Hi; here's the latest batch of arm changes. The big thing

in here is the SMMUv3 changes to add stage-2 translation support.

The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:

Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530

for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:

docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)

* fsl-imx6: Add SNVS support for i.MX6 boards

* smmuv3: Add support for stage 2 translations

* hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop

* hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

* cleanups for recent Kconfig changes

* target/arm: Explicitly select short-format FSR for M-profile

* tests/qtest: Run arm-specific tests only if the required machine is available

* hw/arm/sbsa-ref: add GIC node into DT

* docs: sbsa: correct graphics card name

* Update copyright dates to 2023

Clément Chigot (1):

hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

Enze Li (1):

Update copyright dates to 2023

Fabiano Rosas (3):

target/arm: Explain why we need to select ARM_V7M

arm/Kconfig: Keep Kconfig default entries in default.mak as documentation

arm/Kconfig: Make TCG dependence explicit

Marcin Juszkiewicz (2):

hw/arm/sbsa-ref: add GIC node into DT

docs: sbsa: correct graphics card name

Mostafa Saleh (10):

hw/arm/smmuv3: Add missing fields for IDR0

hw/arm/smmuv3: Update translation config to hold stage-2

hw/arm/smmuv3: Refactor stage-1 PTW

hw/arm/smmuv3: Add page table walk for stage-2

hw/arm/smmuv3: Parse STE config for stage-2

hw/arm/smmuv3: Make TLB lookup work for stage-2

hw/arm/smmuv3: Add VMID to TLB tagging

hw/arm/smmuv3: Add CMDs related to stage-2

hw/arm/smmuv3: Add stage-2 support in iova notifier

hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2

From: Enze Li <lienze@kylinos.cn>

I noticed that in the latest version, the copyright string is still

2022, even though 2023 is halfway through. This patch fixes that and

fixes the documentation along with it.

Message-id: 20230525064345.1152801-1-lienze@kylinos.cn

docs/conf.py | 2 +-

include/qemu/help-texts.h | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py

--- a/docs/conf.py

+++ b/docs/conf.py

@@ -XXX,XX +XXX,XX @@

# General information about the project.

project = u'QEMU'

-copyright = u'2022, The QEMU Project Developers'

+copyright = u'2023, The QEMU Project Developers'

author = u'The QEMU Project Developers'

# The version info for the project you're documenting, acts as replacement for

diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h

index XXXXXXX..XXXXXXX 100644

--- a/include/qemu/help-texts.h

+++ b/include/qemu/help-texts.h

@@ -XXX,XX +XXX,XX @@

#define QEMU_HELP_TEXTS_H

/* Copyright string for -version arguments, About dialogs, etc */

-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \

+#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \

"Fabrice Bellard and the QEMU Project developers"

/* Bug reporting information for --help arguments, About dialogs, etc */

From: Mostafa Saleh <smostafa@google.com>

Allow TLB to be tagged with VMID.

If stage-1 is only supported, VMID is set to -1 and ignored from STE

and CMD_TLBI_NH* cmds.

Update smmu_iotlb_insert trace event to have vmid.

Signed-off-by: Mostafa Saleh <smostafa@google.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Message-id: 20230516203327.2051088-8-smostafa@google.com

hw/arm/smmu-internal.h | 2 ++

include/hw/arm/smmu-common.h | 5 +++--

hw/arm/smmu-common.c | 36 ++++++++++++++++++++++--------------

hw/arm/smmuv3.c | 12 +++++++++---

hw/arm/trace-events | 6 +++---

5 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmu-internal.h

+++ b/hw/arm/smmu-internal.h

@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,

#define SMMU_IOTLB_ASID(key) ((key).asid)

+#define SMMU_IOTLB_VMID(key) ((key).vmid)

typedef struct SMMUIOTLBPageInvInfo {

int asid;

+ int vmid;

uint64_t iova;

uint64_t mask;

} SMMUIOTLBPageInvInfo;

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/smmu-common.h

+++ b/include/hw/arm/smmu-common.h

@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {

typedef struct SMMUIOTLBKey {

uint64_t iova;

uint16_t asid;

+ uint16_t vmid;

uint8_t tg;

uint8_t level;

} SMMUIOTLBKey;

@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);

SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,

SMMUTransTableInfo *tt, hwaddr iova);

void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);

-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,

+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,

uint8_t tg, uint8_t level);

void smmu_iotlb_inv_all(SMMUState *s);

void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);

-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,

+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,

uint8_t tg, uint64_t num_pages, uint8_t ttl);

/* Unmap the range of all the notifiers registered to any IOMMU mr */

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmu-common.c

+++ b/hw/arm/smmu-common.c

@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)

/* Jenkins hash */

a = b = c = JHASH_INITVAL + sizeof(*key);

- a += key->asid + key->level + key->tg;

+ a += key->asid + key->vmid + key->level + key->tg;

b += extract64(key->iova, 0, 32);

c += extract64(key->iova, 32, 32);

@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)

SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;

return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&

- (k1->level == k2->level) && (k1->tg == k2->tg);

+ (k1->level == k2->level) && (k1->tg == k2->tg) &&

+ (k1->vmid == k2->vmid);

-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,

+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,

uint8_t tg, uint8_t level)

- SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};

+ SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,

+ .tg = tg, .level = level};

return key;

}

@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,

uint64_t mask = subpage_size - 1;

SMMUIOTLBKey key;

- key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);

+ key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,

+ iova & ~mask, tg, level);

entry = g_hash_table_lookup(bs->iotlb, &key);

if (entry) {

break;

@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,

if (entry) {

cfg->iotlb_hits++;

- trace_smmu_iotlb_lookup_hit(cfg->asid, iova,

+ trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,

cfg->iotlb_hits, cfg->iotlb_misses,

100 * cfg->iotlb_hits /

(cfg->iotlb_hits + cfg->iotlb_misses));

} else {

cfg->iotlb_misses++;

- trace_smmu_iotlb_lookup_miss(cfg->asid, iova,

+ trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,

cfg->iotlb_hits, cfg->iotlb_misses,

100 * cfg->iotlb_hits /

(cfg->iotlb_hits + cfg->iotlb_misses));

@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)

smmu_iotlb_inv_all(bs);

}

- *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);

- trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);

+ *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,

+ tg, new->level);

+ trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,

+ tg, new->level);

g_hash_table_insert(bs->iotlb, key, new);

}

@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,

return SMMU_IOTLB_ASID(*iotlb_key) == asid;

}

-

-static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,

+static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,

gpointer user_data)

{

SMMUTLBEntry *iter = (SMMUTLBEntry *)value;

@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,

if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {

return false;

}

+ if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {

+ return false;

+ }

return ((info->iova & ~entry->addr_mask) == entry->iova) ||

((entry->iova & ~info->mask) == info->iova);

}

-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,

+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,

uint8_t tg, uint64_t num_pages, uint8_t ttl)

{

/* if tg is not set we use 4KB range invalidation */

uint8_t granule = tg ? tg * 2 + 10 : 12;

if (ttl && (num_pages == 1) && (asid >= 0)) {

- SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);

+ SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);

if (g_hash_table_remove(s->iotlb, &key)) {

return;

@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,

SMMUIOTLBPageInvInfo info = {

.asid = asid, .iova = iova,

+ .vmid = vmid,

.mask = (num_pages * 1 << granule) - 1};

g_hash_table_foreach_remove(s->iotlb,

- smmu_hash_remove_by_asid_iova,

+ smmu_hash_remove_by_asid_vmid_iova,

&info);

}

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

{

dma_addr_t end, addr = CMD_ADDR(cmd);

uint8_t type = CMD_TYPE(cmd);

- uint16_t vmid = CMD_VMID(cmd);

+ int vmid = -1;

uint8_t scale = CMD_SCALE(cmd);

uint8_t num = CMD_NUM(cmd);

uint8_t ttl = CMD_TTL(cmd);

@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

uint64_t num_pages;

uint8_t granule;

int asid = -1;

+ SMMUv3State *smmuv3 = ARM_SMMUV3(s);

+

+ /* Only consider VMID if stage-2 is supported. */

+ if (STAGE2_SUPPORTED(smmuv3)) {

+ vmid = CMD_VMID(cmd);

+ }

if (type == SMMU_CMD_TLBI_NH_VA) {

asid = CMD_ASID(cmd);

@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

if (!tg) {

trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);

smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);

- smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);

+ smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);

@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

num_pages = (mask + 1) >> granule;

trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);

smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);

- smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);

+ smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);

addr += mask + 1;

}

diff --git a/hw/arm/trace-events b/hw/arm/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/trace-events

+++ b/hw/arm/trace-events

@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"

smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"

smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64

smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"

-smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"

-smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"

-smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"

+smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"

+smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"

+smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"

# smmuv3.c

smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"

From: Mostafa Saleh <smostafa@google.com>

In smmuv3_notify_iova, read the granule based on translation stage

and use VMID if valid value is sent.

Signed-off-by: Mostafa Saleh <smostafa@google.com>

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Message-id: 20230516203327.2051088-10-smostafa@google.com

hw/arm/smmuv3.c | 39 ++++++++++++++++++++++++++-------------

hw/arm/trace-events | 2 +-

2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ epilogue:

* @mr: IOMMU mr region handle

* @n: notifier to be called

* @asid: address space ID or negative value if we don't care

+ * @vmid: virtual machine ID or negative value if we don't care

* @iova: iova

* @tg: translation granule (if communicated through range invalidation)

* @num_pages: number of @granule sized pages (if tg != 0), otherwise 1

*/

static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,

IOMMUNotifier *n,

- int asid, dma_addr_t iova,

- uint8_t tg, uint64_t num_pages)

+ int asid, int vmid,

+ dma_addr_t iova, uint8_t tg,

+ uint64_t num_pages)

{

SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);

IOMMUTLBEvent event;

uint8_t granule;

+ SMMUv3State *s = sdev->smmu;

if (!tg) {

SMMUEventInfo event = {.inval_ste_allowed = true};

@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,

return;

}

- tt = select_tt(cfg, iova);

- if (!tt) {

+ if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {

return;

}

- granule = tt->granule_sz;

+

+ if (STAGE1_SUPPORTED(s)) {

+ tt = select_tt(cfg, iova);

+ if (!tt) {

+ return;

+ }

+ granule = tt->granule_sz;

+ } else {

+ granule = cfg->s2cfg.granule_sz;

} else {

granule = tg * 2 + 10;

@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,

memory_region_notify_iommu_one(n, &event);

-/* invalidate an asid/iova range tuple in all mr's */

-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,

- uint8_t tg, uint64_t num_pages)

+/* invalidate an asid/vmid/iova range tuple in all mr's */

+static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,

+ dma_addr_t iova, uint8_t tg,

+ uint64_t num_pages)

{

SMMUDevice *sdev;

@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,

IOMMUMemoryRegion *mr = &sdev->iommu;

IOMMUNotifier *n;

- trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,

- tg, num_pages);

+ trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,

+ iova, tg, num_pages);

IOMMU_NOTIFIER_FOREACH(n, mr) {

- smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);

+ smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);

}

}

}

@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)

if (!tg) {

trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);

- smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);

+ smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);

smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);

@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)

num_pages = (mask + 1) >> granule;

trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);

- smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);

+ smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);

smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);

addr += mask + 1;

}

diff --git a/hw/arm/trace-events b/hw/arm/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/trace-events

+++ b/hw/arm/trace-events

@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"

smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"

smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"

smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"

-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64

+smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64

From: Thomas Huth <thuth@redhat.com>

pflash-cfi02-test.c always uses the "musicpal" machine for testing,

test-arm-mptimer.c always uses the "vexpress-a9" machine, and

microbit-test.c requires the "microbit" machine, so we should only

run these tests if the machines have been enabled in the configuration.

Signed-off-by: Thomas Huth <thuth@redhat.com>

Reviewed-by: Fabiano Rosas <farosas@suse.de>

Message-id: 20230524080600.1618137-1-thuth@redhat.com

tests/qtest/meson.build | 7 ++++---

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build

--- a/tests/qtest/meson.build

+++ b/tests/qtest/meson.build

@@ -XXX,XX +XXX,XX @@ qtests_arm = \

(config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \

(config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \

(config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \

- (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) + \

+ (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and

+ config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \

(config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \

(config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \

(config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \

(config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \

+ (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \

+ (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \

['arm-cpu-features',

- 'microbit-test',

- 'test-arm-mptimer',

'boot-serial-test']

# TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional

From: Mostafa Saleh <smostafa@google.com>

CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the

same as CMD_TLBI_NH_VAA.

CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.

For stage-1 only commands, add a check to throw CERROR_ILL if used

when stage-1 is not supported.

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Signed-off-by: Mostafa Saleh <smostafa@google.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Message-id: 20230516203327.2051088-9-smostafa@google.com

include/hw/arm/smmu-common.h | 1 +

hw/arm/smmu-common.c | 16 +++++++++++

hw/arm/smmuv3.c | 55 ++++++++++++++++++++++++++++++------

hw/arm/trace-events | 4 ++-

4 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h

--- a/include/hw/arm/smmu-common.h

+++ b/include/hw/arm/smmu-common.h

@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,

uint8_t tg, uint8_t level);

void smmu_iotlb_inv_all(SMMUState *s);

void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);

+void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);

void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,

uint8_t tg, uint64_t num_pages, uint8_t ttl);

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmu-common.c

+++ b/hw/arm/smmu-common.c

@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,

return SMMU_IOTLB_ASID(*iotlb_key) == asid;

}

+static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,

+ gpointer user_data)

+{

+ uint16_t vmid = *(uint16_t *)user_data;

+ SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;

+ return SMMU_IOTLB_VMID(*iotlb_key) == vmid;

static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,

gpointer user_data)

@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)

g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);

}

+inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)

+{

+ trace_smmu_iotlb_inv_vmid(vmid);

+ g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);

+}

+

/* VMSAv8-64 Translation */

/**

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmuv3.c

+++ b/hw/arm/smmuv3.c

@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,

}

}

-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

+static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)

{

dma_addr_t end, addr = CMD_ADDR(cmd);

uint8_t type = CMD_TYPE(cmd);

@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

}

if (!tg) {

- trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);

+ trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);

smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);

smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);

return;

@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)

uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);

num_pages = (mask + 1) >> granule;

- trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);

+ trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);

smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);

smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);

addr += mask + 1;

@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)

{

uint16_t asid = CMD_ASID(&cmd);

+ if (!STAGE1_SUPPORTED(s)) {

+ cmd_error = SMMU_CERROR_ILL;

+ break;

+ }

+

trace_smmuv3_cmdq_tlbi_nh_asid(asid);

smmu_inv_notifiers_all(&s->smmu_state);

smmu_iotlb_inv_asid(bs, asid);

break;

}

case SMMU_CMD_TLBI_NH_ALL:

+ if (!STAGE1_SUPPORTED(s)) {

+ cmd_error = SMMU_CERROR_ILL;

+ break;

+ }

+ QEMU_FALLTHROUGH;

case SMMU_CMD_TLBI_NSNH_ALL:

trace_smmuv3_cmdq_tlbi_nh();

smmu_inv_notifiers_all(&s->smmu_state);

@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)

break;

case SMMU_CMD_TLBI_NH_VAA:

case SMMU_CMD_TLBI_NH_VA:

- smmuv3_s1_range_inval(bs, &cmd);

+ if (!STAGE1_SUPPORTED(s)) {

+ cmd_error = SMMU_CERROR_ILL;

+ break;

+ }

+ smmuv3_range_inval(bs, &cmd);

+ break;

+ case SMMU_CMD_TLBI_S12_VMALL:

+ {

+ uint16_t vmid = CMD_VMID(&cmd);

+

+ if (!STAGE2_SUPPORTED(s)) {

+ cmd_error = SMMU_CERROR_ILL;

+ break;

+ }

+

+ trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);

+ smmu_inv_notifiers_all(&s->smmu_state);

+ smmu_iotlb_inv_vmid(bs, vmid);

+ break;

+ }

+ case SMMU_CMD_TLBI_S2_IPA:

+ if (!STAGE2_SUPPORTED(s)) {

+ cmd_error = SMMU_CERROR_ILL;

+ break;

+ }

+ /*

+ * As currently only either s1 or s2 are supported

+ * we can reuse same function for s2.

+ */

+ smmuv3_range_inval(bs, &cmd);

break;

case SMMU_CMD_TLBI_EL3_ALL:

case SMMU_CMD_TLBI_EL3_VA:

@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)

case SMMU_CMD_TLBI_EL2_ASID:

case SMMU_CMD_TLBI_EL2_VA:

case SMMU_CMD_TLBI_EL2_VAA:

- case SMMU_CMD_TLBI_S12_VMALL:

- case SMMU_CMD_TLBI_S2_IPA:

case SMMU_CMD_ATC_INV:

case SMMU_CMD_PRI_RESP:

case SMMU_CMD_RESUME:

@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)

break;

default:

cmd_error = SMMU_CERROR_ILL;

- qemu_log_mask(LOG_GUEST_ERROR,

- "Illegal command type: %d\n", CMD_TYPE(&cmd));

break;

}

qemu_mutex_unlock(&s->mutex);

if (cmd_error) {

+ if (cmd_error == SMMU_CERROR_ILL) {

+ qemu_log_mask(LOG_GUEST_ERROR,

+ "Illegal command type: %d\n", CMD_TYPE(&cmd));

+ }

break;

}

/*

diff --git a/hw/arm/trace-events b/hw/arm/trace-events

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/trace-events

+++ b/hw/arm/trace-events

@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui

smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64

smmu_iotlb_inv_all(void) "IOTLB invalidate all"

smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"

+smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"

smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64

smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"

smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"

@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"

smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"

smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"

smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"

-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"

+smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"

smmuv3_cmdq_tlbi_nh(void) ""

smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"

+smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"

smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"

smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"

smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add Stage-2 PTW code.

Only Aarch64 format is supported as stage-1.

Nesting stage-1 and stage-2 is not supported right now.

HTTU is not supported, SW is expected to maintain the Access flag.

This is described in the SMMUv3 manual(IHI 0070.E.a)

"5.2. Stream Table Entry" in "[181] S2AFFD".

This flag determines the behavior on access of a stage-2 page whose

descriptor has AF == 0:

- 0b0: An Access flag fault occurs (stall not supported).

- 0b1: An Access flag fault never occurs.

An Access fault takes priority over a Permission fault.

There are 3 address size checks for stage-2 according to

(IHI 0070.E.a) in "3.4. Address sizes".

- As nesting is not supported, input address is passed directly to

stage-2, and is checked against IAS.

We use cfg->oas to hold the OAS when stage-1 is not used, this is set

in the next patch.

This check is done outside of smmu_ptw_64_s2 as it is not part of

stage-2(it throws stage-1 fault), and the stage-2 function shouldn't

change it's behavior when nesting is supported.

When nesting is supported and we figure out how to combine TLB for

stage-1 and stage-2 we can move this check into the stage-1 function

as described in ARM DDI0487I.a in pseudocode

aarch64/translation/vmsa_translation/AArch64.S1Translate

aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput

- Input to stage-2 is checked against s2t0sz, and throws stage-2

transaltion fault if exceeds it.

- Output of stage-2 is checked against effective PA output range.

Reviewed-by: Eric Auger <eric.auger@redhat.com>

Signed-off-by: Mostafa Saleh <smostafa@google.com>

Tested-by: Eric Auger <eric.auger@redhat.com>

Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>

Message-id: 20230516203327.2051088-5-smostafa@google.com

hw/arm/smmu-internal.h | 35 ++++++++++

hw/arm/smmu-common.c | 142 ++++++++++++++++++++++++++++++++++++++++-

2 files changed, 176 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h

--- a/hw/arm/smmu-internal.h

+++ b/hw/arm/smmu-internal.h

@@ -XXX,XX +XXX,XX @@

#define PTE_APTABLE(pte) \

(extract64(pte, 61, 2))

+#define PTE_AF(pte) \

+ (extract64(pte, 10, 1))

/*

* TODO: At the moment all transactions are considered as privileged (EL1)

* as IOMMU translation callback does not pass user/priv attributes.

@@ -XXX,XX +XXX,XX @@

#define is_permission_fault(ap, perm) \

(((perm) & IOMMU_WO) && ((ap) & 0x2))

+#define is_permission_fault_s2(s2ap, perm) \

+ (!(((s2ap) & (perm)) == (perm)))

#define PTE_AP_TO_PERM(ap) \

(IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))

@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,

MAKE_64BIT_MASK(0, gsz - 3);

+/* FEAT_LPA2 and FEAT_TTST are not implemented. */

+static inline int get_start_level(int sl0 , int granule_sz)

+ /* ARM DDI0487I.a: Table D8-12. */

+ if (granule_sz == 12) {

+ return 2 - sl0;

+ /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */

+ return 3 - sl0;

+/*

+ * Index in a concatenated first level stage-2 page table.

+ * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.

+ */

+static inline int pgd_concat_idx(int start_level, int granule_sz,

+ dma_addr_t ipa)

+{

+ uint64_t ret;

+ /*

+ * Get the number of bits handled by next levels, then any extra bits in

+ * the address should index the concatenated tables. This relation can be

+ * deduced from tables in ARM DDI0487I.a: D8.2.7-9

+ */

+ int shift = level_shift(start_level - 1, granule_sz);

+

+ ret = ipa >> shift;

+ return ret;

+}

+

#define SMMU_IOTLB_ASID(key) ((key).asid)

typedef struct SMMUIOTLBPageInvInfo {

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmu-common.c

+++ b/hw/arm/smmu-common.c

@@ -XXX,XX +XXX,XX @@ error:

return -EINVAL;

}

+/**

+ * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa

+ * for stage-2.

+ * @cfg: translation config

+ * @ipa: ipa to translate

+ * @perm: access type

+ * @tlbe: SMMUTLBEntry (out)

+ * @info: handle to an error info

+ *

+ * Return 0 on success, < 0 on error. In case of error, @info is filled

+ * and tlbe->perm is set to IOMMU_NONE.

+ * Upon success, @tlbe is filled with translated_addr and entry

+ * permission rights.

+ */

+static int smmu_ptw_64_s2(SMMUTransCfg *cfg,

+ dma_addr_t ipa, IOMMUAccessFlags perm,

+ SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)

+{

+ const int stage = 2;

+ int granule_sz = cfg->s2cfg.granule_sz;

+ /* ARM DDI0487I.a: Table D8-7. */

+ int inputsize = 64 - cfg->s2cfg.tsz;

+ int level = get_start_level(cfg->s2cfg.sl0, granule_sz);

+ int stride = VMSA_STRIDE(granule_sz);

+ int idx = pgd_concat_idx(level, granule_sz, ipa);

+ /*

+ * Get the ttb from concatenated structure.

+ * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))

+ */

+ uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *

+ idx * sizeof(uint64_t);

+ dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);

+

+ baseaddr &= ~indexmask;

+

+ /*

+ * On input, a stage 2 Translation fault occurs if the IPA is outside the

+ * range configured by the relevant S2T0SZ field of the STE.

+ */

+ if (ipa >= (1ULL << inputsize)) {

+ info->type = SMMU_PTW_ERR_TRANSLATION;

+ goto error;

+ }

+

+ while (level < VMSA_LEVELS) {

+ uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);

+ uint64_t mask = subpage_size - 1;

+ uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);

+ uint64_t pte, gpa;

+ dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);

+ uint8_t s2ap;

+

+ if (get_pte(baseaddr, offset, &pte, info)) {

+ goto error;

+ }

+ trace_smmu_ptw_level(stage, level, ipa, subpage_size,

+ baseaddr, offset, pte);

+ if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {

+ trace_smmu_ptw_invalid_pte(stage, level, baseaddr,

+ pte_addr, offset, pte);

+ break;

+ }

+

+ if (is_table_pte(pte, level)) {

+ baseaddr = get_table_pte_address(pte, granule_sz);

+ level++;

+ continue;

+ } else if (is_page_pte(pte, level)) {

+ gpa = get_page_pte_address(pte, granule_sz);

+ trace_smmu_ptw_page_pte(stage, level, ipa,

+ baseaddr, pte_addr, pte, gpa);

+ } else {

+ uint64_t block_size;

+

+ gpa = get_block_pte_address(pte, level, granule_sz,

+ &block_size);