hw/arm/smmuv3.c

   1 /*
   2  * Copyright (C) 2014-2016 Broadcom Corporation
   3  * Copyright (c) 2017 Red Hat, Inc.
   4  * Written by Prem Mallappa, Eric Auger
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, see <http://www.gnu.org/licenses/>.
  17  */
  18
  19 #include "qemu/osdep.h"
  20 #include "qemu/bitops.h"
  21 #include "hw/irq.h"
  22 #include "hw/sysbus.h"
  23 #include "migration/vmstate.h"
  24 #include "hw/qdev-core.h"
  25 #include "hw/pci/pci.h"
  26 #include "cpu.h"
  27 #include "trace.h"
  28 #include "qemu/log.h"
  29 #include "qemu/error-report.h"
  30 #include "qapi/error.h"
  31
  32 #include "hw/arm/smmuv3.h"
  33 #include "smmuv3-internal.h"
  34 #include "smmu-internal.h"
  35
  36 /**
  37  * smmuv3_trigger_irq - pulse @irq if enabled and update
  38  * GERROR register in case of GERROR interrupt
  39  *
  40  * @irq: irq type
  41  * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
  42  */
  43 static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
  44                                uint32_t gerror_mask)
  45 {
  46
  47     bool pulse = false;
  48
  49     switch (irq) {
  50     case SMMU_IRQ_EVTQ:
  51         pulse = smmuv3_eventq_irq_enabled(s);
  52         break;
  53     case SMMU_IRQ_PRIQ:
  54         qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
  55         break;
  56     case SMMU_IRQ_CMD_SYNC:
  57         pulse = true;
  58         break;
  59     case SMMU_IRQ_GERROR:
  60     {
  61         uint32_t pending = s->gerror ^ s->gerrorn;
  62         uint32_t new_gerrors = ~pending & gerror_mask;
  63
  64         if (!new_gerrors) {
  65             /* only toggle non pending errors */
  66             return;
  67         }
  68         s->gerror ^= new_gerrors;
  69         trace_smmuv3_write_gerror(new_gerrors, s->gerror);
  70
  71         pulse = smmuv3_gerror_irq_enabled(s);
  72         break;
  73     }
  74     }
  75     if (pulse) {
  76             trace_smmuv3_trigger_irq(irq);
  77             qemu_irq_pulse(s->irq[irq]);
  78     }
  79 }
  80
  81 static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
  82 {
  83     uint32_t pending = s->gerror ^ s->gerrorn;
  84     uint32_t toggled = s->gerrorn ^ new_gerrorn;
  85
  86     if (toggled & ~pending) {
  87         qemu_log_mask(LOG_GUEST_ERROR,
  88                       "guest toggles non pending errors = 0x%x\n",
  89                       toggled & ~pending);
  90     }
  91
  92     /*
  93      * We do not raise any error in case guest toggles bits corresponding
  94      * to not active IRQs (CONSTRAINED UNPREDICTABLE)
  95      */
  96     s->gerrorn = new_gerrorn;
  97
  98     trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
  99 }
 100
 101 static inline MemTxResult queue_read(SMMUQueue *q, void *data)
 102 {
 103     dma_addr_t addr = Q_CONS_ENTRY(q);
 104
 105     return dma_memory_read(&address_space_memory, addr, data, q->entry_size,
 106                            MEMTXATTRS_UNSPECIFIED);
 107 }
 108
 109 static MemTxResult queue_write(SMMUQueue *q, void *data)
 110 {
 111     dma_addr_t addr = Q_PROD_ENTRY(q);
 112     MemTxResult ret;
 113
 114     ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size,
 115                            MEMTXATTRS_UNSPECIFIED);
 116     if (ret != MEMTX_OK) {
 117         return ret;
 118     }
 119
 120     queue_prod_incr(q);
 121     return MEMTX_OK;
 122 }
 123
 124 static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 125 {
 126     SMMUQueue *q = &s->eventq;
 127     MemTxResult r;
 128
 129     if (!smmuv3_eventq_enabled(s)) {
 130         return MEMTX_ERROR;
 131     }
 132
 133     if (smmuv3_q_full(q)) {
 134         return MEMTX_ERROR;
 135     }
 136
 137     r = queue_write(q, evt);
 138     if (r != MEMTX_OK) {
 139         return r;
 140     }
 141
 142     if (!smmuv3_q_empty(q)) {
 143         smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
 144     }
 145     return MEMTX_OK;
 146 }
 147
 148 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 149 {
 150     Evt evt = {};
 151     MemTxResult r;
 152
 153     if (!smmuv3_eventq_enabled(s)) {
 154         return;
 155     }
 156
 157     EVT_SET_TYPE(&evt, info->type);
 158     EVT_SET_SID(&evt, info->sid);
 159
 160     switch (info->type) {
 161     case SMMU_EVT_NONE:
 162         return;
 163     case SMMU_EVT_F_UUT:
 164         EVT_SET_SSID(&evt, info->u.f_uut.ssid);
 165         EVT_SET_SSV(&evt,  info->u.f_uut.ssv);
 166         EVT_SET_ADDR(&evt, info->u.f_uut.addr);
 167         EVT_SET_RNW(&evt,  info->u.f_uut.rnw);
 168         EVT_SET_PNU(&evt,  info->u.f_uut.pnu);
 169         EVT_SET_IND(&evt,  info->u.f_uut.ind);
 170         break;
 171     case SMMU_EVT_C_BAD_STREAMID:
 172         EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
 173         EVT_SET_SSV(&evt,  info->u.c_bad_streamid.ssv);
 174         break;
 175     case SMMU_EVT_F_STE_FETCH:
 176         EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
 177         EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
 178         EVT_SET_ADDR2(&evt, info->u.f_ste_fetch.addr);
 179         break;
 180     case SMMU_EVT_C_BAD_STE:
 181         EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
 182         EVT_SET_SSV(&evt,  info->u.c_bad_ste.ssv);
 183         break;
 184     case SMMU_EVT_F_STREAM_DISABLED:
 185         break;
 186     case SMMU_EVT_F_TRANS_FORBIDDEN:
 187         EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
 188         EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
 189         break;
 190     case SMMU_EVT_C_BAD_SUBSTREAMID:
 191         EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
 192         break;
 193     case SMMU_EVT_F_CD_FETCH:
 194         EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
 195         EVT_SET_SSV(&evt,  info->u.f_cd_fetch.ssv);
 196         EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
 197         break;
 198     case SMMU_EVT_C_BAD_CD:
 199         EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
 200         EVT_SET_SSV(&evt,  info->u.c_bad_cd.ssv);
 201         break;
 202     case SMMU_EVT_F_WALK_EABT:
 203     case SMMU_EVT_F_TRANSLATION:
 204     case SMMU_EVT_F_ADDR_SIZE:
 205     case SMMU_EVT_F_ACCESS:
 206     case SMMU_EVT_F_PERMISSION:
 207         EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
 208         EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
 209         EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
 210         EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
 211         EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
 212         EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
 213         EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
 214         EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
 215         EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
 216         EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
 217         EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
 218         break;
 219     case SMMU_EVT_F_CFG_CONFLICT:
 220         EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
 221         EVT_SET_SSV(&evt,  info->u.f_cfg_conflict.ssv);
 222         break;
 223     /* rest is not implemented */
 224     case SMMU_EVT_F_BAD_ATS_TREQ:
 225     case SMMU_EVT_F_TLB_CONFLICT:
 226     case SMMU_EVT_E_PAGE_REQ:
 227     default:
 228         g_assert_not_reached();
 229     }
 230
 231     trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
 232     r = smmuv3_write_eventq(s, &evt);
 233     if (r != MEMTX_OK) {
 234         smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
 235     }
 236     info->recorded = true;
 237 }
 238
 239 static void smmuv3_init_regs(SMMUv3State *s)
 240 {
 241     /**
 242      * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
 243      *       multi-level stream table
 244      */
 245     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
 246     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
 247     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
 248     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
 249     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
 250     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
 251     /* terminated transaction will always be aborted/error returned */
 252     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
 253     /* 2-level stream table supported */
 254     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
 255
 256     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
 257     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
 258     s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
 259
 260     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL, 1);
 261     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, HAD, 1);
 262     s->idr[3] = FIELD_DP32(s->idr[3], IDR3, BBML, 2);
 263
 264     /* 4K, 16K and 64K granule support */
 265     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
 266     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN16K, 1);
 267     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
 268     s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
 269
 270     s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
 271     s->cmdq.prod = 0;
 272     s->cmdq.cons = 0;
 273     s->cmdq.entry_size = sizeof(struct Cmd);
 274     s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
 275     s->eventq.prod = 0;
 276     s->eventq.cons = 0;
 277     s->eventq.entry_size = sizeof(struct Evt);
 278
 279     s->features = 0;
 280     s->sid_split = 0;
 281     s->aidr = 0x1;
 282     s->cr[0] = 0;
 283     s->cr0ack = 0;
 284     s->irq_ctrl = 0;
 285     s->gerror = 0;
 286     s->gerrorn = 0;
 287     s->statusr = 0;
 288     s->gbpa = SMMU_GBPA_RESET_VAL;
 289 }
 290
 291 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
 292                         SMMUEventInfo *event)
 293 {
 294     int ret;
 295
 296     trace_smmuv3_get_ste(addr);
 297     /* TODO: guarantee 64-bit single-copy atomicity */
 298     ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf),
 299                           MEMTXATTRS_UNSPECIFIED);
 300     if (ret != MEMTX_OK) {
 301         qemu_log_mask(LOG_GUEST_ERROR,
 302                       "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
 303         event->type = SMMU_EVT_F_STE_FETCH;
 304         event->u.f_ste_fetch.addr = addr;
 305         return -EINVAL;
 306     }
 307     return 0;
 308
 309 }
 310
 311 /* @ssid > 0 not supported yet */
 312 static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
 313                        CD *buf, SMMUEventInfo *event)
 314 {
 315     dma_addr_t addr = STE_CTXPTR(ste);
 316     int ret;
 317
 318     trace_smmuv3_get_cd(addr);
 319     /* TODO: guarantee 64-bit single-copy atomicity */
 320     ret = dma_memory_read(&address_space_memory, addr, buf, sizeof(*buf),
 321                           MEMTXATTRS_UNSPECIFIED);
 322     if (ret != MEMTX_OK) {
 323         qemu_log_mask(LOG_GUEST_ERROR,
 324                       "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
 325         event->type = SMMU_EVT_F_CD_FETCH;
 326         event->u.f_ste_fetch.addr = addr;
 327         return -EINVAL;
 328     }
 329     return 0;
 330 }
 331
 332 /* Returns < 0 in case of invalid STE, 0 otherwise */
 333 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
 334                       STE *ste, SMMUEventInfo *event)
 335 {
 336     uint32_t config;
 337
 338     if (!STE_VALID(ste)) {
 339         if (!event->inval_ste_allowed) {
 340             qemu_log_mask(LOG_GUEST_ERROR, "invalid STE\n");
 341         }
 342         goto bad_ste;
 343     }
 344
 345     config = STE_CONFIG(ste);
 346
 347     if (STE_CFG_ABORT(config)) {
 348         cfg->aborted = true;
 349         return 0;
 350     }
 351
 352     if (STE_CFG_BYPASS(config)) {
 353         cfg->bypassed = true;
 354         return 0;
 355     }
 356
 357     if (STE_CFG_S2_ENABLED(config)) {
 358         qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 359         goto bad_ste;
 360     }
 361
 362     if (STE_S1CDMAX(ste) != 0) {
 363         qemu_log_mask(LOG_UNIMP,
 364                       "SMMUv3 does not support multiple context descriptors yet\n");
 365         goto bad_ste;
 366     }
 367
 368     if (STE_S1STALLD(ste)) {
 369         qemu_log_mask(LOG_UNIMP,
 370                       "SMMUv3 S1 stalling fault model not allowed yet\n");
 371         goto bad_ste;
 372     }
 373     return 0;
 374
 375 bad_ste:
 376     event->type = SMMU_EVT_C_BAD_STE;
 377     return -EINVAL;
 378 }
 379
 380 /**
 381  * smmu_find_ste - Return the stream table entry associated
 382  * to the sid
 383  *
 384  * @s: smmuv3 handle
 385  * @sid: stream ID
 386  * @ste: returned stream table entry
 387  * @event: handle to an event info
 388  *
 389  * Supports linear and 2-level stream table
 390  * Return 0 on success, -EINVAL otherwise
 391  */
 392 static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
 393                          SMMUEventInfo *event)
 394 {
 395     dma_addr_t addr, strtab_base;
 396     uint32_t log2size;
 397     int strtab_size_shift;
 398     int ret;
 399
 400     trace_smmuv3_find_ste(sid, s->features, s->sid_split);
 401     log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE);
 402     /*
 403      * Check SID range against both guest-configured and implementation limits
 404      */
 405     if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
 406         event->type = SMMU_EVT_C_BAD_STREAMID;
 407         return -EINVAL;
 408     }
 409     if (s->features & SMMU_FEATURE_2LVL_STE) {
 410         int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
 411         dma_addr_t l1ptr, l2ptr;
 412         STEDesc l1std;
 413
 414         /*
 415          * Align strtab base address to table size. For this purpose, assume it
 416          * is not bounded by SMMU_IDR1_SIDSIZE.
 417          */
 418         strtab_size_shift = MAX(5, (int)log2size - s->sid_split - 1 + 3);
 419         strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
 420                       ~MAKE_64BIT_MASK(0, strtab_size_shift);
 421         l1_ste_offset = sid >> s->sid_split;
 422         l2_ste_offset = sid & ((1 << s->sid_split) - 1);
 423         l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
 424         /* TODO: guarantee 64-bit single-copy atomicity */
 425         ret = dma_memory_read(&address_space_memory, l1ptr, &l1std,
 426                               sizeof(l1std), MEMTXATTRS_UNSPECIFIED);
 427         if (ret != MEMTX_OK) {
 428             qemu_log_mask(LOG_GUEST_ERROR,
 429                           "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
 430             event->type = SMMU_EVT_F_STE_FETCH;
 431             event->u.f_ste_fetch.addr = l1ptr;
 432             return -EINVAL;
 433         }
 434
 435         span = L1STD_SPAN(&l1std);
 436
 437         if (!span) {
 438             /* l2ptr is not valid */
 439             if (!event->inval_ste_allowed) {
 440                 qemu_log_mask(LOG_GUEST_ERROR,
 441                               "invalid sid=%d (L1STD span=0)\n", sid);
 442             }
 443             event->type = SMMU_EVT_C_BAD_STREAMID;
 444             return -EINVAL;
 445         }
 446         max_l2_ste = (1 << span) - 1;
 447         l2ptr = l1std_l2ptr(&l1std);
 448         trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
 449                                    l2ptr, l2_ste_offset, max_l2_ste);
 450         if (l2_ste_offset > max_l2_ste) {
 451             qemu_log_mask(LOG_GUEST_ERROR,
 452                           "l2_ste_offset=%d > max_l2_ste=%d\n",
 453                           l2_ste_offset, max_l2_ste);
 454             event->type = SMMU_EVT_C_BAD_STE;
 455             return -EINVAL;
 456         }
 457         addr = l2ptr + l2_ste_offset * sizeof(*ste);
 458     } else {
 459         strtab_size_shift = log2size + 5;
 460         strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK &
 461                       ~MAKE_64BIT_MASK(0, strtab_size_shift);
 462         addr = strtab_base + sid * sizeof(*ste);
 463     }
 464
 465     if (smmu_get_ste(s, addr, ste, event)) {
 466         return -EINVAL;
 467     }
 468
 469     return 0;
 470 }
 471
 472 static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
 473 {
 474     int ret = -EINVAL;
 475     int i;
 476
 477     if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
 478         goto bad_cd;
 479     }
 480     if (!CD_A(cd)) {
 481         goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
 482     }
 483     if (CD_S(cd)) {
 484         goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
 485     }
 486     if (CD_HA(cd) || CD_HD(cd)) {
 487         goto bad_cd; /* HTTU = 0 */
 488     }
 489
 490     /* we support only those at the moment */
 491     cfg->aa64 = true;
 492     cfg->stage = 1;
 493
 494     cfg->oas = oas2bits(CD_IPS(cd));
 495     cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
 496     cfg->tbi = CD_TBI(cd);
 497     cfg->asid = CD_ASID(cd);
 498
 499     trace_smmuv3_decode_cd(cfg->oas);
 500
 501     /* decode data dependent on TT */
 502     for (i = 0; i <= 1; i++) {
 503         int tg, tsz;
 504         SMMUTransTableInfo *tt = &cfg->tt[i];
 505
 506         cfg->tt[i].disabled = CD_EPD(cd, i);
 507         if (cfg->tt[i].disabled) {
 508             continue;
 509         }
 510
 511         tsz = CD_TSZ(cd, i);
 512         if (tsz < 16 || tsz > 39) {
 513             goto bad_cd;
 514         }
 515
 516         tg = CD_TG(cd, i);
 517         tt->granule_sz = tg2granule(tg, i);
 518         if ((tt->granule_sz != 12 && tt->granule_sz != 14 &&
 519              tt->granule_sz != 16) || CD_ENDI(cd)) {
 520             goto bad_cd;
 521         }
 522
 523         tt->tsz = tsz;
 524         tt->ttb = CD_TTB(cd, i);
 525         if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
 526             goto bad_cd;
 527         }
 528         tt->had = CD_HAD(cd, i);
 529         trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz, tt->had);
 530     }
 531
 532     cfg->record_faults = CD_R(cd);
 533
 534     return 0;
 535
 536 bad_cd:
 537     event->type = SMMU_EVT_C_BAD_CD;
 538     return ret;
 539 }
 540
 541 /**
 542  * smmuv3_decode_config - Prepare the translation configuration
 543  * for the @mr iommu region
 544  * @mr: iommu memory region the translation config must be prepared for
 545  * @cfg: output translation configuration which is populated through
 546  *       the different configuration decoding steps
 547  * @event: must be zero'ed by the caller
 548  *
 549  * return < 0 in case of config decoding error (@event is filled
 550  * accordingly). Return 0 otherwise.
 551  */
 552 static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
 553                                 SMMUEventInfo *event)
 554 {
 555     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 556     uint32_t sid = smmu_get_sid(sdev);
 557     SMMUv3State *s = sdev->smmu;
 558     int ret;
 559     STE ste;
 560     CD cd;
 561
 562     ret = smmu_find_ste(s, sid, &ste, event);
 563     if (ret) {
 564         return ret;
 565     }
 566
 567     ret = decode_ste(s, cfg, &ste, event);
 568     if (ret) {
 569         return ret;
 570     }
 571
 572     if (cfg->aborted || cfg->bypassed) {
 573         return 0;
 574     }
 575
 576     ret = smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event);
 577     if (ret) {
 578         return ret;
 579     }
 580
 581     return decode_cd(cfg, &cd, event);
 582 }
 583
 584 /**
 585  * smmuv3_get_config - Look up for a cached copy of configuration data for
 586  * @sdev and on cache miss performs a configuration structure decoding from
 587  * guest RAM.
 588  *
 589  * @sdev: SMMUDevice handle
 590  * @event: output event info
 591  *
 592  * The configuration cache contains data resulting from both STE and CD
 593  * decoding under the form of an SMMUTransCfg struct. The hash table is indexed
 594  * by the SMMUDevice handle.
 595  */
 596 static SMMUTransCfg *smmuv3_get_config(SMMUDevice *sdev, SMMUEventInfo *event)
 597 {
 598     SMMUv3State *s = sdev->smmu;
 599     SMMUState *bc = &s->smmu_state;
 600     SMMUTransCfg *cfg;
 601
 602     cfg = g_hash_table_lookup(bc->configs, sdev);
 603     if (cfg) {
 604         sdev->cfg_cache_hits++;
 605         trace_smmuv3_config_cache_hit(smmu_get_sid(sdev),
 606                             sdev->cfg_cache_hits, sdev->cfg_cache_misses,
 607                             100 * sdev->cfg_cache_hits /
 608                             (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
 609     } else {
 610         sdev->cfg_cache_misses++;
 611         trace_smmuv3_config_cache_miss(smmu_get_sid(sdev),
 612                             sdev->cfg_cache_hits, sdev->cfg_cache_misses,
 613                             100 * sdev->cfg_cache_hits /
 614                             (sdev->cfg_cache_hits + sdev->cfg_cache_misses));
 615         cfg = g_new0(SMMUTransCfg, 1);
 616
 617         if (!smmuv3_decode_config(&sdev->iommu, cfg, event)) {
 618             g_hash_table_insert(bc->configs, sdev, cfg);
 619         } else {
 620             g_free(cfg);
 621             cfg = NULL;
 622         }
 623     }
 624     return cfg;
 625 }
 626
 627 static void smmuv3_flush_config(SMMUDevice *sdev)
 628 {
 629     SMMUv3State *s = sdev->smmu;
 630     SMMUState *bc = &s->smmu_state;
 631
 632     trace_smmuv3_config_cache_inv(smmu_get_sid(sdev));
 633     g_hash_table_remove(bc->configs, sdev);
 634 }
 635
 636 static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
 637                                       IOMMUAccessFlags flag, int iommu_idx)
 638 {
 639     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 640     SMMUv3State *s = sdev->smmu;
 641     uint32_t sid = smmu_get_sid(sdev);
 642     SMMUEventInfo event = {.type = SMMU_EVT_NONE,
 643                            .sid = sid,
 644                            .inval_ste_allowed = false};
 645     SMMUPTWEventInfo ptw_info = {};
 646     SMMUTranslationStatus status;
 647     SMMUState *bs = ARM_SMMU(s);
 648     uint64_t page_mask, aligned_addr;
 649     SMMUTLBEntry *cached_entry = NULL;
 650     SMMUTransTableInfo *tt;
 651     SMMUTransCfg *cfg = NULL;
 652     IOMMUTLBEntry entry = {
 653         .target_as = &address_space_memory,
 654         .iova = addr,
 655         .translated_addr = addr,
 656         .addr_mask = ~(hwaddr)0,
 657         .perm = IOMMU_NONE,
 658     };
 659
 660     qemu_mutex_lock(&s->mutex);
 661
 662     if (!smmu_enabled(s)) {
 663         if (FIELD_EX32(s->gbpa, GBPA, ABORT)) {
 664             status = SMMU_TRANS_ABORT;
 665         } else {
 666             status = SMMU_TRANS_DISABLE;
 667         }
 668         goto epilogue;
 669     }
 670
 671     cfg = smmuv3_get_config(sdev, &event);
 672     if (!cfg) {
 673         status = SMMU_TRANS_ERROR;
 674         goto epilogue;
 675     }
 676
 677     if (cfg->aborted) {
 678         status = SMMU_TRANS_ABORT;
 679         goto epilogue;
 680     }
 681
 682     if (cfg->bypassed) {
 683         status = SMMU_TRANS_BYPASS;
 684         goto epilogue;
 685     }
 686
 687     tt = select_tt(cfg, addr);
 688     if (!tt) {
 689         if (cfg->record_faults) {
 690             event.type = SMMU_EVT_F_TRANSLATION;
 691             event.u.f_translation.addr = addr;
 692             event.u.f_translation.rnw = flag & 0x1;
 693         }
 694         status = SMMU_TRANS_ERROR;
 695         goto epilogue;
 696     }
 697
 698     page_mask = (1ULL << (tt->granule_sz)) - 1;
 699     aligned_addr = addr & ~page_mask;
 700
 701     cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
 702     if (cached_entry) {
 703         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
 704             status = SMMU_TRANS_ERROR;
 705             if (cfg->record_faults) {
 706                 event.type = SMMU_EVT_F_PERMISSION;
 707                 event.u.f_permission.addr = addr;
 708                 event.u.f_permission.rnw = flag & 0x1;
 709             }
 710         } else {
 711             status = SMMU_TRANS_SUCCESS;
 712         }
 713         goto epilogue;
 714     }
 715
 716     cached_entry = g_new0(SMMUTLBEntry, 1);
 717
 718     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
 719         g_free(cached_entry);
 720         switch (ptw_info.type) {
 721         case SMMU_PTW_ERR_WALK_EABT:
 722             event.type = SMMU_EVT_F_WALK_EABT;
 723             event.u.f_walk_eabt.addr = addr;
 724             event.u.f_walk_eabt.rnw = flag & 0x1;
 725             event.u.f_walk_eabt.class = 0x1;
 726             event.u.f_walk_eabt.addr2 = ptw_info.addr;
 727             break;
 728         case SMMU_PTW_ERR_TRANSLATION:
 729             if (cfg->record_faults) {
 730                 event.type = SMMU_EVT_F_TRANSLATION;
 731                 event.u.f_translation.addr = addr;
 732                 event.u.f_translation.rnw = flag & 0x1;
 733             }
 734             break;
 735         case SMMU_PTW_ERR_ADDR_SIZE:
 736             if (cfg->record_faults) {
 737                 event.type = SMMU_EVT_F_ADDR_SIZE;
 738                 event.u.f_addr_size.addr = addr;
 739                 event.u.f_addr_size.rnw = flag & 0x1;
 740             }
 741             break;
 742         case SMMU_PTW_ERR_ACCESS:
 743             if (cfg->record_faults) {
 744                 event.type = SMMU_EVT_F_ACCESS;
 745                 event.u.f_access.addr = addr;
 746                 event.u.f_access.rnw = flag & 0x1;
 747             }
 748             break;
 749         case SMMU_PTW_ERR_PERMISSION:
 750             if (cfg->record_faults) {
 751                 event.type = SMMU_EVT_F_PERMISSION;
 752                 event.u.f_permission.addr = addr;
 753                 event.u.f_permission.rnw = flag & 0x1;
 754             }
 755             break;
 756         default:
 757             g_assert_not_reached();
 758         }
 759         status = SMMU_TRANS_ERROR;
 760     } else {
 761         smmu_iotlb_insert(bs, cfg, cached_entry);
 762         status = SMMU_TRANS_SUCCESS;
 763     }
 764
 765 epilogue:
 766     qemu_mutex_unlock(&s->mutex);
 767     switch (status) {
 768     case SMMU_TRANS_SUCCESS:
 769         entry.perm = cached_entry->entry.perm;
 770         entry.translated_addr = cached_entry->entry.translated_addr +
 771                                     (addr & cached_entry->entry.addr_mask);
 772         entry.addr_mask = cached_entry->entry.addr_mask;
 773         trace_smmuv3_translate_success(mr->parent_obj.name, sid, addr,
 774                                        entry.translated_addr, entry.perm);
 775         break;
 776     case SMMU_TRANS_DISABLE:
 777         entry.perm = flag;
 778         entry.addr_mask = ~TARGET_PAGE_MASK;
 779         trace_smmuv3_translate_disable(mr->parent_obj.name, sid, addr,
 780                                       entry.perm);
 781         break;
 782     case SMMU_TRANS_BYPASS:
 783         entry.perm = flag;
 784         entry.addr_mask = ~TARGET_PAGE_MASK;
 785         trace_smmuv3_translate_bypass(mr->parent_obj.name, sid, addr,
 786                                       entry.perm);
 787         break;
 788     case SMMU_TRANS_ABORT:
 789         /* no event is recorded on abort */
 790         trace_smmuv3_translate_abort(mr->parent_obj.name, sid, addr,
 791                                      entry.perm);
 792         break;
 793     case SMMU_TRANS_ERROR:
 794         qemu_log_mask(LOG_GUEST_ERROR,
 795                       "%s translation failed for iova=0x%"PRIx64" (%s)\n",
 796                       mr->parent_obj.name, addr, smmu_event_string(event.type));
 797         smmuv3_record_event(s, &event);
 798         break;
 799     }
 800
 801     return entry;
 802 }
 803
 804 /**
 805  * smmuv3_notify_iova - call the notifier @n for a given
 806  * @asid and @iova tuple.
 807  *
 808  * @mr: IOMMU mr region handle
 809  * @n: notifier to be called
 810  * @asid: address space ID or negative value if we don't care
 811  * @iova: iova
 812  * @tg: translation granule (if communicated through range invalidation)
 813  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
 814  */
 815 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
 816                                IOMMUNotifier *n,
 817                                int asid, dma_addr_t iova,
 818                                uint8_t tg, uint64_t num_pages)
 819 {
 820     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 821     IOMMUTLBEvent event;
 822     uint8_t granule;
 823
 824     if (!tg) {
 825         SMMUEventInfo event = {.inval_ste_allowed = true};
 826         SMMUTransCfg *cfg = smmuv3_get_config(sdev, &event);
 827         SMMUTransTableInfo *tt;
 828
 829         if (!cfg) {
 830             return;
 831         }
 832
 833         if (asid >= 0 && cfg->asid != asid) {
 834             return;
 835         }
 836
 837         tt = select_tt(cfg, iova);
 838         if (!tt) {
 839             return;
 840         }
 841         granule = tt->granule_sz;
 842     } else {
 843         granule = tg * 2 + 10;
 844     }
 845
 846     event.type = IOMMU_NOTIFIER_UNMAP;
 847     event.entry.target_as = &address_space_memory;
 848     event.entry.iova = iova;
 849     event.entry.addr_mask = num_pages * (1 << granule) - 1;
 850     event.entry.perm = IOMMU_NONE;
 851
 852     memory_region_notify_iommu_one(n, &event);
 853 }
 854
 855 /* invalidate an asid/iova range tuple in all mr's */
 856 static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
 857                                       uint8_t tg, uint64_t num_pages)
 858 {
 859     SMMUDevice *sdev;
 860
 861     QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
 862         IOMMUMemoryRegion *mr = &sdev->iommu;
 863         IOMMUNotifier *n;
 864
 865         trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
 866                                         tg, num_pages);
 867
 868         IOMMU_NOTIFIER_FOREACH(n, mr) {
 869             smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
 870         }
 871     }
 872 }
 873
 874 static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 875 {
 876     dma_addr_t end, addr = CMD_ADDR(cmd);
 877     uint8_t type = CMD_TYPE(cmd);
 878     uint16_t vmid = CMD_VMID(cmd);
 879     uint8_t scale = CMD_SCALE(cmd);
 880     uint8_t num = CMD_NUM(cmd);
 881     uint8_t ttl = CMD_TTL(cmd);
 882     bool leaf = CMD_LEAF(cmd);
 883     uint8_t tg = CMD_TG(cmd);
 884     uint64_t num_pages;
 885     uint8_t granule;
 886     int asid = -1;
 887
 888     if (type == SMMU_CMD_TLBI_NH_VA) {
 889         asid = CMD_ASID(cmd);
 890     }
 891
 892     if (!tg) {
 893         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
 894         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
 895         smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
 896         return;
 897     }
 898
 899     /* RIL in use */
 900
 901     num_pages = (num + 1) * BIT_ULL(scale);
 902     granule = tg * 2 + 10;
 903
 904     /* Split invalidations into ^2 range invalidations */
 905     end = addr + (num_pages << granule) - 1;
 906
 907     while (addr != end + 1) {
 908         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
 909
 910         num_pages = (mask + 1) >> granule;
 911         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
 912         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
 913         smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
 914         addr += mask + 1;
 915     }
 916 }
 917
 918 static gboolean
 919 smmuv3_invalidate_ste(gpointer key, gpointer value, gpointer user_data)
 920 {
 921     SMMUDevice *sdev = (SMMUDevice *)key;
 922     uint32_t sid = smmu_get_sid(sdev);
 923     SMMUSIDRange *sid_range = (SMMUSIDRange *)user_data;
 924
 925     if (sid < sid_range->start || sid > sid_range->end) {
 926         return false;
 927     }
 928     trace_smmuv3_config_cache_inv(sid);
 929     return true;
 930 }
 931
 932 static int smmuv3_cmdq_consume(SMMUv3State *s)
 933 {
 934     SMMUState *bs = ARM_SMMU(s);
 935     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
 936     SMMUQueue *q = &s->cmdq;
 937     SMMUCommandType type = 0;
 938
 939     if (!smmuv3_cmdq_enabled(s)) {
 940         return 0;
 941     }
 942     /*
 943      * some commands depend on register values, typically CR0. In case those
 944      * register values change while handling the command, spec says it
 945      * is UNPREDICTABLE whether the command is interpreted under the new
 946      * or old value.
 947      */
 948
 949     while (!smmuv3_q_empty(q)) {
 950         uint32_t pending = s->gerror ^ s->gerrorn;
 951         Cmd cmd;
 952
 953         trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
 954                                   Q_PROD_WRAP(q), Q_CONS_WRAP(q));
 955
 956         if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
 957             break;
 958         }
 959
 960         if (queue_read(q, &cmd) != MEMTX_OK) {
 961             cmd_error = SMMU_CERROR_ABT;
 962             break;
 963         }
 964
 965         type = CMD_TYPE(&cmd);
 966
 967         trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
 968
 969         qemu_mutex_lock(&s->mutex);
 970         switch (type) {
 971         case SMMU_CMD_SYNC:
 972             if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
 973                 smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
 974             }
 975             break;
 976         case SMMU_CMD_PREFETCH_CONFIG:
 977         case SMMU_CMD_PREFETCH_ADDR:
 978             break;
 979         case SMMU_CMD_CFGI_STE:
 980         {
 981             uint32_t sid = CMD_SID(&cmd);
 982             IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid);
 983             SMMUDevice *sdev;
 984
 985             if (CMD_SSEC(&cmd)) {
 986                 cmd_error = SMMU_CERROR_ILL;
 987                 break;
 988             }
 989
 990             if (!mr) {
 991                 break;
 992             }
 993
 994             trace_smmuv3_cmdq_cfgi_ste(sid);
 995             sdev = container_of(mr, SMMUDevice, iommu);
 996             smmuv3_flush_config(sdev);
 997
 998             break;
 999         }
1000         case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
1001         {
1002             uint32_t sid = CMD_SID(&cmd), mask;
1003             uint8_t range = CMD_STE_RANGE(&cmd);
1004             SMMUSIDRange sid_range;
1005
1006             if (CMD_SSEC(&cmd)) {
1007                 cmd_error = SMMU_CERROR_ILL;
1008                 break;
1009             }
1010
1011             mask = (1ULL << (range + 1)) - 1;
1012             sid_range.start = sid & ~mask;
1013             sid_range.end = sid_range.start + mask;
1014
1015             trace_smmuv3_cmdq_cfgi_ste_range(sid_range.start, sid_range.end);
1016             g_hash_table_foreach_remove(bs->configs, smmuv3_invalidate_ste,
1017                                         &sid_range);
1018             break;
1019         }
1020         case SMMU_CMD_CFGI_CD:
1021         case SMMU_CMD_CFGI_CD_ALL:
1022         {
1023             uint32_t sid = CMD_SID(&cmd);
1024             IOMMUMemoryRegion *mr = smmu_iommu_mr(bs, sid);
1025             SMMUDevice *sdev;
1026
1027             if (CMD_SSEC(&cmd)) {
1028                 cmd_error = SMMU_CERROR_ILL;
1029                 break;
1030             }
1031
1032             if (!mr) {
1033                 break;
1034             }
1035
1036             trace_smmuv3_cmdq_cfgi_cd(sid);
1037             sdev = container_of(mr, SMMUDevice, iommu);
1038             smmuv3_flush_config(sdev);
1039             break;
1040         }
1041         case SMMU_CMD_TLBI_NH_ASID:
1042         {
1043             uint16_t asid = CMD_ASID(&cmd);
1044
1045             trace_smmuv3_cmdq_tlbi_nh_asid(asid);
1046             smmu_inv_notifiers_all(&s->smmu_state);
1047             smmu_iotlb_inv_asid(bs, asid);
1048             break;
1049         }
1050         case SMMU_CMD_TLBI_NH_ALL:
1051         case SMMU_CMD_TLBI_NSNH_ALL:
1052             trace_smmuv3_cmdq_tlbi_nh();
1053             smmu_inv_notifiers_all(&s->smmu_state);
1054             smmu_iotlb_inv_all(bs);
1055             break;
1056         case SMMU_CMD_TLBI_NH_VAA:
1057         case SMMU_CMD_TLBI_NH_VA:
1058             smmuv3_s1_range_inval(bs, &cmd);
1059             break;
1060         case SMMU_CMD_TLBI_EL3_ALL:
1061         case SMMU_CMD_TLBI_EL3_VA:
1062         case SMMU_CMD_TLBI_EL2_ALL:
1063         case SMMU_CMD_TLBI_EL2_ASID:
1064         case SMMU_CMD_TLBI_EL2_VA:
1065         case SMMU_CMD_TLBI_EL2_VAA:
1066         case SMMU_CMD_TLBI_S12_VMALL:
1067         case SMMU_CMD_TLBI_S2_IPA:
1068         case SMMU_CMD_ATC_INV:
1069         case SMMU_CMD_PRI_RESP:
1070         case SMMU_CMD_RESUME:
1071         case SMMU_CMD_STALL_TERM:
1072             trace_smmuv3_unhandled_cmd(type);
1073             break;
1074         default:
1075             cmd_error = SMMU_CERROR_ILL;
1076             qemu_log_mask(LOG_GUEST_ERROR,
1077                           "Illegal command type: %d\n", CMD_TYPE(&cmd));
1078             break;
1079         }
1080         qemu_mutex_unlock(&s->mutex);
1081         if (cmd_error) {
1082             break;
1083         }
1084         /*
1085          * We only increment the cons index after the completion of
1086          * the command. We do that because the SYNC returns immediately
1087          * and does not check the completion of previous commands
1088          */
1089         queue_cons_incr(q);
1090     }
1091
1092     if (cmd_error) {
1093         trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
1094         smmu_write_cmdq_err(s, cmd_error);
1095         smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
1096     }
1097
1098     trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
1099                                   Q_PROD_WRAP(q), Q_CONS_WRAP(q));
1100
1101     return 0;
1102 }
1103
1104 static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
1105                                uint64_t data, MemTxAttrs attrs)
1106 {
1107     switch (offset) {
1108     case A_GERROR_IRQ_CFG0:
1109         s->gerror_irq_cfg0 = data;
1110         return MEMTX_OK;
1111     case A_STRTAB_BASE:
1112         s->strtab_base = data;
1113         return MEMTX_OK;
1114     case A_CMDQ_BASE:
1115         s->cmdq.base = data;
1116         s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1117         if (s->cmdq.log2size > SMMU_CMDQS) {
1118             s->cmdq.log2size = SMMU_CMDQS;
1119         }
1120         return MEMTX_OK;
1121     case A_EVENTQ_BASE:
1122         s->eventq.base = data;
1123         s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1124         if (s->eventq.log2size > SMMU_EVENTQS) {
1125             s->eventq.log2size = SMMU_EVENTQS;
1126         }
1127         return MEMTX_OK;
1128     case A_EVENTQ_IRQ_CFG0:
1129         s->eventq_irq_cfg0 = data;
1130         return MEMTX_OK;
1131     default:
1132         qemu_log_mask(LOG_UNIMP,
1133                       "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
1134                       __func__, offset);
1135         return MEMTX_OK;
1136     }
1137 }
1138
1139 static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
1140                                uint64_t data, MemTxAttrs attrs)
1141 {
1142     switch (offset) {
1143     case A_CR0:
1144         s->cr[0] = data;
1145         s->cr0ack = data & ~SMMU_CR0_RESERVED;
1146         /* in case the command queue has been enabled */
1147         smmuv3_cmdq_consume(s);
1148         return MEMTX_OK;
1149     case A_CR1:
1150         s->cr[1] = data;
1151         return MEMTX_OK;
1152     case A_CR2:
1153         s->cr[2] = data;
1154         return MEMTX_OK;
1155     case A_IRQ_CTRL:
1156         s->irq_ctrl = data;
1157         return MEMTX_OK;
1158     case A_GERRORN:
1159         smmuv3_write_gerrorn(s, data);
1160         /*
1161          * By acknowledging the CMDQ_ERR, SW may notify cmds can
1162          * be processed again
1163          */
1164         smmuv3_cmdq_consume(s);
1165         return MEMTX_OK;
1166     case A_GERROR_IRQ_CFG0: /* 64b */
1167         s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
1168         return MEMTX_OK;
1169     case A_GERROR_IRQ_CFG0 + 4:
1170         s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
1171         return MEMTX_OK;
1172     case A_GERROR_IRQ_CFG1:
1173         s->gerror_irq_cfg1 = data;
1174         return MEMTX_OK;
1175     case A_GERROR_IRQ_CFG2:
1176         s->gerror_irq_cfg2 = data;
1177         return MEMTX_OK;
1178     case A_GBPA:
1179         /*
1180          * If UPDATE is not set, the write is ignored. This is the only
1181          * permitted behavior in SMMUv3.2 and later.
1182          */
1183         if (data & R_GBPA_UPDATE_MASK) {
1184             /* Ignore update bit as write is synchronous. */
1185             s->gbpa = data & ~R_GBPA_UPDATE_MASK;
1186         }
1187         return MEMTX_OK;
1188     case A_STRTAB_BASE: /* 64b */
1189         s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
1190         return MEMTX_OK;
1191     case A_STRTAB_BASE + 4:
1192         s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
1193         return MEMTX_OK;
1194     case A_STRTAB_BASE_CFG:
1195         s->strtab_base_cfg = data;
1196         if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
1197             s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
1198             s->features |= SMMU_FEATURE_2LVL_STE;
1199         }
1200         return MEMTX_OK;
1201     case A_CMDQ_BASE: /* 64b */
1202         s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
1203         s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
1204         if (s->cmdq.log2size > SMMU_CMDQS) {
1205             s->cmdq.log2size = SMMU_CMDQS;
1206         }
1207         return MEMTX_OK;
1208     case A_CMDQ_BASE + 4: /* 64b */
1209         s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
1210         return MEMTX_OK;
1211     case A_CMDQ_PROD:
1212         s->cmdq.prod = data;
1213         smmuv3_cmdq_consume(s);
1214         return MEMTX_OK;
1215     case A_CMDQ_CONS:
1216         s->cmdq.cons = data;
1217         return MEMTX_OK;
1218     case A_EVENTQ_BASE: /* 64b */
1219         s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
1220         s->eventq.log2size = extract64(s->eventq.base, 0, 5);
1221         if (s->eventq.log2size > SMMU_EVENTQS) {
1222             s->eventq.log2size = SMMU_EVENTQS;
1223         }
1224         return MEMTX_OK;
1225     case A_EVENTQ_BASE + 4:
1226         s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
1227         return MEMTX_OK;
1228     case A_EVENTQ_PROD:
1229         s->eventq.prod = data;
1230         return MEMTX_OK;
1231     case A_EVENTQ_CONS:
1232         s->eventq.cons = data;
1233         return MEMTX_OK;
1234     case A_EVENTQ_IRQ_CFG0: /* 64b */
1235         s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
1236         return MEMTX_OK;
1237     case A_EVENTQ_IRQ_CFG0 + 4:
1238         s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
1239         return MEMTX_OK;
1240     case A_EVENTQ_IRQ_CFG1:
1241         s->eventq_irq_cfg1 = data;
1242         return MEMTX_OK;
1243     case A_EVENTQ_IRQ_CFG2:
1244         s->eventq_irq_cfg2 = data;
1245         return MEMTX_OK;
1246     default:
1247         qemu_log_mask(LOG_UNIMP,
1248                       "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
1249                       __func__, offset);
1250         return MEMTX_OK;
1251     }
1252 }
1253
1254 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
1255                                    unsigned size, MemTxAttrs attrs)
1256 {
1257     SMMUState *sys = opaque;
1258     SMMUv3State *s = ARM_SMMUV3(sys);
1259     MemTxResult r;
1260
1261     /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1262     offset &= ~0x10000;
1263
1264     switch (size) {
1265     case 8:
1266         r = smmu_writell(s, offset, data, attrs);
1267         break;
1268     case 4:
1269         r = smmu_writel(s, offset, data, attrs);
1270         break;
1271     default:
1272         r = MEMTX_ERROR;
1273         break;
1274     }
1275
1276     trace_smmuv3_write_mmio(offset, data, size, r);
1277     return r;
1278 }
1279
1280 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
1281                                uint64_t *data, MemTxAttrs attrs)
1282 {
1283     switch (offset) {
1284     case A_GERROR_IRQ_CFG0:
1285         *data = s->gerror_irq_cfg0;
1286         return MEMTX_OK;
1287     case A_STRTAB_BASE:
1288         *data = s->strtab_base;
1289         return MEMTX_OK;
1290     case A_CMDQ_BASE:
1291         *data = s->cmdq.base;
1292         return MEMTX_OK;
1293     case A_EVENTQ_BASE:
1294         *data = s->eventq.base;
1295         return MEMTX_OK;
1296     default:
1297         *data = 0;
1298         qemu_log_mask(LOG_UNIMP,
1299                       "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
1300                       __func__, offset);
1301         return MEMTX_OK;
1302     }
1303 }
1304
1305 static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
1306                               uint64_t *data, MemTxAttrs attrs)
1307 {
1308     switch (offset) {
1309     case A_IDREGS ... A_IDREGS + 0x2f:
1310         *data = smmuv3_idreg(offset - A_IDREGS);
1311         return MEMTX_OK;
1312     case A_IDR0 ... A_IDR5:
1313         *data = s->idr[(offset - A_IDR0) / 4];
1314         return MEMTX_OK;
1315     case A_IIDR:
1316         *data = s->iidr;
1317         return MEMTX_OK;
1318     case A_AIDR:
1319         *data = s->aidr;
1320         return MEMTX_OK;
1321     case A_CR0:
1322         *data = s->cr[0];
1323         return MEMTX_OK;
1324     case A_CR0ACK:
1325         *data = s->cr0ack;
1326         return MEMTX_OK;
1327     case A_CR1:
1328         *data = s->cr[1];
1329         return MEMTX_OK;
1330     case A_CR2:
1331         *data = s->cr[2];
1332         return MEMTX_OK;
1333     case A_STATUSR:
1334         *data = s->statusr;
1335         return MEMTX_OK;
1336     case A_GBPA:
1337         *data = s->gbpa;
1338         return MEMTX_OK;
1339     case A_IRQ_CTRL:
1340     case A_IRQ_CTRL_ACK:
1341         *data = s->irq_ctrl;
1342         return MEMTX_OK;
1343     case A_GERROR:
1344         *data = s->gerror;
1345         return MEMTX_OK;
1346     case A_GERRORN:
1347         *data = s->gerrorn;
1348         return MEMTX_OK;
1349     case A_GERROR_IRQ_CFG0: /* 64b */
1350         *data = extract64(s->gerror_irq_cfg0, 0, 32);
1351         return MEMTX_OK;
1352     case A_GERROR_IRQ_CFG0 + 4:
1353         *data = extract64(s->gerror_irq_cfg0, 32, 32);
1354         return MEMTX_OK;
1355     case A_GERROR_IRQ_CFG1:
1356         *data = s->gerror_irq_cfg1;
1357         return MEMTX_OK;
1358     case A_GERROR_IRQ_CFG2:
1359         *data = s->gerror_irq_cfg2;
1360         return MEMTX_OK;
1361     case A_STRTAB_BASE: /* 64b */
1362         *data = extract64(s->strtab_base, 0, 32);
1363         return MEMTX_OK;
1364     case A_STRTAB_BASE + 4: /* 64b */
1365         *data = extract64(s->strtab_base, 32, 32);
1366         return MEMTX_OK;
1367     case A_STRTAB_BASE_CFG:
1368         *data = s->strtab_base_cfg;
1369         return MEMTX_OK;
1370     case A_CMDQ_BASE: /* 64b */
1371         *data = extract64(s->cmdq.base, 0, 32);
1372         return MEMTX_OK;
1373     case A_CMDQ_BASE + 4:
1374         *data = extract64(s->cmdq.base, 32, 32);
1375         return MEMTX_OK;
1376     case A_CMDQ_PROD:
1377         *data = s->cmdq.prod;
1378         return MEMTX_OK;
1379     case A_CMDQ_CONS:
1380         *data = s->cmdq.cons;
1381         return MEMTX_OK;
1382     case A_EVENTQ_BASE: /* 64b */
1383         *data = extract64(s->eventq.base, 0, 32);
1384         return MEMTX_OK;
1385     case A_EVENTQ_BASE + 4: /* 64b */
1386         *data = extract64(s->eventq.base, 32, 32);
1387         return MEMTX_OK;
1388     case A_EVENTQ_PROD:
1389         *data = s->eventq.prod;
1390         return MEMTX_OK;
1391     case A_EVENTQ_CONS:
1392         *data = s->eventq.cons;
1393         return MEMTX_OK;
1394     default:
1395         *data = 0;
1396         qemu_log_mask(LOG_UNIMP,
1397                       "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
1398                       __func__, offset);
1399         return MEMTX_OK;
1400     }
1401 }
1402
1403 static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
1404                                   unsigned size, MemTxAttrs attrs)
1405 {
1406     SMMUState *sys = opaque;
1407     SMMUv3State *s = ARM_SMMUV3(sys);
1408     MemTxResult r;
1409
1410     /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
1411     offset &= ~0x10000;
1412
1413     switch (size) {
1414     case 8:
1415         r = smmu_readll(s, offset, data, attrs);
1416         break;
1417     case 4:
1418         r = smmu_readl(s, offset, data, attrs);
1419         break;
1420     default:
1421         r = MEMTX_ERROR;
1422         break;
1423     }
1424
1425     trace_smmuv3_read_mmio(offset, *data, size, r);
1426     return r;
1427 }
1428
1429 static const MemoryRegionOps smmu_mem_ops = {
1430     .read_with_attrs = smmu_read_mmio,
1431     .write_with_attrs = smmu_write_mmio,
1432     .endianness = DEVICE_LITTLE_ENDIAN,
1433     .valid = {
1434         .min_access_size = 4,
1435         .max_access_size = 8,
1436     },
1437     .impl = {
1438         .min_access_size = 4,
1439         .max_access_size = 8,
1440     },
1441 };
1442
1443 static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
1444 {
1445     int i;
1446
1447     for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
1448         sysbus_init_irq(dev, &s->irq[i]);
1449     }
1450 }
1451
1452 static void smmu_reset_hold(Object *obj)
1453 {
1454     SMMUv3State *s = ARM_SMMUV3(obj);
1455     SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1456
1457     if (c->parent_phases.hold) {
1458         c->parent_phases.hold(obj);
1459     }
1460
1461     smmuv3_init_regs(s);
1462 }
1463
1464 static void smmu_realize(DeviceState *d, Error **errp)
1465 {
1466     SMMUState *sys = ARM_SMMU(d);
1467     SMMUv3State *s = ARM_SMMUV3(sys);
1468     SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
1469     SysBusDevice *dev = SYS_BUS_DEVICE(d);
1470     Error *local_err = NULL;
1471
1472     c->parent_realize(d, &local_err);
1473     if (local_err) {
1474         error_propagate(errp, local_err);
1475         return;
1476     }
1477
1478     qemu_mutex_init(&s->mutex);
1479
1480     memory_region_init_io(&sys->iomem, OBJECT(s),
1481                           &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
1482
1483     sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
1484
1485     sysbus_init_mmio(dev, &sys->iomem);
1486
1487     smmu_init_irq(s, dev);
1488 }
1489
1490 static const VMStateDescription vmstate_smmuv3_queue = {
1491     .name = "smmuv3_queue",
1492     .version_id = 1,
1493     .minimum_version_id = 1,
1494     .fields = (VMStateField[]) {
1495         VMSTATE_UINT64(base, SMMUQueue),
1496         VMSTATE_UINT32(prod, SMMUQueue),
1497         VMSTATE_UINT32(cons, SMMUQueue),
1498         VMSTATE_UINT8(log2size, SMMUQueue),
1499         VMSTATE_END_OF_LIST(),
1500     },
1501 };
1502
1503 static bool smmuv3_gbpa_needed(void *opaque)
1504 {
1505     SMMUv3State *s = opaque;
1506
1507     /* Only migrate GBPA if it has different reset value. */
1508     return s->gbpa != SMMU_GBPA_RESET_VAL;
1509 }
1510
1511 static const VMStateDescription vmstate_gbpa = {
1512     .name = "smmuv3/gbpa",
1513     .version_id = 1,
1514     .minimum_version_id = 1,
1515     .needed = smmuv3_gbpa_needed,
1516     .fields = (VMStateField[]) {
1517         VMSTATE_UINT32(gbpa, SMMUv3State),
1518         VMSTATE_END_OF_LIST()
1519     }
1520 };
1521
1522 static const VMStateDescription vmstate_smmuv3 = {
1523     .name = "smmuv3",
1524     .version_id = 1,
1525     .minimum_version_id = 1,
1526     .priority = MIG_PRI_IOMMU,
1527     .fields = (VMStateField[]) {
1528         VMSTATE_UINT32(features, SMMUv3State),
1529         VMSTATE_UINT8(sid_size, SMMUv3State),
1530         VMSTATE_UINT8(sid_split, SMMUv3State),
1531
1532         VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
1533         VMSTATE_UINT32(cr0ack, SMMUv3State),
1534         VMSTATE_UINT32(statusr, SMMUv3State),
1535         VMSTATE_UINT32(irq_ctrl, SMMUv3State),
1536         VMSTATE_UINT32(gerror, SMMUv3State),
1537         VMSTATE_UINT32(gerrorn, SMMUv3State),
1538         VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
1539         VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
1540         VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
1541         VMSTATE_UINT64(strtab_base, SMMUv3State),
1542         VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
1543         VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
1544         VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
1545         VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
1546
1547         VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1548         VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
1549
1550         VMSTATE_END_OF_LIST(),
1551     },
1552     .subsections = (const VMStateDescription * []) {
1553         &vmstate_gbpa,
1554         NULL
1555     }
1556 };
1557
1558 static void smmuv3_instance_init(Object *obj)
1559 {
1560     /* Nothing much to do here as of now */
1561 }
1562
1563 static void smmuv3_class_init(ObjectClass *klass, void *data)
1564 {
1565     DeviceClass *dc = DEVICE_CLASS(klass);
1566     ResettableClass *rc = RESETTABLE_CLASS(klass);
1567     SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
1568
1569     dc->vmsd = &vmstate_smmuv3;
1570     resettable_class_set_parent_phases(rc, NULL, smmu_reset_hold, NULL,
1571                                        &c->parent_phases);
1572     c->parent_realize = dc->realize;
1573     dc->realize = smmu_realize;
1574 }
1575
1576 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
1577                                       IOMMUNotifierFlag old,
1578                                       IOMMUNotifierFlag new,
1579                                       Error **errp)
1580 {
1581     SMMUDevice *sdev = container_of(iommu, SMMUDevice, iommu);
1582     SMMUv3State *s3 = sdev->smmu;
1583     SMMUState *s = &(s3->smmu_state);
1584
1585     if (new & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
1586         error_setg(errp, "SMMUv3 does not support dev-iotlb yet");
1587         return -EINVAL;
1588     }
1589
1590     if (new & IOMMU_NOTIFIER_MAP) {
1591         error_setg(errp,
1592                    "device %02x.%02x.%x requires iommu MAP notifier which is "
1593                    "not currently supported", pci_bus_num(sdev->bus),
1594                    PCI_SLOT(sdev->devfn), PCI_FUNC(sdev->devfn));
1595         return -EINVAL;
1596     }
1597
1598     if (old == IOMMU_NOTIFIER_NONE) {
1599         trace_smmuv3_notify_flag_add(iommu->parent_obj.name);
1600         QLIST_INSERT_HEAD(&s->devices_with_notifiers, sdev, next);
1601     } else if (new == IOMMU_NOTIFIER_NONE) {
1602         trace_smmuv3_notify_flag_del(iommu->parent_obj.name);
1603         QLIST_REMOVE(sdev, next);
1604     }
1605     return 0;
1606 }
1607
1608 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
1609                                                   void *data)
1610 {
1611     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1612
1613     imrc->translate = smmuv3_translate;
1614     imrc->notify_flag_changed = smmuv3_notify_flag_changed;
1615 }
1616
1617 static const TypeInfo smmuv3_type_info = {
1618     .name          = TYPE_ARM_SMMUV3,
1619     .parent        = TYPE_ARM_SMMU,
1620     .instance_size = sizeof(SMMUv3State),
1621     .instance_init = smmuv3_instance_init,
1622     .class_size    = sizeof(SMMUv3Class),
1623     .class_init    = smmuv3_class_init,
1624 };
1625
1626 static const TypeInfo smmuv3_iommu_memory_region_info = {
1627     .parent = TYPE_IOMMU_MEMORY_REGION,
1628     .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
1629     .class_init = smmuv3_iommu_memory_region_class_init,
1630 };
1631
1632 static void smmuv3_register_types(void)
1633 {
1634     type_register(&smmuv3_type_info);
1635     type_register(&smmuv3_iommu_memory_region_info);
1636 }
1637
1638 type_init(smmuv3_register_types)
1639