]> git.proxmox.com Git - mirror_qemu.git/blame - hw/i386/intel_iommu.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
virtio-crypto: tag as not hotpluggable and migration
[mirror_qemu.git] / hw / i386 / intel_iommu.c
CommitLineData
1da12ec4
LT		 1/*
2 * QEMU emulation of an Intel IOMMU (VT-d)
3 * (DMA Remapping device)
4 *
5 * Copyright (C) 2013 Knut Omang, Oracle <knut.omang@oracle.com>
6 * Copyright (C) 2014 Le Tan, <tamlokveer@gmail.com>
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
b6a0aa05 22#include "qemu/osdep.h"
4684a204 23#include "qemu/error-report.h"
6333e93c 24#include "qapi/error.h"
1da12ec4
LT		 25#include "hw/sysbus.h"
26#include "exec/address-spaces.h"
27#include "intel_iommu_internal.h"
7df953bd 28#include "hw/pci/pci.h"
3cb3b154 29#include "hw/pci/pci_bus.h"
621d983a 30#include "hw/i386/pc.h"
dea651a9 31#include "hw/i386/apic-msidef.h"
04af0e18
PX		 32#include "hw/boards.h"
33#include "hw/i386/x86-iommu.h"
cb135f59 34#include "hw/pci-host/q35.h"
4684a204 35#include "sysemu/kvm.h"
32946019 36#include "hw/i386/apic_internal.h"
fb506e70 37#include "kvm_i386.h"
1da12ec4
LT		 38
39/*#define DEBUG_INTEL_IOMMU*/
40#ifdef DEBUG_INTEL_IOMMU
41enum {
42 DEBUG_GENERAL, DEBUG_CSR, DEBUG_INV, DEBUG_MMU, DEBUG_FLOG,
a5861439 43 DEBUG_CACHE, DEBUG_IR,
1da12ec4
LT		 44};
45#define VTD_DBGBIT(x) (1 << DEBUG_##x)
46static int vtd_dbgflags = VTD_DBGBIT(GENERAL) | VTD_DBGBIT(CSR);
47
48#define VTD_DPRINTF(what, fmt, ...) do { \
49 if (vtd_dbgflags & VTD_DBGBIT(what)) { \
50 fprintf(stderr, "(vtd)%s: " fmt "\n", __func__, \
51 ## __VA_ARGS__); } \
52 } while (0)
53#else
54#define VTD_DPRINTF(what, fmt, ...) do {} while (0)
55#endif
56
57static void vtd_define_quad(IntelIOMMUState *s, hwaddr addr, uint64_t val,
58 uint64_t wmask, uint64_t w1cmask)
59{
60 stq_le_p(&s->csr[addr], val);
61 stq_le_p(&s->wmask[addr], wmask);
62 stq_le_p(&s->w1cmask[addr], w1cmask);
63}
64
65static void vtd_define_quad_wo(IntelIOMMUState *s, hwaddr addr, uint64_t mask)
66{
67 stq_le_p(&s->womask[addr], mask);
68}
69
70static void vtd_define_long(IntelIOMMUState *s, hwaddr addr, uint32_t val,
71 uint32_t wmask, uint32_t w1cmask)
72{
73 stl_le_p(&s->csr[addr], val);
74 stl_le_p(&s->wmask[addr], wmask);
75 stl_le_p(&s->w1cmask[addr], w1cmask);
76}
77
78static void vtd_define_long_wo(IntelIOMMUState *s, hwaddr addr, uint32_t mask)
79{
80 stl_le_p(&s->womask[addr], mask);
81}
82
83/* "External" get/set operations */
84static void vtd_set_quad(IntelIOMMUState *s, hwaddr addr, uint64_t val)
85{
86 uint64_t oldval = ldq_le_p(&s->csr[addr]);
87 uint64_t wmask = ldq_le_p(&s->wmask[addr]);
88 uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
89 stq_le_p(&s->csr[addr],
90 ((oldval & ~wmask) | (val & wmask)) & ~(w1cmask & val));
91}
92
93static void vtd_set_long(IntelIOMMUState *s, hwaddr addr, uint32_t val)
94{
95 uint32_t oldval = ldl_le_p(&s->csr[addr]);
96 uint32_t wmask = ldl_le_p(&s->wmask[addr]);
97 uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
98 stl_le_p(&s->csr[addr],
99 ((oldval & ~wmask) | (val & wmask)) & ~(w1cmask & val));
100}
101
102static uint64_t vtd_get_quad(IntelIOMMUState *s, hwaddr addr)
103{
104 uint64_t val = ldq_le_p(&s->csr[addr]);
105 uint64_t womask = ldq_le_p(&s->womask[addr]);
106 return val & ~womask;
107}
108
109static uint32_t vtd_get_long(IntelIOMMUState *s, hwaddr addr)
110{
111 uint32_t val = ldl_le_p(&s->csr[addr]);
112 uint32_t womask = ldl_le_p(&s->womask[addr]);
113 return val & ~womask;
114}
115
116/* "Internal" get/set operations */
117static uint64_t vtd_get_quad_raw(IntelIOMMUState *s, hwaddr addr)
118{
119 return ldq_le_p(&s->csr[addr]);
120}
121
122static uint32_t vtd_get_long_raw(IntelIOMMUState *s, hwaddr addr)
123{
124 return ldl_le_p(&s->csr[addr]);
125}
126
127static void vtd_set_quad_raw(IntelIOMMUState *s, hwaddr addr, uint64_t val)
128{
129 stq_le_p(&s->csr[addr], val);
130}
131
132static uint32_t vtd_set_clear_mask_long(IntelIOMMUState *s, hwaddr addr,
133 uint32_t clear, uint32_t mask)
134{
135 uint32_t new_val = (ldl_le_p(&s->csr[addr]) & ~clear) | mask;
136 stl_le_p(&s->csr[addr], new_val);
137 return new_val;
138}
139
140static uint64_t vtd_set_clear_mask_quad(IntelIOMMUState *s, hwaddr addr,
141 uint64_t clear, uint64_t mask)
142{
143 uint64_t new_val = (ldq_le_p(&s->csr[addr]) & ~clear) | mask;
144 stq_le_p(&s->csr[addr], new_val);
145 return new_val;
146}
147
b5a280c0
LT		 148/* GHashTable functions */
149static gboolean vtd_uint64_equal(gconstpointer v1, gconstpointer v2)
150{
151 return *((const uint64_t *)v1) == *((const uint64_t *)v2);
152}
153
154static guint vtd_uint64_hash(gconstpointer v)
155{
156 return (guint)*(const uint64_t *)v;
157}
158
159static gboolean vtd_hash_remove_by_domain(gpointer key, gpointer value,
160 gpointer user_data)
161{
162 VTDIOTLBEntry *entry = (VTDIOTLBEntry *)value;
163 uint16_t domain_id = *(uint16_t *)user_data;
164 return entry->domain_id == domain_id;
165}
166
d66b969b
JW		 167/* The shift of an addr for a certain level of paging structure */
168static inline uint32_t vtd_slpt_level_shift(uint32_t level)
169{
170 return VTD_PAGE_SHIFT_4K + (level - 1) * VTD_SL_LEVEL_BITS;
171}
172
173static inline uint64_t vtd_slpt_level_page_mask(uint32_t level)
174{
175 return ~((1ULL << vtd_slpt_level_shift(level)) - 1);
176}
177
b5a280c0
LT		 178static gboolean vtd_hash_remove_by_page(gpointer key, gpointer value,
179 gpointer user_data)
180{
181 VTDIOTLBEntry *entry = (VTDIOTLBEntry *)value;
182 VTDIOTLBPageInvInfo *info = (VTDIOTLBPageInvInfo *)user_data;
d66b969b
JW		 183 uint64_t gfn = (info->addr >> VTD_PAGE_SHIFT_4K) & info->mask;
184 uint64_t gfn_tlb = (info->addr & entry->mask) >> VTD_PAGE_SHIFT_4K;
b5a280c0 185 return (entry->domain_id == info->domain_id) &&
d66b969b
JW		 186 (((entry->gfn & info->mask) == gfn) ||
187 (entry->gfn == gfn_tlb));
b5a280c0
LT		 188}
189
d92fa2dc
LT		 190/* Reset all the gen of VTDAddressSpace to zero and set the gen of
191 * IntelIOMMUState to 1.
192 */
193static void vtd_reset_context_cache(IntelIOMMUState *s)
194{
d92fa2dc 195 VTDAddressSpace *vtd_as;
7df953bd
KO		 196 VTDBus *vtd_bus;
197 GHashTableIter bus_it;
d92fa2dc
LT		 198 uint32_t devfn_it;
199
7df953bd
KO		 200 g_hash_table_iter_init(&bus_it, s->vtd_as_by_busptr);
201
d92fa2dc 202 VTD_DPRINTF(CACHE, "global context_cache_gen=1");
7df953bd 203 while (g_hash_table_iter_next (&bus_it, NULL, (void**)&vtd_bus)) {
04af0e18 204 for (devfn_it = 0; devfn_it < X86_IOMMU_PCI_DEVFN_MAX; ++devfn_it) {
7df953bd 205 vtd_as = vtd_bus->dev_as[devfn_it];
d92fa2dc
LT		 206 if (!vtd_as) {
207 continue;
208 }
209 vtd_as->context_cache_entry.context_cache_gen = 0;
210 }
211 }
212 s->context_cache_gen = 1;
213}
214
b5a280c0
LT		 215static void vtd_reset_iotlb(IntelIOMMUState *s)
216{
217 assert(s->iotlb);
218 g_hash_table_remove_all(s->iotlb);
219}
220
bacabb0a 221static uint64_t vtd_get_iotlb_key(uint64_t gfn, uint16_t source_id,
d66b969b
JW		 222 uint32_t level)
223{
224 return gfn | ((uint64_t)(source_id) << VTD_IOTLB_SID_SHIFT) |
225 ((uint64_t)(level) << VTD_IOTLB_LVL_SHIFT);
226}
227
228static uint64_t vtd_get_iotlb_gfn(hwaddr addr, uint32_t level)
229{
230 return (addr & vtd_slpt_level_page_mask(level)) >> VTD_PAGE_SHIFT_4K;
231}
232
b5a280c0
LT		 233static VTDIOTLBEntry *vtd_lookup_iotlb(IntelIOMMUState *s, uint16_t source_id,
234 hwaddr addr)
235{
d66b969b 236 VTDIOTLBEntry *entry;
b5a280c0 237 uint64_t key;
d66b969b
JW		 238 int level;
239
240 for (level = VTD_SL_PT_LEVEL; level < VTD_SL_PML4_LEVEL; level++) {
241 key = vtd_get_iotlb_key(vtd_get_iotlb_gfn(addr, level),
242 source_id, level);
243 entry = g_hash_table_lookup(s->iotlb, &key);
244 if (entry) {
245 goto out;
246 }
247 }
b5a280c0 248
d66b969b
JW		 249out:
250 return entry;
b5a280c0
LT		 251}
252
253static void vtd_update_iotlb(IntelIOMMUState *s, uint16_t source_id,
254 uint16_t domain_id, hwaddr addr, uint64_t slpte,
d66b969b
JW		 255 bool read_flags, bool write_flags,
256 uint32_t level)
b5a280c0
LT		 257{
258 VTDIOTLBEntry *entry = g_malloc(sizeof(*entry));
259 uint64_t *key = g_malloc(sizeof(*key));
d66b969b 260 uint64_t gfn = vtd_get_iotlb_gfn(addr, level);
b5a280c0
LT		 261
262 VTD_DPRINTF(CACHE, "update iotlb sid 0x%"PRIx16 " gpa 0x%"PRIx64
263 " slpte 0x%"PRIx64 " did 0x%"PRIx16, source_id, addr, slpte,
264 domain_id);
265 if (g_hash_table_size(s->iotlb) >= VTD_IOTLB_MAX_SIZE) {
266 VTD_DPRINTF(CACHE, "iotlb exceeds size limit, forced to reset");
267 vtd_reset_iotlb(s);
268 }
269
270 entry->gfn = gfn;
271 entry->domain_id = domain_id;
272 entry->slpte = slpte;
273 entry->read_flags = read_flags;
274 entry->write_flags = write_flags;
d66b969b
JW		 275 entry->mask = vtd_slpt_level_page_mask(level);
276 *key = vtd_get_iotlb_key(gfn, source_id, level);
b5a280c0
LT		 277 g_hash_table_replace(s->iotlb, key, entry);
278}
279
1da12ec4
LT		 280/* Given the reg addr of both the message data and address, generate an
281 * interrupt via MSI.
282 */
283static void vtd_generate_interrupt(IntelIOMMUState *s, hwaddr mesg_addr_reg,
284 hwaddr mesg_data_reg)
285{
32946019 286 MSIMessage msi;
1da12ec4
LT		 287
288 assert(mesg_data_reg < DMAR_REG_SIZE);
289 assert(mesg_addr_reg < DMAR_REG_SIZE);
290
32946019
RK		 291 msi.address = vtd_get_long_raw(s, mesg_addr_reg);
292 msi.data = vtd_get_long_raw(s, mesg_data_reg);
1da12ec4 293
32946019
RK		 294 VTD_DPRINTF(FLOG, "msi: addr 0x%"PRIx64 " data 0x%"PRIx32,
295 msi.address, msi.data);
296 apic_get_class()->send_msi(&msi);
1da12ec4
LT		 297}
298
299/* Generate a fault event to software via MSI if conditions are met.
300 * Notice that the value of FSTS_REG being passed to it should be the one
301 * before any update.
302 */
303static void vtd_generate_fault_event(IntelIOMMUState *s, uint32_t pre_fsts)
304{
305 if (pre_fsts & VTD_FSTS_PPF || pre_fsts & VTD_FSTS_PFO ||
306 pre_fsts & VTD_FSTS_IQE) {
307 VTD_DPRINTF(FLOG, "there are previous interrupt conditions "
308 "to be serviced by software, fault event is not generated "
309 "(FSTS_REG 0x%"PRIx32 ")", pre_fsts);
310 return;
311 }
312 vtd_set_clear_mask_long(s, DMAR_FECTL_REG, 0, VTD_FECTL_IP);
313 if (vtd_get_long_raw(s, DMAR_FECTL_REG) & VTD_FECTL_IM) {
314 VTD_DPRINTF(FLOG, "Interrupt Mask set, fault event is not generated");
315 } else {
316 vtd_generate_interrupt(s, DMAR_FEADDR_REG, DMAR_FEDATA_REG);
317 vtd_set_clear_mask_long(s, DMAR_FECTL_REG, VTD_FECTL_IP, 0);
318 }
319}
320
321/* Check if the Fault (F) field of the Fault Recording Register referenced by
322 * @index is Set.
323 */
324static bool vtd_is_frcd_set(IntelIOMMUState *s, uint16_t index)
325{
326 /* Each reg is 128-bit */
327 hwaddr addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4);
328 addr += 8; /* Access the high 64-bit half */
329
330 assert(index < DMAR_FRCD_REG_NR);
331
332 return vtd_get_quad_raw(s, addr) & VTD_FRCD_F;
333}
334
335/* Update the PPF field of Fault Status Register.
336 * Should be called whenever change the F field of any fault recording
337 * registers.
338 */
339static void vtd_update_fsts_ppf(IntelIOMMUState *s)
340{
341 uint32_t i;
342 uint32_t ppf_mask = 0;
343
344 for (i = 0; i < DMAR_FRCD_REG_NR; i++) {
345 if (vtd_is_frcd_set(s, i)) {
346 ppf_mask = VTD_FSTS_PPF;
347 break;
348 }
349 }
350 vtd_set_clear_mask_long(s, DMAR_FSTS_REG, VTD_FSTS_PPF, ppf_mask);
351 VTD_DPRINTF(FLOG, "set PPF of FSTS_REG to %d", ppf_mask ? 1 : 0);
352}
353
354static void vtd_set_frcd_and_update_ppf(IntelIOMMUState *s, uint16_t index)
355{
356 /* Each reg is 128-bit */
357 hwaddr addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4);
358 addr += 8; /* Access the high 64-bit half */
359
360 assert(index < DMAR_FRCD_REG_NR);
361
362 vtd_set_clear_mask_quad(s, addr, 0, VTD_FRCD_F);
363 vtd_update_fsts_ppf(s);
364}
365
366/* Must not update F field now, should be done later */
367static void vtd_record_frcd(IntelIOMMUState *s, uint16_t index,
368 uint16_t source_id, hwaddr addr,
369 VTDFaultReason fault, bool is_write)
370{
371 uint64_t hi = 0, lo;
372 hwaddr frcd_reg_addr = DMAR_FRCD_REG_OFFSET + (((uint64_t)index) << 4);
373
374 assert(index < DMAR_FRCD_REG_NR);
375
376 lo = VTD_FRCD_FI(addr);
377 hi = VTD_FRCD_SID(source_id) | VTD_FRCD_FR(fault);
378 if (!is_write) {
379 hi |= VTD_FRCD_T;
380 }
381 vtd_set_quad_raw(s, frcd_reg_addr, lo);
382 vtd_set_quad_raw(s, frcd_reg_addr + 8, hi);
383 VTD_DPRINTF(FLOG, "record to FRCD_REG #%"PRIu16 ": hi 0x%"PRIx64
384 ", lo 0x%"PRIx64, index, hi, lo);
385}
386
387/* Try to collapse multiple pending faults from the same requester */
388static bool vtd_try_collapse_fault(IntelIOMMUState *s, uint16_t source_id)
389{
390 uint32_t i;
391 uint64_t frcd_reg;
392 hwaddr addr = DMAR_FRCD_REG_OFFSET + 8; /* The high 64-bit half */
393
394 for (i = 0; i < DMAR_FRCD_REG_NR; i++) {
395 frcd_reg = vtd_get_quad_raw(s, addr);
396 VTD_DPRINTF(FLOG, "frcd_reg #%d 0x%"PRIx64, i, frcd_reg);
397 if ((frcd_reg & VTD_FRCD_F) &&
398 ((frcd_reg & VTD_FRCD_SID_MASK) == source_id)) {
399 return true;
400 }
401 addr += 16; /* 128-bit for each */
402 }
403 return false;
404}
405
406/* Log and report an DMAR (address translation) fault to software */
407static void vtd_report_dmar_fault(IntelIOMMUState *s, uint16_t source_id,
408 hwaddr addr, VTDFaultReason fault,
409 bool is_write)
410{
411 uint32_t fsts_reg = vtd_get_long_raw(s, DMAR_FSTS_REG);
412
413 assert(fault < VTD_FR_MAX);
414
415 if (fault == VTD_FR_RESERVED_ERR) {
416 /* This is not a normal fault reason case. Drop it. */
417 return;
418 }
419 VTD_DPRINTF(FLOG, "sid 0x%"PRIx16 ", fault %d, addr 0x%"PRIx64
420 ", is_write %d", source_id, fault, addr, is_write);
421 if (fsts_reg & VTD_FSTS_PFO) {
422 VTD_DPRINTF(FLOG, "new fault is not recorded due to "
423 "Primary Fault Overflow");
424 return;
425 }
426 if (vtd_try_collapse_fault(s, source_id)) {
427 VTD_DPRINTF(FLOG, "new fault is not recorded due to "
428 "compression of faults");
429 return;
430 }
431 if (vtd_is_frcd_set(s, s->next_frcd_reg)) {
432 VTD_DPRINTF(FLOG, "Primary Fault Overflow and "
433 "new fault is not recorded, set PFO field");
434 vtd_set_clear_mask_long(s, DMAR_FSTS_REG, 0, VTD_FSTS_PFO);
435 return;
436 }
437
438 vtd_record_frcd(s, s->next_frcd_reg, source_id, addr, fault, is_write);
439
440 if (fsts_reg & VTD_FSTS_PPF) {
441 VTD_DPRINTF(FLOG, "there are pending faults already, "
442 "fault event is not generated");
443 vtd_set_frcd_and_update_ppf(s, s->next_frcd_reg);
444 s->next_frcd_reg++;
445 if (s->next_frcd_reg == DMAR_FRCD_REG_NR) {
446 s->next_frcd_reg = 0;
447 }
448 } else {
449 vtd_set_clear_mask_long(s, DMAR_FSTS_REG, VTD_FSTS_FRI_MASK,
450 VTD_FSTS_FRI(s->next_frcd_reg));
451 vtd_set_frcd_and_update_ppf(s, s->next_frcd_reg); /* Will set PPF */
452 s->next_frcd_reg++;
453 if (s->next_frcd_reg == DMAR_FRCD_REG_NR) {
454 s->next_frcd_reg = 0;
455 }
456 /* This case actually cause the PPF to be Set.
457 * So generate fault event (interrupt).
458 */
459 vtd_generate_fault_event(s, fsts_reg);
460 }
461}
462
ed7b8fbc
LT		 463/* Handle Invalidation Queue Errors of queued invalidation interface error
464 * conditions.
465 */
466static void vtd_handle_inv_queue_error(IntelIOMMUState *s)
467{
468 uint32_t fsts_reg = vtd_get_long_raw(s, DMAR_FSTS_REG);
469
470 vtd_set_clear_mask_long(s, DMAR_FSTS_REG, 0, VTD_FSTS_IQE);
471 vtd_generate_fault_event(s, fsts_reg);
472}
473
474/* Set the IWC field and try to generate an invalidation completion interrupt */
475static void vtd_generate_completion_event(IntelIOMMUState *s)
476{
477 VTD_DPRINTF(INV, "completes an invalidation wait command with "
478 "Interrupt Flag");
479 if (vtd_get_long_raw(s, DMAR_ICS_REG) & VTD_ICS_IWC) {
480 VTD_DPRINTF(INV, "there is a previous interrupt condition to be "
481 "serviced by software, "
482 "new invalidation event is not generated");
483 return;
484 }
485 vtd_set_clear_mask_long(s, DMAR_ICS_REG, 0, VTD_ICS_IWC);
486 vtd_set_clear_mask_long(s, DMAR_IECTL_REG, 0, VTD_IECTL_IP);
487 if (vtd_get_long_raw(s, DMAR_IECTL_REG) & VTD_IECTL_IM) {
488 VTD_DPRINTF(INV, "IM filed in IECTL_REG is set, new invalidation "
489 "event is not generated");
490 return;
491 } else {
492 /* Generate the interrupt event */
493 vtd_generate_interrupt(s, DMAR_IEADDR_REG, DMAR_IEDATA_REG);
494 vtd_set_clear_mask_long(s, DMAR_IECTL_REG, VTD_IECTL_IP, 0);
495 }
496}
497
1da12ec4
LT		 498static inline bool vtd_root_entry_present(VTDRootEntry *root)
499{
500 return root->val & VTD_ROOT_ENTRY_P;
501}
502
503static int vtd_get_root_entry(IntelIOMMUState *s, uint8_t index,
504 VTDRootEntry *re)
505{
506 dma_addr_t addr;
507
508 addr = s->root + index * sizeof(*re);
509 if (dma_memory_read(&address_space_memory, addr, re, sizeof(*re))) {
510 VTD_DPRINTF(GENERAL, "error: fail to access root-entry at 0x%"PRIx64
511 " + %"PRIu8, s->root, index);
512 re->val = 0;
513 return -VTD_FR_ROOT_TABLE_INV;
514 }
515 re->val = le64_to_cpu(re->val);
516 return 0;
517}
518
519static inline bool vtd_context_entry_present(VTDContextEntry *context)
520{
521 return context->lo & VTD_CONTEXT_ENTRY_P;
522}
523
524static int vtd_get_context_entry_from_root(VTDRootEntry *root, uint8_t index,
525 VTDContextEntry *ce)
526{
527 dma_addr_t addr;
528
529 if (!vtd_root_entry_present(root)) {
530 VTD_DPRINTF(GENERAL, "error: root-entry is not present");
531 return -VTD_FR_ROOT_ENTRY_P;
532 }
533 addr = (root->val & VTD_ROOT_ENTRY_CTP) + index * sizeof(*ce);
534 if (dma_memory_read(&address_space_memory, addr, ce, sizeof(*ce))) {
535 VTD_DPRINTF(GENERAL, "error: fail to access context-entry at 0x%"PRIx64
536 " + %"PRIu8,
537 (uint64_t)(root->val & VTD_ROOT_ENTRY_CTP), index);
538 return -VTD_FR_CONTEXT_TABLE_INV;
539 }
540 ce->lo = le64_to_cpu(ce->lo);
541 ce->hi = le64_to_cpu(ce->hi);
542 return 0;
543}
544
545static inline dma_addr_t vtd_get_slpt_base_from_context(VTDContextEntry *ce)
546{
547 return ce->lo & VTD_CONTEXT_ENTRY_SLPTPTR;
548}
549
1da12ec4
LT		 550static inline uint64_t vtd_get_slpte_addr(uint64_t slpte)
551{
552 return slpte & VTD_SL_PT_BASE_ADDR_MASK;
553}
554
555/* Whether the pte indicates the address of the page frame */
556static inline bool vtd_is_last_slpte(uint64_t slpte, uint32_t level)
557{
558 return level == VTD_SL_PT_LEVEL || (slpte & VTD_SL_PT_PAGE_SIZE_MASK);
559}
560
561/* Get the content of a spte located in @base_addr[@index] */
562static uint64_t vtd_get_slpte(dma_addr_t base_addr, uint32_t index)
563{
564 uint64_t slpte;
565
566 assert(index < VTD_SL_PT_ENTRY_NR);
567
568 if (dma_memory_read(&address_space_memory,
569 base_addr + index * sizeof(slpte), &slpte,
570 sizeof(slpte))) {
571 slpte = (uint64_t)-1;
572 return slpte;
573 }
574 slpte = le64_to_cpu(slpte);
575 return slpte;
576}
577
578/* Given a gpa and the level of paging structure, return the offset of current
579 * level.
580 */
581static inline uint32_t vtd_gpa_level_offset(uint64_t gpa, uint32_t level)
582{
583 return (gpa >> vtd_slpt_level_shift(level)) &
584 ((1ULL << VTD_SL_LEVEL_BITS) - 1);
585}
586
587/* Check Capability Register to see if the @level of page-table is supported */
588static inline bool vtd_is_level_supported(IntelIOMMUState *s, uint32_t level)
589{
590 return VTD_CAP_SAGAW_MASK & s->cap &
591 (1ULL << (level - 2 + VTD_CAP_SAGAW_SHIFT));
592}
593
594/* Get the page-table level that hardware should use for the second-level
595 * page-table walk from the Address Width field of context-entry.
596 */
597static inline uint32_t vtd_get_level_from_context_entry(VTDContextEntry *ce)
598{
599 return 2 + (ce->hi & VTD_CONTEXT_ENTRY_AW);
600}
601
602static inline uint32_t vtd_get_agaw_from_context_entry(VTDContextEntry *ce)
603{
604 return 30 + (ce->hi & VTD_CONTEXT_ENTRY_AW) * 9;
605}
606
607static const uint64_t vtd_paging_entry_rsvd_field[] = {
608 [0] = ~0ULL,
609 /* For not large page */
610 [1] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
611 [2] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
612 [3] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
613 [4] = 0x880ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
614 /* For large page */
615 [5] = 0x800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
616 [6] = 0x1ff800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
617 [7] = 0x3ffff800ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
618 [8] = 0x880ULL | ~(VTD_HAW_MASK | VTD_SL_IGN_COM),
619};
620
621static bool vtd_slpte_nonzero_rsvd(uint64_t slpte, uint32_t level)
622{
623 if (slpte & VTD_SL_PT_PAGE_SIZE_MASK) {
624 /* Maybe large page */
625 return slpte & vtd_paging_entry_rsvd_field[level + 4];
626 } else {
627 return slpte & vtd_paging_entry_rsvd_field[level];
628 }
629}
630
631/* Given the @gpa, get relevant @slptep. @slpte_level will be the last level
632 * of the translation, can be used for deciding the size of large page.
633 */
634static int vtd_gpa_to_slpte(VTDContextEntry *ce, uint64_t gpa, bool is_write,
635 uint64_t *slptep, uint32_t *slpte_level,
636 bool *reads, bool *writes)
637{
638 dma_addr_t addr = vtd_get_slpt_base_from_context(ce);
639 uint32_t level = vtd_get_level_from_context_entry(ce);
640 uint32_t offset;
641 uint64_t slpte;
642 uint32_t ce_agaw = vtd_get_agaw_from_context_entry(ce);
643 uint64_t access_right_check;
644
645 /* Check if @gpa is above 2^X-1, where X is the minimum of MGAW in CAP_REG
646 * and AW in context-entry.
647 */
648 if (gpa & ~((1ULL << MIN(ce_agaw, VTD_MGAW)) - 1)) {
649 VTD_DPRINTF(GENERAL, "error: gpa 0x%"PRIx64 " exceeds limits", gpa);
650 return -VTD_FR_ADDR_BEYOND_MGAW;
651 }
652
653 /* FIXME: what is the Atomics request here? */
654 access_right_check = is_write ? VTD_SL_W : VTD_SL_R;
655
656 while (true) {
657 offset = vtd_gpa_level_offset(gpa, level);
658 slpte = vtd_get_slpte(addr, offset);
659
660 if (slpte == (uint64_t)-1) {
661 VTD_DPRINTF(GENERAL, "error: fail to access second-level paging "
662 "entry at level %"PRIu32 " for gpa 0x%"PRIx64,
663 level, gpa);
664 if (level == vtd_get_level_from_context_entry(ce)) {
665 /* Invalid programming of context-entry */
666 return -VTD_FR_CONTEXT_ENTRY_INV;
667 } else {
668 return -VTD_FR_PAGING_ENTRY_INV;
669 }
670 }
671 *reads = (*reads) && (slpte & VTD_SL_R);
672 *writes = (*writes) && (slpte & VTD_SL_W);
673 if (!(slpte & access_right_check)) {
674 VTD_DPRINTF(GENERAL, "error: lack of %s permission for "
675 "gpa 0x%"PRIx64 " slpte 0x%"PRIx64,
676 (is_write ? "write" : "read"), gpa, slpte);
677 return is_write ? -VTD_FR_WRITE : -VTD_FR_READ;
678 }
679 if (vtd_slpte_nonzero_rsvd(slpte, level)) {
680 VTD_DPRINTF(GENERAL, "error: non-zero reserved field in second "
681 "level paging entry level %"PRIu32 " slpte 0x%"PRIx64,
682 level, slpte);
683 return -VTD_FR_PAGING_ENTRY_RSVD;
684 }
685
686 if (vtd_is_last_slpte(slpte, level)) {
687 *slptep = slpte;
688 *slpte_level = level;
689 return 0;
690 }
691 addr = vtd_get_slpte_addr(slpte);
692 level--;
693 }
694}
695
696/* Map a device to its corresponding domain (context-entry) */
697static int vtd_dev_to_context_entry(IntelIOMMUState *s, uint8_t bus_num,
698 uint8_t devfn, VTDContextEntry *ce)
699{
700 VTDRootEntry re;
701 int ret_fr;
702
703 ret_fr = vtd_get_root_entry(s, bus_num, &re);
704 if (ret_fr) {
705 return ret_fr;
706 }
707
708 if (!vtd_root_entry_present(&re)) {
709 VTD_DPRINTF(GENERAL, "error: root-entry #%"PRIu8 " is not present",
710 bus_num);
711 return -VTD_FR_ROOT_ENTRY_P;
712 } else if (re.rsvd || (re.val & VTD_ROOT_ENTRY_RSVD)) {
713 VTD_DPRINTF(GENERAL, "error: non-zero reserved field in root-entry "
714 "hi 0x%"PRIx64 " lo 0x%"PRIx64, re.rsvd, re.val);
715 return -VTD_FR_ROOT_ENTRY_RSVD;
716 }
717
718 ret_fr = vtd_get_context_entry_from_root(&re, devfn, ce);
719 if (ret_fr) {
720 return ret_fr;
721 }
722
723 if (!vtd_context_entry_present(ce)) {
724 VTD_DPRINTF(GENERAL,
725 "error: context-entry #%"PRIu8 "(bus #%"PRIu8 ") "
726 "is not present", devfn, bus_num);
727 return -VTD_FR_CONTEXT_ENTRY_P;
728 } else if ((ce->hi & VTD_CONTEXT_ENTRY_RSVD_HI) ||
729 (ce->lo & VTD_CONTEXT_ENTRY_RSVD_LO)) {
730 VTD_DPRINTF(GENERAL,
731 "error: non-zero reserved field in context-entry "
732 "hi 0x%"PRIx64 " lo 0x%"PRIx64, ce->hi, ce->lo);
733 return -VTD_FR_CONTEXT_ENTRY_RSVD;
734 }
735 /* Check if the programming of context-entry is valid */
736 if (!vtd_is_level_supported(s, vtd_get_level_from_context_entry(ce))) {
737 VTD_DPRINTF(GENERAL, "error: unsupported Address Width value in "
738 "context-entry hi 0x%"PRIx64 " lo 0x%"PRIx64,
739 ce->hi, ce->lo);
740 return -VTD_FR_CONTEXT_ENTRY_INV;
741 } else if (ce->lo & VTD_CONTEXT_ENTRY_TT) {
742 VTD_DPRINTF(GENERAL, "error: unsupported Translation Type in "
743 "context-entry hi 0x%"PRIx64 " lo 0x%"PRIx64,
744 ce->hi, ce->lo);
745 return -VTD_FR_CONTEXT_ENTRY_INV;
746 }
747 return 0;
748}
749
750static inline uint16_t vtd_make_source_id(uint8_t bus_num, uint8_t devfn)
751{
752 return ((bus_num & 0xffUL) << 8) | (devfn & 0xffUL);
753}
754
755static const bool vtd_qualified_faults[] = {
756 [VTD_FR_RESERVED] = false,
757 [VTD_FR_ROOT_ENTRY_P] = false,
758 [VTD_FR_CONTEXT_ENTRY_P] = true,
759 [VTD_FR_CONTEXT_ENTRY_INV] = true,
760 [VTD_FR_ADDR_BEYOND_MGAW] = true,
761 [VTD_FR_WRITE] = true,
762 [VTD_FR_READ] = true,
763 [VTD_FR_PAGING_ENTRY_INV] = true,
764 [VTD_FR_ROOT_TABLE_INV] = false,
765 [VTD_FR_CONTEXT_TABLE_INV] = false,
766 [VTD_FR_ROOT_ENTRY_RSVD] = false,
767 [VTD_FR_PAGING_ENTRY_RSVD] = true,
768 [VTD_FR_CONTEXT_ENTRY_TT] = true,
769 [VTD_FR_RESERVED_ERR] = false,
770 [VTD_FR_MAX] = false,
771};
772
773/* To see if a fault condition is "qualified", which is reported to software
774 * only if the FPD field in the context-entry used to process the faulting
775 * request is 0.
776 */
777static inline bool vtd_is_qualified_fault(VTDFaultReason fault)
778{
779 return vtd_qualified_faults[fault];
780}
781
782static inline bool vtd_is_interrupt_addr(hwaddr addr)
783{
784 return VTD_INTERRUPT_ADDR_FIRST <= addr && addr <= VTD_INTERRUPT_ADDR_LAST;
785}
786
787/* Map dev to context-entry then do a paging-structures walk to do a iommu
788 * translation.
79e2b9ae
PB		 789 *
790 * Called from RCU critical section.
791 *
1da12ec4
LT		 792 * @bus_num: The bus number
793 * @devfn: The devfn, which is the combined of device and function number
794 * @is_write: The access is a write operation
795 * @entry: IOMMUTLBEntry that contain the addr to be translated and result
796 */
7df953bd 797static void vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
1da12ec4
LT		 798 uint8_t devfn, hwaddr addr, bool is_write,
799 IOMMUTLBEntry *entry)
800{
d92fa2dc 801 IntelIOMMUState *s = vtd_as->iommu_state;
1da12ec4 802 VTDContextEntry ce;
7df953bd 803 uint8_t bus_num = pci_bus_num(bus);
d92fa2dc 804 VTDContextCacheEntry *cc_entry = &vtd_as->context_cache_entry;
d66b969b 805 uint64_t slpte, page_mask;
1da12ec4
LT		 806 uint32_t level;
807 uint16_t source_id = vtd_make_source_id(bus_num, devfn);
808 int ret_fr;
809 bool is_fpd_set = false;
810 bool reads = true;
811 bool writes = true;
b5a280c0 812 VTDIOTLBEntry *iotlb_entry;
1da12ec4
LT		 813
814 /* Check if the request is in interrupt address range */
815 if (vtd_is_interrupt_addr(addr)) {
816 if (is_write) {
817 /* FIXME: since we don't know the length of the access here, we
818 * treat Non-DWORD length write requests without PASID as
819 * interrupt requests, too. Withoud interrupt remapping support,
820 * we just use 1:1 mapping.
821 */
822 VTD_DPRINTF(MMU, "write request to interrupt address "
823 "gpa 0x%"PRIx64, addr);
824 entry->iova = addr & VTD_PAGE_MASK_4K;
825 entry->translated_addr = addr & VTD_PAGE_MASK_4K;
826 entry->addr_mask = ~VTD_PAGE_MASK_4K;
827 entry->perm = IOMMU_WO;
828 return;
829 } else {
830 VTD_DPRINTF(GENERAL, "error: read request from interrupt address "
831 "gpa 0x%"PRIx64, addr);
832 vtd_report_dmar_fault(s, source_id, addr, VTD_FR_READ, is_write);
833 return;
834 }
835 }
b5a280c0
LT		 836 /* Try to fetch slpte form IOTLB */
837 iotlb_entry = vtd_lookup_iotlb(s, source_id, addr);
838 if (iotlb_entry) {
839 VTD_DPRINTF(CACHE, "hit iotlb sid 0x%"PRIx16 " gpa 0x%"PRIx64
840 " slpte 0x%"PRIx64 " did 0x%"PRIx16, source_id, addr,
841 iotlb_entry->slpte, iotlb_entry->domain_id);
842 slpte = iotlb_entry->slpte;
843 reads = iotlb_entry->read_flags;
844 writes = iotlb_entry->write_flags;
d66b969b 845 page_mask = iotlb_entry->mask;
b5a280c0
LT		 846 goto out;
847 }
d92fa2dc
LT		 848 /* Try to fetch context-entry from cache first */
849 if (cc_entry->context_cache_gen == s->context_cache_gen) {
850 VTD_DPRINTF(CACHE, "hit context-cache bus %d devfn %d "
851 "(hi %"PRIx64 " lo %"PRIx64 " gen %"PRIu32 ")",
852 bus_num, devfn, cc_entry->context_entry.hi,
853 cc_entry->context_entry.lo, cc_entry->context_cache_gen);
854 ce = cc_entry->context_entry;
855 is_fpd_set = ce.lo & VTD_CONTEXT_ENTRY_FPD;
856 } else {
857 ret_fr = vtd_dev_to_context_entry(s, bus_num, devfn, &ce);
858 is_fpd_set = ce.lo & VTD_CONTEXT_ENTRY_FPD;
859 if (ret_fr) {
860 ret_fr = -ret_fr;
861 if (is_fpd_set && vtd_is_qualified_fault(ret_fr)) {
862 VTD_DPRINTF(FLOG, "fault processing is disabled for DMA "
863 "requests through this context-entry "
864 "(with FPD Set)");
865 } else {
866 vtd_report_dmar_fault(s, source_id, addr, ret_fr, is_write);
867 }
868 return;
1da12ec4 869 }
d92fa2dc
LT		 870 /* Update context-cache */
871 VTD_DPRINTF(CACHE, "update context-cache bus %d devfn %d "
872 "(hi %"PRIx64 " lo %"PRIx64 " gen %"PRIu32 "->%"PRIu32 ")",
873 bus_num, devfn, ce.hi, ce.lo,
874 cc_entry->context_cache_gen, s->context_cache_gen);
875 cc_entry->context_entry = ce;
876 cc_entry->context_cache_gen = s->context_cache_gen;
1da12ec4
LT		 877 }
878
879 ret_fr = vtd_gpa_to_slpte(&ce, addr, is_write, &slpte, &level,
880 &reads, &writes);
881 if (ret_fr) {
882 ret_fr = -ret_fr;
883 if (is_fpd_set && vtd_is_qualified_fault(ret_fr)) {
884 VTD_DPRINTF(FLOG, "fault processing is disabled for DMA requests "
885 "through this context-entry (with FPD Set)");
886 } else {
887 vtd_report_dmar_fault(s, source_id, addr, ret_fr, is_write);
888 }
889 return;
890 }
891
d66b969b 892 page_mask = vtd_slpt_level_page_mask(level);
b5a280c0 893 vtd_update_iotlb(s, source_id, VTD_CONTEXT_ENTRY_DID(ce.hi), addr, slpte,
d66b969b 894 reads, writes, level);
b5a280c0 895out:
d66b969b
JW		 896 entry->iova = addr & page_mask;
897 entry->translated_addr = vtd_get_slpte_addr(slpte) & page_mask;
898 entry->addr_mask = ~page_mask;
1da12ec4
LT		 899 entry->perm = (writes ? 2 : 0) + (reads ? 1 : 0);
900}
901
902static void vtd_root_table_setup(IntelIOMMUState *s)
903{
904 s->root = vtd_get_quad_raw(s, DMAR_RTADDR_REG);
905 s->root_extended = s->root & VTD_RTADDR_RTT;
906 s->root &= VTD_RTADDR_ADDR_MASK;
907
908 VTD_DPRINTF(CSR, "root_table addr 0x%"PRIx64 " %s", s->root,
909 (s->root_extended ? "(extended)" : ""));
910}
911
02a2cbc8
PX		 912static void vtd_iec_notify_all(IntelIOMMUState *s, bool global,
913 uint32_t index, uint32_t mask)
914{
915 x86_iommu_iec_notify_all(X86_IOMMU_DEVICE(s), global, index, mask);
916}
917
a5861439
PX		 918static void vtd_interrupt_remap_table_setup(IntelIOMMUState *s)
919{
920 uint64_t value = 0;
921 value = vtd_get_quad_raw(s, DMAR_IRTA_REG);
922 s->intr_size = 1UL << ((value & VTD_IRTA_SIZE_MASK) + 1);
923 s->intr_root = value & VTD_IRTA_ADDR_MASK;
28589311 924 s->intr_eime = value & VTD_IRTA_EIME;
a5861439 925
02a2cbc8
PX		 926 /* Notify global invalidation */
927 vtd_iec_notify_all(s, true, 0, 0);
a5861439
PX		 928
929 VTD_DPRINTF(CSR, "int remap table addr 0x%"PRIx64 " size %"PRIu32,
930 s->intr_root, s->intr_size);
931}
932
d92fa2dc
LT		 933static void vtd_context_global_invalidate(IntelIOMMUState *s)
934{
935 s->context_cache_gen++;
936 if (s->context_cache_gen == VTD_CONTEXT_CACHE_GEN_MAX) {
937 vtd_reset_context_cache(s);
938 }
939}
940
7df953bd
KO		 941
942/* Find the VTD address space currently associated with a given bus number,
943 */
944static VTDBus *vtd_find_as_from_bus_num(IntelIOMMUState *s, uint8_t bus_num)
945{
946 VTDBus *vtd_bus = s->vtd_as_by_bus_num[bus_num];
947 if (!vtd_bus) {
948 /* Iterate over the registered buses to find the one
949 * which currently hold this bus number, and update the bus_num lookup table:
950 */
951 GHashTableIter iter;
952
953 g_hash_table_iter_init(&iter, s->vtd_as_by_busptr);
954 while (g_hash_table_iter_next (&iter, NULL, (void**)&vtd_bus)) {
955 if (pci_bus_num(vtd_bus->bus) == bus_num) {
956 s->vtd_as_by_bus_num[bus_num] = vtd_bus;
957 return vtd_bus;
958 }
959 }
960 }
961 return vtd_bus;
962}
963
d92fa2dc
LT		 964/* Do a context-cache device-selective invalidation.
965 * @func_mask: FM field after shifting
966 */
967static void vtd_context_device_invalidate(IntelIOMMUState *s,
968 uint16_t source_id,
969 uint16_t func_mask)
970{
971 uint16_t mask;
7df953bd 972 VTDBus *vtd_bus;
d92fa2dc
LT		 973 VTDAddressSpace *vtd_as;
974 uint16_t devfn;
975 uint16_t devfn_it;
976
977 switch (func_mask & 3) {
978 case 0:
979 mask = 0; /* No bits in the SID field masked */
980 break;
981 case 1:
982 mask = 4; /* Mask bit 2 in the SID field */
983 break;
984 case 2:
985 mask = 6; /* Mask bit 2:1 in the SID field */
986 break;
987 case 3:
988 mask = 7; /* Mask bit 2:0 in the SID field */
989 break;
990 }
991 VTD_DPRINTF(INV, "device-selective invalidation source 0x%"PRIx16
992 " mask %"PRIu16, source_id, mask);
7df953bd
KO		 993 vtd_bus = vtd_find_as_from_bus_num(s, VTD_SID_TO_BUS(source_id));
994 if (vtd_bus) {
d92fa2dc 995 devfn = VTD_SID_TO_DEVFN(source_id);
04af0e18 996 for (devfn_it = 0; devfn_it < X86_IOMMU_PCI_DEVFN_MAX; ++devfn_it) {
7df953bd 997 vtd_as = vtd_bus->dev_as[devfn_it];
d92fa2dc
LT		 998 if (vtd_as && ((devfn_it & mask) == (devfn & mask))) {
999 VTD_DPRINTF(INV, "invalidate context-cahce of devfn 0x%"PRIx16,
1000 devfn_it);
1001 vtd_as->context_cache_entry.context_cache_gen = 0;
1002 }
1003 }
1004 }
1005}
1006
1da12ec4
LT		 1007/* Context-cache invalidation
1008 * Returns the Context Actual Invalidation Granularity.
1009 * @val: the content of the CCMD_REG
1010 */
1011static uint64_t vtd_context_cache_invalidate(IntelIOMMUState *s, uint64_t val)
1012{
1013 uint64_t caig;
1014 uint64_t type = val & VTD_CCMD_CIRG_MASK;
1015
1016 switch (type) {
d92fa2dc
LT		 1017 case VTD_CCMD_DOMAIN_INVL:
1018 VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1019 (uint16_t)VTD_CCMD_DID(val));
1020 /* Fall through */
1da12ec4 1021 case VTD_CCMD_GLOBAL_INVL:
d92fa2dc 1022 VTD_DPRINTF(INV, "global invalidation");
1da12ec4 1023 caig = VTD_CCMD_GLOBAL_INVL_A;
d92fa2dc 1024 vtd_context_global_invalidate(s);
1da12ec4
LT		 1025 break;
1026
1027 case VTD_CCMD_DEVICE_INVL:
1da12ec4 1028 caig = VTD_CCMD_DEVICE_INVL_A;
d92fa2dc 1029 vtd_context_device_invalidate(s, VTD_CCMD_SID(val), VTD_CCMD_FM(val));
1da12ec4
LT		 1030 break;
1031
1032 default:
d92fa2dc 1033 VTD_DPRINTF(GENERAL, "error: invalid granularity");
1da12ec4
LT		 1034 caig = 0;
1035 }
1036 return caig;
1037}
1038
b5a280c0
LT		 1039static void vtd_iotlb_global_invalidate(IntelIOMMUState *s)
1040{
1041 vtd_reset_iotlb(s);
1042}
1043
1044static void vtd_iotlb_domain_invalidate(IntelIOMMUState *s, uint16_t domain_id)
1045{
1046 g_hash_table_foreach_remove(s->iotlb, vtd_hash_remove_by_domain,
1047 &domain_id);
1048}
1049
1050static void vtd_iotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
1051 hwaddr addr, uint8_t am)
1052{
1053 VTDIOTLBPageInvInfo info;
1054
1055 assert(am <= VTD_MAMV);
1056 info.domain_id = domain_id;
d66b969b 1057 info.addr = addr;
b5a280c0
LT		 1058 info.mask = ~((1 << am) - 1);
1059 g_hash_table_foreach_remove(s->iotlb, vtd_hash_remove_by_page, &info);
1060}
1061
1da12ec4
LT		 1062/* Flush IOTLB
1063 * Returns the IOTLB Actual Invalidation Granularity.
1064 * @val: the content of the IOTLB_REG
1065 */
1066static uint64_t vtd_iotlb_flush(IntelIOMMUState *s, uint64_t val)
1067{
1068 uint64_t iaig;
1069 uint64_t type = val & VTD_TLB_FLUSH_GRANU_MASK;
b5a280c0
LT		 1070 uint16_t domain_id;
1071 hwaddr addr;
1072 uint8_t am;
1da12ec4
LT		 1073
1074 switch (type) {
1075 case VTD_TLB_GLOBAL_FLUSH:
b5a280c0 1076 VTD_DPRINTF(INV, "global invalidation");
1da12ec4 1077 iaig = VTD_TLB_GLOBAL_FLUSH_A;
b5a280c0 1078 vtd_iotlb_global_invalidate(s);
1da12ec4
LT		 1079 break;
1080
1081 case VTD_TLB_DSI_FLUSH:
b5a280c0
LT		 1082 domain_id = VTD_TLB_DID(val);
1083 VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1084 domain_id);
1da12ec4 1085 iaig = VTD_TLB_DSI_FLUSH_A;
b5a280c0 1086 vtd_iotlb_domain_invalidate(s, domain_id);
1da12ec4
LT		 1087 break;
1088
1089 case VTD_TLB_PSI_FLUSH:
b5a280c0
LT		 1090 domain_id = VTD_TLB_DID(val);
1091 addr = vtd_get_quad_raw(s, DMAR_IVA_REG);
1092 am = VTD_IVA_AM(addr);
1093 addr = VTD_IVA_ADDR(addr);
1094 VTD_DPRINTF(INV, "page-selective invalidation domain 0x%"PRIx16
1095 " addr 0x%"PRIx64 " mask %"PRIu8, domain_id, addr, am);
1096 if (am > VTD_MAMV) {
1097 VTD_DPRINTF(GENERAL, "error: supported max address mask value is "
1098 "%"PRIu8, (uint8_t)VTD_MAMV);
1099 iaig = 0;
1100 break;
1101 }
1da12ec4 1102 iaig = VTD_TLB_PSI_FLUSH_A;
b5a280c0 1103 vtd_iotlb_page_invalidate(s, domain_id, addr, am);
1da12ec4
LT		 1104 break;
1105
1106 default:
b5a280c0 1107 VTD_DPRINTF(GENERAL, "error: invalid granularity");
1da12ec4
LT		 1108 iaig = 0;
1109 }
1110 return iaig;
1111}
1112
ed7b8fbc
LT		 1113static inline bool vtd_queued_inv_enable_check(IntelIOMMUState *s)
1114{
1115 return s->iq_tail == 0;
1116}
1117
1118static inline bool vtd_queued_inv_disable_check(IntelIOMMUState *s)
1119{
1120 return s->qi_enabled && (s->iq_tail == s->iq_head) &&
1121 (s->iq_last_desc_type == VTD_INV_DESC_WAIT);
1122}
1123
1124static void vtd_handle_gcmd_qie(IntelIOMMUState *s, bool en)
1125{
1126 uint64_t iqa_val = vtd_get_quad_raw(s, DMAR_IQA_REG);
1127
1128 VTD_DPRINTF(INV, "Queued Invalidation Enable %s", (en ? "on" : "off"));
1129 if (en) {
1130 if (vtd_queued_inv_enable_check(s)) {
1131 s->iq = iqa_val & VTD_IQA_IQA_MASK;
1132 /* 2^(x+8) entries */
1133 s->iq_size = 1UL << ((iqa_val & VTD_IQA_QS) + 8);
1134 s->qi_enabled = true;
1135 VTD_DPRINTF(INV, "DMAR_IQA_REG 0x%"PRIx64, iqa_val);
1136 VTD_DPRINTF(INV, "Invalidation Queue addr 0x%"PRIx64 " size %d",
1137 s->iq, s->iq_size);
1138 /* Ok - report back to driver */
1139 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_QIES);
1140 } else {
1141 VTD_DPRINTF(GENERAL, "error: can't enable Queued Invalidation: "
1142 "tail %"PRIu16, s->iq_tail);
1143 }
1144 } else {
1145 if (vtd_queued_inv_disable_check(s)) {
1146 /* disable Queued Invalidation */
1147 vtd_set_quad_raw(s, DMAR_IQH_REG, 0);
1148 s->iq_head = 0;
1149 s->qi_enabled = false;
1150 /* Ok - report back to driver */
1151 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, VTD_GSTS_QIES, 0);
1152 } else {
1153 VTD_DPRINTF(GENERAL, "error: can't disable Queued Invalidation: "
1154 "head %"PRIu16 ", tail %"PRIu16
1155 ", last_descriptor %"PRIu8,
1156 s->iq_head, s->iq_tail, s->iq_last_desc_type);
1157 }
1158 }
1159}
1160
1da12ec4
LT		 1161/* Set Root Table Pointer */
1162static void vtd_handle_gcmd_srtp(IntelIOMMUState *s)
1163{
1164 VTD_DPRINTF(CSR, "set Root Table Pointer");
1165
1166 vtd_root_table_setup(s);
1167 /* Ok - report back to driver */
1168 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_RTPS);
1169}
1170
a5861439
PX		 1171/* Set Interrupt Remap Table Pointer */
1172static void vtd_handle_gcmd_sirtp(IntelIOMMUState *s)
1173{
1174 VTD_DPRINTF(CSR, "set Interrupt Remap Table Pointer");
1175
1176 vtd_interrupt_remap_table_setup(s);
1177 /* Ok - report back to driver */
1178 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_IRTPS);
1179}
1180
1da12ec4
LT		 1181/* Handle Translation Enable/Disable */
1182static void vtd_handle_gcmd_te(IntelIOMMUState *s, bool en)
1183{
1184 VTD_DPRINTF(CSR, "Translation Enable %s", (en ? "on" : "off"));
1185
1186 if (en) {
1187 s->dmar_enabled = true;
1188 /* Ok - report back to driver */
1189 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_TES);
1190 } else {
1191 s->dmar_enabled = false;
1192
1193 /* Clear the index of Fault Recording Register */
1194 s->next_frcd_reg = 0;
1195 /* Ok - report back to driver */
1196 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, VTD_GSTS_TES, 0);
1197 }
1198}
1199
80de52ba
PX		 1200/* Handle Interrupt Remap Enable/Disable */
1201static void vtd_handle_gcmd_ire(IntelIOMMUState *s, bool en)
1202{
1203 VTD_DPRINTF(CSR, "Interrupt Remap Enable %s", (en ? "on" : "off"));
1204
1205 if (en) {
1206 s->intr_enabled = true;
1207 /* Ok - report back to driver */
1208 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, 0, VTD_GSTS_IRES);
1209 } else {
1210 s->intr_enabled = false;
1211 /* Ok - report back to driver */
1212 vtd_set_clear_mask_long(s, DMAR_GSTS_REG, VTD_GSTS_IRES, 0);
1213 }
1214}
1215
1da12ec4
LT		 1216/* Handle write to Global Command Register */
1217static void vtd_handle_gcmd_write(IntelIOMMUState *s)
1218{
1219 uint32_t status = vtd_get_long_raw(s, DMAR_GSTS_REG);
1220 uint32_t val = vtd_get_long_raw(s, DMAR_GCMD_REG);
1221 uint32_t changed = status ^ val;
1222
1223 VTD_DPRINTF(CSR, "value 0x%"PRIx32 " status 0x%"PRIx32, val, status);
1224 if (changed & VTD_GCMD_TE) {
1225 /* Translation enable/disable */
1226 vtd_handle_gcmd_te(s, val & VTD_GCMD_TE);
1227 }
1228 if (val & VTD_GCMD_SRTP) {
1229 /* Set/update the root-table pointer */
1230 vtd_handle_gcmd_srtp(s);
1231 }
ed7b8fbc
LT		 1232 if (changed & VTD_GCMD_QIE) {
1233 /* Queued Invalidation Enable */
1234 vtd_handle_gcmd_qie(s, val & VTD_GCMD_QIE);
1235 }
a5861439
PX		 1236 if (val & VTD_GCMD_SIRTP) {
1237 /* Set/update the interrupt remapping root-table pointer */
1238 vtd_handle_gcmd_sirtp(s);
1239 }
80de52ba
PX		 1240 if (changed & VTD_GCMD_IRE) {
1241 /* Interrupt remap enable/disable */
1242 vtd_handle_gcmd_ire(s, val & VTD_GCMD_IRE);
1243 }
1da12ec4
LT		 1244}
1245
1246/* Handle write to Context Command Register */
1247static void vtd_handle_ccmd_write(IntelIOMMUState *s)
1248{
1249 uint64_t ret;
1250 uint64_t val = vtd_get_quad_raw(s, DMAR_CCMD_REG);
1251
1252 /* Context-cache invalidation request */
1253 if (val & VTD_CCMD_ICC) {
ed7b8fbc
LT		 1254 if (s->qi_enabled) {
1255 VTD_DPRINTF(GENERAL, "error: Queued Invalidation enabled, "
1256 "should not use register-based invalidation");
1257 return;
1258 }
1da12ec4
LT		 1259 ret = vtd_context_cache_invalidate(s, val);
1260 /* Invalidation completed. Change something to show */
1261 vtd_set_clear_mask_quad(s, DMAR_CCMD_REG, VTD_CCMD_ICC, 0ULL);
1262 ret = vtd_set_clear_mask_quad(s, DMAR_CCMD_REG, VTD_CCMD_CAIG_MASK,
1263 ret);
1264 VTD_DPRINTF(INV, "CCMD_REG write-back val: 0x%"PRIx64, ret);
1265 }
1266}
1267
1268/* Handle write to IOTLB Invalidation Register */
1269static void vtd_handle_iotlb_write(IntelIOMMUState *s)
1270{
1271 uint64_t ret;
1272 uint64_t val = vtd_get_quad_raw(s, DMAR_IOTLB_REG);
1273
1274 /* IOTLB invalidation request */
1275 if (val & VTD_TLB_IVT) {
ed7b8fbc
LT		 1276 if (s->qi_enabled) {
1277 VTD_DPRINTF(GENERAL, "error: Queued Invalidation enabled, "
1278 "should not use register-based invalidation");
1279 return;
1280 }
1da12ec4
LT		 1281 ret = vtd_iotlb_flush(s, val);
1282 /* Invalidation completed. Change something to show */
1283 vtd_set_clear_mask_quad(s, DMAR_IOTLB_REG, VTD_TLB_IVT, 0ULL);
1284 ret = vtd_set_clear_mask_quad(s, DMAR_IOTLB_REG,
1285 VTD_TLB_FLUSH_GRANU_MASK_A, ret);
1286 VTD_DPRINTF(INV, "IOTLB_REG write-back val: 0x%"PRIx64, ret);
1287 }
1288}
1289
ed7b8fbc
LT		 1290/* Fetch an Invalidation Descriptor from the Invalidation Queue */
1291static bool vtd_get_inv_desc(dma_addr_t base_addr, uint32_t offset,
1292 VTDInvDesc *inv_desc)
1293{
1294 dma_addr_t addr = base_addr + offset * sizeof(*inv_desc);
1295 if (dma_memory_read(&address_space_memory, addr, inv_desc,
1296 sizeof(*inv_desc))) {
1297 VTD_DPRINTF(GENERAL, "error: fail to fetch Invalidation Descriptor "
1298 "base_addr 0x%"PRIx64 " offset %"PRIu32, base_addr, offset);
1299 inv_desc->lo = 0;
1300 inv_desc->hi = 0;
1301
1302 return false;
1303 }
1304 inv_desc->lo = le64_to_cpu(inv_desc->lo);
1305 inv_desc->hi = le64_to_cpu(inv_desc->hi);
1306 return true;
1307}
1308
1309static bool vtd_process_wait_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
1310{
1311 if ((inv_desc->hi & VTD_INV_DESC_WAIT_RSVD_HI) ||
1312 (inv_desc->lo & VTD_INV_DESC_WAIT_RSVD_LO)) {
1313 VTD_DPRINTF(GENERAL, "error: non-zero reserved field in Invalidation "
1314 "Wait Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1315 inv_desc->hi, inv_desc->lo);
1316 return false;
1317 }
1318 if (inv_desc->lo & VTD_INV_DESC_WAIT_SW) {
1319 /* Status Write */
1320 uint32_t status_data = (uint32_t)(inv_desc->lo >>
1321 VTD_INV_DESC_WAIT_DATA_SHIFT);
1322
1323 assert(!(inv_desc->lo & VTD_INV_DESC_WAIT_IF));
1324
1325 /* FIXME: need to be masked with HAW? */
1326 dma_addr_t status_addr = inv_desc->hi;
1327 VTD_DPRINTF(INV, "status data 0x%x, status addr 0x%"PRIx64,
1328 status_data, status_addr);
1329 status_data = cpu_to_le32(status_data);
1330 if (dma_memory_write(&address_space_memory, status_addr, &status_data,
1331 sizeof(status_data))) {
1332 VTD_DPRINTF(GENERAL, "error: fail to perform a coherent write");
1333 return false;
1334 }
1335 } else if (inv_desc->lo & VTD_INV_DESC_WAIT_IF) {
1336 /* Interrupt flag */
1337 VTD_DPRINTF(INV, "Invalidation Wait Descriptor interrupt completion");
1338 vtd_generate_completion_event(s);
1339 } else {
1340 VTD_DPRINTF(GENERAL, "error: invalid Invalidation Wait Descriptor: "
1341 "hi 0x%"PRIx64 " lo 0x%"PRIx64, inv_desc->hi, inv_desc->lo);
1342 return false;
1343 }
1344 return true;
1345}
1346
d92fa2dc
LT		 1347static bool vtd_process_context_cache_desc(IntelIOMMUState *s,
1348 VTDInvDesc *inv_desc)
1349{
1350 if ((inv_desc->lo & VTD_INV_DESC_CC_RSVD) || inv_desc->hi) {
1351 VTD_DPRINTF(GENERAL, "error: non-zero reserved field in Context-cache "
1352 "Invalidate Descriptor");
1353 return false;
1354 }
1355 switch (inv_desc->lo & VTD_INV_DESC_CC_G) {
1356 case VTD_INV_DESC_CC_DOMAIN:
1357 VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1358 (uint16_t)VTD_INV_DESC_CC_DID(inv_desc->lo));
1359 /* Fall through */
1360 case VTD_INV_DESC_CC_GLOBAL:
1361 VTD_DPRINTF(INV, "global invalidation");
1362 vtd_context_global_invalidate(s);
1363 break;
1364
1365 case VTD_INV_DESC_CC_DEVICE:
1366 vtd_context_device_invalidate(s, VTD_INV_DESC_CC_SID(inv_desc->lo),
1367 VTD_INV_DESC_CC_FM(inv_desc->lo));
1368 break;
1369
1370 default:
1371 VTD_DPRINTF(GENERAL, "error: invalid granularity in Context-cache "
1372 "Invalidate Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1373 inv_desc->hi, inv_desc->lo);
1374 return false;
1375 }
1376 return true;
1377}
1378
b5a280c0
LT		 1379static bool vtd_process_iotlb_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
1380{
1381 uint16_t domain_id;
1382 uint8_t am;
1383 hwaddr addr;
1384
1385 if ((inv_desc->lo & VTD_INV_DESC_IOTLB_RSVD_LO) ||
1386 (inv_desc->hi & VTD_INV_DESC_IOTLB_RSVD_HI)) {
1387 VTD_DPRINTF(GENERAL, "error: non-zero reserved field in IOTLB "
1388 "Invalidate Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1389 inv_desc->hi, inv_desc->lo);
1390 return false;
1391 }
1392
1393 switch (inv_desc->lo & VTD_INV_DESC_IOTLB_G) {
1394 case VTD_INV_DESC_IOTLB_GLOBAL:
1395 VTD_DPRINTF(INV, "global invalidation");
1396 vtd_iotlb_global_invalidate(s);
1397 break;
1398
1399 case VTD_INV_DESC_IOTLB_DOMAIN:
1400 domain_id = VTD_INV_DESC_IOTLB_DID(inv_desc->lo);
1401 VTD_DPRINTF(INV, "domain-selective invalidation domain 0x%"PRIx16,
1402 domain_id);
1403 vtd_iotlb_domain_invalidate(s, domain_id);
1404 break;
1405
1406 case VTD_INV_DESC_IOTLB_PAGE:
1407 domain_id = VTD_INV_DESC_IOTLB_DID(inv_desc->lo);
1408 addr = VTD_INV_DESC_IOTLB_ADDR(inv_desc->hi);
1409 am = VTD_INV_DESC_IOTLB_AM(inv_desc->hi);
1410 VTD_DPRINTF(INV, "page-selective invalidation domain 0x%"PRIx16
1411 " addr 0x%"PRIx64 " mask %"PRIu8, domain_id, addr, am);
1412 if (am > VTD_MAMV) {
1413 VTD_DPRINTF(GENERAL, "error: supported max address mask value is "
1414 "%"PRIu8, (uint8_t)VTD_MAMV);
1415 return false;
1416 }
1417 vtd_iotlb_page_invalidate(s, domain_id, addr, am);
1418 break;
1419
1420 default:
1421 VTD_DPRINTF(GENERAL, "error: invalid granularity in IOTLB Invalidate "
1422 "Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1423 inv_desc->hi, inv_desc->lo);
1424 return false;
1425 }
1426 return true;
1427}
1428
02a2cbc8
PX		 1429static bool vtd_process_inv_iec_desc(IntelIOMMUState *s,
1430 VTDInvDesc *inv_desc)
1431{
1432 VTD_DPRINTF(INV, "inv ir glob %d index %d mask %d",
1433 inv_desc->iec.granularity,
1434 inv_desc->iec.index,
1435 inv_desc->iec.index_mask);
1436
1437 vtd_iec_notify_all(s, !inv_desc->iec.granularity,
1438 inv_desc->iec.index,
1439 inv_desc->iec.index_mask);
1440
1441 return true;
1442}
1443
ed7b8fbc
LT		 1444static bool vtd_process_inv_desc(IntelIOMMUState *s)
1445{
1446 VTDInvDesc inv_desc;
1447 uint8_t desc_type;
1448
1449 VTD_DPRINTF(INV, "iq head %"PRIu16, s->iq_head);
1450 if (!vtd_get_inv_desc(s->iq, s->iq_head, &inv_desc)) {
1451 s->iq_last_desc_type = VTD_INV_DESC_NONE;
1452 return false;
1453 }
1454 desc_type = inv_desc.lo & VTD_INV_DESC_TYPE;
1455 /* FIXME: should update at first or at last? */
1456 s->iq_last_desc_type = desc_type;
1457
1458 switch (desc_type) {
1459 case VTD_INV_DESC_CC:
1460 VTD_DPRINTF(INV, "Context-cache Invalidate Descriptor hi 0x%"PRIx64
1461 " lo 0x%"PRIx64, inv_desc.hi, inv_desc.lo);
d92fa2dc
LT		 1462 if (!vtd_process_context_cache_desc(s, &inv_desc)) {
1463 return false;
1464 }
ed7b8fbc
LT		 1465 break;
1466
1467 case VTD_INV_DESC_IOTLB:
1468 VTD_DPRINTF(INV, "IOTLB Invalidate Descriptor hi 0x%"PRIx64
1469 " lo 0x%"PRIx64, inv_desc.hi, inv_desc.lo);
b5a280c0
LT		 1470 if (!vtd_process_iotlb_desc(s, &inv_desc)) {
1471 return false;
1472 }
ed7b8fbc
LT		 1473 break;
1474
1475 case VTD_INV_DESC_WAIT:
1476 VTD_DPRINTF(INV, "Invalidation Wait Descriptor hi 0x%"PRIx64
1477 " lo 0x%"PRIx64, inv_desc.hi, inv_desc.lo);
1478 if (!vtd_process_wait_desc(s, &inv_desc)) {
1479 return false;
1480 }
1481 break;
1482
b7910472 1483 case VTD_INV_DESC_IEC:
02a2cbc8
PX		 1484 VTD_DPRINTF(INV, "Invalidation Interrupt Entry Cache "
1485 "Descriptor hi 0x%"PRIx64 " lo 0x%"PRIx64,
1486 inv_desc.hi, inv_desc.lo);
1487 if (!vtd_process_inv_iec_desc(s, &inv_desc)) {
1488 return false;
1489 }
b7910472
PX		 1490 break;
1491
ed7b8fbc
LT		 1492 default:
1493 VTD_DPRINTF(GENERAL, "error: unkonw Invalidation Descriptor type "
1494 "hi 0x%"PRIx64 " lo 0x%"PRIx64 " type %"PRIu8,
1495 inv_desc.hi, inv_desc.lo, desc_type);
1496 return false;
1497 }
1498 s->iq_head++;
1499 if (s->iq_head == s->iq_size) {
1500 s->iq_head = 0;
1501 }
1502 return true;
1503}
1504
1505/* Try to fetch and process more Invalidation Descriptors */
1506static void vtd_fetch_inv_desc(IntelIOMMUState *s)
1507{
1508 VTD_DPRINTF(INV, "fetch Invalidation Descriptors");
1509 if (s->iq_tail >= s->iq_size) {
1510 /* Detects an invalid Tail pointer */
1511 VTD_DPRINTF(GENERAL, "error: iq_tail is %"PRIu16
1512 " while iq_size is %"PRIu16, s->iq_tail, s->iq_size);
1513 vtd_handle_inv_queue_error(s);
1514 return;
1515 }
1516 while (s->iq_head != s->iq_tail) {
1517 if (!vtd_process_inv_desc(s)) {
1518 /* Invalidation Queue Errors */
1519 vtd_handle_inv_queue_error(s);
1520 break;
1521 }
1522 /* Must update the IQH_REG in time */
1523 vtd_set_quad_raw(s, DMAR_IQH_REG,
1524 (((uint64_t)(s->iq_head)) << VTD_IQH_QH_SHIFT) &
1525 VTD_IQH_QH_MASK);
1526 }
1527}
1528
1529/* Handle write to Invalidation Queue Tail Register */
1530static void vtd_handle_iqt_write(IntelIOMMUState *s)
1531{
1532 uint64_t val = vtd_get_quad_raw(s, DMAR_IQT_REG);
1533
1534 s->iq_tail = VTD_IQT_QT(val);
1535 VTD_DPRINTF(INV, "set iq tail %"PRIu16, s->iq_tail);
1536 if (s->qi_enabled && !(vtd_get_long_raw(s, DMAR_FSTS_REG) & VTD_FSTS_IQE)) {
1537 /* Process Invalidation Queue here */
1538 vtd_fetch_inv_desc(s);
1539 }
1540}
1541
1da12ec4
LT		 1542static void vtd_handle_fsts_write(IntelIOMMUState *s)
1543{
1544 uint32_t fsts_reg = vtd_get_long_raw(s, DMAR_FSTS_REG);
1545 uint32_t fectl_reg = vtd_get_long_raw(s, DMAR_FECTL_REG);
1546 uint32_t status_fields = VTD_FSTS_PFO | VTD_FSTS_PPF | VTD_FSTS_IQE;
1547
1548 if ((fectl_reg & VTD_FECTL_IP) && !(fsts_reg & status_fields)) {
1549 vtd_set_clear_mask_long(s, DMAR_FECTL_REG, VTD_FECTL_IP, 0);
1550 VTD_DPRINTF(FLOG, "all pending interrupt conditions serviced, clear "
1551 "IP field of FECTL_REG");
1552 }
ed7b8fbc
LT		 1553 /* FIXME: when IQE is Clear, should we try to fetch some Invalidation
1554 * Descriptors if there are any when Queued Invalidation is enabled?
1555 */
1da12ec4
LT		 1556}
1557
1558static void vtd_handle_fectl_write(IntelIOMMUState *s)
1559{
1560 uint32_t fectl_reg;
1561 /* FIXME: when software clears the IM field, check the IP field. But do we
1562 * need to compare the old value and the new value to conclude that
1563 * software clears the IM field? Or just check if the IM field is zero?
1564 */
1565 fectl_reg = vtd_get_long_raw(s, DMAR_FECTL_REG);
1566 if ((fectl_reg & VTD_FECTL_IP) && !(fectl_reg & VTD_FECTL_IM)) {
1567 vtd_generate_interrupt(s, DMAR_FEADDR_REG, DMAR_FEDATA_REG);
1568 vtd_set_clear_mask_long(s, DMAR_FECTL_REG, VTD_FECTL_IP, 0);
1569 VTD_DPRINTF(FLOG, "IM field is cleared, generate "
1570 "fault event interrupt");
1571 }
1572}
1573
ed7b8fbc
LT		 1574static void vtd_handle_ics_write(IntelIOMMUState *s)
1575{
1576 uint32_t ics_reg = vtd_get_long_raw(s, DMAR_ICS_REG);
1577 uint32_t iectl_reg = vtd_get_long_raw(s, DMAR_IECTL_REG);
1578
1579 if ((iectl_reg & VTD_IECTL_IP) && !(ics_reg & VTD_ICS_IWC)) {
1580 vtd_set_clear_mask_long(s, DMAR_IECTL_REG, VTD_IECTL_IP, 0);
1581 VTD_DPRINTF(INV, "pending completion interrupt condition serviced, "
1582 "clear IP field of IECTL_REG");
1583 }
1584}
1585
1586static void vtd_handle_iectl_write(IntelIOMMUState *s)
1587{
1588 uint32_t iectl_reg;
1589 /* FIXME: when software clears the IM field, check the IP field. But do we
1590 * need to compare the old value and the new value to conclude that
1591 * software clears the IM field? Or just check if the IM field is zero?
1592 */
1593 iectl_reg = vtd_get_long_raw(s, DMAR_IECTL_REG);
1594 if ((iectl_reg & VTD_IECTL_IP) && !(iectl_reg & VTD_IECTL_IM)) {
1595 vtd_generate_interrupt(s, DMAR_IEADDR_REG, DMAR_IEDATA_REG);
1596 vtd_set_clear_mask_long(s, DMAR_IECTL_REG, VTD_IECTL_IP, 0);
1597 VTD_DPRINTF(INV, "IM field is cleared, generate "
1598 "invalidation event interrupt");
1599 }
1600}
1601
1da12ec4
LT		 1602static uint64_t vtd_mem_read(void *opaque, hwaddr addr, unsigned size)
1603{
1604 IntelIOMMUState *s = opaque;
1605 uint64_t val;
1606
1607 if (addr + size > DMAR_REG_SIZE) {
1608 VTD_DPRINTF(GENERAL, "error: addr outside region: max 0x%"PRIx64
1609 ", got 0x%"PRIx64 " %d",
1610 (uint64_t)DMAR_REG_SIZE, addr, size);
1611 return (uint64_t)-1;
1612 }
1613
1614 switch (addr) {
1615 /* Root Table Address Register, 64-bit */
1616 case DMAR_RTADDR_REG:
1617 if (size == 4) {
1618 val = s->root & ((1ULL << 32) - 1);
1619 } else {
1620 val = s->root;
1621 }
1622 break;
1623
1624 case DMAR_RTADDR_REG_HI:
1625 assert(size == 4);
1626 val = s->root >> 32;
1627 break;
1628
ed7b8fbc
LT		 1629 /* Invalidation Queue Address Register, 64-bit */
1630 case DMAR_IQA_REG:
1631 val = s->iq | (vtd_get_quad(s, DMAR_IQA_REG) & VTD_IQA_QS);
1632 if (size == 4) {
1633 val = val & ((1ULL << 32) - 1);
1634 }
1635 break;
1636
1637 case DMAR_IQA_REG_HI:
1638 assert(size == 4);
1639 val = s->iq >> 32;
1640 break;
1641
1da12ec4
LT		 1642 default:
1643 if (size == 4) {
1644 val = vtd_get_long(s, addr);
1645 } else {
1646 val = vtd_get_quad(s, addr);
1647 }
1648 }
1649 VTD_DPRINTF(CSR, "addr 0x%"PRIx64 " size %d val 0x%"PRIx64,
1650 addr, size, val);
1651 return val;
1652}
1653
1654static void vtd_mem_write(void *opaque, hwaddr addr,
1655 uint64_t val, unsigned size)
1656{
1657 IntelIOMMUState *s = opaque;
1658
1659 if (addr + size > DMAR_REG_SIZE) {
1660 VTD_DPRINTF(GENERAL, "error: addr outside region: max 0x%"PRIx64
1661 ", got 0x%"PRIx64 " %d",
1662 (uint64_t)DMAR_REG_SIZE, addr, size);
1663 return;
1664 }
1665
1666 switch (addr) {
1667 /* Global Command Register, 32-bit */
1668 case DMAR_GCMD_REG:
1669 VTD_DPRINTF(CSR, "DMAR_GCMD_REG write addr 0x%"PRIx64
1670 ", size %d, val 0x%"PRIx64, addr, size, val);
1671 vtd_set_long(s, addr, val);
1672 vtd_handle_gcmd_write(s);
1673 break;
1674
1675 /* Context Command Register, 64-bit */
1676 case DMAR_CCMD_REG:
1677 VTD_DPRINTF(CSR, "DMAR_CCMD_REG write addr 0x%"PRIx64
1678 ", size %d, val 0x%"PRIx64, addr, size, val);
1679 if (size == 4) {
1680 vtd_set_long(s, addr, val);
1681 } else {
1682 vtd_set_quad(s, addr, val);
1683 vtd_handle_ccmd_write(s);
1684 }
1685 break;
1686
1687 case DMAR_CCMD_REG_HI:
1688 VTD_DPRINTF(CSR, "DMAR_CCMD_REG_HI write addr 0x%"PRIx64
1689 ", size %d, val 0x%"PRIx64, addr, size, val);
1690 assert(size == 4);
1691 vtd_set_long(s, addr, val);
1692 vtd_handle_ccmd_write(s);
1693 break;
1694
1695 /* IOTLB Invalidation Register, 64-bit */
1696 case DMAR_IOTLB_REG:
1697 VTD_DPRINTF(INV, "DMAR_IOTLB_REG write addr 0x%"PRIx64
1698 ", size %d, val 0x%"PRIx64, addr, size, val);
1699 if (size == 4) {
1700 vtd_set_long(s, addr, val);
1701 } else {
1702 vtd_set_quad(s, addr, val);
1703 vtd_handle_iotlb_write(s);
1704 }
1705 break;
1706
1707 case DMAR_IOTLB_REG_HI:
1708 VTD_DPRINTF(INV, "DMAR_IOTLB_REG_HI write addr 0x%"PRIx64
1709 ", size %d, val 0x%"PRIx64, addr, size, val);
1710 assert(size == 4);
1711 vtd_set_long(s, addr, val);
1712 vtd_handle_iotlb_write(s);
1713 break;
1714
b5a280c0
LT		 1715 /* Invalidate Address Register, 64-bit */
1716 case DMAR_IVA_REG:
1717 VTD_DPRINTF(INV, "DMAR_IVA_REG write addr 0x%"PRIx64
1718 ", size %d, val 0x%"PRIx64, addr, size, val);
1719 if (size == 4) {
1720 vtd_set_long(s, addr, val);
1721 } else {
1722 vtd_set_quad(s, addr, val);
1723 }
1724 break;
1725
1726 case DMAR_IVA_REG_HI:
1727 VTD_DPRINTF(INV, "DMAR_IVA_REG_HI write addr 0x%"PRIx64
1728 ", size %d, val 0x%"PRIx64, addr, size, val);
1729 assert(size == 4);
1730 vtd_set_long(s, addr, val);
1731 break;
1732
1da12ec4
LT		 1733 /* Fault Status Register, 32-bit */
1734 case DMAR_FSTS_REG:
1735 VTD_DPRINTF(FLOG, "DMAR_FSTS_REG write addr 0x%"PRIx64
1736 ", size %d, val 0x%"PRIx64, addr, size, val);
1737 assert(size == 4);
1738 vtd_set_long(s, addr, val);
1739 vtd_handle_fsts_write(s);
1740 break;
1741
1742 /* Fault Event Control Register, 32-bit */
1743 case DMAR_FECTL_REG:
1744 VTD_DPRINTF(FLOG, "DMAR_FECTL_REG write addr 0x%"PRIx64
1745 ", size %d, val 0x%"PRIx64, addr, size, val);
1746 assert(size == 4);
1747 vtd_set_long(s, addr, val);
1748 vtd_handle_fectl_write(s);
1749 break;
1750
1751 /* Fault Event Data Register, 32-bit */
1752 case DMAR_FEDATA_REG:
1753 VTD_DPRINTF(FLOG, "DMAR_FEDATA_REG write addr 0x%"PRIx64
1754 ", size %d, val 0x%"PRIx64, addr, size, val);
1755 assert(size == 4);
1756 vtd_set_long(s, addr, val);
1757 break;
1758
1759 /* Fault Event Address Register, 32-bit */
1760 case DMAR_FEADDR_REG:
1761 VTD_DPRINTF(FLOG, "DMAR_FEADDR_REG write addr 0x%"PRIx64
1762 ", size %d, val 0x%"PRIx64, addr, size, val);
1763 assert(size == 4);
1764 vtd_set_long(s, addr, val);
1765 break;
1766
1767 /* Fault Event Upper Address Register, 32-bit */
1768 case DMAR_FEUADDR_REG:
1769 VTD_DPRINTF(FLOG, "DMAR_FEUADDR_REG write addr 0x%"PRIx64
1770 ", size %d, val 0x%"PRIx64, addr, size, val);
1771 assert(size == 4);
1772 vtd_set_long(s, addr, val);
1773 break;
1774
1775 /* Protected Memory Enable Register, 32-bit */
1776 case DMAR_PMEN_REG:
1777 VTD_DPRINTF(CSR, "DMAR_PMEN_REG write addr 0x%"PRIx64
1778 ", size %d, val 0x%"PRIx64, addr, size, val);
1779 assert(size == 4);
1780 vtd_set_long(s, addr, val);
1781 break;
1782
1783 /* Root Table Address Register, 64-bit */
1784 case DMAR_RTADDR_REG:
1785 VTD_DPRINTF(CSR, "DMAR_RTADDR_REG write addr 0x%"PRIx64
1786 ", size %d, val 0x%"PRIx64, addr, size, val);
1787 if (size == 4) {
1788 vtd_set_long(s, addr, val);
1789 } else {
1790 vtd_set_quad(s, addr, val);
1791 }
1792 break;
1793
1794 case DMAR_RTADDR_REG_HI:
1795 VTD_DPRINTF(CSR, "DMAR_RTADDR_REG_HI write addr 0x%"PRIx64
1796 ", size %d, val 0x%"PRIx64, addr, size, val);
1797 assert(size == 4);
1798 vtd_set_long(s, addr, val);
1799 break;
1800
ed7b8fbc
LT		 1801 /* Invalidation Queue Tail Register, 64-bit */
1802 case DMAR_IQT_REG:
1803 VTD_DPRINTF(INV, "DMAR_IQT_REG write addr 0x%"PRIx64
1804 ", size %d, val 0x%"PRIx64, addr, size, val);
1805 if (size == 4) {
1806 vtd_set_long(s, addr, val);
1807 } else {
1808 vtd_set_quad(s, addr, val);
1809 }
1810 vtd_handle_iqt_write(s);
1811 break;
1812
1813 case DMAR_IQT_REG_HI:
1814 VTD_DPRINTF(INV, "DMAR_IQT_REG_HI write addr 0x%"PRIx64
1815 ", size %d, val 0x%"PRIx64, addr, size, val);
1816 assert(size == 4);
1817 vtd_set_long(s, addr, val);
1818 /* 19:63 of IQT_REG is RsvdZ, do nothing here */
1819 break;
1820
1821 /* Invalidation Queue Address Register, 64-bit */
1822 case DMAR_IQA_REG:
1823 VTD_DPRINTF(INV, "DMAR_IQA_REG write addr 0x%"PRIx64
1824 ", size %d, val 0x%"PRIx64, addr, size, val);
1825 if (size == 4) {
1826 vtd_set_long(s, addr, val);
1827 } else {
1828 vtd_set_quad(s, addr, val);
1829 }
1830 break;
1831
1832 case DMAR_IQA_REG_HI:
1833 VTD_DPRINTF(INV, "DMAR_IQA_REG_HI write addr 0x%"PRIx64
1834 ", size %d, val 0x%"PRIx64, addr, size, val);
1835 assert(size == 4);
1836 vtd_set_long(s, addr, val);
1837 break;
1838
1839 /* Invalidation Completion Status Register, 32-bit */
1840 case DMAR_ICS_REG:
1841 VTD_DPRINTF(INV, "DMAR_ICS_REG write addr 0x%"PRIx64
1842 ", size %d, val 0x%"PRIx64, addr, size, val);
1843 assert(size == 4);
1844 vtd_set_long(s, addr, val);
1845 vtd_handle_ics_write(s);
1846 break;
1847
1848 /* Invalidation Event Control Register, 32-bit */
1849 case DMAR_IECTL_REG:
1850 VTD_DPRINTF(INV, "DMAR_IECTL_REG write addr 0x%"PRIx64
1851 ", size %d, val 0x%"PRIx64, addr, size, val);
1852 assert(size == 4);
1853 vtd_set_long(s, addr, val);
1854 vtd_handle_iectl_write(s);
1855 break;
1856
1857 /* Invalidation Event Data Register, 32-bit */
1858 case DMAR_IEDATA_REG:
1859 VTD_DPRINTF(INV, "DMAR_IEDATA_REG write addr 0x%"PRIx64
1860 ", size %d, val 0x%"PRIx64, addr, size, val);
1861 assert(size == 4);
1862 vtd_set_long(s, addr, val);
1863 break;
1864
1865 /* Invalidation Event Address Register, 32-bit */
1866 case DMAR_IEADDR_REG:
1867 VTD_DPRINTF(INV, "DMAR_IEADDR_REG write addr 0x%"PRIx64
1868 ", size %d, val 0x%"PRIx64, addr, size, val);
1869 assert(size == 4);
1870 vtd_set_long(s, addr, val);
1871 break;
1872
1873 /* Invalidation Event Upper Address Register, 32-bit */
1874 case DMAR_IEUADDR_REG:
1875 VTD_DPRINTF(INV, "DMAR_IEUADDR_REG write addr 0x%"PRIx64
1876 ", size %d, val 0x%"PRIx64, addr, size, val);
1877 assert(size == 4);
1878 vtd_set_long(s, addr, val);
1879 break;
1880
1da12ec4
LT		 1881 /* Fault Recording Registers, 128-bit */
1882 case DMAR_FRCD_REG_0_0:
1883 VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_0 write addr 0x%"PRIx64
1884 ", size %d, val 0x%"PRIx64, addr, size, val);
1885 if (size == 4) {
1886 vtd_set_long(s, addr, val);
1887 } else {
1888 vtd_set_quad(s, addr, val);
1889 }
1890 break;
1891
1892 case DMAR_FRCD_REG_0_1:
1893 VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_1 write addr 0x%"PRIx64
1894 ", size %d, val 0x%"PRIx64, addr, size, val);
1895 assert(size == 4);
1896 vtd_set_long(s, addr, val);
1897 break;
1898
1899 case DMAR_FRCD_REG_0_2:
1900 VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_2 write addr 0x%"PRIx64
1901 ", size %d, val 0x%"PRIx64, addr, size, val);
1902 if (size == 4) {
1903 vtd_set_long(s, addr, val);
1904 } else {
1905 vtd_set_quad(s, addr, val);
1906 /* May clear bit 127 (Fault), update PPF */
1907 vtd_update_fsts_ppf(s);
1908 }
1909 break;
1910
1911 case DMAR_FRCD_REG_0_3:
1912 VTD_DPRINTF(FLOG, "DMAR_FRCD_REG_0_3 write addr 0x%"PRIx64
1913 ", size %d, val 0x%"PRIx64, addr, size, val);
1914 assert(size == 4);
1915 vtd_set_long(s, addr, val);
1916 /* May clear bit 127 (Fault), update PPF */
1917 vtd_update_fsts_ppf(s);
1918 break;
1919
a5861439
PX		 1920 case DMAR_IRTA_REG:
1921 VTD_DPRINTF(IR, "DMAR_IRTA_REG write addr 0x%"PRIx64
1922 ", size %d, val 0x%"PRIx64, addr, size, val);
1923 if (size == 4) {
1924 vtd_set_long(s, addr, val);
1925 } else {
1926 vtd_set_quad(s, addr, val);
1927 }
1928 break;
1929
1930 case DMAR_IRTA_REG_HI:
1931 VTD_DPRINTF(IR, "DMAR_IRTA_REG_HI write addr 0x%"PRIx64
1932 ", size %d, val 0x%"PRIx64, addr, size, val);
1933 assert(size == 4);
1934 vtd_set_long(s, addr, val);
1935 break;
1936
1da12ec4
LT		 1937 default:
1938 VTD_DPRINTF(GENERAL, "error: unhandled reg write addr 0x%"PRIx64
1939 ", size %d, val 0x%"PRIx64, addr, size, val);
1940 if (size == 4) {
1941 vtd_set_long(s, addr, val);
1942 } else {
1943 vtd_set_quad(s, addr, val);
1944 }
1945 }
1946}
1947
1948static IOMMUTLBEntry vtd_iommu_translate(MemoryRegion *iommu, hwaddr addr,
1949 bool is_write)
1950{
1951 VTDAddressSpace *vtd_as = container_of(iommu, VTDAddressSpace, iommu);
1952 IntelIOMMUState *s = vtd_as->iommu_state;
1da12ec4
LT		 1953 IOMMUTLBEntry ret = {
1954 .target_as = &address_space_memory,
1955 .iova = addr,
1956 .translated_addr = 0,
1957 .addr_mask = ~(hwaddr)0,
1958 .perm = IOMMU_NONE,
1959 };
1960
1961 if (!s->dmar_enabled) {
1962 /* DMAR disabled, passthrough, use 4k-page*/
1963 ret.iova = addr & VTD_PAGE_MASK_4K;
1964 ret.translated_addr = addr & VTD_PAGE_MASK_4K;
1965 ret.addr_mask = ~VTD_PAGE_MASK_4K;
1966 ret.perm = IOMMU_RW;
1967 return ret;
1968 }
1969
7df953bd 1970 vtd_do_iommu_translate(vtd_as, vtd_as->bus, vtd_as->devfn, addr,
d92fa2dc 1971 is_write, &ret);
1da12ec4
LT		 1972 VTD_DPRINTF(MMU,
1973 "bus %"PRIu8 " slot %"PRIu8 " func %"PRIu8 " devfn %"PRIu8
7df953bd 1974 " gpa 0x%"PRIx64 " hpa 0x%"PRIx64, pci_bus_num(vtd_as->bus),
d92fa2dc
LT		 1975 VTD_PCI_SLOT(vtd_as->devfn), VTD_PCI_FUNC(vtd_as->devfn),
1976 vtd_as->devfn, addr, ret.translated_addr);
1da12ec4
LT		 1977 return ret;
1978}
1979
5bf3d319
PX		 1980static void vtd_iommu_notify_flag_changed(MemoryRegion *iommu,
1981 IOMMUNotifierFlag old,
1982 IOMMUNotifierFlag new)
3cb3b154
AW		 1983{
1984 VTDAddressSpace *vtd_as = container_of(iommu, VTDAddressSpace, iommu);
1985
a3276f78
PX		 1986 if (new & IOMMU_NOTIFIER_MAP) {
1987 error_report("Device at bus %s addr %02x.%d requires iommu "
1988 "notifier which is currently not supported by "
1989 "intel-iommu emulation",
1990 vtd_as->bus->qbus.name, PCI_SLOT(vtd_as->devfn),
1991 PCI_FUNC(vtd_as->devfn));
1992 exit(1);
1993 }
3cb3b154
AW		 1994}
1995
1da12ec4
LT		 1996static const VMStateDescription vtd_vmstate = {
1997 .name = "iommu-intel",
1998 .unmigratable = 1,
1999};
2000
2001static const MemoryRegionOps vtd_mem_ops = {
2002 .read = vtd_mem_read,
2003 .write = vtd_mem_write,
2004 .endianness = DEVICE_LITTLE_ENDIAN,
2005 .impl = {
2006 .min_access_size = 4,
2007 .max_access_size = 8,
2008 },
2009 .valid = {
2010 .min_access_size = 4,
2011 .max_access_size = 8,
2012 },
2013};
2014
2015static Property vtd_properties[] = {
2016 DEFINE_PROP_UINT32("version", IntelIOMMUState, version, 0),
e6b6af05
RK		 2017 DEFINE_PROP_ON_OFF_AUTO("eim", IntelIOMMUState, intr_eim,
2018 ON_OFF_AUTO_AUTO),
fb506e70 2019 DEFINE_PROP_BOOL("x-buggy-eim", IntelIOMMUState, buggy_eim, false),
1da12ec4
LT		 2020 DEFINE_PROP_END_OF_LIST(),
2021};
2022
651e4cef
PX		 2023/* Read IRTE entry with specific index */
2024static int vtd_irte_get(IntelIOMMUState *iommu, uint16_t index,
bc38ee10 2025 VTD_IR_TableEntry *entry, uint16_t sid)
651e4cef 2026{
ede9c94a
PX		 2027 static const uint16_t vtd_svt_mask[VTD_SQ_MAX] = \
2028 {0xffff, 0xfffb, 0xfff9, 0xfff8};
651e4cef 2029 dma_addr_t addr = 0x00;
ede9c94a
PX		 2030 uint16_t mask, source_id;
2031 uint8_t bus, bus_max, bus_min;
651e4cef
PX		 2032
2033 addr = iommu->intr_root + index * sizeof(*entry);
2034 if (dma_memory_read(&address_space_memory, addr, entry,
2035 sizeof(*entry))) {
2036 VTD_DPRINTF(GENERAL, "error: fail to access IR root at 0x%"PRIx64
2037 " + %"PRIu16, iommu->intr_root, index);
2038 return -VTD_FR_IR_ROOT_INVAL;
2039 }
2040
bc38ee10 2041 if (!entry->irte.present) {
651e4cef
PX		 2042 VTD_DPRINTF(GENERAL, "error: present flag not set in IRTE"
2043 " entry index %u value 0x%"PRIx64 " 0x%"PRIx64,
2044 index, le64_to_cpu(entry->data[1]),
2045 le64_to_cpu(entry->data[0]));
2046 return -VTD_FR_IR_ENTRY_P;
2047 }
2048
bc38ee10
MT		 2049 if (entry->irte.__reserved_0 || entry->irte.__reserved_1 ||
2050 entry->irte.__reserved_2) {
651e4cef
PX		 2051 VTD_DPRINTF(GENERAL, "error: IRTE entry index %"PRIu16
2052 " reserved fields non-zero: 0x%"PRIx64 " 0x%"PRIx64,
2053 index, le64_to_cpu(entry->data[1]),
2054 le64_to_cpu(entry->data[0]));
2055 return -VTD_FR_IR_IRTE_RSVD;
2056 }
2057
ede9c94a
PX		 2058 if (sid != X86_IOMMU_SID_INVALID) {
2059 /* Validate IRTE SID */
bc38ee10
MT		 2060 source_id = le32_to_cpu(entry->irte.source_id);
2061 switch (entry->irte.sid_vtype) {
ede9c94a
PX		 2062 case VTD_SVT_NONE:
2063 VTD_DPRINTF(IR, "No SID validation for IRTE index %d", index);
2064 break;
2065
2066 case VTD_SVT_ALL:
bc38ee10 2067 mask = vtd_svt_mask[entry->irte.sid_q];
ede9c94a
PX		 2068 if ((source_id & mask) != (sid & mask)) {
2069 VTD_DPRINTF(GENERAL, "SID validation for IRTE index "
2070 "%d failed (reqid 0x%04x sid 0x%04x)", index,
2071 sid, source_id);
2072 return -VTD_FR_IR_SID_ERR;
2073 }
2074 break;
2075
2076 case VTD_SVT_BUS:
2077 bus_max = source_id >> 8;
2078 bus_min = source_id & 0xff;
2079 bus = sid >> 8;
2080 if (bus > bus_max || bus < bus_min) {
2081 VTD_DPRINTF(GENERAL, "SID validation for IRTE index %d "
2082 "failed (bus %d outside %d-%d)", index, bus,
2083 bus_min, bus_max);
2084 return -VTD_FR_IR_SID_ERR;
2085 }
2086 break;
2087
2088 default:
2089 VTD_DPRINTF(GENERAL, "Invalid SVT bits (0x%x) in IRTE index "
bc38ee10 2090 "%d", entry->irte.sid_vtype, index);
ede9c94a
PX		 2091 /* Take this as verification failure. */
2092 return -VTD_FR_IR_SID_ERR;
2093 break;
2094 }
2095 }
651e4cef
PX		 2096
2097 return 0;
2098}
2099
2100/* Fetch IRQ information of specific IR index */
ede9c94a
PX		 2101static int vtd_remap_irq_get(IntelIOMMUState *iommu, uint16_t index,
2102 VTDIrq *irq, uint16_t sid)
651e4cef 2103{
bc38ee10 2104 VTD_IR_TableEntry irte = {};
651e4cef
PX		 2105 int ret = 0;
2106
ede9c94a 2107 ret = vtd_irte_get(iommu, index, &irte, sid);
651e4cef
PX		 2108 if (ret) {
2109 return ret;
2110 }
2111
bc38ee10
MT		 2112 irq->trigger_mode = irte.irte.trigger_mode;
2113 irq->vector = irte.irte.vector;
2114 irq->delivery_mode = irte.irte.delivery_mode;
2115 irq->dest = le32_to_cpu(irte.irte.dest_id);
28589311 2116 if (!iommu->intr_eime) {
651e4cef
PX		 2117#define VTD_IR_APIC_DEST_MASK (0xff00ULL)
2118#define VTD_IR_APIC_DEST_SHIFT (8)
28589311
JK		 2119 irq->dest = (irq->dest & VTD_IR_APIC_DEST_MASK) >>
2120 VTD_IR_APIC_DEST_SHIFT;
2121 }
bc38ee10
MT		 2122 irq->dest_mode = irte.irte.dest_mode;
2123 irq->redir_hint = irte.irte.redir_hint;
651e4cef
PX		 2124
2125 VTD_DPRINTF(IR, "remapping interrupt index %d: trig:%u,vec:%u,"
2126 "deliver:%u,dest:%u,dest_mode:%u", index,
2127 irq->trigger_mode, irq->vector, irq->delivery_mode,
2128 irq->dest, irq->dest_mode);
2129
2130 return 0;
2131}
2132
2133/* Generate one MSI message from VTDIrq info */
2134static void vtd_generate_msi_message(VTDIrq *irq, MSIMessage *msg_out)
2135{
2136 VTD_MSIMessage msg = {};
2137
2138 /* Generate address bits */
2139 msg.dest_mode = irq->dest_mode;
2140 msg.redir_hint = irq->redir_hint;
2141 msg.dest = irq->dest;
32946019 2142 msg.__addr_hi = irq->dest & 0xffffff00;
651e4cef
PX		 2143 msg.__addr_head = cpu_to_le32(0xfee);
2144 /* Keep this from original MSI address bits */
2145 msg.__not_used = irq->msi_addr_last_bits;
2146
2147 /* Generate data bits */
2148 msg.vector = irq->vector;
2149 msg.delivery_mode = irq->delivery_mode;
2150 msg.level = 1;
2151 msg.trigger_mode = irq->trigger_mode;
2152
2153 msg_out->address = msg.msi_addr;
2154 msg_out->data = msg.msi_data;
2155}
2156
2157/* Interrupt remapping for MSI/MSI-X entry */
2158static int vtd_interrupt_remap_msi(IntelIOMMUState *iommu,
2159 MSIMessage *origin,
ede9c94a
PX		 2160 MSIMessage *translated,
2161 uint16_t sid)
651e4cef
PX		 2162{
2163 int ret = 0;
2164 VTD_IR_MSIAddress addr;
2165 uint16_t index;
09cd058a 2166 VTDIrq irq = {};
651e4cef
PX		 2167
2168 assert(origin && translated);
2169
2170 if (!iommu || !iommu->intr_enabled) {
2171 goto do_not_translate;
2172 }
2173
2174 if (origin->address & VTD_MSI_ADDR_HI_MASK) {
2175 VTD_DPRINTF(GENERAL, "error: MSI addr high 32 bits nonzero"
2176 " during interrupt remapping: 0x%"PRIx32,
2177 (uint32_t)((origin->address & VTD_MSI_ADDR_HI_MASK) >> \
2178 VTD_MSI_ADDR_HI_SHIFT));
2179 return -VTD_FR_IR_REQ_RSVD;
2180 }
2181
2182 addr.data = origin->address & VTD_MSI_ADDR_LO_MASK;
bc38ee10 2183 if (le16_to_cpu(addr.addr.__head) != 0xfee) {
651e4cef
PX		 2184 VTD_DPRINTF(GENERAL, "error: MSI addr low 32 bits invalid: "
2185 "0x%"PRIx32, addr.data);
2186 return -VTD_FR_IR_REQ_RSVD;
2187 }
2188
2189 /* This is compatible mode. */
bc38ee10 2190 if (addr.addr.int_mode != VTD_IR_INT_FORMAT_REMAP) {
651e4cef
PX		 2191 goto do_not_translate;
2192 }
2193
bc38ee10 2194 index = addr.addr.index_h << 15 | le16_to_cpu(addr.addr.index_l);
651e4cef
PX		 2195
2196#define VTD_IR_MSI_DATA_SUBHANDLE (0x0000ffff)
2197#define VTD_IR_MSI_DATA_RESERVED (0xffff0000)
2198
bc38ee10 2199 if (addr.addr.sub_valid) {
651e4cef
PX		 2200 /* See VT-d spec 5.1.2.2 and 5.1.3 on subhandle */
2201 index += origin->data & VTD_IR_MSI_DATA_SUBHANDLE;
2202 }
2203
ede9c94a 2204 ret = vtd_remap_irq_get(iommu, index, &irq, sid);
651e4cef
PX		 2205 if (ret) {
2206 return ret;
2207 }
2208
bc38ee10 2209 if (addr.addr.sub_valid) {
651e4cef
PX		 2210 VTD_DPRINTF(IR, "received MSI interrupt");
2211 if (origin->data & VTD_IR_MSI_DATA_RESERVED) {
2212 VTD_DPRINTF(GENERAL, "error: MSI data bits non-zero for "
2213 "interrupt remappable entry: 0x%"PRIx32,
2214 origin->data);
2215 return -VTD_FR_IR_REQ_RSVD;
2216 }
2217 } else {
2218 uint8_t vector = origin->data & 0xff;
dea651a9
FW		 2219 uint8_t trigger_mode = (origin->data >> MSI_DATA_TRIGGER_SHIFT) & 0x1;
2220
651e4cef
PX		 2221 VTD_DPRINTF(IR, "received IOAPIC interrupt");
2222 /* IOAPIC entry vector should be aligned with IRTE vector
2223 * (see vt-d spec 5.1.5.1). */
2224 if (vector != irq.vector) {
2225 VTD_DPRINTF(GENERAL, "IOAPIC vector inconsistent: "
2226 "entry: %d, IRTE: %d, index: %d",
2227 vector, irq.vector, index);
2228 }
dea651a9
FW		 2229
2230 /* The Trigger Mode field must match the Trigger Mode in the IRTE.
2231 * (see vt-d spec 5.1.5.1). */
2232 if (trigger_mode != irq.trigger_mode) {
2233 VTD_DPRINTF(GENERAL, "IOAPIC trigger mode inconsistent: "
2234 "entry: %u, IRTE: %u, index: %d",
2235 trigger_mode, irq.trigger_mode, index);
2236 }
2237
651e4cef
PX		 2238 }
2239
2240 /*
2241 * We'd better keep the last two bits, assuming that guest OS
2242 * might modify it. Keep it does not hurt after all.
2243 */
bc38ee10 2244 irq.msi_addr_last_bits = addr.addr.__not_care;
651e4cef
PX		 2245
2246 /* Translate VTDIrq to MSI message */
2247 vtd_generate_msi_message(&irq, translated);
2248
2249 VTD_DPRINTF(IR, "mapping MSI 0x%"PRIx64":0x%"PRIx32 " -> "
2250 "0x%"PRIx64":0x%"PRIx32, origin->address, origin->data,
2251 translated->address, translated->data);
2252 return 0;
2253
2254do_not_translate:
2255 memcpy(translated, origin, sizeof(*origin));
2256 return 0;
2257}
2258
8b5ed7df
PX		 2259static int vtd_int_remap(X86IOMMUState *iommu, MSIMessage *src,
2260 MSIMessage *dst, uint16_t sid)
2261{
ede9c94a
PX		 2262 return vtd_interrupt_remap_msi(INTEL_IOMMU_DEVICE(iommu),
2263 src, dst, sid);
8b5ed7df
PX		 2264}
2265
651e4cef
PX		 2266static MemTxResult vtd_mem_ir_read(void *opaque, hwaddr addr,
2267 uint64_t *data, unsigned size,
2268 MemTxAttrs attrs)
2269{
2270 return MEMTX_OK;
2271}
2272
2273static MemTxResult vtd_mem_ir_write(void *opaque, hwaddr addr,
2274 uint64_t value, unsigned size,
2275 MemTxAttrs attrs)
2276{
2277 int ret = 0;
09cd058a 2278 MSIMessage from = {}, to = {};
ede9c94a 2279 uint16_t sid = X86_IOMMU_SID_INVALID;
651e4cef
PX		 2280
2281 from.address = (uint64_t) addr + VTD_INTERRUPT_ADDR_FIRST;
2282 from.data = (uint32_t) value;
2283
ede9c94a
PX		 2284 if (!attrs.unspecified) {
2285 /* We have explicit Source ID */
2286 sid = attrs.requester_id;
2287 }
2288
2289 ret = vtd_interrupt_remap_msi(opaque, &from, &to, sid);
651e4cef
PX		 2290 if (ret) {
2291 /* TODO: report error */
2292 VTD_DPRINTF(GENERAL, "int remap fail for addr 0x%"PRIx64
2293 " data 0x%"PRIx32, from.address, from.data);
2294 /* Drop this interrupt */
2295 return MEMTX_ERROR;
2296 }
2297
2298 VTD_DPRINTF(IR, "delivering MSI 0x%"PRIx64":0x%"PRIx32
2299 " for device sid 0x%04x",
2300 to.address, to.data, sid);
2301
32946019 2302 apic_get_class()->send_msi(&to);
651e4cef
PX		 2303
2304 return MEMTX_OK;
2305}
2306
2307static const MemoryRegionOps vtd_mem_ir_ops = {
2308 .read_with_attrs = vtd_mem_ir_read,
2309 .write_with_attrs = vtd_mem_ir_write,
2310 .endianness = DEVICE_LITTLE_ENDIAN,
2311 .impl = {
2312 .min_access_size = 4,
2313 .max_access_size = 4,
2314 },
2315 .valid = {
2316 .min_access_size = 4,
2317 .max_access_size = 4,
2318 },
2319};
7df953bd
KO		 2320
2321VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus, int devfn)
2322{
2323 uintptr_t key = (uintptr_t)bus;
2324 VTDBus *vtd_bus = g_hash_table_lookup(s->vtd_as_by_busptr, &key);
2325 VTDAddressSpace *vtd_dev_as;
2326
2327 if (!vtd_bus) {
2328 /* No corresponding free() */
04af0e18
PX		 2329 vtd_bus = g_malloc0(sizeof(VTDBus) + sizeof(VTDAddressSpace *) * \
2330 X86_IOMMU_PCI_DEVFN_MAX);
7df953bd
KO		 2331 vtd_bus->bus = bus;
2332 key = (uintptr_t)bus;
2333 g_hash_table_insert(s->vtd_as_by_busptr, &key, vtd_bus);
2334 }
2335
2336 vtd_dev_as = vtd_bus->dev_as[devfn];
2337
2338 if (!vtd_dev_as) {
2339 vtd_bus->dev_as[devfn] = vtd_dev_as = g_malloc0(sizeof(VTDAddressSpace));
2340
2341 vtd_dev_as->bus = bus;
2342 vtd_dev_as->devfn = (uint8_t)devfn;
2343 vtd_dev_as->iommu_state = s;
2344 vtd_dev_as->context_cache_entry.context_cache_gen = 0;
2345 memory_region_init_iommu(&vtd_dev_as->iommu, OBJECT(s),
2346 &s->iommu_ops, "intel_iommu", UINT64_MAX);
651e4cef
PX		 2347 memory_region_init_io(&vtd_dev_as->iommu_ir, OBJECT(s),
2348 &vtd_mem_ir_ops, s, "intel_iommu_ir",
2349 VTD_INTERRUPT_ADDR_SIZE);
2350 memory_region_add_subregion(&vtd_dev_as->iommu, VTD_INTERRUPT_ADDR_FIRST,
2351 &vtd_dev_as->iommu_ir);
7df953bd
KO		 2352 address_space_init(&vtd_dev_as->as,
2353 &vtd_dev_as->iommu, "intel_iommu");
2354 }
2355 return vtd_dev_as;
2356}
2357
1da12ec4
LT		 2358/* Do the initialization. It will also be called when reset, so pay
2359 * attention when adding new initialization stuff.
2360 */
2361static void vtd_init(IntelIOMMUState *s)
2362{
d54bd7f8
PX		 2363 X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
2364
1da12ec4
LT		 2365 memset(s->csr, 0, DMAR_REG_SIZE);
2366 memset(s->wmask, 0, DMAR_REG_SIZE);
2367 memset(s->w1cmask, 0, DMAR_REG_SIZE);
2368 memset(s->womask, 0, DMAR_REG_SIZE);
2369
2370 s->iommu_ops.translate = vtd_iommu_translate;
5bf3d319 2371 s->iommu_ops.notify_flag_changed = vtd_iommu_notify_flag_changed;
1da12ec4
LT		 2372 s->root = 0;
2373 s->root_extended = false;
2374 s->dmar_enabled = false;
2375 s->iq_head = 0;
2376 s->iq_tail = 0;
2377 s->iq = 0;
2378 s->iq_size = 0;
2379 s->qi_enabled = false;
2380 s->iq_last_desc_type = VTD_INV_DESC_NONE;
2381 s->next_frcd_reg = 0;
2382 s->cap = VTD_CAP_FRO | VTD_CAP_NFR | VTD_CAP_ND | VTD_CAP_MGAW |
d66b969b 2383 VTD_CAP_SAGAW | VTD_CAP_MAMV | VTD_CAP_PSI | VTD_CAP_SLLPS;
ed7b8fbc 2384 s->ecap = VTD_ECAP_QI | VTD_ECAP_IRO;
1da12ec4 2385
d54bd7f8 2386 if (x86_iommu->intr_supported) {
e6b6af05
RK		 2387 s->ecap |= VTD_ECAP_IR | VTD_ECAP_MHMV;
2388 if (s->intr_eim == ON_OFF_AUTO_ON) {
2389 s->ecap |= VTD_ECAP_EIM;
2390 }
2391 assert(s->intr_eim != ON_OFF_AUTO_AUTO);
d54bd7f8
PX		 2392 }
2393
d92fa2dc 2394 vtd_reset_context_cache(s);
b5a280c0 2395 vtd_reset_iotlb(s);
d92fa2dc 2396
1da12ec4
LT		 2397 /* Define registers with default values and bit semantics */
2398 vtd_define_long(s, DMAR_VER_REG, 0x10UL, 0, 0);
2399 vtd_define_quad(s, DMAR_CAP_REG, s->cap, 0, 0);
2400 vtd_define_quad(s, DMAR_ECAP_REG, s->ecap, 0, 0);
2401 vtd_define_long(s, DMAR_GCMD_REG, 0, 0xff800000UL, 0);
2402 vtd_define_long_wo(s, DMAR_GCMD_REG, 0xff800000UL);
2403 vtd_define_long(s, DMAR_GSTS_REG, 0, 0, 0);
2404 vtd_define_quad(s, DMAR_RTADDR_REG, 0, 0xfffffffffffff000ULL, 0);
2405 vtd_define_quad(s, DMAR_CCMD_REG, 0, 0xe0000003ffffffffULL, 0);
2406 vtd_define_quad_wo(s, DMAR_CCMD_REG, 0x3ffff0000ULL);
2407
2408 /* Advanced Fault Logging not supported */
2409 vtd_define_long(s, DMAR_FSTS_REG, 0, 0, 0x11UL);
2410 vtd_define_long(s, DMAR_FECTL_REG, 0x80000000UL, 0x80000000UL, 0);
2411 vtd_define_long(s, DMAR_FEDATA_REG, 0, 0x0000ffffUL, 0);
2412 vtd_define_long(s, DMAR_FEADDR_REG, 0, 0xfffffffcUL, 0);
2413
2414 /* Treated as RsvdZ when EIM in ECAP_REG is not supported
2415 * vtd_define_long(s, DMAR_FEUADDR_REG, 0, 0xffffffffUL, 0);
2416 */
2417 vtd_define_long(s, DMAR_FEUADDR_REG, 0, 0, 0);
2418
2419 /* Treated as RO for implementations that PLMR and PHMR fields reported
2420 * as Clear in the CAP_REG.
2421 * vtd_define_long(s, DMAR_PMEN_REG, 0, 0x80000000UL, 0);
2422 */
2423 vtd_define_long(s, DMAR_PMEN_REG, 0, 0, 0);
2424
ed7b8fbc
LT		 2425 vtd_define_quad(s, DMAR_IQH_REG, 0, 0, 0);
2426 vtd_define_quad(s, DMAR_IQT_REG, 0, 0x7fff0ULL, 0);
2427 vtd_define_quad(s, DMAR_IQA_REG, 0, 0xfffffffffffff007ULL, 0);
2428 vtd_define_long(s, DMAR_ICS_REG, 0, 0, 0x1UL);
2429 vtd_define_long(s, DMAR_IECTL_REG, 0x80000000UL, 0x80000000UL, 0);
2430 vtd_define_long(s, DMAR_IEDATA_REG, 0, 0xffffffffUL, 0);
2431 vtd_define_long(s, DMAR_IEADDR_REG, 0, 0xfffffffcUL, 0);
2432 /* Treadted as RsvdZ when EIM in ECAP_REG is not supported */
2433 vtd_define_long(s, DMAR_IEUADDR_REG, 0, 0, 0);
2434
1da12ec4
LT		 2435 /* IOTLB registers */
2436 vtd_define_quad(s, DMAR_IOTLB_REG, 0, 0Xb003ffff00000000ULL, 0);
2437 vtd_define_quad(s, DMAR_IVA_REG, 0, 0xfffffffffffff07fULL, 0);
2438 vtd_define_quad_wo(s, DMAR_IVA_REG, 0xfffffffffffff07fULL);
2439
2440 /* Fault Recording Registers, 128-bit */
2441 vtd_define_quad(s, DMAR_FRCD_REG_0_0, 0, 0, 0);
2442 vtd_define_quad(s, DMAR_FRCD_REG_0_2, 0, 0, 0x8000000000000000ULL);
a5861439
PX		 2443
2444 /*
28589311 2445 * Interrupt remapping registers.
a5861439 2446 */
28589311 2447 vtd_define_quad(s, DMAR_IRTA_REG, 0, 0xfffffffffffff80fULL, 0);
1da12ec4
LT		 2448}
2449
2450/* Should not reset address_spaces when reset because devices will still use
2451 * the address space they got at first (won't ask the bus again).
2452 */
2453static void vtd_reset(DeviceState *dev)
2454{
2455 IntelIOMMUState *s = INTEL_IOMMU_DEVICE(dev);
2456
2457 VTD_DPRINTF(GENERAL, "");
2458 vtd_init(s);
2459}
2460
621d983a
MA		 2461static AddressSpace *vtd_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
2462{
2463 IntelIOMMUState *s = opaque;
2464 VTDAddressSpace *vtd_as;
2465
04af0e18 2466 assert(0 <= devfn && devfn <= X86_IOMMU_PCI_DEVFN_MAX);
621d983a
MA		 2467
2468 vtd_as = vtd_find_add_as(s, bus, devfn);
2469 return &vtd_as->as;
2470}
2471
e6b6af05 2472static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)
6333e93c 2473{
e6b6af05
RK		 2474 X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(s);
2475
6333e93c
RK		 2476 /* Currently Intel IOMMU IR only support "kernel-irqchip={off|split}" */
2477 if (x86_iommu->intr_supported && kvm_irqchip_in_kernel() &&
2478 !kvm_irqchip_is_split()) {
2479 error_setg(errp, "Intel Interrupt Remapping cannot work with "
2480 "kernel-irqchip=on, please use 'split|off'.");
2481 return false;
2482 }
e6b6af05
RK		 2483 if (s->intr_eim == ON_OFF_AUTO_ON && !x86_iommu->intr_supported) {
2484 error_setg(errp, "eim=on cannot be selected without intremap=on");
2485 return false;
2486 }
2487
2488 if (s->intr_eim == ON_OFF_AUTO_AUTO) {
fb506e70
RK		 2489 s->intr_eim = (kvm_irqchip_in_kernel() || s->buggy_eim)
2490 && x86_iommu->intr_supported ?
e6b6af05
RK		 2491 ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
2492 }
fb506e70
RK		 2493 if (s->intr_eim == ON_OFF_AUTO_ON && !s->buggy_eim) {
2494 if (!kvm_irqchip_in_kernel()) {
2495 error_setg(errp, "eim=on requires accel=kvm,kernel-irqchip=split");
2496 return false;
2497 }
2498 if (!kvm_enable_x2apic()) {
2499 error_setg(errp, "eim=on requires support on the KVM side"
2500 "(X2APIC_API, first shipped in v4.7)");
2501 return false;
2502 }
2503 }
e6b6af05 2504
6333e93c
RK		 2505 return true;
2506}
2507
1da12ec4
LT		 2508static void vtd_realize(DeviceState *dev, Error **errp)
2509{
cb135f59
PX		 2510 PCMachineState *pcms = PC_MACHINE(qdev_get_machine());
2511 PCIBus *bus = pcms->bus;
1da12ec4 2512 IntelIOMMUState *s = INTEL_IOMMU_DEVICE(dev);
4684a204 2513 X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(dev);
1da12ec4
LT		 2514
2515 VTD_DPRINTF(GENERAL, "");
fb9f5926 2516 x86_iommu->type = TYPE_INTEL;
6333e93c 2517
e6b6af05 2518 if (!vtd_decide_config(s, errp)) {
6333e93c
RK		 2519 return;
2520 }
2521
7df953bd 2522 memset(s->vtd_as_by_bus_num, 0, sizeof(s->vtd_as_by_bus_num));
1da12ec4
LT		 2523 memory_region_init_io(&s->csrmem, OBJECT(s), &vtd_mem_ops, s,
2524 "intel_iommu", DMAR_REG_SIZE);
2525 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->csrmem);
b5a280c0
LT		 2526 /* No corresponding destroy */
2527 s->iotlb = g_hash_table_new_full(vtd_uint64_hash, vtd_uint64_equal,
2528 g_free, g_free);
7df953bd
KO		 2529 s->vtd_as_by_busptr = g_hash_table_new_full(vtd_uint64_hash, vtd_uint64_equal,
2530 g_free, g_free);
1da12ec4 2531 vtd_init(s);
621d983a
MA		 2532 sysbus_mmio_map(SYS_BUS_DEVICE(s), 0, Q35_HOST_BRIDGE_IOMMU_ADDR);
2533 pci_setup_iommu(bus, vtd_host_dma_iommu, dev);
cb135f59
PX		 2534 /* Pseudo address space under root PCI bus. */
2535 pcms->ioapic_as = vtd_host_dma_iommu(bus, s, Q35_PSEUDO_DEVFN_IOAPIC);
1da12ec4
LT		 2536}
2537
2538static void vtd_class_init(ObjectClass *klass, void *data)
2539{
2540 DeviceClass *dc = DEVICE_CLASS(klass);
1c7955c4 2541 X86IOMMUClass *x86_class = X86_IOMMU_CLASS(klass);
1da12ec4
LT		 2542
2543 dc->reset = vtd_reset;
1da12ec4
LT		 2544 dc->vmsd = &vtd_vmstate;
2545 dc->props = vtd_properties;
621d983a 2546 dc->hotpluggable = false;
1c7955c4 2547 x86_class->realize = vtd_realize;
8b5ed7df 2548 x86_class->int_remap = vtd_int_remap;
1da12ec4
LT		 2549}
2550
2551static const TypeInfo vtd_info = {
2552 .name = TYPE_INTEL_IOMMU_DEVICE,
1c7955c4 2553 .parent = TYPE_X86_IOMMU_DEVICE,
1da12ec4
LT		 2554 .instance_size = sizeof(IntelIOMMUState),
2555 .class_init = vtd_class_init,
2556};
2557
2558static void vtd_register_types(void)
2559{
2560 VTD_DPRINTF(GENERAL, "");
2561 type_register_static(&vtd_info);
2562}
2563
2564type_init(vtd_register_types)
QEMU mirror