From nobody Fri Oct 23 20:55:19 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1792652279; cv=none; d=zohomail.com; s=zohoarc; b=KsTtu1K+y+bpMDvfi/2AtlfrWJyuqRyUwklnC9NM3ZwnBErluMnBywnQyKTcQdTbFIQuyO/POoEGPKDxFYnVHznFbam25tsxiMFCNJioFeLtX2kNnZ2FZgBGWZTSe4H3QsGJQijnj7qTbdumwzBQRUGvw/jSYbHs0HiIrn/3dy8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1792652279; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=uaZ92pSw4E8Hk4k2weVirTCg0rZzmsr2yzkfmVPAnMw=; b=CdxSOu2VuZmmyKQhYIP+zq8+dQ7WMLIaohfhpy+oaOVFlsey36ZR69HMNVQNRpRf8ot//9aCzXNNcpusZIjTEHbG3dRJh6iclvK7xqfZTkFOg8Dizc/4SKbmRbwhxsC2N8YwxBB2Gigqp+nSPy4bh+n/Scj6svSJHxq1o176ccs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1792652279338192.80826489206117; Wed, 21 Oct 2026 23:57:59 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1xJmk4-00020U-HA; Thu, 22 Oct 2026 02:57:36 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1xJmjm-0001z6-PE for qemu-devel@nongnu.org; Thu, 22 Oct 2026 02:57:19 -0400 Received: from mail-pj2-x0b.google.com ([2607:f8b0:4864:39::b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1xJmji-0005Uf-1f for qemu-devel@nongnu.org; Thu, 22 Oct 2026 02:57:16 -0400 Received: by mail-pj2-x0b.google.com with SMTP id 98e67ed59e1d1-3ad6011ecebso394067a91.1 for ; Wed, 21 Oct 2026 23:57:12 -0700 (PDT) Received: from Dell-WorkStation.localdomain ([191.96.240.159]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ad85fbee3asm3065154a91.3.2026.10.21.23.57.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 21 Oct 2026 23:57:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792652231; x=1793257031; darn=nongnu.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=uaZ92pSw4E8Hk4k2weVirTCg0rZzmsr2yzkfmVPAnMw=; b=Vaw+aNLOQ7TpstZAPzIcOq3he6d/E1HMg23TUQ1UaMFNt7mCr6kDKzolaIKKGJ9AEw obHpMS2e+58HXeu48yH1Jvr1Pu5vJfRQp33Ce/M75zRO+4jmkZrhuZVorrYIJRH56PB9 owBcsbVvKOHtZ58jFm5VCjrXnmB/NufBN+bC+U4E9HKzfv+toY+BK64lD83BKoReuSUB 2zEIu11dVWHmBq+Ugu/hEYLDfsOQFnLy4dO/MnPMvBr72M5A0i8pcSjfRZ/VcvK6rHwZ j0pnLvGfurvNTWaI6f9iN2Wr7dZ+YQUXsftE6rtw3AA6rFuiWm23tnyftD/ADSlCrSz3 ixog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792652231; x=1793257031; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=uaZ92pSw4E8Hk4k2weVirTCg0rZzmsr2yzkfmVPAnMw=; b=CSJbSnyFimd8jpDJpInQ5DcEWTxYLT4UNwEgvxa0MgzfN2EVK+lFQGA72/sYGnl7T9 mrMrN4CLQ54EUJISr5aSFZJle4z9GQhWbYjA7EO2BlG/J3/Mxy9cSH2IFyDuU42N1rzS 5Bsjv1Xi9M/JZU8dleL9dCSUEY7ZJldaMu6l3kOU0CF7FFBWKsLZi86mUMPBm65T9gVz LhXtZQD2UKyIMAo9nMHyEfFOqfpCmWKGIJEWn9Hs19Oq2BEuMNhRnSOoqGOsnOOuxNfg qWTnaBW328bym+ay1EP2qYn0G6yVcPXsMFplBoXCp9LHCJza2Zk2+Btgow2jZ4Sjmv1S XuaQ== X-Gm-Message-State: AFq9FYLx65fHX6yClPN+qgT7ESTHTrZ2wcfN9zL0U9QahFcjvYgJvc0+ b9WKOUZbGcXHkDZX6Wrt7vyp0B8VApXhj+3me8usjenuZmv5YiEZ1b67is8t2EUZqhu3fQ== X-Gm-Gg: AYBFou1LLYGbStWsCJcCIPbclc/10bhj7Elo75jOGirXHBupX7oL/5gVu3XLFUCjEIJ AQLDoHFT5IBe5YJy5yCbEwEiVONTr/W6rIRQ0gm0lNMF5hB+03Lt0U6gSU6OK5L59O20NNxaoLb 1A8wqW0DvT47Z2KihWPJQpJEbRthNQGeemtohcjNW2UMlr0ouWkDPPrpNogszuheu8QKqs7vft5 XFST5ptfPmvkUSc6n4mSWWGglvY0jmekjqP+4Wih17L/DoJfq69i1hDjt+bQlQCg9joI8D76jp0 nEzqrKIkbS4LsSVHYOVnDoFJKCGzDLU49GtwRqBE9FZVVc+gLBIwmiU0M+wWLrE2Rq/ceAlJoWW bsCZFXphwGZ/zZVqdNvSk6iQ4A0BxZzIvIsAXk4zyT8DgW17goWUN02EjV9xtjNyevuSa6uNCDL P8hvyP7h2bGhDW3rGNTZ4KSn8go1ODg56lNRJYVoreFlyVDqQTadEAT9ACTSn0JbDvpko+RITpr nphmVrXEiYT0emtdlQg1Gmd3NBlsFIgDPzfh0E2/EXgQplFMhkzI8758WwApxcgN23CS20MkH3P hgy3pI5p7w== X-Received: by 2002:a17:90b:3ec5:b0:3ab:e588:c288 with SMTP id 98e67ed59e1d1-3ad86e9e4cdmr3907851a91.11.1792652230429; Wed, 21 Oct 2026 23:57:10 -0700 (PDT) From: Zephyr Li To: qemu-devel@nongnu.org Cc: qemu-riscv@nongnu.org, palmer@dabbelt.com, daniel.barboza@oss.qualcomm.com, liwei1518@gmail.com, zhiwei_liu@linux.alibaba.com, chao.liu@processmission.com, farosas@suse.de, lvivier@redhat.com, pbonzini@redhat.com, Zephyr Li Subject: [PATCH v2] hw/riscv/riscv-iommu: encode debug translation ranges Date: Thu, 22 Oct 2026 14:56:47 +0800 Message-ID: <20261022065647.67150-1-fritchleybohrer@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=2607:f8b0:4864:39::b; envelope-from=fritchleybohrer@gmail.com; helo=mail-pj2-x0b.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1792652282220158500 Content-Type: text/plain; charset="utf-8" The debug translation response aligns the translated physical address to the effective translation range, but always reports S=3D0. For a request inside a superpage, the response therefore identifies the wrong 4 KiB physical page. For effective ranges larger than 4 KiB, set S and encode the range size using trailing ones in the PPN field. Keep the existing response format for 4 KiB translations. The RISC-V IOMMU specification permits reporting a 4 KiB translation even when the page tables use superpages. Reporting the effective range is an implementation choice; this change does not claim that S=3D1 is mandatory for every translation through a superpage mapping. Add debug-response tests for S-stage-only 4 KiB, 64 KiB NAPOT, and 2 MiB translations, G-stage-only 2 MiB translations, and nested S4K/G2M, S2M/G4K, and S2M/G2M mappings. Check requests inside large ranges and at both ends. The mixed nested cases verify that the response uses the smaller effective translation granularity. Fixes: a7aa525b93c3 ("hw/riscv/riscv-iommu: add DBG support") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3552 Signed-off-by: Zephyr Li Reviewed-by: Daniel Henrique Barboza --- Changes in v2: - Regenerate the patch from the source tree to correct malformed hunk metad= ata. - No functional changes. --- hw/riscv/riscv-iommu.c | 14 ++- tests/qtest/iommu-riscv-test.c | 193 +++++++++++++++++++++++++++++++++ 2 files changed, 206 insertions(+), 1 deletion(-) diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 323a041b4a..67d8456b9d 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -2281,8 +2281,20 @@ static void riscv_iommu_process_dbg(RISCVIOMMUState = *s) if (fault) { iova =3D RISCV_IOMMU_TR_RESPONSE_FAULT | (((uint64_t) fault) <= < 10); } else { + uint64_t ppn; + iova =3D iotlb.translated_addr & ~iotlb.addr_mask; - iova =3D set_field(0, RISCV_IOMMU_TR_RESPONSE_PPN, PPN_DOWN(io= va)); + ppn =3D PPN_DOWN(iova); + + if (iotlb.addr_mask > TARGET_PAGE_SIZE - 1) { + /* Encode the translation range as trailing ones in the PP= N. */ + ppn |=3D PPN_DOWN(iotlb.addr_mask) >> 1; + iova =3D RISCV_IOMMU_TR_RESPONSE_S; + } else { + iova =3D 0; + } + + iova =3D set_field(iova, RISCV_IOMMU_TR_RESPONSE_PPN, ppn); } riscv_iommu_reg_set64(s, RISCV_IOMMU_REG_TR_RESPONSE, iova); } diff --git a/tests/qtest/iommu-riscv-test.c b/tests/qtest/iommu-riscv-test.c index 2638024891..1cd753c4f2 100644 --- a/tests/qtest/iommu-riscv-test.c +++ b/tests/qtest/iommu-riscv-test.c @@ -19,6 +19,12 @@ =20 #define DMA_LEN 4 =20 +#define DBG_PAGE_SIZE 0x1000ull +#define DBG_NAPOT_SIZE 0x10000ull +#define DBG_SUPERPAGE_SIZE 0x200000ull +#define DBG_TRANSLATED_PA 0x90000000ull +#define DBG_NESTED_GPA 0x200000ull + /* RISC-V virt machine PCI configuration */ #define RISCV_GPEX_PIO_BASE 0x3000000 #define RISCV_BUS_PIO_LIMIT 0x10000 @@ -35,6 +41,64 @@ typedef struct RiscvIommuTestState { uint64_t iommu_base; } RiscvIommuTestState; =20 +typedef struct RiscvIommuDbgTest { + const char *name; + QRIOMMUTransMode mode; + uint64_t s_page_size; + uint64_t g_page_size; + uint64_t pa; + uint64_t expected_response; +} RiscvIommuDbgTest; + +static const RiscvIommuDbgTest debug_tests[] =3D { + { + .name =3D "page-4k", + .mode =3D QRIOMMU_TM_S_STAGE_ONLY, + .s_page_size =3D DBG_PAGE_SIZE, + .pa =3D DBG_TRANSLATED_PA + DBG_PAGE_SIZE, + .expected_response =3D 0x24000400ull, + }, { + .name =3D "napot-64k", + .mode =3D QRIOMMU_TM_S_STAGE_ONLY, + .s_page_size =3D DBG_NAPOT_SIZE, + .pa =3D DBG_TRANSLATED_PA, + .expected_response =3D 0x24001e00ull, + }, { + .name =3D "superpage", + .mode =3D QRIOMMU_TM_S_STAGE_ONLY, + .s_page_size =3D DBG_SUPERPAGE_SIZE, + .pa =3D DBG_TRANSLATED_PA, + .expected_response =3D 0x2403fe00ull, + }, { + .name =3D "g-stage-superpage", + .mode =3D QRIOMMU_TM_G_STAGE_ONLY, + .g_page_size =3D DBG_SUPERPAGE_SIZE, + .pa =3D DBG_TRANSLATED_PA, + .expected_response =3D 0x2403fe00ull, + }, { + .name =3D "nested-s4k-g2m", + .mode =3D QRIOMMU_TM_NESTED, + .s_page_size =3D DBG_PAGE_SIZE, + .g_page_size =3D DBG_SUPERPAGE_SIZE, + .pa =3D DBG_TRANSLATED_PA, + .expected_response =3D 0x24001000ull, + }, { + .name =3D "nested-s2m-g4k", + .mode =3D QRIOMMU_TM_NESTED, + .s_page_size =3D DBG_SUPERPAGE_SIZE, + .g_page_size =3D DBG_PAGE_SIZE, + .pa =3D DBG_TRANSLATED_PA, + .expected_response =3D 0x24001000ull, + }, { + .name =3D "nested-s2m-g2m", + .mode =3D QRIOMMU_TM_NESTED, + .s_page_size =3D DBG_SUPERPAGE_SIZE, + .g_page_size =3D DBG_SUPERPAGE_SIZE, + .pa =3D DBG_TRANSLATED_PA, + .expected_response =3D 0x2403fe00ull, + }, +}; + static void riscv_config_qpci_bus(QGenericPCIBus *qpci) { qpci->gpex_pio_base =3D RISCV_GPEX_PIO_BASE; @@ -264,6 +328,129 @@ static void test_riscv_iommu_nested(void) run_riscv_iommu_translation(&cfg); } =20 +static void riscv_iommu_dbg_map_leaf(QTestState *qts, uint64_t l1_pa, + uint64_t l2_pa, uint64_t va, uint64_t = pa, + uint64_t page_size) +{ + uint64_t pte =3D ((pa >> 12) << 10) | QRIOMMU_LEAF_PTE_RW_MASK; + uint64_t pte_addr; + + g_assert_cmphex(pa & (page_size - 1), =3D=3D, 0); + + if (page_size =3D=3D DBG_SUPERPAGE_SIZE) { + pte_addr =3D l1_pa + (((va >> 21) & 0x1ff) * sizeof(uint64_t)); + qtest_writeq(qts, pte_addr, pte); + } else if (page_size =3D=3D DBG_NAPOT_SIZE) { + /* A 64 KiB NAPOT PTE has N=3D1 and PPN[3:0]=3D1000. */ + pte |=3D BIT_ULL(63) | (8ull << 10); + va &=3D ~(DBG_NAPOT_SIZE - 1); + for (unsigned i =3D 0; i < DBG_NAPOT_SIZE / DBG_PAGE_SIZE; i++) { + pte_addr =3D l2_pa + ((((va >> 12) + i) & 0x1ff) * + sizeof(uint64_t)); + qtest_writeq(qts, pte_addr, pte); + } + } else { + g_assert_cmphex(page_size, =3D=3D, DBG_PAGE_SIZE); + pte_addr =3D l2_pa + (((va >> 12) & 0x1ff) * sizeof(uint64_t)); + qtest_writeq(qts, pte_addr, pte); + } +} + +static uint64_t riscv_iommu_dbg_translate(RiscvIommuTestState *state, + uint64_t iova) +{ + uint64_t request; + + qtest_writeq(state->qts, + state->iommu_base + RISCV_IOMMU_REG_TR_REQ_IOVA, iova); + request =3D ((uint64_t)state->testdev->devfn << 40) | + RISCV_IOMMU_TR_REQ_CTL_GO_BUSY; + qtest_writeq(state->qts, + state->iommu_base + RISCV_IOMMU_REG_TR_REQ_CTL, request); + + request =3D qtest_readq(state->qts, + state->iommu_base + RISCV_IOMMU_REG_TR_REQ_CTL); + g_assert_cmpuint(request & RISCV_IOMMU_TR_REQ_CTL_GO_BUSY, =3D=3D, 0); + + return qtest_readq(state->qts, + state->iommu_base + RISCV_IOMMU_REG_TR_RESPONSE); +} + +static void test_riscv_iommu_dbg(gconstpointer data) +{ + const RiscvIommuDbgTest *cfg =3D data; + RiscvIommuTestState state =3D { 0 }; + uint64_t iova =3D QRIOMMU_IOVA & ~(DBG_PAGE_SIZE - 1); + uint64_t s_pa =3D cfg->pa; + uint64_t page_size =3D cfg->mode =3D=3D QRIOMMU_TM_G_STAGE_ONLY ? + cfg->g_page_size : cfg->s_page_size; + uint64_t response; + + if (!riscv_iommu_test_setup(&state)) { + return; + } + + riscv_iommu_check(state.qts, state.iommu_base, cfg->mode); + qriommu_build_translation(state.qts, cfg->mode, state.testdev->devfn); + + if (cfg->mode =3D=3D QRIOMMU_TM_NESTED) { + uint64_t g_l1_pa =3D QRIOMMU_SPACE_OFFS + QRIOMMU_G_L0_PTE_VAL; + uint64_t g_l2_pa =3D QRIOMMU_SPACE_OFFS + QRIOMMU_G_L1_PTE_VAL; + uint64_t offset =3D iova & (DBG_SUPERPAGE_SIZE - 1); + uint64_t gpa =3D DBG_NESTED_GPA + offset; + uint64_t pte_addr; + uint64_t pte; + + /* Map all S-stage page tables through one 2 MiB G-stage leaf. */ + riscv_iommu_dbg_map_leaf(state.qts, g_l1_pa, g_l2_pa, 0, + QRIOMMU_SPACE_OFFS, DBG_SUPERPAGE_SIZE); + + if (cfg->g_page_size =3D=3D DBG_PAGE_SIZE) { + pte_addr =3D g_l1_pa + (((gpa >> 21) & 0x1ff) * sizeof(uint64_= t)); + pte =3D ((g_l2_pa >> 12) << 10) | QRIOMMU_NON_LEAF_PTE_MASK; + qtest_writeq(state.qts, pte_addr, pte); + } + riscv_iommu_dbg_map_leaf(state.qts, g_l1_pa, g_l2_pa, gpa, + cfg->pa + (offset & ~(cfg->g_page_size - = 1)), + cfg->g_page_size); + s_pa =3D gpa & ~(cfg->s_page_size - 1); + page_size =3D MIN(page_size, cfg->g_page_size); + } + + if (cfg->mode =3D=3D QRIOMMU_TM_G_STAGE_ONLY) { + riscv_iommu_dbg_map_leaf(state.qts, + QRIOMMU_SPACE_OFFS + QRIOMMU_G_L0_PTE_VAL, + QRIOMMU_SPACE_OFFS + QRIOMMU_G_L1_PTE_VAL, + iova, cfg->pa, cfg->g_page_size); + } else { + riscv_iommu_dbg_map_leaf(state.qts, + QRIOMMU_SPACE_OFFS + QRIOMMU_L0_PTE_VAL, + QRIOMMU_SPACE_OFFS + QRIOMMU_L1_PTE_VAL, + iova, s_pa, cfg->s_page_size); + } + qriommu_program_regs(state.qts, state.iommu_base); + + /* + * The spec permits reporting a smaller range. These tests check QEMU's + * choice to report the effective range returned by an uncached walk. + * No DMA precedes these requests, and debug requests do not fill the = IOTLB. + */ + response =3D riscv_iommu_dbg_translate(&state, iova); + g_assert_cmphex(response, =3D=3D, cfg->expected_response); + + if (page_size > DBG_PAGE_SIZE) { + /* Check both ends as well as the interior of the reported range. = */ + iova &=3D ~(page_size - 1); + response =3D riscv_iommu_dbg_translate(&state, iova); + g_assert_cmphex(response, =3D=3D, cfg->expected_response); + response =3D riscv_iommu_dbg_translate(&state, + iova + page_size - DBG_PAGE_SI= ZE); + g_assert_cmphex(response, =3D=3D, cfg->expected_response); + } + + riscv_iommu_test_teardown(&state); +} + int main(int argc, char **argv) { g_test_init(&argc, &argv, NULL); @@ -275,5 +462,11 @@ int main(int argc, char **argv) test_riscv_iommu_g_stage_only); qtest_add_func("/iommu-testdev/translation/ns-nested", test_riscv_iommu_nested); + for (unsigned i =3D 0; i < G_N_ELEMENTS(debug_tests); i++) { + g_autofree char *path =3D g_strdup_printf("/iommu-testdev/debug/%s= ", + debug_tests[i].name); + + qtest_add_data_func(path, &debug_tests[i], test_riscv_iommu_dbg); + } return g_test_run(); } --=20 2.43.0