From: Jean-Christophe Dubois <jcd@tribudubois.net>

We need a solution to use an Ethernet PHY that is not the first device

on the MDIO bus (device 0 on MDIO bus).

As an example with the i.MX6UL the NXP SOC has 2 Ethernet devices but

only one MDIO bus on which the 2 related PHY are connected but at unique

addresses.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: a1a5c0e139d1c763194b8020573dcb6025daeefa.1593296112.git.jcd@tribudubois.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/net/imx_fec.h | 1 +

hw/net/imx_fec.c | 24 +++++++++++++++++-------

hw/net/trace-events | 4 ++--

3 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/net/imx_fec.h

+++ b/include/hw/net/imx_fec.h

@@ -XXX,XX +XXX,XX @@ typedef struct IMXFECState {

uint32_t phy_advertise;

uint32_t phy_int;

uint32_t phy_int_mask;

+ uint32_t phy_num;

bool is_fec;

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/imx_fec.c

+++ b/hw/net/imx_fec.c

@@ -XXX,XX +XXX,XX @@ static void imx_phy_reset(IMXFECState *s)

static uint32_t imx_phy_read(IMXFECState *s, int reg)

{

uint32_t val;

+ uint32_t phy = reg / 32;

- if (reg > 31) {

- /* we only advertise one phy */

+ if (phy != s->phy_num) {

+ qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

+ TYPE_IMX_FEC, __func__, phy);

return 0;

}

+ reg %= 32;

+

switch (reg) {

case 0: /* Basic Control */

val = s->phy_control;

@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)

break;

}

- trace_imx_phy_read(val, reg);

+ trace_imx_phy_read(val, phy, reg);

return val;

}

static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)

{

- trace_imx_phy_write(val, reg);

+ uint32_t phy = reg / 32;

- if (reg > 31) {

- /* we only advertise one phy */

+ if (phy != s->phy_num) {

+ qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",

+ TYPE_IMX_FEC, __func__, phy);

return;

}

+ reg %= 32;

+

+ trace_imx_phy_write(val, phy, reg);

+

switch (reg) {

case 0: /* Basic Control */

if (val & 0x8000) {

@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,

extract32(value,

18, 10)));

} else {

- /* This a write operation */

+ /* This is a write operation */

imx_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16));

}

/* raise the interrupt as the PHY operation is done */

@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)

static Property imx_eth_properties[] = {

DEFINE_NIC_PROPERTIES(IMXFECState, conf),

DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1),

+ DEFINE_PROP_UINT32("phy-num", IMXFECState, phy_num, 0),

DEFINE_PROP_END_OF_LIST(),

};

diff --git a/hw/net/trace-events b/hw/net/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/trace-events

+++ b/hw/net/trace-events

@@ -XXX,XX +XXX,XX @@ i82596_set_multicast(uint16_t count) "Added %d multicast entries"

i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"

# imx_fec.c

-imx_phy_read(uint32_t val, int reg) "0x%04"PRIx32" <= reg[%d]"

-imx_phy_write(uint32_t val, int reg) "0x%04"PRIx32" => reg[%d]"

+imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"

+imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"

imx_phy_update_link(const char *s) "%s"

imx_phy_reset(void) ""

imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"

--

2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

Add properties to the i.MX6UL processor to be able to select a

particular PHY on the MDIO bus for each FEC device.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: ea1d604198b6b73ea6521676e45bacfc597aba53.1593296112.git.jcd@tribudubois.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/fsl-imx6ul.h | 2 ++

hw/arm/fsl-imx6ul.c | 10 ++++++++++

2 files changed, 12 insertions(+)

diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/fsl-imx6ul.h

+++ b/include/hw/arm/fsl-imx6ul.h

@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6ULState {

MemoryRegion caam;

MemoryRegion ocram;

MemoryRegion ocram_alias;

+

+ uint32_t phy_num[FSL_IMX6UL_NUM_ETHS];

} FslIMX6ULState;

enum FslIMX6ULMemoryMap {

diff --git a/hw/arm/fsl-imx6ul.c b/hw/arm/fsl-imx6ul.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/fsl-imx6ul.c

+++ b/hw/arm/fsl-imx6ul.c

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)

FSL_IMX6UL_ENET2_TIMER_IRQ,

};

+ object_property_set_uint(OBJECT(&s->eth[i]),

+ s->phy_num[i],

+ "phy-num", &error_abort);

object_property_set_uint(OBJECT(&s->eth[i]),

FSL_IMX6UL_ETH_NUM_TX_RINGS,

"tx-ring-num", &error_abort);

@@ -XXX,XX +XXX,XX @@ static void fsl_imx6ul_realize(DeviceState *dev, Error **errp)

FSL_IMX6UL_OCRAM_ALIAS_ADDR, &s->ocram_alias);

}

+static Property fsl_imx6ul_properties[] = {

+ DEFINE_PROP_UINT32("fec1-phy-num", FslIMX6ULState, phy_num[0], 0),

+ DEFINE_PROP_UINT32("fec2-phy-num", FslIMX6ULState, phy_num[1], 1),

+ DEFINE_PROP_END_OF_LIST(),

+};

+

static void fsl_imx6ul_class_init(ObjectClass *oc, void *data)

{

DeviceClass *dc = DEVICE_CLASS(oc);

+ device_class_set_props(dc, fsl_imx6ul_properties);

dc->realize = fsl_imx6ul_realize;

dc->desc = "i.MX6UL SOC";

/* Reason: Uses serial_hds and nd_table in realize() directly */

--

2.20.1

From: Jean-Christophe Dubois <jcd@tribudubois.net>

The i.MX6UL EVK 14x14 board uses:

- PHY 2 for FEC 1

- PHY 1 for FEC 2

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>

Message-id: fb41992126c091a71d76ab3d1898959091f60583.1593296112.git.jcd@tribudubois.net

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/mcimx6ul-evk.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/hw/arm/mcimx6ul-evk.c b/hw/arm/mcimx6ul-evk.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/mcimx6ul-evk.c

+++ b/hw/arm/mcimx6ul-evk.c

@@ -XXX,XX +XXX,XX @@ static void mcimx6ul_evk_init(MachineState *machine)

s = FSL_IMX6UL(object_new(TYPE_FSL_IMX6UL));

object_property_add_child(OBJECT(machine), "soc", OBJECT(s));

+ object_property_set_uint(OBJECT(s), 2, "fec1-phy-num", &error_fatal);

+ object_property_set_uint(OBJECT(s), 1, "fec2-phy-num", &error_fatal);

qdev_realize(DEVICE(s), NULL, &error_fatal);

memory_region_add_subregion(get_system_memory(), FSL_IMX6UL_MMDC_ADDR,

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

Introduce a new property defining a reserved region:

<low address>:<high address>:<type>.

This will be used to encode reserved IOVA regions.

For instance, in virtio-iommu use case, reserved IOVA regions

will be passed by the machine code to the virtio-iommu-pci

device (an array of those). The type of the reserved region

will match the virtio_iommu_probe_resv_mem subtype value:

- VIRTIO_IOMMU_RESV_MEM_T_RESERVED (0)

- VIRTIO_IOMMU_RESV_MEM_T_MSI (1)

on PC/Q35 machine, this will be used to inform the

virtio-iommu-pci device it should bypass the MSI region.

The reserved region will be: 0xfee00000:0xfeefffff:1.

On ARM, we can declare the ITS MSI doorbell as an MSI

region to prevent MSIs from being mapped on guest side.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Markus Armbruster <armbru@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-2-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/exec/memory.h | 6 +++

include/hw/qdev-properties.h | 3 ++

include/qemu/typedefs.h | 1 +

hw/core/qdev-properties.c | 89 ++++++++++++++++++++++++++++++++++++

4 files changed, 99 insertions(+)

diff --git a/include/exec/memory.h b/include/exec/memory.h

index XXXXXXX..XXXXXXX 100644

--- a/include/exec/memory.h

+++ b/include/exec/memory.h

@@ -XXX,XX +XXX,XX @@ extern bool global_dirty_log;

typedef struct MemoryRegionOps MemoryRegionOps;

+struct ReservedRegion {

+ hwaddr low;

+ hwaddr high;

+ unsigned type;

+};

+

typedef struct IOMMUTLBEntry IOMMUTLBEntry;

/* See address_space_translate: bit 0 is read, bit 1 is write. */

diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/qdev-properties.h

+++ b/include/hw/qdev-properties.h

@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_string;

extern const PropertyInfo qdev_prop_chr;

extern const PropertyInfo qdev_prop_tpm;

extern const PropertyInfo qdev_prop_macaddr;

+extern const PropertyInfo qdev_prop_reserved_region;

extern const PropertyInfo qdev_prop_on_off_auto;

extern const PropertyInfo qdev_prop_multifd_compression;

extern const PropertyInfo qdev_prop_losttickpolicy;

@@ -XXX,XX +XXX,XX @@ extern const PropertyInfo qdev_prop_pcie_link_width;

DEFINE_PROP(_n, _s, _f, qdev_prop_drive_iothread, BlockBackend *)

#define DEFINE_PROP_MACADDR(_n, _s, _f) \

DEFINE_PROP(_n, _s, _f, qdev_prop_macaddr, MACAddr)

+#define DEFINE_PROP_RESERVED_REGION(_n, _s, _f) \

+ DEFINE_PROP(_n, _s, _f, qdev_prop_reserved_region, ReservedRegion)

#define DEFINE_PROP_ON_OFF_AUTO(_n, _s, _f, _d) \

DEFINE_PROP_SIGNED(_n, _s, _f, _d, qdev_prop_on_off_auto, OnOffAuto)

#define DEFINE_PROP_MULTIFD_COMPRESSION(_n, _s, _f, _d) \

diff --git a/include/qemu/typedefs.h b/include/qemu/typedefs.h

index XXXXXXX..XXXXXXX 100644

--- a/include/qemu/typedefs.h

+++ b/include/qemu/typedefs.h

@@ -XXX,XX +XXX,XX @@ typedef struct ISABus ISABus;

typedef struct ISADevice ISADevice;

typedef struct IsaDma IsaDma;

typedef struct MACAddr MACAddr;

+typedef struct ReservedRegion ReservedRegion;

typedef struct MachineClass MachineClass;

typedef struct MachineState MachineState;

typedef struct MemoryListener MemoryListener;

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/core/qdev-properties.c

+++ b/hw/core/qdev-properties.c

@@ -XXX,XX +XXX,XX @@

#include "chardev/char.h"

#include "qemu/uuid.h"

#include "qemu/units.h"

+#include "qemu/cutils.h"

void qdev_prop_set_after_realize(DeviceState *dev, const char *name,

Error **errp)

@@ -XXX,XX +XXX,XX @@ const PropertyInfo qdev_prop_macaddr = {

.set = set_mac,

};

+/* --- Reserved Region --- */

+

+/*

+ * Accepted syntax:

+ * <low address>:<high address>:<type>

+ * where low/high addresses are uint64_t in hexadecimal

+ * and type is a non-negative decimal integer

+ */

+static void get_reserved_region(Object *obj, Visitor *v, const char *name,

+ void *opaque, Error **errp)

+{

+ DeviceState *dev = DEVICE(obj);

+ Property *prop = opaque;

+ ReservedRegion *rr = qdev_get_prop_ptr(dev, prop);

+ char buffer[64];

+ char *p = buffer;

+ int rc;

+

+ rc = snprintf(buffer, sizeof(buffer), "0x%"PRIx64":0x%"PRIx64":%u",

+ rr->low, rr->high, rr->type);

+ assert(rc < sizeof(buffer));

+

+ visit_type_str(v, name, &p, errp);

+}

+

+static void set_reserved_region(Object *obj, Visitor *v, const char *name,

+ void *opaque, Error **errp)

+{

+ DeviceState *dev = DEVICE(obj);

+ Property *prop = opaque;

+ ReservedRegion *rr = qdev_get_prop_ptr(dev, prop);

+ Error *local_err = NULL;

+ const char *endptr;

+ char *str;

+ int ret;

+

+ if (dev->realized) {

+ qdev_prop_set_after_realize(dev, name, errp);

+ return;

+ }

+

+ visit_type_str(v, name, &str, &local_err);

+ if (local_err) {

+ error_propagate(errp, local_err);

+ return;

+ }

+

+ ret = qemu_strtou64(str, &endptr, 16, &rr->low);

+ if (ret) {

+ error_setg(errp, "start address of '%s'"

+ " must be a hexadecimal integer", name);

+ goto out;

+ }

+ if (*endptr != ':') {

+ goto separator_error;

+ }

+

+ ret = qemu_strtou64(endptr + 1, &endptr, 16, &rr->high);

+ if (ret) {

+ error_setg(errp, "end address of '%s'"

+ " must be a hexadecimal integer", name);

+ goto out;

+ }

+ if (*endptr != ':') {

+ goto separator_error;

+ }

+

+ ret = qemu_strtoui(endptr + 1, &endptr, 10, &rr->type);

+ if (ret) {

+ error_setg(errp, "type of '%s'"

+ " must be a non-negative decimal integer", name);

+ }

+ goto out;

+

+separator_error:

+ error_setg(errp, "reserved region fields must be separated with ':'");

+out:

+ g_free(str);

+ return;

+}

+

+const PropertyInfo qdev_prop_reserved_region = {

+ .name = "reserved_region",

+ .description = "Reserved Region, example: 0xFEE00000:0xFEEFFFFF:0",

+ .get = get_reserved_region,

+ .set = set_reserved_region,

+};

+

/* --- on/off/auto --- */

const PropertyInfo qdev_prop_on_off_auto = {

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

This patch implements the PROBE request. At the moment,

only THE RESV_MEM property is handled. The first goal is

to report iommu wide reserved regions such as the MSI regions

set by the machine code. On x86 this will be the IOAPIC MSI

region, [0xFEE00000 - 0xFEEFFFFF], on ARM this may be the ITS

doorbell.

In the future we may introduce per device reserved regions.

This will be useful when protecting host assigned devices

which may expose their own reserved regions

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-3-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/virtio/virtio-iommu.h | 2 +

hw/virtio/virtio-iommu.c | 94 ++++++++++++++++++++++++++++++--

hw/virtio/trace-events | 1 +

3 files changed, 93 insertions(+), 4 deletions(-)

diff --git a/include/hw/virtio/virtio-iommu.h b/include/hw/virtio/virtio-iommu.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/virtio/virtio-iommu.h

+++ b/include/hw/virtio/virtio-iommu.h

@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOIOMMU {

GHashTable *as_by_busptr;

IOMMUPciBus *iommu_pcibus_by_bus_num[PCI_BUS_MAX];

PCIBus *primary_bus;

+ ReservedRegion *reserved_regions;

+ uint32_t nb_reserved_regions;

GTree *domains;

QemuMutex mutex;

GTree *endpoints;

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

@@ -XXX,XX +XXX,XX @@

/* Max size */

#define VIOMMU_DEFAULT_QUEUE_SIZE 256

+#define VIOMMU_PROBE_SIZE 512

typedef struct VirtIOIOMMUDomain {

uint32_t id;

@@ -XXX,XX +XXX,XX @@ static int virtio_iommu_unmap(VirtIOIOMMU *s,

return ret;

}

+static ssize_t virtio_iommu_fill_resv_mem_prop(VirtIOIOMMU *s, uint32_t ep,

+ uint8_t *buf, size_t free)

+{

+ struct virtio_iommu_probe_resv_mem prop = {};

+ size_t size = sizeof(prop), length = size - sizeof(prop.head), total;

+ int i;

+

+ total = size * s->nb_reserved_regions;

+

+ if (total > free) {

+ return -ENOSPC;

+ }

+

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ unsigned subtype = s->reserved_regions[i].type;

+

+ assert(subtype == VIRTIO_IOMMU_RESV_MEM_T_RESERVED ||

+ subtype == VIRTIO_IOMMU_RESV_MEM_T_MSI);

+ prop.head.type = cpu_to_le16(VIRTIO_IOMMU_PROBE_T_RESV_MEM);

+ prop.head.length = cpu_to_le16(length);

+ prop.subtype = subtype;

+ prop.start = cpu_to_le64(s->reserved_regions[i].low);

+ prop.end = cpu_to_le64(s->reserved_regions[i].high);

+

+ memcpy(buf, &prop, size);

+

+ trace_virtio_iommu_fill_resv_property(ep, prop.subtype,

+ prop.start, prop.end);

+ buf += size;

+ }

+ return total;

+}

+

+/**

+ * virtio_iommu_probe - Fill the probe request buffer with

+ * the properties the device is able to return

+ */

+static int virtio_iommu_probe(VirtIOIOMMU *s,

+ struct virtio_iommu_req_probe *req,

+ uint8_t *buf)

+{

+ uint32_t ep_id = le32_to_cpu(req->endpoint);

+ size_t free = VIOMMU_PROBE_SIZE;

+ ssize_t count;

+

+ if (!virtio_iommu_mr(s, ep_id)) {

+ return VIRTIO_IOMMU_S_NOENT;

+ }

+

+ count = virtio_iommu_fill_resv_mem_prop(s, ep_id, buf, free);

+ if (count < 0) {

+ return VIRTIO_IOMMU_S_INVAL;

+ }

+ buf += count;

+ free -= count;

+

+ return VIRTIO_IOMMU_S_OK;

+}

+

static int virtio_iommu_iov_to_req(struct iovec *iov,

unsigned int iov_cnt,

void *req, size_t req_sz)

@@ -XXX,XX +XXX,XX @@ virtio_iommu_handle_req(detach)

virtio_iommu_handle_req(map)

virtio_iommu_handle_req(unmap)

+static int virtio_iommu_handle_probe(VirtIOIOMMU *s,

+ struct iovec *iov,

+ unsigned int iov_cnt,

+ uint8_t *buf)

+{

+ struct virtio_iommu_req_probe req;

+ int ret = virtio_iommu_iov_to_req(iov, iov_cnt, &req, sizeof(req));

+

+ return ret ? ret : virtio_iommu_probe(s, &req, buf);

+}

+

static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

{

VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);

struct virtio_iommu_req_head head;

struct virtio_iommu_req_tail tail = {};

+ size_t output_size = sizeof(tail), sz;

VirtQueueElement *elem;

unsigned int iov_cnt;

struct iovec *iov;

- size_t sz;

+ void *buf = NULL;

for (;;) {

elem = virtqueue_pop(vq, sizeof(VirtQueueElement));

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

case VIRTIO_IOMMU_T_UNMAP:

tail.status = virtio_iommu_handle_unmap(s, iov, iov_cnt);

break;

+ case VIRTIO_IOMMU_T_PROBE:

+ {

+ struct virtio_iommu_req_tail *ptail;

+

+ output_size = s->config.probe_size + sizeof(tail);

+ buf = g_malloc0(output_size);

+

+ ptail = (struct virtio_iommu_req_tail *)

+ (buf + s->config.probe_size);

+ ptail->status = virtio_iommu_handle_probe(s, iov, iov_cnt, buf);

+ }

default:

tail.status = VIRTIO_IOMMU_S_UNSUPP;

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_handle_command(VirtIODevice *vdev, VirtQueue *vq)

out:

sz = iov_from_buf(elem->in_sg, elem->in_num, 0,

- &tail, sizeof(tail));

- assert(sz == sizeof(tail));

+ buf ? buf : &tail, output_size);

+ assert(sz == output_size);

- virtqueue_push(vq, elem, sizeof(tail));

+ virtqueue_push(vq, elem, sz);

virtio_notify(vdev, vq);

g_free(elem);

+ g_free(buf);

}

}

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

s->config.page_size_mask = TARGET_PAGE_MASK;

s->config.input_range.end = -1UL;

s->config.domain_range.end = 32;

+ s->config.probe_size = VIOMMU_PROBE_SIZE;

virtio_add_feature(&s->features, VIRTIO_RING_F_EVENT_IDX);

virtio_add_feature(&s->features, VIRTIO_RING_F_INDIRECT_DESC);

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_device_realize(DeviceState *dev, Error **errp)

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MAP_UNMAP);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_BYPASS);

virtio_add_feature(&s->features, VIRTIO_IOMMU_F_MMIO);

+ virtio_add_feature(&s->features, VIRTIO_IOMMU_F_PROBE);

qemu_mutex_init(&s->mutex);

diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/trace-events

+++ b/hw/virtio/trace-events

@@ -XXX,XX +XXX,XX @@ virtio_iommu_get_domain(uint32_t domain_id) "Alloc domain=%d"

virtio_iommu_put_domain(uint32_t domain_id) "Free domain=%d"

virtio_iommu_translate_out(uint64_t virt_addr, uint64_t phys_addr, uint32_t sid) "0x%"PRIx64" -> 0x%"PRIx64 " for sid=%d"

virtio_iommu_report_fault(uint8_t reason, uint32_t flags, uint32_t endpoint, uint64_t addr) "FAULT reason=%d flags=%d endpoint=%d address =0x%"PRIx64

+virtio_iommu_fill_resv_property(uint32_t devid, uint8_t subtype, uint64_t start, uint64_t end) "dev= %d, type=%d start=0x%"PRIx64" end=0x%"PRIx64

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

When translating an address we need to check if it belongs to

a reserved virtual address range. If it does, there are 2 cases:

- it belongs to a RESERVED region: the guest should neither use

this address in a MAP not instruct the end-point to DMA on

them. We report an error

- It belongs to an MSI region: we bypass the translation.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Xu <peterx@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Message-id: 20200629070404.10969-4-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/virtio/virtio-iommu.c | 20 ++++++++++++++++++++

1 file changed, 20 insertions(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu.c

+++ b/hw/virtio/virtio-iommu.c

@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr,

uint32_t sid, flags;

bool bypass_allowed;

bool found;

+ int i;

interval.low = addr;

interval.high = addr + 1;

@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry virtio_iommu_translate(IOMMUMemoryRegion *mr, hwaddr addr,

goto unlock;

}

+ for (i = 0; i < s->nb_reserved_regions; i++) {

+ ReservedRegion *reg = &s->reserved_regions[i];

+

+ if (addr >= reg->low && addr <= reg->high) {

+ switch (reg->type) {

+ case VIRTIO_IOMMU_RESV_MEM_T_MSI:

+ entry.perm = flag;

+ break;

+ case VIRTIO_IOMMU_RESV_MEM_T_RESERVED:

+ default:

+ virtio_iommu_report_fault(s, VIRTIO_IOMMU_FAULT_R_MAPPING,

+ VIRTIO_IOMMU_FAULT_F_ADDRESS,

+ sid, addr);

+ break;

+ }

+ goto unlock;

+ }

+ }

+

if (!ep->domain) {

if (!bypass_allowed) {

error_report_once("%s %02x:%02x.%01x not attached to any domain",

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

The machine may need to pass reserved regions to the

virtio-iommu-pci device (such as the MSI window on x86

or the MSI doorbells on ARM).

So let's add an array of Interval properties.

Note: if some reserved regions are already set by the

machine code - which should be the case in general -,

the length of the property array is already set and

prevents the end-user from modifying them. For example,

attempting to use:

-device virtio-iommu-pci,\

len-reserved-regions=1,reserved-regions[0]=0xfee00000:0xfeefffff:1

would result in the following error message:

qemu-system-aarch64: -device virtio-iommu-pci,addr=0xa,

len-reserved-regions=1,reserved-regions[0]=0xfee00000:0xfeefffff:1:

array size property len-reserved-regions may not be set more than once

Otherwise, for example, adding two reserved regions is achieved

using the following options:

-device virtio-iommu-pci,addr=0xa,len-reserved-regions=2,\

reserved-regions[0]=0xfee00000:0xfeefffff:1,\

reserved-regions[1]=0x1000000:100ffff:1

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Reviewed-by: Peter Xu <peterx@redhat.com>

Message-id: 20200629070404.10969-5-eric.auger@redhat.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/virtio/virtio-iommu-pci.c | 11 +++++++++++

1 file changed, 11 insertions(+)

diff --git a/hw/virtio/virtio-iommu-pci.c b/hw/virtio/virtio-iommu-pci.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/virtio/virtio-iommu-pci.c

+++ b/hw/virtio/virtio-iommu-pci.c

@@ -XXX,XX +XXX,XX @@ struct VirtIOIOMMUPCI {

static Property virtio_iommu_pci_properties[] = {

DEFINE_PROP_UINT32("class", VirtIOPCIProxy, class_code, 0),

+ DEFINE_PROP_ARRAY("reserved-regions", VirtIOIOMMUPCI,

+ vdev.nb_reserved_regions, vdev.reserved_regions,

+ qdev_prop_reserved_region, ReservedRegion),

DEFINE_PROP_END_OF_LIST(),

};

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)

{

VirtIOIOMMUPCI *dev = VIRTIO_IOMMU_PCI(vpci_dev);

DeviceState *vdev = DEVICE(&dev->vdev);

+ VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);

if (!qdev_get_machine_hotplug_handler(DEVICE(vpci_dev))) {

MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());

@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)

"-no-acpi\n");

return;

}

+ for (int i = 0; i < s->nb_reserved_regions; i++) {

+ if (s->reserved_regions[i].type != VIRTIO_IOMMU_RESV_MEM_T_RESERVED &&

+ s->reserved_regions[i].type != VIRTIO_IOMMU_RESV_MEM_T_MSI) {

+ error_setg(errp, "reserved region %d has an invalid type", i);

+ error_append_hint(errp, "Valid values are 0 and 1\n");

+ }

+ }

object_property_set_link(OBJECT(dev),

OBJECT(pci_get_bus(&vpci_dev->pci_dev)),

"primary-bus", &error_abort);

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

At the moment the virtio-iommu translates MSI transactions.

This behavior is inherited from ARM SMMU. The virt machine

code knows where the guest MSI doorbells are so we can easily

declare those regions as VIRTIO_IOMMU_RESV_MEM_T_MSI. With that

setting the guest will not map MSIs through the IOMMU and those

transactions will be simply bypassed.

Depending on which MSI controller is in use (ITS or GICV2M),

we declare either:

- the ITS interrupt translation space (ITS_base + 0x10000),

containing the GITS_TRANSLATOR or

- The GICV2M single frame, containing the MSI_SETSP_NS register.

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Message-id: 20200629070404.10969-6-eric.auger@redhat.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/virt.h | 7 +++++++

hw/arm/virt.c | 30 ++++++++++++++++++++++++++++++

2 files changed, 37 insertions(+)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/virt.h

+++ b/include/hw/arm/virt.h

@@ -XXX,XX +XXX,XX @@ typedef enum VirtIOMMUType {

VIRT_IOMMU_VIRTIO,

} VirtIOMMUType;

+typedef enum VirtMSIControllerType {

+ VIRT_MSI_CTRL_NONE,

+ VIRT_MSI_CTRL_GICV2M,

+ VIRT_MSI_CTRL_ITS,

+} VirtMSIControllerType;

+

typedef enum VirtGICType {

VIRT_GIC_VERSION_MAX,

VIRT_GIC_VERSION_HOST,

@@ -XXX,XX +XXX,XX @@ typedef struct {

OnOffAuto acpi;

VirtGICType gic_version;

VirtIOMMUType iommu;

+ VirtMSIControllerType msi_controller;

uint16_t virtio_iommu_bdf;

struct arm_boot_info bootinfo;

MemMapEntry *memmap;

diff --git a/hw/arm/virt.c b/hw/arm/virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/virt.c

+++ b/hw/arm/virt.c

@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)

sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, vms->memmap[VIRT_GIC_ITS].base);

fdt_add_its_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_ITS;

}

static void create_v2m(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)

}

fdt_add_v2m_gic_node(vms);

+ vms->msi_controller = VIRT_MSI_CTRL_GICV2M;

}

static void create_gic(VirtMachineState *vms)

@@ -XXX,XX +XXX,XX @@ out:

static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,

DeviceState *dev, Error **errp)

{

+ VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);

+

if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {

virt_memory_pre_plug(hotplug_dev, dev, errp);

+ } else if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {

+ hwaddr db_start = 0, db_end = 0;

+ char *resv_prop_str;

+

+ switch (vms->msi_controller) {

+ case VIRT_MSI_CTRL_NONE:

+ return;

+ case VIRT_MSI_CTRL_ITS:

+ /* GITS_TRANSLATER page */

+ db_start = base_memmap[VIRT_GIC_ITS].base + 0x10000;

+ db_end = base_memmap[VIRT_GIC_ITS].base +

+ base_memmap[VIRT_GIC_ITS].size - 1;

+ break;

+ case VIRT_MSI_CTRL_GICV2M:

+ /* MSI_SETSPI_NS page */

+ db_start = base_memmap[VIRT_GIC_V2M].base;

+ db_end = db_start + base_memmap[VIRT_GIC_V2M].size - 1;

+ break;

+ }

+ resv_prop_str = g_strdup_printf("0x%"PRIx64":0x%"PRIx64":%u",

+ db_start, db_end,

+ VIRTIO_IOMMU_RESV_MEM_T_MSI);

+

+ qdev_prop_set_uint32(dev, "len-reserved-regions", 1);

+ qdev_prop_set_string(dev, "reserved-regions[0]", resv_prop_str);

+ g_free(resv_prop_str);

}

}

--

2.20.1

From: Beata Michalska <beata.michalska@linaro.org>

On ARMv7 & ARMv8 some load/store instructions might trigger a data abort

exception with no valid ISS info to be decoded. The lack of decode info

makes it at least tricky to emulate those instruction which is one of the

(many) reasons why KVM will not even try to do so.

Add support for handling those by requesting KVM to inject external

dabt into the quest.

Signed-off-by: Beata Michalska <beata.michalska@linaro.org>

Reviewed-by: Andrew Jones <drjones@redhat.com>

Message-id: 20200629114110.30723-2-beata.michalska@linaro.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/kvm.c | 52 ++++++++++++++++++++++++++++++++++++++++++++++++

1 file changed, 52 insertions(+)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm.c

+++ b/target/arm/kvm.c

@@ -XXX,XX +XXX,XX @@ const KVMCapabilityInfo kvm_arch_required_capabilities[] = {

static bool cap_has_mp_state;

static bool cap_has_inject_serror_esr;

+static bool cap_has_inject_ext_dabt;

static ARMHostCPUFeatures arm_host_cpu_features;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)

ret = -EINVAL;

}

+ if (kvm_check_extension(s, KVM_CAP_ARM_NISV_TO_USER)) {

+ if (kvm_vm_enable_cap(s, KVM_CAP_ARM_NISV_TO_USER, 0)) {

+ error_report("Failed to enable KVM_CAP_ARM_NISV_TO_USER cap");

+ } else {

+ /* Set status for supporting the external dabt injection */

+ cap_has_inject_ext_dabt = kvm_check_extension(s,

+ KVM_CAP_ARM_INJECT_EXT_DABT);

+ }

+ }

+

return ret;

}

@@ -XXX,XX +XXX,XX @@ void kvm_arm_vm_state_change(void *opaque, int running, RunState state)

}

}

+/**

+ * kvm_arm_handle_dabt_nisv:

+ * @cs: CPUState

+ * @esr_iss: ISS encoding (limited) for the exception from Data Abort

+ * ISV bit set to '0b0' -> no valid instruction syndrome

+ * @fault_ipa: faulting address for the synchronous data abort

+ *

+ * Returns: 0 if the exception has been handled, < 0 otherwise

+ */

+static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

+ uint64_t fault_ipa)

+{

+ /*

+ * Request KVM to inject the external data abort into the guest

+ */

+ if (cap_has_inject_ext_dabt) {

+ struct kvm_vcpu_events events = { };

+ /*

+ * The external data abort event will be handled immediately by KVM

+ * using the address fault that triggered the exit on given VCPU.

+ * Requesting injection of the external data abort does not rely

+ * on any other VCPU state. Therefore, in this particular case, the VCPU

+ * synchronization can be exceptionally skipped.

+ */

+ events.exception.ext_dabt_pending = 1;

+ /* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */

+ return kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events);

+ } else {

+ error_report("Data abort exception triggered by guest memory access "

+ "at physical address: 0x" TARGET_FMT_lx,

+ (target_ulong)fault_ipa);

+ error_printf("KVM unable to emulate faulting instruction.\n");

+ }

+ return -1;

+}

+

int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

{

int ret = 0;

@@ -XXX,XX +XXX,XX @@ int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)

ret = EXCP_DEBUG;

} /* otherwise return to guest */

break;

+ case KVM_EXIT_ARM_NISV:

+ /* External DABT with no valid iss to decode */

+ ret = kvm_arm_handle_dabt_nisv(cs, run->arm_nisv.esr_iss,

+ run->arm_nisv.fault_ipa);

+ break;

default:

qemu_log_mask(LOG_UNIMP, "%s: un-handled exit reason %d\n",

__func__, run->exit_reason);

--

2.20.1

From: Beata Michalska <beata.michalska@linaro.org>

Injecting external data abort through KVM might trigger

an issue on kernels that do not get updated to include the KVM fix.

For those and aarch32 guests, the injected abort gets misconfigured

to be an implementation defined exception. This leads to the guest

repeatedly re-running the faulting instruction.

Add support for handling that case.

[

Fixed-by: 018f22f95e8a

    ('KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests')

Fixed-by: 21aecdbd7f3a

    ('KVM: arm: Make inject_abt32() inject an external abort instead')

]

Signed-off-by: Beata Michalska <beata.michalska@linaro.org>

Acked-by: Andrew Jones <drjones@redhat.com>

Message-id: 20200629114110.30723-3-beata.michalska@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.h | 2 ++

target/arm/kvm_arm.h | 10 +++++++++

target/arm/kvm.c | 30 ++++++++++++++++++++++++++-

target/arm/kvm32.c | 34 ++++++++++++++++++++++++++++++

target/arm/kvm64.c | 49 ++++++++++++++++++++++++++++++++++++++++++++

5 files changed, 124 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {

uint64_t esr;

} serror;

+ uint8_t ext_dabt_raised; /* Tracking/verifying injection of ext DABT */

+

/* State of our input IRQ/FIQ/VIRQ/VFIQ lines */

uint32_t irq_line_state;

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm_arm.h

+++ b/target/arm/kvm_arm.h

@@ -XXX,XX +XXX,XX @@ bool kvm_arm_hw_debug_active(CPUState *cs);

struct kvm_guest_debug_arch;

void kvm_arm_copy_hw_debug_data(struct kvm_guest_debug_arch *ptr);

+/**

+ * kvm_arm_verify_ext_dabt_pending:

+ * @cs: CPUState

+ *

+ * Verify the fault status code wrt the Ext DABT injection

+ *

+ * Returns: true if the fault status code is as expected, false otherwise

+ */

+bool kvm_arm_verify_ext_dabt_pending(CPUState *cs);

+

/**

* its_class_name:

*

diff --git a/target/arm/kvm.c b/target/arm/kvm.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm.c

+++ b/target/arm/kvm.c

@@ -XXX,XX +XXX,XX @@ int kvm_get_vcpu_events(ARMCPU *cpu)

void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)

{

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

+

+ if (unlikely(env->ext_dabt_raised)) {

+ /*

+ * Verifying that the ext DABT has been properly injected,

+ * otherwise risking indefinitely re-running the faulting instruction

+ * Covering a very narrow case for kernels 5.5..5.5.4

+ * when injected abort was misconfigured to be

+ * an IMPLEMENTATION DEFINED exception (for 32-bit EL1)

+ */

+ if (!arm_feature(env, ARM_FEATURE_AARCH64) &&

+ unlikely(!kvm_arm_verify_ext_dabt_pending(cs))) {

+

+ error_report("Data abort exception with no valid ISS generated by "

+ "guest memory access. KVM unable to emulate faulting "

+ "instruction. Failed to inject an external data abort "

+ "into the guest.");

+ abort();

+ }

+ /* Clear the status */

+ env->ext_dabt_raised = 0;

+ }

}

MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)

@@ -XXX,XX +XXX,XX @@ void kvm_arm_vm_state_change(void *opaque, int running, RunState state)

static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

uint64_t fault_ipa)

{

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

/*

* Request KVM to inject the external data abort into the guest

*/

@@ -XXX,XX +XXX,XX @@ static int kvm_arm_handle_dabt_nisv(CPUState *cs, uint64_t esr_iss,

*/

events.exception.ext_dabt_pending = 1;

/* KVM_CAP_ARM_INJECT_EXT_DABT implies KVM_CAP_VCPU_EVENTS */

- return kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events);

+ if (!kvm_vcpu_ioctl(cs, KVM_SET_VCPU_EVENTS, &events)) {

+ env->ext_dabt_raised = 1;

+ return 0;

+ }

} else {

error_report("Data abort exception triggered by guest memory access "

"at physical address: 0x" TARGET_FMT_lx,

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm32.c

+++ b/target/arm/kvm32.c

@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_init(CPUState *cs)

{

qemu_log_mask(LOG_UNIMP, "%s: not implemented\n", __func__);

}

+

+#define ARM_REG_DFSR ARM_CP15_REG32(0, 5, 0, 0)

+#define ARM_REG_TTBCR ARM_CP15_REG32(0, 2, 0, 2)

+/*

+ *DFSR:

+ * TTBCR.EAE == 0

+ * FS[4] - DFSR[10]

+ * FS[3:0] - DFSR[3:0]

+ * TTBCR.EAE == 1

+ * FS, bits [5:0]

+ */

+#define DFSR_FSC(lpae, v) \

+ ((lpae) ? ((v) & 0x3F) : (((v) >> 6) | ((v) & 0x1F)))

+

+#define DFSC_EXTABT(lpae) ((lpae) ? 0x10 : 0x08)

+

+bool kvm_arm_verify_ext_dabt_pending(CPUState *cs)

+{

+ uint32_t dfsr_val;

+

+ if (!kvm_get_one_reg(cs, ARM_REG_DFSR, &dfsr_val)) {

+ ARMCPU *cpu = ARM_CPU(cs);

+ CPUARMState *env = &cpu->env;

+ uint32_t ttbcr;

+ int lpae = 0;

+

+ if (!kvm_get_one_reg(cs, ARM_REG_TTBCR, &ttbcr)) {

+ lpae = arm_feature(env, ARM_FEATURE_LPAE) && (ttbcr & TTBCR_EAE);

+ }

+ /* The verification is based on FS filed of the DFSR reg only*/

+ return (DFSR_FSC(lpae, dfsr_val) == DFSC_EXTABT(lpae));

+ }

+ return false;

+}

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/kvm64.c

+++ b/target/arm/kvm64.c

@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)

return false;

}

+

+#define ARM64_REG_ESR_EL1 ARM64_SYS_REG(3, 0, 5, 2, 0)

+#define ARM64_REG_TCR_EL1 ARM64_SYS_REG(3, 0, 2, 0, 2)

+

+/*

+ * ESR_EL1