]> git.proxmox.com Git - mirror_qemu.git/blame - hw/arm/smmuv3.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
hw/arm/smmu-common: Manage IOTLB block entries
[mirror_qemu.git] / hw / arm / smmuv3.c
CommitLineData
10a83cb9
PM		 1/*
2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19#include "qemu/osdep.h"
64552b6b 20#include "hw/irq.h"
10a83cb9 21#include "hw/sysbus.h"
d6454270 22#include "migration/vmstate.h"
10a83cb9
PM		 23#include "hw/qdev-core.h"
24#include "hw/pci/pci.h"
25#include "exec/address-spaces.h"
9122bea9 26#include "cpu.h"
10a83cb9
PM		 27#include "trace.h"
28#include "qemu/log.h"
29#include "qemu/error-report.h"
30#include "qapi/error.h"
31
32#include "hw/arm/smmuv3.h"
33#include "smmuv3-internal.h"
34
6a736033
EA		 35/**
36 * smmuv3_trigger_irq - pulse @irq if enabled and update
37 * GERROR register in case of GERROR interrupt
38 *
39 * @irq: irq type
40 * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
41 */
fae4be38
EA		 42static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
43 uint32_t gerror_mask)
6a736033
EA		 44{
45
46 bool pulse = false;
47
48 switch (irq) {
49 case SMMU_IRQ_EVTQ:
50 pulse = smmuv3_eventq_irq_enabled(s);
51 break;
52 case SMMU_IRQ_PRIQ:
53 qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
54 break;
55 case SMMU_IRQ_CMD_SYNC:
56 pulse = true;
57 break;
58 case SMMU_IRQ_GERROR:
59 {
60 uint32_t pending = s->gerror ^ s->gerrorn;
61 uint32_t new_gerrors = ~pending & gerror_mask;
62
63 if (!new_gerrors) {
64 /* only toggle non pending errors */
65 return;
66 }
67 s->gerror ^= new_gerrors;
68 trace_smmuv3_write_gerror(new_gerrors, s->gerror);
69
70 pulse = smmuv3_gerror_irq_enabled(s);
71 break;
72 }
73 }
74 if (pulse) {
75 trace_smmuv3_trigger_irq(irq);
76 qemu_irq_pulse(s->irq[irq]);
77 }
78}
79
fae4be38 80static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
6a736033
EA		 81{
82 uint32_t pending = s->gerror ^ s->gerrorn;
83 uint32_t toggled = s->gerrorn ^ new_gerrorn;
84
85 if (toggled & ~pending) {
86 qemu_log_mask(LOG_GUEST_ERROR,
87 "guest toggles non pending errors = 0x%x\n",
88 toggled & ~pending);
89 }
90
91 /*
92 * We do not raise any error in case guest toggles bits corresponding
93 * to not active IRQs (CONSTRAINED UNPREDICTABLE)
94 */
95 s->gerrorn = new_gerrorn;
96
97 trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
98}
99
dadd1a08
EA		 100static inline MemTxResult queue_read(SMMUQueue *q, void *data)
101{
102 dma_addr_t addr = Q_CONS_ENTRY(q);
103
104 return dma_memory_read(&address_space_memory, addr, data, q->entry_size);
105}
106
107static MemTxResult queue_write(SMMUQueue *q, void *data)
108{
109 dma_addr_t addr = Q_PROD_ENTRY(q);
110 MemTxResult ret;
111
112 ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size);
113 if (ret != MEMTX_OK) {
114 return ret;
115 }
116
117 queue_prod_incr(q);
118 return MEMTX_OK;
119}
120
bb981004 121static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
dadd1a08
EA		 122{
123 SMMUQueue *q = &s->eventq;
bb981004 124 MemTxResult r;
dadd1a08
EA		 125
126 if (!smmuv3_eventq_enabled(s)) {
bb981004 127 return MEMTX_ERROR;
dadd1a08
EA		 128 }
129
130 if (smmuv3_q_full(q)) {
bb981004 131 return MEMTX_ERROR;
dadd1a08
EA		 132 }
133
bb981004
EA		 134 r = queue_write(q, evt);
135 if (r != MEMTX_OK) {
136 return r;
137 }
dadd1a08 138
9f4d2a13 139 if (!smmuv3_q_empty(q)) {
dadd1a08
EA		 140 smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
141 }
bb981004
EA		 142 return MEMTX_OK;
143}
144
145void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
146{
24af32e0 147 Evt evt = {};
bb981004
EA		 148 MemTxResult r;
149
150 if (!smmuv3_eventq_enabled(s)) {
151 return;
152 }
153
154 EVT_SET_TYPE(&evt, info->type);
155 EVT_SET_SID(&evt, info->sid);
156
157 switch (info->type) {
9122bea9 158 case SMMU_EVT_NONE:
bb981004
EA		 159 return;
160 case SMMU_EVT_F_UUT:
161 EVT_SET_SSID(&evt, info->u.f_uut.ssid);
162 EVT_SET_SSV(&evt, info->u.f_uut.ssv);
163 EVT_SET_ADDR(&evt, info->u.f_uut.addr);
164 EVT_SET_RNW(&evt, info->u.f_uut.rnw);
165 EVT_SET_PNU(&evt, info->u.f_uut.pnu);
166 EVT_SET_IND(&evt, info->u.f_uut.ind);
167 break;
168 case SMMU_EVT_C_BAD_STREAMID:
169 EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
170 EVT_SET_SSV(&evt, info->u.c_bad_streamid.ssv);
171 break;
172 case SMMU_EVT_F_STE_FETCH:
173 EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
174 EVT_SET_SSV(&evt, info->u.f_ste_fetch.ssv);
b255cafb 175 EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
bb981004
EA		 176 break;
177 case SMMU_EVT_C_BAD_STE:
178 EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
179 EVT_SET_SSV(&evt, info->u.c_bad_ste.ssv);
180 break;
181 case SMMU_EVT_F_STREAM_DISABLED:
182 break;
183 case SMMU_EVT_F_TRANS_FORBIDDEN:
184 EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
185 EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
186 break;
187 case SMMU_EVT_C_BAD_SUBSTREAMID:
188 EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
189 break;
190 case SMMU_EVT_F_CD_FETCH:
191 EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
192 EVT_SET_SSV(&evt, info->u.f_cd_fetch.ssv);
193 EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
194 break;
195 case SMMU_EVT_C_BAD_CD:
196 EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
197 EVT_SET_SSV(&evt, info->u.c_bad_cd.ssv);
198 break;
199 case SMMU_EVT_F_WALK_EABT:
200 case SMMU_EVT_F_TRANSLATION:
201 case SMMU_EVT_F_ADDR_SIZE:
202 case SMMU_EVT_F_ACCESS:
203 case SMMU_EVT_F_PERMISSION:
204 EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
205 EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
206 EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
207 EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
208 EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
209 EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
210 EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
211 EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
212 EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
213 EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
214 EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
215 break;
216 case SMMU_EVT_F_CFG_CONFLICT:
217 EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
218 EVT_SET_SSV(&evt, info->u.f_cfg_conflict.ssv);
219 break;
220 /* rest is not implemented */
221 case SMMU_EVT_F_BAD_ATS_TREQ:
222 case SMMU_EVT_F_TLB_CONFLICT:
223 case SMMU_EVT_E_PAGE_REQ:
224 default:
225 g_assert_not_reached();
226 }
227
228 trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
229 r = smmuv3_write_eventq(s, &evt);
230 if (r != MEMTX_OK) {
231 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
232 }
233 info->recorded = true;
dadd1a08
EA		 234}
235
10a83cb9
PM		 236static void smmuv3_init_regs(SMMUv3State *s)
237{
238 /**
239 * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
240 * multi-level stream table
241 */
242 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
243 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
244 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
245 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
246 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
247 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
248 /* terminated transaction will always be aborted/error returned */
249 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
250 /* 2-level stream table supported */
251 s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
252
253 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
254 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
255 s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS, SMMU_CMDQS);
256
257 /* 4K and 64K granule support */
258 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
259 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
260 s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
261
262 s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
263 s->cmdq.prod = 0;
264 s->cmdq.cons = 0;
265 s->cmdq.entry_size = sizeof(struct Cmd);
266 s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
267 s->eventq.prod = 0;
268 s->eventq.cons = 0;
269 s->eventq.entry_size = sizeof(struct Evt);
270
271 s->features = 0;
272 s->sid_split = 0;
273}
274
9bde7f06
EA		 275static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
276 SMMUEventInfo *event)
277{
278 int ret;
279
280 trace_smmuv3_get_ste(addr);
281 /* TODO: guarantee 64-bit single-copy atomicity */
18610bfd 282 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf));
9bde7f06
EA		 283 if (ret != MEMTX_OK) {
284 qemu_log_mask(LOG_GUEST_ERROR,
285 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
286 event->type = SMMU_EVT_F_STE_FETCH;
287 event->u.f_ste_fetch.addr = addr;
288 return -EINVAL;
289 }
290 return 0;
291
292}
293
294/* @ssid > 0 not supported yet */
295static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
296 CD *buf, SMMUEventInfo *event)
297{
298 dma_addr_t addr = STE_CTXPTR(ste);
299 int ret;
300
301 trace_smmuv3_get_cd(addr);
302 /* TODO: guarantee 64-bit single-copy atomicity */
18610bfd 303 ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf));
9bde7f06
EA		 304 if (ret != MEMTX_OK) {
305 qemu_log_mask(LOG_GUEST_ERROR,
306 "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
307 event->type = SMMU_EVT_F_CD_FETCH;
308 event->u.f_ste_fetch.addr = addr;
309 return -EINVAL;
310 }
311 return 0;
312}
313
9122bea9 314/* Returns < 0 in case of invalid STE, 0 otherwise */
9bde7f06
EA		 315static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
316 STE *ste, SMMUEventInfo *event)
317{
318 uint32_t config;
9bde7f06
EA		 319
320 if (!STE_VALID(ste)) {
3499ec08
EA		 321 if (!event->inval_ste_allowed) {
322 qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n");
323 }
9bde7f06
EA		 324 goto bad_ste;
325 }
326
327 config = STE_CONFIG(ste);
328
329 if (STE_CFG_ABORT(config)) {
9122bea9
JH		 330 cfg->aborted = true;
331 return 0;
9bde7f06
EA		 332 }
333
334 if (STE_CFG_BYPASS(config)) {
335 cfg->bypassed = true;
9122bea9 336 return 0;
9bde7f06
EA		 337 }
338
339 if (STE_CFG_S2_ENABLED(config)) {
340 qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
341 goto bad_ste;
342 }
343
344 if (STE_S1CDMAX(ste) != 0) {
345 qemu_log_mask(LOG_UNIMP,
346 "SMMUv3 does not support multiple context descriptors yet\n");
347 goto bad_ste;
348 }
349
350 if (STE_S1STALLD(ste)) {
351 qemu_log_mask(LOG_UNIMP,
352 "SMMUv3 S1 stalling fault model not allowed yet\n");
353 goto bad_ste;
354 }
355 return 0;
356
357bad_ste:
358 event->type = SMMU_EVT_C_BAD_STE;
359 return -EINVAL;
360}
361
362/**
363 * smmu_find_ste - Return the stream table entry associated
364 * to the sid
365 *
366 * @s: smmuv3 handle
367 * @sid: stream ID
368 * @ste: returned stream table entry
369 * @event: handle to an event info
370 *
371 * Supports linear and 2-level stream table
372 * Return 0 on success, -EINVAL otherwise
373 */
374static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
375 SMMUEventInfo *event)
376{
41678c33 377 dma_addr_t addr, strtab_base;
05ff2fb8 378 uint32_t log2size;
41678c33 379 int strtab_size_shift;
9bde7f06
EA		 380 int ret;
381
382 trace_smmuv3_find_ste(sid, s->features, s->sid_split);
05ff2fb8
SV		 383 log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
384 /*
385 * Check SID range against both guest-configured and implementation limits
386 */
387 if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
9bde7f06
EA		 388 event->type = SMMU_EVT_C_BAD_STREAMID;
389 return -EINVAL;
390 }
391 if (s->features & SMMU_FEATURE_2LVL_STE) {
392 int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
41678c33 393 dma_addr_t l1ptr, l2ptr;
9bde7f06
EA		 394 STEDesc l1std;
395
41678c33
SV		 396 /*
397 * Align strtab base address to table size. For this purpose, assume it
398 * is not bounded by SMMU_IDR1_SIDSIZE.
399 */
400 strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
401 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
402 ~MAKE_64BIT_MASK(0, strtab_size_shift);
9bde7f06
EA		 403 l1_ste_offset = sid >> s->sid_split;
404 l2_ste_offset = sid & ((1 << s->sid_split) - 1);
405 l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
406 /* TODO: guarantee 64-bit single-copy atomicity */
18610bfd
PMD		 407 ret = dma_memory_read(&address_space_memory, l1ptr, &l1std,
408 sizeof(l1std));
9bde7f06
EA		 409 if (ret != MEMTX_OK) {
410 qemu_log_mask(LOG_GUEST_ERROR,
411 "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
412 event->type = SMMU_EVT_F_STE_FETCH;
413 event->u.f_ste_fetch.addr = l1ptr;
414 return -EINVAL;
415 }
416
417 span = L1STD_SPAN(&l1std);
418
419 if (!span) {
420 /* l2ptr is not valid */
3499ec08
EA		 421 if (!event->inval_ste_allowed) {
422 qemu_log_mask(LOG_GUEST_ERROR,
423 "invalid sid=%d (L1STD span=0)\n", sid);
424 }
9bde7f06
EA		 425 event->type = SMMU_EVT_C_BAD_STREAMID;
426 return -EINVAL;
427 }
428 max_l2_ste = (1 << span) - 1;
429 l2ptr = l1std_l2ptr(&l1std);
430 trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
431 l2ptr, l2_ste_offset, max_l2_ste);
432 if (l2_ste_offset > max_l2_ste) {
433 qemu_log_mask(LOG_GUEST_ERROR,
434 "l2_ste_offset=%d > max_l2_ste=%d\n",
435 l2_ste_offset, max_l2_ste);
436 event->type = SMMU_EVT_C_BAD_STE;
437 return -EINVAL;
438 }
439 addr = l2ptr + l2_ste_offset * sizeof(*ste);
440 } else {
41678c33
SV		 441 strtab_size_shift = log2size + 5;
442 strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
443 ~MAKE_64BIT_MASK(0, strtab_size_shift);
444 addr = strtab_base + sid * sizeof(*ste);
9bde7f06
EA		 445 }
446
447 if (smmu_get_ste(s, addr, ste, event)) {
448 return -EINVAL;
449 }
450
451 return 0;
452}
453
454static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
455{
456 int ret = -EINVAL;
457 int i;
458
459 if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
460 goto bad_cd;
461 }
462 if (!CD_A(cd)) {
463 goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
464 }
465 if (CD_S(cd)) {
466 goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
467 }
468 if (CD_HA(cd) || CD_HD(cd)) {
469 goto bad_cd; /* HTTU = 0 */
470 }
471
472 /* we support only those at the moment */
473 cfg->aa64 = true;
474 cfg->stage = 1;
475
476 cfg->oas = oas2bits(CD_IPS(cd));
477 cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
478 cfg->tbi = CD_TBI(cd);
479 cfg->asid = CD_ASID(cd);
480
481 trace_smmuv3_decode_cd(cfg->oas);
482
483 /* decode data dependent on TT */
484 for (i = 0; i <= 1; i++) {
485 int tg, tsz;
486 SMMUTransTableInfo *tt = &cfg->tt[i];
487
488 cfg->tt[i].disabled = CD_EPD(cd, i);
489 if (cfg->tt[i].disabled) {
490 continue;
491 }
492
493 tsz = CD_TSZ(cd, i);
494 if (tsz < 16 || tsz > 39) {
495 goto bad_cd;
496 }
497
498 tg = CD_TG(cd, i);
499 tt->granule_sz = tg2granule(tg, i);
500 if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {
501 goto bad_cd;
502 }
503
504 tt->tsz = tsz;
505 tt->ttb = CD_TTB(cd, i);
506 if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
507 goto bad_cd;
508 }
509 trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz);
510 }
511
512 event->record_trans_faults = CD_R(cd);
513
514 return 0;
515
516bad_cd:
517 event->type = SMMU_EVT_C_BAD_CD;
518 return ret;
519}
520
521/**
522 * smmuv3_decode_config - Prepare the translation configuration
523 * for the @mr iommu region
524 * @mr: iommu memory region the translation config must be prepared for
525 * @cfg: output translation configuration which is populated through
526 * the different configuration decoding steps
527 * @event: must be zero'ed by the caller
528 *
9122bea9 529 * return < 0 in case of config decoding error (@event is filled
9bde7f06
EA		 530 * accordingly). Return 0 otherwise.
531 */
532static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
533 SMMUEventInfo *event)
534{
535 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
536 uint32_t sid = smmu_get_sid(sdev);
537 SMMUv3State *s = sdev->smmu;
9122bea9 538 int ret;
9bde7f06
EA		 539 STE ste;
540 CD cd;
541
9122bea9
JH		 542 ret = smmu_find_ste(s, sid, &ste, event);
543 if (ret) {
9bde7f06
EA		 544 return ret;
545 }
546
9122bea9
JH		 547 ret = decode_ste(s, cfg, &ste, event);
548 if (ret) {
9bde7f06
EA		 549 return ret;
550 }
551
9122bea9
JH		 552 if (cfg->aborted || cfg->bypassed) {
553 return 0;
554 }
555
556 ret = smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event);
557 if (ret) {
9bde7f06
EA		 558 return ret;
559 }
560
561 return decode_cd(cfg, &cd, event);
562}
563
32cfd7f3
EA		 564/**
565 * smmuv3_get_config - Look up for a cached copy of configuration data for
566 * @sdev and on cache miss performs a configuration structure decoding from
567 * guest RAM.
568 *
569 * @sdev: SMMUDevice handle
570 * @event: output event info
571 *
572 * The configuration cache contains data resulting from both STE and CD
573 * decoding under the form of an SMMUTransCfg struct. The hash table is indexed
574 * by the SMMUDevice handle.
575 */
576static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event)
577{
578 SMMUv3State *s = sdev->smmu;
579 SMMUState *bc = &s->smmu_state;
580 SMMUTransCfg *cfg;
581
582 cfg = g_hash_table_lookup(bc->configs, sdev);
583 if (cfg) {
584 sdev->cfg_cache_hits++;
585 trace_smmuv3_config_cache_hit(smmu_get_sid(sdev),
586 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
587 100 * sdev->cfg_cache_hits /
588 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
589 } else {
590 sdev->cfg_cache_misses++;
591 trace_smmuv3_config_cache_miss(smmu_get_sid(sdev),
592 sdev->cfg_cache_hits, sdev->cfg_cache_misses,
593 100 * sdev->cfg_cache_hits /
594 (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
595 cfg = g_new0(SMMUTransCfg, 1);
596
597 if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) {
598 g_hash_table_insert(bc->configs, sdev, cfg);
599 } else {
600 g_free(cfg);
601 cfg = NULL;
602 }
603 }
604 return cfg;
605}
606
607static void smmuv3_flush_config(SMMUDevice *sdev)
608{
609 SMMUv3State *s = sdev->smmu;
610 SMMUState *bc = &s->smmu_state;
611
612 trace_smmuv3_config_cache_inv(smmu_get_sid(sdev));
613 g_hash_table_remove(bc->configs, sdev);
614}
615
9bde7f06 616static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
2c91bcf2 617 IOMMUAccessFlags flag, int iommu_idx)
9bde7f06
EA		 618{
619 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
620 SMMUv3State *s = sdev->smmu;
621 uint32_t sid = smmu_get_sid(sdev);
3499ec08
EA		 622 SMMUEventInfo event = {.type = SMMU_EVT_NONE,
623 .sid = sid,
624 .inval_ste_allowed = false};
9bde7f06 625 SMMUPTWEventInfo ptw_info = {};
9122bea9 626 SMMUTranslationStatus status;
cc27ed81
EA		 627 SMMUState *bs = ARM_SMMU(s);
628 uint64_t page_mask, aligned_addr;
a7550158 629 SMMUTLBEntry *cached_entry = NULL;
cc27ed81 630 SMMUTransTableInfo *tt;
32cfd7f3 631 SMMUTransCfg *cfg = NULL;
9bde7f06
EA		 632 IOMMUTLBEntry entry = {
633 .target_as = &address_space_memory,
634 .iova = addr,
635 .translated_addr = addr,
636 .addr_mask = ~(hwaddr)0,
637 .perm = IOMMU_NONE,
638 };
9bde7f06 639
32cfd7f3
EA		 640 qemu_mutex_lock(&s->mutex);
641
9bde7f06 642 if (!smmu_enabled(s)) {
9122bea9
JH		 643 status = SMMU_TRANS_DISABLE;
644 goto epilogue;
9bde7f06
EA		 645 }
646
32cfd7f3
EA		 647 cfg = smmuv3_get_config(sdev, &event);
648 if (!cfg) {
9122bea9
JH		 649 status = SMMU_TRANS_ERROR;
650 goto epilogue;
9bde7f06
EA		 651 }
652
32cfd7f3 653 if (cfg->aborted) {
9122bea9
JH		 654 status = SMMU_TRANS_ABORT;
655 goto epilogue;
9bde7f06
EA		 656 }
657
32cfd7f3 658 if (cfg->bypassed) {
9122bea9
JH		 659 status = SMMU_TRANS_BYPASS;
660 goto epilogue;
661 }
662
cc27ed81
EA		 663 tt = select_tt(cfg, addr);
664 if (!tt) {
665 if (event.record_trans_faults) {
666 event.type = SMMU_EVT_F_TRANSLATION;
667 event.u.f_translation.addr = addr;
668 event.u.f_translation.rnw = flag & 0x1;
669 }
670 status = SMMU_TRANS_ERROR;
671 goto epilogue;
672 }
673
674 page_mask = (1ULL << (tt->granule_sz)) - 1;
675 aligned_addr = addr & ~page_mask;
676
9e54dee7 677 cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
cc27ed81 678 if (cached_entry) {
a7550158 679 if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
cc27ed81
EA		 680 status = SMMU_TRANS_ERROR;
681 if (event.record_trans_faults) {
682 event.type = SMMU_EVT_F_PERMISSION;
683 event.u.f_permission.addr = addr;
684 event.u.f_permission.rnw = flag & 0x1;
685 }
686 } else {
687 status = SMMU_TRANS_SUCCESS;
688 }
689 goto epilogue;
690 }
691
a7550158 692 cached_entry = g_new0(SMMUTLBEntry, 1);
cc27ed81
EA		 693
694 if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
695 g_free(cached_entry);
9bde7f06
EA		 696 switch (ptw_info.type) {
697 case SMMU_PTW_ERR_WALK_EABT:
698 event.type = SMMU_EVT_F_WALK_EABT;
699 event.u.f_walk_eabt.addr = addr;
700 event.u.f_walk_eabt.rnw = flag & 0x1;
701 event.u.f_walk_eabt.class = 0x1;
702 event.u.f_walk_eabt.addr2 = ptw_info.addr;
703 break;
704 case SMMU_PTW_ERR_TRANSLATION:
705 if (event.record_trans_faults) {
706 event.type = SMMU_EVT_F_TRANSLATION;
707 event.u.f_translation.addr = addr;
708 event.u.f_translation.rnw = flag & 0x1;
709 }
710 break;
711 case SMMU_PTW_ERR_ADDR_SIZE:
712 if (event.record_trans_faults) {
713 event.type = SMMU_EVT_F_ADDR_SIZE;
714 event.u.f_addr_size.addr = addr;
715 event.u.f_addr_size.rnw = flag & 0x1;
716 }
717 break;
718 case SMMU_PTW_ERR_ACCESS:
719 if (event.record_trans_faults) {
720 event.type = SMMU_EVT_F_ACCESS;
721 event.u.f_access.addr = addr;
722 event.u.f_access.rnw = flag & 0x1;
723 }
724 break;
725 case SMMU_PTW_ERR_PERMISSION:
726 if (event.record_trans_faults) {
727 event.type = SMMU_EVT_F_PERMISSION;
728 event.u.f_permission.addr = addr;
729 event.u.f_permission.rnw = flag & 0x1;
730 }
731 break;
732 default:
733 g_assert_not_reached();
734 }
9122bea9
JH		 735 status = SMMU_TRANS_ERROR;
736 } else {
6808bca9 737 smmu_iotlb_insert(bs, cfg, cached_entry);
9122bea9 738 status = SMMU_TRANS_SUCCESS;
9bde7f06 739 }
9122bea9
JH		 740
741epilogue:
32cfd7f3 742 qemu_mutex_unlock(&s->mutex);
9122bea9
JH		 743 switch (status) {
744 case SMMU_TRANS_SUCCESS:
745 entry.perm = flag;
a7550158 746 entry.translated_addr = cached_entry->entry.translated_addr +
9e54dee7 747 (addr & cached_entry->entry.addr_mask);
a7550158 748 entry.addr_mask = cached_entry->entry.addr_mask;
9122bea9
JH		 749 trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr,
750 entry.translated_addr, entry.perm);
751 break;
752 case SMMU_TRANS_DISABLE:
753 entry.perm = flag;
754 entry.addr_mask = ~TARGET_PAGE_MASK;
755 trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr,
756 entry.perm);
757 break;
758 case SMMU_TRANS_BYPASS:
759 entry.perm = flag;
760 entry.addr_mask = ~TARGET_PAGE_MASK;
761 trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr,
762 entry.perm);
763 break;
764 case SMMU_TRANS_ABORT:
765 /* no event is recorded on abort */
766 trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr,
767 entry.perm);
768 break;
769 case SMMU_TRANS_ERROR:
9bde7f06 770 qemu_log_mask(LOG_GUEST_ERROR,
9122bea9
JH		 771 "%s translation failed for iova=0x%"PRIx64"(%s)\n",
772 mr->parent_obj.name, addr, smmu_event_string(event.type));
9bde7f06 773 smmuv3_record_event(s, &event);
9122bea9 774 break;
9bde7f06
EA		 775 }
776
777 return entry;
778}
779
832e4222
EA		 780/**
781 * smmuv3_notify_iova - call the notifier @n for a given
782 * @asid and @iova tuple.
783 *
784 * @mr: IOMMU mr region handle
785 * @n: notifier to be called
786 * @asid: address space ID or negative value if we don't care
787 * @iova: iova
788 */
789static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
790 IOMMUNotifier *n,
791 int asid,
792 dma_addr_t iova)
793{
794 SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
3499ec08 795 SMMUEventInfo event = {.inval_ste_allowed = true};
832e4222
EA		 796 SMMUTransTableInfo *tt;
797 SMMUTransCfg *cfg;
798 IOMMUTLBEntry entry;
799
800 cfg = smmuv3_get_config(sdev, &event);
801 if (!cfg) {
832e4222
EA		 802 return;
803 }
804
805 if (asid >= 0 && cfg->asid != asid) {
806 return;
807 }
808
809 tt = select_tt(cfg, iova);
810 if (!tt) {
811 return;
812 }
813
814 entry.target_as = &address_space_memory;
815 entry.iova = iova;
816 entry.addr_mask = (1 << tt->granule_sz) - 1;
817 entry.perm = IOMMU_NONE;
818
819 memory_region_notify_one(n, &entry);
820}
821
822/* invalidate an asid/iova tuple in all mr's */
823static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova)
824{
c6370441 825 SMMUDevice *sdev;
832e4222 826
c6370441
EA		 827 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
828 IOMMUMemoryRegion *mr = &sdev->iommu;
832e4222
EA		 829 IOMMUNotifier *n;
830
831 trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova);
832
833 IOMMU_NOTIFIER_FOREACH(n, mr) {
834 smmuv3_notify_iova(mr, n, asid, iova);
835 }
836 }
837}
838
fae4be38 839static int smmuv3_cmdq_consume(SMMUv3State *s)
dadd1a08 840{
32cfd7f3 841 SMMUState *bs = ARM_SMMU(s);
dadd1a08
EA		 842 SMMUCmdError cmd_error = SMMU_CERROR_NONE;
843 SMMUQueue *q = &s->cmdq;
844 SMMUCommandType type = 0;
845
846 if (!smmuv3_cmdq_enabled(s)) {
847 return 0;
848 }
849 /*
850 * some commands depend on register values, typically CR0. In case those
851 * register values change while handling the command, spec says it
852 * is UNPREDICTABLE whether the command is interpreted under the new
853 * or old value.
854 */
855
856 while (!smmuv3_q_empty(q)) {
857 uint32_t pending = s->gerror ^ s->gerrorn;
858 Cmd cmd;
859
860 trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
861 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
862
863 if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
864 break;
865 }
866
867 if (queue_read(q, &cmd) != MEMTX_OK) {
868 cmd_error = SMMU_CERROR_ABT;
869 break;
870 }
871
872 type = CMD_TYPE(&cmd);
873
874 trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
875
32cfd7f3 876 qemu_mutex_lock(&s->mutex);
dadd1a08
EA		 877 switch (type) {
878 case SMMU_CMD_SYNC:
879 if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
880 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
881 }
882 break;
883 case SMMU_CMD_PREFETCH_CONFIG:
884 case SMMU_CMD_PREFETCH_ADDR:
32cfd7f3 885 break;
dadd1a08 886 case SMMU_CMD_CFGI_STE:
32cfd7f3
EA		 887 {
888 uint32_t sid = CMD_SID(&cmd);
889 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid);
890 SMMUDevice *sdev;
891
892 if (CMD_SSEC(&cmd)) {
893 cmd_error = SMMU_CERROR_ILL;
894 break;
895 }
896
897 if (!mr) {
898 break;
899 }
900
901 trace_smmuv3_cmdq_cfgi_ste(sid);
902 sdev = container_of(mr, SMMUDevice, iommu);
903 smmuv3_flush_config(sdev);
904
905 break;
906 }
dadd1a08 907 case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
32cfd7f3
EA		 908 {
909 uint32_t start = CMD_SID(&cmd), end, i;
910 uint8_t range = CMD_STE_RANGE(&cmd);
911
912 if (CMD_SSEC(&cmd)) {
913 cmd_error = SMMU_CERROR_ILL;
914 break;
915 }
916
917 end = start + (1 << (range + 1)) - 1;
918 trace_smmuv3_cmdq_cfgi_ste_range(start, end);
919
920 for (i = start; i <= end; i++) {
921 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, i);
922 SMMUDevice *sdev;
923
924 if (!mr) {
925 continue;
926 }
927 sdev = container_of(mr, SMMUDevice, iommu);
928 smmuv3_flush_config(sdev);
929 }
930 break;
931 }
dadd1a08
EA		 932 case SMMU_CMD_CFGI_CD:
933 case SMMU_CMD_CFGI_CD_ALL:
32cfd7f3
EA		 934 {
935 uint32_t sid = CMD_SID(&cmd);
936 IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid);
937 SMMUDevice *sdev;
938
939 if (CMD_SSEC(&cmd)) {
940 cmd_error = SMMU_CERROR_ILL;
941 break;
942 }
943
944 if (!mr) {
945 break;
946 }
947
948 trace_smmuv3_cmdq_cfgi_cd(sid);
949 sdev = container_of(mr, SMMUDevice, iommu);
950 smmuv3_flush_config(sdev);
951 break;
952 }
dadd1a08 953 case SMMU_CMD_TLBI_NH_ASID:
cc27ed81
EA		 954 {
955 uint16_t asid = CMD_ASID(&cmd);
956
957 trace_smmuv3_cmdq_tlbi_nh_asid(asid);
832e4222 958 smmu_inv_notifiers_all(&s->smmu_state);
cc27ed81
EA		 959 smmu_iotlb_inv_asid(bs, asid);
960 break;
961 }
962 case SMMU_CMD_TLBI_NH_ALL:
963 case SMMU_CMD_TLBI_NSNH_ALL:
964 trace_smmuv3_cmdq_tlbi_nh();
832e4222 965 smmu_inv_notifiers_all(&s->smmu_state);
cc27ed81
EA		 966 smmu_iotlb_inv_all(bs);
967 break;
dadd1a08 968 case SMMU_CMD_TLBI_NH_VAA:
cc27ed81
EA		 969 {
970 dma_addr_t addr = CMD_ADDR(&cmd);
971 uint16_t vmid = CMD_VMID(&cmd);
972
973 trace_smmuv3_cmdq_tlbi_nh_vaa(vmid, addr);
832e4222 974 smmuv3_inv_notifiers_iova(bs, -1, addr);
9e54dee7 975 smmu_iotlb_inv_iova(bs, -1, addr);
cc27ed81
EA		 976 break;
977 }
978 case SMMU_CMD_TLBI_NH_VA:
979 {
980 uint16_t asid = CMD_ASID(&cmd);
981 uint16_t vmid = CMD_VMID(&cmd);
982 dma_addr_t addr = CMD_ADDR(&cmd);
983 bool leaf = CMD_LEAF(&cmd);
984
985 trace_smmuv3_cmdq_tlbi_nh_va(vmid, asid, addr, leaf);
832e4222 986 smmuv3_inv_notifiers_iova(bs, asid, addr);
cc27ed81
EA		 987 smmu_iotlb_inv_iova(bs, asid, addr);
988 break;
989 }
dadd1a08
EA		 990 case SMMU_CMD_TLBI_EL3_ALL:
991 case SMMU_CMD_TLBI_EL3_VA:
992 case SMMU_CMD_TLBI_EL2_ALL:
993 case SMMU_CMD_TLBI_EL2_ASID:
994 case SMMU_CMD_TLBI_EL2_VA:
995 case SMMU_CMD_TLBI_EL2_VAA:
996 case SMMU_CMD_TLBI_S12_VMALL:
997 case SMMU_CMD_TLBI_S2_IPA:
dadd1a08
EA		 998 case SMMU_CMD_ATC_INV:
999 case SMMU_CMD_PRI_RESP:
1000 case SMMU_CMD_RESUME:
1001 case SMMU_CMD_STALL_TERM:
1002 trace_smmuv3_unhandled_cmd(type);
1003 break;
1004 default:
1005 cmd_error = SMMU_CERROR_ILL;
1006 qemu_log_mask(LOG_GUEST_ERROR,
1007 "Illegal command type: %d\n", CMD_TYPE(&cmd));
1008 break;
1009 }
32cfd7f3 1010 qemu_mutex_unlock(&s->mutex);
dadd1a08
EA		 1011 if (cmd_error) {
1012 break;
1013 }
1014 /*
1015 * We only increment the cons index after the completion of
1016 * the command. We do that because the SYNC returns immediately
1017 * and does not check the completion of previous commands
1018 */
1019 queue_cons_incr(q);
1020 }
1021
1022 if (cmd_error) {
1023 trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
1024 smmu_write_cmdq_err(s, cmd_error);
1025 smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
1026 }
1027
1028 trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
1029 Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1030
1031 return 0;
1032}
1033
fae4be38
EA		 1034static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
1035 uint64_t data, MemTxAttrs attrs)
1036{
1037 switch (offset) {
1038 case A_GERROR_IRQ_CFG0:
1039 s->gerror_irq_cfg0 = data;
1040 return MEMTX_OK;
1041 case A_STRTAB_BASE:
1042 s->strtab_base = data;
1043 return MEMTX_OK;
1044 case A_CMDQ_BASE:
1045 s->cmdq.base = data;
1046 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1047 if (s->cmdq.log2size > SMMU_CMDQS) {
1048 s->cmdq.log2size = SMMU_CMDQS;
1049 }
1050 return MEMTX_OK;
1051 case A_EVENTQ_BASE:
1052 s->eventq.base = data;
1053 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1054 if (s->eventq.log2size > SMMU_EVENTQS) {
1055 s->eventq.log2size = SMMU_EVENTQS;
1056 }
1057 return MEMTX_OK;
1058 case A_EVENTQ_IRQ_CFG0:
1059 s->eventq_irq_cfg0 = data;
1060 return MEMTX_OK;
1061 default:
1062 qemu_log_mask(LOG_UNIMP,
1063 "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
1064 __func__, offset);
1065 return MEMTX_OK;
1066 }
1067}
1068
1069static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
1070 uint64_t data, MemTxAttrs attrs)
1071{
1072 switch (offset) {
1073 case A_CR0:
1074 s->cr[0] = data;
1075 s->cr0ack = data & ~SMMU_CR0_RESERVED;
1076 /* in case the command queue has been enabled */
1077 smmuv3_cmdq_consume(s);
1078 return MEMTX_OK;
1079 case A_CR1:
1080 s->cr[1] = data;
1081 return MEMTX_OK;
1082 case A_CR2:
1083 s->cr[2] = data;
1084 return MEMTX_OK;
1085 case A_IRQ_CTRL:
1086 s->irq_ctrl = data;
1087 return MEMTX_OK;
1088 case A_GERRORN:
1089 smmuv3_write_gerrorn(s, data);
1090 /*
1091 * By acknowledging the CMDQ_ERR, SW may notify cmds can
1092 * be processed again
1093 */
1094 smmuv3_cmdq_consume(s);
1095 return MEMTX_OK;
1096 case A_GERROR_IRQ_CFG0: /* 64b */
1097 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
1098 return MEMTX_OK;
1099 case A_GERROR_IRQ_CFG0 + 4:
1100 s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
1101 return MEMTX_OK;
1102 case A_GERROR_IRQ_CFG1:
1103 s->gerror_irq_cfg1 = data;
1104 return MEMTX_OK;
1105 case A_GERROR_IRQ_CFG2:
1106 s->gerror_irq_cfg2 = data;
1107 return MEMTX_OK;
1108 case A_STRTAB_BASE: /* 64b */
1109 s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
1110 return MEMTX_OK;
1111 case A_STRTAB_BASE + 4:
1112 s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
1113 return MEMTX_OK;
1114 case A_STRTAB_BASE_CFG:
1115 s->strtab_base_cfg = data;
1116 if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
1117 s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
1118 s->features |= SMMU_FEATURE_2LVL_STE;
1119 }
1120 return MEMTX_OK;
1121 case A_CMDQ_BASE: /* 64b */
1122 s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
1123 s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1124 if (s->cmdq.log2size > SMMU_CMDQS) {
1125 s->cmdq.log2size = SMMU_CMDQS;
1126 }
1127 return MEMTX_OK;
1128 case A_CMDQ_BASE + 4: /* 64b */
1129 s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
1130 return MEMTX_OK;
1131 case A_CMDQ_PROD:
1132 s->cmdq.prod = data;
1133 smmuv3_cmdq_consume(s);
1134 return MEMTX_OK;
1135 case A_CMDQ_CONS:
1136 s->cmdq.cons = data;
1137 return MEMTX_OK;
1138 case A_EVENTQ_BASE: /* 64b */
1139 s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
1140 s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1141 if (s->eventq.log2size > SMMU_EVENTQS) {
1142 s->eventq.log2size = SMMU_EVENTQS;
1143 }
1144 return MEMTX_OK;
1145 case A_EVENTQ_BASE + 4:
1146 s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
1147 return MEMTX_OK;
1148 case A_EVENTQ_PROD:
1149 s->eventq.prod = data;
1150 return MEMTX_OK;
1151 case A_EVENTQ_CONS:
1152 s->eventq.cons = data;
1153 return MEMTX_OK;
1154 case A_EVENTQ_IRQ_CFG0: /* 64b */
1155 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
1156 return MEMTX_OK;
1157 case A_EVENTQ_IRQ_CFG0 + 4:
1158 s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
1159 return MEMTX_OK;
1160 case A_EVENTQ_IRQ_CFG1:
1161 s->eventq_irq_cfg1 = data;
1162 return MEMTX_OK;
1163 case A_EVENTQ_IRQ_CFG2:
1164 s->eventq_irq_cfg2 = data;
1165 return MEMTX_OK;
1166 default:
1167 qemu_log_mask(LOG_UNIMP,
1168 "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
1169 __func__, offset);
1170 return MEMTX_OK;
1171 }
1172}
1173
10a83cb9
PM		 1174static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
1175 unsigned size, MemTxAttrs attrs)
1176{
fae4be38
EA		 1177 SMMUState *sys = opaque;
1178 SMMUv3State *s = ARM_SMMUV3(sys);
1179 MemTxResult r;
1180
1181 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1182 offset &= ~0x10000;
1183
1184 switch (size) {
1185 case 8:
1186 r = smmu_writell(s, offset, data, attrs);
1187 break;
1188 case 4:
1189 r = smmu_writel(s, offset, data, attrs);
1190 break;
1191 default:
1192 r = MEMTX_ERROR;
1193 break;
1194 }
1195
1196 trace_smmuv3_write_mmio(offset, data, size, r);
1197 return r;
10a83cb9
PM		 1198}
1199
1200static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
1201 uint64_t *data, MemTxAttrs attrs)
1202{
1203 switch (offset) {
1204 case A_GERROR_IRQ_CFG0:
1205 *data = s->gerror_irq_cfg0;
1206 return MEMTX_OK;
1207 case A_STRTAB_BASE:
1208 *data = s->strtab_base;
1209 return MEMTX_OK;
1210 case A_CMDQ_BASE:
1211 *data = s->cmdq.base;
1212 return MEMTX_OK;
1213 case A_EVENTQ_BASE:
1214 *data = s->eventq.base;
1215 return MEMTX_OK;
1216 default:
1217 *data = 0;
1218 qemu_log_mask(LOG_UNIMP,
1219 "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
1220 __func__, offset);
1221 return MEMTX_OK;
1222 }
1223}
1224
1225static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
1226 uint64_t *data, MemTxAttrs attrs)
1227{
1228 switch (offset) {
97fb318d 1229 case A_IDREGS ... A_IDREGS + 0x2f:
10a83cb9
PM		 1230 *data = smmuv3_idreg(offset - A_IDREGS);
1231 return MEMTX_OK;
1232 case A_IDR0 ... A_IDR5:
1233 *data = s->idr[(offset - A_IDR0) / 4];
1234 return MEMTX_OK;
1235 case A_IIDR:
1236 *data = s->iidr;
1237 return MEMTX_OK;
1238 case A_CR0:
1239 *data = s->cr[0];
1240 return MEMTX_OK;
1241 case A_CR0ACK:
1242 *data = s->cr0ack;
1243 return MEMTX_OK;
1244 case A_CR1:
1245 *data = s->cr[1];
1246 return MEMTX_OK;
1247 case A_CR2:
1248 *data = s->cr[2];
1249 return MEMTX_OK;
1250 case A_STATUSR:
1251 *data = s->statusr;
1252 return MEMTX_OK;
1253 case A_IRQ_CTRL:
1254 case A_IRQ_CTRL_ACK:
1255 *data = s->irq_ctrl;
1256 return MEMTX_OK;
1257 case A_GERROR:
1258 *data = s->gerror;
1259 return MEMTX_OK;
1260 case A_GERRORN:
1261 *data = s->gerrorn;
1262 return MEMTX_OK;
1263 case A_GERROR_IRQ_CFG0: /* 64b */
1264 *data = extract64(s->gerror_irq_cfg0, 0, 32);
1265 return MEMTX_OK;
1266 case A_GERROR_IRQ_CFG0 + 4:
1267 *data = extract64(s->gerror_irq_cfg0, 32, 32);
1268 return MEMTX_OK;
1269 case A_GERROR_IRQ_CFG1:
1270 *data = s->gerror_irq_cfg1;
1271 return MEMTX_OK;
1272 case A_GERROR_IRQ_CFG2:
1273 *data = s->gerror_irq_cfg2;
1274 return MEMTX_OK;
1275 case A_STRTAB_BASE: /* 64b */
1276 *data = extract64(s->strtab_base, 0, 32);
1277 return MEMTX_OK;
1278 case A_STRTAB_BASE + 4: /* 64b */
1279 *data = extract64(s->strtab_base, 32, 32);
1280 return MEMTX_OK;
1281 case A_STRTAB_BASE_CFG:
1282 *data = s->strtab_base_cfg;
1283 return MEMTX_OK;
1284 case A_CMDQ_BASE: /* 64b */
1285 *data = extract64(s->cmdq.base, 0, 32);
1286 return MEMTX_OK;
1287 case A_CMDQ_BASE + 4:
1288 *data = extract64(s->cmdq.base, 32, 32);
1289 return MEMTX_OK;
1290 case A_CMDQ_PROD:
1291 *data = s->cmdq.prod;
1292 return MEMTX_OK;
1293 case A_CMDQ_CONS:
1294 *data = s->cmdq.cons;
1295 return MEMTX_OK;
1296 case A_EVENTQ_BASE: /* 64b */
1297 *data = extract64(s->eventq.base, 0, 32);
1298 return MEMTX_OK;
1299 case A_EVENTQ_BASE + 4: /* 64b */
1300 *data = extract64(s->eventq.base, 32, 32);
1301 return MEMTX_OK;
1302 case A_EVENTQ_PROD:
1303 *data = s->eventq.prod;
1304 return MEMTX_OK;
1305 case A_EVENTQ_CONS:
1306 *data = s->eventq.cons;
1307 return MEMTX_OK;
1308 default:
1309 *data = 0;
1310 qemu_log_mask(LOG_UNIMP,
1311 "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
1312 __func__, offset);
1313 return MEMTX_OK;
1314 }
1315}
1316
1317static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
1318 unsigned size, MemTxAttrs attrs)
1319{
1320 SMMUState *sys = opaque;
1321 SMMUv3State *s = ARM_SMMUV3(sys);
1322 MemTxResult r;
1323
1324 /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1325 offset &= ~0x10000;
1326
1327 switch (size) {
1328 case 8:
1329 r = smmu_readll(s, offset, data, attrs);
1330 break;
1331 case 4:
1332 r = smmu_readl(s, offset, data, attrs);
1333 break;
1334 default:
1335 r = MEMTX_ERROR;
1336 break;
1337 }
1338
1339 trace_smmuv3_read_mmio(offset, *data, size, r);
1340 return r;
1341}
1342
1343static const MemoryRegionOps smmu_mem_ops = {
1344 .read_with_attrs = smmu_read_mmio,
1345 .write_with_attrs = smmu_write_mmio,
1346 .endianness = DEVICE_LITTLE_ENDIAN,
1347 .valid = {
1348 .min_access_size = 4,
1349 .max_access_size = 8,
1350 },
1351 .impl = {
1352 .min_access_size = 4,
1353 .max_access_size = 8,
1354 },
1355};
1356
1357static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
1358{
1359 int i;
1360
1361 for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
1362 sysbus_init_irq(dev, &s->irq[i]);
1363 }
1364}
1365
1366static void smmu_reset(DeviceState *dev)
1367{
1368 SMMUv3State *s = ARM_SMMUV3(dev);
1369 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1370
1371 c->parent_reset(dev);
1372
1373 smmuv3_init_regs(s);
1374}
1375
1376static void smmu_realize(DeviceState *d, Error **errp)
1377{
1378 SMMUState *sys = ARM_SMMU(d);
1379 SMMUv3State *s = ARM_SMMUV3(sys);
1380 SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1381 SysBusDevice *dev = SYS_BUS_DEVICE(d);
1382 Error *local_err = NULL;
1383
1384 c->parent_realize(d, &local_err);
1385 if (local_err) {
1386 error_propagate(errp, local_err);
1387 return;
1388 }
1389
32cfd7f3
EA		 1390 qemu_mutex_init(&s->mutex);
1391
10a83cb9
PM		 1392 memory_region_init_io(&sys->iomem, OBJECT(s),
1393 &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
1394
1395 sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
1396
1397 sysbus_init_mmio(dev, &sys->iomem);
1398
1399 smmu_init_irq(s, dev);
1400}
1401
1402static const VMStateDescription vmstate_smmuv3_queue = {
1403 .name = "smmuv3_queue",
1404 .version_id = 1,
1405 .minimum_version_id = 1,
1406 .fields = (VMStateField[]) {
1407 VMSTATE_UINT64(base, SMMUQueue),
1408 VMSTATE_UINT32(prod, SMMUQueue),
1409 VMSTATE_UINT32(cons, SMMUQueue),
1410 VMSTATE_UINT8(log2size, SMMUQueue),
758b71f7 1411 VMSTATE_END_OF_LIST(),
10a83cb9
PM		 1412 },
1413};
1414
1415static const VMStateDescription vmstate_smmuv3 = {
1416 .name = "smmuv3",
1417 .version_id = 1,
1418 .minimum_version_id = 1,
1419 .fields = (VMStateField[]) {
1420 VMSTATE_UINT32(features, SMMUv3State),
1421 VMSTATE_UINT8(sid_size, SMMUv3State),
1422 VMSTATE_UINT8(sid_split, SMMUv3State),
1423
1424 VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
1425 VMSTATE_UINT32(cr0ack, SMMUv3State),
1426 VMSTATE_UINT32(statusr, SMMUv3State),
1427 VMSTATE_UINT32(irq_ctrl, SMMUv3State),
1428 VMSTATE_UINT32(gerror, SMMUv3State),
1429 VMSTATE_UINT32(gerrorn, SMMUv3State),
1430 VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
1431 VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
1432 VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
1433 VMSTATE_UINT64(strtab_base, SMMUv3State),
1434 VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
1435 VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
1436 VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
1437 VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
1438
1439 VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1440 VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1441
1442 VMSTATE_END_OF_LIST(),
1443 },
1444};
1445
1446static void smmuv3_instance_init(Object *obj)
1447{
1448 /* Nothing much to do here as of now */
1449}
1450
1451static void smmuv3_class_init(ObjectClass *klass, void *data)
1452{
1453 DeviceClass *dc = DEVICE_CLASS(klass);
1454 SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
1455
1456 dc->vmsd = &vmstate_smmuv3;
1457 device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset);
1458 c->parent_realize = dc->realize;
1459 dc->realize = smmu_realize;
1460}
1461
549d4005
EA		 1462static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
1463 IOMMUNotifierFlag old,
1464 IOMMUNotifierFlag new,
1465 Error **errp)
0d1ac82e 1466{
832e4222
EA		 1467 SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu);
1468 SMMUv3State *s3 = sdev->smmu;
1469 SMMUState *s = &(s3->smmu_state);
832e4222
EA		 1470
1471 if (new & IOMMU_NOTIFIER_MAP) {
549d4005
EA		 1472 error_setg(errp,
1473 "device %02x.%02x.%x requires iommu MAP notifier which is "
1474 "not currently supported", pci_bus_num(sdev->bus),
1475 PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn));
1476 return -EINVAL;
832e4222
EA		 1477 }
1478
0d1ac82e 1479 if (old == IOMMU_NOTIFIER_NONE) {
832e4222 1480 trace_smmuv3_notify_flag_add(iommu->parent_obj.name);
c6370441
EA		 1481 QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next);
1482 } else if (new == IOMMU_NOTIFIER_NONE) {
1483 trace_smmuv3_notify_flag_del(iommu->parent_obj.name);
1484 QLIST_REMOVE(sdev, next);
0d1ac82e 1485 }
549d4005 1486 return 0;
0d1ac82e
EA		 1487}
1488
10a83cb9
PM		 1489static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
1490 void *data)
1491{
9bde7f06
EA		 1492 IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1493
1494 imrc->translate = smmuv3_translate;
0d1ac82e 1495 imrc->notify_flag_changed = smmuv3_notify_flag_changed;
10a83cb9
PM		 1496}
1497
1498static const TypeInfo smmuv3_type_info = {
1499 .name = TYPE_ARM_SMMUV3,
1500 .parent = TYPE_ARM_SMMU,
1501 .instance_size = sizeof(SMMUv3State),
1502 .instance_init = smmuv3_instance_init,
1503 .class_size = sizeof(SMMUv3Class),
1504 .class_init = smmuv3_class_init,
1505};
1506
1507static const TypeInfo smmuv3_iommu_memory_region_info = {
1508 .parent = TYPE_IOMMU_MEMORY_REGION,
1509 .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
1510 .class_init = smmuv3_iommu_memory_region_class_init,
1511};
1512
1513static void smmuv3_register_types(void)
1514{
1515 type_register(&smmuv3_type_info);
1516 type_register(&smmuv3_iommu_memory_region_info);
1517}
1518
1519type_init(smmuv3_register_types)
1520
QEMU mirror