2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, see <http://www.gnu.org/licenses/>.
19 #include "qemu/osdep.h"
20 #include "qemu/bitops.h"
22 #include "hw/sysbus.h"
23 #include "migration/vmstate.h"
24 #include "hw/qdev-core.h"
25 #include "hw/pci/pci.h"
29 #include "qemu/error-report.h"
30 #include "qapi/error.h"
32 #include "hw/arm/smmuv3.h"
33 #include "smmuv3-internal.h"
34 #include "smmu-internal.h"
36 #define PTW_RECORD_FAULT(cfg) (((cfg)->stage == 1) ? (cfg)->record_faults : \
37 (cfg)->s2cfg.record_faults)
40 * smmuv3_trigger_irq - pulse @irq if enabled and update
41 * GERROR register in case of GERROR interrupt
44 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
46 static void smmuv3_trigger_irq(SMMUv3State
*s
, SMMUIrq irq
,
54 pulse
= smmuv3_eventq_irq_enabled(s
);
57 qemu_log_mask(LOG_UNIMP
, "PRI not yet supported\n");
59 case SMMU_IRQ_CMD_SYNC
:
64 uint32_t pending
= s
->gerror
^ s
->gerrorn
;
65 uint32_t new_gerrors
= ~pending
& gerror_mask
;
68 /* only toggle non pending errors */
71 s
->gerror
^= new_gerrors
;
72 trace_smmuv3_write_gerror(new_gerrors
, s
->gerror
);
74 pulse
= smmuv3_gerror_irq_enabled(s
);
79 trace_smmuv3_trigger_irq(irq
);
80 qemu_irq_pulse(s
->irq
[irq
]);
84 static void smmuv3_write_gerrorn(SMMUv3State
*s
, uint32_t new_gerrorn
)
86 uint32_t pending
= s
->gerror
^ s
->gerrorn
;
87 uint32_t toggled
= s
->gerrorn
^ new_gerrorn
;
89 if (toggled
& ~pending
) {
90 qemu_log_mask(LOG_GUEST_ERROR
,
91 "guest toggles non pending errors = 0x%x\n",
96 * We do not raise any error in case guest toggles bits corresponding
97 * to not active IRQs (CONSTRAINED UNPREDICTABLE)
99 s
->gerrorn
= new_gerrorn
;
101 trace_smmuv3_write_gerrorn(toggled
& pending
, s
->gerrorn
);
104 static inline MemTxResult
queue_read(SMMUQueue
*q
, void *data
)
106 dma_addr_t addr
= Q_CONS_ENTRY(q
);
108 return dma_memory_read(&address_space_memory
, addr
, data
, q
->entry_size
,
109 MEMTXATTRS_UNSPECIFIED
);
112 static MemTxResult
queue_write(SMMUQueue
*q
, void *data
)
114 dma_addr_t addr
= Q_PROD_ENTRY(q
);
117 ret
= dma_memory_write(&address_space_memory
, addr
, data
, q
->entry_size
,
118 MEMTXATTRS_UNSPECIFIED
);
119 if (ret
!= MEMTX_OK
) {
127 static MemTxResult
smmuv3_write_eventq(SMMUv3State
*s
, Evt
*evt
)
129 SMMUQueue
*q
= &s
->eventq
;
132 if (!smmuv3_eventq_enabled(s
)) {
136 if (smmuv3_q_full(q
)) {
140 r
= queue_write(q
, evt
);
145 if (!smmuv3_q_empty(q
)) {
146 smmuv3_trigger_irq(s
, SMMU_IRQ_EVTQ
, 0);
151 void smmuv3_record_event(SMMUv3State
*s
, SMMUEventInfo
*info
)
156 if (!smmuv3_eventq_enabled(s
)) {
160 EVT_SET_TYPE(&evt
, info
->type
);
161 EVT_SET_SID(&evt
, info
->sid
);
163 switch (info
->type
) {
167 EVT_SET_SSID(&evt
, info
->u
.f_uut
.ssid
);
168 EVT_SET_SSV(&evt
, info
->u
.f_uut
.ssv
);
169 EVT_SET_ADDR(&evt
, info
->u
.f_uut
.addr
);
170 EVT_SET_RNW(&evt
, info
->u
.f_uut
.rnw
);
171 EVT_SET_PNU(&evt
, info
->u
.f_uut
.pnu
);
172 EVT_SET_IND(&evt
, info
->u
.f_uut
.ind
);
174 case SMMU_EVT_C_BAD_STREAMID
:
175 EVT_SET_SSID(&evt
, info
->u
.c_bad_streamid
.ssid
);
176 EVT_SET_SSV(&evt
, info
->u
.c_bad_streamid
.ssv
);
178 case SMMU_EVT_F_STE_FETCH
:
179 EVT_SET_SSID(&evt
, info
->u
.f_ste_fetch
.ssid
);
180 EVT_SET_SSV(&evt
, info
->u
.f_ste_fetch
.ssv
);
181 EVT_SET_ADDR2(&evt
, info
->u
.f_ste_fetch
.addr
);
183 case SMMU_EVT_C_BAD_STE
:
184 EVT_SET_SSID(&evt
, info
->u
.c_bad_ste
.ssid
);
185 EVT_SET_SSV(&evt
, info
->u
.c_bad_ste
.ssv
);
187 case SMMU_EVT_F_STREAM_DISABLED
:
189 case SMMU_EVT_F_TRANS_FORBIDDEN
:
190 EVT_SET_ADDR(&evt
, info
->u
.f_transl_forbidden
.addr
);
191 EVT_SET_RNW(&evt
, info
->u
.f_transl_forbidden
.rnw
);
193 case SMMU_EVT_C_BAD_SUBSTREAMID
:
194 EVT_SET_SSID(&evt
, info
->u
.c_bad_substream
.ssid
);
196 case SMMU_EVT_F_CD_FETCH
:
197 EVT_SET_SSID(&evt
, info
->u
.f_cd_fetch
.ssid
);
198 EVT_SET_SSV(&evt
, info
->u
.f_cd_fetch
.ssv
);
199 EVT_SET_ADDR(&evt
, info
->u
.f_cd_fetch
.addr
);
201 case SMMU_EVT_C_BAD_CD
:
202 EVT_SET_SSID(&evt
, info
->u
.c_bad_cd
.ssid
);
203 EVT_SET_SSV(&evt
, info
->u
.c_bad_cd
.ssv
);
205 case SMMU_EVT_F_WALK_EABT
:
206 case SMMU_EVT_F_TRANSLATION
:
207 case SMMU_EVT_F_ADDR_SIZE
:
208 case SMMU_EVT_F_ACCESS
:
209 case SMMU_EVT_F_PERMISSION
:
210 EVT_SET_STALL(&evt
, info
->u
.f_walk_eabt
.stall
);
211 EVT_SET_STAG(&evt
, info
->u
.f_walk_eabt
.stag
);
212 EVT_SET_SSID(&evt
, info
->u
.f_walk_eabt
.ssid
);
213 EVT_SET_SSV(&evt
, info
->u
.f_walk_eabt
.ssv
);
214 EVT_SET_S2(&evt
, info
->u
.f_walk_eabt
.s2
);
215 EVT_SET_ADDR(&evt
, info
->u
.f_walk_eabt
.addr
);
216 EVT_SET_RNW(&evt
, info
->u
.f_walk_eabt
.rnw
);
217 EVT_SET_PNU(&evt
, info
->u
.f_walk_eabt
.pnu
);
218 EVT_SET_IND(&evt
, info
->u
.f_walk_eabt
.ind
);
219 EVT_SET_CLASS(&evt
, info
->u
.f_walk_eabt
.class);
220 EVT_SET_ADDR2(&evt
, info
->u
.f_walk_eabt
.addr2
);
222 case SMMU_EVT_F_CFG_CONFLICT
:
223 EVT_SET_SSID(&evt
, info
->u
.f_cfg_conflict
.ssid
);
224 EVT_SET_SSV(&evt
, info
->u
.f_cfg_conflict
.ssv
);
226 /* rest is not implemented */
227 case SMMU_EVT_F_BAD_ATS_TREQ
:
228 case SMMU_EVT_F_TLB_CONFLICT
:
229 case SMMU_EVT_E_PAGE_REQ
:
231 g_assert_not_reached();
234 trace_smmuv3_record_event(smmu_event_string(info
->type
), info
->sid
);
235 r
= smmuv3_write_eventq(s
, &evt
);
237 smmuv3_trigger_irq(s
, SMMU_IRQ_GERROR
, R_GERROR_EVENTQ_ABT_ERR_MASK
);
239 info
->recorded
= true;
242 static void smmuv3_init_regs(SMMUv3State
*s
)
245 * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
246 * multi-level stream table
248 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, S1P
, 1); /* stage 1 supported */
249 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, TTF
, 2); /* AArch64 PTW only */
250 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, COHACC
, 1); /* IO coherent */
251 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, ASID16
, 1); /* 16-bit ASID */
252 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, TTENDIAN
, 2); /* little endian */
253 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, STALL_MODEL
, 1); /* No stall */
254 /* terminated transaction will always be aborted/error returned */
255 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, TERM_MODEL
, 1);
256 /* 2-level stream table supported */
257 s
->idr
[0] = FIELD_DP32(s
->idr
[0], IDR0
, STLEVEL
, 1);
259 s
->idr
[1] = FIELD_DP32(s
->idr
[1], IDR1
, SIDSIZE
, SMMU_IDR1_SIDSIZE
);
260 s
->idr
[1] = FIELD_DP32(s
->idr
[1], IDR1
, EVENTQS
, SMMU_EVENTQS
);
261 s
->idr
[1] = FIELD_DP32(s
->idr
[1], IDR1
, CMDQS
, SMMU_CMDQS
);
263 s
->idr
[3] = FIELD_DP32(s
->idr
[3], IDR3
, RIL
, 1);
264 s
->idr
[3] = FIELD_DP32(s
->idr
[3], IDR3
, HAD
, 1);
265 s
->idr
[3] = FIELD_DP32(s
->idr
[3], IDR3
, BBML
, 2);
267 /* 4K, 16K and 64K granule support */
268 s
->idr
[5] = FIELD_DP32(s
->idr
[5], IDR5
, GRAN4K
, 1);
269 s
->idr
[5] = FIELD_DP32(s
->idr
[5], IDR5
, GRAN16K
, 1);
270 s
->idr
[5] = FIELD_DP32(s
->idr
[5], IDR5
, GRAN64K
, 1);
271 s
->idr
[5] = FIELD_DP32(s
->idr
[5], IDR5
, OAS
, SMMU_IDR5_OAS
); /* 44 bits */
273 s
->cmdq
.base
= deposit64(s
->cmdq
.base
, 0, 5, SMMU_CMDQS
);
276 s
->cmdq
.entry_size
= sizeof(struct Cmd
);
277 s
->eventq
.base
= deposit64(s
->eventq
.base
, 0, 5, SMMU_EVENTQS
);
280 s
->eventq
.entry_size
= sizeof(struct Evt
);
291 s
->gbpa
= SMMU_GBPA_RESET_VAL
;
294 static int smmu_get_ste(SMMUv3State
*s
, dma_addr_t addr
, STE
*buf
,
295 SMMUEventInfo
*event
)
299 trace_smmuv3_get_ste(addr
);
300 /* TODO: guarantee 64-bit single-copy atomicity */
301 ret
= dma_memory_read(&address_space_memory
, addr
, buf
, sizeof(*buf
),
302 MEMTXATTRS_UNSPECIFIED
);
303 if (ret
!= MEMTX_OK
) {
304 qemu_log_mask(LOG_GUEST_ERROR
,
305 "Cannot fetch pte at address=0x%"PRIx64
"\n", addr
);
306 event
->type
= SMMU_EVT_F_STE_FETCH
;
307 event
->u
.f_ste_fetch
.addr
= addr
;
314 /* @ssid > 0 not supported yet */
315 static int smmu_get_cd(SMMUv3State
*s
, STE
*ste
, uint32_t ssid
,
316 CD
*buf
, SMMUEventInfo
*event
)
318 dma_addr_t addr
= STE_CTXPTR(ste
);
321 trace_smmuv3_get_cd(addr
);
322 /* TODO: guarantee 64-bit single-copy atomicity */
323 ret
= dma_memory_read(&address_space_memory
, addr
, buf
, sizeof(*buf
),
324 MEMTXATTRS_UNSPECIFIED
);
325 if (ret
!= MEMTX_OK
) {
326 qemu_log_mask(LOG_GUEST_ERROR
,
327 "Cannot fetch pte at address=0x%"PRIx64
"\n", addr
);
328 event
->type
= SMMU_EVT_F_CD_FETCH
;
329 event
->u
.f_ste_fetch
.addr
= addr
;
336 * Max valid value is 39 when SMMU_IDR3.STT == 0.
337 * In architectures after SMMUv3.0:
338 * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
339 * field is MAX(16, 64-IAS)
340 * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
342 * As we only support AA64, IAS = OAS.
344 static bool s2t0sz_valid(SMMUTransCfg
*cfg
)
346 if (cfg
->s2cfg
.tsz
> 39) {
350 if (cfg
->s2cfg
.granule_sz
== 16) {
351 return (cfg
->s2cfg
.tsz
>= 64 - oas2bits(SMMU_IDR5_OAS
));
354 return (cfg
->s2cfg
.tsz
>= MAX(64 - oas2bits(SMMU_IDR5_OAS
), 16));
358 * Return true if s2 page table config is valid.
359 * This checks with the configured start level, ias_bits and granularity we can
360 * have a valid page table as described in ARM ARM D8.2 Translation process.
361 * The idea here is to see for the highest possible number of IPA bits, how
362 * many concatenated tables we would need, if it is more than 16, then this is
365 static bool s2_pgtable_config_valid(uint8_t sl0
, uint8_t t0sz
, uint8_t gran
)
367 int level
= get_start_level(sl0
, gran
);
368 uint64_t ipa_bits
= 64 - t0sz
;
369 uint64_t max_ipa
= (1ULL << ipa_bits
) - 1;
370 int nr_concat
= pgd_concat_idx(level
, gran
, max_ipa
) + 1;
372 return nr_concat
<= VMSA_MAX_S2_CONCAT
;
375 static int decode_ste_s2_cfg(SMMUTransCfg
*cfg
, STE
*ste
)
379 if (STE_S2AA64(ste
) == 0x0) {
380 qemu_log_mask(LOG_UNIMP
,
381 "SMMUv3 AArch32 tables not supported\n");
382 g_assert_not_reached();
385 switch (STE_S2TG(ste
)) {
387 cfg
->s2cfg
.granule_sz
= 12;
390 cfg
->s2cfg
.granule_sz
= 16;
393 cfg
->s2cfg
.granule_sz
= 14;
396 qemu_log_mask(LOG_GUEST_ERROR
,
397 "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste
));
401 cfg
->s2cfg
.vttb
= STE_S2TTB(ste
);
403 cfg
->s2cfg
.sl0
= STE_S2SL0(ste
);
404 /* FEAT_TTST not supported. */
405 if (cfg
->s2cfg
.sl0
== 0x3) {
406 qemu_log_mask(LOG_UNIMP
, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
410 /* For AA64, The effective S2PS size is capped to the OAS. */
411 cfg
->s2cfg
.eff_ps
= oas2bits(MIN(STE_S2PS(ste
), SMMU_IDR5_OAS
));
413 * It is ILLEGAL for the address in S2TTB to be outside the range
414 * described by the effective S2PS value.
416 if (cfg
->s2cfg
.vttb
& ~(MAKE_64BIT_MASK(0, cfg
->s2cfg
.eff_ps
))) {
417 qemu_log_mask(LOG_GUEST_ERROR
,
418 "SMMUv3 S2TTB too large 0x%" PRIx64
419 ", effective PS %d bits\n",
420 cfg
->s2cfg
.vttb
, cfg
->s2cfg
.eff_ps
);
424 cfg
->s2cfg
.tsz
= STE_S2T0SZ(ste
);
426 if (!s2t0sz_valid(cfg
)) {
427 qemu_log_mask(LOG_GUEST_ERROR
, "SMMUv3 bad STE S2T0SZ = %d\n",
432 if (!s2_pgtable_config_valid(cfg
->s2cfg
.sl0
, cfg
->s2cfg
.tsz
,
433 cfg
->s2cfg
.granule_sz
)) {
434 qemu_log_mask(LOG_GUEST_ERROR
,
435 "SMMUv3 STE stage 2 config not valid!\n");
439 /* Only LE supported(IDR0.TTENDIAN). */
440 if (STE_S2ENDI(ste
)) {
441 qemu_log_mask(LOG_GUEST_ERROR
,
442 "SMMUv3 STE_S2ENDI only supports LE!\n");
446 cfg
->s2cfg
.affd
= STE_S2AFFD(ste
);
448 cfg
->s2cfg
.record_faults
= STE_S2R(ste
);
449 /* As stall is not supported. */
451 qemu_log_mask(LOG_UNIMP
, "SMMUv3 Stall not implemented!\n");
455 /* This is still here as stage 2 has not been fully enabled yet. */
456 qemu_log_mask(LOG_UNIMP
, "SMMUv3 does not support stage 2 yet\n");
465 /* Returns < 0 in case of invalid STE, 0 otherwise */
466 static int decode_ste(SMMUv3State
*s
, SMMUTransCfg
*cfg
,
467 STE
*ste
, SMMUEventInfo
*event
)
472 if (!STE_VALID(ste
)) {
473 if (!event
->inval_ste_allowed
) {
474 qemu_log_mask(LOG_GUEST_ERROR
, "invalid STE\n");
479 config
= STE_CONFIG(ste
);
481 if (STE_CFG_ABORT(config
)) {
486 if (STE_CFG_BYPASS(config
)) {
487 cfg
->bypassed
= true;
492 * If a stage is enabled in SW while not advertised, throw bad ste
493 * according to user manual(IHI0070E) "5.2 Stream Table Entry".
495 if (!STAGE1_SUPPORTED(s
) && STE_CFG_S1_ENABLED(config
)) {
496 qemu_log_mask(LOG_GUEST_ERROR
, "SMMUv3 S1 used but not supported.\n");
499 if (!STAGE2_SUPPORTED(s
) && STE_CFG_S2_ENABLED(config
)) {
500 qemu_log_mask(LOG_GUEST_ERROR
, "SMMUv3 S2 used but not supported.\n");
504 if (STAGE2_SUPPORTED(s
)) {
505 /* VMID is considered even if s2 is disabled. */
506 cfg
->s2cfg
.vmid
= STE_S2VMID(ste
);
509 cfg
->s2cfg
.vmid
= -1;
512 if (STE_CFG_S2_ENABLED(config
)) {
514 * Stage-1 OAS defaults to OAS even if not enabled as it would be used
515 * in input address check for stage-2.
517 cfg
->oas
= oas2bits(SMMU_IDR5_OAS
);
518 ret
= decode_ste_s2_cfg(cfg
, ste
);
524 if (STE_S1CDMAX(ste
) != 0) {
525 qemu_log_mask(LOG_UNIMP
,
526 "SMMUv3 does not support multiple context descriptors yet\n");
530 if (STE_S1STALLD(ste
)) {
531 qemu_log_mask(LOG_UNIMP
,
532 "SMMUv3 S1 stalling fault model not allowed yet\n");
538 event
->type
= SMMU_EVT_C_BAD_STE
;
543 * smmu_find_ste - Return the stream table entry associated
548 * @ste: returned stream table entry
549 * @event: handle to an event info
551 * Supports linear and 2-level stream table
552 * Return 0 on success, -EINVAL otherwise
554 static int smmu_find_ste(SMMUv3State
*s
, uint32_t sid
, STE
*ste
,
555 SMMUEventInfo
*event
)
557 dma_addr_t addr
, strtab_base
;
559 int strtab_size_shift
;
562 trace_smmuv3_find_ste(sid
, s
->features
, s
->sid_split
);
563 log2size
= FIELD_EX32(s
->strtab_base_cfg
, STRTAB_BASE_CFG
, LOG2SIZE
);
565 * Check SID range against both guest-configured and implementation limits
567 if (sid
>= (1 << MIN(log2size
, SMMU_IDR1_SIDSIZE
))) {
568 event
->type
= SMMU_EVT_C_BAD_STREAMID
;
571 if (s
->features
& SMMU_FEATURE_2LVL_STE
) {
572 int l1_ste_offset
, l2_ste_offset
, max_l2_ste
, span
;
573 dma_addr_t l1ptr
, l2ptr
;
577 * Align strtab base address to table size. For this purpose, assume it
578 * is not bounded by SMMU_IDR1_SIDSIZE.
580 strtab_size_shift
= MAX(5, (int)log2size
- s
->sid_split
- 1 + 3);
581 strtab_base
= s
->strtab_base
& SMMU_BASE_ADDR_MASK
&
582 ~MAKE_64BIT_MASK(0, strtab_size_shift
);
583 l1_ste_offset
= sid
>> s
->sid_split
;
584 l2_ste_offset
= sid
& ((1 << s
->sid_split
) - 1);
585 l1ptr
= (dma_addr_t
)(strtab_base
+ l1_ste_offset
* sizeof(l1std
));
586 /* TODO: guarantee 64-bit single-copy atomicity */
587 ret
= dma_memory_read(&address_space_memory
, l1ptr
, &l1std
,
588 sizeof(l1std
), MEMTXATTRS_UNSPECIFIED
);
589 if (ret
!= MEMTX_OK
) {
590 qemu_log_mask(LOG_GUEST_ERROR
,
591 "Could not read L1PTR at 0X%"PRIx64
"\n", l1ptr
);
592 event
->type
= SMMU_EVT_F_STE_FETCH
;
593 event
->u
.f_ste_fetch
.addr
= l1ptr
;
597 span
= L1STD_SPAN(&l1std
);
600 /* l2ptr is not valid */
601 if (!event
->inval_ste_allowed
) {
602 qemu_log_mask(LOG_GUEST_ERROR
,
603 "invalid sid=%d (L1STD span=0)\n", sid
);
605 event
->type
= SMMU_EVT_C_BAD_STREAMID
;
608 max_l2_ste
= (1 << span
) - 1;
609 l2ptr
= l1std_l2ptr(&l1std
);
610 trace_smmuv3_find_ste_2lvl(s
->strtab_base
, l1ptr
, l1_ste_offset
,
611 l2ptr
, l2_ste_offset
, max_l2_ste
);
612 if (l2_ste_offset
> max_l2_ste
) {
613 qemu_log_mask(LOG_GUEST_ERROR
,
614 "l2_ste_offset=%d > max_l2_ste=%d\n",
615 l2_ste_offset
, max_l2_ste
);
616 event
->type
= SMMU_EVT_C_BAD_STE
;
619 addr
= l2ptr
+ l2_ste_offset
* sizeof(*ste
);
621 strtab_size_shift
= log2size
+ 5;
622 strtab_base
= s
->strtab_base
& SMMU_BASE_ADDR_MASK
&
623 ~MAKE_64BIT_MASK(0, strtab_size_shift
);
624 addr
= strtab_base
+ sid
* sizeof(*ste
);
627 if (smmu_get_ste(s
, addr
, ste
, event
)) {
634 static int decode_cd(SMMUTransCfg
*cfg
, CD
*cd
, SMMUEventInfo
*event
)
639 if (!CD_VALID(cd
) || !CD_AARCH64(cd
)) {
643 goto bad_cd
; /* SMMU_IDR0.TERM_MODEL == 1 */
646 goto bad_cd
; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
648 if (CD_HA(cd
) || CD_HD(cd
)) {
649 goto bad_cd
; /* HTTU = 0 */
652 /* we support only those at the moment */
656 cfg
->oas
= oas2bits(CD_IPS(cd
));
657 cfg
->oas
= MIN(oas2bits(SMMU_IDR5_OAS
), cfg
->oas
);
658 cfg
->tbi
= CD_TBI(cd
);
659 cfg
->asid
= CD_ASID(cd
);
661 trace_smmuv3_decode_cd(cfg
->oas
);
663 /* decode data dependent on TT */
664 for (i
= 0; i
<= 1; i
++) {
666 SMMUTransTableInfo
*tt
= &cfg
->tt
[i
];
668 cfg
->tt
[i
].disabled
= CD_EPD(cd
, i
);
669 if (cfg
->tt
[i
].disabled
) {
674 if (tsz
< 16 || tsz
> 39) {
679 tt
->granule_sz
= tg2granule(tg
, i
);
680 if ((tt
->granule_sz
!= 12 && tt
->granule_sz
!= 14 &&
681 tt
->granule_sz
!= 16) || CD_ENDI(cd
)) {
686 tt
->ttb
= CD_TTB(cd
, i
);
687 if (tt
->ttb
& ~(MAKE_64BIT_MASK(0, cfg
->oas
))) {
690 tt
->had
= CD_HAD(cd
, i
);
691 trace_smmuv3_decode_cd_tt(i
, tt
->tsz
, tt
->ttb
, tt
->granule_sz
, tt
->had
);
694 cfg
->record_faults
= CD_R(cd
);
699 event
->type
= SMMU_EVT_C_BAD_CD
;
704 * smmuv3_decode_config - Prepare the translation configuration
705 * for the @mr iommu region
706 * @mr: iommu memory region the translation config must be prepared for
707 * @cfg: output translation configuration which is populated through
708 * the different configuration decoding steps
709 * @event: must be zero'ed by the caller
711 * return < 0 in case of config decoding error (@event is filled
712 * accordingly). Return 0 otherwise.
714 static int smmuv3_decode_config(IOMMUMemoryRegion
*mr
, SMMUTransCfg
*cfg
,
715 SMMUEventInfo
*event
)
717 SMMUDevice
*sdev
= container_of(mr
, SMMUDevice
, iommu
);
718 uint32_t sid
= smmu_get_sid(sdev
);
719 SMMUv3State
*s
= sdev
->smmu
;
724 /* ASID defaults to -1 (if s1 is not supported). */
727 ret
= smmu_find_ste(s
, sid
, &ste
, event
);
732 ret
= decode_ste(s
, cfg
, &ste
, event
);
737 if (cfg
->aborted
|| cfg
->bypassed
) {
741 ret
= smmu_get_cd(s
, &ste
, 0 /* ssid */, &cd
, event
);
746 return decode_cd(cfg
, &cd
, event
);
750 * smmuv3_get_config - Look up for a cached copy of configuration data for
751 * @sdev and on cache miss performs a configuration structure decoding from
754 * @sdev: SMMUDevice handle
755 * @event: output event info
757 * The configuration cache contains data resulting from both STE and CD
758 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed
759 * by the SMMUDevice handle.
761 static SMMUTransCfg
*smmuv3_get_config(SMMUDevice
*sdev
, SMMUEventInfo
*event
)
763 SMMUv3State
*s
= sdev
->smmu
;
764 SMMUState
*bc
= &s
->smmu_state
;
767 cfg
= g_hash_table_lookup(bc
->configs
, sdev
);
769 sdev
->cfg_cache_hits
++;
770 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev
),
771 sdev
->cfg_cache_hits
, sdev
->cfg_cache_misses
,
772 100 * sdev
->cfg_cache_hits
/
773 (sdev
->cfg_cache_hits
+ sdev
->cfg_cache_misses
));
775 sdev
->cfg_cache_misses
++;
776 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev
),
777 sdev
->cfg_cache_hits
, sdev
->cfg_cache_misses
,
778 100 * sdev
->cfg_cache_hits
/
779 (sdev
->cfg_cache_hits
+ sdev
->cfg_cache_misses
));
780 cfg
= g_new0(SMMUTransCfg
, 1);
782 if (!smmuv3_decode_config(&sdev
->iommu
, cfg
, event
)) {
783 g_hash_table_insert(bc
->configs
, sdev
, cfg
);
792 static void smmuv3_flush_config(SMMUDevice
*sdev
)
794 SMMUv3State
*s
= sdev
->smmu
;
795 SMMUState
*bc
= &s
->smmu_state
;
797 trace_smmuv3_config_cache_inv(smmu_get_sid(sdev
));
798 g_hash_table_remove(bc
->configs
, sdev
);
801 static IOMMUTLBEntry
smmuv3_translate(IOMMUMemoryRegion
*mr
, hwaddr addr
,
802 IOMMUAccessFlags flag
, int iommu_idx
)
804 SMMUDevice
*sdev
= container_of(mr
, SMMUDevice
, iommu
);
805 SMMUv3State
*s
= sdev
->smmu
;
806 uint32_t sid
= smmu_get_sid(sdev
);
807 SMMUEventInfo event
= {.type
= SMMU_EVT_NONE
,
809 .inval_ste_allowed
= false};
810 SMMUPTWEventInfo ptw_info
= {};
811 SMMUTranslationStatus status
;
812 SMMUState
*bs
= ARM_SMMU(s
);
813 uint64_t page_mask
, aligned_addr
;
814 SMMUTLBEntry
*cached_entry
= NULL
;
815 SMMUTransTableInfo
*tt
;
816 SMMUTransCfg
*cfg
= NULL
;
817 IOMMUTLBEntry entry
= {
818 .target_as
= &address_space_memory
,
820 .translated_addr
= addr
,
821 .addr_mask
= ~(hwaddr
)0,
825 * Combined attributes used for TLB lookup, as only one stage is supported,
826 * it will hold attributes based on the enabled stage.
828 SMMUTransTableInfo tt_combined
;
830 qemu_mutex_lock(&s
->mutex
);
832 if (!smmu_enabled(s
)) {
833 if (FIELD_EX32(s
->gbpa
, GBPA
, ABORT
)) {
834 status
= SMMU_TRANS_ABORT
;
836 status
= SMMU_TRANS_DISABLE
;
841 cfg
= smmuv3_get_config(sdev
, &event
);
843 status
= SMMU_TRANS_ERROR
;
848 status
= SMMU_TRANS_ABORT
;
853 status
= SMMU_TRANS_BYPASS
;
857 if (cfg
->stage
== 1) {
858 /* Select stage1 translation table. */
859 tt
= select_tt(cfg
, addr
);
861 if (cfg
->record_faults
) {
862 event
.type
= SMMU_EVT_F_TRANSLATION
;
863 event
.u
.f_translation
.addr
= addr
;
864 event
.u
.f_translation
.rnw
= flag
& 0x1;
866 status
= SMMU_TRANS_ERROR
;
869 tt_combined
.granule_sz
= tt
->granule_sz
;
870 tt_combined
.tsz
= tt
->tsz
;
874 tt_combined
.granule_sz
= cfg
->s2cfg
.granule_sz
;
875 tt_combined
.tsz
= cfg
->s2cfg
.tsz
;
878 * TLB lookup looks for granule and input size for a translation stage,
879 * as only one stage is supported right now, choose the right values
880 * from the configuration.
882 page_mask
= (1ULL << tt_combined
.granule_sz
) - 1;
883 aligned_addr
= addr
& ~page_mask
;
885 cached_entry
= smmu_iotlb_lookup(bs
, cfg
, &tt_combined
, aligned_addr
);
887 if ((flag
& IOMMU_WO
) && !(cached_entry
->entry
.perm
& IOMMU_WO
)) {
888 status
= SMMU_TRANS_ERROR
;
890 * We know that the TLB only contains either stage-1 or stage-2 as
891 * nesting is not supported. So it is sufficient to check the
892 * translation stage to know the TLB stage for now.
894 event
.u
.f_walk_eabt
.s2
= (cfg
->stage
== 2);
895 if (PTW_RECORD_FAULT(cfg
)) {
896 event
.type
= SMMU_EVT_F_PERMISSION
;
897 event
.u
.f_permission
.addr
= addr
;
898 event
.u
.f_permission
.rnw
= flag
& 0x1;
901 status
= SMMU_TRANS_SUCCESS
;
906 cached_entry
= g_new0(SMMUTLBEntry
, 1);
908 if (smmu_ptw(cfg
, aligned_addr
, flag
, cached_entry
, &ptw_info
)) {
909 /* All faults from PTW has S2 field. */
910 event
.u
.f_walk_eabt
.s2
= (ptw_info
.stage
== 2);
911 g_free(cached_entry
);
912 switch (ptw_info
.type
) {
913 case SMMU_PTW_ERR_WALK_EABT
:
914 event
.type
= SMMU_EVT_F_WALK_EABT
;
915 event
.u
.f_walk_eabt
.addr
= addr
;
916 event
.u
.f_walk_eabt
.rnw
= flag
& 0x1;
917 event
.u
.f_walk_eabt
.class = 0x1;
918 event
.u
.f_walk_eabt
.addr2
= ptw_info
.addr
;
920 case SMMU_PTW_ERR_TRANSLATION
:
921 if (PTW_RECORD_FAULT(cfg
)) {
922 event
.type
= SMMU_EVT_F_TRANSLATION
;
923 event
.u
.f_translation
.addr
= addr
;
924 event
.u
.f_translation
.rnw
= flag
& 0x1;
927 case SMMU_PTW_ERR_ADDR_SIZE
:
928 if (PTW_RECORD_FAULT(cfg
)) {
929 event
.type
= SMMU_EVT_F_ADDR_SIZE
;
930 event
.u
.f_addr_size
.addr
= addr
;
931 event
.u
.f_addr_size
.rnw
= flag
& 0x1;
934 case SMMU_PTW_ERR_ACCESS
:
935 if (PTW_RECORD_FAULT(cfg
)) {
936 event
.type
= SMMU_EVT_F_ACCESS
;
937 event
.u
.f_access
.addr
= addr
;
938 event
.u
.f_access
.rnw
= flag
& 0x1;
941 case SMMU_PTW_ERR_PERMISSION
:
942 if (PTW_RECORD_FAULT(cfg
)) {
943 event
.type
= SMMU_EVT_F_PERMISSION
;
944 event
.u
.f_permission
.addr
= addr
;
945 event
.u
.f_permission
.rnw
= flag
& 0x1;
949 g_assert_not_reached();
951 status
= SMMU_TRANS_ERROR
;
953 smmu_iotlb_insert(bs
, cfg
, cached_entry
);
954 status
= SMMU_TRANS_SUCCESS
;
958 qemu_mutex_unlock(&s
->mutex
);
960 case SMMU_TRANS_SUCCESS
:
961 entry
.perm
= cached_entry
->entry
.perm
;
962 entry
.translated_addr
= cached_entry
->entry
.translated_addr
+
963 (addr
& cached_entry
->entry
.addr_mask
);
964 entry
.addr_mask
= cached_entry
->entry
.addr_mask
;
965 trace_smmuv3_translate_success(mr
->parent_obj
.name
, sid
, addr
,
966 entry
.translated_addr
, entry
.perm
);
968 case SMMU_TRANS_DISABLE
:
970 entry
.addr_mask
= ~TARGET_PAGE_MASK
;
971 trace_smmuv3_translate_disable(mr
->parent_obj
.name
, sid
, addr
,
974 case SMMU_TRANS_BYPASS
:
976 entry
.addr_mask
= ~TARGET_PAGE_MASK
;
977 trace_smmuv3_translate_bypass(mr
->parent_obj
.name
, sid
, addr
,
980 case SMMU_TRANS_ABORT
:
981 /* no event is recorded on abort */
982 trace_smmuv3_translate_abort(mr
->parent_obj
.name
, sid
, addr
,
985 case SMMU_TRANS_ERROR
:
986 qemu_log_mask(LOG_GUEST_ERROR
,
987 "%s translation failed for iova=0x%"PRIx64
" (%s)\n",
988 mr
->parent_obj
.name
, addr
, smmu_event_string(event
.type
));
989 smmuv3_record_event(s
, &event
);
997 * smmuv3_notify_iova - call the notifier @n for a given
998 * @asid and @iova tuple.
1000 * @mr: IOMMU mr region handle
1001 * @n: notifier to be called
1002 * @asid: address space ID or negative value if we don't care
1004 * @tg: translation granule (if communicated through range invalidation)
1005 * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
1007 static void smmuv3_notify_iova(IOMMUMemoryRegion
*mr
,
1009 int asid
, dma_addr_t iova
,
1010 uint8_t tg
, uint64_t num_pages
)
1012 SMMUDevice
*sdev
= container_of(mr
, SMMUDevice
, iommu
);
1013 IOMMUTLBEvent event
;
1017 SMMUEventInfo event
= {.inval_ste_allowed
= true};
1018 SMMUTransCfg
*cfg
= smmuv3_get_config(sdev
, &event
);
1019 SMMUTransTableInfo
*tt
;
1025 if (asid
>= 0 && cfg
->asid
!= asid
) {
1029 tt
= select_tt(cfg
, iova
);
1033 granule
= tt
->granule_sz
;
1035 granule
= tg
* 2 + 10;
1038 event
.type
= IOMMU_NOTIFIER_UNMAP
;
1039 event
.entry
.target_as
= &address_space_memory
;
1040 event
.entry
.iova
= iova
;
1041 event
.entry
.addr_mask
= num_pages
* (1 << granule
) - 1;
1042 event
.entry
.perm
= IOMMU_NONE
;
1044 memory_region_notify_iommu_one(n
, &event
);
1047 /* invalidate an asid/iova range tuple in all mr's */
1048 static void smmuv3_inv_notifiers_iova(SMMUState
*s
, int asid
, dma_addr_t iova
,
1049 uint8_t tg
, uint64_t num_pages
)
1053 QLIST_FOREACH(sdev
, &s
->devices_with_notifiers
, next
) {
1054 IOMMUMemoryRegion
*mr
= &sdev
->iommu
;
1057 trace_smmuv3_inv_notifiers_iova(mr
->parent_obj
.name
, asid
, iova
,
1060 IOMMU_NOTIFIER_FOREACH(n
, mr
) {
1061 smmuv3_notify_iova(mr
, n
, asid
, iova
, tg
, num_pages
);
1066 static void smmuv3_s1_range_inval(SMMUState
*s
, Cmd
*cmd
)
1068 dma_addr_t end
, addr
= CMD_ADDR(cmd
);
1069 uint8_t type
= CMD_TYPE(cmd
);
1070 uint16_t vmid
= CMD_VMID(cmd
);
1071 uint8_t scale
= CMD_SCALE(cmd
);
1072 uint8_t num
= CMD_NUM(cmd
);
1073 uint8_t ttl
= CMD_TTL(cmd
);
1074 bool leaf
= CMD_LEAF(cmd
);
1075 uint8_t tg
= CMD_TG(cmd
);
1080 if (type
== SMMU_CMD_TLBI_NH_VA
) {
1081 asid
= CMD_ASID(cmd
);
1085 trace_smmuv3_s1_range_inval(vmid
, asid
, addr
, tg
, 1, ttl
, leaf
);
1086 smmuv3_inv_notifiers_iova(s
, asid
, addr
, tg
, 1);
1087 smmu_iotlb_inv_iova(s
, asid
, addr
, tg
, 1, ttl
);
1093 num_pages
= (num
+ 1) * BIT_ULL(scale
);
1094 granule
= tg
* 2 + 10;
1096 /* Split invalidations into ^2 range invalidations */
1097 end
= addr
+ (num_pages
<< granule
) - 1;
1099 while (addr
!= end
+ 1) {
1100 uint64_t mask
= dma_aligned_pow2_mask(addr
, end
, 64);
1102 num_pages
= (mask
+ 1) >> granule
;
1103 trace_smmuv3_s1_range_inval(vmid
, asid
, addr
, tg
, num_pages
, ttl
, leaf
);
1104 smmuv3_inv_notifiers_iova(s
, asid
, addr
, tg
, num_pages
);
1105 smmu_iotlb_inv_iova(s
, asid
, addr
, tg
, num_pages
, ttl
);
1111 smmuv3_invalidate_ste(gpointer key
, gpointer value
, gpointer user_data
)
1113 SMMUDevice
*sdev
= (SMMUDevice
*)key
;
1114 uint32_t sid
= smmu_get_sid(sdev
);
1115 SMMUSIDRange
*sid_range
= (SMMUSIDRange
*)user_data
;
1117 if (sid
< sid_range
->start
|| sid
> sid_range
->end
) {
1120 trace_smmuv3_config_cache_inv(sid
);
1124 static int smmuv3_cmdq_consume(SMMUv3State
*s
)
1126 SMMUState
*bs
= ARM_SMMU(s
);
1127 SMMUCmdError cmd_error
= SMMU_CERROR_NONE
;
1128 SMMUQueue
*q
= &s
->cmdq
;
1129 SMMUCommandType type
= 0;
1131 if (!smmuv3_cmdq_enabled(s
)) {
1135 * some commands depend on register values, typically CR0. In case those
1136 * register values change while handling the command, spec says it
1137 * is UNPREDICTABLE whether the command is interpreted under the new
1141 while (!smmuv3_q_empty(q
)) {
1142 uint32_t pending
= s
->gerror
^ s
->gerrorn
;
1145 trace_smmuv3_cmdq_consume(Q_PROD(q
), Q_CONS(q
),
1146 Q_PROD_WRAP(q
), Q_CONS_WRAP(q
));
1148 if (FIELD_EX32(pending
, GERROR
, CMDQ_ERR
)) {
1152 if (queue_read(q
, &cmd
) != MEMTX_OK
) {
1153 cmd_error
= SMMU_CERROR_ABT
;
1157 type
= CMD_TYPE(&cmd
);
1159 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type
));
1161 qemu_mutex_lock(&s
->mutex
);
1164 if (CMD_SYNC_CS(&cmd
) & CMD_SYNC_SIG_IRQ
) {
1165 smmuv3_trigger_irq(s
, SMMU_IRQ_CMD_SYNC
, 0);
1168 case SMMU_CMD_PREFETCH_CONFIG
:
1169 case SMMU_CMD_PREFETCH_ADDR
:
1171 case SMMU_CMD_CFGI_STE
:
1173 uint32_t sid
= CMD_SID(&cmd
);
1174 IOMMUMemoryRegion
*mr
= smmu_iommu_mr(bs
, sid
);
1177 if (CMD_SSEC(&cmd
)) {
1178 cmd_error
= SMMU_CERROR_ILL
;
1186 trace_smmuv3_cmdq_cfgi_ste(sid
);
1187 sdev
= container_of(mr
, SMMUDevice
, iommu
);
1188 smmuv3_flush_config(sdev
);
1192 case SMMU_CMD_CFGI_STE_RANGE
: /* same as SMMU_CMD_CFGI_ALL */
1194 uint32_t sid
= CMD_SID(&cmd
), mask
;
1195 uint8_t range
= CMD_STE_RANGE(&cmd
);
1196 SMMUSIDRange sid_range
;
1198 if (CMD_SSEC(&cmd
)) {
1199 cmd_error
= SMMU_CERROR_ILL
;
1203 mask
= (1ULL << (range
+ 1)) - 1;
1204 sid_range
.start
= sid
& ~mask
;
1205 sid_range
.end
= sid_range
.start
+ mask
;
1207 trace_smmuv3_cmdq_cfgi_ste_range(sid_range
.start
, sid_range
.end
);
1208 g_hash_table_foreach_remove(bs
->configs
, smmuv3_invalidate_ste
,
1212 case SMMU_CMD_CFGI_CD
:
1213 case SMMU_CMD_CFGI_CD_ALL
:
1215 uint32_t sid
= CMD_SID(&cmd
);
1216 IOMMUMemoryRegion
*mr
= smmu_iommu_mr(bs
, sid
);
1219 if (CMD_SSEC(&cmd
)) {
1220 cmd_error
= SMMU_CERROR_ILL
;
1228 trace_smmuv3_cmdq_cfgi_cd(sid
);
1229 sdev
= container_of(mr
, SMMUDevice
, iommu
);
1230 smmuv3_flush_config(sdev
);
1233 case SMMU_CMD_TLBI_NH_ASID
:
1235 uint16_t asid
= CMD_ASID(&cmd
);
1237 trace_smmuv3_cmdq_tlbi_nh_asid(asid
);
1238 smmu_inv_notifiers_all(&s
->smmu_state
);
1239 smmu_iotlb_inv_asid(bs
, asid
);
1242 case SMMU_CMD_TLBI_NH_ALL
:
1243 case SMMU_CMD_TLBI_NSNH_ALL
:
1244 trace_smmuv3_cmdq_tlbi_nh();
1245 smmu_inv_notifiers_all(&s
->smmu_state
);
1246 smmu_iotlb_inv_all(bs
);
1248 case SMMU_CMD_TLBI_NH_VAA
:
1249 case SMMU_CMD_TLBI_NH_VA
:
1250 smmuv3_s1_range_inval(bs
, &cmd
);
1252 case SMMU_CMD_TLBI_EL3_ALL
:
1253 case SMMU_CMD_TLBI_EL3_VA
:
1254 case SMMU_CMD_TLBI_EL2_ALL
:
1255 case SMMU_CMD_TLBI_EL2_ASID
:
1256 case SMMU_CMD_TLBI_EL2_VA
:
1257 case SMMU_CMD_TLBI_EL2_VAA
:
1258 case SMMU_CMD_TLBI_S12_VMALL
:
1259 case SMMU_CMD_TLBI_S2_IPA
:
1260 case SMMU_CMD_ATC_INV
:
1261 case SMMU_CMD_PRI_RESP
:
1262 case SMMU_CMD_RESUME
:
1263 case SMMU_CMD_STALL_TERM
:
1264 trace_smmuv3_unhandled_cmd(type
);
1267 cmd_error
= SMMU_CERROR_ILL
;
1268 qemu_log_mask(LOG_GUEST_ERROR
,
1269 "Illegal command type: %d\n", CMD_TYPE(&cmd
));
1272 qemu_mutex_unlock(&s
->mutex
);
1277 * We only increment the cons index after the completion of
1278 * the command. We do that because the SYNC returns immediately
1279 * and does not check the completion of previous commands
1285 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type
), cmd_error
);
1286 smmu_write_cmdq_err(s
, cmd_error
);
1287 smmuv3_trigger_irq(s
, SMMU_IRQ_GERROR
, R_GERROR_CMDQ_ERR_MASK
);
1290 trace_smmuv3_cmdq_consume_out(Q_PROD(q
), Q_CONS(q
),
1291 Q_PROD_WRAP(q
), Q_CONS_WRAP(q
));
1296 static MemTxResult
smmu_writell(SMMUv3State
*s
, hwaddr offset
,
1297 uint64_t data
, MemTxAttrs attrs
)
1300 case A_GERROR_IRQ_CFG0
:
1301 s
->gerror_irq_cfg0
= data
;
1304 s
->strtab_base
= data
;
1307 s
->cmdq
.base
= data
;
1308 s
->cmdq
.log2size
= extract64(s
->cmdq
.base
, 0, 5);
1309 if (s
->cmdq
.log2size
> SMMU_CMDQS
) {
1310 s
->cmdq
.log2size
= SMMU_CMDQS
;
1314 s
->eventq
.base
= data
;
1315 s
->eventq
.log2size
= extract64(s
->eventq
.base
, 0, 5);
1316 if (s
->eventq
.log2size
> SMMU_EVENTQS
) {
1317 s
->eventq
.log2size
= SMMU_EVENTQS
;
1320 case A_EVENTQ_IRQ_CFG0
:
1321 s
->eventq_irq_cfg0
= data
;
1324 qemu_log_mask(LOG_UNIMP
,
1325 "%s Unexpected 64-bit access to 0x%"PRIx64
" (WI)\n",
1331 static MemTxResult
smmu_writel(SMMUv3State
*s
, hwaddr offset
,
1332 uint64_t data
, MemTxAttrs attrs
)
1337 s
->cr0ack
= data
& ~SMMU_CR0_RESERVED
;
1338 /* in case the command queue has been enabled */
1339 smmuv3_cmdq_consume(s
);
1351 smmuv3_write_gerrorn(s
, data
);
1353 * By acknowledging the CMDQ_ERR, SW may notify cmds can
1354 * be processed again
1356 smmuv3_cmdq_consume(s
);
1358 case A_GERROR_IRQ_CFG0
: /* 64b */
1359 s
->gerror_irq_cfg0
= deposit64(s
->gerror_irq_cfg0
, 0, 32, data
);
1361 case A_GERROR_IRQ_CFG0
+ 4:
1362 s
->gerror_irq_cfg0
= deposit64(s
->gerror_irq_cfg0
, 32, 32, data
);
1364 case A_GERROR_IRQ_CFG1
:
1365 s
->gerror_irq_cfg1
= data
;
1367 case A_GERROR_IRQ_CFG2
:
1368 s
->gerror_irq_cfg2
= data
;
1372 * If UPDATE is not set, the write is ignored. This is the only
1373 * permitted behavior in SMMUv3.2 and later.
1375 if (data
& R_GBPA_UPDATE_MASK
) {
1376 /* Ignore update bit as write is synchronous. */
1377 s
->gbpa
= data
& ~R_GBPA_UPDATE_MASK
;
1380 case A_STRTAB_BASE
: /* 64b */
1381 s
->strtab_base
= deposit64(s
->strtab_base
, 0, 32, data
);
1383 case A_STRTAB_BASE
+ 4:
1384 s
->strtab_base
= deposit64(s
->strtab_base
, 32, 32, data
);
1386 case A_STRTAB_BASE_CFG
:
1387 s
->strtab_base_cfg
= data
;
1388 if (FIELD_EX32(data
, STRTAB_BASE_CFG
, FMT
) == 1) {
1389 s
->sid_split
= FIELD_EX32(data
, STRTAB_BASE_CFG
, SPLIT
);
1390 s
->features
|= SMMU_FEATURE_2LVL_STE
;
1393 case A_CMDQ_BASE
: /* 64b */
1394 s
->cmdq
.base
= deposit64(s
->cmdq
.base
, 0, 32, data
);
1395 s
->cmdq
.log2size
= extract64(s
->cmdq
.base
, 0, 5);
1396 if (s
->cmdq
.log2size
> SMMU_CMDQS
) {
1397 s
->cmdq
.log2size
= SMMU_CMDQS
;
1400 case A_CMDQ_BASE
+ 4: /* 64b */
1401 s
->cmdq
.base
= deposit64(s
->cmdq
.base
, 32, 32, data
);
1404 s
->cmdq
.prod
= data
;
1405 smmuv3_cmdq_consume(s
);
1408 s
->cmdq
.cons
= data
;
1410 case A_EVENTQ_BASE
: /* 64b */
1411 s
->eventq
.base
= deposit64(s
->eventq
.base
, 0, 32, data
);
1412 s
->eventq
.log2size
= extract64(s
->eventq
.base
, 0, 5);
1413 if (s
->eventq
.log2size
> SMMU_EVENTQS
) {
1414 s
->eventq
.log2size
= SMMU_EVENTQS
;
1417 case A_EVENTQ_BASE
+ 4:
1418 s
->eventq
.base
= deposit64(s
->eventq
.base
, 32, 32, data
);
1421 s
->eventq
.prod
= data
;
1424 s
->eventq
.cons
= data
;
1426 case A_EVENTQ_IRQ_CFG0
: /* 64b */
1427 s
->eventq_irq_cfg0
= deposit64(s
->eventq_irq_cfg0
, 0, 32, data
);
1429 case A_EVENTQ_IRQ_CFG0
+ 4:
1430 s
->eventq_irq_cfg0
= deposit64(s
->eventq_irq_cfg0
, 32, 32, data
);
1432 case A_EVENTQ_IRQ_CFG1
:
1433 s
->eventq_irq_cfg1
= data
;
1435 case A_EVENTQ_IRQ_CFG2
:
1436 s
->eventq_irq_cfg2
= data
;
1439 qemu_log_mask(LOG_UNIMP
,
1440 "%s Unexpected 32-bit access to 0x%"PRIx64
" (WI)\n",
1446 static MemTxResult
smmu_write_mmio(void *opaque
, hwaddr offset
, uint64_t data
,
1447 unsigned size
, MemTxAttrs attrs
)
1449 SMMUState
*sys
= opaque
;
1450 SMMUv3State
*s
= ARM_SMMUV3(sys
);
1453 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1458 r
= smmu_writell(s
, offset
, data
, attrs
);
1461 r
= smmu_writel(s
, offset
, data
, attrs
);
1468 trace_smmuv3_write_mmio(offset
, data
, size
, r
);
1472 static MemTxResult
smmu_readll(SMMUv3State
*s
, hwaddr offset
,
1473 uint64_t *data
, MemTxAttrs attrs
)
1476 case A_GERROR_IRQ_CFG0
:
1477 *data
= s
->gerror_irq_cfg0
;
1480 *data
= s
->strtab_base
;
1483 *data
= s
->cmdq
.base
;
1486 *data
= s
->eventq
.base
;
1490 qemu_log_mask(LOG_UNIMP
,
1491 "%s Unexpected 64-bit access to 0x%"PRIx64
" (RAZ)\n",
1497 static MemTxResult
smmu_readl(SMMUv3State
*s
, hwaddr offset
,
1498 uint64_t *data
, MemTxAttrs attrs
)
1501 case A_IDREGS
... A_IDREGS
+ 0x2f:
1502 *data
= smmuv3_idreg(offset
- A_IDREGS
);
1504 case A_IDR0
... A_IDR5
:
1505 *data
= s
->idr
[(offset
- A_IDR0
) / 4];
1532 case A_IRQ_CTRL_ACK
:
1533 *data
= s
->irq_ctrl
;
1541 case A_GERROR_IRQ_CFG0
: /* 64b */
1542 *data
= extract64(s
->gerror_irq_cfg0
, 0, 32);
1544 case A_GERROR_IRQ_CFG0
+ 4:
1545 *data
= extract64(s
->gerror_irq_cfg0
, 32, 32);
1547 case A_GERROR_IRQ_CFG1
:
1548 *data
= s
->gerror_irq_cfg1
;
1550 case A_GERROR_IRQ_CFG2
:
1551 *data
= s
->gerror_irq_cfg2
;
1553 case A_STRTAB_BASE
: /* 64b */
1554 *data
= extract64(s
->strtab_base
, 0, 32);
1556 case A_STRTAB_BASE
+ 4: /* 64b */
1557 *data
= extract64(s
->strtab_base
, 32, 32);
1559 case A_STRTAB_BASE_CFG
:
1560 *data
= s
->strtab_base_cfg
;
1562 case A_CMDQ_BASE
: /* 64b */
1563 *data
= extract64(s
->cmdq
.base
, 0, 32);
1565 case A_CMDQ_BASE
+ 4:
1566 *data
= extract64(s
->cmdq
.base
, 32, 32);
1569 *data
= s
->cmdq
.prod
;
1572 *data
= s
->cmdq
.cons
;
1574 case A_EVENTQ_BASE
: /* 64b */
1575 *data
= extract64(s
->eventq
.base
, 0, 32);
1577 case A_EVENTQ_BASE
+ 4: /* 64b */
1578 *data
= extract64(s
->eventq
.base
, 32, 32);
1581 *data
= s
->eventq
.prod
;
1584 *data
= s
->eventq
.cons
;
1588 qemu_log_mask(LOG_UNIMP
,
1589 "%s unhandled 32-bit access at 0x%"PRIx64
" (RAZ)\n",
1595 static MemTxResult
smmu_read_mmio(void *opaque
, hwaddr offset
, uint64_t *data
,
1596 unsigned size
, MemTxAttrs attrs
)
1598 SMMUState
*sys
= opaque
;
1599 SMMUv3State
*s
= ARM_SMMUV3(sys
);
1602 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1607 r
= smmu_readll(s
, offset
, data
, attrs
);
1610 r
= smmu_readl(s
, offset
, data
, attrs
);
1617 trace_smmuv3_read_mmio(offset
, *data
, size
, r
);
1621 static const MemoryRegionOps smmu_mem_ops
= {
1622 .read_with_attrs
= smmu_read_mmio
,
1623 .write_with_attrs
= smmu_write_mmio
,
1624 .endianness
= DEVICE_LITTLE_ENDIAN
,
1626 .min_access_size
= 4,
1627 .max_access_size
= 8,
1630 .min_access_size
= 4,
1631 .max_access_size
= 8,
1635 static void smmu_init_irq(SMMUv3State
*s
, SysBusDevice
*dev
)
1639 for (i
= 0; i
< ARRAY_SIZE(s
->irq
); i
++) {
1640 sysbus_init_irq(dev
, &s
->irq
[i
]);
1644 static void smmu_reset_hold(Object
*obj
)
1646 SMMUv3State
*s
= ARM_SMMUV3(obj
);
1647 SMMUv3Class
*c
= ARM_SMMUV3_GET_CLASS(s
);
1649 if (c
->parent_phases
.hold
) {
1650 c
->parent_phases
.hold(obj
);
1653 smmuv3_init_regs(s
);
1656 static void smmu_realize(DeviceState
*d
, Error
**errp
)
1658 SMMUState
*sys
= ARM_SMMU(d
);
1659 SMMUv3State
*s
= ARM_SMMUV3(sys
);
1660 SMMUv3Class
*c
= ARM_SMMUV3_GET_CLASS(s
);
1661 SysBusDevice
*dev
= SYS_BUS_DEVICE(d
);
1662 Error
*local_err
= NULL
;
1664 c
->parent_realize(d
, &local_err
);
1666 error_propagate(errp
, local_err
);
1670 qemu_mutex_init(&s
->mutex
);
1672 memory_region_init_io(&sys
->iomem
, OBJECT(s
),
1673 &smmu_mem_ops
, sys
, TYPE_ARM_SMMUV3
, 0x20000);
1675 sys
->mrtypename
= TYPE_SMMUV3_IOMMU_MEMORY_REGION
;
1677 sysbus_init_mmio(dev
, &sys
->iomem
);
1679 smmu_init_irq(s
, dev
);
1682 static const VMStateDescription vmstate_smmuv3_queue
= {
1683 .name
= "smmuv3_queue",
1685 .minimum_version_id
= 1,
1686 .fields
= (VMStateField
[]) {
1687 VMSTATE_UINT64(base
, SMMUQueue
),
1688 VMSTATE_UINT32(prod
, SMMUQueue
),
1689 VMSTATE_UINT32(cons
, SMMUQueue
),
1690 VMSTATE_UINT8(log2size
, SMMUQueue
),
1691 VMSTATE_END_OF_LIST(),
1695 static bool smmuv3_gbpa_needed(void *opaque
)
1697 SMMUv3State
*s
= opaque
;
1699 /* Only migrate GBPA if it has different reset value. */
1700 return s
->gbpa
!= SMMU_GBPA_RESET_VAL
;
1703 static const VMStateDescription vmstate_gbpa
= {
1704 .name
= "smmuv3/gbpa",
1706 .minimum_version_id
= 1,
1707 .needed
= smmuv3_gbpa_needed
,
1708 .fields
= (VMStateField
[]) {
1709 VMSTATE_UINT32(gbpa
, SMMUv3State
),
1710 VMSTATE_END_OF_LIST()
1714 static const VMStateDescription vmstate_smmuv3
= {
1717 .minimum_version_id
= 1,
1718 .priority
= MIG_PRI_IOMMU
,
1719 .fields
= (VMStateField
[]) {
1720 VMSTATE_UINT32(features
, SMMUv3State
),
1721 VMSTATE_UINT8(sid_size
, SMMUv3State
),
1722 VMSTATE_UINT8(sid_split
, SMMUv3State
),
1724 VMSTATE_UINT32_ARRAY(cr
, SMMUv3State
, 3),
1725 VMSTATE_UINT32(cr0ack
, SMMUv3State
),
1726 VMSTATE_UINT32(statusr
, SMMUv3State
),
1727 VMSTATE_UINT32(irq_ctrl
, SMMUv3State
),
1728 VMSTATE_UINT32(gerror
, SMMUv3State
),
1729 VMSTATE_UINT32(gerrorn
, SMMUv3State
),
1730 VMSTATE_UINT64(gerror_irq_cfg0
, SMMUv3State
),
1731 VMSTATE_UINT32(gerror_irq_cfg1
, SMMUv3State
),
1732 VMSTATE_UINT32(gerror_irq_cfg2
, SMMUv3State
),
1733 VMSTATE_UINT64(strtab_base
, SMMUv3State
),
1734 VMSTATE_UINT32(strtab_base_cfg
, SMMUv3State
),
1735 VMSTATE_UINT64(eventq_irq_cfg0
, SMMUv3State
),
1736 VMSTATE_UINT32(eventq_irq_cfg1
, SMMUv3State
),
1737 VMSTATE_UINT32(eventq_irq_cfg2
, SMMUv3State
),
1739 VMSTATE_STRUCT(cmdq
, SMMUv3State
, 0, vmstate_smmuv3_queue
, SMMUQueue
),
1740 VMSTATE_STRUCT(eventq
, SMMUv3State
, 0, vmstate_smmuv3_queue
, SMMUQueue
),
1742 VMSTATE_END_OF_LIST(),
1744 .subsections
= (const VMStateDescription
* []) {
1750 static void smmuv3_instance_init(Object
*obj
)
1752 /* Nothing much to do here as of now */
1755 static void smmuv3_class_init(ObjectClass
*klass
, void *data
)
1757 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1758 ResettableClass
*rc
= RESETTABLE_CLASS(klass
);
1759 SMMUv3Class
*c
= ARM_SMMUV3_CLASS(klass
);
1761 dc
->vmsd
= &vmstate_smmuv3
;
1762 resettable_class_set_parent_phases(rc
, NULL
, smmu_reset_hold
, NULL
,
1764 c
->parent_realize
= dc
->realize
;
1765 dc
->realize
= smmu_realize
;
1768 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion
*iommu
,
1769 IOMMUNotifierFlag old
,
1770 IOMMUNotifierFlag
new,
1773 SMMUDevice
*sdev
= container_of(iommu
, SMMUDevice
, iommu
);
1774 SMMUv3State
*s3
= sdev
->smmu
;
1775 SMMUState
*s
= &(s3
->smmu_state
);
1777 if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP
) {
1778 error_setg(errp
, "SMMUv3 does not support dev-iotlb yet");
1782 if (new & IOMMU_NOTIFIER_MAP
) {
1784 "device %02x.%02x.%x requires iommu MAP notifier which is "
1785 "not currently supported", pci_bus_num(sdev
->bus
),
1786 PCI_SLOT(sdev
->devfn
), PCI_FUNC(sdev
->devfn
));
1790 if (old
== IOMMU_NOTIFIER_NONE
) {
1791 trace_smmuv3_notify_flag_add(iommu
->parent_obj
.name
);
1792 QLIST_INSERT_HEAD(&s
->devices_with_notifiers
, sdev
, next
);
1793 } else if (new == IOMMU_NOTIFIER_NONE
) {
1794 trace_smmuv3_notify_flag_del(iommu
->parent_obj
.name
);
1795 QLIST_REMOVE(sdev
, next
);
1800 static void smmuv3_iommu_memory_region_class_init(ObjectClass
*klass
,
1803 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
1805 imrc
->translate
= smmuv3_translate
;
1806 imrc
->notify_flag_changed
= smmuv3_notify_flag_changed
;
1809 static const TypeInfo smmuv3_type_info
= {
1810 .name
= TYPE_ARM_SMMUV3
,
1811 .parent
= TYPE_ARM_SMMU
,
1812 .instance_size
= sizeof(SMMUv3State
),
1813 .instance_init
= smmuv3_instance_init
,
1814 .class_size
= sizeof(SMMUv3Class
),
1815 .class_init
= smmuv3_class_init
,
1818 static const TypeInfo smmuv3_iommu_memory_region_info
= {
1819 .parent
= TYPE_IOMMU_MEMORY_REGION
,
1820 .name
= TYPE_SMMUV3_IOMMU_MEMORY_REGION
,
1821 .class_init
= smmuv3_iommu_memory_region_class_init
,
1824 static void smmuv3_register_types(void)
1826 type_register(&smmuv3_type_info
);
1827 type_register(&smmuv3_iommu_memory_region_info
);
1830 type_init(smmuv3_register_types
)