target-arm queue: Eric's SMMUv3 patchset, and an array

of minor bugfixes and improvements from various others.

thanks

-- PMM

The following changes since commit c8b7e627b4269a3bc3ae41d9f420547a47e6d9b9:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-05-04' into staging (2018-05-04 14:42:46 +0100)

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180504

for you to fetch changes up to 5680740c92993e9b3f3e011f2a2c394070e33f56:

hw/arm/virt: Introduce the iommu option (2018-05-04 18:05:52 +0100)

* Emulate the SMMUv3 (IOMMU); one will be created in the 'virt' board

if the commandline includes "-machine iommu=smmuv3"

* target/arm: Implement v8M VLLDM and VLSTM

* hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode

* Some fixes to silence Coverity false-positives

* arm: boot: set boot_info starting from first_cpu

(fixes a technical bug not visible in practice)

* hw/net/smc91c111: Convert away from old_mmio

* hw/usb/tusb6010: Convert away from old_mmio

* hw/char/cmsdk-apb-uart.c: Accept more input after character read

* target/arm: Make MPUIR write-ignored on OMAP, StrongARM

* hw/arm/virt: Add linux,pci-domain property

Eric Auger (11):

hw/arm/smmu-common: smmu base device and datatypes

hw/arm/smmu-common: IOMMU memory region and address space setup

hw/arm/smmu-common: VMSAv8-64 page table walk

hw/arm/smmuv3: Wired IRQ and GERROR helpers

hw/arm/smmuv3: Queue helpers

hw/arm/smmuv3: Implement MMIO write operations

hw/arm/smmuv3: Event queue recording helper

hw/arm/smmuv3: Implement translate callback

hw/arm/smmuv3: Abort on vfio or vhost case

target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route

hw/arm/virt: Introduce the iommu option

Igor Mammedov (1):

arm: boot: set boot_info starting from first_cpu

Jan Kiszka (1):

hw/arm/virt: Add linux,pci-domain property

Mathew Maidment (1):

target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case

Patrick Oppenlander (1):

hw/char/cmsdk-apb-uart.c: Accept more input after character read

hw/usb/tusb6010: Convert away from old_mmio

hw/net/smc91c111: Convert away from old_mmio

target/arm: Implement v8M VLLDM and VLSTM

Prem Mallappa (3):

hw/arm/smmuv3: Skeleton

hw/arm/virt: Add SMMUv3 to the virt board

hw/arm/virt-acpi-build: Add smmuv3 node in IORT table

Richard Henderson (2):

target/arm: Tidy conditions in handle_vec_simd_shri

target/arm: Tidy condition in disas_simd_two_reg_misc

Thomas Huth (1):

hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode

From: Mathew Maidment <mathew1800@gmail.com>

The duplication of id_tlbtr_reginfo was unintentionally added within

3281af8114c6b8ead02f08b58e3c36895c1ea047 which should have been

id_mpuir_reginfo.

The effect was that for OMAP and StrongARM CPUs we would

incorrectly UNDEF writes to MPUIR rather than NOPing them.

Signed-off-by: Mathew Maidment <mathew1800@gmail.com>

Message-id: 20180501184933.37609-2-mathew1800@gmail.com

[PMM: tweak commit message]

target/arm/helper.c | 2 +-

diff --git a/target/arm/helper.c b/target/arm/helper.c

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {

r->access = PL1_RW;

}

- id_tlbtr_reginfo.access = PL1_RW;

+ id_mpuir_reginfo.access = PL1_RW;

id_tlbtr_reginfo.access = PL1_RW;

}

if (arm_feature(env, ARM_FEATURE_V8)) {

For v8M the instructions VLLDM and VLSTM support lazy saving

and restoring of the secure floating-point registers. Even

if the floating point extension is not implemented, these

instructions must act as NOPs in Secure state, so they can

be used as part of the secure-to-nonsecure call sequence.

Fixes: https://bugs.launchpad.net/qemu/+bug/1768295

Message-id: 20180503105730.5958-1-peter.maydell@linaro.org

target/arm/translate.c | 17 ++++++++++++++++-

1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c

--- a/target/arm/translate.c

+++ b/target/arm/translate.c

@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)

/* Coprocessor. */

if (arm_dc_feature(s, ARM_FEATURE_M)) {

/* We don't currently implement M profile FP support,

- * so this entire space should give a NOCP fault.

+ * so this entire space should give a NOCP fault, with

+ * the exception of the v8M VLLDM and VLSTM insns, which

+ * must be NOPs in Secure state and UNDEF in Nonsecure state.

*/

+ if (arm_dc_feature(s, ARM_FEATURE_V8) &&

+ (insn & 0xffa00f00) == 0xec200a00) {

+ /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx

+ * - VLLDM, VLSTM

+ * We choose to UNDEF if the RAZ bits are non-zero.

+ */

+ if (!s->v8m_secure || (insn & 0x0040f0ff)) {

+ goto illegal_op;

+ }

+ /* Just NOP since FP support is not implemented */

+ break;

+ }

+ /* All other insns: NOCP */

gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),

default_exception_el(s));

break;

From: Prem Mallappa <prem.mallappa@broadcom.com>

This patch builds the smmuv3 node in the ACPI IORT table.

The RID space of the root complex, which spans 0x0-0x10000

maps to streamid space 0x0-0x10000 in smmuv3, which in turn

maps to deviceid space 0x0-0x10000 in the ITS group.

The guest must feature the IOMMU probe deferral series

(https://lkml.org/lkml/2017/4/10/214) which fixes streamid

multiple lookup. This bug is not related to the SMMU emulation.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>

Message-id: 1524665762-31355-14-git-send-email-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/acpi/acpi-defs.h | 15 ++++++++++

hw/arm/virt-acpi-build.c | 55 ++++++++++++++++++++++++++++++++-----

2 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h

--- a/include/hw/acpi/acpi-defs.h

+++ b/include/hw/acpi/acpi-defs.h

@@ -XXX,XX +XXX,XX @@ struct AcpiIortItsGroup {

} QEMU_PACKED;

typedef struct AcpiIortItsGroup AcpiIortItsGroup;

+struct AcpiIortSmmu3 {

+ ACPI_IORT_NODE_HEADER_DEF

+ uint64_t base_address;

+ uint32_t flags;

+ uint32_t reserved2;

+ uint64_t vatos_address;

+ uint32_t model;

+ uint32_t event_gsiv;

+ uint32_t pri_gsiv;

+ uint32_t gerr_gsiv;

+ uint32_t sync_gsiv;

+ AcpiIortIdMapping id_mapping_array[0];

+} QEMU_PACKED;

+typedef struct AcpiIortSmmu3 AcpiIortSmmu3;

+

struct AcpiIortRC {

ACPI_IORT_NODE_HEADER_DEF

AcpiIortMemoryAccess memory_properties;

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt-acpi-build.c

+++ b/hw/arm/virt-acpi-build.c

@@ -XXX,XX +XXX,XX @@ build_rsdp(GArray *rsdp_table, BIOSLinker *linker, unsigned xsdt_tbl_offset)

}

static void

-build_iort(GArray *table_data, BIOSLinker *linker)

+build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)

{

- int iort_start = table_data->len;

+ int nb_nodes, iort_start = table_data->len;

AcpiIortIdMapping *idmap;

AcpiIortItsGroup *its;

AcpiIortTable *iort;

- size_t node_size, iort_length;

+ AcpiIortSmmu3 *smmu;

+ size_t node_size, iort_length, smmu_offset = 0;

AcpiIortRC *rc;

iort = acpi_data_push(table_data, sizeof(*iort));

+ if (vms->iommu == VIRT_IOMMU_SMMUV3) {

+ nb_nodes = 3; /* RC, ITS, SMMUv3 */

+ } else {

+ nb_nodes = 2; /* RC, ITS */

+ }

+

iort_length = sizeof(*iort);

- iort->node_count = cpu_to_le32(2); /* RC and ITS nodes */

+ iort->node_count = cpu_to_le32(nb_nodes);

iort->node_offset = cpu_to_le32(sizeof(*iort));

/* ITS group node */

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)

its->its_count = cpu_to_le32(1);

its->identifiers[0] = 0; /* MADT translation_id */

+ if (vms->iommu == VIRT_IOMMU_SMMUV3) {

+ int irq = vms->irqmap[VIRT_SMMU];

+

+ /* SMMUv3 node */

+ smmu_offset = iort->node_offset + node_size;

+ node_size = sizeof(*smmu) + sizeof(*idmap);

+ iort_length += node_size;

+ smmu = acpi_data_push(table_data, node_size);

+

+ smmu->type = ACPI_IORT_NODE_SMMU_V3;

+ smmu->length = cpu_to_le16(node_size);

+ smmu->mapping_count = cpu_to_le32(1);

+ smmu->mapping_offset = cpu_to_le32(sizeof(*smmu));

+ smmu->base_address = cpu_to_le64(vms->memmap[VIRT_SMMU].base);

+ smmu->event_gsiv = cpu_to_le32(irq);

+ smmu->pri_gsiv = cpu_to_le32(irq + 1);

+ smmu->gerr_gsiv = cpu_to_le32(irq + 2);

+ smmu->sync_gsiv = cpu_to_le32(irq + 3);

+

+ /* Identity RID mapping covering the whole input RID range */

+ idmap = &smmu->id_mapping_array[0];

+ idmap->input_base = 0;

+ idmap->id_count = cpu_to_le32(0xFFFF);

+ idmap->output_base = 0;

+ /* output IORT node is the ITS group node (the first node) */

+ idmap->output_reference = cpu_to_le32(iort->node_offset);

+ }

+

/* Root Complex Node */

node_size = sizeof(*rc) + sizeof(*idmap);

iort_length += node_size;

@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)

idmap->input_base = 0;

idmap->id_count = cpu_to_le32(0xFFFF);

idmap->output_base = 0;

- /* output IORT node is the ITS group node (the first node) */

- idmap->output_reference = cpu_to_le32(iort->node_offset);

+

+ if (vms->iommu == VIRT_IOMMU_SMMUV3) {

+ /* output IORT node is the smmuv3 node */

+ idmap->output_reference = cpu_to_le32(smmu_offset);

+ } else {

+ /* output IORT node is the ITS group node (the first node) */

+ idmap->output_reference = cpu_to_le32(iort->node_offset);

+ }

iort->length = cpu_to_le32(iort_length);

@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)

if (its_class_name() && !vmc->no_its) {

acpi_add_table(table_offsets, tables_blob);

- build_iort(tables_blob, tables->linker);

+ build_iort(tables_blob, tables->linker, vms);

}

/* XSDT is pointed to by RSDP */

From: Eric Auger <eric.auger@redhat.com>

This patch implements the IOMMU Memory Region translate()

callback. Most of the code relates to the translation

configuration decoding and check (STE, CD).

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>

Message-id: 1524665762-31355-10-git-send-email-eric.auger@redhat.com

hw/arm/smmuv3-internal.h | 160 +++++++++++++++++

hw/arm/smmuv3.c | 358 +++++++++++++++++++++++++++++++++++++++

hw/arm/trace-events | 9 +

3 files changed, 527 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h

--- a/hw/arm/smmuv3-internal.h

+++ b/hw/arm/smmuv3-internal.h

@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {

void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);

+/* Configuration Data */

+

+/* STE Level 1 Descriptor */

+typedef struct STEDesc {

+ uint32_t word[2];

+} STEDesc;

+

+/* CD Level 1 Descriptor */

+typedef struct CDDesc {

+ uint32_t word[2];

+} CDDesc;

+

+/* Stream Table Entry(STE) */

+typedef struct STE {

+ uint32_t word[16];

+} STE;

+

+/* Context Descriptor(CD) */

+typedef struct CD {

+ uint32_t word[16];

+} CD;

+

+/* STE fields */

+

+#define STE_VALID(x) extract32((x)->word[0], 0, 1)

+

+#define STE_CONFIG(x) extract32((x)->word[0], 1, 3)

+#define STE_CFG_S1_ENABLED(config) (config & 0x1)

+#define STE_CFG_S2_ENABLED(config) (config & 0x2)

+#define STE_CFG_ABORT(config) (!(config & 0x4))

+#define STE_CFG_BYPASS(config) (config == 0x4)

+

+#define STE_S1FMT(x) extract32((x)->word[0], 4 , 2)

+#define STE_S1CDMAX(x) extract32((x)->word[1], 27, 5)

+#define STE_S1STALLD(x) extract32((x)->word[2], 27, 1)

+#define STE_EATS(x) extract32((x)->word[2], 28, 2)

+#define STE_STRW(x) extract32((x)->word[2], 30, 2)

+#define STE_S2VMID(x) extract32((x)->word[4], 0 , 16)

+#define STE_S2T0SZ(x) extract32((x)->word[5], 0 , 6)

+#define STE_S2SL0(x) extract32((x)->word[5], 6 , 2)

+#define STE_S2TG(x) extract32((x)->word[5], 14, 2)

+#define STE_S2PS(x) extract32((x)->word[5], 16, 3)

+#define STE_S2AA64(x) extract32((x)->word[5], 19, 1)

+#define STE_S2HD(x) extract32((x)->word[5], 24, 1)

+#define STE_S2HA(x) extract32((x)->word[5], 25, 1)

+#define STE_S2S(x) extract32((x)->word[5], 26, 1)

+#define STE_CTXPTR(x) \

+ ({ \

+ unsigned long addr; \

+ addr = (uint64_t)extract32((x)->word[1], 0, 16) << 32; \

+ addr |= (uint64_t)((x)->word[0] & 0xffffffc0); \

+ addr; \

+ })

+

+#define STE_S2TTB(x) \

+ ({ \

+ unsigned long addr; \

+ addr = (uint64_t)extract32((x)->word[7], 0, 16) << 32; \

+ addr |= (uint64_t)((x)->word[6] & 0xfffffff0); \

+ addr; \

+ })

+

+static inline int oas2bits(int oas_field)

+{

+ switch (oas_field) {

+ case 0:

+ return 32;

+ case 1:

+ return 36;

+ case 2:

+ return 40;

+ case 3:

+ return 42;

+ case 4:

+ return 44;

+ case 5:

+ return 48;

+ }

+ return -1;

+}

+

+static inline int pa_range(STE *ste)

+{

+ int oas_field = MIN(STE_S2PS(ste), SMMU_IDR5_OAS);

+

+ if (!STE_S2AA64(ste)) {

+ return 40;

+ }

+

+ return oas2bits(oas_field);

+}

+

+#define MAX_PA(ste) ((1 << pa_range(ste)) - 1)

+

+/* CD fields */

+

+#define CD_VALID(x) extract32((x)->word[0], 30, 1)

+#define CD_ASID(x) extract32((x)->word[1], 16, 16)

+#define CD_TTB(x, sel) \

+ ({ \

+ uint64_t hi, lo; \

+ hi = extract32((x)->word[(sel) * 2 + 3], 0, 19); \

+ hi <<= 32; \

+ lo = (x)->word[(sel) * 2 + 2] & ~0xfULL; \

+ hi | lo; \

+ })

+

+#define CD_TSZ(x, sel) extract32((x)->word[0], (16 * (sel)) + 0, 6)

+#define CD_TG(x, sel) extract32((x)->word[0], (16 * (sel)) + 6, 2)

+#define CD_EPD(x, sel) extract32((x)->word[0], (16 * (sel)) + 14, 1)

+#define CD_ENDI(x) extract32((x)->word[0], 15, 1)

+#define CD_IPS(x) extract32((x)->word[1], 0 , 3)

+#define CD_TBI(x) extract32((x)->word[1], 6 , 2)

+#define CD_HD(x) extract32((x)->word[1], 10 , 1)

+#define CD_HA(x) extract32((x)->word[1], 11 , 1)

+#define CD_S(x) extract32((x)->word[1], 12, 1)

+#define CD_R(x) extract32((x)->word[1], 13, 1)

+#define CD_A(x) extract32((x)->word[1], 14, 1)

+#define CD_AARCH64(x) extract32((x)->word[1], 9 , 1)

+

+#define CDM_VALID(x) ((x)->word[0] & 0x1)

+

+static inline int is_cd_valid(SMMUv3State *s, STE *ste, CD *cd)

+{

+ return CD_VALID(cd);

+}

+

+/**

+ * tg2granule - Decodes the CD translation granule size field according

+ * to the ttbr in use

+ * @bits: TG0/1 fields

+ * @ttbr: ttbr index in use

+ */

+static inline int tg2granule(int bits, int ttbr)

+{

+ switch (bits) {

+ case 0:

+ return ttbr ? 0 : 12;

+ case 1:

+ return ttbr ? 14 : 16;

+ case 2:

+ return ttbr ? 12 : 14;

+ case 3:

+ return ttbr ? 16 : 0;

+ default:

+ return 0;

+ }

+}

+

+static inline uint64_t l1std_l2ptr(STEDesc *desc)

+{

+ uint64_t hi, lo;

+

+ hi = desc->word[1];

+ lo = desc->word[0] & ~0x1fULL;

+ return hi << 32 | lo;

+}

+

+#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 4))

+

#endif

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)

s->sid_split = 0;

}

+static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,

+ SMMUEventInfo *event)

+{

+ int ret;

+

+ trace_smmuv3_get_ste(addr);

+ /* TODO: guarantee 64-bit single-copy atomicity */

+ ret = dma_memory_read(&address_space_memory, addr,

+ (void *)buf, sizeof(*buf));

+ if (ret != MEMTX_OK) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "Cannot fetch pte at address=0x%"PRIx64"\n", addr);

+ event->type = SMMU_EVT_F_STE_FETCH;

+ event->u.f_ste_fetch.addr = addr;

+ return -EINVAL;

+ }

+ return 0;

+

+}

+

+/* @ssid > 0 not supported yet */

+static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,

+ CD *buf, SMMUEventInfo *event)

+{

+ dma_addr_t addr = STE_CTXPTR(ste);

+ int ret;

+

+ trace_smmuv3_get_cd(addr);

+ /* TODO: guarantee 64-bit single-copy atomicity */

+ ret = dma_memory_read(&address_space_memory, addr,

+ (void *)buf, sizeof(*buf));

+ if (ret != MEMTX_OK) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "Cannot fetch pte at address=0x%"PRIx64"\n", addr);

+ event->type = SMMU_EVT_F_CD_FETCH;

+ event->u.f_ste_fetch.addr = addr;

+ return -EINVAL;

+ }

+ return 0;

+}

+

+/* Returns <0 if the caller has no need to continue the translation */

+static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,

+ STE *ste, SMMUEventInfo *event)

+{

+ uint32_t config;

+ int ret = -EINVAL;

+

+ if (!STE_VALID(ste)) {

+ goto bad_ste;

+ }

+

+ config = STE_CONFIG(ste);

+

+ if (STE_CFG_ABORT(config)) {

+ cfg->aborted = true; /* abort but don't record any event */

+ return ret;

+ }

+

+ if (STE_CFG_BYPASS(config)) {

+ cfg->bypassed = true;

+ return ret;

+ }

+

+ if (STE_CFG_S2_ENABLED(config)) {

+ qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");

+ goto bad_ste;

+ }

+

+ if (STE_S1CDMAX(ste) != 0) {

+ qemu_log_mask(LOG_UNIMP,

+ "SMMUv3 does not support multiple context descriptors yet\n");

+ goto bad_ste;

+ }

+

+ if (STE_S1STALLD(ste)) {

+ qemu_log_mask(LOG_UNIMP,

+ "SMMUv3 S1 stalling fault model not allowed yet\n");

+ goto bad_ste;

+ }

+ return 0;

+

+bad_ste:

+ event->type = SMMU_EVT_C_BAD_STE;

+ return -EINVAL;

+}

+

+/**

+ * smmu_find_ste - Return the stream table entry associated

+ * to the sid

+ *

+ * @s: smmuv3 handle

+ * @sid: stream ID

+ * @ste: returned stream table entry

+ * @event: handle to an event info

+ *

+ * Supports linear and 2-level stream table

+ * Return 0 on success, -EINVAL otherwise

+ */

+static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,

+ SMMUEventInfo *event)

+{

+ dma_addr_t addr;

+ int ret;

+

+ trace_smmuv3_find_ste(sid, s->features, s->sid_split);

+ /* Check SID range */

+ if (sid > (1 << SMMU_IDR1_SIDSIZE)) {

+ event->type = SMMU_EVT_C_BAD_STREAMID;

+ return -EINVAL;

+ }

+ if (s->features & SMMU_FEATURE_2LVL_STE) {

+ int l1_ste_offset, l2_ste_offset, max_l2_ste, span;

+ dma_addr_t strtab_base, l1ptr, l2ptr;

+ STEDesc l1std;

+

+ strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;

+ l1_ste_offset = sid >> s->sid_split;

+ l2_ste_offset = sid & ((1 << s->sid_split) - 1);

+ l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));

+ /* TODO: guarantee 64-bit single-copy atomicity */

+ ret = dma_memory_read(&address_space_memory, l1ptr,

+ (uint8_t *)&l1std, sizeof(l1std));

+ if (ret != MEMTX_OK) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);

+ event->type = SMMU_EVT_F_STE_FETCH;

+ event->u.f_ste_fetch.addr = l1ptr;

+ return -EINVAL;

+ }

+

+ span = L1STD_SPAN(&l1std);

+

+ if (!span) {

+ /* l2ptr is not valid */

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "invalid sid=%d (L1STD span=0)\n", sid);

+ event->type = SMMU_EVT_C_BAD_STREAMID;

+ return -EINVAL;

+ }

+ max_l2_ste = (1 << span) - 1;

+ l2ptr = l1std_l2ptr(&l1std);

+ trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,

+ l2ptr, l2_ste_offset, max_l2_ste);

+ if (l2_ste_offset > max_l2_ste) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "l2_ste_offset=%d > max_l2_ste=%d\n",

+ l2_ste_offset, max_l2_ste);

+ event->type = SMMU_EVT_C_BAD_STE;

+ return -EINVAL;

+ }

+ addr = l2ptr + l2_ste_offset * sizeof(*ste);

+ } else {

+ addr = s->strtab_base + sid * sizeof(*ste);

+ }

+

+ if (smmu_get_ste(s, addr, ste, event)) {

+ return -EINVAL;

+ }

+

+ return 0;

+}

+

+static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)

+{

+ int ret = -EINVAL;

+ int i;

+

+ if (!CD_VALID(cd) || !CD_AARCH64(cd)) {

+ goto bad_cd;

+ }

+ if (!CD_A(cd)) {

+ goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */

+ }

+ if (CD_S(cd)) {

+ goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */

+ }

+ if (CD_HA(cd) || CD_HD(cd)) {

+ goto bad_cd; /* HTTU = 0 */

+ }

+

+ /* we support only those at the moment */

+ cfg->aa64 = true;

+ cfg->stage = 1;

+

+ cfg->oas = oas2bits(CD_IPS(cd));

+ cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);

+ cfg->tbi = CD_TBI(cd);

+ cfg->asid = CD_ASID(cd);

+

+ trace_smmuv3_decode_cd(cfg->oas);

+

+ /* decode data dependent on TT */

+ for (i = 0; i <= 1; i++) {

+ int tg, tsz;

+ SMMUTransTableInfo *tt = &cfg->tt[i];

+

+ cfg->tt[i].disabled = CD_EPD(cd, i);

+ if (cfg->tt[i].disabled) {

+ continue;

+ }

+

+ tsz = CD_TSZ(cd, i);

+ if (tsz < 16 || tsz > 39) {

+ goto bad_cd;

+ }

+

+ tg = CD_TG(cd, i);

+ tt->granule_sz = tg2granule(tg, i);

+ if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {

+ goto bad_cd;

+ }

+

+ tt->tsz = tsz;

+ tt->ttb = CD_TTB(cd, i);

+ if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {

+ goto bad_cd;

+ }

+ trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz);

+ }

+

+ event->record_trans_faults = CD_R(cd);

+

+ return 0;

+

+bad_cd:

+ event->type = SMMU_EVT_C_BAD_CD;

+ return ret;

+}

+

+/**

+ * smmuv3_decode_config - Prepare the translation configuration

+ * for the @mr iommu region

+ * @mr: iommu memory region the translation config must be prepared for

+ * @cfg: output translation configuration which is populated through

+ * the different configuration decoding steps

+ * @event: must be zero'ed by the caller

+ *

+ * return < 0 if the translation needs to be aborted (@event is filled

+ * accordingly). Return 0 otherwise.

+ */

+static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,

+ SMMUEventInfo *event)

+{

+ SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);

+ uint32_t sid = smmu_get_sid(sdev);

+ SMMUv3State *s = sdev->smmu;

+ int ret = -EINVAL;

+ STE ste;

+ CD cd;

+

+ if (smmu_find_ste(s, sid, &ste, event)) {

+ return ret;

+ }

+

+ if (decode_ste(s, cfg, &ste, event)) {

+ return ret;

+ }

+

+ if (smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event)) {

+ return ret;

+ }

+

+ return decode_cd(cfg, &cd, event);

+}

+

+static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,

+ IOMMUAccessFlags flag)

+{

+ SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);

+ SMMUv3State *s = sdev->smmu;

+ uint32_t sid = smmu_get_sid(sdev);

+ SMMUEventInfo event = {.type = SMMU_EVT_OK, .sid = sid};

+ SMMUPTWEventInfo ptw_info = {};

+ SMMUTransCfg cfg = {};

+ IOMMUTLBEntry entry = {

+ .target_as = &address_space_memory,

+ .iova = addr,

+ .translated_addr = addr,

+ .addr_mask = ~(hwaddr)0,

+ .perm = IOMMU_NONE,

+ };

+ int ret = 0;

+

+ if (!smmu_enabled(s)) {

+ goto out;

+ }

+

+ ret = smmuv3_decode_config(mr, &cfg, &event);

+ if (ret) {

+ goto out;

+ }

+

+ if (cfg.aborted) {

+ goto out;

+ }

+

+ ret = smmu_ptw(&cfg, addr, flag, &entry, &ptw_info);

+ if (ret) {

+ switch (ptw_info.type) {

+ case SMMU_PTW_ERR_WALK_EABT:

+ event.type = SMMU_EVT_F_WALK_EABT;

+ event.u.f_walk_eabt.addr = addr;

+ event.u.f_walk_eabt.rnw = flag & 0x1;

+ event.u.f_walk_eabt.class = 0x1;

+ event.u.f_walk_eabt.addr2 = ptw_info.addr;

+ break;

+ case SMMU_PTW_ERR_TRANSLATION:

+ if (event.record_trans_faults) {

+ event.type = SMMU_EVT_F_TRANSLATION;

+ event.u.f_translation.addr = addr;

+ event.u.f_translation.rnw = flag & 0x1;

+ }

+ break;

+ case SMMU_PTW_ERR_ADDR_SIZE:

+ if (event.record_trans_faults) {

+ event.type = SMMU_EVT_F_ADDR_SIZE;

+ event.u.f_addr_size.addr = addr;

+ event.u.f_addr_size.rnw = flag & 0x1;

+ }

+ break;

+ case SMMU_PTW_ERR_ACCESS:

+ if (event.record_trans_faults) {

+ event.type = SMMU_EVT_F_ACCESS;

+ event.u.f_access.addr = addr;

+ event.u.f_access.rnw = flag & 0x1;

+ }

+ break;

+ case SMMU_PTW_ERR_PERMISSION:

+ if (event.record_trans_faults) {

+ event.type = SMMU_EVT_F_PERMISSION;

+ event.u.f_permission.addr = addr;

+ event.u.f_permission.rnw = flag & 0x1;

+ }

+ }

+ }

+out:

+ if (ret) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "%s translation failed for iova=0x%"PRIx64"(%d)\n",

+ mr->parent_obj.name, addr, ret);

+ entry.perm = IOMMU_NONE;

+ smmuv3_record_event(s, &event);

+ } else if (!cfg.aborted) {

+ entry.perm = flag;

+ trace_smmuv3_translate(mr->parent_obj.name, sid, addr,

+ entry.translated_addr, entry.perm);

+ }

+

+ return entry;

+}

+

static int smmuv3_cmdq_consume(SMMUv3State *s)

{

SMMUCmdError cmd_error = SMMU_CERROR_NONE;

@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)

static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,

void *data)

{

+ IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);

+

+ imrc->translate = smmuv3_translate;

static const TypeInfo smmuv3_type_info = {

diff --git a/hw/arm/trace-events b/hw/arm/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/trace-events

+++ b/hw/arm/trace-events

@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx

smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"

smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"

smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"

+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"

+smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%lx l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"

+smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64

+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass iova:0x%"PRIx64" is_write=%d"

+smmuv3_translate_in(uint16_t sid, int pci_bus_num, uint64_t strtab_base) "SID:0x%x bus:%d strtab_base:0x%"PRIx64

+smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64

+smmuv3_translate(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"

+smmuv3_decode_cd(uint32_t oas) "oas=%d"

+smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d"

Path analysis shows that size == 3 && !is_q has been eliminated.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20180501180455.11214-3-richard.henderson@linaro.org

target/arm/translate-a64.c | 6 +++++-

1 file changed, 5 insertions(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)

/* All 64-bit element operations can be shared with scalar 2misc */

int pass;

- for (pass = 0; pass < (is_q ? 2 : 1); pass++) {

+ /* Coverity claims (size == 3 && !is_q) has been eliminated

+ * from all paths leading to here.

+ */

+ tcg_debug_assert(is_q);

+ for (pass = 0; pass < 2; pass++) {

TCGv_i64 tcg_op = tcg_temp_new_i64();

TCGv_i64 tcg_res = tcg_temp_new_i64();

From: Prem Mallappa <prem.mallappa@broadcom.com>

Add code to instantiate an smmuv3 in virt machine. A new iommu

integer member is introduced in VirtMachineState to store the type

of the iommu in use.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 1524665762-31355-13-git-send-email-eric.auger@redhat.com

include/hw/arm/virt.h | 10 +++++++

hw/arm/virt.c | 64 ++++++++++++++++++++++++++++++++++++++++++-

2 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@

#define NUM_GICV2M_SPIS 64

#define NUM_VIRTIO_TRANSPORTS 32

+#define NUM_SMMU_IRQS 4

#define ARCH_GICV3_MAINT_IRQ 9

@@ -XXX,XX +XXX,XX @@ enum {

VIRT_GIC_V2M,

VIRT_GIC_ITS,

VIRT_GIC_REDIST,

+ VIRT_SMMU,

VIRT_UART,

VIRT_MMIO,

VIRT_RTC,

@@ -XXX,XX +XXX,XX @@ enum {

VIRT_SECURE_MEM,

};

+typedef enum VirtIOMMUType {

+ VIRT_IOMMU_NONE,

+ VIRT_IOMMU_SMMUV3,

+ VIRT_IOMMU_VIRTIO,

+} VirtIOMMUType;

+

typedef struct MemMapEntry {

hwaddr base;

hwaddr size;

@@ -XXX,XX +XXX,XX @@ typedef struct {

bool its;

bool virt;

int32_t gic_version;

+ VirtIOMMUType iommu;

struct arm_boot_info bootinfo;

const MemMapEntry *memmap;

const int *irqmap;

@@ -XXX,XX +XXX,XX @@ typedef struct {

uint32_t clock_phandle;

uint32_t gic_phandle;

uint32_t msi_phandle;

+ uint32_t iommu_phandle;

int psci_conduit;

} VirtMachineState;

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@

#include "hw/smbios/smbios.h"

#include "qapi/visitor.h"

#include "standard-headers/linux/input.h"

+#include "hw/arm/smmuv3.h"

#define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \

static void virt_##major##_##minor##_class_init(ObjectClass *oc, \

@@ -XXX,XX +XXX,XX @@ static const MemMapEntry a15memmap[] = {

[VIRT_FW_CFG] = { 0x09020000, 0x00000018 },

[VIRT_GPIO] = { 0x09030000, 0x00001000 },

[VIRT_SECURE_UART] = { 0x09040000, 0x00001000 },

+ [VIRT_SMMU] = { 0x09050000, 0x00020000 },

[VIRT_MMIO] = { 0x0a000000, 0x00000200 },

/* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */

[VIRT_PLATFORM_BUS] = { 0x0c000000, 0x02000000 },

@@ -XXX,XX +XXX,XX @@ static const int a15irqmap[] = {

[VIRT_SECURE_UART] = 8,

[VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */

[VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */

+ [VIRT_SMMU] = 74, /* ...to 74 + NUM_SMMU_IRQS - 1 */

[VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */

};

@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(const VirtMachineState *vms,

0x7 /* PCI irq */);

-static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)

+static void create_smmu(const VirtMachineState *vms, qemu_irq *pic,

+ PCIBus *bus)

+{

+ char *node;

+ const char compat[] = "arm,smmu-v3";

+ int irq = vms->irqmap[VIRT_SMMU];

+ int i;

+ hwaddr base = vms->memmap[VIRT_SMMU].base;

+ hwaddr size = vms->memmap[VIRT_SMMU].size;

+ const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";

+ DeviceState *dev;

+

+ if (vms->iommu != VIRT_IOMMU_SMMUV3 || !vms->iommu_phandle) {

+ return;

+ }

+

+ dev = qdev_create(NULL, "arm-smmuv3");

+

+ object_property_set_link(OBJECT(dev), OBJECT(bus), "primary-bus",

+ &error_abort);

+ qdev_init_nofail(dev);

+ sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);

+ for (i = 0; i < NUM_SMMU_IRQS; i++) {

+ sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);

+ }

+

+ node = g_strdup_printf("/smmuv3@%" PRIx64, base);

+ qemu_fdt_add_subnode(vms->fdt, node);

+ qemu_fdt_setprop(vms->fdt, node, "compatible", compat, sizeof(compat));

+ qemu_fdt_setprop_sized_cells(vms->fdt, node, "reg", 2, base, 2, size);

+

+ qemu_fdt_setprop_cells(vms->fdt, node, "interrupts",

+ GIC_FDT_IRQ_TYPE_SPI, irq , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,

+ GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,

+ GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,

+ GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);

+

+ qemu_fdt_setprop(vms->fdt, node, "interrupt-names", irq_names,

+ sizeof(irq_names));

+

+ qemu_fdt_setprop_cell(vms->fdt, node, "clocks", vms->clock_phandle);

+ qemu_fdt_setprop_string(vms->fdt, node, "clock-names", "apb_pclk");

+ qemu_fdt_setprop(vms->fdt, node, "dma-coherent", NULL, 0);

+

+ qemu_fdt_setprop_cell(vms->fdt, node, "#iommu-cells", 1);

+

+ qemu_fdt_setprop_cell(vms->fdt, node, "phandle", vms->iommu_phandle);

+ g_free(node);

+}

+

+static void create_pcie(VirtMachineState *vms, qemu_irq *pic)

hwaddr base_mmio = vms->memmap[VIRT_PCIE_MMIO].base;

hwaddr size_mmio = vms->memmap[VIRT_PCIE_MMIO].size;

@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)

qemu_fdt_setprop_cell(vms->fdt, nodename, "#interrupt-cells", 1);

create_pcie_irq_map(vms, vms->gic_phandle, irq, nodename);

+ if (vms->iommu) {

+ vms->iommu_phandle = qemu_fdt_alloc_phandle(vms->fdt);

+

+ create_smmu(vms, pic, pci->bus);

+

+ qemu_fdt_setprop_cells(vms->fdt, nodename, "iommu-map",

+ 0x0, vms->iommu_phandle, 0x0, 0x10000);

+ }

+

g_free(nodename);