1 /* 2 * Copyright (C) 2014-2016 Broadcom Corporation 3 * Copyright (c) 2017 Red Hat, Inc. 4 * Written by Prem Mallappa, Eric Auger 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License version 2 as 8 * published by the Free Software Foundation. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * You should have received a copy of the GNU General Public License along 16 * with this program; if not, see <http://www.gnu.org/licenses/>. 17 */ 18 19 #include "qemu/osdep.h" 20 #include "hw/boards.h" 21 #include "sysemu/sysemu.h" 22 #include "hw/sysbus.h" 23 #include "hw/qdev-core.h" 24 #include "hw/pci/pci.h" 25 #include "exec/address-spaces.h" 26 #include "trace.h" 27 #include "qemu/log.h" 28 #include "qemu/error-report.h" 29 #include "qapi/error.h" 30 31 #include "hw/arm/smmuv3.h" 32 #include "smmuv3-internal.h" 33 34 /** 35 * smmuv3_trigger_irq - pulse @irq if enabled and update 36 * GERROR register in case of GERROR interrupt 37 * 38 * @irq: irq type 39 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR) 40 */ 41 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, 42 uint32_t gerror_mask) 43 { 44 45 bool pulse = false; 46 47 switch (irq) { 48 case SMMU_IRQ_EVTQ: 49 pulse = smmuv3_eventq_irq_enabled(s); 50 break; 51 case SMMU_IRQ_PRIQ: 52 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n"); 53 break; 54 case SMMU_IRQ_CMD_SYNC: 55 pulse = true; 56 break; 57 case SMMU_IRQ_GERROR: 58 { 59 uint32_t pending = s->gerror ^ s->gerrorn; 60 uint32_t new_gerrors = ~pending & gerror_mask; 61 62 if (!new_gerrors) { 63 /* only toggle non pending errors */ 64 return; 65 } 66 s->gerror ^= new_gerrors; 67 trace_smmuv3_write_gerror(new_gerrors, s->gerror); 68 69 pulse = smmuv3_gerror_irq_enabled(s); 70 break; 71 } 72 } 73 if (pulse) { 74 trace_smmuv3_trigger_irq(irq); 75 qemu_irq_pulse(s->irq[irq]); 76 } 77 } 78 79 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn) 80 { 81 uint32_t pending = s->gerror ^ s->gerrorn; 82 uint32_t toggled = s->gerrorn ^ new_gerrorn; 83 84 if (toggled & ~pending) { 85 qemu_log_mask(LOG_GUEST_ERROR, 86 "guest toggles non pending errors = 0x%x\n", 87 toggled & ~pending); 88 } 89 90 /* 91 * We do not raise any error in case guest toggles bits corresponding 92 * to not active IRQs (CONSTRAINED UNPREDICTABLE) 93 */ 94 s->gerrorn = new_gerrorn; 95 96 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn); 97 } 98 99 static inline MemTxResult queue_read(SMMUQueue *q, void *data) 100 { 101 dma_addr_t addr = Q_CONS_ENTRY(q); 102 103 return dma_memory_read(&address_space_memory, addr, data, q->entry_size); 104 } 105 106 static MemTxResult queue_write(SMMUQueue *q, void *data) 107 { 108 dma_addr_t addr = Q_PROD_ENTRY(q); 109 MemTxResult ret; 110 111 ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size); 112 if (ret != MEMTX_OK) { 113 return ret; 114 } 115 116 queue_prod_incr(q); 117 return MEMTX_OK; 118 } 119 120 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt) 121 { 122 SMMUQueue *q = &s->eventq; 123 MemTxResult r; 124 125 if (!smmuv3_eventq_enabled(s)) { 126 return MEMTX_ERROR; 127 } 128 129 if (smmuv3_q_full(q)) { 130 return MEMTX_ERROR; 131 } 132 133 r = queue_write(q, evt); 134 if (r != MEMTX_OK) { 135 return r; 136 } 137 138 if (smmuv3_q_empty(q)) { 139 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0); 140 } 141 return MEMTX_OK; 142 } 143 144 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info) 145 { 146 Evt evt = {}; 147 MemTxResult r; 148 149 if (!smmuv3_eventq_enabled(s)) { 150 return; 151 } 152 153 EVT_SET_TYPE(&evt, info->type); 154 EVT_SET_SID(&evt, info->sid); 155 156 switch (info->type) { 157 case SMMU_EVT_OK: 158 return; 159 case SMMU_EVT_F_UUT: 160 EVT_SET_SSID(&evt, info->u.f_uut.ssid); 161 EVT_SET_SSV(&evt, info->u.f_uut.ssv); 162 EVT_SET_ADDR(&evt, info->u.f_uut.addr); 163 EVT_SET_RNW(&evt, info->u.f_uut.rnw); 164 EVT_SET_PNU(&evt, info->u.f_uut.pnu); 165 EVT_SET_IND(&evt, info->u.f_uut.ind); 166 break; 167 case SMMU_EVT_C_BAD_STREAMID: 168 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid); 169 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv); 170 break; 171 case SMMU_EVT_F_STE_FETCH: 172 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid); 173 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv); 174 EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr); 175 break; 176 case SMMU_EVT_C_BAD_STE: 177 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid); 178 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv); 179 break; 180 case SMMU_EVT_F_STREAM_DISABLED: 181 break; 182 case SMMU_EVT_F_TRANS_FORBIDDEN: 183 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr); 184 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw); 185 break; 186 case SMMU_EVT_C_BAD_SUBSTREAMID: 187 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid); 188 break; 189 case SMMU_EVT_F_CD_FETCH: 190 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid); 191 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv); 192 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr); 193 break; 194 case SMMU_EVT_C_BAD_CD: 195 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid); 196 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv); 197 break; 198 case SMMU_EVT_F_WALK_EABT: 199 case SMMU_EVT_F_TRANSLATION: 200 case SMMU_EVT_F_ADDR_SIZE: 201 case SMMU_EVT_F_ACCESS: 202 case SMMU_EVT_F_PERMISSION: 203 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall); 204 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag); 205 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid); 206 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv); 207 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2); 208 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr); 209 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw); 210 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu); 211 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind); 212 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class); 213 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2); 214 break; 215 case SMMU_EVT_F_CFG_CONFLICT: 216 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid); 217 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv); 218 break; 219 /* rest is not implemented */ 220 case SMMU_EVT_F_BAD_ATS_TREQ: 221 case SMMU_EVT_F_TLB_CONFLICT: 222 case SMMU_EVT_E_PAGE_REQ: 223 default: 224 g_assert_not_reached(); 225 } 226 227 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid); 228 r = smmuv3_write_eventq(s, &evt); 229 if (r != MEMTX_OK) { 230 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK); 231 } 232 info->recorded = true; 233 } 234 235 static void smmuv3_init_regs(SMMUv3State *s) 236 { 237 /** 238 * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID, 239 * multi-level stream table 240 */ 241 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */ 242 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */ 243 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */ 244 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */ 245 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */ 246 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */ 247 /* terminated transaction will always be aborted/error returned */ 248 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1); 249 /* 2-level stream table supported */ 250 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1); 251 252 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE); 253 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS); 254 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS); 255 256 /* 4K and 64K granule support */ 257 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1); 258 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1); 259 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */ 260 261 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS); 262 s->cmdq.prod = 0; 263 s->cmdq.cons = 0; 264 s->cmdq.entry_size = sizeof(struct Cmd); 265 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS); 266 s->eventq.prod = 0; 267 s->eventq.cons = 0; 268 s->eventq.entry_size = sizeof(struct Evt); 269 270 s->features = 0; 271 s->sid_split = 0; 272 } 273 274 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf, 275 SMMUEventInfo *event) 276 { 277 int ret; 278 279 trace_smmuv3_get_ste(addr); 280 /* TODO: guarantee 64-bit single-copy atomicity */ 281 ret = dma_memory_read(&address_space_memory, addr, 282 (void *)buf, sizeof(*buf)); 283 if (ret != MEMTX_OK) { 284 qemu_log_mask(LOG_GUEST_ERROR, 285 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 286 event->type = SMMU_EVT_F_STE_FETCH; 287 event->u.f_ste_fetch.addr = addr; 288 return -EINVAL; 289 } 290 return 0; 291 292 } 293 294 /* @ssid > 0 not supported yet */ 295 static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid, 296 CD *buf, SMMUEventInfo *event) 297 { 298 dma_addr_t addr = STE_CTXPTR(ste); 299 int ret; 300 301 trace_smmuv3_get_cd(addr); 302 /* TODO: guarantee 64-bit single-copy atomicity */ 303 ret = dma_memory_read(&address_space_memory, addr, 304 (void *)buf, sizeof(*buf)); 305 if (ret != MEMTX_OK) { 306 qemu_log_mask(LOG_GUEST_ERROR, 307 "Cannot fetch pte at address=0x%"PRIx64"\n", addr); 308 event->type = SMMU_EVT_F_CD_FETCH; 309 event->u.f_ste_fetch.addr = addr; 310 return -EINVAL; 311 } 312 return 0; 313 } 314 315 /* Returns <0 if the caller has no need to continue the translation */ 316 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg, 317 STE *ste, SMMUEventInfo *event) 318 { 319 uint32_t config; 320 int ret = -EINVAL; 321 322 if (!STE_VALID(ste)) { 323 goto bad_ste; 324 } 325 326 config = STE_CONFIG(ste); 327 328 if (STE_CFG_ABORT(config)) { 329 cfg->aborted = true; /* abort but don't record any event */ 330 return ret; 331 } 332 333 if (STE_CFG_BYPASS(config)) { 334 cfg->bypassed = true; 335 return ret; 336 } 337 338 if (STE_CFG_S2_ENABLED(config)) { 339 qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n"); 340 goto bad_ste; 341 } 342 343 if (STE_S1CDMAX(ste) != 0) { 344 qemu_log_mask(LOG_UNIMP, 345 "SMMUv3 does not support multiple context descriptors yet\n"); 346 goto bad_ste; 347 } 348 349 if (STE_S1STALLD(ste)) { 350 qemu_log_mask(LOG_UNIMP, 351 "SMMUv3 S1 stalling fault model not allowed yet\n"); 352 goto bad_ste; 353 } 354 return 0; 355 356 bad_ste: 357 event->type = SMMU_EVT_C_BAD_STE; 358 return -EINVAL; 359 } 360 361 /** 362 * smmu_find_ste - Return the stream table entry associated 363 * to the sid 364 * 365 * @s: smmuv3 handle 366 * @sid: stream ID 367 * @ste: returned stream table entry 368 * @event: handle to an event info 369 * 370 * Supports linear and 2-level stream table 371 * Return 0 on success, -EINVAL otherwise 372 */ 373 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, 374 SMMUEventInfo *event) 375 { 376 dma_addr_t addr; 377 int ret; 378 379 trace_smmuv3_find_ste(sid, s->features, s->sid_split); 380 /* Check SID range */ 381 if (sid > (1 << SMMU_IDR1_SIDSIZE)) { 382 event->type = SMMU_EVT_C_BAD_STREAMID; 383 return -EINVAL; 384 } 385 if (s->features & SMMU_FEATURE_2LVL_STE) { 386 int l1_ste_offset, l2_ste_offset, max_l2_ste, span; 387 dma_addr_t strtab_base, l1ptr, l2ptr; 388 STEDesc l1std; 389 390 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK; 391 l1_ste_offset = sid >> s->sid_split; 392 l2_ste_offset = sid & ((1 << s->sid_split) - 1); 393 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std)); 394 /* TODO: guarantee 64-bit single-copy atomicity */ 395 ret = dma_memory_read(&address_space_memory, l1ptr, 396 (uint8_t *)&l1std, sizeof(l1std)); 397 if (ret != MEMTX_OK) { 398 qemu_log_mask(LOG_GUEST_ERROR, 399 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr); 400 event->type = SMMU_EVT_F_STE_FETCH; 401 event->u.f_ste_fetch.addr = l1ptr; 402 return -EINVAL; 403 } 404 405 span = L1STD_SPAN(&l1std); 406 407 if (!span) { 408 /* l2ptr is not valid */ 409 qemu_log_mask(LOG_GUEST_ERROR, 410 "invalid sid=%d (L1STD span=0)\n", sid); 411 event->type = SMMU_EVT_C_BAD_STREAMID; 412 return -EINVAL; 413 } 414 max_l2_ste = (1 << span) - 1; 415 l2ptr = l1std_l2ptr(&l1std); 416 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, 417 l2ptr, l2_ste_offset, max_l2_ste); 418 if (l2_ste_offset > max_l2_ste) { 419 qemu_log_mask(LOG_GUEST_ERROR, 420 "l2_ste_offset=%d > max_l2_ste=%d\n", 421 l2_ste_offset, max_l2_ste); 422 event->type = SMMU_EVT_C_BAD_STE; 423 return -EINVAL; 424 } 425 addr = l2ptr + l2_ste_offset * sizeof(*ste); 426 } else { 427 addr = s->strtab_base + sid * sizeof(*ste); 428 } 429 430 if (smmu_get_ste(s, addr, ste, event)) { 431 return -EINVAL; 432 } 433 434 return 0; 435 } 436 437 static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event) 438 { 439 int ret = -EINVAL; 440 int i; 441 442 if (!CD_VALID(cd) || !CD_AARCH64(cd)) { 443 goto bad_cd; 444 } 445 if (!CD_A(cd)) { 446 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */ 447 } 448 if (CD_S(cd)) { 449 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */ 450 } 451 if (CD_HA(cd) || CD_HD(cd)) { 452 goto bad_cd; /* HTTU = 0 */ 453 } 454 455 /* we support only those at the moment */ 456 cfg->aa64 = true; 457 cfg->stage = 1; 458 459 cfg->oas = oas2bits(CD_IPS(cd)); 460 cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas); 461 cfg->tbi = CD_TBI(cd); 462 cfg->asid = CD_ASID(cd); 463 464 trace_smmuv3_decode_cd(cfg->oas); 465 466 /* decode data dependent on TT */ 467 for (i = 0; i <= 1; i++) { 468 int tg, tsz; 469 SMMUTransTableInfo *tt = &cfg->tt[i]; 470 471 cfg->tt[i].disabled = CD_EPD(cd, i); 472 if (cfg->tt[i].disabled) { 473 continue; 474 } 475 476 tsz = CD_TSZ(cd, i); 477 if (tsz < 16 || tsz > 39) { 478 goto bad_cd; 479 } 480 481 tg = CD_TG(cd, i); 482 tt->granule_sz = tg2granule(tg, i); 483 if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) { 484 goto bad_cd; 485 } 486 487 tt->tsz = tsz; 488 tt->ttb = CD_TTB(cd, i); 489 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) { 490 goto bad_cd; 491 } 492 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz); 493 } 494 495 event->record_trans_faults = CD_R(cd); 496 497 return 0; 498 499 bad_cd: 500 event->type = SMMU_EVT_C_BAD_CD; 501 return ret; 502 } 503 504 /** 505 * smmuv3_decode_config - Prepare the translation configuration 506 * for the @mr iommu region 507 * @mr: iommu memory region the translation config must be prepared for 508 * @cfg: output translation configuration which is populated through 509 * the different configuration decoding steps 510 * @event: must be zero'ed by the caller 511 * 512 * return < 0 if the translation needs to be aborted (@event is filled 513 * accordingly). Return 0 otherwise. 514 */ 515 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg, 516 SMMUEventInfo *event) 517 { 518 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 519 uint32_t sid = smmu_get_sid(sdev); 520 SMMUv3State *s = sdev->smmu; 521 int ret = -EINVAL; 522 STE ste; 523 CD cd; 524 525 if (smmu_find_ste(s, sid, &ste, event)) { 526 return ret; 527 } 528 529 if (decode_ste(s, cfg, &ste, event)) { 530 return ret; 531 } 532 533 if (smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event)) { 534 return ret; 535 } 536 537 return decode_cd(cfg, &cd, event); 538 } 539 540 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr, 541 IOMMUAccessFlags flag) 542 { 543 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu); 544 SMMUv3State *s = sdev->smmu; 545 uint32_t sid = smmu_get_sid(sdev); 546 SMMUEventInfo event = {.type = SMMU_EVT_OK, .sid = sid}; 547 SMMUPTWEventInfo ptw_info = {}; 548 SMMUTransCfg cfg = {}; 549 IOMMUTLBEntry entry = { 550 .target_as = &address_space_memory, 551 .iova = addr, 552 .translated_addr = addr, 553 .addr_mask = ~(hwaddr)0, 554 .perm = IOMMU_NONE, 555 }; 556 int ret = 0; 557 558 if (!smmu_enabled(s)) { 559 goto out; 560 } 561 562 ret = smmuv3_decode_config(mr, &cfg, &event); 563 if (ret) { 564 goto out; 565 } 566 567 if (cfg.aborted) { 568 goto out; 569 } 570 571 ret = smmu_ptw(&cfg, addr, flag, &entry, &ptw_info); 572 if (ret) { 573 switch (ptw_info.type) { 574 case SMMU_PTW_ERR_WALK_EABT: 575 event.type = SMMU_EVT_F_WALK_EABT; 576 event.u.f_walk_eabt.addr = addr; 577 event.u.f_walk_eabt.rnw = flag & 0x1; 578 event.u.f_walk_eabt.class = 0x1; 579 event.u.f_walk_eabt.addr2 = ptw_info.addr; 580 break; 581 case SMMU_PTW_ERR_TRANSLATION: 582 if (event.record_trans_faults) { 583 event.type = SMMU_EVT_F_TRANSLATION; 584 event.u.f_translation.addr = addr; 585 event.u.f_translation.rnw = flag & 0x1; 586 } 587 break; 588 case SMMU_PTW_ERR_ADDR_SIZE: 589 if (event.record_trans_faults) { 590 event.type = SMMU_EVT_F_ADDR_SIZE; 591 event.u.f_addr_size.addr = addr; 592 event.u.f_addr_size.rnw = flag & 0x1; 593 } 594 break; 595 case SMMU_PTW_ERR_ACCESS: 596 if (event.record_trans_faults) { 597 event.type = SMMU_EVT_F_ACCESS; 598 event.u.f_access.addr = addr; 599 event.u.f_access.rnw = flag & 0x1; 600 } 601 break; 602 case SMMU_PTW_ERR_PERMISSION: 603 if (event.record_trans_faults) { 604 event.type = SMMU_EVT_F_PERMISSION; 605 event.u.f_permission.addr = addr; 606 event.u.f_permission.rnw = flag & 0x1; 607 } 608 break; 609 default: 610 g_assert_not_reached(); 611 } 612 } 613 out: 614 if (ret) { 615 qemu_log_mask(LOG_GUEST_ERROR, 616 "%s translation failed for iova=0x%"PRIx64"(%d)\n", 617 mr->parent_obj.name, addr, ret); 618 entry.perm = IOMMU_NONE; 619 smmuv3_record_event(s, &event); 620 } else if (!cfg.aborted) { 621 entry.perm = flag; 622 trace_smmuv3_translate(mr->parent_obj.name, sid, addr, 623 entry.translated_addr, entry.perm); 624 } 625 626 return entry; 627 } 628 629 static int smmuv3_cmdq_consume(SMMUv3State *s) 630 { 631 SMMUCmdError cmd_error = SMMU_CERROR_NONE; 632 SMMUQueue *q = &s->cmdq; 633 SMMUCommandType type = 0; 634 635 if (!smmuv3_cmdq_enabled(s)) { 636 return 0; 637 } 638 /* 639 * some commands depend on register values, typically CR0. In case those 640 * register values change while handling the command, spec says it 641 * is UNPREDICTABLE whether the command is interpreted under the new 642 * or old value. 643 */ 644 645 while (!smmuv3_q_empty(q)) { 646 uint32_t pending = s->gerror ^ s->gerrorn; 647 Cmd cmd; 648 649 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q), 650 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 651 652 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) { 653 break; 654 } 655 656 if (queue_read(q, &cmd) != MEMTX_OK) { 657 cmd_error = SMMU_CERROR_ABT; 658 break; 659 } 660 661 type = CMD_TYPE(&cmd); 662 663 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type)); 664 665 switch (type) { 666 case SMMU_CMD_SYNC: 667 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) { 668 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0); 669 } 670 break; 671 case SMMU_CMD_PREFETCH_CONFIG: 672 case SMMU_CMD_PREFETCH_ADDR: 673 case SMMU_CMD_CFGI_STE: 674 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */ 675 case SMMU_CMD_CFGI_CD: 676 case SMMU_CMD_CFGI_CD_ALL: 677 case SMMU_CMD_TLBI_NH_ALL: 678 case SMMU_CMD_TLBI_NH_ASID: 679 case SMMU_CMD_TLBI_NH_VA: 680 case SMMU_CMD_TLBI_NH_VAA: 681 case SMMU_CMD_TLBI_EL3_ALL: 682 case SMMU_CMD_TLBI_EL3_VA: 683 case SMMU_CMD_TLBI_EL2_ALL: 684 case SMMU_CMD_TLBI_EL2_ASID: 685 case SMMU_CMD_TLBI_EL2_VA: 686 case SMMU_CMD_TLBI_EL2_VAA: 687 case SMMU_CMD_TLBI_S12_VMALL: 688 case SMMU_CMD_TLBI_S2_IPA: 689 case SMMU_CMD_TLBI_NSNH_ALL: 690 case SMMU_CMD_ATC_INV: 691 case SMMU_CMD_PRI_RESP: 692 case SMMU_CMD_RESUME: 693 case SMMU_CMD_STALL_TERM: 694 trace_smmuv3_unhandled_cmd(type); 695 break; 696 default: 697 cmd_error = SMMU_CERROR_ILL; 698 qemu_log_mask(LOG_GUEST_ERROR, 699 "Illegal command type: %d\n", CMD_TYPE(&cmd)); 700 break; 701 } 702 if (cmd_error) { 703 break; 704 } 705 /* 706 * We only increment the cons index after the completion of 707 * the command. We do that because the SYNC returns immediately 708 * and does not check the completion of previous commands 709 */ 710 queue_cons_incr(q); 711 } 712 713 if (cmd_error) { 714 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error); 715 smmu_write_cmdq_err(s, cmd_error); 716 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK); 717 } 718 719 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q), 720 Q_PROD_WRAP(q), Q_CONS_WRAP(q)); 721 722 return 0; 723 } 724 725 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset, 726 uint64_t data, MemTxAttrs attrs) 727 { 728 switch (offset) { 729 case A_GERROR_IRQ_CFG0: 730 s->gerror_irq_cfg0 = data; 731 return MEMTX_OK; 732 case A_STRTAB_BASE: 733 s->strtab_base = data; 734 return MEMTX_OK; 735 case A_CMDQ_BASE: 736 s->cmdq.base = data; 737 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 738 if (s->cmdq.log2size > SMMU_CMDQS) { 739 s->cmdq.log2size = SMMU_CMDQS; 740 } 741 return MEMTX_OK; 742 case A_EVENTQ_BASE: 743 s->eventq.base = data; 744 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 745 if (s->eventq.log2size > SMMU_EVENTQS) { 746 s->eventq.log2size = SMMU_EVENTQS; 747 } 748 return MEMTX_OK; 749 case A_EVENTQ_IRQ_CFG0: 750 s->eventq_irq_cfg0 = data; 751 return MEMTX_OK; 752 default: 753 qemu_log_mask(LOG_UNIMP, 754 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n", 755 __func__, offset); 756 return MEMTX_OK; 757 } 758 } 759 760 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset, 761 uint64_t data, MemTxAttrs attrs) 762 { 763 switch (offset) { 764 case A_CR0: 765 s->cr[0] = data; 766 s->cr0ack = data & ~SMMU_CR0_RESERVED; 767 /* in case the command queue has been enabled */ 768 smmuv3_cmdq_consume(s); 769 return MEMTX_OK; 770 case A_CR1: 771 s->cr[1] = data; 772 return MEMTX_OK; 773 case A_CR2: 774 s->cr[2] = data; 775 return MEMTX_OK; 776 case A_IRQ_CTRL: 777 s->irq_ctrl = data; 778 return MEMTX_OK; 779 case A_GERRORN: 780 smmuv3_write_gerrorn(s, data); 781 /* 782 * By acknowledging the CMDQ_ERR, SW may notify cmds can 783 * be processed again 784 */ 785 smmuv3_cmdq_consume(s); 786 return MEMTX_OK; 787 case A_GERROR_IRQ_CFG0: /* 64b */ 788 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data); 789 return MEMTX_OK; 790 case A_GERROR_IRQ_CFG0 + 4: 791 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data); 792 return MEMTX_OK; 793 case A_GERROR_IRQ_CFG1: 794 s->gerror_irq_cfg1 = data; 795 return MEMTX_OK; 796 case A_GERROR_IRQ_CFG2: 797 s->gerror_irq_cfg2 = data; 798 return MEMTX_OK; 799 case A_STRTAB_BASE: /* 64b */ 800 s->strtab_base = deposit64(s->strtab_base, 0, 32, data); 801 return MEMTX_OK; 802 case A_STRTAB_BASE + 4: 803 s->strtab_base = deposit64(s->strtab_base, 32, 32, data); 804 return MEMTX_OK; 805 case A_STRTAB_BASE_CFG: 806 s->strtab_base_cfg = data; 807 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) { 808 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); 809 s->features |= SMMU_FEATURE_2LVL_STE; 810 } 811 return MEMTX_OK; 812 case A_CMDQ_BASE: /* 64b */ 813 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data); 814 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5); 815 if (s->cmdq.log2size > SMMU_CMDQS) { 816 s->cmdq.log2size = SMMU_CMDQS; 817 } 818 return MEMTX_OK; 819 case A_CMDQ_BASE + 4: /* 64b */ 820 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data); 821 return MEMTX_OK; 822 case A_CMDQ_PROD: 823 s->cmdq.prod = data; 824 smmuv3_cmdq_consume(s); 825 return MEMTX_OK; 826 case A_CMDQ_CONS: 827 s->cmdq.cons = data; 828 return MEMTX_OK; 829 case A_EVENTQ_BASE: /* 64b */ 830 s->eventq.base = deposit64(s->eventq.base, 0, 32, data); 831 s->eventq.log2size = extract64(s->eventq.base, 0, 5); 832 if (s->eventq.log2size > SMMU_EVENTQS) { 833 s->eventq.log2size = SMMU_EVENTQS; 834 } 835 return MEMTX_OK; 836 case A_EVENTQ_BASE + 4: 837 s->eventq.base = deposit64(s->eventq.base, 32, 32, data); 838 return MEMTX_OK; 839 case A_EVENTQ_PROD: 840 s->eventq.prod = data; 841 return MEMTX_OK; 842 case A_EVENTQ_CONS: 843 s->eventq.cons = data; 844 return MEMTX_OK; 845 case A_EVENTQ_IRQ_CFG0: /* 64b */ 846 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data); 847 return MEMTX_OK; 848 case A_EVENTQ_IRQ_CFG0 + 4: 849 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data); 850 return MEMTX_OK; 851 case A_EVENTQ_IRQ_CFG1: 852 s->eventq_irq_cfg1 = data; 853 return MEMTX_OK; 854 case A_EVENTQ_IRQ_CFG2: 855 s->eventq_irq_cfg2 = data; 856 return MEMTX_OK; 857 default: 858 qemu_log_mask(LOG_UNIMP, 859 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n", 860 __func__, offset); 861 return MEMTX_OK; 862 } 863 } 864 865 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data, 866 unsigned size, MemTxAttrs attrs) 867 { 868 SMMUState *sys = opaque; 869 SMMUv3State *s = ARM_SMMUV3(sys); 870 MemTxResult r; 871 872 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 873 offset &= ~0x10000; 874 875 switch (size) { 876 case 8: 877 r = smmu_writell(s, offset, data, attrs); 878 break; 879 case 4: 880 r = smmu_writel(s, offset, data, attrs); 881 break; 882 default: 883 r = MEMTX_ERROR; 884 break; 885 } 886 887 trace_smmuv3_write_mmio(offset, data, size, r); 888 return r; 889 } 890 891 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset, 892 uint64_t *data, MemTxAttrs attrs) 893 { 894 switch (offset) { 895 case A_GERROR_IRQ_CFG0: 896 *data = s->gerror_irq_cfg0; 897 return MEMTX_OK; 898 case A_STRTAB_BASE: 899 *data = s->strtab_base; 900 return MEMTX_OK; 901 case A_CMDQ_BASE: 902 *data = s->cmdq.base; 903 return MEMTX_OK; 904 case A_EVENTQ_BASE: 905 *data = s->eventq.base; 906 return MEMTX_OK; 907 default: 908 *data = 0; 909 qemu_log_mask(LOG_UNIMP, 910 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n", 911 __func__, offset); 912 return MEMTX_OK; 913 } 914 } 915 916 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset, 917 uint64_t *data, MemTxAttrs attrs) 918 { 919 switch (offset) { 920 case A_IDREGS ... A_IDREGS + 0x1f: 921 *data = smmuv3_idreg(offset - A_IDREGS); 922 return MEMTX_OK; 923 case A_IDR0 ... A_IDR5: 924 *data = s->idr[(offset - A_IDR0) / 4]; 925 return MEMTX_OK; 926 case A_IIDR: 927 *data = s->iidr; 928 return MEMTX_OK; 929 case A_CR0: 930 *data = s->cr[0]; 931 return MEMTX_OK; 932 case A_CR0ACK: 933 *data = s->cr0ack; 934 return MEMTX_OK; 935 case A_CR1: 936 *data = s->cr[1]; 937 return MEMTX_OK; 938 case A_CR2: 939 *data = s->cr[2]; 940 return MEMTX_OK; 941 case A_STATUSR: 942 *data = s->statusr; 943 return MEMTX_OK; 944 case A_IRQ_CTRL: 945 case A_IRQ_CTRL_ACK: 946 *data = s->irq_ctrl; 947 return MEMTX_OK; 948 case A_GERROR: 949 *data = s->gerror; 950 return MEMTX_OK; 951 case A_GERRORN: 952 *data = s->gerrorn; 953 return MEMTX_OK; 954 case A_GERROR_IRQ_CFG0: /* 64b */ 955 *data = extract64(s->gerror_irq_cfg0, 0, 32); 956 return MEMTX_OK; 957 case A_GERROR_IRQ_CFG0 + 4: 958 *data = extract64(s->gerror_irq_cfg0, 32, 32); 959 return MEMTX_OK; 960 case A_GERROR_IRQ_CFG1: 961 *data = s->gerror_irq_cfg1; 962 return MEMTX_OK; 963 case A_GERROR_IRQ_CFG2: 964 *data = s->gerror_irq_cfg2; 965 return MEMTX_OK; 966 case A_STRTAB_BASE: /* 64b */ 967 *data = extract64(s->strtab_base, 0, 32); 968 return MEMTX_OK; 969 case A_STRTAB_BASE + 4: /* 64b */ 970 *data = extract64(s->strtab_base, 32, 32); 971 return MEMTX_OK; 972 case A_STRTAB_BASE_CFG: 973 *data = s->strtab_base_cfg; 974 return MEMTX_OK; 975 case A_CMDQ_BASE: /* 64b */ 976 *data = extract64(s->cmdq.base, 0, 32); 977 return MEMTX_OK; 978 case A_CMDQ_BASE + 4: 979 *data = extract64(s->cmdq.base, 32, 32); 980 return MEMTX_OK; 981 case A_CMDQ_PROD: 982 *data = s->cmdq.prod; 983 return MEMTX_OK; 984 case A_CMDQ_CONS: 985 *data = s->cmdq.cons; 986 return MEMTX_OK; 987 case A_EVENTQ_BASE: /* 64b */ 988 *data = extract64(s->eventq.base, 0, 32); 989 return MEMTX_OK; 990 case A_EVENTQ_BASE + 4: /* 64b */ 991 *data = extract64(s->eventq.base, 32, 32); 992 return MEMTX_OK; 993 case A_EVENTQ_PROD: 994 *data = s->eventq.prod; 995 return MEMTX_OK; 996 case A_EVENTQ_CONS: 997 *data = s->eventq.cons; 998 return MEMTX_OK; 999 default: 1000 *data = 0; 1001 qemu_log_mask(LOG_UNIMP, 1002 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n", 1003 __func__, offset); 1004 return MEMTX_OK; 1005 } 1006 } 1007 1008 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data, 1009 unsigned size, MemTxAttrs attrs) 1010 { 1011 SMMUState *sys = opaque; 1012 SMMUv3State *s = ARM_SMMUV3(sys); 1013 MemTxResult r; 1014 1015 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */ 1016 offset &= ~0x10000; 1017 1018 switch (size) { 1019 case 8: 1020 r = smmu_readll(s, offset, data, attrs); 1021 break; 1022 case 4: 1023 r = smmu_readl(s, offset, data, attrs); 1024 break; 1025 default: 1026 r = MEMTX_ERROR; 1027 break; 1028 } 1029 1030 trace_smmuv3_read_mmio(offset, *data, size, r); 1031 return r; 1032 } 1033 1034 static const MemoryRegionOps smmu_mem_ops = { 1035 .read_with_attrs = smmu_read_mmio, 1036 .write_with_attrs = smmu_write_mmio, 1037 .endianness = DEVICE_LITTLE_ENDIAN, 1038 .valid = { 1039 .min_access_size = 4, 1040 .max_access_size = 8, 1041 }, 1042 .impl = { 1043 .min_access_size = 4, 1044 .max_access_size = 8, 1045 }, 1046 }; 1047 1048 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev) 1049 { 1050 int i; 1051 1052 for (i = 0; i < ARRAY_SIZE(s->irq); i++) { 1053 sysbus_init_irq(dev, &s->irq[i]); 1054 } 1055 } 1056 1057 static void smmu_reset(DeviceState *dev) 1058 { 1059 SMMUv3State *s = ARM_SMMUV3(dev); 1060 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1061 1062 c->parent_reset(dev); 1063 1064 smmuv3_init_regs(s); 1065 } 1066 1067 static void smmu_realize(DeviceState *d, Error **errp) 1068 { 1069 SMMUState *sys = ARM_SMMU(d); 1070 SMMUv3State *s = ARM_SMMUV3(sys); 1071 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s); 1072 SysBusDevice *dev = SYS_BUS_DEVICE(d); 1073 Error *local_err = NULL; 1074 1075 c->parent_realize(d, &local_err); 1076 if (local_err) { 1077 error_propagate(errp, local_err); 1078 return; 1079 } 1080 1081 memory_region_init_io(&sys->iomem, OBJECT(s), 1082 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000); 1083 1084 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION; 1085 1086 sysbus_init_mmio(dev, &sys->iomem); 1087 1088 smmu_init_irq(s, dev); 1089 } 1090 1091 static const VMStateDescription vmstate_smmuv3_queue = { 1092 .name = "smmuv3_queue", 1093 .version_id = 1, 1094 .minimum_version_id = 1, 1095 .fields = (VMStateField[]) { 1096 VMSTATE_UINT64(base, SMMUQueue), 1097 VMSTATE_UINT32(prod, SMMUQueue), 1098 VMSTATE_UINT32(cons, SMMUQueue), 1099 VMSTATE_UINT8(log2size, SMMUQueue), 1100 }, 1101 }; 1102 1103 static const VMStateDescription vmstate_smmuv3 = { 1104 .name = "smmuv3", 1105 .version_id = 1, 1106 .minimum_version_id = 1, 1107 .fields = (VMStateField[]) { 1108 VMSTATE_UINT32(features, SMMUv3State), 1109 VMSTATE_UINT8(sid_size, SMMUv3State), 1110 VMSTATE_UINT8(sid_split, SMMUv3State), 1111 1112 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3), 1113 VMSTATE_UINT32(cr0ack, SMMUv3State), 1114 VMSTATE_UINT32(statusr, SMMUv3State), 1115 VMSTATE_UINT32(irq_ctrl, SMMUv3State), 1116 VMSTATE_UINT32(gerror, SMMUv3State), 1117 VMSTATE_UINT32(gerrorn, SMMUv3State), 1118 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State), 1119 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State), 1120 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State), 1121 VMSTATE_UINT64(strtab_base, SMMUv3State), 1122 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State), 1123 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State), 1124 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State), 1125 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State), 1126 1127 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1128 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue), 1129 1130 VMSTATE_END_OF_LIST(), 1131 }, 1132 }; 1133 1134 static void smmuv3_instance_init(Object *obj) 1135 { 1136 /* Nothing much to do here as of now */ 1137 } 1138 1139 static void smmuv3_class_init(ObjectClass *klass, void *data) 1140 { 1141 DeviceClass *dc = DEVICE_CLASS(klass); 1142 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass); 1143 1144 dc->vmsd = &vmstate_smmuv3; 1145 device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset); 1146 c->parent_realize = dc->realize; 1147 dc->realize = smmu_realize; 1148 } 1149 1150 static void smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu, 1151 IOMMUNotifierFlag old, 1152 IOMMUNotifierFlag new) 1153 { 1154 if (old == IOMMU_NOTIFIER_NONE) { 1155 warn_report("SMMUV3 does not support vhost/vfio integration yet: " 1156 "devices of those types will not function properly"); 1157 } 1158 } 1159 1160 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass, 1161 void *data) 1162 { 1163 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass); 1164 1165 imrc->translate = smmuv3_translate; 1166 imrc->notify_flag_changed = smmuv3_notify_flag_changed; 1167 } 1168 1169 static const TypeInfo smmuv3_type_info = { 1170 .name = TYPE_ARM_SMMUV3, 1171 .parent = TYPE_ARM_SMMU, 1172 .instance_size = sizeof(SMMUv3State), 1173 .instance_init = smmuv3_instance_init, 1174 .class_size = sizeof(SMMUv3Class), 1175 .class_init = smmuv3_class_init, 1176 }; 1177 1178 static const TypeInfo smmuv3_iommu_memory_region_info = { 1179 .parent = TYPE_IOMMU_MEMORY_REGION, 1180 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION, 1181 .class_init = smmuv3_iommu_memory_region_class_init, 1182 }; 1183 1184 static void smmuv3_register_types(void) 1185 { 1186 type_register(&smmuv3_type_info); 1187 type_register(&smmuv3_iommu_memory_region_info); 1188 } 1189 1190 type_init(smmuv3_register_types) 1191 1192