173 case SMMU_EVT_F_STE_FETCH:
174 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
175 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv);
176 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
177 break;
178 case SMMU_EVT_C_BAD_STE:
179 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
180 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv);
181 break;
182 case SMMU_EVT_F_STREAM_DISABLED:
183 break;
184 case SMMU_EVT_F_TRANS_FORBIDDEN:
185 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
186 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
187 break;
188 case SMMU_EVT_C_BAD_SUBSTREAMID:
189 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
190 break;
191 case SMMU_EVT_F_CD_FETCH:
192 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
193 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv);
194 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
195 break;
196 case SMMU_EVT_C_BAD_CD:
197 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
198 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv);
199 break;
200 case SMMU_EVT_F_WALK_EABT:
201 case SMMU_EVT_F_TRANSLATION:
202 case SMMU_EVT_F_ADDR_SIZE:
203 case SMMU_EVT_F_ACCESS:
204 case SMMU_EVT_F_PERMISSION:
205 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
206 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
207 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
208 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
209 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
210 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
211 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
212 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
213 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
214 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
215 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
216 break;
217 case SMMU_EVT_F_CFG_CONFLICT:
218 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
219 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv);
220 break;
221 /* rest is not implemented */
222 case SMMU_EVT_F_BAD_ATS_TREQ:
223 case SMMU_EVT_F_TLB_CONFLICT:
224 case SMMU_EVT_E_PAGE_REQ:
225 default:
226 g_assert_not_reached();
227 }
228
229 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
230 r = smmuv3_write_eventq(s, &evt);
231 if (r != MEMTX_OK) {
232 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
233 }
234 info->recorded = true;
235 }
236
237 static void smmuv3_init_regs(SMMUv3State *s)
238 {
239 /**
240 * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
241 * multi-level stream table
242 */
243 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
244 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
245 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
246 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
247 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
248 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
249 /* terminated transaction will always be aborted/error returned */
250 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
251 /* 2-level stream table supported */
252 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
253
254 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
255 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
256 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS);
257
258 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
259 s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
260
261 /* 4K and 64K granule support */
262 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
263 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
264 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
265
266 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
267 s->cmdq.prod = 0;
268 s->cmdq.cons = 0;
269 s->cmdq.entry_size = sizeof(struct Cmd);
270 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
271 s->eventq.prod = 0;
272 s->eventq.cons = 0;
273 s->eventq.entry_size = sizeof(struct Evt);
274
275 s->features = 0;
276 s->sid_split = 0;
277 s->aidr = 0x1;
278 }
279
280 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
281 SMMUEventInfo *event)
282 {
283 int ret;
284
285 trace_smmuv3_get_ste(addr);
286 /* TODO: guarantee 64-bit single-copy atomicity */
287 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf));
288 if (ret != MEMTX_OK) {
289 qemu_log_mask(LOG_GUEST_ERROR,
290 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
291 event->type = SMMU_EVT_F_STE_FETCH;
292 event->u.f_ste_fetch.addr = addr;
293 return -EINVAL;
294 }
295 return 0;
296
297 }
298
299 /* @ssid > 0 not supported yet */
300 static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
301 CD *buf, SMMUEventInfo *event)
302 {
303 dma_addr_t addr = STE_CTXPTR(ste);
304 int ret;
305
306 trace_smmuv3_get_cd(addr);
307 /* TODO: guarantee 64-bit single-copy atomicity */
308 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf));
309 if (ret != MEMTX_OK) {
310 qemu_log_mask(LOG_GUEST_ERROR,
311 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
312 event->type = SMMU_EVT_F_CD_FETCH;
313 event->u.f_ste_fetch.addr = addr;
314 return -EINVAL;
315 }
316 return 0;
317 }
318
319 /* Returns < 0 in case of invalid STE, 0 otherwise */
320 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
321 STE *ste, SMMUEventInfo *event)
322 {
323 uint32_t config;
324
325 if (!STE_VALID(ste)) {
326 if (!event->inval_ste_allowed) {
327 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n");
328 }
329 goto bad_ste;
330 }
331
332 config = STE_CONFIG(ste);
333
334 if (STE_CFG_ABORT(config)) {
335 cfg->aborted = true;
336 return 0;
337 }
338
339 if (STE_CFG_BYPASS(config)) {
340 cfg->bypassed = true;
341 return 0;
342 }
343
344 if (STE_CFG_S2_ENABLED(config)) {
345 qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
346 goto bad_ste;
347 }
348
349 if (STE_S1CDMAX(ste) != 0) {
350 qemu_log_mask(LOG_UNIMP,
351 "SMMUv3 does not support multiple context descriptors yet\n");
352 goto bad_ste;
353 }
354
355 if (STE_S1STALLD(ste)) {
356 qemu_log_mask(LOG_UNIMP,
357 "SMMUv3 S1 stalling fault model not allowed yet\n");
358 goto bad_ste;
359 }
360 return 0;
361
362 bad_ste:
363 event->type = SMMU_EVT_C_BAD_STE;
364 return -EINVAL;
365 }
366
367 /**
368 * smmu_find_ste - Return the stream table entry associated
369 * to the sid
370 *
371 * @s: smmuv3 handle
372 * @sid: stream ID
373 * @ste: returned stream table entry
374 * @event: handle to an event info
375 *
376 * Supports linear and 2-level stream table
377 * Return 0 on success, -EINVAL otherwise
378 */
379 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
380 SMMUEventInfo *event)
381 {
382 dma_addr_t addr, strtab_base;
383 uint32_t log2size;
384 int strtab_size_shift;
385 int ret;
386
387 trace_smmuv3_find_ste(sid, s->features, s->sid_split);
388 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
389 /*
390 * Check SID range against both guest-configured and implementation limits
391 */
392 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
393 event->type = SMMU_EVT_C_BAD_STREAMID;
394 return -EINVAL;
395 }
396 if (s->features & SMMU_FEATURE_2LVL_STE) {
397 int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
398 dma_addr_t l1ptr, l2ptr;
399 STEDesc l1std;
400
401 /*
402 * Align strtab base address to table size. For this purpose, assume it
403 * is not bounded by SMMU_IDR1_SIDSIZE.
404 */
405 strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
406 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
407 ~MAKE_64BIT_MASK(0, strtab_size_shift);
408 l1_ste_offset = sid >> s->sid_split;
409 l2_ste_offset = sid & ((1 << s->sid_split) - 1);
410 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
411 /* TODO: guarantee 64-bit single-copy atomicity */
412 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std,
413 sizeof(l1std));
414 if (ret != MEMTX_OK) {
415 qemu_log_mask(LOG_GUEST_ERROR,
416 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
417 event->type = SMMU_EVT_F_STE_FETCH;
418 event->u.f_ste_fetch.addr = l1ptr;
419 return -EINVAL;
420 }
421
422 span = L1STD_SPAN(&l1std);
423
424 if (!span) {
425 /* l2ptr is not valid */
426 if (!event->inval_ste_allowed) {
427 qemu_log_mask(LOG_GUEST_ERROR,
428 "invalid sid=%d (L1STD span=0)\n", sid);
429 }
430 event->type = SMMU_EVT_C_BAD_STREAMID;
431 return -EINVAL;
432 }
433 max_l2_ste = (1 << span) - 1;
434 l2ptr = l1std_l2ptr(&l1std);
435 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
436 l2ptr, l2_ste_offset, max_l2_ste);
437 if (l2_ste_offset > max_l2_ste) {
438 qemu_log_mask(LOG_GUEST_ERROR,
439 "l2_ste_offset=%d > max_l2_ste=%d\n",
440 l2_ste_offset, max_l2_ste);
441 event->type = SMMU_EVT_C_BAD_STE;
442 return -EINVAL;
443 }
444 addr = l2ptr + l2_ste_offset * sizeof(*ste);
445 } else {
446 strtab_size_shift = log2size + 5;
447 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
448 ~MAKE_64BIT_MASK(0, strtab_size_shift);
449 addr = strtab_base + sid * sizeof(*ste);
450 }
451
452 if (smmu_get_ste(s, addr, ste, event)) {
453 return -EINVAL;
454 }
455
456 return 0;
457 }
458
459 static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
460 {
461 int ret = -EINVAL;
462 int i;
463
464 if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
465 goto bad_cd;
466 }
467 if (!CD_A(cd)) {
468 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
469 }
470 if (CD_S(cd)) {
471 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
472 }
473 if (CD_HA(cd) || CD_HD(cd)) {
474 goto bad_cd; /* HTTU = 0 */
475 }
476
477 /* we support only those at the moment */
478 cfg->aa64 = true;
479 cfg->stage = 1;
480
481 cfg->oas = oas2bits(CD_IPS(cd));
482 cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
483 cfg->tbi = CD_TBI(cd);
484 cfg->asid = CD_ASID(cd);
485
486 trace_smmuv3_decode_cd(cfg->oas);
487
488 /* decode data dependent on TT */
489 for (i = 0; i <= 1; i++) {
490 int tg, tsz;
491 SMMUTransTableInfo *tt = &cfg->tt[i];
492
493 cfg->tt[i].disabled = CD_EPD(cd, i);
494 if (cfg->tt[i].disabled) {
495 continue;
496 }
497
498 tsz = CD_TSZ(cd, i);
499 if (tsz < 16 || tsz > 39) {
500 goto bad_cd;
501 }
502
503 tg = CD_TG(cd, i);
504 tt->granule_sz = tg2granule(tg, i);
505 if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {
506 goto bad_cd;
507 }
508
509 tt->tsz = tsz;
510 tt->ttb = CD_TTB(cd, i);
511 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
512 goto bad_cd;
513 }
514 tt->had = CD_HAD(cd, i);
515 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had);
516 }
517
518 event->record_trans_faults = CD_R(cd);
519
520 return 0;
521
522 bad_cd:
523 event->type = SMMU_EVT_C_BAD_CD;
524 return ret;
525 }
526
527 /**
528 * smmuv3_decode_config - Prepare the translation configuration
529 * for the @mr iommu region
530 * @mr: iommu memory region the translation config must be prepared for
531 * @cfg: output translation configuration which is populated through
532 * the different configuration decoding steps
533 * @event: must be zero'ed by the caller
534 *
535 * return < 0 in case of config decoding error (@event is filled
536 * accordingly). Return 0 otherwise.
537 */
538 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
539 SMMUEventInfo *event)
540 {
541 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
542 uint32_t sid = smmu_get_sid(sdev);
543 SMMUv3State *s = sdev->smmu;
544 int ret;
545 STE ste;
546 CD cd;
547
548 ret = smmu_find_ste(s, sid, &ste, event);
549 if (ret) {
550 return ret;
551 }
552
553 ret = decode_ste(s, cfg, &ste, event);
554 if (ret) {
555 return ret;
556 }
557
558 if (cfg->aborted || cfg->bypassed) {
559 return 0;
560 }
561
562 ret = smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event);
563 if (ret) {
564 return ret;
565 }
566
567 return decode_cd(cfg, &cd, event);
568 }
569
570 /**
571 * smmuv3_get_config - Look up for a cached copy of configuration data for
572 * @sdev and on cache miss performs a configuration structure decoding from
573 * guest RAM.
574 *
575 * @sdev: SMMUDevice handle
576 * @event: output event info
577 *
578 * The configuration cache contains data resulting from both STE and CD
579 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed
580 * by the SMMUDevice handle.
581 */
582 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event)
583 {
584 SMMUv3State *s = sdev->smmu;
585 SMMUState *bc = &s->smmu_state;
586 SMMUTransCfg *cfg;
587
588 cfg = g_hash_table_lookup(bc->configs, sdev);
589 if (cfg) {
590 sdev->cfg_cache_hits++;
591 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev),
592 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
593 100 * sdev->cfg_cache_hits /
594 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
595 } else {
596 sdev->cfg_cache_misses++;
597 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev),
598 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
599 100 * sdev->cfg_cache_hits /
600 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
601 cfg = g_new0(SMMUTransCfg, 1);
602
603 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) {
604 g_hash_table_insert(bc->configs, sdev, cfg);
605 } else {
606 g_free(cfg);
607 cfg = NULL;
608 }
609 }
610 return cfg;
611 }
612
613 static void smmuv3_flush_config(SMMUDevice *sdev)
614 {
615 SMMUv3State *s = sdev->smmu;
616 SMMUState *bc = &s->smmu_state;
617
618 trace_smmuv3_config_cache_inv(smmu_get_sid(sdev));
619 g_hash_table_remove(bc->configs, sdev);
620 }
621
622 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
623 IOMMUAccessFlags flag, int iommu_idx)
624 {
625 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
626 SMMUv3State *s = sdev->smmu;
627 uint32_t sid = smmu_get_sid(sdev);
628 SMMUEventInfo event = {.type = SMMU_EVT_NONE,
629 .sid = sid,
630 .inval_ste_allowed = false};
631 SMMUPTWEventInfo ptw_info = {};
632 SMMUTranslationStatus status;
633 SMMUState *bs = ARM_SMMU(s);
634 uint64_t page_mask, aligned_addr;
635 SMMUTLBEntry *cached_entry = NULL;
636 SMMUTransTableInfo *tt;
637 SMMUTransCfg *cfg = NULL;
638 IOMMUTLBEntry entry = {
639 .target_as = &address_space_memory,
640 .iova = addr,
641 .translated_addr = addr,
642 .addr_mask = ~(hwaddr)0,
643 .perm = IOMMU_NONE,
644 };
645
646 qemu_mutex_lock(&s->mutex);
647
648 if (!smmu_enabled(s)) {
649 status = SMMU_TRANS_DISABLE;
650 goto epilogue;
651 }
652
653 cfg = smmuv3_get_config(sdev, &event);
654 if (!cfg) {
655 status = SMMU_TRANS_ERROR;
656 goto epilogue;
657 }
658
659 if (cfg->aborted) {
660 status = SMMU_TRANS_ABORT;
661 goto epilogue;
662 }
663
664 if (cfg->bypassed) {
665 status = SMMU_TRANS_BYPASS;
666 goto epilogue;
667 }
668
669 tt = select_tt(cfg, addr);
670 if (!tt) {
671 if (event.record_trans_faults) {
672 event.type = SMMU_EVT_F_TRANSLATION;
673 event.u.f_translation.addr = addr;
674 event.u.f_translation.rnw = flag & 0x1;
675 }
676 status = SMMU_TRANS_ERROR;
677 goto epilogue;
678 }
679
680 page_mask = (1ULL << (tt->granule_sz)) - 1;
681 aligned_addr = addr & ~page_mask;
682
683 cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
684 if (cached_entry) {
685 if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
686 status = SMMU_TRANS_ERROR;
687 if (event.record_trans_faults) {
688 event.type = SMMU_EVT_F_PERMISSION;
689 event.u.f_permission.addr = addr;
690 event.u.f_permission.rnw = flag & 0x1;
691 }
692 } else {
693 status = SMMU_TRANS_SUCCESS;
694 }
695 goto epilogue;
696 }
697
698 cached_entry = g_new0(SMMUTLBEntry, 1);
699
700 if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
701 g_free(cached_entry);
702 switch (ptw_info.type) {
703 case SMMU_PTW_ERR_WALK_EABT:
704 event.type = SMMU_EVT_F_WALK_EABT;
705 event.u.f_walk_eabt.addr = addr;
706 event.u.f_walk_eabt.rnw = flag & 0x1;
707 event.u.f_walk_eabt.class = 0x1;
708 event.u.f_walk_eabt.addr2 = ptw_info.addr;
709 break;
710 case SMMU_PTW_ERR_TRANSLATION:
711 if (event.record_trans_faults) {
712 event.type = SMMU_EVT_F_TRANSLATION;
713 event.u.f_translation.addr = addr;
714 event.u.f_translation.rnw = flag & 0x1;
715 }
716 break;
717 case SMMU_PTW_ERR_ADDR_SIZE:
718 if (event.record_trans_faults) {
719 event.type = SMMU_EVT_F_ADDR_SIZE;
720 event.u.f_addr_size.addr = addr;
721 event.u.f_addr_size.rnw = flag & 0x1;
722 }
723 break;
724 case SMMU_PTW_ERR_ACCESS:
725 if (event.record_trans_faults) {
726 event.type = SMMU_EVT_F_ACCESS;
727 event.u.f_access.addr = addr;
728 event.u.f_access.rnw = flag & 0x1;
729 }
730 break;
731 case SMMU_PTW_ERR_PERMISSION:
732 if (event.record_trans_faults) {
733 event.type = SMMU_EVT_F_PERMISSION;
734 event.u.f_permission.addr = addr;
735 event.u.f_permission.rnw = flag & 0x1;
736 }
737 break;
738 default:
739 g_assert_not_reached();
740 }
741 status = SMMU_TRANS_ERROR;
742 } else {
743 smmu_iotlb_insert(bs, cfg, cached_entry);
744 status = SMMU_TRANS_SUCCESS;
745 }
746
747 epilogue:
748 qemu_mutex_unlock(&s->mutex);
749 switch (status) {
750 case SMMU_TRANS_SUCCESS:
751 entry.perm = flag;
752 entry.translated_addr = cached_entry->entry.translated_addr +
753 (addr & cached_entry->entry.addr_mask);
754 entry.addr_mask = cached_entry->entry.addr_mask;
755 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr,
756 entry.translated_addr, entry.perm);
757 break;
758 case SMMU_TRANS_DISABLE:
759 entry.perm = flag;
760 entry.addr_mask = ~TARGET_PAGE_MASK;
761 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr,
762 entry.perm);
763 break;
764 case SMMU_TRANS_BYPASS:
765 entry.perm = flag;
766 entry.addr_mask = ~TARGET_PAGE_MASK;
767 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr,
768 entry.perm);
769 break;
770 case SMMU_TRANS_ABORT:
771 /* no event is recorded on abort */
772 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr,
773 entry.perm);
774 break;
775 case SMMU_TRANS_ERROR:
776 qemu_log_mask(LOG_GUEST_ERROR,
777 "%s translation failed for iova=0x%"PRIx64"(%s)\n",
778 mr->parent_obj.name, addr, smmu_event_string(event.type));
779 smmuv3_record_event(s, &event);
780 break;
781 }
782
783 return entry;
784 }
785
786 /**
787 * smmuv3_notify_iova - call the notifier @n for a given
788 * @asid and @iova tuple.
789 *
790 * @mr: IOMMU mr region handle
791 * @n: notifier to be called
792 * @asid: address space ID or negative value if we don't care
793 * @iova: iova
794 * @tg: translation granule (if communicated through range invalidation)
795 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
796 */
797 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
798 IOMMUNotifier *n,
799 int asid, dma_addr_t iova,
800 uint8_t tg, uint64_t num_pages)
801 {
802 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
803 IOMMUTLBEvent event;
804 uint8_t granule;
805
806 if (!tg) {
807 SMMUEventInfo event = {.inval_ste_allowed = true};
808 SMMUTransCfg *cfg = smmuv3_get_config(sdev, &event);
809 SMMUTransTableInfo *tt;
810
811 if (!cfg) {
812 return;
813 }
814
815 if (asid >= 0 && cfg->asid != asid) {
816 return;
817 }
818
819 tt = select_tt(cfg, iova);
820 if (!tt) {
821 return;
822 }
823 granule = tt->granule_sz;
824 } else {
825 granule = tg * 2 + 10;
826 }
827
828 event.type = IOMMU_NOTIFIER_UNMAP;
829 event.entry.target_as = &address_space_memory;
830 event.entry.iova = iova;
831 event.entry.addr_mask = num_pages * (1 << granule) - 1;
832 event.entry.perm = IOMMU_NONE;
833
834 memory_region_notify_iommu_one(n, &event);
835 }
836
837 /* invalidate an asid/iova range tuple in all mr's */
838 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
839 uint8_t tg, uint64_t num_pages)
840 {
841 SMMUDevice *sdev;
842
843 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
844 IOMMUMemoryRegion *mr = &sdev->iommu;
845 IOMMUNotifier *n;
846
847 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
848 tg, num_pages);
849
850 IOMMU_NOTIFIER_FOREACH(n, mr) {
851 smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
852 }
853 }
854 }
855
856 static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
857 {
858 uint8_t scale = 0, num = 0, ttl = 0;
859 dma_addr_t addr = CMD_ADDR(cmd);
860 uint8_t type = CMD_TYPE(cmd);
861 uint16_t vmid = CMD_VMID(cmd);
862 bool leaf = CMD_LEAF(cmd);
863 uint8_t tg = CMD_TG(cmd);
864 hwaddr num_pages = 1;
865 int asid = -1;
866
867 if (tg) {
868 scale = CMD_SCALE(cmd);
869 num = CMD_NUM(cmd);
870 ttl = CMD_TTL(cmd);
871 num_pages = (num + 1) * BIT_ULL(scale);
872 }
873
874 if (type == SMMU_CMD_TLBI_NH_VA) {
875 asid = CMD_ASID(cmd);
876 }
877 trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
878 smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
879 smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
880 }
881
882 static int smmuv3_cmdq_consume(SMMUv3State *s)
883 {
884 SMMUState *bs = ARM_SMMU(s);
885 SMMUCmdError cmd_error = SMMU_CERROR_NONE;
886 SMMUQueue *q = &s->cmdq;
887 SMMUCommandType type = 0;
888
889 if (!smmuv3_cmdq_enabled(s)) {
890 return 0;
891 }
892 /*
893 * some commands depend on register values, typically CR0. In case those
894 * register values change while handling the command, spec says it
895 * is UNPREDICTABLE whether the command is interpreted under the new
896 * or old value.
897 */
898
899 while (!smmuv3_q_empty(q)) {
900 uint32_t pending = s->gerror ^ s->gerrorn;
901 Cmd cmd;
902
903 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
904 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
905
906 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
907 break;
908 }
909
910 if (queue_read(q, &cmd) != MEMTX_OK) {
911 cmd_error = SMMU_CERROR_ABT;
912 break;
913 }
914
915 type = CMD_TYPE(&cmd);
916
917 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
918
919 qemu_mutex_lock(&s->mutex);
920 switch (type) {
921 case SMMU_CMD_SYNC:
922 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
923 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
924 }
925 break;
926 case SMMU_CMD_PREFETCH_CONFIG:
927 case SMMU_CMD_PREFETCH_ADDR:
928 break;
929 case SMMU_CMD_CFGI_STE:
930 {
931 uint32_t sid = CMD_SID(&cmd);
932 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid);
933 SMMUDevice *sdev;
934
935 if (CMD_SSEC(&cmd)) {
936 cmd_error = SMMU_CERROR_ILL;
937 break;
938 }
939
940 if (!mr) {
941 break;
942 }
943
944 trace_smmuv3_cmdq_cfgi_ste(sid);
945 sdev = container_of(mr, SMMUDevice, iommu);
946 smmuv3_flush_config(sdev);
947
948 break;
949 }
950 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
951 {
952 uint32_t start = CMD_SID(&cmd), end, i;
953 uint8_t range = CMD_STE_RANGE(&cmd);
954
955 if (CMD_SSEC(&cmd)) {
956 cmd_error = SMMU_CERROR_ILL;
957 break;
958 }
959
960 end = start + (1 << (range + 1)) - 1;
961 trace_smmuv3_cmdq_cfgi_ste_range(start, end);
962
963 for (i = start; i <= end; i++) {
964 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, i);
965 SMMUDevice *sdev;
966
967 if (!mr) {
968 continue;
969 }
970 sdev = container_of(mr, SMMUDevice, iommu);
971 smmuv3_flush_config(sdev);
972 }
973 break;
974 }
975 case SMMU_CMD_CFGI_CD:
976 case SMMU_CMD_CFGI_CD_ALL:
977 {
978 uint32_t sid = CMD_SID(&cmd);
979 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid);
980 SMMUDevice *sdev;
981
982 if (CMD_SSEC(&cmd)) {
983 cmd_error = SMMU_CERROR_ILL;
984 break;
985 }
986
987 if (!mr) {
988 break;
989 }
990
991 trace_smmuv3_cmdq_cfgi_cd(sid);
992 sdev = container_of(mr, SMMUDevice, iommu);
993 smmuv3_flush_config(sdev);
994 break;
995 }
996 case SMMU_CMD_TLBI_NH_ASID:
997 {
998 uint16_t asid = CMD_ASID(&cmd);
999
1000 trace_smmuv3_cmdq_tlbi_nh_asid(asid);
1001 smmu_inv_notifiers_all(&s->smmu_state);
1002 smmu_iotlb_inv_asid(bs, asid);
1003 break;
1004 }
1005 case SMMU_CMD_TLBI_NH_ALL:
1006 case SMMU_CMD_TLBI_NSNH_ALL:
1007 trace_smmuv3_cmdq_tlbi_nh();
1008 smmu_inv_notifiers_all(&s->smmu_state);
1009 smmu_iotlb_inv_all(bs);
1010 break;
1011 case SMMU_CMD_TLBI_NH_VAA:
1012 case SMMU_CMD_TLBI_NH_VA:
1013 smmuv3_s1_range_inval(bs, &cmd);
1014 break;
1015 case SMMU_CMD_TLBI_EL3_ALL:
1016 case SMMU_CMD_TLBI_EL3_VA:
1017 case SMMU_CMD_TLBI_EL2_ALL:
1018 case SMMU_CMD_TLBI_EL2_ASID:
1019 case SMMU_CMD_TLBI_EL2_VA:
1020 case SMMU_CMD_TLBI_EL2_VAA:
1021 case SMMU_CMD_TLBI_S12_VMALL:
1022 case SMMU_CMD_TLBI_S2_IPA:
1023 case SMMU_CMD_ATC_INV:
1024 case SMMU_CMD_PRI_RESP:
1025 case SMMU_CMD_RESUME:
1026 case SMMU_CMD_STALL_TERM:
1027 trace_smmuv3_unhandled_cmd(type);
1028 break;
1029 default:
1030 cmd_error = SMMU_CERROR_ILL;
1031 qemu_log_mask(LOG_GUEST_ERROR,
1032 "Illegal command type: %d\n", CMD_TYPE(&cmd));
1033 break;
1034 }
1035 qemu_mutex_unlock(&s->mutex);
1036 if (cmd_error) {
1037 break;
1038 }
1039 /*
1040 * We only increment the cons index after the completion of
1041 * the command. We do that because the SYNC returns immediately
1042 * and does not check the completion of previous commands
1043 */
1044 queue_cons_incr(q);
1045 }
1046
1047 if (cmd_error) {
1048 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
1049 smmu_write_cmdq_err(s, cmd_error);
1050 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
1051 }
1052
1053 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
1054 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1055
1056 return 0;
1057 }
1058
1059 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
1060 uint64_t data, MemTxAttrs attrs)
1061 {
1062 switch (offset) {
1063 case A_GERROR_IRQ_CFG0:
1064 s->gerror_irq_cfg0 = data;
1065 return MEMTX_OK;
1066 case A_STRTAB_BASE:
1067 s->strtab_base = data;
1068 return MEMTX_OK;
1069 case A_CMDQ_BASE:
1070 s->cmdq.base = data;
1071 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1072 if (s->cmdq.log2size > SMMU_CMDQS) {
1073 s->cmdq.log2size = SMMU_CMDQS;
1074 }
1075 return MEMTX_OK;
1076 case A_EVENTQ_BASE:
1077 s->eventq.base = data;
1078 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1079 if (s->eventq.log2size > SMMU_EVENTQS) {
1080 s->eventq.log2size = SMMU_EVENTQS;
1081 }
1082 return MEMTX_OK;
1083 case A_EVENTQ_IRQ_CFG0:
1084 s->eventq_irq_cfg0 = data;
1085 return MEMTX_OK;
1086 default:
1087 qemu_log_mask(LOG_UNIMP,
1088 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
1089 __func__, offset);
1090 return MEMTX_OK;
1091 }
1092 }
1093
1094 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
1095 uint64_t data, MemTxAttrs attrs)
1096 {
1097 switch (offset) {
1098 case A_CR0:
1099 s->cr[0] = data;
1100 s->cr0ack = data & ~SMMU_CR0_RESERVED;
1101 /* in case the command queue has been enabled */
1102 smmuv3_cmdq_consume(s);
1103 return MEMTX_OK;
1104 case A_CR1:
1105 s->cr[1] = data;
1106 return MEMTX_OK;
1107 case A_CR2:
1108 s->cr[2] = data;
1109 return MEMTX_OK;
1110 case A_IRQ_CTRL:
1111 s->irq_ctrl = data;
1112 return MEMTX_OK;
1113 case A_GERRORN:
1114 smmuv3_write_gerrorn(s, data);
1115 /*
1116 * By acknowledging the CMDQ_ERR, SW may notify cmds can
1117 * be processed again
1118 */
1119 smmuv3_cmdq_consume(s);
1120 return MEMTX_OK;
1121 case A_GERROR_IRQ_CFG0: /* 64b */
1122 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
1123 return MEMTX_OK;
1124 case A_GERROR_IRQ_CFG0 + 4:
1125 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
1126 return MEMTX_OK;
1127 case A_GERROR_IRQ_CFG1:
1128 s->gerror_irq_cfg1 = data;
1129 return MEMTX_OK;
1130 case A_GERROR_IRQ_CFG2:
1131 s->gerror_irq_cfg2 = data;
1132 return MEMTX_OK;
1133 case A_STRTAB_BASE: /* 64b */
1134 s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
1135 return MEMTX_OK;
1136 case A_STRTAB_BASE + 4:
1137 s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
1138 return MEMTX_OK;
1139 case A_STRTAB_BASE_CFG:
1140 s->strtab_base_cfg = data;
1141 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
1142 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
1143 s->features |= SMMU_FEATURE_2LVL_STE;
1144 }
1145 return MEMTX_OK;
1146 case A_CMDQ_BASE: /* 64b */
1147 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
1148 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1149 if (s->cmdq.log2size > SMMU_CMDQS) {
1150 s->cmdq.log2size = SMMU_CMDQS;
1151 }
1152 return MEMTX_OK;
1153 case A_CMDQ_BASE + 4: /* 64b */
1154 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
1155 return MEMTX_OK;
1156 case A_CMDQ_PROD:
1157 s->cmdq.prod = data;
1158 smmuv3_cmdq_consume(s);
1159 return MEMTX_OK;
1160 case A_CMDQ_CONS:
1161 s->cmdq.cons = data;
1162 return MEMTX_OK;
1163 case A_EVENTQ_BASE: /* 64b */
1164 s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
1165 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1166 if (s->eventq.log2size > SMMU_EVENTQS) {
1167 s->eventq.log2size = SMMU_EVENTQS;
1168 }
1169 return MEMTX_OK;
1170 case A_EVENTQ_BASE + 4:
1171 s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
1172 return MEMTX_OK;
1173 case A_EVENTQ_PROD:
1174 s->eventq.prod = data;
1175 return MEMTX_OK;
1176 case A_EVENTQ_CONS:
1177 s->eventq.cons = data;
1178 return MEMTX_OK;
1179 case A_EVENTQ_IRQ_CFG0: /* 64b */
1180 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
1181 return MEMTX_OK;
1182 case A_EVENTQ_IRQ_CFG0 + 4:
1183 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
1184 return MEMTX_OK;
1185 case A_EVENTQ_IRQ_CFG1:
1186 s->eventq_irq_cfg1 = data;
1187 return MEMTX_OK;
1188 case A_EVENTQ_IRQ_CFG2:
1189 s->eventq_irq_cfg2 = data;
1190 return MEMTX_OK;
1191 default:
1192 qemu_log_mask(LOG_UNIMP,
1193 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
1194 __func__, offset);
1195 return MEMTX_OK;
1196 }
1197 }
1198
1199 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
1200 unsigned size, MemTxAttrs attrs)
1201 {
1202 SMMUState *sys = opaque;
1203 SMMUv3State *s = ARM_SMMUV3(sys);
1204 MemTxResult r;
1205
1206 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1207 offset &= ~0x10000;
1208
1209 switch (size) {
1210 case 8:
1211 r = smmu_writell(s, offset, data, attrs);
1212 break;
1213 case 4:
1214 r = smmu_writel(s, offset, data, attrs);
1215 break;
1216 default:
1217 r = MEMTX_ERROR;
1218 break;
1219 }
1220
1221 trace_smmuv3_write_mmio(offset, data, size, r);
1222 return r;
1223 }
1224
1225 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
1226 uint64_t *data, MemTxAttrs attrs)
1227 {
1228 switch (offset) {
1229 case A_GERROR_IRQ_CFG0:
1230 *data = s->gerror_irq_cfg0;
1231 return MEMTX_OK;
1232 case A_STRTAB_BASE:
1233 *data = s->strtab_base;
1234 return MEMTX_OK;
1235 case A_CMDQ_BASE:
1236 *data = s->cmdq.base;
1237 return MEMTX_OK;
1238 case A_EVENTQ_BASE:
1239 *data = s->eventq.base;
1240 return MEMTX_OK;
1241 default:
1242 *data = 0;
1243 qemu_log_mask(LOG_UNIMP,
1244 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
1245 __func__, offset);
1246 return MEMTX_OK;
1247 }
1248 }
1249
1250 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
1251 uint64_t *data, MemTxAttrs attrs)
1252 {
1253 switch (offset) {
1254 case A_IDREGS ... A_IDREGS + 0x2f:
1255 *data = smmuv3_idreg(offset - A_IDREGS);
1256 return MEMTX_OK;
1257 case A_IDR0 ... A_IDR5:
1258 *data = s->idr[(offset - A_IDR0) / 4];
1259 return MEMTX_OK;
1260 case A_IIDR:
1261 *data = s->iidr;
1262 return MEMTX_OK;
1263 case A_AIDR:
1264 *data = s->aidr;
1265 return MEMTX_OK;
1266 case A_CR0:
1267 *data = s->cr[0];
1268 return MEMTX_OK;
1269 case A_CR0ACK:
1270 *data = s->cr0ack;
1271 return MEMTX_OK;
1272 case A_CR1:
1273 *data = s->cr[1];
1274 return MEMTX_OK;
1275 case A_CR2:
1276 *data = s->cr[2];
1277 return MEMTX_OK;
1278 case A_STATUSR:
1279 *data = s->statusr;
1280 return MEMTX_OK;
1281 case A_IRQ_CTRL:
1282 case A_IRQ_CTRL_ACK:
1283 *data = s->irq_ctrl;
1284 return MEMTX_OK;
1285 case A_GERROR:
1286 *data = s->gerror;
1287 return MEMTX_OK;
1288 case A_GERRORN:
1289 *data = s->gerrorn;
1290 return MEMTX_OK;
1291 case A_GERROR_IRQ_CFG0: /* 64b */
1292 *data = extract64(s->gerror_irq_cfg0, 0, 32);
1293 return MEMTX_OK;
1294 case A_GERROR_IRQ_CFG0 + 4:
1295 *data = extract64(s->gerror_irq_cfg0, 32, 32);
1296 return MEMTX_OK;
1297 case A_GERROR_IRQ_CFG1:
1298 *data = s->gerror_irq_cfg1;
1299 return MEMTX_OK;
1300 case A_GERROR_IRQ_CFG2:
1301 *data = s->gerror_irq_cfg2;
1302 return MEMTX_OK;
1303 case A_STRTAB_BASE: /* 64b */
1304 *data = extract64(s->strtab_base, 0, 32);
1305 return MEMTX_OK;
1306 case A_STRTAB_BASE + 4: /* 64b */
1307 *data = extract64(s->strtab_base, 32, 32);
1308 return MEMTX_OK;
1309 case A_STRTAB_BASE_CFG:
1310 *data = s->strtab_base_cfg;
1311 return MEMTX_OK;
1312 case A_CMDQ_BASE: /* 64b */
1313 *data = extract64(s->cmdq.base, 0, 32);
1314 return MEMTX_OK;
1315 case A_CMDQ_BASE + 4:
1316 *data = extract64(s->cmdq.base, 32, 32);
1317 return MEMTX_OK;
1318 case A_CMDQ_PROD:
1319 *data = s->cmdq.prod;
1320 return MEMTX_OK;
1321 case A_CMDQ_CONS:
1322 *data = s->cmdq.cons;
1323 return MEMTX_OK;
1324 case A_EVENTQ_BASE: /* 64b */
1325 *data = extract64(s->eventq.base, 0, 32);
1326 return MEMTX_OK;
1327 case A_EVENTQ_BASE + 4: /* 64b */
1328 *data = extract64(s->eventq.base, 32, 32);
1329 return MEMTX_OK;
1330 case A_EVENTQ_PROD:
1331 *data = s->eventq.prod;
1332 return MEMTX_OK;
1333 case A_EVENTQ_CONS:
1334 *data = s->eventq.cons;
1335 return MEMTX_OK;
1336 default:
1337 *data = 0;
1338 qemu_log_mask(LOG_UNIMP,
1339 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
1340 __func__, offset);
1341 return MEMTX_OK;
1342 }
1343 }
1344
1345 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
1346 unsigned size, MemTxAttrs attrs)
1347 {
1348 SMMUState *sys = opaque;
1349 SMMUv3State *s = ARM_SMMUV3(sys);
1350 MemTxResult r;
1351
1352 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1353 offset &= ~0x10000;
1354
1355 switch (size) {
1356 case 8:
1357 r = smmu_readll(s, offset, data, attrs);
1358 break;
1359 case 4:
1360 r = smmu_readl(s, offset, data, attrs);
1361 break;
1362 default:
1363 r = MEMTX_ERROR;
1364 break;
1365 }
1366
1367 trace_smmuv3_read_mmio(offset, *data, size, r);
1368 return r;
1369 }
1370
1371 static const MemoryRegionOps smmu_mem_ops = {
1372 .read_with_attrs = smmu_read_mmio,
1373 .write_with_attrs = smmu_write_mmio,
1374 .endianness = DEVICE_LITTLE_ENDIAN,
1375 .valid = {
1376 .min_access_size = 4,
1377 .max_access_size = 8,
1378 },
1379 .impl = {
1380 .min_access_size = 4,
1381 .max_access_size = 8,
1382 },
1383 };
1384
1385 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
1386 {
1387 int i;
1388
1389 for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
1390 sysbus_init_irq(dev, &s->irq[i]);
1391 }
1392 }
1393
1394 static void smmu_reset(DeviceState *dev)
1395 {
1396 SMMUv3State *s = ARM_SMMUV3(dev);
1397 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1398
1399 c->parent_reset(dev);
1400
1401 smmuv3_init_regs(s);
1402 }
1403
1404 static void smmu_realize(DeviceState *d, Error **errp)
1405 {
1406 SMMUState *sys = ARM_SMMU(d);
1407 SMMUv3State *s = ARM_SMMUV3(sys);
1408 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1409 SysBusDevice *dev = SYS_BUS_DEVICE(d);
1410 Error *local_err = NULL;
1411
1412 c->parent_realize(d, &local_err);
1413 if (local_err) {
1414 error_propagate(errp, local_err);
1415 return;
1416 }
1417
1418 qemu_mutex_init(&s->mutex);
1419
1420 memory_region_init_io(&sys->iomem, OBJECT(s),
1421 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
1422
1423 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
1424
1425 sysbus_init_mmio(dev, &sys->iomem);
1426
1427 smmu_init_irq(s, dev);
1428 }
1429
1430 static const VMStateDescription vmstate_smmuv3_queue = {
1431 .name = "smmuv3_queue",
1432 .version_id = 1,
1433 .minimum_version_id = 1,
1434 .fields = (VMStateField[]) {
1435 VMSTATE_UINT64(base, SMMUQueue),
1436 VMSTATE_UINT32(prod, SMMUQueue),
1437 VMSTATE_UINT32(cons, SMMUQueue),
1438 VMSTATE_UINT8(log2size, SMMUQueue),
1439 VMSTATE_END_OF_LIST(),
1440 },
1441 };
1442
1443 static const VMStateDescription vmstate_smmuv3 = {
1444 .name = "smmuv3",
1445 .version_id = 1,
1446 .minimum_version_id = 1,
1447 .priority = MIG_PRI_IOMMU,
1448 .fields = (VMStateField[]) {
1449 VMSTATE_UINT32(features, SMMUv3State),
1450 VMSTATE_UINT8(sid_size, SMMUv3State),
1451 VMSTATE_UINT8(sid_split, SMMUv3State),
1452
1453 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
1454 VMSTATE_UINT32(cr0ack, SMMUv3State),
1455 VMSTATE_UINT32(statusr, SMMUv3State),
1456 VMSTATE_UINT32(irq_ctrl, SMMUv3State),
1457 VMSTATE_UINT32(gerror, SMMUv3State),
1458 VMSTATE_UINT32(gerrorn, SMMUv3State),
1459 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
1460 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
1461 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
1462 VMSTATE_UINT64(strtab_base, SMMUv3State),
1463 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
1464 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
1465 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
1466 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
1467
1468 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1469 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1470
1471 VMSTATE_END_OF_LIST(),
1472 },
1473 };
1474
1475 static void smmuv3_instance_init(Object *obj)
1476 {
1477 /* Nothing much to do here as of now */
1478 }
1479
1480 static void smmuv3_class_init(ObjectClass *klass, void *data)
1481 {
1482 DeviceClass *dc = DEVICE_CLASS(klass);
1483 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
1484
1485 dc->vmsd = &vmstate_smmuv3;
1486 device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset);
1487 c->parent_realize = dc->realize;
1488 dc->realize = smmu_realize;
1489 }
1490
1491 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
1492 IOMMUNotifierFlag old,
1493 IOMMUNotifierFlag new,
1494 Error **errp)
1495 {
1496 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu);
1497 SMMUv3State *s3 = sdev->smmu;
1498 SMMUState *s = &(s3->smmu_state);
1499
1500 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
1501 error_setg(errp, "SMMUv3 does not support dev-iotlb yet");
1502 return -EINVAL;
1503 }
1504
1505 if (new & IOMMU_NOTIFIER_MAP) {
1506 error_setg(errp,
1507 "device %02x.%02x.%x requires iommu MAP notifier which is "
1508 "not currently supported", pci_bus_num(sdev->bus),
1509 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn));
1510 return -EINVAL;
1511 }
1512
1513 if (old == IOMMU_NOTIFIER_NONE) {
1514 trace_smmuv3_notify_flag_add(iommu->parent_obj.name);
1515 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next);
1516 } else if (new == IOMMU_NOTIFIER_NONE) {
1517 trace_smmuv3_notify_flag_del(iommu->parent_obj.name);
1518 QLIST_REMOVE(sdev, next);
1519 }
1520 return 0;
1521 }
1522
1523 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
1524 void *data)
1525 {
1526 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1527
1528 imrc->translate = smmuv3_translate;
1529 imrc->notify_flag_changed = smmuv3_notify_flag_changed;
1530 }
1531
1532 static const TypeInfo smmuv3_type_info = {
1533 .name = TYPE_ARM_SMMUV3,
1534 .parent = TYPE_ARM_SMMU,
1535 .instance_size = sizeof(SMMUv3State),
1536 .instance_init = smmuv3_instance_init,
1537 .class_size = sizeof(SMMUv3Class),
1538 .class_init = smmuv3_class_init,
1539 };
1540
1541 static const TypeInfo smmuv3_iommu_memory_region_info = {
1542 .parent = TYPE_IOMMU_MEMORY_REGION,
1543 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
1544 .class_init = smmuv3_iommu_memory_region_class_init,
1545 };
1546
1547 static void smmuv3_register_types(void)
1548 {
1549 type_register(&smmuv3_type_info);
1550 type_register(&smmuv3_iommu_memory_region_info);
1551 }
1552
1553 type_init(smmuv3_register_types)
1554
AR7 emulation for QEMU