* [Qemu-devel] [V6 0/4] AMD IOMMU
@ 2016-02-21 18:10 David Kiarie
2016-02-21 18:10 ` [Qemu-devel] [V6 1/4] hw/i386: Introduce " David Kiarie
` (5 more replies)
0 siblings, 6 replies; 53+ messages in thread
From: David Kiarie @ 2016-02-21 18:10 UTC (permalink / raw)
To: qemu-devel; +Cc: marcel, valentine.sinitsyn, jan.kiszka, David Kiarie, mst
Hello there,
Repost, AMD IOMMU patches version 6.
Changes since version 5
-Fixed macro formating issues
-changed occurences of IO MMU to IOMMU for consistency
-Fixed capability registers duplication
-Rebased to current master
David Kiarie (4):
hw/i386: Introduce AMD IOMMU
hw/core: Add AMD IOMMU to machine properties
hw/i386: ACPI table for AMD IOMMU
hw/pci-host: Emulate AMD IOMMU
hw/core/machine.c | 28 +-
hw/i386/Makefile.objs | 1 +
hw/i386/acpi-build.c | 208 +++++-
hw/i386/amd_iommu.c | 1432 +++++++++++++++++++++++++++++++++++++++++
hw/i386/amd_iommu.h | 395 ++++++++++++
hw/pci-host/piix.c | 1 +
hw/pci-host/q35.c | 14 +-
include/hw/acpi/acpi-defs.h | 55 ++
include/hw/boards.h | 3 +-
include/hw/i386/intel_iommu.h | 1 +
include/hw/pci/pci.h | 2 +
qemu-options.hx | 6 +-
util/qemu-config.c | 4 +-
13 files changed, 2123 insertions(+), 27 deletions(-)
create mode 100644 hw/i386/amd_iommu.c
create mode 100644 hw/i386/amd_iommu.h
--
2.1.4
^ permalink raw reply [flat|nested] 53+ messages in thread
* [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
@ 2016-02-21 18:10 ` David Kiarie
2016-02-25 15:43 ` Marcel Apfelbaum
2016-02-21 18:10 ` [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties David Kiarie
` (4 subsequent siblings)
5 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-02-21 18:10 UTC (permalink / raw)
To: qemu-devel; +Cc: marcel, valentine.sinitsyn, jan.kiszka, David Kiarie, mst
Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
The IOMMU does basic translation, error checking and has a
mininal IOTLB implementation
Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
---
hw/i386/Makefile.objs | 1 +
hw/i386/amd_iommu.c | 1432 +++++++++++++++++++++++++++++++++++++++++++++++++
hw/i386/amd_iommu.h | 395 ++++++++++++++
include/hw/pci/pci.h | 2 +
4 files changed, 1830 insertions(+)
create mode 100644 hw/i386/amd_iommu.c
create mode 100644 hw/i386/amd_iommu.h
diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
index b52d5b8..2f1a265 100644
--- a/hw/i386/Makefile.objs
+++ b/hw/i386/Makefile.objs
@@ -3,6 +3,7 @@ obj-y += multiboot.o
obj-y += pc.o pc_piix.o pc_q35.o
obj-y += pc_sysfw.o
obj-y += intel_iommu.o
+obj-y += amd_iommu.o
obj-$(CONFIG_XEN) += ../xenpv/ xen/
obj-y += kvmvapic.o
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
new file mode 100644
index 0000000..3dac043
--- /dev/null
+++ b/hw/i386/amd_iommu.c
@@ -0,0 +1,1432 @@
+/*
+ * QEMU emulation of AMD IOMMU (AMD-Vi)
+ *
+ * Copyright (C) 2011 Eduard - Gabriel Munteanu
+ * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Cache implementation inspired by hw/i386/intel_iommu.c
+ *
+ */
+#include "hw/i386/amd_iommu.h"
+
+/*#define DEBUG_AMD_IOMMU*/
+#ifdef DEBUG_AMD_IOMMU
+enum {
+ DEBUG_GENERAL, DEBUG_CAPAB, DEBUG_MMIO, DEBUG_ELOG,
+ DEBUG_CACHE, DEBUG_COMMAND, DEBUG_MMU
+};
+
+#define IOMMU_DBGBIT(x) (1 << DEBUG_##x)
+static int iommu_dbgflags = IOMMU_DBGBIT(MMIO);
+
+#define IOMMU_DPRINTF(what, fmt, ...) do { \
+ if (iommu_dbgflags & IOMMU_DBGBIT(what)) { \
+ fprintf(stderr, "(amd-iommu)%s: " fmt "\n", __func__, \
+ ## __VA_ARGS__); } \
+ } while (0)
+#else
+#define IOMMU_DPRINTF(what, fmt, ...) do {} while (0)
+#endif
+
+typedef struct AMDIOMMUAddressSpace {
+ uint8_t bus_num; /* bus number */
+ uint8_t devfn; /* device function */
+ AMDIOMMUState *iommu_state; /* IOMMU - one per machine */
+ MemoryRegion iommu; /* Device's iommu region */
+ AddressSpace as; /* device's corresponding address space */
+} AMDIOMMUAddressSpace;
+
+/* IOMMU cache entry */
+typedef struct IOMMUIOTLBEntry {
+ uint64_t gfn;
+ uint16_t domid;
+ uint64_t devid;
+ uint64_t perms;
+ uint64_t translated_addr;
+} IOMMUIOTLBEntry;
+
+/* configure MMIO registers at startup/reset */
+static void amd_iommu_set_quad(AMDIOMMUState *s, hwaddr addr, uint64_t val,
+ uint64_t romask, uint64_t w1cmask)
+{
+ stq_le_p(&s->mmior[addr], val);
+ stq_le_p(&s->romask[addr], romask);
+ stq_le_p(&s->w1cmask[addr], w1cmask);
+}
+
+static uint16_t amd_iommu_readw(AMDIOMMUState *s, hwaddr addr)
+{
+ return lduw_le_p(&s->mmior[addr]);
+}
+
+static uint32_t amd_iommu_readl(AMDIOMMUState *s, hwaddr addr)
+{
+ return ldl_le_p(&s->mmior[addr]);
+}
+
+static uint64_t amd_iommu_readq(AMDIOMMUState *s, hwaddr addr)
+{
+ return ldq_le_p(&s->mmior[addr]);
+}
+
+/* internal write */
+static void amd_iommu_writeq_raw(AMDIOMMUState *s, uint64_t val, hwaddr addr)
+{
+ stq_le_p(&s->mmior[addr], val);
+}
+
+/* external write */
+static void amd_iommu_writew(AMDIOMMUState *s, hwaddr addr, uint16_t val)
+{
+ uint16_t romask = lduw_le_p(&s->romask[addr]);
+ uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
+ uint16_t oldval = lduw_le_p(&s->mmior[addr]);
+ stw_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask & oldval));
+}
+
+static void amd_iommu_writel(AMDIOMMUState *s, hwaddr addr, uint32_t val)
+{
+ uint32_t romask = ldl_le_p(&s->romask[addr]);
+ uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
+ uint32_t oldval = ldl_le_p(&s->mmior[addr]);
+ stl_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask & oldval));
+}
+
+static void amd_iommu_writeq(AMDIOMMUState *s, hwaddr addr, uint64_t val)
+{
+ uint64_t romask = ldq_le_p(&s->romask[addr]);
+ uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
+ uint32_t oldval = ldq_le_p(&s->mmior[addr]);
+ stq_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask & oldval));
+}
+
+static void amd_iommu_log_event(AMDIOMMUState *s, uint16_t *evt)
+{
+ /* event logging not enabled */
+ if (!s->evtlog_enabled || *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |
+ IOMMU_MMIO_STATUS_EVT_OVF) {
+ return;
+ }
+
+ /* event log buffer full */
+ if (s->evtlog_tail >= s->evtlog_len) {
+ *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_EVT_OVF;
+ /* generate interrupt */
+ msi_notify(&s->dev, 0);
+ }
+
+ if (dma_memory_write(&address_space_memory, s->evtlog_len + s->evtlog_tail,
+ &evt, IOMMU_EVENT_LEN)) {
+ IOMMU_DPRINTF(ELOG, "error: fail to write at address 0x%"PRIx64
+ " + offset 0x%"PRIx32, s->evtlog, s->evtlog_tail);
+ }
+
+ s->evtlog_tail += IOMMU_EVENT_LEN;
+ *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
+}
+
+/* log an error encountered page-walking
+ *
+ * @addr: virtual address in translation request
+ */
+static void amd_iommu_page_fault(AMDIOMMUState *s, uint16_t devid,
+ dma_addr_t addr, uint16_t info)
+{
+ IOMMU_DPRINTF(ELOG, "");
+
+ uint16_t evt[8];
+
+ info |= IOMMU_EVENT_IOPF_I;
+
+ /* encode information */
+ *(uint16_t *)&evt[0] = devid;
+ *(uint16_t *)&evt[3] = info;
+ *(uint64_t *)&evt[4] = cpu_to_le64(addr);
+
+ /* log a page fault */
+ amd_iommu_log_event(s, evt);
+
+ /* Abort the translation */
+ pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
+ PCI_STATUS_SIG_TARGET_ABORT);
+}
+/*
+ * log a master abort accessing device table
+ * @devtab : address of device table entry
+ * @info : error flags
+ */
+static void amd_iommu_log_devtab_error(AMDIOMMUState *s, uint16_t devid,
+ dma_addr_t devtab, uint16_t info)
+{
+
+ IOMMU_DPRINTF(ELOG, "");
+
+ uint16_t evt[8];
+
+ info |= IOMMU_EVENT_DEV_TAB_HW_ERROR;
+
+ /* encode information */
+ *(uint16_t *)&evt[0] = devid;
+ *(uint8_t *)&evt[3] = info;
+ *(uint64_t *)&evt[4] = cpu_to_le64(devtab);
+
+ amd_iommu_log_event(s, evt);
+
+ /* Abort the translation */
+ pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
+ PCI_STATUS_SIG_TARGET_ABORT);
+
+}
+
+/* log a master abort encountered during a page-walk
+ * @addr : address that couldn't be accessed
+ */
+static void amd_iommu_log_pagetab_error(AMDIOMMUState *s, uint16_t devid,
+ dma_addr_t addr, uint16_t info)
+{
+ IOMMU_DPRINTF(ELOG, "");
+
+ uint16_t evt[8];
+
+ info |= IOMMU_EVENT_PAGE_TAB_HW_ERROR;
+
+ /* encode information */
+ *(uint16_t *)&evt[0] = devid;
+ *(uint8_t *)&evt[3] = info;
+ *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
+
+ amd_iommu_log_event(s, evt);
+
+ /* Abort the translation */
+ pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
+ PCI_STATUS_SIG_TARGET_ABORT);
+
+}
+
+/* log an event trying to access command buffer
+ * @addr : address that couldn't be accessed
+ */
+static void amd_iommu_log_command_error(AMDIOMMUState *s, dma_addr_t addr)
+{
+ IOMMU_DPRINTF(ELOG, "");
+
+ uint16_t evt[8];
+
+ /* encode information */
+ *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_COMMAND_HW_ERROR;
+ *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
+
+ amd_iommu_log_event(s, evt);
+
+ /* Abort the translation */
+ pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
+ PCI_STATUS_SIG_TARGET_ABORT);
+}
+
+/* log an illegal comand event
+ * @addr : address of illegal command
+ */
+static void amd_iommu_log_illegalcom_error(AMDIOMMUState *s, uint16_t info,
+ dma_addr_t addr)
+{
+ IOMMU_DPRINTF(ELOG, "");
+
+ uint16_t evt[8];
+
+ /* encode information */
+ *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_ILLEGAL_COMMAND_ERROR;
+ *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
+
+ amd_iommu_log_event(s, evt);
+}
+
+/* log an error accessing device table
+ *
+ * @devid : device owning the table entry
+ * @devtab : address of device table entry
+ * @info : error flags
+ */
+static void amd_iommu_log_illegaldevtab_error(AMDIOMMUState *s, uint16_t devid,
+ dma_addr_t addr, uint16_t info)
+{
+ IOMMU_DPRINTF(ELOG, "");
+
+ uint16_t evt[8];
+
+ info |= IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY;
+
+ *(uint16_t *)&evt[0] = devid;
+ *(uint8_t *)&evt[3] = info;
+ *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
+
+ amd_iommu_log_event(s, evt);
+}
+
+static gboolean amd_iommu_uint64_equal(gconstpointer v1, gconstpointer v2)
+{
+ return *((const uint64_t *)v1) == *((const uint64_t *)v2);
+}
+
+static guint amd_iommu_uint64_hash(gconstpointer v)
+{
+ return (guint)*(const uint64_t *)v;
+}
+
+static IOMMUIOTLBEntry *amd_iommu_iotlb_lookup(AMDIOMMUState *s, hwaddr addr,
+ uint64_t devid)
+{
+ uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
+ ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
+ return g_hash_table_lookup(s->iotlb, &key);
+}
+
+static void amd_iommu_iotlb_reset(AMDIOMMUState *s)
+{
+ assert(s->iotlb);
+ g_hash_table_remove_all(s->iotlb);
+}
+
+static gboolean amd_iommu_iotlb_remove_by_devid(gpointer key, gpointer value,
+ gpointer user_data)
+{
+ IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
+ uint16_t devid = *(uint16_t *)user_data;
+ return entry->devid == devid;
+}
+
+static void amd_iommu_iotlb_remove_page(AMDIOMMUState *s, hwaddr addr,
+ uint64_t devid)
+{
+ uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
+ ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
+ g_hash_table_remove(s->iotlb, &key);
+}
+
+/* extract device id */
+static inline uint16_t devid_extract(uint8_t *cmd)
+{
+ return (uint16_t)cmd[2] & IOMMU_INVAL_DEV_ID_MASK;
+}
+
+static void amd_iommu_invalidate_iotlb(AMDIOMMUState *s, uint64_t *cmd)
+{
+ uint16_t devid = devid_extract((uint8_t *)cmd);
+ /* if invalidation of more than one page requested */
+ if (IOMMU_INVAL_ALL(cmd[0])) {
+ g_hash_table_foreach_remove(s->iotlb, amd_iommu_iotlb_remove_by_devid,
+ &devid);
+ } else {
+ hwaddr addr = (hwaddr)(cmd[1] & IOMMU_INVAL_ADDR_MASK);
+ amd_iommu_iotlb_remove_page(s, addr, devid);
+ }
+}
+
+static void amd_iommu_update_iotlb(AMDIOMMUState *s, uint16_t devid,
+ uint64_t gpa, uint64_t spa, uint64_t perms,
+ uint16_t domid)
+{
+ IOMMUIOTLBEntry *entry = g_malloc(sizeof(*entry));
+ uint64_t *key = g_malloc(sizeof(key));
+ uint64_t gfn = gpa >> IOMMU_PAGE_SHIFT_4K;
+
+ IOMMU_DPRINTF(CACHE, " update iotlb devid: %02x:%02x.%x gpa 0x%"PRIx64
+ " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
+ PCI_FUNC(devid), gpa, spa);
+
+ if (g_hash_table_size(s->iotlb) >= IOMMU_IOTLB_MAX_SIZE) {
+ IOMMU_DPRINTF(CACHE, "iotlb exceeds size limit - reset");
+ amd_iommu_iotlb_reset(s);
+ }
+
+ entry->gfn = gfn;
+ entry->domid = domid;
+ entry->perms = perms;
+ entry->translated_addr = spa;
+ *key = gfn | ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
+ g_hash_table_replace(s->iotlb, key, entry);
+}
+
+/* execute a completion wait command */
+static void amd_iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+ unsigned int addr;
+
+ /* completion store */
+ if (cmd[0] & IOMMU_COM_COMPLETION_STORE_MASK) {
+ addr = le64_to_cpu(*(uint64_t *)cmd) & IOMMU_COM_STORE_ADDRESS_MASK;
+ if (dma_memory_write(&address_space_memory, addr, cmd + 8, 8)) {
+ IOMMU_DPRINTF(ELOG, "error: fail to write at address 0%x"PRIx64,
+ addr);
+ }
+ }
+
+ /* set completion interrupt */
+ if (cmd[0] & IOMMU_COM_COMPLETION_INTR) {
+ s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
+ }
+}
+
+/* get command type */
+static uint8_t opcode(uint8_t *cmd)
+{
+ return cmd[IOMMU_CMDBUF_ID_BYTE] >> IOMMU_CMDBUF_ID_RSHIFT;
+}
+
+/* linux seems to be using reserved bits so I just log without abortig bug */
+static void iommu_inval_devtab_entry(AMDIOMMUState *s, uint8_t *cmd,
+ uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ /* This command should invalidate internal caches of which there isn't */
+ if (*(uint64_t *)&cmd[0] & IOMMU_CMD_INVAL_DEV_RSVD ||
+ *(uint64_t *)&cmd[1]) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ }
+#ifdef DEBUG_AMD_IOMMU
+ uint16_t devid = devid_extract(cmd);
+#endif
+ IOMMU_DPRINTF(COMMAND, "device table entry for devid: %02x:%02x.%x"
+ "invalidated", PCI_BUS_NUM(devid), PCI_SLOT(devid),
+ PCI_FUNC(devid));
+}
+
+static void iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ if (*(uint32_t *)&cmd[1] & IOMMU_COMPLETION_WAIT_RSVD) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ }
+ /* pretend to wait for command execution to complete */
+ IOMMU_DPRINTF(COMMAND, "completion wait requested with store address 0x%"
+ PRIx64 " and store data 0x%"PRIx64, (cmd[0] &
+ IOMMU_COM_STORE_ADDRESS_MASK), *(uint64_t *)(cmd + 8));
+ amd_iommu_completion_wait(s, cmd);
+}
+
+static void iommu_complete_ppr(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ if ((*(uint64_t *)&cmd[0] & IOMMU_COMPLETE_PPR_RQ_RSVD) ||
+ *(uint64_t *)&cmd[1] & 0xffff000000000000) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ }
+
+ IOMMU_DPRINTF(COMMAND, "Execution of PPR queue requested");
+}
+
+static void iommu_inval_all(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_ALL_RSVD) ||
+ *(uint64_t *)&cmd[1]) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ }
+
+ amd_iommu_iotlb_reset(s);
+ IOMMU_DPRINTF(COMMAND, "Invalidation of all IOMMU cache requested");
+}
+
+static inline uint16_t domid_extract(uint64_t *cmd)
+{
+ return (uint16_t)cmd[0] & IOMMU_INVAL_PAGES_DOMID;
+}
+
+static gboolean amd_iommu_iotlb_remove_by_domid(gpointer key, gpointer value,
+ gpointer user_data)
+{
+ IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
+ uint16_t domid = *(uint16_t *)user_data;
+ return entry->domid == domid;
+}
+
+/* we don't have devid - we can't remove pages by address */
+static void iommu_inval_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+ uint16_t domid = domid_extract((uint64_t *)cmd);
+
+ if (*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_PAGES_RSVD ||
+ *(uint32_t *)&cmd[1] & 0x00000ff0) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ }
+
+ g_hash_table_foreach_remove(s->iotlb, amd_iommu_iotlb_remove_by_domid,
+ &domid);
+
+ IOMMU_DPRINTF(COMMAND, "IOMMU pages for domain 0x%"PRIx16 "invalidated",
+ domid);
+}
+
+static void iommu_prefetch_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ if ((*(uint64_t *)&cmd[0] & IOMMU_PRF_IOMMU_PAGES_RSVD) ||
+ (*(uint32_t *)&cmd[1] & 0x00000fd4)) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ }
+
+ IOMMU_DPRINTF(COMMAND, "Pre-fetch of IOMMU pages requested");
+}
+
+static void iommu_inval_inttable(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_INTR_TABLE_RSVD) ||
+ *(uint64_t *)&cmd[1]) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ return;
+ }
+
+ IOMMU_DPRINTF(COMMAND, "interrupt table invalidated");
+}
+
+static void iommu_inval_iotlb(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ if (*(uint32_t *)&cmd[2] & IOMMU_INVAL_IOTLB_PAGES_RSVD) {
+ amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
+ return;
+ }
+
+ amd_iommu_invalidate_iotlb(s, (uint64_t *)cmd);
+ IOMMU_DPRINTF(COMMAND, "IOTLB pages invalidated");
+}
+
+/* not honouring reserved bits is regarded as an illegal command */
+static void amd_iommu_cmdbuf_exec(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint8_t type;
+ uint8_t cmd[IOMMU_COMMAND_SIZE];
+
+ memset(cmd, 0, IOMMU_COMMAND_SIZE);
+
+ if (dma_memory_read(&address_space_memory, s->cmdbuf + s->cmdbuf_head, cmd,
+ IOMMU_COMMAND_SIZE)) {
+ IOMMU_DPRINTF(COMMAND, "error: fail to access memory at 0x%"PRIx64
+ " + 0x%"PRIu8, s->cmdbuf, s->cmdbuf_head);
+ amd_iommu_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
+ return;
+ }
+
+ type = opcode(cmd);
+
+ switch (type) {
+ case IOMMU_CMD_COMPLETION_WAIT:
+ iommu_completion_wait(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_INVAL_DEVTAB_ENTRY:
+ iommu_inval_devtab_entry(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_INVAL_IOMMU_PAGES:
+ iommu_inval_pages(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_INVAL_IOTLB_PAGES:
+ iommu_inval_iotlb(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_INVAL_INTR_TABLE:
+ iommu_inval_inttable(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_PREFETCH_IOMMU_PAGES:
+ iommu_prefetch_pages(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_COMPLETE_PPR_REQUEST:
+ iommu_complete_ppr(s, cmd, type);
+ break;
+
+ case IOMMU_CMD_INVAL_IOMMU_ALL:
+ iommu_inval_all(s, cmd, type);
+ break;
+
+ default:
+ IOMMU_DPRINTF(COMMAND, "unhandled command %d", type);
+ /* log illegal command */
+ amd_iommu_log_illegalcom_error(s, type,
+ s->cmdbuf + s->cmdbuf_head);
+ break;
+ }
+
+}
+
+static void amd_iommu_cmdbuf_run(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t *mmio_cmdbuf_head = (uint64_t *)(s->mmior +
+ IOMMU_MMIO_COMMAND_HEAD);
+
+ if (!s->cmdbuf_enabled) {
+ IOMMU_DPRINTF(COMMAND, "error: IOMMU trying to execute commands with "
+ "command buffer disabled. IOMMU control value 0x%"PRIx64,
+ amd_iommu_readq(s, IOMMU_MMIO_CONTROL));
+ return;
+ }
+
+ while (s->cmdbuf_head != s->cmdbuf_tail) {
+ /* check if there is work to do. */
+ IOMMU_DPRINTF(COMMAND, "command buffer head at 0x%"PRIx32 " command "
+ "buffer tail at 0x%"PRIx32" command buffer base at 0x%"
+ PRIx64, s->cmdbuf_head, s->cmdbuf_tail, s->cmdbuf);
+ amd_iommu_cmdbuf_exec(s);
+ s->cmdbuf_head += IOMMU_COMMAND_SIZE;
+ amd_iommu_writeq_raw(s, s->cmdbuf_head, IOMMU_MMIO_COMMAND_HEAD);
+
+ /* wrap head pointer */
+ if (s->cmdbuf_head >= s->cmdbuf_len * IOMMU_COMMAND_SIZE) {
+ s->cmdbuf_head = 0;
+ }
+ }
+
+ *mmio_cmdbuf_head = cpu_to_le64(s->cmdbuf_head);
+}
+
+/* System Software might never read from some of this fields but anyways */
+static uint64_t amd_iommu_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+ AMDIOMMUState *s = opaque;
+
+ uint64_t val = -1;
+ if (addr + size > IOMMU_MMIO_SIZE) {
+ IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIX64
+ ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE, addr,
+ size);
+ return (uint64_t)-1;
+ }
+
+ if (size == 2) {
+ val = amd_iommu_readw(s, addr);
+ } else if (size == 4) {
+ val = amd_iommu_readl(s, addr);
+ } else if (size == 8) {
+ val = amd_iommu_readq(s, addr);
+ }
+
+ switch (addr & ~0x07) {
+ case IOMMU_MMIO_DEVICE_TABLE:
+ IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_COMMAND_BASE:
+ IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_BASE read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_EVENT_BASE:
+ IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_CONTROL:
+ IOMMU_DPRINTF(MMIO, "MMIO_CONTROL read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_EXCL_BASE:
+ IOMMU_DPRINTF(MMIO, "MMIO_EXCL_BASE read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_EXCL_LIMIT:
+ IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_COMMAND_HEAD:
+ IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_COMMAND_TAIL:
+ IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_TAIL read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_EVENT_HEAD:
+ IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_EVENT_TAIL:
+ IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_STATUS:
+ IOMMU_DPRINTF(MMIO, "MMIO_STATUS read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ break;
+
+ case IOMMU_MMIO_EXT_FEATURES:
+ IOMMU_DPRINTF(MMU, "MMIO_EXT_FEATURES read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64 "value 0x%"PRIx64,
+ addr, size, addr & ~0x07, val);
+ break;
+
+ default:
+ IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO read addr 0x%"PRIx64
+ ", size %d offset 0x%"PRIx64, addr, size,
+ addr & ~0x07);
+ }
+ return val;
+}
+
+static void iommu_handle_control_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+ /*
+ * read whatever is already written in case
+ * software is writing in chucks less than 8 bytes
+ */
+ unsigned long control = amd_iommu_readq(s, IOMMU_MMIO_CONTROL);
+ s->enabled = !!(control & IOMMU_MMIO_CONTROL_IOMMUEN);
+
+ s->ats_enabled = !!(control & IOMMU_MMIO_CONTROL_HTTUNEN);
+ s->evtlog_enabled = s->enabled && !!(control &
+ IOMMU_MMIO_CONTROL_EVENTLOGEN);
+
+ s->evtlog_intr = !!(control & IOMMU_MMIO_CONTROL_EVENTINTEN);
+ s->completion_wait_intr = !!(control & IOMMU_MMIO_CONTROL_COMWAITINTEN);
+ s->cmdbuf_enabled = s->enabled && !!(control &
+ IOMMU_MMIO_CONTROL_CMDBUFLEN);
+
+ /* update the flags depending on the control register */
+ if (s->cmdbuf_enabled) {
+ (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
+ IOMMU_MMIO_STATUS_CMDBUF_RUN;
+ } else {
+ (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
+ ~IOMMU_MMIO_STATUS_CMDBUF_RUN;
+ }
+ if (s->evtlog_enabled) {
+ (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
+ IOMMU_MMIO_STATUS_EVT_RUN;
+ } else {
+ (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
+ ~IOMMU_MMIO_STATUS_EVT_RUN;
+ }
+
+ IOMMU_DPRINTF(COMMAND, "MMIO_STATUS state 0x%"PRIx64, control);
+
+ amd_iommu_cmdbuf_run(s);
+}
+
+static inline void iommu_handle_devtab_write(AMDIOMMUState *s)
+
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_DEVICE_TABLE);
+ s->devtab = (dma_addr_t)(val & IOMMU_MMIO_DEVTAB_BASE_MASK);
+
+ /* set device table length */
+ s->devtab_len = ((val & IOMMU_MMIO_DEVTAB_SIZE_MASK) + 1 *
+ (IOMMU_MMIO_DEVTAB_SIZE_UNIT /
+ IOMMU_MMIO_DEVTAB_ENTRY_SIZE));
+}
+
+static inline void iommu_handle_cmdhead_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ s->cmdbuf_head = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_HEAD)
+ & IOMMU_MMIO_CMDBUF_HEAD_MASK;
+ amd_iommu_cmdbuf_run(s);
+}
+
+static inline void iommu_handle_cmdbase_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ s->cmdbuf = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_BASE)
+ & IOMMU_MMIO_CMDBUF_BASE_MASK;
+ s->cmdbuf_len = 1UL << (s->mmior[IOMMU_MMIO_CMDBUF_SIZE_BYTE]
+ & IOMMU_MMIO_CMDBUF_SIZE_MASK);
+ s->cmdbuf_head = s->cmdbuf_tail = 0;
+
+}
+
+static inline void iommu_handle_cmdtail_write(AMDIOMMUState *s)
+{
+ s->cmdbuf_tail = amd_iommu_readq(s, IOMMU_MMIO_COMMAND_TAIL)
+ & IOMMU_MMIO_CMDBUF_TAIL_MASK;
+ amd_iommu_cmdbuf_run(s);
+}
+
+static inline void iommu_handle_excllim_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EXCL_LIMIT);
+ s->excl_limit = (val & IOMMU_MMIO_EXCL_LIMIT_MASK) |
+ IOMMU_MMIO_EXCL_LIMIT_LOW;
+}
+
+static inline void iommu_handle_evtbase_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_BASE);
+ s->evtlog = val & IOMMU_MMIO_EVTLOG_BASE_MASK;
+ s->evtlog_len = 1UL << (*(uint64_t *)&s->mmior[IOMMU_MMIO_EVTLOG_SIZE_BYTE]
+ & IOMMU_MMIO_EVTLOG_SIZE_MASK);
+}
+
+static inline void iommu_handle_evttail_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_TAIL);
+ s->evtlog_tail = val & IOMMU_MMIO_EVTLOG_TAIL_MASK;
+}
+
+static inline void iommu_handle_evthead_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_HEAD);
+ s->evtlog_head = val & IOMMU_MMIO_EVTLOG_HEAD_MASK;
+}
+
+static inline void iommu_handle_pprbase_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_BASE);
+ s->ppr_log = val & IOMMU_MMIO_PPRLOG_BASE_MASK;
+ s->pprlog_len = 1UL << (*(uint64_t *)&s->mmior[IOMMU_MMIO_PPRLOG_SIZE_BYTE]
+ & IOMMU_MMIO_PPRLOG_SIZE_MASK);
+}
+
+static inline void iommu_handle_pprhead_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_HEAD);
+ s->pprlog_head = val & IOMMU_MMIO_PPRLOG_HEAD_MASK;
+}
+
+static inline void iommu_handle_pprtail_write(AMDIOMMUState *s)
+{
+ IOMMU_DPRINTF(COMMAND, "");
+
+ uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_TAIL);
+ s->pprlog_tail = val & IOMMU_MMIO_PPRLOG_TAIL_MASK;
+}
+
+/* FIXME: something might go wrong if System Software writes in chunks
+ * of one byte but linux writes in chunks of 4 bytes so currently it
+ * works correctly with linux but will definitely be busted if software
+ * reads/writes 8 bytes
+ */
+static void amd_iommu_mmio_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned size)
+{
+
+ IOMMU_DPRINTF(COMMAND, "");
+
+ AMDIOMMUState *s = opaque;
+ unsigned long offset = addr & 0x07;
+
+ if (addr + size > IOMMU_MMIO_SIZE) {
+ IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIx64
+ ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE, addr,
+ size);
+ return;
+ }
+
+ switch (addr & ~0x07) {
+ case IOMMU_MMIO_CONTROL:
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+
+ IOMMU_DPRINTF(COMMAND, "MMIO_CONTROL write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ iommu_handle_control_write(s);
+ break;
+
+ case IOMMU_MMIO_DEVICE_TABLE:
+ IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+
+ /* set device table address
+ * This also suffers from inability to tell whether software
+ * is done writing
+ */
+
+ if (offset || (size == 8)) {
+ iommu_handle_devtab_write(s);
+ }
+ break;
+
+ case IOMMU_MMIO_COMMAND_HEAD:
+ IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+
+ iommu_handle_cmdhead_write(s);
+ break;
+
+ case IOMMU_MMIO_COMMAND_BASE:
+ IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_BASE write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+
+ /* FIXME - make sure System Software has finished writing incase
+ * it writes in chucks less than 8 bytes in a robust way.As for
+ * now, this hacks works for the linux driver
+ */
+ if (offset || (size == 8)) {
+ iommu_handle_cmdbase_write(s);
+ }
+ break;
+
+ case IOMMU_MMIO_COMMAND_TAIL:
+ IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_TAIL write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_cmdtail_write(s);
+ break;
+
+ case IOMMU_MMIO_EVENT_BASE:
+ IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_evtbase_write(s);
+ break;
+
+ case IOMMU_MMIO_EVENT_HEAD:
+ IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_evthead_write(s);
+ break;
+
+ case IOMMU_MMIO_EVENT_TAIL:
+ IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_evttail_write(s);
+ break;
+
+ case IOMMU_MMIO_EXCL_LIMIT:
+ IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_excllim_write(s);
+ break;
+
+ /* PPR log base - unused for now */
+ case IOMMU_MMIO_PPR_BASE:
+ IOMMU_DPRINTF(MMIO, "MMIO_PPR_BASE write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_pprbase_write(s);
+ break;
+ /* PPR log head - also unused for now */
+ case IOMMU_MMIO_PPR_HEAD:
+ IOMMU_DPRINTF(MMIO, "MMIO_PPR_HEAD write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_pprhead_write(s);
+ break;
+ /* PPR log tail - unused for now */
+ case IOMMU_MMIO_PPR_TAIL:
+ IOMMU_DPRINTF(MMIO, "MMIO_PPR_TAIL write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ if (size == 2) {
+ amd_iommu_writew(s, addr, val);
+ } else if (size == 4) {
+ amd_iommu_writel(s, addr, val);
+ } else if (size == 8) {
+ amd_iommu_writeq(s, addr, val);
+ }
+ iommu_handle_pprtail_write(s);
+ break;
+
+ /* ignore write to ext_features */
+ default:
+ IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO write addr 0x%"PRIx64
+ ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
+ addr, size, val, offset);
+ }
+
+}
+
+static inline uint64_t amd_iommu_get_perms(uint64_t entry)
+{
+ return (entry & (IOMMU_DEV_PERM_READ | IOMMU_DEV_PERM_WRITE)) >>
+ IOMMU_DEV_PERM_SHIFT;
+}
+
+AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn)
+{
+ AMDIOMMUState *s = opaque;
+ AMDIOMMUAddressSpace **iommu_as;
+ int bus_num = pci_bus_num(bus);
+
+ /* just in case */
+ assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
+ assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
+
+ iommu_as = s->address_spaces[bus_num];
+
+ /* allocate memory during the first run */
+ if (!iommu_as) {
+ iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) * PCI_DEVFN_MAX);
+ s->address_spaces[bus_num] = iommu_as;
+ }
+
+ /* set up IOMMU region */
+ if (!iommu_as[devfn]) {
+ iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
+ iommu_as[devfn]->bus_num = (uint8_t)bus_num;
+ iommu_as[devfn]->devfn = (uint8_t)devfn;
+ iommu_as[devfn]->iommu_state = s;
+
+ memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
+ &s->iommu_ops, "amd-iommu", UINT64_MAX);
+ address_space_init(&iommu_as[devfn]->as, &iommu_as[devfn]->iommu,
+ "amd-iommu");
+ }
+ return &iommu_as[devfn]->as;
+}
+
+/* validate a page table entry */
+static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
+ uint64_t *dte)
+{
+ if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
+ || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
+ || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
+ amd_iommu_log_illegaldevtab_error(s, devid,
+ s->devtab + devid * IOMMU_DEVTAB_ENTRY_SIZE, 0);
+ return false;
+ }
+
+ return dte[0] & IOMMU_DEV_VALID && (dte[0] & IOMMU_DEV_TRANSLATION_VALID)
+ && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
+}
+
+/* get a device table entry given the devid */
+static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t *entry)
+{
+ uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
+
+ IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
+
+ if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
+ IOMMU_DEVTAB_ENTRY_SIZE)) {
+ IOMMU_DPRINTF(MMU, "error: fail to access Device Entry devtab 0x%"PRIx64
+ "offset 0x%"PRIx32, s->devtab, offset);
+ /* log ever accessing dte */
+ amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
+ return false;
+ }
+
+ if (!amd_iommu_validate_dte(s, devid, entry)) {
+ IOMMU_DPRINTF(MMU,
+ "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
+ return false;
+ }
+
+ return true;
+}
+
+/* get pte translation mode */
+static inline uint8_t get_pte_translation_mode(uint64_t pte)
+{
+ return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
+}
+
+static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
+ IOMMUTLBEntry *ret, unsigned perms,
+ hwaddr addr)
+{
+ uint8_t level, oldlevel;
+ unsigned present;
+ uint64_t pte, pte_addr;
+ uint64_t pte_perms;
+ pte = dte[0];
+
+ level = get_pte_translation_mode(pte);
+
+ if (level >= 7 || level == 0) {
+ IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 " detected"
+ "while translating 0x%"PRIx64, level, addr);
+ return -1;
+ }
+
+ while (level > 0) {
+ pte_perms = amd_iommu_get_perms(pte);
+ present = pte & 1;
+ if (!present || perms != (perms & pte_perms)) {
+ amd_iommu_page_fault(as->iommu_state, as->devfn, addr, perms);
+ IOMMU_DPRINTF(MMU, "error: page fault accessing virtual addr 0x%"
+ PRIx64, addr);
+ return -1;
+ }
+
+ /* go to the next lower level */
+ pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
+ /* add offset and load pte */
+ pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
+ pte = ldq_phys(&address_space_memory, pte_addr);
+ oldlevel = level;
+ level = get_pte_translation_mode(pte);
+
+ /* PT is corrupted or not there */
+ if (level != oldlevel - 1) {
+ return -1;
+ }
+ }
+
+ ret->iova = addr & IOMMU_PAGE_MASK_4K;
+ ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) & IOMMU_PAGE_MASK_4K;
+ ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
+ ret->perm = IOMMU_RW;
+ return 0;
+}
+
+/* TODO : Mark addresses as Accessed and Dirty */
+static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr addr,
+ bool is_write, IOMMUTLBEntry *ret)
+{
+ AMDIOMMUState *s = as->iommu_state;
+ uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
+ IOMMUIOTLBEntry *iotlb_entry;
+ uint8_t err;
+ uint64_t entry[4];
+
+ /* try getting a cache entry first */
+ iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
+
+ if (iotlb_entry) {
+ IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa 0x%"PRIx64
+ " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
+ PCI_FUNC(devid), addr, iotlb_entry->translated_addr);
+ ret->iova = addr & IOMMU_PAGE_MASK_4K;
+ ret->translated_addr = iotlb_entry->translated_addr;
+ ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
+ ret->perm = iotlb_entry->perms;
+ return;
+ } else {
+ if (!amd_iommu_get_dte(s, devid, entry)) {
+ goto out;
+ }
+
+ err = amd_iommu_page_walk(as, entry, ret,
+ is_write ? IOMMU_PERM_WRITE : IOMMU_PERM_READ,
+ addr);
+ if (err) {
+ IOMMU_DPRINTF(MMU, "error: hardware error accessing page tables"
+ " while translating addr 0x%"PRIx64, addr);
+ amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
+ goto out;
+ }
+
+ amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
+ ret->perm, entry[1] & IOMMU_DEV_DOMID_ID_MASK);
+ return;
+ }
+
+out:
+ ret->iova = addr;
+ ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
+ ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
+ ret->perm = IOMMU_RW;
+ return;
+}
+
+static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr addr,
+ bool is_write)
+{
+ IOMMU_DPRINTF(GENERAL, "");
+
+ AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace, iommu);
+ AMDIOMMUState *s = as->iommu_state;
+
+ IOMMUTLBEntry ret = {
+ .target_as = &address_space_memory,
+ .iova = addr,
+ .translated_addr = 0,
+ .addr_mask = ~(hwaddr)0,
+ .perm = IOMMU_NONE,
+ };
+
+ if (!s->enabled) {
+ /* IOMMU disabled - corresponds to iommu=off not
+ * failure to provide any parameter
+ */
+ ret.iova = addr & IOMMU_PAGE_MASK_4K;
+ ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
+ ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
+ ret.perm = IOMMU_RW;
+ return ret;
+ }
+
+ amd_iommu_do_translate(as, addr, is_write, &ret);
+ IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa 0x%"PRIx64,
+ as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn), addr,
+ ret.translated_addr);
+
+ return ret;
+}
+
+static const MemoryRegionOps mmio_mem_ops = {
+ .read = amd_iommu_mmio_read,
+ .write = amd_iommu_mmio_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .impl = {
+ .min_access_size = 1,
+ .max_access_size = 8,
+ .unaligned = false,
+ },
+ .valid = {
+ .min_access_size = 1,
+ .max_access_size = 8,
+ }
+};
+
+static void amd_iommu_init(AMDIOMMUState *s)
+{
+ printf("amd_iommu_init");
+
+ amd_iommu_iotlb_reset(s);
+
+ s->iommu_ops.translate = amd_iommu_translate;
+
+ s->devtab_len = 0;
+ s->cmdbuf_len = 0;
+ s->cmdbuf_head = 0;
+ s->cmdbuf_tail = 0;
+ s->evtlog_head = 0;
+ s->evtlog_tail = 0;
+ s->excl_enabled = false;
+ s->excl_allow = false;
+ s->mmio_enabled = false;
+ s->enabled = false;
+ s->ats_enabled = false;
+ s->cmdbuf_enabled = false;
+
+ /* reset MMIO */
+ memset(s->mmior, 0, IOMMU_MMIO_SIZE);
+ amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
+ 0xffffffffffffffef, 0);
+ amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
+ /* reset device ident */
+ pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
+ pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
+ pci_config_set_prog_interface(s->dev.config, 00);
+ pci_config_set_class(s->dev.config, 0x0806);
+
+ /* reset IOMMU specific capabilities */
+ pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
+ pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
+ s->mmio.addr & ~(0xffff0000));
+ pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
+ (s->mmio.addr & ~(0xffff)) >> 16);
+ pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
+ 0xff000000);
+ pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
+ pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
+ IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
+}
+
+static void amd_iommu_reset(DeviceState *dev)
+{
+ AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
+
+ amd_iommu_init(s);
+}
+
+static void amd_iommu_realize(PCIDevice *dev, Error **error)
+{
+ AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
+
+ s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
+ amd_iommu_uint64_equal, g_free, g_free);
+
+ s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
+ IOMMU_CAPAB_SIZE);
+
+ /* add msi and hypertransport capabilities */
+ pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
+ pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
+
+ amd_iommu_init(s);
+
+ /* set up MMIO */
+ memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
+ IOMMU_MMIO_SIZE);
+
+ if (s->mmio.addr == IOMMU_BASE_ADDR) {
+ return;
+ }
+
+ s->mmio.addr = IOMMU_BASE_ADDR;
+ memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR, &s->mmio);
+}
+
+static const VMStateDescription vmstate_amd_iommu = {
+ .name = "amd-iommu",
+ .fields = (VMStateField[]) {
+ VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
+ VMSTATE_END_OF_LIST()
+ }
+};
+
+static Property amd_iommu_properties[] = {
+ DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void amd_iommu_uninit(PCIDevice *dev)
+{
+ AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
+ amd_iommu_iotlb_reset(s);
+}
+
+static void amd_iommu_class_init(ObjectClass *klass, void* data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = amd_iommu_realize;
+ k->exit = amd_iommu_uninit;
+
+ dc->reset = amd_iommu_reset;
+ dc->vmsd = &vmstate_amd_iommu;
+ dc->props = amd_iommu_properties;
+}
+
+static const TypeInfo amd_iommu = {
+ .name = TYPE_AMD_IOMMU_DEVICE,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(AMDIOMMUState),
+ .class_init = amd_iommu_class_init
+};
+
+static void amd_iommu_register_types(void)
+{
+ type_register_static(&amd_iommu);
+}
+
+type_init(amd_iommu_register_types);
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
new file mode 100644
index 0000000..7d317e1
--- /dev/null
+++ b/hw/i386/amd_iommu.h
@@ -0,0 +1,395 @@
+/*
+ * QEMU emulation of an AMD IOMMU (AMD-Vi)
+ *
+ * Copyright (C) 2011 Eduard - Gabriel Munteanu
+ * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef AMD_IOMMU_H_
+#define AMD_IOMMU_H_
+
+#include "hw/hw.h"
+#include "hw/pci/pci.h"
+#include "hw/pci/msi.h"
+#include "hw/sysbus.h"
+#include "sysemu/dma.h"
+
+/* Capability registers */
+#define IOMMU_CAPAB_HEADER 0x00
+#define IOMMU_CAPAB_REV_TYPE 0x02
+#define IOMMU_CAPAB_FLAGS 0x03
+#define IOMMU_CAPAB_BAR_LOW 0x04
+#define IOMMU_CAPAB_BAR_HIGH 0x08
+#define IOMMU_CAPAB_RANGE 0x0C
+#define IOMMU_CAPAB_MISC 0x10
+#define IOMMU_CAPAB_MISC1 0x14
+
+#define IOMMU_CAPAB_SIZE 0x18
+#define IOMMU_CAPAB_REG_SIZE 0x04
+
+/* Capability header data */
+#define IOMMU_CAPAB_ID_SEC 0xf
+#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
+#define IOMMU_CAPAB_EFR_SUP (1 << 27)
+#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
+#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
+#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
+#define IOMMU_CAPAB_INIT_REV (1 << 19)
+#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
+#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV | IOMMU_CAPAB_TYPE)
+#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
+ IOMMU_CAPAB_FLAG_HTTUNNEL)
+#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
+#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
+
+/* MMIO registers */
+#define IOMMU_MMIO_DEVICE_TABLE 0x0000
+#define IOMMU_MMIO_COMMAND_BASE 0x0008
+#define IOMMU_MMIO_EVENT_BASE 0x0010
+#define IOMMU_MMIO_CONTROL 0x0018
+#define IOMMU_MMIO_EXCL_BASE 0x0020
+#define IOMMU_MMIO_EXCL_LIMIT 0x0028
+#define IOMMU_MMIO_EXT_FEATURES 0x0030
+#define IOMMU_MMIO_COMMAND_HEAD 0x2000
+#define IOMMU_MMIO_COMMAND_TAIL 0x2008
+#define IOMMU_MMIO_EVENT_HEAD 0x2010
+#define IOMMU_MMIO_EVENT_TAIL 0x2018
+#define IOMMU_MMIO_STATUS 0x2020
+#define IOMMU_MMIO_PPR_BASE 0x0038
+#define IOMMU_MMIO_PPR_HEAD 0x2030
+#define IOMMU_MMIO_PPR_TAIL 0x2038
+
+#define IOMMU_MMIO_SIZE 0x4000
+
+#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
+#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
+ IOMMU_MMIO_DEVTAB_SIZE_MASK)
+#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
+#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
+
+/* some of this are similar but just for readability */
+#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
+#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
+#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
+#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
+#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
+#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
+
+#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
+#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
+#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
+#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
+#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
+#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
+
+#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
+#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
+#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
+#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
+#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
+
+#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
+#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
+#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
+#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
+#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
+
+/* mmio control register flags */
+#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
+#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
+#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
+#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
+#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
+#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
+#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
+#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
+#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
+#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
+#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
+#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
+#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
+#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
+#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
+
+/* MMIO status register bits */
+#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
+#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
+#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
+#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
+#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
+#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
+#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
+#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
+#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
+#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
+#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
+#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
+#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
+#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
+#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
+#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
+#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
+
+#define IOMMU_CMDBUF_ID_BYTE 0x07
+#define IOMMU_CMDBUF_ID_RSHIFT 4
+
+#define IOMMU_CMD_COMPLETION_WAIT 0x01
+#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
+#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
+#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
+#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
+#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
+#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
+#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
+
+#define IOMMU_DEVTAB_ENTRY_SIZE 32
+
+/* Device table entry bits 0:63 */
+#define IOMMU_DEV_VALID (1ULL << 0)
+#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
+#define IOMMU_DEV_MODE_MASK 0x7
+#define IOMMU_DEV_MODE_RSHIFT 9
+#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
+#define IOMMU_DEV_PT_ROOT_RSHIFT 12
+#define IOMMU_DEV_PERM_SHIFT 61
+#define IOMMU_DEV_PERM_READ (1ULL << 61)
+#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
+
+/* Device table entry bits 64:127 */
+#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
+#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
+#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
+#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
+#define IOMMU_DEV_IOCTL_MASK (~3)
+#define IOMMU_DEV_IOCTL_RSHIFT 20
+#define IOMMU_DEV_IOCTL_DENY 0
+#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
+#define IOMMU_DEV_IOCTL_TRANSLATE 2
+#define IOMMU_DEV_CACHE (1ULL << 37)
+#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
+#define IOMMU_DEV_EXCL (1ULL << 39)
+
+/* Event codes and flags, as stored in the info field */
+#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
+#define IOMMU_EVENT_IOPF (0x2U << 12)
+#define IOMMU_EVENT_IOPF_I (1U << 3)
+#define IOMMU_EVENT_IOPF_PR (1U << 4)
+#define IOMMU_EVENT_IOPF_RW (1U << 5)
+#define IOMMU_EVENT_IOPF_PE (1U << 6)
+#define IOMMU_EVENT_IOPF_RZ (1U << 7)
+#define IOMMU_EVENT_IOPF_TR (1U << 8)
+#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
+#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
+#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
+#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
+#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
+#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
+
+#define IOMMU_EVENT_LEN 16
+#define IOMMU_PERM_READ (1 << 0)
+#define IOMMU_PERM_WRITE (1 << 1)
+#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
+
+/* AMD RD890 Chipset */
+#define PCI_DEVICE_ID_RD890_IOMMU 0x20
+
+#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
+#define IOMMU_FEATURE_PPR (1ULL << 1)
+#define IOMMU_FEATURE_NX (1ULL << 3)
+#define IOMMU_FEATURE_GT (1ULL << 4)
+#define IOMMU_FEATURE_IA (1ULL << 6)
+#define IOMMU_FEATURE_GA (1ULL << 7)
+#define IOMMU_FEATURE_HE (1ULL << 8)
+#define IOMMU_FEATURE_PC (1ULL << 9)
+
+/* reserved DTE bits */
+#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
+#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
+#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
+
+/* IOMMU paging mode */
+#define IOMMU_GATS_MODE (6ULL << 12)
+#define IOMMU_HATS_MODE (6ULL << 10)
+
+/* PCI SIG constants */
+#define PCI_BUS_MAX 256
+#define PCI_SLOT_MAX 32
+#define PCI_FUNC_MAX 8
+#define PCI_DEVFN_MAX 256
+
+/* IOTLB */
+#define IOMMU_IOTLB_MAX_SIZE 1024
+#define IOMMU_DEVID_SHIFT 36
+
+/* extended feature support */
+#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR | \
+ IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
+ IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
+ IOMMU_HATS_MODE)
+
+/* capabilities header */
+#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
+ IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
+ | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
+ IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
+
+/* command constants */
+#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
+#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
+#define IOMMU_COM_COMPLETION_INTR 0x2
+#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
+#define IOMMU_COMMAND_SIZE 0x10
+
+/* IOMMU default address */
+#define IOMMU_BASE_ADDR 0xfed80000
+
+/* page management constants */
+#define IOMMU_PAGE_SHIFT 12
+#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
+
+#define IOMMU_PAGE_SHIFT_4K 12
+#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
+#define IOMMU_PAGE_SHIFT_2M 21
+#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
+#define IOMMU_PAGE_SHIFT_1G 30
+#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
+
+#define IOMMU_MAX_VA_ADDR (48UL << 5)
+#define IOMMU_MAX_PH_ADDR (40UL << 8)
+#define IOMMU_MAX_GVA_ADDR (48UL << 15)
+
+/* invalidation command device id */
+#define IOMMU_INVAL_DEV_ID_SHIFT 32
+#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) - 1))
+
+/* invalidation address */
+#define IOMMU_INVAL_ADDR_MASK_SHIFT 12
+#define IOMMU_INVAL_ADDR_MASK (~((1UL << IOMMU_INVAL_ADDR_MASK_SHIFT) - 1))
+
+/* invalidation S bit mask */
+#define IOMMU_INVAL_ALL(val) ((val) & (0x1))
+
+/* reserved bits */
+#define IOMMU_COMPLETION_WAIT_RSVD 0x0ff000000
+#define IOMMU_CMD_INVAL_DEV_RSVD 0xffff00000fffffff
+#define IOMMU_INVAL_IOMMU_PAGES_RSVD 0xfff000000fff0000
+#define IOMMU_INVAL_IOTLB_PAGES_RSVD 0x00000ff4
+#define IOMMU_INVAL_INTR_TABLE_RSVD 0xffff00000fffffff
+#define IOMMU_PRF_IOMMU_PAGES_RSVD 0x00ff00000ff00000
+#define IOMMU_COMPLETE_PPR_RQ_RSVD 0xffff00000ff00000
+#define IOMMU_INVAL_IOMMU_ALL_RSVD 0x0fffffff00000000
+
+/* command masks - inval iommu pages */
+#define IOMMU_INVAL_PAGES_PASID (~((1UL << 20) - 1))
+#define IOMMU_INVAL_PAGES_DOMID (((1UL << 16) - 1) << 32)
+#define IOMMU_INVAL_PAGES_ADDRESS (~((1UL << 12) - 1))
+#define IOMMU_INVAL_PAGES_SBIT (1UL << 0)
+#define IOMMU_INVAL_PAGES_PDE (1UL << 1)
+#define IOMMU_INVAL_PAGES_GN (1UL << 2)
+
+/* masks - inval iotlb pages */
+#define IOMMU_INVAL_IOTLB_DEVID (~((1UL << 16) - 1))
+#define IOMMU_INVAL_IOTLB_PASID_LOW (0xff << 15)
+#define IOMMU_INVAL_IOTLB_MAXPEND (0xff << 23)
+#define IOMMU_INVAL_IOTLB_QUEUEID (~((1UL << 16) - 1))
+#define IOMMU_INVAL_IOTLB_PASID_HIGH (0xff << 46)
+#define IOMMU_INVAL_IOTLB_GN IOMMU_INVAL_PAGES_GN
+#define IOMMU_INVAL_IOTLB_S IOMMU_INVAL_PAGES_S
+#define IOMMU_INVAL_IOTLB_ADDRESS IOMMU_INVAL_PAGES_ADDRESS
+#define IOMMU_INVAL_IOTLB_MAKEPASID(low, high)
+
+/* masks - prefetch pages */
+#define IOMMU_PREFETCH_PAGES_DEVID IOMMU_INVAL_IOTLB_DEVID
+#define IOMMU_PREFETCH_PAGES_PFCOUNT IOMMU_INVAL_IOTLB_MAXPEND
+
+#define TYPE_AMD_IOMMU_DEVICE "amd-iommu"
+#define AMD_IOMMU_DEVICE(obj)\
+ OBJECT_CHECK(AMDIOMMUState, (obj), TYPE_AMD_IOMMU_DEVICE)
+
+#define AMD_IOMMU_STR "amd"
+
+typedef struct AMDIOMMUAddressSpace AMDIOMMUAddressSpace;
+
+typedef struct AMDIOMMUState {
+ PCIDevice dev; /* The PCI device itself */
+
+ uint32_t version;
+
+ uint32_t capab_offset; /* capability offset pointer */
+ uint64_t mmio_addr;
+ uint8_t *capab; /* capabilities registers */
+
+ bool enabled; /* IOMMU enabled */
+ bool ats_enabled; /* address translation enabled */
+ bool cmdbuf_enabled; /* command buffer enabled */
+ bool evtlog_enabled; /* event log enabled */
+ bool excl_enabled;
+
+ dma_addr_t devtab; /* base address device table */
+ size_t devtab_len; /* device table length */
+
+ dma_addr_t cmdbuf; /* command buffer base address */
+ uint64_t cmdbuf_len; /* command buffer length */
+ uint32_t cmdbuf_head; /* current IOMMU read position */
+ uint32_t cmdbuf_tail; /* next Software write position */
+ bool completion_wait_intr;
+
+ dma_addr_t evtlog; /* base address event log */
+ bool evtlog_intr;
+ uint32_t evtlog_len; /* event log length */
+ uint32_t evtlog_head; /* current IOMMU write position */
+ uint32_t evtlog_tail; /* current Software read position */
+
+ /* unused for now */
+ dma_addr_t excl_base; /* base DVA - IOMMU exclusion range */
+ dma_addr_t excl_limit; /* limit of IOMMU exclusion range */
+ bool excl_allow; /* translate accesses to the exclusion range */
+ bool excl_enable; /* exclusion range enabled */
+
+ dma_addr_t ppr_log; /* base address ppr log */
+ uint32_t pprlog_len; /* ppr log len */
+ uint32_t pprlog_head; /* ppr log head */
+ uint32_t pprlog_tail; /* ppr log tail */
+
+ MemoryRegion mmio; /* MMIO region */
+ uint8_t mmior[IOMMU_MMIO_SIZE]; /* read/write MMIO */
+ uint8_t w1cmask[IOMMU_MMIO_SIZE]; /* read/write 1 clear mask */
+ uint8_t romask[IOMMU_MMIO_SIZE]; /* MMIO read/only mask */
+ bool mmio_enabled;
+
+ /* IOMMU function */
+ MemoryRegionIOMMUOps iommu_ops;
+
+ /* for each served device */
+ AMDIOMMUAddressSpace **address_spaces[PCI_BUS_MAX];
+
+ /* IOTLB */
+ GHashTable *iotlb;
+} AMDIOMMUState;
+
+/*
+ * bridge_host_amd_iommu: setup an IOMMU function on a bus
+ *
+ * called for all PCI devices
+ *
+ * @bus: PCI bus to host the IOMMU
+ * @opaque: opaque pointer to AMDIOMMUState struct
+ * @defvn: PCI function of device for which to setup IOMMU region for
+ *
+ */
+AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn);
+
+#endif
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index dedf277..61deace 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -15,6 +15,8 @@
/* PCI bus */
+#define PCI_BUS_NUM(x) (((x) >> 8) & 0xff)
+#define PCI_DEVID(bus, devfn) ((((uint16_t)(bus)) << 8) | (devfn))
#define PCI_DEVFN(slot, func) ((((slot) & 0x1f) << 3) | ((func) & 0x07))
#define PCI_SLOT(devfn) (((devfn) >> 3) & 0x1f)
#define PCI_FUNC(devfn) ((devfn) & 0x07)
--
2.1.4
^ permalink raw reply related [flat|nested] 53+ messages in thread
* [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
2016-02-21 18:10 ` [Qemu-devel] [V6 1/4] hw/i386: Introduce " David Kiarie
@ 2016-02-21 18:10 ` David Kiarie
2016-02-21 20:09 ` Jan Kiszka
2016-03-11 13:20 ` Michael S. Tsirkin
2016-02-21 18:10 ` [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU David Kiarie
` (3 subsequent siblings)
5 siblings, 2 replies; 53+ messages in thread
From: David Kiarie @ 2016-02-21 18:10 UTC (permalink / raw)
To: qemu-devel; +Cc: marcel, valentine.sinitsyn, jan.kiszka, David Kiarie, mst
Add IOMMU as a string to machine properties which is
used to control whether and the type of IOMMU to emulate
Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
---
hw/core/machine.c | 28 ++++++++++++++++++++--------
include/hw/boards.h | 3 ++-
qemu-options.hx | 6 +++---
util/qemu-config.c | 4 ++--
4 files changed, 27 insertions(+), 14 deletions(-)
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 6d1a0d8..001ace9 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -14,6 +14,8 @@
#include "hw/boards.h"
#include "qapi-visit.h"
#include "qapi/visitor.h"
+#include "hw/i386/amd_iommu.h"
+#include "hw/i386/intel_iommu.h"
#include "hw/sysbus.h"
#include "sysemu/sysemu.h"
#include "qemu/error-report.h"
@@ -284,18 +286,28 @@ static void machine_set_firmware(Object *obj, const char *value, Error **errp)
ms->firmware = g_strdup(value);
}
-static bool machine_get_iommu(Object *obj, Error **errp)
+static char *machine_get_iommu(Object *obj, Error **errp)
{
MachineState *ms = MACHINE(obj);
- return ms->iommu;
+ return g_strdup(ms->iommu);
}
-static void machine_set_iommu(Object *obj, bool value, Error **errp)
+static void machine_set_iommu(Object *obj, const char *value, Error **errp)
{
MachineState *ms = MACHINE(obj);
+ Error *err = NULL;
+
+ g_free(ms->iommu);
+
+ if (g_strcmp0(value, AMD_IOMMU_STR) &&
+ g_strcmp0(value, INTEL_IOMMU_STR)) {
+ error_setg(errp, "Invalid IOMMU type %s", value);
+ error_propagate(errp, err);
+ return;
+ }
- ms->iommu = value;
+ ms->iommu = g_strdup(value);
}
static void machine_set_suppress_vmdesc(Object *obj, bool value, Error **errp)
@@ -455,11 +467,10 @@ static void machine_initfn(Object *obj)
object_property_set_description(obj, "firmware",
"Firmware image",
NULL);
- object_property_add_bool(obj, "iommu",
- machine_get_iommu,
- machine_set_iommu, NULL);
+ object_property_add_str(obj, "iommu",
+ machine_get_iommu, machine_set_iommu, NULL);
object_property_set_description(obj, "iommu",
- "Set on/off to enable/disable Intel IOMMU (VT-d)",
+ "IOMMU list",
NULL);
object_property_add_bool(obj, "suppress-vmdesc",
machine_get_suppress_vmdesc,
@@ -485,6 +496,7 @@ static void machine_finalize(Object *obj)
g_free(ms->dumpdtb);
g_free(ms->dt_compatible);
g_free(ms->firmware);
+ g_free(ms->iommu);
}
bool machine_usb(MachineState *machine)
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 0f30959..b119245 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -36,6 +36,7 @@ bool machine_usb(MachineState *machine);
bool machine_kernel_irqchip_allowed(MachineState *machine);
bool machine_kernel_irqchip_required(MachineState *machine);
bool machine_kernel_irqchip_split(MachineState *machine);
+bool machine_amd_iommu(MachineState *machine);
int machine_kvm_shadow_mem(MachineState *machine);
int machine_phandle_start(MachineState *machine);
bool machine_dump_guest_core(MachineState *machine);
@@ -126,7 +127,7 @@ struct MachineState {
bool usb_disabled;
bool igd_gfx_passthru;
char *firmware;
- bool iommu;
+ char *iommu;
bool suppress_vmdesc;
ram_addr_t ram_size;
diff --git a/qemu-options.hx b/qemu-options.hx
index 2f0465e..dad160f 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -38,7 +38,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
" kvm_shadow_mem=size of KVM shadow MMU\n"
" dump-guest-core=on|off include guest memory in a core dump (default=on)\n"
" mem-merge=on|off controls memory merge support (default: on)\n"
- " iommu=on|off controls emulated Intel IOMMU (VT-d) support (default=off)\n"
+ " iommu=amd|intel enables and selects the emulated IOMMU (default: off)\n"
" igd-passthru=on|off controls IGD GFX passthrough support (default=off)\n"
" aes-key-wrap=on|off controls support for AES key wrapping (default=on)\n"
" dea-key-wrap=on|off controls support for DEA key wrapping (default=on)\n"
@@ -72,8 +72,8 @@ Include guest memory in a core dump. The default is on.
Enables or disables memory merge support. This feature, when supported by
the host, de-duplicates identical memory pages among VMs instances
(enabled by default).
-@item iommu=on|off
-Enables or disables emulated Intel IOMMU (VT-d) support. The default is off.
+@item iommu=intel|amd
+Enables and selects the emulated IOMMU. The default is off.
@item aes-key-wrap=on|off
Enables or disables AES key wrapping support on s390-ccw hosts. This feature
controls whether AES wrapping keys will be created to allow
diff --git a/util/qemu-config.c b/util/qemu-config.c
index fb97307..f1b5a3b 100644
--- a/util/qemu-config.c
+++ b/util/qemu-config.c
@@ -213,8 +213,8 @@ static QemuOptsList machine_opts = {
.help = "firmware image",
},{
.name = "iommu",
- .type = QEMU_OPT_BOOL,
- .help = "Set on/off to enable/disable Intel IOMMU (VT-d)",
+ .type = QEMU_OPT_STRING,
+ .help = "Enables IOMMU and sets the emulated type",
},{
.name = "suppress-vmdesc",
.type = QEMU_OPT_BOOL,
--
2.1.4
^ permalink raw reply related [flat|nested] 53+ messages in thread
* [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
2016-02-21 18:10 ` [Qemu-devel] [V6 1/4] hw/i386: Introduce " David Kiarie
2016-02-21 18:10 ` [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties David Kiarie
@ 2016-02-21 18:10 ` David Kiarie
2016-02-21 18:20 ` Jan Kiszka
2016-02-21 18:11 ` [Qemu-devel] [V6 4/4] hw/pci-host: Emulate " David Kiarie
` (2 subsequent siblings)
5 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-02-21 18:10 UTC (permalink / raw)
To: qemu-devel; +Cc: marcel, valentine.sinitsyn, jan.kiszka, David Kiarie, mst
Add IVRS table for AMD IOMMU. Generate IVRS or DMAR
depending on emulated IOMMU
Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
---
hw/i386/acpi-build.c | 208 +++++++++++++++++++++++++++++++++++++++++---
include/hw/acpi/acpi-defs.h | 55 ++++++++++++
2 files changed, 252 insertions(+), 11 deletions(-)
diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 4554eb8..fa1310f 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -51,6 +51,7 @@
#include "hw/pci/pci_bus.h"
#include "hw/pci-host/q35.h"
#include "hw/i386/intel_iommu.h"
+#include "hw/i386/amd_iommu.h"
#include "hw/timer/hpet.h"
#include "hw/acpi/aml-build.h"
@@ -121,6 +122,12 @@ typedef struct AcpiBuildPciBusHotplugState {
bool pcihp_bridge_en;
} AcpiBuildPciBusHotplugState;
+typedef enum iommu_type {
+ TYPE_AMD,
+ TYPE_INTEL,
+ TYPE_NONE
+} iommu_type;
+
static
int acpi_add_cpu_info(Object *o, void *opaque)
{
@@ -2513,6 +2520,188 @@ build_dmar_q35(GArray *table_data, GArray *linker)
"DMAR", table_data->len - dmar_start, 1, NULL, NULL);
}
+static void
+build_amd_iommu(GArray *table_data, GArray *linker)
+{
+ int iommu_start = table_data->len;
+ bool iommu_ambig;
+
+ AcpiAMDIOMMUIVRS *ivrs;
+ AcpiAMDIOMMUHardwareUnit *iommu;
+
+ /* IVRS definition */
+ ivrs = acpi_data_push(table_data, sizeof(*ivrs));
+ ivrs->revision = cpu_to_le16(ACPI_IOMMU_IVRS_TYPE);
+ ivrs->length = cpu_to_le16((sizeof(*ivrs) + sizeof(*iommu)));
+ ivrs->v_common_info = cpu_to_le64(AMD_IOMMU_HOST_ADDRESS_WIDTH << 8);
+
+ AMDIOMMUState *s = (AMDIOMMUState *)object_resolve_path_type("",
+ TYPE_AMD_IOMMU_DEVICE, &iommu_ambig);
+
+ /* IVDB definition - type 10h */
+ iommu = acpi_data_push(table_data, sizeof(*iommu));
+ if (!iommu_ambig) {
+ iommu->type = cpu_to_le16(0x10);
+ /* IVHD flags */
+ iommu->flags = cpu_to_le16(iommu->flags);
+ iommu->flags = cpu_to_le16(IVHD_HT_TUNEN | IVHD_PPRSUP | IVHD_IOTLBSUP
+ | IVHD_PREFSUP);
+ iommu->length = cpu_to_le16(sizeof(*iommu));
+ iommu->device_id = cpu_to_le16(PCI_DEVICE_ID_RD890_IOMMU);
+ iommu->capability_offset = cpu_to_le16(s->capab_offset);
+ iommu->mmio_base = cpu_to_le64(s->mmio.addr);
+ iommu->pci_segment = 0;
+ iommu->interrupt_info = 0;
+ /* EFR features */
+ iommu->efr_register = cpu_to_le64(IVHD_EFR_GTSUP | IVHD_EFR_HATS
+ | IVHD_EFR_GATS);
+ iommu->efr_register = cpu_to_le64(iommu->efr_register);
+ /* device entries */
+ memset(iommu->dev_entries, 0, 20);
+ /* Add device flags here
+ * This is are 4-byte device entries currently reporting the range of
+ * devices 00h - ffffh; all devices
+ *
+ * Device setting affecting all devices should be made here
+ *
+ * Refer to
+ * (http://developer.amd.com/wordpress/media/2012/10/488821.pdf)
+ * 5.2.2.1
+ */
+ iommu->dev_entries[12] = 3;
+ iommu->dev_entries[16] = 4;
+ iommu->dev_entries[17] = 0xff;
+ iommu->dev_entries[18] = 0xff;
+ }
+
+ build_header(linker, table_data, (void *)(table_data->data + iommu_start),
+ "IVRS", table_data->len - iommu_start, 1, NULL);
+}
+
+static iommu_type has_iommu(void)
+{
+ bool ambiguous;
+
+ if (object_resolve_path_type("", TYPE_AMD_IOMMU_DEVICE, &ambiguous)
+ && !ambiguous)
+ return TYPE_AMD;
+ else if (object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE, &ambiguous)
+ && !ambiguous)
+ return TYPE_INTEL;
+ else
+ return TYPE_NONE;
+}
+
+static void
+build_dsdt(GArray *table_data, GArray *linker,
+ AcpiPmInfo *pm, AcpiMiscInfo *misc)
+{
+ Aml *dsdt, *sb_scope, *scope, *dev, *method, *field;
+ MachineState *machine = MACHINE(qdev_get_machine());
+ uint32_t nr_mem = machine->ram_slots;
+
+ dsdt = init_aml_allocator();
+
+ /* Reserve space for header */
+ acpi_data_push(dsdt->buf, sizeof(AcpiTableHeader));
+
+ build_dbg_aml(dsdt);
+ if (misc->is_piix4) {
+ sb_scope = aml_scope("_SB");
+ dev = aml_device("PCI0");
+ aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
+ aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
+ aml_append(dev, aml_name_decl("_UID", aml_int(1)));
+ aml_append(sb_scope, dev);
+ aml_append(dsdt, sb_scope);
+
+ build_hpet_aml(dsdt);
+ build_piix4_pm(dsdt);
+ build_piix4_isa_bridge(dsdt);
+ build_isa_devices_aml(dsdt);
+ build_piix4_pci_hotplug(dsdt);
+ build_piix4_pci0_int(dsdt);
+ } else {
+ sb_scope = aml_scope("_SB");
+ aml_append(sb_scope,
+ aml_operation_region("PCST", AML_SYSTEM_IO, 0xae00, 0x0c));
+ aml_append(sb_scope,
+ aml_operation_region("PCSB", AML_SYSTEM_IO, 0xae0c, 0x01));
+ field = aml_field("PCSB", AML_ANY_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
+ aml_append(field, aml_named_field("PCIB", 8));
+ aml_append(sb_scope, field);
+ aml_append(dsdt, sb_scope);
+
+ sb_scope = aml_scope("_SB");
+ dev = aml_device("PCI0");
+ aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
+ aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
+ aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
+ aml_append(dev, aml_name_decl("_UID", aml_int(1)));
+ aml_append(dev, aml_name_decl("SUPP", aml_int(0)));
+ aml_append(dev, aml_name_decl("CTRL", aml_int(0)));
+ aml_append(dev, build_q35_osc_method());
+ aml_append(sb_scope, dev);
+ aml_append(dsdt, sb_scope);
+
+ build_hpet_aml(dsdt);
+ build_q35_isa_bridge(dsdt);
+ build_isa_devices_aml(dsdt);
+ build_q35_pci0_int(dsdt);
+ }
+
+ build_cpu_hotplug_aml(dsdt);
+ build_memory_hotplug_aml(dsdt, nr_mem, pm->mem_hp_io_base,
+ pm->mem_hp_io_len);
+
+ scope = aml_scope("_GPE");
+ {
+ aml_append(scope, aml_name_decl("_HID", aml_string("ACPI0006")));
+
+ aml_append(scope, aml_method("_L00", 0, AML_NOTSERIALIZED));
+
+ if (misc->is_piix4) {
+ method = aml_method("_E01", 0, AML_NOTSERIALIZED);
+ aml_append(method,
+ aml_acquire(aml_name("\\_SB.PCI0.BLCK"), 0xFFFF));
+ aml_append(method, aml_call0("\\_SB.PCI0.PCNT"));
+ aml_append(method, aml_release(aml_name("\\_SB.PCI0.BLCK")));
+ aml_append(scope, method);
+ } else {
+ aml_append(scope, aml_method("_L01", 0, AML_NOTSERIALIZED));
+ }
+
+ method = aml_method("_E02", 0, AML_NOTSERIALIZED);
+ aml_append(method, aml_call0("\\_SB." CPU_SCAN_METHOD));
+ aml_append(scope, method);
+
+ method = aml_method("_E03", 0, AML_NOTSERIALIZED);
+ aml_append(method, aml_call0(MEMORY_HOTPLUG_HANDLER_PATH));
+ aml_append(scope, method);
+
+ aml_append(scope, aml_method("_L04", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L05", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L06", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L07", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L08", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L09", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L0A", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L0B", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L0C", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L0D", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L0E", 0, AML_NOTSERIALIZED));
+ aml_append(scope, aml_method("_L0F", 0, AML_NOTSERIALIZED));
+ }
+ aml_append(dsdt, scope);
+
+ /* copy AML table into ACPI tables blob and patch header there */
+ g_array_append_vals(table_data, dsdt->buf->data, dsdt->buf->len);
+ build_header(linker, table_data,
+ (void *)(table_data->data + table_data->len - dsdt->buf->len),
+ "DSDT", dsdt->buf->len, 1, NULL);
+ free_aml_allocator();
+}
+
static GArray *
build_rsdp(GArray *rsdp_table, GArray *linker, unsigned rsdt)
{
@@ -2570,16 +2759,6 @@ static bool acpi_get_mcfg(AcpiMcfgInfo *mcfg)
return true;
}
-static bool acpi_has_iommu(void)
-{
- bool ambiguous;
- Object *intel_iommu;
-
- intel_iommu = object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE,
- &ambiguous);
- return intel_iommu && !ambiguous;
-}
-
static bool acpi_has_nvdimm(void)
{
PCMachineState *pcms = PC_MACHINE(qdev_get_machine());
@@ -2600,6 +2779,7 @@ void acpi_build(AcpiBuildTables *tables)
AcpiMcfgInfo mcfg;
PcPciInfo pci;
uint8_t *u;
+ iommu_type type = has_iommu();
size_t aml_len = 0;
GArray *tables_blob = tables->table_data;
AcpiSlicOem slic_oem = { .id = NULL, .table_id = NULL };
@@ -2666,7 +2846,13 @@ void acpi_build(AcpiBuildTables *tables)
acpi_add_table(table_offsets, tables_blob);
build_mcfg_q35(tables_blob, tables->linker, &mcfg);
}
- if (acpi_has_iommu()) {
+
+ if (type == TYPE_AMD) {
+ acpi_add_table(table_offsets, tables_blob);
+ build_amd_iommu(tables_blob, tables->linker);
+ }
+
+ if (type == TYPE_INTEL) {
acpi_add_table(table_offsets, tables_blob);
build_dmar_q35(tables_blob, tables->linker);
}
diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
index c7a03d4..a161358 100644
--- a/include/hw/acpi/acpi-defs.h
+++ b/include/hw/acpi/acpi-defs.h
@@ -570,4 +570,59 @@ typedef struct AcpiDmarHardwareUnit AcpiDmarHardwareUnit;
/* Masks for Flags field above */
#define ACPI_DMAR_INCLUDE_PCI_ALL 1
+/* IVRS constants */
+#define ACPI_IOMMU_HARDWAREUNIT_TYPE 0x10
+#define ACPI_IOMMU_IVRS_TYPE 0x1
+#define AMD_IOMMU_HOST_ADDRESS_WIDTH 39UL
+
+/* AMD IOMMU IVRS table */
+struct AcpiAMDIOMMUIVRS {
+ ACPI_TABLE_HEADER_DEF
+ uint32_t v_common_info; /* common virtualization information */
+ uint64_t reserved; /* reserved */
+} QEMU_PACKED;
+typedef struct AcpiAMDIOMMUIVRS AcpiAMDIOMMUIVRS;
+
+/* flags in the IVHD headers */
+#define IVHD_HT_TUNEN (1UL << 0)
+#define IVHD_PASS_PW (1UL << 1)
+#define IVHD_RESPASS_PW (1UL << 2)
+#define IVHD_ISOC (1UL << 3)
+#define IVHD_IOTLBSUP (1UL << 4)
+#define IVHD_COHERENT (1UL << 5)
+#define IVHD_PREFSUP (1UL << 6)
+#define IVHD_PPRSUP (1UL << 7)
+
+/* features in the IVHD headers */
+#define IVHD_EFR_HATS 48
+#define IVHD_EFR_GATS 48
+#define IVHD_EFR_MSI_NUM
+#define IVHD_EFR_PNBANKS
+#define IVHD_EFR_PNCOUNTERS
+#define IVHD_EFR_PASMAX
+#define IVHD_EFR_HESUP (1UL << 7)
+#define IVHD_EFR_GASUP (1UL << 6)
+#define IVHD_EFR_IASUP (1UL << 5)
+#define IVHD_EFR_GLXSUP (3UL << 3)
+#define IVHD_EFR_GTSUP (1UL << 2)
+#define IVHD_EFR_NXSUP (1UL << 1)
+#define IVHD_EFR_XTSUP (1UL << 0)
+
+/* IVDB type 10h */
+struct AcpiAMDIOMMUHardwareUnit {
+ uint8_t type;
+ uint8_t flags;
+ uint16_t length;
+ uint16_t device_id;
+ uint16_t capability_offset;
+ uint64_t mmio_base;
+ uint16_t pci_segment;
+ uint16_t interrupt_info;
+ uint32_t features;
+ uint64_t efr_register;
+ uint64_t reserved;
+ uint8_t dev_entries[20];
+} QEMU_PACKED;
+typedef struct AcpiAMDIOMMUHardwareUnit AcpiAMDIOMMUHardwareUnit;
+
#endif
--
2.1.4
^ permalink raw reply related [flat|nested] 53+ messages in thread
* [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
` (2 preceding siblings ...)
2016-02-21 18:10 ` [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU David Kiarie
@ 2016-02-21 18:11 ` David Kiarie
2016-02-22 11:22 ` Marcel Apfelbaum
2016-03-11 13:22 ` Michael S. Tsirkin
2016-02-21 20:20 ` [Qemu-devel] [V6 0/4] " Jan Kiszka
2016-03-01 13:07 ` Michael S. Tsirkin
5 siblings, 2 replies; 53+ messages in thread
From: David Kiarie @ 2016-02-21 18:11 UTC (permalink / raw)
To: qemu-devel; +Cc: marcel, valentine.sinitsyn, jan.kiszka, David Kiarie, mst
Add AMD IOMMU emulation support to q35 chipset
Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
---
hw/pci-host/piix.c | 1 +
hw/pci-host/q35.c | 14 ++++++++++++--
include/hw/i386/intel_iommu.h | 1 +
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
index 41aa66f..ab2e24a 100644
--- a/hw/pci-host/piix.c
+++ b/hw/pci-host/piix.c
@@ -36,6 +36,7 @@
#include "hw/i386/ioapic.h"
#include "qapi/visitor.h"
#include "qemu/error-report.h"
+#include "hw/i386/amd_iommu.h"
/*
* I440FX chipset data sheet.
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 115fb8c..355fb32 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -31,6 +31,7 @@
#include "hw/hw.h"
#include "hw/pci-host/q35.h"
#include "qapi/visitor.h"
+#include "hw/i386/amd_iommu.h"
/****************************************************************************
* Q35 host
@@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
mch->pci_address_space, &mch->pam_regions[i+1],
PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
}
- /* Intel IOMMU (VT-d) */
- if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
+
+ if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR) == 0) {
+ /* Intel IOMMU (VT-d) */
mch_init_dmar(mch);
+ } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, AMD_IOMMU_STR)
+ == 0) {
+ AMDIOMMUState *iommu_state;
+ PCIDevice *iommu;
+ PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
+ iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
+ iommu_state = AMD_IOMMU_DEVICE(iommu);
+ pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
}
}
diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
index b024ffa..539530c 100644
--- a/include/hw/i386/intel_iommu.h
+++ b/include/hw/i386/intel_iommu.h
@@ -27,6 +27,7 @@
#define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
#define INTEL_IOMMU_DEVICE(obj) \
OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
+#define INTEL_IOMMU_STR "intel"
/* DMAR Hardware Unit Definition address (IOMMU unit) */
#define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
--
2.1.4
^ permalink raw reply related [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU
2016-02-21 18:10 ` [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU David Kiarie
@ 2016-02-21 18:20 ` Jan Kiszka
2016-02-21 19:00 ` David Kiarie
0 siblings, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-02-21 18:20 UTC (permalink / raw)
To: David Kiarie, qemu-devel; +Cc: marcel, valentine.sinitsyn, mst
[-- Attachment #1: Type: text/plain, Size: 9190 bytes --]
On 2016-02-21 19:10, David Kiarie wrote:
> Add IVRS table for AMD IOMMU. Generate IVRS or DMAR
> depending on emulated IOMMU
>
> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> ---
> hw/i386/acpi-build.c | 208 +++++++++++++++++++++++++++++++++++++++++---
> include/hw/acpi/acpi-defs.h | 55 ++++++++++++
> 2 files changed, 252 insertions(+), 11 deletions(-)
>
> diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
> index 4554eb8..fa1310f 100644
> --- a/hw/i386/acpi-build.c
> +++ b/hw/i386/acpi-build.c
> @@ -51,6 +51,7 @@
> #include "hw/pci/pci_bus.h"
> #include "hw/pci-host/q35.h"
> #include "hw/i386/intel_iommu.h"
> +#include "hw/i386/amd_iommu.h"
> #include "hw/timer/hpet.h"
>
> #include "hw/acpi/aml-build.h"
> @@ -121,6 +122,12 @@ typedef struct AcpiBuildPciBusHotplugState {
> bool pcihp_bridge_en;
> } AcpiBuildPciBusHotplugState;
>
> +typedef enum iommu_type {
> + TYPE_AMD,
> + TYPE_INTEL,
> + TYPE_NONE
> +} iommu_type;
> +
> static
> int acpi_add_cpu_info(Object *o, void *opaque)
> {
> @@ -2513,6 +2520,188 @@ build_dmar_q35(GArray *table_data, GArray *linker)
> "DMAR", table_data->len - dmar_start, 1, NULL, NULL);
> }
>
> +static void
> +build_amd_iommu(GArray *table_data, GArray *linker)
> +{
> + int iommu_start = table_data->len;
> + bool iommu_ambig;
> +
> + AcpiAMDIOMMUIVRS *ivrs;
> + AcpiAMDIOMMUHardwareUnit *iommu;
> +
> + /* IVRS definition */
> + ivrs = acpi_data_push(table_data, sizeof(*ivrs));
> + ivrs->revision = cpu_to_le16(ACPI_IOMMU_IVRS_TYPE);
> + ivrs->length = cpu_to_le16((sizeof(*ivrs) + sizeof(*iommu)));
> + ivrs->v_common_info = cpu_to_le64(AMD_IOMMU_HOST_ADDRESS_WIDTH << 8);
> +
> + AMDIOMMUState *s = (AMDIOMMUState *)object_resolve_path_type("",
> + TYPE_AMD_IOMMU_DEVICE, &iommu_ambig);
> +
> + /* IVDB definition - type 10h */
> + iommu = acpi_data_push(table_data, sizeof(*iommu));
> + if (!iommu_ambig) {
> + iommu->type = cpu_to_le16(0x10);
> + /* IVHD flags */
> + iommu->flags = cpu_to_le16(iommu->flags);
> + iommu->flags = cpu_to_le16(IVHD_HT_TUNEN | IVHD_PPRSUP | IVHD_IOTLBSUP
> + | IVHD_PREFSUP);
> + iommu->length = cpu_to_le16(sizeof(*iommu));
> + iommu->device_id = cpu_to_le16(PCI_DEVICE_ID_RD890_IOMMU);
> + iommu->capability_offset = cpu_to_le16(s->capab_offset);
> + iommu->mmio_base = cpu_to_le64(s->mmio.addr);
> + iommu->pci_segment = 0;
> + iommu->interrupt_info = 0;
> + /* EFR features */
> + iommu->efr_register = cpu_to_le64(IVHD_EFR_GTSUP | IVHD_EFR_HATS
> + | IVHD_EFR_GATS);
> + iommu->efr_register = cpu_to_le64(iommu->efr_register);
> + /* device entries */
> + memset(iommu->dev_entries, 0, 20);
> + /* Add device flags here
> + * This is are 4-byte device entries currently reporting the range of
> + * devices 00h - ffffh; all devices
> + *
> + * Device setting affecting all devices should be made here
> + *
> + * Refer to
> + * (http://developer.amd.com/wordpress/media/2012/10/488821.pdf)
> + * 5.2.2.1
> + */
> + iommu->dev_entries[12] = 3;
> + iommu->dev_entries[16] = 4;
> + iommu->dev_entries[17] = 0xff;
> + iommu->dev_entries[18] = 0xff;
> + }
> +
> + build_header(linker, table_data, (void *)(table_data->data + iommu_start),
> + "IVRS", table_data->len - iommu_start, 1, NULL);
> +}
> +
> +static iommu_type has_iommu(void)
> +{
> + bool ambiguous;
> +
> + if (object_resolve_path_type("", TYPE_AMD_IOMMU_DEVICE, &ambiguous)
> + && !ambiguous)
> + return TYPE_AMD;
> + else if (object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE, &ambiguous)
> + && !ambiguous)
> + return TYPE_INTEL;
> + else
> + return TYPE_NONE;
> +}
> +
> +static void
> +build_dsdt(GArray *table_data, GArray *linker,
> + AcpiPmInfo *pm, AcpiMiscInfo *misc)
> +{
> + Aml *dsdt, *sb_scope, *scope, *dev, *method, *field;
> + MachineState *machine = MACHINE(qdev_get_machine());
> + uint32_t nr_mem = machine->ram_slots;
> +
> + dsdt = init_aml_allocator();
> +
> + /* Reserve space for header */
> + acpi_data_push(dsdt->buf, sizeof(AcpiTableHeader));
> +
> + build_dbg_aml(dsdt);
> + if (misc->is_piix4) {
> + sb_scope = aml_scope("_SB");
> + dev = aml_device("PCI0");
> + aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
> + aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
> + aml_append(dev, aml_name_decl("_UID", aml_int(1)));
> + aml_append(sb_scope, dev);
> + aml_append(dsdt, sb_scope);
> +
> + build_hpet_aml(dsdt);
> + build_piix4_pm(dsdt);
> + build_piix4_isa_bridge(dsdt);
> + build_isa_devices_aml(dsdt);
> + build_piix4_pci_hotplug(dsdt);
> + build_piix4_pci0_int(dsdt);
> + } else {
> + sb_scope = aml_scope("_SB");
> + aml_append(sb_scope,
> + aml_operation_region("PCST", AML_SYSTEM_IO, 0xae00, 0x0c));
> + aml_append(sb_scope,
> + aml_operation_region("PCSB", AML_SYSTEM_IO, 0xae0c, 0x01));
> + field = aml_field("PCSB", AML_ANY_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
> + aml_append(field, aml_named_field("PCIB", 8));
> + aml_append(sb_scope, field);
> + aml_append(dsdt, sb_scope);
> +
> + sb_scope = aml_scope("_SB");
> + dev = aml_device("PCI0");
> + aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
> + aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
> + aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
> + aml_append(dev, aml_name_decl("_UID", aml_int(1)));
> + aml_append(dev, aml_name_decl("SUPP", aml_int(0)));
> + aml_append(dev, aml_name_decl("CTRL", aml_int(0)));
> + aml_append(dev, build_q35_osc_method());
> + aml_append(sb_scope, dev);
> + aml_append(dsdt, sb_scope);
> +
> + build_hpet_aml(dsdt);
> + build_q35_isa_bridge(dsdt);
> + build_isa_devices_aml(dsdt);
> + build_q35_pci0_int(dsdt);
> + }
> +
> + build_cpu_hotplug_aml(dsdt);
> + build_memory_hotplug_aml(dsdt, nr_mem, pm->mem_hp_io_base,
> + pm->mem_hp_io_len);
> +
> + scope = aml_scope("_GPE");
> + {
> + aml_append(scope, aml_name_decl("_HID", aml_string("ACPI0006")));
> +
> + aml_append(scope, aml_method("_L00", 0, AML_NOTSERIALIZED));
> +
> + if (misc->is_piix4) {
> + method = aml_method("_E01", 0, AML_NOTSERIALIZED);
> + aml_append(method,
> + aml_acquire(aml_name("\\_SB.PCI0.BLCK"), 0xFFFF));
> + aml_append(method, aml_call0("\\_SB.PCI0.PCNT"));
> + aml_append(method, aml_release(aml_name("\\_SB.PCI0.BLCK")));
> + aml_append(scope, method);
> + } else {
> + aml_append(scope, aml_method("_L01", 0, AML_NOTSERIALIZED));
> + }
> +
> + method = aml_method("_E02", 0, AML_NOTSERIALIZED);
> + aml_append(method, aml_call0("\\_SB." CPU_SCAN_METHOD));
> + aml_append(scope, method);
> +
> + method = aml_method("_E03", 0, AML_NOTSERIALIZED);
> + aml_append(method, aml_call0(MEMORY_HOTPLUG_HANDLER_PATH));
> + aml_append(scope, method);
> +
> + aml_append(scope, aml_method("_L04", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L05", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L06", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L07", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L08", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L09", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L0A", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L0B", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L0C", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L0D", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L0E", 0, AML_NOTSERIALIZED));
> + aml_append(scope, aml_method("_L0F", 0, AML_NOTSERIALIZED));
> + }
> + aml_append(dsdt, scope);
> +
> + /* copy AML table into ACPI tables blob and patch header there */
> + g_array_append_vals(table_data, dsdt->buf->data, dsdt->buf->len);
> + build_header(linker, table_data,
> + (void *)(table_data->data + table_data->len - dsdt->buf->len),
> + "DSDT", dsdt->buf->len, 1, NULL);
Grabbed an old version by accident? This one still cannot build over
current master (c3bce9d5f9).
In fact, there are more build error with this file. Please check
carefully before posting.
Jan
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU
2016-02-21 18:20 ` Jan Kiszka
@ 2016-02-21 19:00 ` David Kiarie
0 siblings, 0 replies; 53+ messages in thread
From: David Kiarie @ 2016-02-21 19:00 UTC (permalink / raw)
To: Jan Kiszka
Cc: Marcel Apfelbaum, Valentine Sinitsyn, QEMU Developers,
Michael S. Tsirkin
On Sun, Feb 21, 2016 at 9:20 PM, Jan Kiszka <jan.kiszka@web.de> wrote:
> On 2016-02-21 19:10, David Kiarie wrote:
>> Add IVRS table for AMD IOMMU. Generate IVRS or DMAR
>> depending on emulated IOMMU
>>
>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> ---
>> hw/i386/acpi-build.c | 208 +++++++++++++++++++++++++++++++++++++++++---
>> include/hw/acpi/acpi-defs.h | 55 ++++++++++++
>> 2 files changed, 252 insertions(+), 11 deletions(-)
>>
>> diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
>> index 4554eb8..fa1310f 100644
>> --- a/hw/i386/acpi-build.c
>> +++ b/hw/i386/acpi-build.c
>> @@ -51,6 +51,7 @@
>> #include "hw/pci/pci_bus.h"
>> #include "hw/pci-host/q35.h"
>> #include "hw/i386/intel_iommu.h"
>> +#include "hw/i386/amd_iommu.h"
>> #include "hw/timer/hpet.h"
>>
>> #include "hw/acpi/aml-build.h"
>> @@ -121,6 +122,12 @@ typedef struct AcpiBuildPciBusHotplugState {
>> bool pcihp_bridge_en;
>> } AcpiBuildPciBusHotplugState;
>>
>> +typedef enum iommu_type {
>> + TYPE_AMD,
>> + TYPE_INTEL,
>> + TYPE_NONE
>> +} iommu_type;
>> +
>> static
>> int acpi_add_cpu_info(Object *o, void *opaque)
>> {
>> @@ -2513,6 +2520,188 @@ build_dmar_q35(GArray *table_data, GArray *linker)
>> "DMAR", table_data->len - dmar_start, 1, NULL, NULL);
>> }
>>
>> +static void
>> +build_amd_iommu(GArray *table_data, GArray *linker)
>> +{
>> + int iommu_start = table_data->len;
>> + bool iommu_ambig;
>> +
>> + AcpiAMDIOMMUIVRS *ivrs;
>> + AcpiAMDIOMMUHardwareUnit *iommu;
>> +
>> + /* IVRS definition */
>> + ivrs = acpi_data_push(table_data, sizeof(*ivrs));
>> + ivrs->revision = cpu_to_le16(ACPI_IOMMU_IVRS_TYPE);
>> + ivrs->length = cpu_to_le16((sizeof(*ivrs) + sizeof(*iommu)));
>> + ivrs->v_common_info = cpu_to_le64(AMD_IOMMU_HOST_ADDRESS_WIDTH << 8);
>> +
>> + AMDIOMMUState *s = (AMDIOMMUState *)object_resolve_path_type("",
>> + TYPE_AMD_IOMMU_DEVICE, &iommu_ambig);
>> +
>> + /* IVDB definition - type 10h */
>> + iommu = acpi_data_push(table_data, sizeof(*iommu));
>> + if (!iommu_ambig) {
>> + iommu->type = cpu_to_le16(0x10);
>> + /* IVHD flags */
>> + iommu->flags = cpu_to_le16(iommu->flags);
>> + iommu->flags = cpu_to_le16(IVHD_HT_TUNEN | IVHD_PPRSUP | IVHD_IOTLBSUP
>> + | IVHD_PREFSUP);
>> + iommu->length = cpu_to_le16(sizeof(*iommu));
>> + iommu->device_id = cpu_to_le16(PCI_DEVICE_ID_RD890_IOMMU);
>> + iommu->capability_offset = cpu_to_le16(s->capab_offset);
>> + iommu->mmio_base = cpu_to_le64(s->mmio.addr);
>> + iommu->pci_segment = 0;
>> + iommu->interrupt_info = 0;
>> + /* EFR features */
>> + iommu->efr_register = cpu_to_le64(IVHD_EFR_GTSUP | IVHD_EFR_HATS
>> + | IVHD_EFR_GATS);
>> + iommu->efr_register = cpu_to_le64(iommu->efr_register);
>> + /* device entries */
>> + memset(iommu->dev_entries, 0, 20);
>> + /* Add device flags here
>> + * This is are 4-byte device entries currently reporting the range of
>> + * devices 00h - ffffh; all devices
>> + *
>> + * Device setting affecting all devices should be made here
>> + *
>> + * Refer to
>> + * (http://developer.amd.com/wordpress/media/2012/10/488821.pdf)
>> + * 5.2.2.1
>> + */
>> + iommu->dev_entries[12] = 3;
>> + iommu->dev_entries[16] = 4;
>> + iommu->dev_entries[17] = 0xff;
>> + iommu->dev_entries[18] = 0xff;
>> + }
>> +
>> + build_header(linker, table_data, (void *)(table_data->data + iommu_start),
>> + "IVRS", table_data->len - iommu_start, 1, NULL);
>> +}
>> +
>> +static iommu_type has_iommu(void)
>> +{
>> + bool ambiguous;
>> +
>> + if (object_resolve_path_type("", TYPE_AMD_IOMMU_DEVICE, &ambiguous)
>> + && !ambiguous)
>> + return TYPE_AMD;
>> + else if (object_resolve_path_type("", TYPE_INTEL_IOMMU_DEVICE, &ambiguous)
>> + && !ambiguous)
>> + return TYPE_INTEL;
>> + else
>> + return TYPE_NONE;
>> +}
>> +
>> +static void
>> +build_dsdt(GArray *table_data, GArray *linker,
>> + AcpiPmInfo *pm, AcpiMiscInfo *misc)
>> +{
>> + Aml *dsdt, *sb_scope, *scope, *dev, *method, *field;
>> + MachineState *machine = MACHINE(qdev_get_machine());
>> + uint32_t nr_mem = machine->ram_slots;
>> +
>> + dsdt = init_aml_allocator();
>> +
>> + /* Reserve space for header */
>> + acpi_data_push(dsdt->buf, sizeof(AcpiTableHeader));
>> +
>> + build_dbg_aml(dsdt);
>> + if (misc->is_piix4) {
>> + sb_scope = aml_scope("_SB");
>> + dev = aml_device("PCI0");
>> + aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A03")));
>> + aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
>> + aml_append(dev, aml_name_decl("_UID", aml_int(1)));
>> + aml_append(sb_scope, dev);
>> + aml_append(dsdt, sb_scope);
>> +
>> + build_hpet_aml(dsdt);
>> + build_piix4_pm(dsdt);
>> + build_piix4_isa_bridge(dsdt);
>> + build_isa_devices_aml(dsdt);
>> + build_piix4_pci_hotplug(dsdt);
>> + build_piix4_pci0_int(dsdt);
>> + } else {
>> + sb_scope = aml_scope("_SB");
>> + aml_append(sb_scope,
>> + aml_operation_region("PCST", AML_SYSTEM_IO, 0xae00, 0x0c));
>> + aml_append(sb_scope,
>> + aml_operation_region("PCSB", AML_SYSTEM_IO, 0xae0c, 0x01));
>> + field = aml_field("PCSB", AML_ANY_ACC, AML_NOLOCK, AML_WRITE_AS_ZEROS);
>> + aml_append(field, aml_named_field("PCIB", 8));
>> + aml_append(sb_scope, field);
>> + aml_append(dsdt, sb_scope);
>> +
>> + sb_scope = aml_scope("_SB");
>> + dev = aml_device("PCI0");
>> + aml_append(dev, aml_name_decl("_HID", aml_eisaid("PNP0A08")));
>> + aml_append(dev, aml_name_decl("_CID", aml_eisaid("PNP0A03")));
>> + aml_append(dev, aml_name_decl("_ADR", aml_int(0)));
>> + aml_append(dev, aml_name_decl("_UID", aml_int(1)));
>> + aml_append(dev, aml_name_decl("SUPP", aml_int(0)));
>> + aml_append(dev, aml_name_decl("CTRL", aml_int(0)));
>> + aml_append(dev, build_q35_osc_method());
>> + aml_append(sb_scope, dev);
>> + aml_append(dsdt, sb_scope);
>> +
>> + build_hpet_aml(dsdt);
>> + build_q35_isa_bridge(dsdt);
>> + build_isa_devices_aml(dsdt);
>> + build_q35_pci0_int(dsdt);
>> + }
>> +
>> + build_cpu_hotplug_aml(dsdt);
>> + build_memory_hotplug_aml(dsdt, nr_mem, pm->mem_hp_io_base,
>> + pm->mem_hp_io_len);
>> +
>> + scope = aml_scope("_GPE");
>> + {
>> + aml_append(scope, aml_name_decl("_HID", aml_string("ACPI0006")));
>> +
>> + aml_append(scope, aml_method("_L00", 0, AML_NOTSERIALIZED));
>> +
>> + if (misc->is_piix4) {
>> + method = aml_method("_E01", 0, AML_NOTSERIALIZED);
>> + aml_append(method,
>> + aml_acquire(aml_name("\\_SB.PCI0.BLCK"), 0xFFFF));
>> + aml_append(method, aml_call0("\\_SB.PCI0.PCNT"));
>> + aml_append(method, aml_release(aml_name("\\_SB.PCI0.BLCK")));
>> + aml_append(scope, method);
>> + } else {
>> + aml_append(scope, aml_method("_L01", 0, AML_NOTSERIALIZED));
>> + }
>> +
>> + method = aml_method("_E02", 0, AML_NOTSERIALIZED);
>> + aml_append(method, aml_call0("\\_SB." CPU_SCAN_METHOD));
>> + aml_append(scope, method);
>> +
>> + method = aml_method("_E03", 0, AML_NOTSERIALIZED);
>> + aml_append(method, aml_call0(MEMORY_HOTPLUG_HANDLER_PATH));
>> + aml_append(scope, method);
>> +
>> + aml_append(scope, aml_method("_L04", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L05", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L06", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L07", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L08", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L09", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L0A", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L0B", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L0C", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L0D", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L0E", 0, AML_NOTSERIALIZED));
>> + aml_append(scope, aml_method("_L0F", 0, AML_NOTSERIALIZED));
>> + }
>> + aml_append(dsdt, scope);
>> +
>> + /* copy AML table into ACPI tables blob and patch header there */
>> + g_array_append_vals(table_data, dsdt->buf->data, dsdt->buf->len);
>> + build_header(linker, table_data,
>> + (void *)(table_data->data + table_data->len - dsdt->buf->len),
>> + "DSDT", dsdt->buf->len, 1, NULL);
>
> Grabbed an old version by accident? This one still cannot build over
> current master (c3bce9d5f9).
heh, no, I sent the current version. Current workflow; Fix code, test
, rebase on master (and blow up everything), send.
Am replying with the correct patch, in case someone wants to test.
>
> In fact, there are more build error with this file. Please check
> carefully before posting.
>
> Jan
>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties
2016-02-21 18:10 ` [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties David Kiarie
@ 2016-02-21 20:09 ` Jan Kiszka
2016-03-02 20:51 ` David Kiarie
2016-03-11 13:20 ` Michael S. Tsirkin
1 sibling, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-02-21 20:09 UTC (permalink / raw)
To: David Kiarie, qemu-devel; +Cc: marcel, valentine.sinitsyn, mst
[-- Attachment #1: Type: text/plain, Size: 906 bytes --]
On 2016-02-21 19:10, David Kiarie wrote:
> diff --git a/qemu-options.hx b/qemu-options.hx
> index 2f0465e..dad160f 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -38,7 +38,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
> " kvm_shadow_mem=size of KVM shadow MMU\n"
> " dump-guest-core=on|off include guest memory in a core dump (default=on)\n"
> " mem-merge=on|off controls memory merge support (default: on)\n"
> - " iommu=on|off controls emulated Intel IOMMU (VT-d) support (default=off)\n"
> + " iommu=amd|intel enables and selects the emulated IOMMU (default: off)\n"
We should also support "iommu=off" or "none" to explicitly disable it.
That is consistent with other switches, and maybe there will once be a
machine type (chipset) with IOMMU enabled by default.
Jan
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
` (3 preceding siblings ...)
2016-02-21 18:11 ` [Qemu-devel] [V6 4/4] hw/pci-host: Emulate " David Kiarie
@ 2016-02-21 20:20 ` Jan Kiszka
2016-02-22 5:57 ` David Kiarie
2016-03-01 13:07 ` Michael S. Tsirkin
5 siblings, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-02-21 20:20 UTC (permalink / raw)
To: David Kiarie, qemu-devel; +Cc: marcel, valentine.sinitsyn, mst
[-- Attachment #1: Type: text/plain, Size: 607 bytes --]
On 2016-02-21 19:10, David Kiarie wrote:
> Hello there,
>
> Repost, AMD IOMMU patches version 6.
>
> Changes since version 5
> -Fixed macro formating issues
> -changed occurences of IO MMU to IOMMU for consistency
> -Fixed capability registers duplication
> -Rebased to current master
I suspect this still has some subtle bugs: I'm running the patches over
master with standard Linux distro as guest, full desktop, and I'm
getting sporadic segfaults of arbitrary programs. These disappear once I
disable the IOMMU or switch to the Intel version.
How did you test so far?
Jan
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-02-21 20:20 ` [Qemu-devel] [V6 0/4] " Jan Kiszka
@ 2016-02-22 5:57 ` David Kiarie
2016-02-22 7:29 ` Jan Kiszka
0 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-02-22 5:57 UTC (permalink / raw)
To: Jan Kiszka
Cc: Marcel Apfelbaum, Valentine Sinitsyn, QEMU Developers,
Michael S. Tsirkin
On Sun, Feb 21, 2016 at 11:20 PM, Jan Kiszka <jan.kiszka@web.de> wrote:
> On 2016-02-21 19:10, David Kiarie wrote:
>> Hello there,
>>
>> Repost, AMD IOMMU patches version 6.
>>
>> Changes since version 5
>> -Fixed macro formating issues
>> -changed occurences of IO MMU to IOMMU for consistency
>> -Fixed capability registers duplication
>> -Rebased to current master
>
> I suspect this still has some subtle bugs: I'm running the patches over
> master with standard Linux distro as guest, full desktop, and I'm
> getting sporadic segfaults of arbitrary programs. These disappear once I
> disable the IOMMU or switch to the Intel version.
Is this L1 guest or L2 guest ? - haven't got any such so far.
>
> How did you test so far?
I mainly test by logging. I've tested L1 without any iommu-related
command line parameters and with L1 with 'iommu=1 iommu=pt'. L2 guest;
passed-through a device checked it's working correctly, that all.
These guests barely have any load though.
>
> Jan
>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-02-22 5:57 ` David Kiarie
@ 2016-02-22 7:29 ` Jan Kiszka
2016-02-22 11:05 ` David Kiarie
0 siblings, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-02-22 7:29 UTC (permalink / raw)
To: David Kiarie
Cc: Marcel Apfelbaum, Valentine Sinitsyn, QEMU Developers,
Michael S. Tsirkin
[-- Attachment #1: Type: text/plain, Size: 1302 bytes --]
On 2016-02-22 06:57, David Kiarie wrote:
> On Sun, Feb 21, 2016 at 11:20 PM, Jan Kiszka <jan.kiszka@web.de> wrote:
>> On 2016-02-21 19:10, David Kiarie wrote:
>>> Hello there,
>>>
>>> Repost, AMD IOMMU patches version 6.
>>>
>>> Changes since version 5
>>> -Fixed macro formating issues
>>> -changed occurences of IO MMU to IOMMU for consistency
>>> -Fixed capability registers duplication
>>> -Rebased to current master
>>
>> I suspect this still has some subtle bugs: I'm running the patches over
>> master with standard Linux distro as guest, full desktop, and I'm
>> getting sporadic segfaults of arbitrary programs. These disappear once I
>> disable the IOMMU or switch to the Intel version.
>
> Is this L1 guest or L2 guest ? - haven't got any such so far.
It's L1 only.
>
>>
>> How did you test so far?
>
> I mainly test by logging. I've tested L1 without any iommu-related
> command line parameters and with L1 with 'iommu=1 iommu=pt'. L2 guest;
> passed-through a device checked it's working correctly, that all.
> These guests barely have any load though.
I quickly reproduced the issue by starting some "heavier" applications,
a browser or an office suite. Something is apparently always corrupted
then, data or code, thus the crashes.
Jan
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-02-22 7:29 ` Jan Kiszka
@ 2016-02-22 11:05 ` David Kiarie
2016-02-22 11:12 ` Jan Kiszka
0 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-02-22 11:05 UTC (permalink / raw)
To: Jan Kiszka
Cc: Marcel Apfelbaum, Valentine Sinitsyn, QEMU Developers,
Michael S. Tsirkin
On Mon, Feb 22, 2016 at 10:29 AM, Jan Kiszka <jan.kiszka@web.de> wrote:
> On 2016-02-22 06:57, David Kiarie wrote:
>> On Sun, Feb 21, 2016 at 11:20 PM, Jan Kiszka <jan.kiszka@web.de> wrote:
>>> On 2016-02-21 19:10, David Kiarie wrote:
>>>> Hello there,
>>>>
>>>> Repost, AMD IOMMU patches version 6.
>>>>
>>>> Changes since version 5
>>>> -Fixed macro formating issues
>>>> -changed occurences of IO MMU to IOMMU for consistency
>>>> -Fixed capability registers duplication
>>>> -Rebased to current master
>>>
>>> I suspect this still has some subtle bugs: I'm running the patches over
>>> master with standard Linux distro as guest, full desktop, and I'm
>>> getting sporadic segfaults of arbitrary programs. These disappear once I
>>> disable the IOMMU or switch to the Intel version.
>>
>> Is this L1 guest or L2 guest ? - haven't got any such so far.
>
> It's L1 only.
>
>>
>>>
>>> How did you test so far?
>>
>> I mainly test by logging. I've tested L1 without any iommu-related
>> command line parameters and with L1 with 'iommu=1 iommu=pt'. L2 guest;
>> passed-through a device checked it's working correctly, that all.
>> These guests barely have any load though.
>
> I quickly reproduced the issue by starting some "heavier" applications,
> a browser or an office suite. Something is apparently always corrupted
> then, data or code, thus the crashes.
Can't reproduce this issue with my ubuntu/debian VMs. Are you using
any iommu-related command line parameters ?
>
> Jan
>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-02-22 11:05 ` David Kiarie
@ 2016-02-22 11:12 ` Jan Kiszka
0 siblings, 0 replies; 53+ messages in thread
From: Jan Kiszka @ 2016-02-22 11:12 UTC (permalink / raw)
To: David Kiarie
Cc: Marcel Apfelbaum, Valentine Sinitsyn, QEMU Developers,
Michael S. Tsirkin
[-- Attachment #1: Type: text/plain, Size: 1883 bytes --]
On 2016-02-22 12:05, David Kiarie wrote:
> On Mon, Feb 22, 2016 at 10:29 AM, Jan Kiszka <jan.kiszka@web.de> wrote:
>> On 2016-02-22 06:57, David Kiarie wrote:
>>> On Sun, Feb 21, 2016 at 11:20 PM, Jan Kiszka <jan.kiszka@web.de> wrote:
>>>> On 2016-02-21 19:10, David Kiarie wrote:
>>>>> Hello there,
>>>>>
>>>>> Repost, AMD IOMMU patches version 6.
>>>>>
>>>>> Changes since version 5
>>>>> -Fixed macro formating issues
>>>>> -changed occurences of IO MMU to IOMMU for consistency
>>>>> -Fixed capability registers duplication
>>>>> -Rebased to current master
>>>>
>>>> I suspect this still has some subtle bugs: I'm running the patches over
>>>> master with standard Linux distro as guest, full desktop, and I'm
>>>> getting sporadic segfaults of arbitrary programs. These disappear once I
>>>> disable the IOMMU or switch to the Intel version.
>>>
>>> Is this L1 guest or L2 guest ? - haven't got any such so far.
>>
>> It's L1 only.
>>
>>>
>>>>
>>>> How did you test so far?
>>>
>>> I mainly test by logging. I've tested L1 without any iommu-related
>>> command line parameters and with L1 with 'iommu=1 iommu=pt'. L2 guest;
>>> passed-through a device checked it's working correctly, that all.
>>> These guests barely have any load though.
>>
>> I quickly reproduced the issue by starting some "heavier" applications,
>> a browser or an office suite. Something is apparently always corrupted
>> then, data or code, thus the crashes.
>
> Can't reproduce this issue with my ubuntu/debian VMs. Are you using
> any iommu-related command line parameters ?
This is my command line:
qemu-system-x86_64
-drive file=/path/to/64-bit-linux.img,discard=unmap,if=none,id=disk
-device ide-hd,drive=disk -snapshot -m 1G -enable-kvm -smp 4
-machine q35,iommu=amd
64-bit guest userland, linus.git head guest kernel.
Jan
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-02-21 18:11 ` [Qemu-devel] [V6 4/4] hw/pci-host: Emulate " David Kiarie
@ 2016-02-22 11:22 ` Marcel Apfelbaum
[not found] ` <56D75688.1020500@gmail.com>
2016-03-11 13:22 ` Michael S. Tsirkin
1 sibling, 1 reply; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-02-22 11:22 UTC (permalink / raw)
To: David Kiarie, qemu-devel; +Cc: valentine.sinitsyn, jan.kiszka, mst
On 02/21/2016 08:11 PM, David Kiarie wrote:
> Add AMD IOMMU emulation support to q35 chipset
>
> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> ---
> hw/pci-host/piix.c | 1 +
> hw/pci-host/q35.c | 14 ++++++++++++--
> include/hw/i386/intel_iommu.h | 1 +
> 3 files changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
> index 41aa66f..ab2e24a 100644
> --- a/hw/pci-host/piix.c
> +++ b/hw/pci-host/piix.c
> @@ -36,6 +36,7 @@
> #include "hw/i386/ioapic.h"
> #include "qapi/visitor.h"
> #include "qemu/error-report.h"
> +#include "hw/i386/amd_iommu.h"
Hi,
I think you don't need this include anymore.
>
> /*
> * I440FX chipset data sheet.
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 115fb8c..355fb32 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -31,6 +31,7 @@
> #include "hw/hw.h"
> #include "hw/pci-host/q35.h"
> #include "qapi/visitor.h"
> +#include "hw/i386/amd_iommu.h"
>
> /****************************************************************************
> * Q35 host
> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
> mch->pci_address_space, &mch->pam_regions[i+1],
> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
> }
> - /* Intel IOMMU (VT-d) */
> - if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
> +
> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR) == 0) {
> + /* Intel IOMMU (VT-d) */
> mch_init_dmar(mch);
> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, AMD_IOMMU_STR)
> + == 0) {
> + AMDIOMMUState *iommu_state;
> + PCIDevice *iommu;
> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
> + iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
> + iommu_state = AMD_IOMMU_DEVICE(iommu);
> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
pci_setup_iommu third parameter is void*, so you don't need to cast to AMDIOMMUState
before passing it.
Thanks,
Marcel
> }
> }
>
> diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
> index b024ffa..539530c 100644
> --- a/include/hw/i386/intel_iommu.h
> +++ b/include/hw/i386/intel_iommu.h
> @@ -27,6 +27,7 @@
> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
> #define INTEL_IOMMU_DEVICE(obj) \
> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
> +#define INTEL_IOMMU_STR "intel"
>
> /* DMAR Hardware Unit Definition address (IOMMU unit) */
> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-02-21 18:10 ` [Qemu-devel] [V6 1/4] hw/i386: Introduce " David Kiarie
@ 2016-02-25 15:43 ` Marcel Apfelbaum
2016-02-26 6:23 ` David Kiarie
2016-03-02 19:11 ` David Kiarie
0 siblings, 2 replies; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-02-25 15:43 UTC (permalink / raw)
To: David Kiarie, qemu-devel; +Cc: valentine.sinitsyn, jan.kiszka, mst
On 02/21/2016 08:10 PM, David Kiarie wrote:
> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
> The IOMMU does basic translation, error checking and has a
> mininal IOTLB implementation
Hi,
>
> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> ---
> hw/i386/Makefile.objs | 1 +
> hw/i386/amd_iommu.c | 1432 +++++++++++++++++++++++++++++++++++++++++++++++++
> hw/i386/amd_iommu.h | 395 ++++++++++++++
> include/hw/pci/pci.h | 2 +
> 4 files changed, 1830 insertions(+)
> create mode 100644 hw/i386/amd_iommu.c
> create mode 100644 hw/i386/amd_iommu.h
>
> diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
> index b52d5b8..2f1a265 100644
> --- a/hw/i386/Makefile.objs
> +++ b/hw/i386/Makefile.objs
> @@ -3,6 +3,7 @@ obj-y += multiboot.o
> obj-y += pc.o pc_piix.o pc_q35.o
> obj-y += pc_sysfw.o
> obj-y += intel_iommu.o
> +obj-y += amd_iommu.o
> obj-$(CONFIG_XEN) += ../xenpv/ xen/
>
> obj-y += kvmvapic.o
> diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
> new file mode 100644
> index 0000000..3dac043
> --- /dev/null
> +++ b/hw/i386/amd_iommu.c
> @@ -0,0 +1,1432 @@
> +/*
> + * QEMU emulation of AMD IOMMU (AMD-Vi)
> + *
> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation; either version 2 of the License, or
> + * (at your option) any later version.
> +
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> + * GNU General Public License for more details.
> +
> + * You should have received a copy of the GNU General Public License along
> + * with this program; if not, see <http://www.gnu.org/licenses/>.
> + *
> + * Cache implementation inspired by hw/i386/intel_iommu.c
> + *
> + */
> +#include "hw/i386/amd_iommu.h"
> +
> +/*#define DEBUG_AMD_IOMMU*/
> +#ifdef DEBUG_AMD_IOMMU
> +enum {
> + DEBUG_GENERAL, DEBUG_CAPAB, DEBUG_MMIO, DEBUG_ELOG,
> + DEBUG_CACHE, DEBUG_COMMAND, DEBUG_MMU
> +};
> +
> +#define IOMMU_DBGBIT(x) (1 << DEBUG_##x)
> +static int iommu_dbgflags = IOMMU_DBGBIT(MMIO);
> +
> +#define IOMMU_DPRINTF(what, fmt, ...) do { \
> + if (iommu_dbgflags & IOMMU_DBGBIT(what)) { \
> + fprintf(stderr, "(amd-iommu)%s: " fmt "\n", __func__, \
> + ## __VA_ARGS__); } \
> + } while (0)
> +#else
> +#define IOMMU_DPRINTF(what, fmt, ...) do {} while (0)
> +#endif
> +
> +typedef struct AMDIOMMUAddressSpace {
> + uint8_t bus_num; /* bus number */
> + uint8_t devfn; /* device function */
> + AMDIOMMUState *iommu_state; /* IOMMU - one per machine */
> + MemoryRegion iommu; /* Device's iommu region */
> + AddressSpace as; /* device's corresponding address space */
> +} AMDIOMMUAddressSpace;
> +
> +/* IOMMU cache entry */
> +typedef struct IOMMUIOTLBEntry {
> + uint64_t gfn;
> + uint16_t domid;
> + uint64_t devid;
> + uint64_t perms;
> + uint64_t translated_addr;
> +} IOMMUIOTLBEntry;
> +
> +/* configure MMIO registers at startup/reset */
> +static void amd_iommu_set_quad(AMDIOMMUState *s, hwaddr addr, uint64_t val,
> + uint64_t romask, uint64_t w1cmask)
> +{
> + stq_le_p(&s->mmior[addr], val);
> + stq_le_p(&s->romask[addr], romask);
> + stq_le_p(&s->w1cmask[addr], w1cmask);
> +}
> +
> +static uint16_t amd_iommu_readw(AMDIOMMUState *s, hwaddr addr)
> +{
> + return lduw_le_p(&s->mmior[addr]);
> +}
> +
> +static uint32_t amd_iommu_readl(AMDIOMMUState *s, hwaddr addr)
> +{
> + return ldl_le_p(&s->mmior[addr]);
> +}
> +
> +static uint64_t amd_iommu_readq(AMDIOMMUState *s, hwaddr addr)
> +{
> + return ldq_le_p(&s->mmior[addr]);
> +}
> +
> +/* internal write */
> +static void amd_iommu_writeq_raw(AMDIOMMUState *s, uint64_t val, hwaddr addr)
> +{
> + stq_le_p(&s->mmior[addr], val);
> +}
> +
> +/* external write */
> +static void amd_iommu_writew(AMDIOMMUState *s, hwaddr addr, uint16_t val)
> +{
> + uint16_t romask = lduw_le_p(&s->romask[addr]);
> + uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
> + uint16_t oldval = lduw_le_p(&s->mmior[addr]);
> + stw_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask & oldval));
> +}
> +
> +static void amd_iommu_writel(AMDIOMMUState *s, hwaddr addr, uint32_t val)
> +{
> + uint32_t romask = ldl_le_p(&s->romask[addr]);
> + uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
> + uint32_t oldval = ldl_le_p(&s->mmior[addr]);
> + stl_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask & oldval));
> +}
> +
> +static void amd_iommu_writeq(AMDIOMMUState *s, hwaddr addr, uint64_t val)
> +{
> + uint64_t romask = ldq_le_p(&s->romask[addr]);
> + uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
> + uint32_t oldval = ldq_le_p(&s->mmior[addr]);
> + stq_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask & oldval));
> +}
> +
> +static void amd_iommu_log_event(AMDIOMMUState *s, uint16_t *evt)
> +{
> + /* event logging not enabled */
> + if (!s->evtlog_enabled || *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |
> + IOMMU_MMIO_STATUS_EVT_OVF) {
> + return;
> + }
> +
> + /* event log buffer full */
> + if (s->evtlog_tail >= s->evtlog_len) {
> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_EVT_OVF;
> + /* generate interrupt */
> + msi_notify(&s->dev, 0);
> + }
> +
> + if (dma_memory_write(&address_space_memory, s->evtlog_len + s->evtlog_tail,
> + &evt, IOMMU_EVENT_LEN)) {
> + IOMMU_DPRINTF(ELOG, "error: fail to write at address 0x%"PRIx64
> + " + offset 0x%"PRIx32, s->evtlog, s->evtlog_tail);
> + }
> +
> + s->evtlog_tail += IOMMU_EVENT_LEN;
> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
> +}
> +
> +/* log an error encountered page-walking
> + *
> + * @addr: virtual address in translation request
> + */
> +static void amd_iommu_page_fault(AMDIOMMUState *s, uint16_t devid,
> + dma_addr_t addr, uint16_t info)
> +{
> + IOMMU_DPRINTF(ELOG, "");
> +
> + uint16_t evt[8];
> +
> + info |= IOMMU_EVENT_IOPF_I;
> +
> + /* encode information */
> + *(uint16_t *)&evt[0] = devid;
> + *(uint16_t *)&evt[3] = info;
> + *(uint64_t *)&evt[4] = cpu_to_le64(addr);
> +
> + /* log a page fault */
> + amd_iommu_log_event(s, evt);
> +
> + /* Abort the translation */
> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
> + PCI_STATUS_SIG_TARGET_ABORT);
> +}
> +/*
> + * log a master abort accessing device table
> + * @devtab : address of device table entry
> + * @info : error flags
> + */
> +static void amd_iommu_log_devtab_error(AMDIOMMUState *s, uint16_t devid,
> + dma_addr_t devtab, uint16_t info)
> +{
> +
> + IOMMU_DPRINTF(ELOG, "");
> +
> + uint16_t evt[8];
> +
> + info |= IOMMU_EVENT_DEV_TAB_HW_ERROR;
> +
> + /* encode information */
> + *(uint16_t *)&evt[0] = devid;
> + *(uint8_t *)&evt[3] = info;
> + *(uint64_t *)&evt[4] = cpu_to_le64(devtab);
> +
> + amd_iommu_log_event(s, evt);
> +
> + /* Abort the translation */
> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
> + PCI_STATUS_SIG_TARGET_ABORT);
> +
> +}
> +
> +/* log a master abort encountered during a page-walk
> + * @addr : address that couldn't be accessed
> + */
> +static void amd_iommu_log_pagetab_error(AMDIOMMUState *s, uint16_t devid,
> + dma_addr_t addr, uint16_t info)
> +{
> + IOMMU_DPRINTF(ELOG, "");
> +
> + uint16_t evt[8];
> +
> + info |= IOMMU_EVENT_PAGE_TAB_HW_ERROR;
> +
> + /* encode information */
> + *(uint16_t *)&evt[0] = devid;
> + *(uint8_t *)&evt[3] = info;
> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
> +
> + amd_iommu_log_event(s, evt);
> +
> + /* Abort the translation */
> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
> + PCI_STATUS_SIG_TARGET_ABORT);
> +
> +}
> +
> +/* log an event trying to access command buffer
> + * @addr : address that couldn't be accessed
> + */
> +static void amd_iommu_log_command_error(AMDIOMMUState *s, dma_addr_t addr)
> +{
> + IOMMU_DPRINTF(ELOG, "");
> +
> + uint16_t evt[8];
> +
> + /* encode information */
> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_COMMAND_HW_ERROR;
> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
> +
> + amd_iommu_log_event(s, evt);
> +
> + /* Abort the translation */
> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
> + PCI_STATUS_SIG_TARGET_ABORT);
> +}
> +
> +/* log an illegal comand event
> + * @addr : address of illegal command
> + */
> +static void amd_iommu_log_illegalcom_error(AMDIOMMUState *s, uint16_t info,
> + dma_addr_t addr)
> +{
> + IOMMU_DPRINTF(ELOG, "");
> +
> + uint16_t evt[8];
> +
> + /* encode information */
> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_ILLEGAL_COMMAND_ERROR;
> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
Can you please use a macro instead of 3 literal?
> +
> + amd_iommu_log_event(s, evt);
> +}
> +
> +/* log an error accessing device table
> + *
> + * @devid : device owning the table entry
> + * @devtab : address of device table entry
> + * @info : error flags
> + */
> +static void amd_iommu_log_illegaldevtab_error(AMDIOMMUState *s, uint16_t devid,
> + dma_addr_t addr, uint16_t info)
> +{
> + IOMMU_DPRINTF(ELOG, "");
> +
> + uint16_t evt[8];
> +
> + info |= IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY;
> +
> + *(uint16_t *)&evt[0] = devid;
> + *(uint8_t *)&evt[3] = info;
> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
> +
> + amd_iommu_log_event(s, evt);
> +}
It seems that the all log functions do the same:
create an event, log it and optionally set PCI_STATUS_SIG_TARGET_ABORT
I would consider to unite them in the same function. (not a must)
> +
> +static gboolean amd_iommu_uint64_equal(gconstpointer v1, gconstpointer v2)
> +{
> + return *((const uint64_t *)v1) == *((const uint64_t *)v2);
> +}
> +
> +static guint amd_iommu_uint64_hash(gconstpointer v)
> +{
> + return (guint)*(const uint64_t *)v;
> +}
> +
> +static IOMMUIOTLBEntry *amd_iommu_iotlb_lookup(AMDIOMMUState *s, hwaddr addr,
> + uint64_t devid)
> +{
> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
> + return g_hash_table_lookup(s->iotlb, &key);
> +}
> +
> +static void amd_iommu_iotlb_reset(AMDIOMMUState *s)
> +{
> + assert(s->iotlb);
> + g_hash_table_remove_all(s->iotlb);
> +}
> +
> +static gboolean amd_iommu_iotlb_remove_by_devid(gpointer key, gpointer value,
> + gpointer user_data)
> +{
> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
> + uint16_t devid = *(uint16_t *)user_data;
> + return entry->devid == devid;
> +}
> +
> +static void amd_iommu_iotlb_remove_page(AMDIOMMUState *s, hwaddr addr,
> + uint64_t devid)
> +{
> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
> + g_hash_table_remove(s->iotlb, &key);
> +}
> +
> +/* extract device id */
> +static inline uint16_t devid_extract(uint8_t *cmd)
> +{
> + return (uint16_t)cmd[2] & IOMMU_INVAL_DEV_ID_MASK;
> +}
> +
> +static void amd_iommu_invalidate_iotlb(AMDIOMMUState *s, uint64_t *cmd)
> +{
> + uint16_t devid = devid_extract((uint8_t *)cmd);
> + /* if invalidation of more than one page requested */
> + if (IOMMU_INVAL_ALL(cmd[0])) {
> + g_hash_table_foreach_remove(s->iotlb, amd_iommu_iotlb_remove_by_devid,
> + &devid);
> + } else {
> + hwaddr addr = (hwaddr)(cmd[1] & IOMMU_INVAL_ADDR_MASK);
> + amd_iommu_iotlb_remove_page(s, addr, devid);
> + }
> +}
> +
> +static void amd_iommu_update_iotlb(AMDIOMMUState *s, uint16_t devid,
> + uint64_t gpa, uint64_t spa, uint64_t perms,
> + uint16_t domid)
> +{
> + IOMMUIOTLBEntry *entry = g_malloc(sizeof(*entry));
> + uint64_t *key = g_malloc(sizeof(key));
> + uint64_t gfn = gpa >> IOMMU_PAGE_SHIFT_4K;
> +
> + IOMMU_DPRINTF(CACHE, " update iotlb devid: %02x:%02x.%x gpa 0x%"PRIx64
> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
> + PCI_FUNC(devid), gpa, spa);
> +
> + if (g_hash_table_size(s->iotlb) >= IOMMU_IOTLB_MAX_SIZE) {
> + IOMMU_DPRINTF(CACHE, "iotlb exceeds size limit - reset");
> + amd_iommu_iotlb_reset(s);
> + }
> +
> + entry->gfn = gfn;
> + entry->domid = domid;
> + entry->perms = perms;
> + entry->translated_addr = spa;
> + *key = gfn | ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
> + g_hash_table_replace(s->iotlb, key, entry);
> +}
> +
> +/* execute a completion wait command */
> +static void amd_iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> + unsigned int addr;
> +
> + /* completion store */
> + if (cmd[0] & IOMMU_COM_COMPLETION_STORE_MASK) {
> + addr = le64_to_cpu(*(uint64_t *)cmd) & IOMMU_COM_STORE_ADDRESS_MASK;
> + if (dma_memory_write(&address_space_memory, addr, cmd + 8, 8)) {
> + IOMMU_DPRINTF(ELOG, "error: fail to write at address 0%x"PRIx64,
> + addr);
> + }
> + }
> +
> + /* set completion interrupt */
> + if (cmd[0] & IOMMU_COM_COMPLETION_INTR) {
> + s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
> + }
> +}
> +
> +/* get command type */
> +static uint8_t opcode(uint8_t *cmd)
> +{
> + return cmd[IOMMU_CMDBUF_ID_BYTE] >> IOMMU_CMDBUF_ID_RSHIFT;
> +}
> +
> +/* linux seems to be using reserved bits so I just log without abortig bug */
I couldn't quite understand the comment
> +static void iommu_inval_devtab_entry(AMDIOMMUState *s, uint8_t *cmd,
> + uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + /* This command should invalidate internal caches of which there isn't */
> + if (*(uint64_t *)&cmd[0] & IOMMU_CMD_INVAL_DEV_RSVD ||
> + *(uint64_t *)&cmd[1]) {
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + }
> +#ifdef DEBUG_AMD_IOMMU
> + uint16_t devid = devid_extract(cmd);
> +#endif
> + IOMMU_DPRINTF(COMMAND, "device table entry for devid: %02x:%02x.%x"
> + "invalidated", PCI_BUS_NUM(devid), PCI_SLOT(devid),
> + PCI_FUNC(devid));
> +}
> +
> +static void iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + if (*(uint32_t *)&cmd[1] & IOMMU_COMPLETION_WAIT_RSVD) {
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + }
> + /* pretend to wait for command execution to complete */
> + IOMMU_DPRINTF(COMMAND, "completion wait requested with store address 0x%"
> + PRIx64 " and store data 0x%"PRIx64, (cmd[0] &
> + IOMMU_COM_STORE_ADDRESS_MASK), *(uint64_t *)(cmd + 8));
> + amd_iommu_completion_wait(s, cmd);
> +}
> +
> +static void iommu_complete_ppr(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + if ((*(uint64_t *)&cmd[0] & IOMMU_COMPLETE_PPR_RQ_RSVD) ||
> + *(uint64_t *)&cmd[1] & 0xffff000000000000) {
Can you please document this mask?
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + }
> +
> + IOMMU_DPRINTF(COMMAND, "Execution of PPR queue requested");
> +}
> +
> +static void iommu_inval_all(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_ALL_RSVD) ||
> + *(uint64_t *)&cmd[1]) {
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + }
> +
> + amd_iommu_iotlb_reset(s);
> + IOMMU_DPRINTF(COMMAND, "Invalidation of all IOMMU cache requested");
> +}
> +
> +static inline uint16_t domid_extract(uint64_t *cmd)
> +{
> + return (uint16_t)cmd[0] & IOMMU_INVAL_PAGES_DOMID;
> +}
> +
> +static gboolean amd_iommu_iotlb_remove_by_domid(gpointer key, gpointer value,
> + gpointer user_data)
> +{
> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
> + uint16_t domid = *(uint16_t *)user_data;
> + return entry->domid == domid;
> +}
> +
> +/* we don't have devid - we can't remove pages by address */
> +static void iommu_inval_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> + uint16_t domid = domid_extract((uint64_t *)cmd);
> +
> + if (*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_PAGES_RSVD ||
> + *(uint32_t *)&cmd[1] & 0x00000ff0) {
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + }
> +
> + g_hash_table_foreach_remove(s->iotlb, amd_iommu_iotlb_remove_by_domid,
> + &domid);
> +
> + IOMMU_DPRINTF(COMMAND, "IOMMU pages for domain 0x%"PRIx16 "invalidated",
> + domid);
> +}
> +
> +static void iommu_prefetch_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + if ((*(uint64_t *)&cmd[0] & IOMMU_PRF_IOMMU_PAGES_RSVD) ||
> + (*(uint32_t *)&cmd[1] & 0x00000fd4)) {
Here the same, maybe you can name the mask, so we can easier follow the spec.
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + }
> +
> + IOMMU_DPRINTF(COMMAND, "Pre-fetch of IOMMU pages requested");
> +}
> +
> +static void iommu_inval_inttable(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_INTR_TABLE_RSVD) ||
> + *(uint64_t *)&cmd[1]) {
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + return;
> + }
> +
> + IOMMU_DPRINTF(COMMAND, "interrupt table invalidated");
> +}
> +
> +static void iommu_inval_iotlb(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + if (*(uint32_t *)&cmd[2] & IOMMU_INVAL_IOTLB_PAGES_RSVD) {
> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf + s->cmdbuf_head);
> + return;
> + }
> +
> + amd_iommu_invalidate_iotlb(s, (uint64_t *)cmd);
> + IOMMU_DPRINTF(COMMAND, "IOTLB pages invalidated");
> +}
> +
> +/* not honouring reserved bits is regarded as an illegal command */
> +static void amd_iommu_cmdbuf_exec(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint8_t type;
> + uint8_t cmd[IOMMU_COMMAND_SIZE];
> +
> + memset(cmd, 0, IOMMU_COMMAND_SIZE);
> +
> + if (dma_memory_read(&address_space_memory, s->cmdbuf + s->cmdbuf_head, cmd,
> + IOMMU_COMMAND_SIZE)) {
> + IOMMU_DPRINTF(COMMAND, "error: fail to access memory at 0x%"PRIx64
> + " + 0x%"PRIu8, s->cmdbuf, s->cmdbuf_head);
> + amd_iommu_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
> + return;
> + }
> +
> + type = opcode(cmd);
> +
> + switch (type) {
> + case IOMMU_CMD_COMPLETION_WAIT:
> + iommu_completion_wait(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_INVAL_DEVTAB_ENTRY:
> + iommu_inval_devtab_entry(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_INVAL_IOMMU_PAGES:
> + iommu_inval_pages(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_INVAL_IOTLB_PAGES:
> + iommu_inval_iotlb(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_INVAL_INTR_TABLE:
> + iommu_inval_inttable(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_PREFETCH_IOMMU_PAGES:
> + iommu_prefetch_pages(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_COMPLETE_PPR_REQUEST:
> + iommu_complete_ppr(s, cmd, type);
> + break;
> +
> + case IOMMU_CMD_INVAL_IOMMU_ALL:
> + iommu_inval_all(s, cmd, type);
> + break;
> +
> + default:
> + IOMMU_DPRINTF(COMMAND, "unhandled command %d", type);
> + /* log illegal command */
> + amd_iommu_log_illegalcom_error(s, type,
> + s->cmdbuf + s->cmdbuf_head);
> + break;
> + }
> +
> +}
> +
> +static void amd_iommu_cmdbuf_run(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t *mmio_cmdbuf_head = (uint64_t *)(s->mmior +
> + IOMMU_MMIO_COMMAND_HEAD);
> +
> + if (!s->cmdbuf_enabled) {
> + IOMMU_DPRINTF(COMMAND, "error: IOMMU trying to execute commands with "
> + "command buffer disabled. IOMMU control value 0x%"PRIx64,
> + amd_iommu_readq(s, IOMMU_MMIO_CONTROL));
> + return;
> + }
> +
> + while (s->cmdbuf_head != s->cmdbuf_tail) {
> + /* check if there is work to do. */
> + IOMMU_DPRINTF(COMMAND, "command buffer head at 0x%"PRIx32 " command "
> + "buffer tail at 0x%"PRIx32" command buffer base at 0x%"
> + PRIx64, s->cmdbuf_head, s->cmdbuf_tail, s->cmdbuf);
> + amd_iommu_cmdbuf_exec(s);
> + s->cmdbuf_head += IOMMU_COMMAND_SIZE;
> + amd_iommu_writeq_raw(s, s->cmdbuf_head, IOMMU_MMIO_COMMAND_HEAD);
> +
> + /* wrap head pointer */
> + if (s->cmdbuf_head >= s->cmdbuf_len * IOMMU_COMMAND_SIZE) {
> + s->cmdbuf_head = 0;
> + }
> + }
> +
> + *mmio_cmdbuf_head = cpu_to_le64(s->cmdbuf_head);
> +}
> +
> +/* System Software might never read from some of this fields but anyways */
> +static uint64_t amd_iommu_mmio_read(void *opaque, hwaddr addr, unsigned size)
> +{
> + AMDIOMMUState *s = opaque;
> +
> + uint64_t val = -1;
The above might work, but it looks a little weird
> + if (addr + size > IOMMU_MMIO_SIZE) {
> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIX64
> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE, addr,
> + size);
> + return (uint64_t)-1;
> + }
> +
> + if (size == 2) {
> + val = amd_iommu_readw(s, addr);
> + } else if (size == 4) {
> + val = amd_iommu_readl(s, addr);
> + } else if (size == 8) {
> + val = amd_iommu_readq(s, addr);
> + }
> +
> + switch (addr & ~0x07) {
> + case IOMMU_MMIO_DEVICE_TABLE:
> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_COMMAND_BASE:
> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_BASE read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_EVENT_BASE:
> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_CONTROL:
> + IOMMU_DPRINTF(MMIO, "MMIO_CONTROL read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_EXCL_BASE:
> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_BASE read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_EXCL_LIMIT:
> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_COMMAND_HEAD:
> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_COMMAND_TAIL:
> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_TAIL read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_EVENT_HEAD:
> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_EVENT_TAIL:
> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_STATUS:
> + IOMMU_DPRINTF(MMIO, "MMIO_STATUS read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + break;
> +
> + case IOMMU_MMIO_EXT_FEATURES:
> + IOMMU_DPRINTF(MMU, "MMIO_EXT_FEATURES read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64 "value 0x%"PRIx64,
> + addr, size, addr & ~0x07, val);
> + break;
> +
> + default:
> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO read addr 0x%"PRIx64
> + ", size %d offset 0x%"PRIx64, addr, size,
> + addr & ~0x07);
> + }
> + return val;
> +}
> +
> +static void iommu_handle_control_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> + /*
> + * read whatever is already written in case
> + * software is writing in chucks less than 8 bytes
> + */
> + unsigned long control = amd_iommu_readq(s, IOMMU_MMIO_CONTROL);
> + s->enabled = !!(control & IOMMU_MMIO_CONTROL_IOMMUEN);
> +
> + s->ats_enabled = !!(control & IOMMU_MMIO_CONTROL_HTTUNEN);
> + s->evtlog_enabled = s->enabled && !!(control &
> + IOMMU_MMIO_CONTROL_EVENTLOGEN);
> +
> + s->evtlog_intr = !!(control & IOMMU_MMIO_CONTROL_EVENTINTEN);
> + s->completion_wait_intr = !!(control & IOMMU_MMIO_CONTROL_COMWAITINTEN);
> + s->cmdbuf_enabled = s->enabled && !!(control &
> + IOMMU_MMIO_CONTROL_CMDBUFLEN);
> +
> + /* update the flags depending on the control register */
> + if (s->cmdbuf_enabled) {
> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
> + IOMMU_MMIO_STATUS_CMDBUF_RUN;
> + } else {
> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
> + ~IOMMU_MMIO_STATUS_CMDBUF_RUN;
> + }
> + if (s->evtlog_enabled) {
> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
> + IOMMU_MMIO_STATUS_EVT_RUN;
> + } else {
> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
> + ~IOMMU_MMIO_STATUS_EVT_RUN;
> + }
> +
> + IOMMU_DPRINTF(COMMAND, "MMIO_STATUS state 0x%"PRIx64, control);
> +
> + amd_iommu_cmdbuf_run(s);
> +}
> +
> +static inline void iommu_handle_devtab_write(AMDIOMMUState *s)
> +
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_DEVICE_TABLE);
> + s->devtab = (dma_addr_t)(val & IOMMU_MMIO_DEVTAB_BASE_MASK);
> +
> + /* set device table length */
> + s->devtab_len = ((val & IOMMU_MMIO_DEVTAB_SIZE_MASK) + 1 *
> + (IOMMU_MMIO_DEVTAB_SIZE_UNIT /
> + IOMMU_MMIO_DEVTAB_ENTRY_SIZE));
> +}
> +
> +static inline void iommu_handle_cmdhead_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + s->cmdbuf_head = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_HEAD)
> + & IOMMU_MMIO_CMDBUF_HEAD_MASK;
> + amd_iommu_cmdbuf_run(s);
> +}
> +
> +static inline void iommu_handle_cmdbase_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + s->cmdbuf = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_BASE)
> + & IOMMU_MMIO_CMDBUF_BASE_MASK;
> + s->cmdbuf_len = 1UL << (s->mmior[IOMMU_MMIO_CMDBUF_SIZE_BYTE]
> + & IOMMU_MMIO_CMDBUF_SIZE_MASK);
> + s->cmdbuf_head = s->cmdbuf_tail = 0;
> +
> +}
> +
> +static inline void iommu_handle_cmdtail_write(AMDIOMMUState *s)
> +{
> + s->cmdbuf_tail = amd_iommu_readq(s, IOMMU_MMIO_COMMAND_TAIL)
> + & IOMMU_MMIO_CMDBUF_TAIL_MASK;
> + amd_iommu_cmdbuf_run(s);
> +}
> +
> +static inline void iommu_handle_excllim_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EXCL_LIMIT);
> + s->excl_limit = (val & IOMMU_MMIO_EXCL_LIMIT_MASK) |
> + IOMMU_MMIO_EXCL_LIMIT_LOW;
> +}
> +
> +static inline void iommu_handle_evtbase_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_BASE);
> + s->evtlog = val & IOMMU_MMIO_EVTLOG_BASE_MASK;
> + s->evtlog_len = 1UL << (*(uint64_t *)&s->mmior[IOMMU_MMIO_EVTLOG_SIZE_BYTE]
> + & IOMMU_MMIO_EVTLOG_SIZE_MASK);
> +}
> +
> +static inline void iommu_handle_evttail_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_TAIL);
> + s->evtlog_tail = val & IOMMU_MMIO_EVTLOG_TAIL_MASK;
> +}
> +
> +static inline void iommu_handle_evthead_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_HEAD);
> + s->evtlog_head = val & IOMMU_MMIO_EVTLOG_HEAD_MASK;
> +}
> +
> +static inline void iommu_handle_pprbase_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_BASE);
> + s->ppr_log = val & IOMMU_MMIO_PPRLOG_BASE_MASK;
> + s->pprlog_len = 1UL << (*(uint64_t *)&s->mmior[IOMMU_MMIO_PPRLOG_SIZE_BYTE]
> + & IOMMU_MMIO_PPRLOG_SIZE_MASK);
> +}
> +
> +static inline void iommu_handle_pprhead_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_HEAD);
> + s->pprlog_head = val & IOMMU_MMIO_PPRLOG_HEAD_MASK;
> +}
> +
> +static inline void iommu_handle_pprtail_write(AMDIOMMUState *s)
> +{
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_TAIL);
> + s->pprlog_tail = val & IOMMU_MMIO_PPRLOG_TAIL_MASK;
> +}
> +
> +/* FIXME: something might go wrong if System Software writes in chunks
> + * of one byte but linux writes in chunks of 4 bytes so currently it
> + * works correctly with linux but will definitely be busted if software
> + * reads/writes 8 bytes
> + */
> +static void amd_iommu_mmio_write(void *opaque, hwaddr addr, uint64_t val,
> + unsigned size)
> +{
> +
> + IOMMU_DPRINTF(COMMAND, "");
> +
> + AMDIOMMUState *s = opaque;
> + unsigned long offset = addr & 0x07;
> +
> + if (addr + size > IOMMU_MMIO_SIZE) {
> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIx64
> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE, addr,
> + size);
> + return;
> + }
> +
> + switch (addr & ~0x07) {
> + case IOMMU_MMIO_CONTROL:
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> +
> + IOMMU_DPRINTF(COMMAND, "MMIO_CONTROL write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + iommu_handle_control_write(s);
> + break;
> +
> + case IOMMU_MMIO_DEVICE_TABLE:
> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> +
> + /* set device table address
> + * This also suffers from inability to tell whether software
> + * is done writing
> + */
> +
> + if (offset || (size == 8)) {
> + iommu_handle_devtab_write(s);
> + }
> + break;
> +
> + case IOMMU_MMIO_COMMAND_HEAD:
> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> +
> + iommu_handle_cmdhead_write(s);
> + break;
> +
> + case IOMMU_MMIO_COMMAND_BASE:
> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_BASE write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> +
> + /* FIXME - make sure System Software has finished writing incase
> + * it writes in chucks less than 8 bytes in a robust way.As for
> + * now, this hacks works for the linux driver
> + */
> + if (offset || (size == 8)) {
> + iommu_handle_cmdbase_write(s);
> + }
> + break;
> +
> + case IOMMU_MMIO_COMMAND_TAIL:
> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_TAIL write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_cmdtail_write(s);
> + break;
> +
> + case IOMMU_MMIO_EVENT_BASE:
> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_evtbase_write(s);
> + break;
> +
> + case IOMMU_MMIO_EVENT_HEAD:
> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_evthead_write(s);
> + break;
> +
> + case IOMMU_MMIO_EVENT_TAIL:
> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_evttail_write(s);
> + break;
> +
> + case IOMMU_MMIO_EXCL_LIMIT:
> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_excllim_write(s);
> + break;
> +
> + /* PPR log base - unused for now */
> + case IOMMU_MMIO_PPR_BASE:
> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_BASE write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_pprbase_write(s);
> + break;
> + /* PPR log head - also unused for now */
> + case IOMMU_MMIO_PPR_HEAD:
> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_HEAD write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_pprhead_write(s);
> + break;
> + /* PPR log tail - unused for now */
> + case IOMMU_MMIO_PPR_TAIL:
> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_TAIL write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + if (size == 2) {
> + amd_iommu_writew(s, addr, val);
> + } else if (size == 4) {
> + amd_iommu_writel(s, addr, val);
> + } else if (size == 8) {
> + amd_iommu_writeq(s, addr, val);
> + }
> + iommu_handle_pprtail_write(s);
> + break;
> +
> + /* ignore write to ext_features */
> + default:
> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO write addr 0x%"PRIx64
> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
> + addr, size, val, offset);
> + }
> +
> +}
> +
> +static inline uint64_t amd_iommu_get_perms(uint64_t entry)
> +{
> + return (entry & (IOMMU_DEV_PERM_READ | IOMMU_DEV_PERM_WRITE)) >>
> + IOMMU_DEV_PERM_SHIFT;
> +}
> +
> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn)
> +{
> + AMDIOMMUState *s = opaque;
> + AMDIOMMUAddressSpace **iommu_as;
> + int bus_num = pci_bus_num(bus);
> +
> + /* just in case */
This comment troubles me, do we need the assert?
> + assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
bus_num < PCI_BUS_MAX, right ?
> + assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
same with devfn I suppose.
> +
> + iommu_as = s->address_spaces[bus_num];
> +
> + /* allocate memory during the first run */
> + if (!iommu_as) {
Why lazy init? We can do that at AMDIOMMUState init, right?
> + iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) * PCI_DEVFN_MAX);
> + s->address_spaces[bus_num] = iommu_as;
> + }
> +
> + /* set up IOMMU region */
> + if (!iommu_as[devfn]) {
> + iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
same here
> + iommu_as[devfn]->bus_num = (uint8_t)bus_num;
> + iommu_as[devfn]->devfn = (uint8_t)devfn;
> + iommu_as[devfn]->iommu_state = s;
> +
> + memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
> + &s->iommu_ops, "amd-iommu", UINT64_MAX);
> + address_space_init(&iommu_as[devfn]->as, &iommu_as[devfn]->iommu,
> + "amd-iommu");
> + }
> + return &iommu_as[devfn]->as;
> +}
> +
> +/* validate a page table entry */
> +static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
> + uint64_t *dte)
> +{
> + if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
> + || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
> + || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
> + amd_iommu_log_illegaldevtab_error(s, devid,
> + s->devtab + devid * IOMMU_DEVTAB_ENTRY_SIZE, 0);
> + return false;
> + }
> +
> + return dte[0] & IOMMU_DEV_VALID && (dte[0] & IOMMU_DEV_TRANSLATION_VALID)
> + && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
> +}
> +
> +/* get a device table entry given the devid */
> +static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t *entry)
> +{
> + uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
> +
> + IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
> +
> + if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
> + IOMMU_DEVTAB_ENTRY_SIZE)) {
> + IOMMU_DPRINTF(MMU, "error: fail to access Device Entry devtab 0x%"PRIx64
> + "offset 0x%"PRIx32, s->devtab, offset);
> + /* log ever accessing dte */
> + amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
> + return false;
> + }
> +
> + if (!amd_iommu_validate_dte(s, devid, entry)) {
> + IOMMU_DPRINTF(MMU,
> + "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +/* get pte translation mode */
> +static inline uint8_t get_pte_translation_mode(uint64_t pte)
> +{
> + return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
> +}
> +
> +static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
> + IOMMUTLBEntry *ret, unsigned perms,
> + hwaddr addr)
> +{
> + uint8_t level, oldlevel;
> + unsigned present;
> + uint64_t pte, pte_addr;
> + uint64_t pte_perms;
> + pte = dte[0];
> +
> + level = get_pte_translation_mode(pte);
> +
> + if (level >= 7 || level == 0) {
> + IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 " detected"
> + "while translating 0x%"PRIx64, level, addr);
> + return -1;
> + }
> +
> + while (level > 0) {
> + pte_perms = amd_iommu_get_perms(pte);
> + present = pte & 1;
> + if (!present || perms != (perms & pte_perms)) {
> + amd_iommu_page_fault(as->iommu_state, as->devfn, addr, perms);
> + IOMMU_DPRINTF(MMU, "error: page fault accessing virtual addr 0x%"
> + PRIx64, addr);
> + return -1;
> + }
> +
> + /* go to the next lower level */
> + pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
> + /* add offset and load pte */
> + pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
> + pte = ldq_phys(&address_space_memory, pte_addr);
> + oldlevel = level;
> + level = get_pte_translation_mode(pte);
> +
> + /* PT is corrupted or not there */
> + if (level != oldlevel - 1) {
> + return -1;
> + }
> + }
> +
> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
> + ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) & IOMMU_PAGE_MASK_4K;
> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
> + ret->perm = IOMMU_RW;
> + return 0;
> +}
> +
> +/* TODO : Mark addresses as Accessed and Dirty */
If you don't mark addresses as dirty, can't this cause the sporadic errors
of arbitrary programs Jan talked about?
> +static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr addr,
> + bool is_write, IOMMUTLBEntry *ret)
> +{
> + AMDIOMMUState *s = as->iommu_state;
> + uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
> + IOMMUIOTLBEntry *iotlb_entry;
> + uint8_t err;
> + uint64_t entry[4];
> +
> + /* try getting a cache entry first */
> + iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
> +
> + if (iotlb_entry) {
> + IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa 0x%"PRIx64
> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
> + PCI_FUNC(devid), addr, iotlb_entry->translated_addr);
> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
> + ret->translated_addr = iotlb_entry->translated_addr;
> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
> + ret->perm = iotlb_entry->perms;
> + return;
> + } else {
you return from the if clause so you don't need the else
> + if (!amd_iommu_get_dte(s, devid, entry)) {
is not an error if you did not find the device id?
> + goto out;
> + }
> +
> + err = amd_iommu_page_walk(as, entry, ret,
> + is_write ? IOMMU_PERM_WRITE : IOMMU_PERM_READ,
> + addr);
> + if (err) {
> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page tables"
> + " while translating addr 0x%"PRIx64, addr);
> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
> + goto out;
> + }
> +
> + amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
> + ret->perm, entry[1] & IOMMU_DEV_DOMID_ID_MASK);
> + return;
> + }
> +
> +out:
> + ret->iova = addr;
> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
> + ret->perm = IOMMU_RW;
> + return;
you don't need the above return
> +}
> +
> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr addr,
> + bool is_write)
> +{
> + IOMMU_DPRINTF(GENERAL, "");
> +
> + AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace, iommu);
> + AMDIOMMUState *s = as->iommu_state;
> +
> + IOMMUTLBEntry ret = {
> + .target_as = &address_space_memory,
> + .iova = addr,
> + .translated_addr = 0,
> + .addr_mask = ~(hwaddr)0,
> + .perm = IOMMU_NONE,
> + };
> +
> + if (!s->enabled) {
> + /* IOMMU disabled - corresponds to iommu=off not
> + * failure to provide any parameter
> + */
> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
> + ret.perm = IOMMU_RW;
> + return ret;
> + }
> +
> + amd_iommu_do_translate(as, addr, is_write, &ret);
> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa 0x%"PRIx64,
> + as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn), addr,
> + ret.translated_addr);
> +
> + return ret;
> +}
> +
> +static const MemoryRegionOps mmio_mem_ops = {
> + .read = amd_iommu_mmio_read,
> + .write = amd_iommu_mmio_write,
> + .endianness = DEVICE_LITTLE_ENDIAN,
> + .impl = {
> + .min_access_size = 1,
> + .max_access_size = 8,
> + .unaligned = false,
> + },
> + .valid = {
> + .min_access_size = 1,
> + .max_access_size = 8,
> + }
> +};
> +
> +static void amd_iommu_init(AMDIOMMUState *s)
> +{
> + printf("amd_iommu_init");
you should use the debug macro here
> +
> + amd_iommu_iotlb_reset(s);
> +
> + s->iommu_ops.translate = amd_iommu_translate;
> +
> + s->devtab_len = 0;
> + s->cmdbuf_len = 0;
> + s->cmdbuf_head = 0;
> + s->cmdbuf_tail = 0;
> + s->evtlog_head = 0;
> + s->evtlog_tail = 0;
> + s->excl_enabled = false;
> + s->excl_allow = false;
> + s->mmio_enabled = false;
> + s->enabled = false;
> + s->ats_enabled = false;
> + s->cmdbuf_enabled = false;
> +
> + /* reset MMIO */
> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
> + 0xffffffffffffffef, 0);
> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
> + /* reset device ident */
> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
> + pci_config_set_prog_interface(s->dev.config, 00);
> + pci_config_set_class(s->dev.config, 0x0806);
> +
> + /* reset IOMMU specific capabilities */
> + pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
> + s->mmio.addr & ~(0xffff0000));
> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
> + (s->mmio.addr & ~(0xffff)) >> 16);
> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
> + 0xff000000);
> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
All the capabilities are read-write? Otherwise you need to set the wmask
to indicate what fields are writable.
> +}
> +
> +static void amd_iommu_reset(DeviceState *dev)
> +{
> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
> +
> + amd_iommu_init(s);
> +}
> +
> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
> +{
> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
> +
> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
> + amd_iommu_uint64_equal, g_free, g_free);
> +
> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
> + IOMMU_CAPAB_SIZE);
> +
> + /* add msi and hypertransport capabilities */
> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
> +
> + amd_iommu_init(s);
> +
> + /* set up MMIO */
> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
> + IOMMU_MMIO_SIZE);
> +
> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
I don't understand why is need here. realize is called only once in the init process
and you set it a few lines below.
> + return;
> + }
> +
> + s->mmio.addr = IOMMU_BASE_ADDR;
> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR, &s->mmio);
> +}
> +
> +static const VMStateDescription vmstate_amd_iommu = {
> + .name = "amd-iommu",
> + .fields = (VMStateField[]) {
> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
> + VMSTATE_END_OF_LIST()
> + }
> +};
> +
> +static Property amd_iommu_properties[] = {
> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
> + DEFINE_PROP_END_OF_LIST(),
> +};
> +
> +static void amd_iommu_uninit(PCIDevice *dev)
> +{
> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
> + amd_iommu_iotlb_reset(s);
at this point you also need to clean also the memory regions you use.
> +}
> +
> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
> +{
> + DeviceClass *dc = DEVICE_CLASS(klass);
> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
> +
> + k->realize = amd_iommu_realize;
> + k->exit = amd_iommu_uninit;
> +
> + dc->reset = amd_iommu_reset;
> + dc->vmsd = &vmstate_amd_iommu;
> + dc->props = amd_iommu_properties;
> +}
> +
> +static const TypeInfo amd_iommu = {
> + .name = TYPE_AMD_IOMMU_DEVICE,
> + .parent = TYPE_PCI_DEVICE,
> + .instance_size = sizeof(AMDIOMMUState),
> + .class_init = amd_iommu_class_init
> +};
> +
> +static void amd_iommu_register_types(void)
> +{
> + type_register_static(&amd_iommu);
> +}
> +
> +type_init(amd_iommu_register_types);
> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
> new file mode 100644
> index 0000000..7d317e1
> --- /dev/null
> +++ b/hw/i386/amd_iommu.h
> @@ -0,0 +1,395 @@
> +/*
> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
> + *
> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
> + *
> + * This program is free software; you can redistribute it and/or modify
> + * it under the terms of the GNU General Public License as published by
> + * the Free Software Foundation; either version 2 of the License, or
> + * (at your option) any later version.
> +
> + * This program is distributed in the hope that it will be useful,
> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
> + * GNU General Public License for more details.
> +
> + * You should have received a copy of the GNU General Public License along
> + * with this program; if not, see <http://www.gnu.org/licenses/>.
> + */
> +
> +#ifndef AMD_IOMMU_H_
> +#define AMD_IOMMU_H_
> +
> +#include "hw/hw.h"
> +#include "hw/pci/pci.h"
> +#include "hw/pci/msi.h"
> +#include "hw/sysbus.h"
> +#include "sysemu/dma.h"
> +
> +/* Capability registers */
> +#define IOMMU_CAPAB_HEADER 0x00
> +#define IOMMU_CAPAB_REV_TYPE 0x02
> +#define IOMMU_CAPAB_FLAGS 0x03
> +#define IOMMU_CAPAB_BAR_LOW 0x04
> +#define IOMMU_CAPAB_BAR_HIGH 0x08
> +#define IOMMU_CAPAB_RANGE 0x0C
> +#define IOMMU_CAPAB_MISC 0x10
> +#define IOMMU_CAPAB_MISC1 0x14
> +
> +#define IOMMU_CAPAB_SIZE 0x18
> +#define IOMMU_CAPAB_REG_SIZE 0x04
> +
> +/* Capability header data */
> +#define IOMMU_CAPAB_ID_SEC 0xf
> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV | IOMMU_CAPAB_TYPE)
> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
> + IOMMU_CAPAB_FLAG_HTTUNNEL)
> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
> +
> +/* MMIO registers */
> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
> +#define IOMMU_MMIO_EVENT_BASE 0x0010
> +#define IOMMU_MMIO_CONTROL 0x0018
> +#define IOMMU_MMIO_EXCL_BASE 0x0020
> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
> +#define IOMMU_MMIO_STATUS 0x2020
> +#define IOMMU_MMIO_PPR_BASE 0x0038
> +#define IOMMU_MMIO_PPR_HEAD 0x2030
> +#define IOMMU_MMIO_PPR_TAIL 0x2038
> +
> +#define IOMMU_MMIO_SIZE 0x4000
> +
> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
> +
> +/* some of this are similar but just for readability */
> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
> +
> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
> +
> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
> +
> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
> +
> +/* mmio control register flags */
> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
> +
> +/* MMIO status register bits */
> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
> +
> +#define IOMMU_CMDBUF_ID_BYTE 0x07
> +#define IOMMU_CMDBUF_ID_RSHIFT 4
> +
> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
> +
> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
> +
> +/* Device table entry bits 0:63 */
> +#define IOMMU_DEV_VALID (1ULL << 0)
> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
> +#define IOMMU_DEV_MODE_MASK 0x7
> +#define IOMMU_DEV_MODE_RSHIFT 9
> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
> +#define IOMMU_DEV_PERM_SHIFT 61
> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
> +
> +/* Device table entry bits 64:127 */
> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
> +#define IOMMU_DEV_IOCTL_MASK (~3)
> +#define IOMMU_DEV_IOCTL_RSHIFT 20
> +#define IOMMU_DEV_IOCTL_DENY 0
> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
> +#define IOMMU_DEV_CACHE (1ULL << 37)
> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
> +#define IOMMU_DEV_EXCL (1ULL << 39)
> +
> +/* Event codes and flags, as stored in the info field */
> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
> +#define IOMMU_EVENT_IOPF (0x2U << 12)
> +#define IOMMU_EVENT_IOPF_I (1U << 3)
> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
> +
> +#define IOMMU_EVENT_LEN 16
> +#define IOMMU_PERM_READ (1 << 0)
> +#define IOMMU_PERM_WRITE (1 << 1)
> +#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
> +
> +/* AMD RD890 Chipset */
> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
We keep the pci ids in include/hw/pci/pci_ids.h
> +
> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
> +#define IOMMU_FEATURE_PPR (1ULL << 1)
> +#define IOMMU_FEATURE_NX (1ULL << 3)
> +#define IOMMU_FEATURE_GT (1ULL << 4)
> +#define IOMMU_FEATURE_IA (1ULL << 6)
> +#define IOMMU_FEATURE_GA (1ULL << 7)
> +#define IOMMU_FEATURE_HE (1ULL << 8)
> +#define IOMMU_FEATURE_PC (1ULL << 9)
> +
> +/* reserved DTE bits */
> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
> +
> +/* IOMMU paging mode */
> +#define IOMMU_GATS_MODE (6ULL << 12)
> +#define IOMMU_HATS_MODE (6ULL << 10)
> +
> +/* PCI SIG constants */
> +#define PCI_BUS_MAX 256
> +#define PCI_SLOT_MAX 32
> +#define PCI_FUNC_MAX 8
> +#define PCI_DEVFN_MAX 256
Maybe we can move the PCI macros to include/hw/pci/pci.h, those are not IOMMU specific.
> +
> +/* IOTLB */
> +#define IOMMU_IOTLB_MAX_SIZE 1024
> +#define IOMMU_DEVID_SHIFT 36
> +
> +/* extended feature support */
> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR | \
> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
> + IOMMU_HATS_MODE)
> +
> +/* capabilities header */
> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
> +
> +/* command constants */
> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
> +#define IOMMU_COM_COMPLETION_INTR 0x2
> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
> +#define IOMMU_COMMAND_SIZE 0x10
> +
> +/* IOMMU default address */
> +#define IOMMU_BASE_ADDR 0xfed80000
> +
> +/* page management constants */
> +#define IOMMU_PAGE_SHIFT 12
> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
> +
> +#define IOMMU_PAGE_SHIFT_4K 12
> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
> +#define IOMMU_PAGE_SHIFT_2M 21
> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
> +#define IOMMU_PAGE_SHIFT_1G 30
> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
> +
> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
> +
> +/* invalidation command device id */
> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) - 1))
> +
> +/* invalidation address */
> +#define IOMMU_INVAL_ADDR_MASK_SHIFT 12
> +#define IOMMU_INVAL_ADDR_MASK (~((1UL << IOMMU_INVAL_ADDR_MASK_SHIFT) - 1))
> +
> +/* invalidation S bit mask */
> +#define IOMMU_INVAL_ALL(val) ((val) & (0x1))
> +
> +/* reserved bits */
> +#define IOMMU_COMPLETION_WAIT_RSVD 0x0ff000000
> +#define IOMMU_CMD_INVAL_DEV_RSVD 0xffff00000fffffff
> +#define IOMMU_INVAL_IOMMU_PAGES_RSVD 0xfff000000fff0000
> +#define IOMMU_INVAL_IOTLB_PAGES_RSVD 0x00000ff4
> +#define IOMMU_INVAL_INTR_TABLE_RSVD 0xffff00000fffffff
> +#define IOMMU_PRF_IOMMU_PAGES_RSVD 0x00ff00000ff00000
> +#define IOMMU_COMPLETE_PPR_RQ_RSVD 0xffff00000ff00000
> +#define IOMMU_INVAL_IOMMU_ALL_RSVD 0x0fffffff00000000
> +
> +/* command masks - inval iommu pages */
> +#define IOMMU_INVAL_PAGES_PASID (~((1UL << 20) - 1))
> +#define IOMMU_INVAL_PAGES_DOMID (((1UL << 16) - 1) << 32)
> +#define IOMMU_INVAL_PAGES_ADDRESS (~((1UL << 12) - 1))
> +#define IOMMU_INVAL_PAGES_SBIT (1UL << 0)
> +#define IOMMU_INVAL_PAGES_PDE (1UL << 1)
> +#define IOMMU_INVAL_PAGES_GN (1UL << 2)
> +
> +/* masks - inval iotlb pages */
> +#define IOMMU_INVAL_IOTLB_DEVID (~((1UL << 16) - 1))
> +#define IOMMU_INVAL_IOTLB_PASID_LOW (0xff << 15)
> +#define IOMMU_INVAL_IOTLB_MAXPEND (0xff << 23)
> +#define IOMMU_INVAL_IOTLB_QUEUEID (~((1UL << 16) - 1))
> +#define IOMMU_INVAL_IOTLB_PASID_HIGH (0xff << 46)
> +#define IOMMU_INVAL_IOTLB_GN IOMMU_INVAL_PAGES_GN
> +#define IOMMU_INVAL_IOTLB_S IOMMU_INVAL_PAGES_S
> +#define IOMMU_INVAL_IOTLB_ADDRESS IOMMU_INVAL_PAGES_ADDRESS
> +#define IOMMU_INVAL_IOTLB_MAKEPASID(low, high)
> +
> +/* masks - prefetch pages */
> +#define IOMMU_PREFETCH_PAGES_DEVID IOMMU_INVAL_IOTLB_DEVID
> +#define IOMMU_PREFETCH_PAGES_PFCOUNT IOMMU_INVAL_IOTLB_MAXPEND
> +
> +#define TYPE_AMD_IOMMU_DEVICE "amd-iommu"
> +#define AMD_IOMMU_DEVICE(obj)\
> + OBJECT_CHECK(AMDIOMMUState, (obj), TYPE_AMD_IOMMU_DEVICE)
> +
> +#define AMD_IOMMU_STR "amd"
> +
> +typedef struct AMDIOMMUAddressSpace AMDIOMMUAddressSpace;
> +
> +typedef struct AMDIOMMUState {
> + PCIDevice dev; /* The PCI device itself */
> +
> + uint32_t version;
> +
> + uint32_t capab_offset; /* capability offset pointer */
> + uint64_t mmio_addr;
> + uint8_t *capab; /* capabilities registers */
> +
> + bool enabled; /* IOMMU enabled */
> + bool ats_enabled; /* address translation enabled */
> + bool cmdbuf_enabled; /* command buffer enabled */
> + bool evtlog_enabled; /* event log enabled */
> + bool excl_enabled;
> +
> + dma_addr_t devtab; /* base address device table */
> + size_t devtab_len; /* device table length */
> +
> + dma_addr_t cmdbuf; /* command buffer base address */
> + uint64_t cmdbuf_len; /* command buffer length */
> + uint32_t cmdbuf_head; /* current IOMMU read position */
> + uint32_t cmdbuf_tail; /* next Software write position */
> + bool completion_wait_intr;
> +
> + dma_addr_t evtlog; /* base address event log */
> + bool evtlog_intr;
> + uint32_t evtlog_len; /* event log length */
> + uint32_t evtlog_head; /* current IOMMU write position */
> + uint32_t evtlog_tail; /* current Software read position */
> +
> + /* unused for now */
I suggest what is not used to remove for now
> + dma_addr_t excl_base; /* base DVA - IOMMU exclusion range */
> + dma_addr_t excl_limit; /* limit of IOMMU exclusion range */
> + bool excl_allow; /* translate accesses to the exclusion range */
> + bool excl_enable; /* exclusion range enabled */
> +
> + dma_addr_t ppr_log; /* base address ppr log */
> + uint32_t pprlog_len; /* ppr log len */
> + uint32_t pprlog_head; /* ppr log head */
> + uint32_t pprlog_tail; /* ppr log tail */
> +
> + MemoryRegion mmio; /* MMIO region */
> + uint8_t mmior[IOMMU_MMIO_SIZE]; /* read/write MMIO */
> + uint8_t w1cmask[IOMMU_MMIO_SIZE]; /* read/write 1 clear mask */
> + uint8_t romask[IOMMU_MMIO_SIZE]; /* MMIO read/only mask */
> + bool mmio_enabled;
> +
> + /* IOMMU function */
> + MemoryRegionIOMMUOps iommu_ops;
> +
> + /* for each served device */
> + AMDIOMMUAddressSpace **address_spaces[PCI_BUS_MAX];
> +
> + /* IOTLB */
> + GHashTable *iotlb;
> +} AMDIOMMUState;
> +
> +/*
> + * bridge_host_amd_iommu: setup an IOMMU function on a bus
> + *
> + * called for all PCI devices
> + *
> + * @bus: PCI bus to host the IOMMU
> + * @opaque: opaque pointer to AMDIOMMUState struct
> + * @defvn: PCI function of device for which to setup IOMMU region for
> + *
> + */
> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn);
> +
> +#endif
> diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
> index dedf277..61deace 100644
> --- a/include/hw/pci/pci.h
> +++ b/include/hw/pci/pci.h
> @@ -15,6 +15,8 @@
>
> /* PCI bus */
>
> +#define PCI_BUS_NUM(x) (((x) >> 8) & 0xff)
> +#define PCI_DEVID(bus, devfn) ((((uint16_t)(bus)) << 8) | (devfn))
> #define PCI_DEVFN(slot, func) ((((slot) & 0x1f) << 3) | ((func) & 0x07))
> #define PCI_SLOT(devfn) (((devfn) >> 3) & 0x1f)
> #define PCI_FUNC(devfn) ((devfn) & 0x07)
>
Thanks,
Marcel
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-02-25 15:43 ` Marcel Apfelbaum
@ 2016-02-26 6:23 ` David Kiarie
2016-03-02 4:00 ` David Kiarie
2016-03-02 19:11 ` David Kiarie
1 sibling, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-02-26 6:23 UTC (permalink / raw)
To: Marcel Apfelbaum
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers, Michael S. Tsirkin
On Thu, Feb 25, 2016 at 6:43 PM, Marcel Apfelbaum <marcel@redhat.com> wrote:
> On 02/21/2016 08:10 PM, David Kiarie wrote:
>>
>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>> The IOMMU does basic translation, error checking and has a
>> mininal IOTLB implementation
>
>
> Hi,
>
>>
>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> ---
>> hw/i386/Makefile.objs | 1 +
>> hw/i386/amd_iommu.c | 1432
>> +++++++++++++++++++++++++++++++++++++++++++++++++
>> hw/i386/amd_iommu.h | 395 ++++++++++++++
>> include/hw/pci/pci.h | 2 +
>> 4 files changed, 1830 insertions(+)
>> create mode 100644 hw/i386/amd_iommu.c
>> create mode 100644 hw/i386/amd_iommu.h
>>
>> diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
>> index b52d5b8..2f1a265 100644
>> --- a/hw/i386/Makefile.objs
>> +++ b/hw/i386/Makefile.objs
>> @@ -3,6 +3,7 @@ obj-y += multiboot.o
>> obj-y += pc.o pc_piix.o pc_q35.o
>> obj-y += pc_sysfw.o
>> obj-y += intel_iommu.o
>> +obj-y += amd_iommu.o
>> obj-$(CONFIG_XEN) += ../xenpv/ xen/
>>
>> obj-y += kvmvapic.o
>> diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
>> new file mode 100644
>> index 0000000..3dac043
>> --- /dev/null
>> +++ b/hw/i386/amd_iommu.c
>> @@ -0,0 +1,1432 @@
>> +/*
>> + * QEMU emulation of AMD IOMMU (AMD-Vi)
>> + *
>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License as published by
>> + * the Free Software Foundation; either version 2 of the License, or
>> + * (at your option) any later version.
>> +
>> + * This program is distributed in the hope that it will be useful,
>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>> + * GNU General Public License for more details.
>> +
>> + * You should have received a copy of the GNU General Public License
>> along
>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>> + *
>> + * Cache implementation inspired by hw/i386/intel_iommu.c
>> + *
>> + */
>> +#include "hw/i386/amd_iommu.h"
>> +
>> +/*#define DEBUG_AMD_IOMMU*/
>> +#ifdef DEBUG_AMD_IOMMU
>> +enum {
>> + DEBUG_GENERAL, DEBUG_CAPAB, DEBUG_MMIO, DEBUG_ELOG,
>> + DEBUG_CACHE, DEBUG_COMMAND, DEBUG_MMU
>> +};
>> +
>> +#define IOMMU_DBGBIT(x) (1 << DEBUG_##x)
>> +static int iommu_dbgflags = IOMMU_DBGBIT(MMIO);
>> +
>> +#define IOMMU_DPRINTF(what, fmt, ...) do { \
>> + if (iommu_dbgflags & IOMMU_DBGBIT(what)) { \
>> + fprintf(stderr, "(amd-iommu)%s: " fmt "\n", __func__, \
>> + ## __VA_ARGS__); } \
>> + } while (0)
>> +#else
>> +#define IOMMU_DPRINTF(what, fmt, ...) do {} while (0)
>> +#endif
>> +
>> +typedef struct AMDIOMMUAddressSpace {
>> + uint8_t bus_num; /* bus number
>> */
>> + uint8_t devfn; /* device function
>> */
>> + AMDIOMMUState *iommu_state; /* IOMMU - one per machine
>> */
>> + MemoryRegion iommu; /* Device's iommu region
>> */
>> + AddressSpace as; /* device's corresponding address space
>> */
>> +} AMDIOMMUAddressSpace;
>> +
>> +/* IOMMU cache entry */
>> +typedef struct IOMMUIOTLBEntry {
>> + uint64_t gfn;
>> + uint16_t domid;
>> + uint64_t devid;
>> + uint64_t perms;
>> + uint64_t translated_addr;
>> +} IOMMUIOTLBEntry;
>> +
>> +/* configure MMIO registers at startup/reset */
>> +static void amd_iommu_set_quad(AMDIOMMUState *s, hwaddr addr, uint64_t
>> val,
>> + uint64_t romask, uint64_t w1cmask)
>> +{
>> + stq_le_p(&s->mmior[addr], val);
>> + stq_le_p(&s->romask[addr], romask);
>> + stq_le_p(&s->w1cmask[addr], w1cmask);
>> +}
>> +
>> +static uint16_t amd_iommu_readw(AMDIOMMUState *s, hwaddr addr)
>> +{
>> + return lduw_le_p(&s->mmior[addr]);
>> +}
>> +
>> +static uint32_t amd_iommu_readl(AMDIOMMUState *s, hwaddr addr)
>> +{
>> + return ldl_le_p(&s->mmior[addr]);
>> +}
>> +
>> +static uint64_t amd_iommu_readq(AMDIOMMUState *s, hwaddr addr)
>> +{
>> + return ldq_le_p(&s->mmior[addr]);
>> +}
>> +
>> +/* internal write */
>> +static void amd_iommu_writeq_raw(AMDIOMMUState *s, uint64_t val, hwaddr
>> addr)
>> +{
>> + stq_le_p(&s->mmior[addr], val);
>> +}
>> +
>> +/* external write */
>> +static void amd_iommu_writew(AMDIOMMUState *s, hwaddr addr, uint16_t val)
>> +{
>> + uint16_t romask = lduw_le_p(&s->romask[addr]);
>> + uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
>> + uint16_t oldval = lduw_le_p(&s->mmior[addr]);
>> + stw_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>> oldval));
>> +}
>> +
>> +static void amd_iommu_writel(AMDIOMMUState *s, hwaddr addr, uint32_t val)
>> +{
>> + uint32_t romask = ldl_le_p(&s->romask[addr]);
>> + uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
>> + uint32_t oldval = ldl_le_p(&s->mmior[addr]);
>> + stl_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>> oldval));
>> +}
>> +
>> +static void amd_iommu_writeq(AMDIOMMUState *s, hwaddr addr, uint64_t val)
>> +{
>> + uint64_t romask = ldq_le_p(&s->romask[addr]);
>> + uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
>> + uint32_t oldval = ldq_le_p(&s->mmior[addr]);
>> + stq_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>> oldval));
>> +}
>> +
>> +static void amd_iommu_log_event(AMDIOMMUState *s, uint16_t *evt)
>> +{
>> + /* event logging not enabled */
>> + if (!s->evtlog_enabled || *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |
>> + IOMMU_MMIO_STATUS_EVT_OVF) {
>> + return;
>> + }
>> +
>> + /* event log buffer full */
>> + if (s->evtlog_tail >= s->evtlog_len) {
>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>> IOMMU_MMIO_STATUS_EVT_OVF;
>> + /* generate interrupt */
>> + msi_notify(&s->dev, 0);
>> + }
>> +
>> + if (dma_memory_write(&address_space_memory, s->evtlog_len +
>> s->evtlog_tail,
>> + &evt, IOMMU_EVENT_LEN)) {
>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address 0x%"PRIx64
>> + " + offset 0x%"PRIx32, s->evtlog, s->evtlog_tail);
>> + }
>> +
>> + s->evtlog_tail += IOMMU_EVENT_LEN;
>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>> IOMMU_MMIO_STATUS_COMP_INT;
>> +}
>> +
>> +/* log an error encountered page-walking
>> + *
>> + * @addr: virtual address in translation request
>> + */
>> +static void amd_iommu_page_fault(AMDIOMMUState *s, uint16_t devid,
>> + dma_addr_t addr, uint16_t info)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_IOPF_I;
>> +
>> + /* encode information */
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint16_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = cpu_to_le64(addr);
>> +
>> + /* log a page fault */
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +}
>> +/*
>> + * log a master abort accessing device table
>> + * @devtab : address of device table entry
>> + * @info : error flags
>> + */
>> +static void amd_iommu_log_devtab_error(AMDIOMMUState *s, uint16_t devid,
>> + dma_addr_t devtab, uint16_t info)
>> +{
>> +
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_DEV_TAB_HW_ERROR;
>> +
>> + /* encode information */
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint8_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = cpu_to_le64(devtab);
>> +
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +
>> +}
>> +
>> +/* log a master abort encountered during a page-walk
>> + * @addr : address that couldn't be accessed
>> + */
>> +static void amd_iommu_log_pagetab_error(AMDIOMMUState *s, uint16_t devid,
>> + dma_addr_t addr, uint16_t info)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_PAGE_TAB_HW_ERROR;
>> +
>> + /* encode information */
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint8_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>> +
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +
>> +}
>> +
>> +/* log an event trying to access command buffer
>> + * @addr : address that couldn't be accessed
>> + */
>> +static void amd_iommu_log_command_error(AMDIOMMUState *s, dma_addr_t
>> addr)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + /* encode information */
>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_COMMAND_HW_ERROR;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>> +
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +}
>> +
>> +/* log an illegal comand event
>> + * @addr : address of illegal command
>> + */
>> +static void amd_iommu_log_illegalcom_error(AMDIOMMUState *s, uint16_t
>> info,
>> + dma_addr_t addr)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + /* encode information */
>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_ILLEGAL_COMMAND_ERROR;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>
>
> Can you please use a macro instead of 3 literal?
>
>> +
>> + amd_iommu_log_event(s, evt);
>> +}
>> +
>> +/* log an error accessing device table
>> + *
>> + * @devid : device owning the table entry
>> + * @devtab : address of device table entry
>> + * @info : error flags
>> + */
>> +static void amd_iommu_log_illegaldevtab_error(AMDIOMMUState *s, uint16_t
>> devid,
>> + dma_addr_t addr, uint16_t
>> info)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY;
>> +
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint8_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>> +
>> + amd_iommu_log_event(s, evt);
>> +}
>
>
> It seems that the all log functions do the same:
> create an event, log it and optionally set PCI_STATUS_SIG_TARGET_ABORT
>
> I would consider to unite them in the same function. (not a must)
>
>> +
>> +static gboolean amd_iommu_uint64_equal(gconstpointer v1, gconstpointer
>> v2)
>> +{
>> + return *((const uint64_t *)v1) == *((const uint64_t *)v2);
>> +}
>> +
>> +static guint amd_iommu_uint64_hash(gconstpointer v)
>> +{
>> + return (guint)*(const uint64_t *)v;
>> +}
>> +
>> +static IOMMUIOTLBEntry *amd_iommu_iotlb_lookup(AMDIOMMUState *s, hwaddr
>> addr,
>> + uint64_t devid)
>> +{
>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>> + return g_hash_table_lookup(s->iotlb, &key);
>> +}
>> +
>> +static void amd_iommu_iotlb_reset(AMDIOMMUState *s)
>> +{
>> + assert(s->iotlb);
>> + g_hash_table_remove_all(s->iotlb);
>> +}
>> +
>> +static gboolean amd_iommu_iotlb_remove_by_devid(gpointer key, gpointer
>> value,
>> + gpointer user_data)
>> +{
>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>> + uint16_t devid = *(uint16_t *)user_data;
>> + return entry->devid == devid;
>> +}
>> +
>> +static void amd_iommu_iotlb_remove_page(AMDIOMMUState *s, hwaddr addr,
>> + uint64_t devid)
>> +{
>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>> + g_hash_table_remove(s->iotlb, &key);
>> +}
>> +
>> +/* extract device id */
>> +static inline uint16_t devid_extract(uint8_t *cmd)
>> +{
>> + return (uint16_t)cmd[2] & IOMMU_INVAL_DEV_ID_MASK;
>> +}
>> +
>> +static void amd_iommu_invalidate_iotlb(AMDIOMMUState *s, uint64_t *cmd)
>> +{
>> + uint16_t devid = devid_extract((uint8_t *)cmd);
>> + /* if invalidation of more than one page requested */
>> + if (IOMMU_INVAL_ALL(cmd[0])) {
>> + g_hash_table_foreach_remove(s->iotlb,
>> amd_iommu_iotlb_remove_by_devid,
>> + &devid);
>> + } else {
>> + hwaddr addr = (hwaddr)(cmd[1] & IOMMU_INVAL_ADDR_MASK);
>> + amd_iommu_iotlb_remove_page(s, addr, devid);
>> + }
>> +}
>> +
>> +static void amd_iommu_update_iotlb(AMDIOMMUState *s, uint16_t devid,
>> + uint64_t gpa, uint64_t spa, uint64_t
>> perms,
>> + uint16_t domid)
>> +{
>> + IOMMUIOTLBEntry *entry = g_malloc(sizeof(*entry));
>> + uint64_t *key = g_malloc(sizeof(key));
>> + uint64_t gfn = gpa >> IOMMU_PAGE_SHIFT_4K;
>> +
>> + IOMMU_DPRINTF(CACHE, " update iotlb devid: %02x:%02x.%x gpa
>> 0x%"PRIx64
>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
>> + PCI_FUNC(devid), gpa, spa);
>> +
>> + if (g_hash_table_size(s->iotlb) >= IOMMU_IOTLB_MAX_SIZE) {
>> + IOMMU_DPRINTF(CACHE, "iotlb exceeds size limit - reset");
>> + amd_iommu_iotlb_reset(s);
>> + }
>> +
>> + entry->gfn = gfn;
>> + entry->domid = domid;
>> + entry->perms = perms;
>> + entry->translated_addr = spa;
>> + *key = gfn | ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>> + g_hash_table_replace(s->iotlb, key, entry);
>> +}
>> +
>> +/* execute a completion wait command */
>> +static void amd_iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> + unsigned int addr;
>> +
>> + /* completion store */
>> + if (cmd[0] & IOMMU_COM_COMPLETION_STORE_MASK) {
>> + addr = le64_to_cpu(*(uint64_t *)cmd) &
>> IOMMU_COM_STORE_ADDRESS_MASK;
>> + if (dma_memory_write(&address_space_memory, addr, cmd + 8, 8)) {
>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address
>> 0%x"PRIx64,
>> + addr);
>> + }
>> + }
>> +
>> + /* set completion interrupt */
>> + if (cmd[0] & IOMMU_COM_COMPLETION_INTR) {
>> + s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
>> + }
>> +}
>> +
>> +/* get command type */
>> +static uint8_t opcode(uint8_t *cmd)
>> +{
>> + return cmd[IOMMU_CMDBUF_ID_BYTE] >> IOMMU_CMDBUF_ID_RSHIFT;
>> +}
>> +
>> +/* linux seems to be using reserved bits so I just log without abortig
>> bug */
>
>
> I couldn't quite understand the comment
>
>> +static void iommu_inval_devtab_entry(AMDIOMMUState *s, uint8_t *cmd,
>> + uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + /* This command should invalidate internal caches of which there
>> isn't */
>> + if (*(uint64_t *)&cmd[0] & IOMMU_CMD_INVAL_DEV_RSVD ||
>> + *(uint64_t *)&cmd[1]) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +#ifdef DEBUG_AMD_IOMMU
>> + uint16_t devid = devid_extract(cmd);
>> +#endif
>> + IOMMU_DPRINTF(COMMAND, "device table entry for devid: %02x:%02x.%x"
>> + "invalidated", PCI_BUS_NUM(devid), PCI_SLOT(devid),
>> + PCI_FUNC(devid));
>> +}
>> +
>> +static void iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if (*(uint32_t *)&cmd[1] & IOMMU_COMPLETION_WAIT_RSVD) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> + /* pretend to wait for command execution to complete */
>> + IOMMU_DPRINTF(COMMAND, "completion wait requested with store address
>> 0x%"
>> + PRIx64 " and store data 0x%"PRIx64, (cmd[0] &
>> + IOMMU_COM_STORE_ADDRESS_MASK), *(uint64_t *)(cmd + 8));
>> + amd_iommu_completion_wait(s, cmd);
>> +}
>> +
>> +static void iommu_complete_ppr(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_COMPLETE_PPR_RQ_RSVD) ||
>> + *(uint64_t *)&cmd[1] & 0xffff000000000000) {
>
>
>
> Can you please document this mask?
>
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "Execution of PPR queue requested");
>> +}
>> +
>> +static void iommu_inval_all(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_ALL_RSVD) ||
>> + *(uint64_t *)&cmd[1]) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + amd_iommu_iotlb_reset(s);
>> + IOMMU_DPRINTF(COMMAND, "Invalidation of all IOMMU cache requested");
>> +}
>> +
>> +static inline uint16_t domid_extract(uint64_t *cmd)
>> +{
>> + return (uint16_t)cmd[0] & IOMMU_INVAL_PAGES_DOMID;
>> +}
>> +
>> +static gboolean amd_iommu_iotlb_remove_by_domid(gpointer key, gpointer
>> value,
>> + gpointer user_data)
>> +{
>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>> + uint16_t domid = *(uint16_t *)user_data;
>> + return entry->domid == domid;
>> +}
>> +
>> +/* we don't have devid - we can't remove pages by address */
>> +static void iommu_inval_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> + uint16_t domid = domid_extract((uint64_t *)cmd);
>> +
>> + if (*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_PAGES_RSVD ||
>> + *(uint32_t *)&cmd[1] & 0x00000ff0) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + g_hash_table_foreach_remove(s->iotlb,
>> amd_iommu_iotlb_remove_by_domid,
>> + &domid);
>> +
>> + IOMMU_DPRINTF(COMMAND, "IOMMU pages for domain 0x%"PRIx16
>> "invalidated",
>> + domid);
>> +}
>> +
>> +static void iommu_prefetch_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_PRF_IOMMU_PAGES_RSVD) ||
>> + (*(uint32_t *)&cmd[1] & 0x00000fd4)) {
>
>
> Here the same, maybe you can name the mask, so we can easier follow the
> spec.
>
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "Pre-fetch of IOMMU pages requested");
>> +}
>> +
>> +static void iommu_inval_inttable(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_INTR_TABLE_RSVD) ||
>> + *(uint64_t *)&cmd[1]) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + return;
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "interrupt table invalidated");
>> +}
>> +
>> +static void iommu_inval_iotlb(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if (*(uint32_t *)&cmd[2] & IOMMU_INVAL_IOTLB_PAGES_RSVD) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + return;
>> + }
>> +
>> + amd_iommu_invalidate_iotlb(s, (uint64_t *)cmd);
>> + IOMMU_DPRINTF(COMMAND, "IOTLB pages invalidated");
>> +}
>> +
>> +/* not honouring reserved bits is regarded as an illegal command */
>> +static void amd_iommu_cmdbuf_exec(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint8_t type;
>> + uint8_t cmd[IOMMU_COMMAND_SIZE];
>> +
>> + memset(cmd, 0, IOMMU_COMMAND_SIZE);
>> +
>> + if (dma_memory_read(&address_space_memory, s->cmdbuf +
>> s->cmdbuf_head, cmd,
>> + IOMMU_COMMAND_SIZE)) {
>> + IOMMU_DPRINTF(COMMAND, "error: fail to access memory at
>> 0x%"PRIx64
>> + " + 0x%"PRIu8, s->cmdbuf, s->cmdbuf_head);
>> + amd_iommu_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
>> + return;
>> + }
>> +
>> + type = opcode(cmd);
>> +
>> + switch (type) {
>> + case IOMMU_CMD_COMPLETION_WAIT:
>> + iommu_completion_wait(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_DEVTAB_ENTRY:
>> + iommu_inval_devtab_entry(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_IOMMU_PAGES:
>> + iommu_inval_pages(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_IOTLB_PAGES:
>> + iommu_inval_iotlb(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_INTR_TABLE:
>> + iommu_inval_inttable(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_PREFETCH_IOMMU_PAGES:
>> + iommu_prefetch_pages(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_COMPLETE_PPR_REQUEST:
>> + iommu_complete_ppr(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_IOMMU_ALL:
>> + iommu_inval_all(s, cmd, type);
>> + break;
>> +
>> + default:
>> + IOMMU_DPRINTF(COMMAND, "unhandled command %d", type);
>> + /* log illegal command */
>> + amd_iommu_log_illegalcom_error(s, type,
>> + s->cmdbuf + s->cmdbuf_head);
>> + break;
>> + }
>> +
>> +}
>> +
>> +static void amd_iommu_cmdbuf_run(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t *mmio_cmdbuf_head = (uint64_t *)(s->mmior +
>> + IOMMU_MMIO_COMMAND_HEAD);
>> +
>> + if (!s->cmdbuf_enabled) {
>> + IOMMU_DPRINTF(COMMAND, "error: IOMMU trying to execute commands
>> with "
>> + "command buffer disabled. IOMMU control value
>> 0x%"PRIx64,
>> + amd_iommu_readq(s, IOMMU_MMIO_CONTROL));
>> + return;
>> + }
>> +
>> + while (s->cmdbuf_head != s->cmdbuf_tail) {
>> + /* check if there is work to do. */
>> + IOMMU_DPRINTF(COMMAND, "command buffer head at 0x%"PRIx32 "
>> command "
>> + "buffer tail at 0x%"PRIx32" command buffer base at
>> 0x%"
>> + PRIx64, s->cmdbuf_head, s->cmdbuf_tail, s->cmdbuf);
>> + amd_iommu_cmdbuf_exec(s);
>> + s->cmdbuf_head += IOMMU_COMMAND_SIZE;
>> + amd_iommu_writeq_raw(s, s->cmdbuf_head,
>> IOMMU_MMIO_COMMAND_HEAD);
>> +
>> + /* wrap head pointer */
>> + if (s->cmdbuf_head >= s->cmdbuf_len * IOMMU_COMMAND_SIZE) {
>> + s->cmdbuf_head = 0;
>> + }
>> + }
>> +
>> + *mmio_cmdbuf_head = cpu_to_le64(s->cmdbuf_head);
>> +}
>> +
>> +/* System Software might never read from some of this fields but anyways
>> */
>> +static uint64_t amd_iommu_mmio_read(void *opaque, hwaddr addr, unsigned
>> size)
>> +{
>> + AMDIOMMUState *s = opaque;
>> +
>> + uint64_t val = -1;
>
>
> The above might work, but it looks a little weird
>
>> + if (addr + size > IOMMU_MMIO_SIZE) {
>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIX64
>> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE,
>> addr,
>> + size);
>> + return (uint64_t)-1;
>> + }
>> +
>> + if (size == 2) {
>> + val = amd_iommu_readw(s, addr);
>> + } else if (size == 4) {
>> + val = amd_iommu_readl(s, addr);
>> + } else if (size == 8) {
>> + val = amd_iommu_readq(s, addr);
>> + }
>> +
>> + switch (addr & ~0x07) {
>> + case IOMMU_MMIO_DEVICE_TABLE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_BASE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_CONTROL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_CONTROL read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EXCL_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_BASE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EXCL_LIMIT:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_TAIL read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_STATUS:
>> + IOMMU_DPRINTF(MMIO, "MMIO_STATUS read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EXT_FEATURES:
>> + IOMMU_DPRINTF(MMU, "MMIO_EXT_FEATURES read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64 "value 0x%"PRIx64,
>> + addr, size, addr & ~0x07, val);
>> + break;
>> +
>> + default:
>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + }
>> + return val;
>> +}
>> +
>> +static void iommu_handle_control_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> + /*
>> + * read whatever is already written in case
>> + * software is writing in chucks less than 8 bytes
>> + */
>> + unsigned long control = amd_iommu_readq(s, IOMMU_MMIO_CONTROL);
>> + s->enabled = !!(control & IOMMU_MMIO_CONTROL_IOMMUEN);
>> +
>> + s->ats_enabled = !!(control & IOMMU_MMIO_CONTROL_HTTUNEN);
>> + s->evtlog_enabled = s->enabled && !!(control &
>> + IOMMU_MMIO_CONTROL_EVENTLOGEN);
>> +
>> + s->evtlog_intr = !!(control & IOMMU_MMIO_CONTROL_EVENTINTEN);
>> + s->completion_wait_intr = !!(control &
>> IOMMU_MMIO_CONTROL_COMWAITINTEN);
>> + s->cmdbuf_enabled = s->enabled && !!(control &
>> + IOMMU_MMIO_CONTROL_CMDBUFLEN);
>> +
>> + /* update the flags depending on the control register */
>> + if (s->cmdbuf_enabled) {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>> + IOMMU_MMIO_STATUS_CMDBUF_RUN;
>> + } else {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>> + ~IOMMU_MMIO_STATUS_CMDBUF_RUN;
>> + }
>> + if (s->evtlog_enabled) {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>> + IOMMU_MMIO_STATUS_EVT_RUN;
>> + } else {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>> + ~IOMMU_MMIO_STATUS_EVT_RUN;
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "MMIO_STATUS state 0x%"PRIx64, control);
>> +
>> + amd_iommu_cmdbuf_run(s);
>> +}
>> +
>> +static inline void iommu_handle_devtab_write(AMDIOMMUState *s)
>> +
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_DEVICE_TABLE);
>> + s->devtab = (dma_addr_t)(val & IOMMU_MMIO_DEVTAB_BASE_MASK);
>> +
>> + /* set device table length */
>> + s->devtab_len = ((val & IOMMU_MMIO_DEVTAB_SIZE_MASK) + 1 *
>> + (IOMMU_MMIO_DEVTAB_SIZE_UNIT /
>> + IOMMU_MMIO_DEVTAB_ENTRY_SIZE));
>> +}
>> +
>> +static inline void iommu_handle_cmdhead_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + s->cmdbuf_head = (dma_addr_t)amd_iommu_readq(s,
>> IOMMU_MMIO_COMMAND_HEAD)
>> + & IOMMU_MMIO_CMDBUF_HEAD_MASK;
>> + amd_iommu_cmdbuf_run(s);
>> +}
>> +
>> +static inline void iommu_handle_cmdbase_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + s->cmdbuf = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_BASE)
>> + & IOMMU_MMIO_CMDBUF_BASE_MASK;
>> + s->cmdbuf_len = 1UL << (s->mmior[IOMMU_MMIO_CMDBUF_SIZE_BYTE]
>> + & IOMMU_MMIO_CMDBUF_SIZE_MASK);
>> + s->cmdbuf_head = s->cmdbuf_tail = 0;
>> +
>> +}
>> +
>> +static inline void iommu_handle_cmdtail_write(AMDIOMMUState *s)
>> +{
>> + s->cmdbuf_tail = amd_iommu_readq(s, IOMMU_MMIO_COMMAND_TAIL)
>> + & IOMMU_MMIO_CMDBUF_TAIL_MASK;
>> + amd_iommu_cmdbuf_run(s);
>> +}
>> +
>> +static inline void iommu_handle_excllim_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EXCL_LIMIT);
>> + s->excl_limit = (val & IOMMU_MMIO_EXCL_LIMIT_MASK) |
>> + IOMMU_MMIO_EXCL_LIMIT_LOW;
>> +}
>> +
>> +static inline void iommu_handle_evtbase_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_BASE);
>> + s->evtlog = val & IOMMU_MMIO_EVTLOG_BASE_MASK;
>> + s->evtlog_len = 1UL << (*(uint64_t
>> *)&s->mmior[IOMMU_MMIO_EVTLOG_SIZE_BYTE]
>> + & IOMMU_MMIO_EVTLOG_SIZE_MASK);
>> +}
>> +
>> +static inline void iommu_handle_evttail_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_TAIL);
>> + s->evtlog_tail = val & IOMMU_MMIO_EVTLOG_TAIL_MASK;
>> +}
>> +
>> +static inline void iommu_handle_evthead_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_HEAD);
>> + s->evtlog_head = val & IOMMU_MMIO_EVTLOG_HEAD_MASK;
>> +}
>> +
>> +static inline void iommu_handle_pprbase_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_BASE);
>> + s->ppr_log = val & IOMMU_MMIO_PPRLOG_BASE_MASK;
>> + s->pprlog_len = 1UL << (*(uint64_t
>> *)&s->mmior[IOMMU_MMIO_PPRLOG_SIZE_BYTE]
>> + & IOMMU_MMIO_PPRLOG_SIZE_MASK);
>> +}
>> +
>> +static inline void iommu_handle_pprhead_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_HEAD);
>> + s->pprlog_head = val & IOMMU_MMIO_PPRLOG_HEAD_MASK;
>> +}
>> +
>> +static inline void iommu_handle_pprtail_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_TAIL);
>> + s->pprlog_tail = val & IOMMU_MMIO_PPRLOG_TAIL_MASK;
>> +}
>> +
>> +/* FIXME: something might go wrong if System Software writes in chunks
>> + * of one byte but linux writes in chunks of 4 bytes so currently it
>> + * works correctly with linux but will definitely be busted if software
>> + * reads/writes 8 bytes
>> + */
>> +static void amd_iommu_mmio_write(void *opaque, hwaddr addr, uint64_t val,
>> + unsigned size)
>> +{
>> +
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + AMDIOMMUState *s = opaque;
>> + unsigned long offset = addr & 0x07;
>> +
>> + if (addr + size > IOMMU_MMIO_SIZE) {
>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIx64
>> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE,
>> addr,
>> + size);
>> + return;
>> + }
>> +
>> + switch (addr & ~0x07) {
>> + case IOMMU_MMIO_CONTROL:
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "MMIO_CONTROL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + iommu_handle_control_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_DEVICE_TABLE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + /* set device table address
>> + * This also suffers from inability to tell whether software
>> + * is done writing
>> + */
>> +
>> + if (offset || (size == 8)) {
>> + iommu_handle_devtab_write(s);
>> + }
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + iommu_handle_cmdhead_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_BASE:
>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_BASE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + /* FIXME - make sure System Software has finished writing incase
>> + * it writes in chucks less than 8 bytes in a robust way.As for
>> + * now, this hacks works for the linux driver
>> + */
>> + if (offset || (size == 8)) {
>> + iommu_handle_cmdbase_write(s);
>> + }
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_TAIL:
>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_TAIL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_cmdtail_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_evtbase_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_evthead_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_evttail_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EXCL_LIMIT:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_excllim_write(s);
>> + break;
>> +
>> + /* PPR log base - unused for now */
>> + case IOMMU_MMIO_PPR_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_BASE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_pprbase_write(s);
>> + break;
>> + /* PPR log head - also unused for now */
>> + case IOMMU_MMIO_PPR_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_HEAD write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_pprhead_write(s);
>> + break;
>> + /* PPR log tail - unused for now */
>> + case IOMMU_MMIO_PPR_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_TAIL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_pprtail_write(s);
>> + break;
>> +
>> + /* ignore write to ext_features */
>> + default:
>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + }
>> +
>> +}
>> +
>> +static inline uint64_t amd_iommu_get_perms(uint64_t entry)
>> +{
>> + return (entry & (IOMMU_DEV_PERM_READ | IOMMU_DEV_PERM_WRITE)) >>
>> + IOMMU_DEV_PERM_SHIFT;
>> +}
>> +
>> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn)
>> +{
>> + AMDIOMMUState *s = opaque;
>> + AMDIOMMUAddressSpace **iommu_as;
>> + int bus_num = pci_bus_num(bus);
>> +
>> + /* just in case */
>
>
> This comment troubles me, do we need the assert?
>
>> + assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
>
>
> bus_num < PCI_BUS_MAX, right ?
>
>> + assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
>
>
> same with devfn I suppose.
>
>> +
>> + iommu_as = s->address_spaces[bus_num];
>> +
>> + /* allocate memory during the first run */
>> + if (!iommu_as) {
>
>
> Why lazy init? We can do that at AMDIOMMUState init, right?
>
>> + iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) *
>> PCI_DEVFN_MAX);
>> + s->address_spaces[bus_num] = iommu_as;
>> + }
>> +
>> + /* set up IOMMU region */
>> + if (!iommu_as[devfn]) {
>> + iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
>
>
> same here
>
>> + iommu_as[devfn]->bus_num = (uint8_t)bus_num;
>> + iommu_as[devfn]->devfn = (uint8_t)devfn;
>> + iommu_as[devfn]->iommu_state = s;
>> +
>> + memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
>> + &s->iommu_ops, "amd-iommu", UINT64_MAX);
>> + address_space_init(&iommu_as[devfn]->as, &iommu_as[devfn]->iommu,
>> + "amd-iommu");
>> + }
>> + return &iommu_as[devfn]->as;
>> +}
>> +
>> +/* validate a page table entry */
>> +static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
>> + uint64_t *dte)
>> +{
>> + if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
>> + || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
>> + || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
>> + amd_iommu_log_illegaldevtab_error(s, devid,
>> + s->devtab + devid *
>> IOMMU_DEVTAB_ENTRY_SIZE, 0);
>> + return false;
>> + }
>> +
>> + return dte[0] & IOMMU_DEV_VALID && (dte[0] &
>> IOMMU_DEV_TRANSLATION_VALID)
>> + && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
>> +}
>> +
>> +/* get a device table entry given the devid */
>> +static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t
>> *entry)
>> +{
>> + uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
>> +
>> + IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
>> +
>> + if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
>> + IOMMU_DEVTAB_ENTRY_SIZE)) {
>> + IOMMU_DPRINTF(MMU, "error: fail to access Device Entry devtab
>> 0x%"PRIx64
>> + "offset 0x%"PRIx32, s->devtab, offset);
>> + /* log ever accessing dte */
>> + amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
>> + return false;
>> + }
>> +
>> + if (!amd_iommu_validate_dte(s, devid, entry)) {
>> + IOMMU_DPRINTF(MMU,
>> + "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
>> + return false;
>> + }
>> +
>> + return true;
>> +}
>> +
>> +/* get pte translation mode */
>> +static inline uint8_t get_pte_translation_mode(uint64_t pte)
>> +{
>> + return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
>> +}
>> +
>> +static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
>> + IOMMUTLBEntry *ret, unsigned perms,
>> + hwaddr addr)
>> +{
>> + uint8_t level, oldlevel;
>> + unsigned present;
>> + uint64_t pte, pte_addr;
>> + uint64_t pte_perms;
>> + pte = dte[0];
>> +
>> + level = get_pte_translation_mode(pte);
>> +
>> + if (level >= 7 || level == 0) {
>> + IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 "
>> detected"
>> + "while translating 0x%"PRIx64, level, addr);
>> + return -1;
>> + }
>> +
>> + while (level > 0) {
>> + pte_perms = amd_iommu_get_perms(pte);
>> + present = pte & 1;
>> + if (!present || perms != (perms & pte_perms)) {
>> + amd_iommu_page_fault(as->iommu_state, as->devfn, addr,
>> perms);
>> + IOMMU_DPRINTF(MMU, "error: page fault accessing virtual addr
>> 0x%"
>> + PRIx64, addr);
>> + return -1;
>> + }
>> +
>> + /* go to the next lower level */
>> + pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
>> + /* add offset and load pte */
>> + pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
>> + pte = ldq_phys(&address_space_memory, pte_addr);
>> + oldlevel = level;
>> + level = get_pte_translation_mode(pte);
>> +
>> + /* PT is corrupted or not there */
>> + if (level != oldlevel - 1) {
>> + return -1;
>> + }
>> + }
>> +
>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>> + ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) &
>> IOMMU_PAGE_MASK_4K;
>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret->perm = IOMMU_RW;
>> + return 0;
>> +}
>> +
>> +/* TODO : Mark addresses as Accessed and Dirty */
>
>
> If you don't mark addresses as dirty, can't this cause the sporadic errors
> of arbitrary programs Jan talked about?
I don't think this the issue, am seem to be receiving wrong 'host
physical addresses' in the last few kernel version. This issue is not
there in older kernels.
>
>> +static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr addr,
>> + bool is_write, IOMMUTLBEntry *ret)
>> +{
>> + AMDIOMMUState *s = as->iommu_state;
>> + uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
>> + IOMMUIOTLBEntry *iotlb_entry;
>> + uint8_t err;
>> + uint64_t entry[4];
>> +
>> + /* try getting a cache entry first */
>> + iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
>> +
>> + if (iotlb_entry) {
>> + IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa
>> 0x%"PRIx64
>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid),
>> PCI_SLOT(devid),
>> + PCI_FUNC(devid), addr,
>> iotlb_entry->translated_addr);
>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>> + ret->translated_addr = iotlb_entry->translated_addr;
>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret->perm = iotlb_entry->perms;
>> + return;
>> + } else {
>
>
> you return from the if clause so you don't need the else
>
>> + if (!amd_iommu_get_dte(s, devid, entry)) {
>
>
> is not an error if you did not find the device id?
>
>> + goto out;
>> + }
>> +
>> + err = amd_iommu_page_walk(as, entry, ret,
>> + is_write ? IOMMU_PERM_WRITE :
>> IOMMU_PERM_READ,
>> + addr);
>> + if (err) {
>> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page
>> tables"
>> + " while translating addr 0x%"PRIx64, addr);
>> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
>> + goto out;
>> + }
>> +
>> + amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
>> + ret->perm, entry[1] &
>> IOMMU_DEV_DOMID_ID_MASK);
>> + return;
>> + }
>> +
>> +out:
>> + ret->iova = addr;
>> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret->perm = IOMMU_RW;
>> + return;
>
>
> you don't need the above return
>
>> +}
>> +
>> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr
>> addr,
>> + bool is_write)
>> +{
>> + IOMMU_DPRINTF(GENERAL, "");
>> +
>> + AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace,
>> iommu);
>> + AMDIOMMUState *s = as->iommu_state;
>> +
>> + IOMMUTLBEntry ret = {
>> + .target_as = &address_space_memory,
>> + .iova = addr,
>> + .translated_addr = 0,
>> + .addr_mask = ~(hwaddr)0,
>> + .perm = IOMMU_NONE,
>> + };
>> +
>> + if (!s->enabled) {
>> + /* IOMMU disabled - corresponds to iommu=off not
>> + * failure to provide any parameter
>> + */
>> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
>> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
>> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret.perm = IOMMU_RW;
>> + return ret;
>> + }
>> +
>> + amd_iommu_do_translate(as, addr, is_write, &ret);
>> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa
>> 0x%"PRIx64,
>> + as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn),
>> addr,
>> + ret.translated_addr);
>> +
>> + return ret;
>> +}
>> +
>> +static const MemoryRegionOps mmio_mem_ops = {
>> + .read = amd_iommu_mmio_read,
>> + .write = amd_iommu_mmio_write,
>> + .endianness = DEVICE_LITTLE_ENDIAN,
>> + .impl = {
>> + .min_access_size = 1,
>> + .max_access_size = 8,
>> + .unaligned = false,
>> + },
>> + .valid = {
>> + .min_access_size = 1,
>> + .max_access_size = 8,
>> + }
>> +};
>> +
>> +static void amd_iommu_init(AMDIOMMUState *s)
>> +{
>> + printf("amd_iommu_init");
>
>
> you should use the debug macro here
>
>> +
>> + amd_iommu_iotlb_reset(s);
>> +
>> + s->iommu_ops.translate = amd_iommu_translate;
>> +
>> + s->devtab_len = 0;
>> + s->cmdbuf_len = 0;
>> + s->cmdbuf_head = 0;
>> + s->cmdbuf_tail = 0;
>> + s->evtlog_head = 0;
>> + s->evtlog_tail = 0;
>> + s->excl_enabled = false;
>> + s->excl_allow = false;
>> + s->mmio_enabled = false;
>> + s->enabled = false;
>> + s->ats_enabled = false;
>> + s->cmdbuf_enabled = false;
>> +
>> + /* reset MMIO */
>> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
>> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
>> + 0xffffffffffffffef, 0);
>> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
>> + /* reset device ident */
>> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
>> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
>> + pci_config_set_prog_interface(s->dev.config, 00);
>> + pci_config_set_class(s->dev.config, 0x0806);
>> +
>> + /* reset IOMMU specific capabilities */
>> + pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
>> + s->mmio.addr & ~(0xffff0000));
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
>> + (s->mmio.addr & ~(0xffff)) >> 16);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
>> + 0xff000000);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
>
>
> All the capabilities are read-write? Otherwise you need to set the wmask
> to indicate what fields are writable.
>
>> +}
>> +
>> +static void amd_iommu_reset(DeviceState *dev)
>> +{
>> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
>> +
>> + amd_iommu_init(s);
>> +}
>> +
>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>> +{
>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>> +
>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>> + amd_iommu_uint64_equal, g_free,
>> g_free);
>> +
>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>> + IOMMU_CAPAB_SIZE);
>> +
>> + /* add msi and hypertransport capabilities */
>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
>> +
>> + amd_iommu_init(s);
>> +
>> + /* set up MMIO */
>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
>> + IOMMU_MMIO_SIZE);
>> +
>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>
>
> I don't understand why is need here. realize is called only once in the init
> process
> and you set it a few lines below.
>
>> + return;
>> + }
>> +
>> + s->mmio.addr = IOMMU_BASE_ADDR;
>> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR,
>> &s->mmio);
>> +}
>> +
>> +static const VMStateDescription vmstate_amd_iommu = {
>> + .name = "amd-iommu",
>> + .fields = (VMStateField[]) {
>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>> + VMSTATE_END_OF_LIST()
>> + }
>> +};
>> +
>> +static Property amd_iommu_properties[] = {
>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>> + DEFINE_PROP_END_OF_LIST(),
>> +};
>> +
>> +static void amd_iommu_uninit(PCIDevice *dev)
>> +{
>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>> + amd_iommu_iotlb_reset(s);
>
>
> at this point you also need to clean also the memory regions you use.
>
>> +}
>> +
>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>> +{
>> + DeviceClass *dc = DEVICE_CLASS(klass);
>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>> +
>> + k->realize = amd_iommu_realize;
>> + k->exit = amd_iommu_uninit;
>> +
>> + dc->reset = amd_iommu_reset;
>> + dc->vmsd = &vmstate_amd_iommu;
>> + dc->props = amd_iommu_properties;
>> +}
>> +
>> +static const TypeInfo amd_iommu = {
>> + .name = TYPE_AMD_IOMMU_DEVICE,
>> + .parent = TYPE_PCI_DEVICE,
>> + .instance_size = sizeof(AMDIOMMUState),
>> + .class_init = amd_iommu_class_init
>> +};
>> +
>> +static void amd_iommu_register_types(void)
>> +{
>> + type_register_static(&amd_iommu);
>> +}
>> +
>> +type_init(amd_iommu_register_types);
>> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
>> new file mode 100644
>> index 0000000..7d317e1
>> --- /dev/null
>> +++ b/hw/i386/amd_iommu.h
>> @@ -0,0 +1,395 @@
>> +/*
>> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
>> + *
>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License as published by
>> + * the Free Software Foundation; either version 2 of the License, or
>> + * (at your option) any later version.
>> +
>> + * This program is distributed in the hope that it will be useful,
>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>> + * GNU General Public License for more details.
>> +
>> + * You should have received a copy of the GNU General Public License
>> along
>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>> + */
>> +
>> +#ifndef AMD_IOMMU_H_
>> +#define AMD_IOMMU_H_
>> +
>> +#include "hw/hw.h"
>> +#include "hw/pci/pci.h"
>> +#include "hw/pci/msi.h"
>> +#include "hw/sysbus.h"
>> +#include "sysemu/dma.h"
>> +
>> +/* Capability registers */
>> +#define IOMMU_CAPAB_HEADER 0x00
>> +#define IOMMU_CAPAB_REV_TYPE 0x02
>> +#define IOMMU_CAPAB_FLAGS 0x03
>> +#define IOMMU_CAPAB_BAR_LOW 0x04
>> +#define IOMMU_CAPAB_BAR_HIGH 0x08
>> +#define IOMMU_CAPAB_RANGE 0x0C
>> +#define IOMMU_CAPAB_MISC 0x10
>> +#define IOMMU_CAPAB_MISC1 0x14
>> +
>> +#define IOMMU_CAPAB_SIZE 0x18
>> +#define IOMMU_CAPAB_REG_SIZE 0x04
>> +
>> +/* Capability header data */
>> +#define IOMMU_CAPAB_ID_SEC 0xf
>> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
>> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
>> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
>> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
>> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
>> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
>> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
>> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV |
>> IOMMU_CAPAB_TYPE)
>> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
>> + IOMMU_CAPAB_FLAG_HTTUNNEL)
>> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
>> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
>> +
>> +/* MMIO registers */
>> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
>> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
>> +#define IOMMU_MMIO_EVENT_BASE 0x0010
>> +#define IOMMU_MMIO_CONTROL 0x0018
>> +#define IOMMU_MMIO_EXCL_BASE 0x0020
>> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
>> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
>> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
>> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
>> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
>> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
>> +#define IOMMU_MMIO_STATUS 0x2020
>> +#define IOMMU_MMIO_PPR_BASE 0x0038
>> +#define IOMMU_MMIO_PPR_HEAD 0x2030
>> +#define IOMMU_MMIO_PPR_TAIL 0x2038
>> +
>> +#define IOMMU_MMIO_SIZE 0x4000
>> +
>> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
>> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
>> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
>> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
>> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
>> +
>> +/* some of this are similar but just for readability */
>> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
>> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
>> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
>> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +
>> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
>> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
>> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
>> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +
>> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
>> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
>> +
>> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
>> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
>> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
>> +
>> +/* mmio control register flags */
>> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
>> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
>> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
>> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
>> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
>> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
>> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
>> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
>> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
>> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
>> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
>> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
>> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
>> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
>> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
>> +
>> +/* MMIO status register bits */
>> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
>> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
>> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
>> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
>> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
>> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
>> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
>> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
>> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
>> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
>> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
>> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
>> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
>> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
>> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
>> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
>> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
>> +
>> +#define IOMMU_CMDBUF_ID_BYTE 0x07
>> +#define IOMMU_CMDBUF_ID_RSHIFT 4
>> +
>> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
>> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
>> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
>> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
>> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
>> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
>> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
>> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
>> +
>> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
>> +
>> +/* Device table entry bits 0:63 */
>> +#define IOMMU_DEV_VALID (1ULL << 0)
>> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
>> +#define IOMMU_DEV_MODE_MASK 0x7
>> +#define IOMMU_DEV_MODE_RSHIFT 9
>> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
>> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
>> +#define IOMMU_DEV_PERM_SHIFT 61
>> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
>> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
>> +
>> +/* Device table entry bits 64:127 */
>> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
>> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
>> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
>> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
>> +#define IOMMU_DEV_IOCTL_MASK (~3)
>> +#define IOMMU_DEV_IOCTL_RSHIFT 20
>> +#define IOMMU_DEV_IOCTL_DENY 0
>> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
>> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
>> +#define IOMMU_DEV_CACHE (1ULL << 37)
>> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
>> +#define IOMMU_DEV_EXCL (1ULL << 39)
>> +
>> +/* Event codes and flags, as stored in the info field */
>> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
>> +#define IOMMU_EVENT_IOPF (0x2U << 12)
>> +#define IOMMU_EVENT_IOPF_I (1U << 3)
>> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
>> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
>> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
>> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
>> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
>> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
>> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
>> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
>> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
>> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
>> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
>> +
>> +#define IOMMU_EVENT_LEN 16
>> +#define IOMMU_PERM_READ (1 << 0)
>> +#define IOMMU_PERM_WRITE (1 << 1)
>> +#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
>> +
>> +/* AMD RD890 Chipset */
>> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
>
>
> We keep the pci ids in include/hw/pci/pci_ids.h
>
>> +
>> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
>> +#define IOMMU_FEATURE_PPR (1ULL << 1)
>> +#define IOMMU_FEATURE_NX (1ULL << 3)
>> +#define IOMMU_FEATURE_GT (1ULL << 4)
>> +#define IOMMU_FEATURE_IA (1ULL << 6)
>> +#define IOMMU_FEATURE_GA (1ULL << 7)
>> +#define IOMMU_FEATURE_HE (1ULL << 8)
>> +#define IOMMU_FEATURE_PC (1ULL << 9)
>> +
>> +/* reserved DTE bits */
>> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
>> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
>> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
>> +
>> +/* IOMMU paging mode */
>> +#define IOMMU_GATS_MODE (6ULL << 12)
>> +#define IOMMU_HATS_MODE (6ULL << 10)
>> +
>> +/* PCI SIG constants */
>> +#define PCI_BUS_MAX 256
>> +#define PCI_SLOT_MAX 32
>> +#define PCI_FUNC_MAX 8
>> +#define PCI_DEVFN_MAX 256
>
>
> Maybe we can move the PCI macros to include/hw/pci/pci.h, those are not
> IOMMU specific.
>
>> +
>> +/* IOTLB */
>> +#define IOMMU_IOTLB_MAX_SIZE 1024
>> +#define IOMMU_DEVID_SHIFT 36
>> +
>> +/* extended feature support */
>> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR |
>> \
>> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
>> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
>> + IOMMU_HATS_MODE)
>> +
>> +/* capabilities header */
>> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
>> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
>> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
>> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
>> +
>> +/* command constants */
>> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
>> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
>> +#define IOMMU_COM_COMPLETION_INTR 0x2
>> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
>> +#define IOMMU_COMMAND_SIZE 0x10
>> +
>> +/* IOMMU default address */
>> +#define IOMMU_BASE_ADDR 0xfed80000
>> +
>> +/* page management constants */
>> +#define IOMMU_PAGE_SHIFT 12
>> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
>> +
>> +#define IOMMU_PAGE_SHIFT_4K 12
>> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
>> +#define IOMMU_PAGE_SHIFT_2M 21
>> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
>> +#define IOMMU_PAGE_SHIFT_1G 30
>> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
>> +
>> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
>> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
>> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
>> +
>> +/* invalidation command device id */
>> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
>> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) -
>> 1))
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
` (4 preceding siblings ...)
2016-02-21 20:20 ` [Qemu-devel] [V6 0/4] " Jan Kiszka
@ 2016-03-01 13:07 ` Michael S. Tsirkin
2016-03-01 13:48 ` Jan Kiszka
5 siblings, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 13:07 UTC (permalink / raw)
To: David Kiarie; +Cc: marcel, valentine.sinitsyn, jan.kiszka, qemu-devel
On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
> Hello there,
>
> Repost, AMD IOMMU patches version 6.
>
> Changes since version 5
> -Fixed macro formating issues
> -changed occurences of IO MMU to IOMMU for consistency
> -Fixed capability registers duplication
> -Rebased to current master
>
> David Kiarie (4):
> hw/i386: Introduce AMD IOMMU
> hw/core: Add AMD IOMMU to machine properties
> hw/i386: ACPI table for AMD IOMMU
> hw/pci-host: Emulate AMD IOMMU
I went over AMD IOMMU spec.
I'm concerned that it appears that there's no chance for it to
work correctly if host caches invalid PTE entries.
The spec vaguely discusses write-protecting such PTEs but
that would be very complex if it can be made to work at all.
This means that this can't work with e.g. VFIO.
It can only work with emulated devices.
OTOH VTD can easily support PTE shadowing by setting a flag.
I'd like us to find some way to avoid possibility
of user error creating a configuration mixing e.g.
vfio with the amd iommu.
I'm not sure how to do this.
Any idea?
> hw/core/machine.c | 28 +-
> hw/i386/Makefile.objs | 1 +
> hw/i386/acpi-build.c | 208 +++++-
> hw/i386/amd_iommu.c | 1432 +++++++++++++++++++++++++++++++++++++++++
> hw/i386/amd_iommu.h | 395 ++++++++++++
> hw/pci-host/piix.c | 1 +
> hw/pci-host/q35.c | 14 +-
> include/hw/acpi/acpi-defs.h | 55 ++
> include/hw/boards.h | 3 +-
> include/hw/i386/intel_iommu.h | 1 +
> include/hw/pci/pci.h | 2 +
> qemu-options.hx | 6 +-
> util/qemu-config.c | 4 +-
> 13 files changed, 2123 insertions(+), 27 deletions(-)
> create mode 100644 hw/i386/amd_iommu.c
> create mode 100644 hw/i386/amd_iommu.h
>
> --
> 2.1.4
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 13:07 ` Michael S. Tsirkin
@ 2016-03-01 13:48 ` Jan Kiszka
2016-03-01 13:55 ` Michael S. Tsirkin
` (2 more replies)
0 siblings, 3 replies; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 13:48 UTC (permalink / raw)
To: Michael S. Tsirkin, David Kiarie; +Cc: marcel, valentine.sinitsyn, qemu-devel
On 2016-03-01 14:07, Michael S. Tsirkin wrote:
> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
>> Hello there,
>>
>> Repost, AMD IOMMU patches version 6.
>>
>> Changes since version 5
>> -Fixed macro formating issues
>> -changed occurences of IO MMU to IOMMU for consistency
>> -Fixed capability registers duplication
>> -Rebased to current master
>>
>> David Kiarie (4):
>> hw/i386: Introduce AMD IOMMU
>> hw/core: Add AMD IOMMU to machine properties
>> hw/i386: ACPI table for AMD IOMMU
>> hw/pci-host: Emulate AMD IOMMU
>
> I went over AMD IOMMU spec.
> I'm concerned that it appears that there's no chance for it to
> work correctly if host caches invalid PTE entries.
>
> The spec vaguely discusses write-protecting such PTEs but
> that would be very complex if it can be made to work at all.
>
> This means that this can't work with e.g. VFIO.
> It can only work with emulated devices.
You mean it can't work if we program a real IOMMU (for VFIO) with
translated data from the emulated one but cannot track any updates of
the related page tables because the guest is not required to issue
traceable flush requests? Hmm, too bad.
>
> OTOH VTD can easily support PTE shadowing by setting a flag.
Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
implementations are expected to NOT require explicit software flushing
of write buffers and report RWBF=0 in the Capability register", we may
eventually run into guests that no longer check that flag if we expose
something that looks like a "newer" implementation.
However, this flag is not set right now in our VT-d model.
>
> I'd like us to find some way to avoid possibility
> of user error creating a configuration mixing e.g.
> vfio with the amd iommu.
>
> I'm not sure how to do this.
>
> Any idea?
There is likely no way around write-protecting the IOMMU page tables (in
KVM mode) once we evaluated and cached them somewhere. For now, I would
simply deny vfio while an IOMMU is active on x86.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 13:48 ` Jan Kiszka
@ 2016-03-01 13:55 ` Michael S. Tsirkin
2016-03-01 14:12 ` Jan Kiszka
2016-03-01 14:00 ` Jan Kiszka
2016-03-02 21:17 ` David Kiarie
2 siblings, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 13:55 UTC (permalink / raw)
To: Jan Kiszka; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On Tue, Mar 01, 2016 at 02:48:19PM +0100, Jan Kiszka wrote:
> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
> > On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
> >> Hello there,
> >>
> >> Repost, AMD IOMMU patches version 6.
> >>
> >> Changes since version 5
> >> -Fixed macro formating issues
> >> -changed occurences of IO MMU to IOMMU for consistency
> >> -Fixed capability registers duplication
> >> -Rebased to current master
> >>
> >> David Kiarie (4):
> >> hw/i386: Introduce AMD IOMMU
> >> hw/core: Add AMD IOMMU to machine properties
> >> hw/i386: ACPI table for AMD IOMMU
> >> hw/pci-host: Emulate AMD IOMMU
> >
> > I went over AMD IOMMU spec.
> > I'm concerned that it appears that there's no chance for it to
> > work correctly if host caches invalid PTE entries.
> >
> > The spec vaguely discusses write-protecting such PTEs but
> > that would be very complex if it can be made to work at all.
> >
> > This means that this can't work with e.g. VFIO.
> > It can only work with emulated devices.
>
> You mean it can't work if we program a real IOMMU (for VFIO) with
> translated data from the emulated one but cannot track any updates of
> the related page tables because the guest is not required to issue
> traceable flush requests? Hmm, too bad.
>
> >
> > OTOH VTD can easily support PTE shadowing by setting a flag.
>
> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
> implementations are expected to NOT require explicit software flushing
> of write buffers and report RWBF=0 in the Capability register", we may
> eventually run into guests that no longer check that flag if we expose
> something that looks like a "newer" implementation.
Hopefully not, if that happens we'll have to do a PV IOMMU :)
> However, this flag is not set right now in our VT-d model.
> >
> > I'd like us to find some way to avoid possibility
> > of user error creating a configuration mixing e.g.
> > vfio with the amd iommu.
> >
> > I'm not sure how to do this.
> >
> > Any idea?
>
> There is likely no way around write-protecting the IOMMU page tables (in
> KVM mode) once we evaluated and cached them somewhere.
Well for one, it's possible to use vt-d and not amd iommu.
> For now, I would
> simply deny vfio while an IOMMU is active on x86.
>
> Jan
With the caveat that we should be able to do it per iommu type
down the road.
> --
> Siemens AG, Corporate Technology, CT RDA ITP SES-DE
> Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 13:48 ` Jan Kiszka
2016-03-01 13:55 ` Michael S. Tsirkin
@ 2016-03-01 14:00 ` Jan Kiszka
2016-03-01 20:11 ` Michael S. Tsirkin
2016-03-02 21:17 ` David Kiarie
2 siblings, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 14:00 UTC (permalink / raw)
To: Michael S. Tsirkin, David Kiarie; +Cc: marcel, valentine.sinitsyn, qemu-devel
On 2016-03-01 14:48, Jan Kiszka wrote:
> There is likely no way around write-protecting the IOMMU page tables (in
> KVM mode) once we evaluated and cached them somewhere.
I mean, when in kvm mode AND having something that caches enabled, of
course.
Besides vfio, we also still have the question how to deal with virtio
and DMA remapping, which is probably similarly complicated when some
vhost technology is involved.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 13:55 ` Michael S. Tsirkin
@ 2016-03-01 14:12 ` Jan Kiszka
2016-03-01 14:18 ` Jan Kiszka
2016-03-01 14:19 ` Michael S. Tsirkin
0 siblings, 2 replies; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 14:12 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On 2016-03-01 14:55, Michael S. Tsirkin wrote:
> On Tue, Mar 01, 2016 at 02:48:19PM +0100, Jan Kiszka wrote:
>> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
>>> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
>>>> Hello there,
>>>>
>>>> Repost, AMD IOMMU patches version 6.
>>>>
>>>> Changes since version 5
>>>> -Fixed macro formating issues
>>>> -changed occurences of IO MMU to IOMMU for consistency
>>>> -Fixed capability registers duplication
>>>> -Rebased to current master
>>>>
>>>> David Kiarie (4):
>>>> hw/i386: Introduce AMD IOMMU
>>>> hw/core: Add AMD IOMMU to machine properties
>>>> hw/i386: ACPI table for AMD IOMMU
>>>> hw/pci-host: Emulate AMD IOMMU
>>>
>>> I went over AMD IOMMU spec.
>>> I'm concerned that it appears that there's no chance for it to
>>> work correctly if host caches invalid PTE entries.
>>>
>>> The spec vaguely discusses write-protecting such PTEs but
>>> that would be very complex if it can be made to work at all.
>>>
>>> This means that this can't work with e.g. VFIO.
>>> It can only work with emulated devices.
>>
>> You mean it can't work if we program a real IOMMU (for VFIO) with
>> translated data from the emulated one but cannot track any updates of
>> the related page tables because the guest is not required to issue
>> traceable flush requests? Hmm, too bad.
>>
>>>
>>> OTOH VTD can easily support PTE shadowing by setting a flag.
>>
>> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
>> implementations are expected to NOT require explicit software flushing
>> of write buffers and report RWBF=0 in the Capability register", we may
>> eventually run into guests that no longer check that flag if we expose
>> something that looks like a "newer" implementation.
>
> Hopefully not, if that happens we'll have to do a PV IOMMU :)
Please not.
>
>> However, this flag is not set right now in our VT-d model.
>>>
>>> I'd like us to find some way to avoid possibility
>>> of user error creating a configuration mixing e.g.
>>> vfio with the amd iommu.
>>>
>>> I'm not sure how to do this.
>>>
>>> Any idea?
>>
>> There is likely no way around write-protecting the IOMMU page tables (in
>> KVM mode) once we evaluated and cached them somewhere.
>
> Well for one, it's possible to use vt-d and not amd iommu.
That would lead to nice combos of AMD CPUs with VT-d IOMMU. While it may
be possible, I wouldn't rely on guests having tested that combination
very well.
>
>
>> For now, I would
>> simply deny vfio while an IOMMU is active on x86.
>>
>> Jan
>
> With the caveat that we should be able to do it per iommu type
> down the road.
Right now, it's type-independent.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 14:12 ` Jan Kiszka
@ 2016-03-01 14:18 ` Jan Kiszka
2016-03-01 14:30 ` Michael S. Tsirkin
2016-03-01 14:19 ` Michael S. Tsirkin
1 sibling, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 14:18 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On 2016-03-01 15:12, Jan Kiszka wrote:
> On 2016-03-01 14:55, Michael S. Tsirkin wrote:
>> On Tue, Mar 01, 2016 at 02:48:19PM +0100, Jan Kiszka wrote:
>>> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
>>>> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
>>>>> Hello there,
>>>>>
>>>>> Repost, AMD IOMMU patches version 6.
>>>>>
>>>>> Changes since version 5
>>>>> -Fixed macro formating issues
>>>>> -changed occurences of IO MMU to IOMMU for consistency
>>>>> -Fixed capability registers duplication
>>>>> -Rebased to current master
>>>>>
>>>>> David Kiarie (4):
>>>>> hw/i386: Introduce AMD IOMMU
>>>>> hw/core: Add AMD IOMMU to machine properties
>>>>> hw/i386: ACPI table for AMD IOMMU
>>>>> hw/pci-host: Emulate AMD IOMMU
>>>>
>>>> I went over AMD IOMMU spec.
>>>> I'm concerned that it appears that there's no chance for it to
>>>> work correctly if host caches invalid PTE entries.
>>>>
>>>> The spec vaguely discusses write-protecting such PTEs but
>>>> that would be very complex if it can be made to work at all.
>>>>
>>>> This means that this can't work with e.g. VFIO.
>>>> It can only work with emulated devices.
>>>
>>> You mean it can't work if we program a real IOMMU (for VFIO) with
>>> translated data from the emulated one but cannot track any updates of
>>> the related page tables because the guest is not required to issue
>>> traceable flush requests? Hmm, too bad.
>>>
>>>>
>>>> OTOH VTD can easily support PTE shadowing by setting a flag.
>>>
>>> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
>>> implementations are expected to NOT require explicit software flushing
>>> of write buffers and report RWBF=0 in the Capability register", we may
>>> eventually run into guests that no longer check that flag if we expose
>>> something that looks like a "newer" implementation.
>>
>> Hopefully not, if that happens we'll have to do a PV IOMMU :)
>
> Please not.
>
>>
>>> However, this flag is not set right now in our VT-d model.
>>>>
>>>> I'd like us to find some way to avoid possibility
>>>> of user error creating a configuration mixing e.g.
>>>> vfio with the amd iommu.
>>>>
>>>> I'm not sure how to do this.
>>>>
>>>> Any idea?
>>>
>>> There is likely no way around write-protecting the IOMMU page tables (in
>>> KVM mode) once we evaluated and cached them somewhere.
>>
>> Well for one, it's possible to use vt-d and not amd iommu.
>
> That would lead to nice combos of AMD CPUs with VT-d IOMMU. While it may
> be possible, I wouldn't rely on guests having tested that combination
> very well.
To make the concern more concrete: I'm playing with code that will reuse
the MMU page tables for the IOMMU - the AMD architecture is designed for
that optimization (in contrast to Intel's). So, if the guest is not
foreseeing that artificial combo above (ours will definitely not)
because it is designed around the reuse, it will at least fail to run.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 14:12 ` Jan Kiszka
2016-03-01 14:18 ` Jan Kiszka
@ 2016-03-01 14:19 ` Michael S. Tsirkin
1 sibling, 0 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 14:19 UTC (permalink / raw)
To: Jan Kiszka; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On Tue, Mar 01, 2016 at 03:12:40PM +0100, Jan Kiszka wrote:
> On 2016-03-01 14:55, Michael S. Tsirkin wrote:
> > On Tue, Mar 01, 2016 at 02:48:19PM +0100, Jan Kiszka wrote:
> >> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
> >>> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
> >>>> Hello there,
> >>>>
> >>>> Repost, AMD IOMMU patches version 6.
> >>>>
> >>>> Changes since version 5
> >>>> -Fixed macro formating issues
> >>>> -changed occurences of IO MMU to IOMMU for consistency
> >>>> -Fixed capability registers duplication
> >>>> -Rebased to current master
> >>>>
> >>>> David Kiarie (4):
> >>>> hw/i386: Introduce AMD IOMMU
> >>>> hw/core: Add AMD IOMMU to machine properties
> >>>> hw/i386: ACPI table for AMD IOMMU
> >>>> hw/pci-host: Emulate AMD IOMMU
> >>>
> >>> I went over AMD IOMMU spec.
> >>> I'm concerned that it appears that there's no chance for it to
> >>> work correctly if host caches invalid PTE entries.
> >>>
> >>> The spec vaguely discusses write-protecting such PTEs but
> >>> that would be very complex if it can be made to work at all.
> >>>
> >>> This means that this can't work with e.g. VFIO.
> >>> It can only work with emulated devices.
> >>
> >> You mean it can't work if we program a real IOMMU (for VFIO) with
> >> translated data from the emulated one but cannot track any updates of
> >> the related page tables because the guest is not required to issue
> >> traceable flush requests? Hmm, too bad.
> >>
> >>>
> >>> OTOH VTD can easily support PTE shadowing by setting a flag.
> >>
> >> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
> >> implementations are expected to NOT require explicit software flushing
> >> of write buffers and report RWBF=0 in the Capability register", we may
> >> eventually run into guests that no longer check that flag if we expose
> >> something that looks like a "newer" implementation.
> >
> > Hopefully not, if that happens we'll have to do a PV IOMMU :)
>
> Please not.
>
> >
> >> However, this flag is not set right now in our VT-d model.
> >>>
> >>> I'd like us to find some way to avoid possibility
> >>> of user error creating a configuration mixing e.g.
> >>> vfio with the amd iommu.
> >>>
> >>> I'm not sure how to do this.
> >>>
> >>> Any idea?
> >>
> >> There is likely no way around write-protecting the IOMMU page tables (in
> >> KVM mode) once we evaluated and cached them somewhere.
> >
> > Well for one, it's possible to use vt-d and not amd iommu.
>
> That would lead to nice combos of AMD CPUs with VT-d IOMMU. While it may
> be possible, I wouldn't rely on guests having tested that combination
> very well.
Well, for example we use the q35/piix chipset with AMD CPUs,
is this very different?
> >
> >
> >> For now, I would
> >> simply deny vfio while an IOMMU is active on x86.
> >>
> >> Jan
> >
> > With the caveat that we should be able to do it per iommu type
> > down the road.
>
> Right now, it's type-independent.
>
> Jan
>
> --
> Siemens AG, Corporate Technology, CT RDA ITP SES-DE
> Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 14:18 ` Jan Kiszka
@ 2016-03-01 14:30 ` Michael S. Tsirkin
2016-03-01 14:35 ` Jan Kiszka
0 siblings, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 14:30 UTC (permalink / raw)
To: Jan Kiszka; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On Tue, Mar 01, 2016 at 03:18:05PM +0100, Jan Kiszka wrote:
> On 2016-03-01 15:12, Jan Kiszka wrote:
> > On 2016-03-01 14:55, Michael S. Tsirkin wrote:
> >> On Tue, Mar 01, 2016 at 02:48:19PM +0100, Jan Kiszka wrote:
> >>> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
> >>>> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
> >>>>> Hello there,
> >>>>>
> >>>>> Repost, AMD IOMMU patches version 6.
> >>>>>
> >>>>> Changes since version 5
> >>>>> -Fixed macro formating issues
> >>>>> -changed occurences of IO MMU to IOMMU for consistency
> >>>>> -Fixed capability registers duplication
> >>>>> -Rebased to current master
> >>>>>
> >>>>> David Kiarie (4):
> >>>>> hw/i386: Introduce AMD IOMMU
> >>>>> hw/core: Add AMD IOMMU to machine properties
> >>>>> hw/i386: ACPI table for AMD IOMMU
> >>>>> hw/pci-host: Emulate AMD IOMMU
> >>>>
> >>>> I went over AMD IOMMU spec.
> >>>> I'm concerned that it appears that there's no chance for it to
> >>>> work correctly if host caches invalid PTE entries.
> >>>>
> >>>> The spec vaguely discusses write-protecting such PTEs but
> >>>> that would be very complex if it can be made to work at all.
> >>>>
> >>>> This means that this can't work with e.g. VFIO.
> >>>> It can only work with emulated devices.
> >>>
> >>> You mean it can't work if we program a real IOMMU (for VFIO) with
> >>> translated data from the emulated one but cannot track any updates of
> >>> the related page tables because the guest is not required to issue
> >>> traceable flush requests? Hmm, too bad.
> >>>
> >>>>
> >>>> OTOH VTD can easily support PTE shadowing by setting a flag.
> >>>
> >>> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
> >>> implementations are expected to NOT require explicit software flushing
> >>> of write buffers and report RWBF=0 in the Capability register", we may
> >>> eventually run into guests that no longer check that flag if we expose
> >>> something that looks like a "newer" implementation.
> >>
> >> Hopefully not, if that happens we'll have to do a PV IOMMU :)
> >
> > Please not.
> >
> >>
> >>> However, this flag is not set right now in our VT-d model.
> >>>>
> >>>> I'd like us to find some way to avoid possibility
> >>>> of user error creating a configuration mixing e.g.
> >>>> vfio with the amd iommu.
> >>>>
> >>>> I'm not sure how to do this.
> >>>>
> >>>> Any idea?
> >>>
> >>> There is likely no way around write-protecting the IOMMU page tables (in
> >>> KVM mode) once we evaluated and cached them somewhere.
> >>
> >> Well for one, it's possible to use vt-d and not amd iommu.
> >
> > That would lead to nice combos of AMD CPUs with VT-d IOMMU. While it may
> > be possible, I wouldn't rely on guests having tested that combination
> > very well.
>
> To make the concern more concrete: I'm playing with code that will reuse
> the MMU page tables for the IOMMU - the AMD architecture is designed for
> that optimization (in contrast to Intel's). So, if the guest is not
> foreseeing that artificial combo above (ours will definitely not)
> because it is designed around the reuse, it will at least fail to run.
>
> Jan
So if you have an AMD iommu on the host and that is capable
of 2-level translation, then the flushing problem
can be fixed by a kind of iommu pass-through
where you point the host's iommu to guest's page tables.
So maybe what you need to do is make it possible
for device to query iommu and ask whether it
supports devices caching invalid PTEs.
If not, vfio could fail.
> --
> Siemens AG, Corporate Technology, CT RDA ITP SES-DE
> Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 14:30 ` Michael S. Tsirkin
@ 2016-03-01 14:35 ` Jan Kiszka
0 siblings, 0 replies; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 14:35 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On 2016-03-01 15:30, Michael S. Tsirkin wrote:
> On Tue, Mar 01, 2016 at 03:18:05PM +0100, Jan Kiszka wrote:
>> On 2016-03-01 15:12, Jan Kiszka wrote:
>>> On 2016-03-01 14:55, Michael S. Tsirkin wrote:
>>>> On Tue, Mar 01, 2016 at 02:48:19PM +0100, Jan Kiszka wrote:
>>>>> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
>>>>>> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
>>>>>>> Hello there,
>>>>>>>
>>>>>>> Repost, AMD IOMMU patches version 6.
>>>>>>>
>>>>>>> Changes since version 5
>>>>>>> -Fixed macro formating issues
>>>>>>> -changed occurences of IO MMU to IOMMU for consistency
>>>>>>> -Fixed capability registers duplication
>>>>>>> -Rebased to current master
>>>>>>>
>>>>>>> David Kiarie (4):
>>>>>>> hw/i386: Introduce AMD IOMMU
>>>>>>> hw/core: Add AMD IOMMU to machine properties
>>>>>>> hw/i386: ACPI table for AMD IOMMU
>>>>>>> hw/pci-host: Emulate AMD IOMMU
>>>>>>
>>>>>> I went over AMD IOMMU spec.
>>>>>> I'm concerned that it appears that there's no chance for it to
>>>>>> work correctly if host caches invalid PTE entries.
>>>>>>
>>>>>> The spec vaguely discusses write-protecting such PTEs but
>>>>>> that would be very complex if it can be made to work at all.
>>>>>>
>>>>>> This means that this can't work with e.g. VFIO.
>>>>>> It can only work with emulated devices.
>>>>>
>>>>> You mean it can't work if we program a real IOMMU (for VFIO) with
>>>>> translated data from the emulated one but cannot track any updates of
>>>>> the related page tables because the guest is not required to issue
>>>>> traceable flush requests? Hmm, too bad.
>>>>>
>>>>>>
>>>>>> OTOH VTD can easily support PTE shadowing by setting a flag.
>>>>>
>>>>> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
>>>>> implementations are expected to NOT require explicit software flushing
>>>>> of write buffers and report RWBF=0 in the Capability register", we may
>>>>> eventually run into guests that no longer check that flag if we expose
>>>>> something that looks like a "newer" implementation.
>>>>
>>>> Hopefully not, if that happens we'll have to do a PV IOMMU :)
>>>
>>> Please not.
>>>
>>>>
>>>>> However, this flag is not set right now in our VT-d model.
>>>>>>
>>>>>> I'd like us to find some way to avoid possibility
>>>>>> of user error creating a configuration mixing e.g.
>>>>>> vfio with the amd iommu.
>>>>>>
>>>>>> I'm not sure how to do this.
>>>>>>
>>>>>> Any idea?
>>>>>
>>>>> There is likely no way around write-protecting the IOMMU page tables (in
>>>>> KVM mode) once we evaluated and cached them somewhere.
>>>>
>>>> Well for one, it's possible to use vt-d and not amd iommu.
>>>
>>> That would lead to nice combos of AMD CPUs with VT-d IOMMU. While it may
>>> be possible, I wouldn't rely on guests having tested that combination
>>> very well.
>>
>> To make the concern more concrete: I'm playing with code that will reuse
>> the MMU page tables for the IOMMU - the AMD architecture is designed for
>> that optimization (in contrast to Intel's). So, if the guest is not
>> foreseeing that artificial combo above (ours will definitely not)
>> because it is designed around the reuse, it will at least fail to run.
>>
>> Jan
>
> So if you have an AMD iommu on the host and that is capable
> of 2-level translation, then the flushing problem
> can be fixed by a kind of iommu pass-through
> where you point the host's iommu to guest's page tables.
Yes, right, that could be another approach - provided the tables have
compatible entries. I didn't look details of any of both so far, but I
wouldn't be overly optimistic. Usually, hardware is not very well
designed for interesting nesting purposes.
>
> So maybe what you need to do is make it possible
> for device to query iommu and ask whether it
> supports devices caching invalid PTEs.
> If not, vfio could fail.
Makes sense.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 14:00 ` Jan Kiszka
@ 2016-03-01 20:11 ` Michael S. Tsirkin
2016-03-01 20:17 ` Jan Kiszka
0 siblings, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 20:11 UTC (permalink / raw)
To: Jan Kiszka; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On Tue, Mar 01, 2016 at 03:00:09PM +0100, Jan Kiszka wrote:
> On 2016-03-01 14:48, Jan Kiszka wrote:
> > There is likely no way around write-protecting the IOMMU page tables (in
> > KVM mode) once we evaluated and cached them somewhere.
>
> I mean, when in kvm mode AND having something that caches enabled, of
> course.
Just write-protecting won't be enough either, since
the moment you remove the protection, all bets are off,
and if you don't, guest will start from the same point
when you re-enter and fault again.
What this seems to call for is a new kind of protection
where yes PTE is write protected, but instead of
making PTE writeable (or killing guest)
KVM handles it as an MMIO: emulates the write and then skips the instruction.
Emulation can be in kernel, just writing into guest memory
on behalf of the guest - with some kind of notifier
to flush the vfio cache - or instead it can exit to userspace
and have QEMU handle it like MMIO and write into guest memory.
> Besides vfio, we also still have the question how to deal with virtio
> and DMA remapping, which is probably similarly complicated when some
> vhost technology is involved.
>
> Jan
Well, that can limit itself to cache valid entries which is presumably
what hardware iommu does.
> --
> Siemens AG, Corporate Technology, CT RDA ITP SES-DE
> Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 20:11 ` Michael S. Tsirkin
@ 2016-03-01 20:17 ` Jan Kiszka
2016-03-01 20:39 ` Michael S. Tsirkin
0 siblings, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 20:17 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On 2016-03-01 21:11, Michael S. Tsirkin wrote:
> On Tue, Mar 01, 2016 at 03:00:09PM +0100, Jan Kiszka wrote:
>> On 2016-03-01 14:48, Jan Kiszka wrote:
>>> There is likely no way around write-protecting the IOMMU page tables (in
>>> KVM mode) once we evaluated and cached them somewhere.
>>
>> I mean, when in kvm mode AND having something that caches enabled, of
>> course.
>
> Just write-protecting won't be enough either, since
> the moment you remove the protection, all bets are off,
> and if you don't, guest will start from the same point
> when you re-enter and fault again.
We would not remove protection as long as the entry is in use by the
IOMMU. There should be no difference from shadow MMU logic here: trap
and emulate the write.
>
> What this seems to call for is a new kind of protection
> where yes PTE is write protected, but instead of
> making PTE writeable (or killing guest)
> KVM handles it as an MMIO: emulates the write and then skips the instruction.
>
> Emulation can be in kernel, just writing into guest memory
> on behalf of the guest - with some kind of notifier
> to flush the vfio cache - or instead it can exit to userspace
> and have QEMU handle it like MMIO and write into guest memory.
Exactly, but that's nothing new, is it? It's "just" slow, like other
shadow MMUs.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 20:17 ` Jan Kiszka
@ 2016-03-01 20:39 ` Michael S. Tsirkin
2016-03-01 21:23 ` Jan Kiszka
0 siblings, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 20:39 UTC (permalink / raw)
To: Jan Kiszka; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On Tue, Mar 01, 2016 at 09:17:58PM +0100, Jan Kiszka wrote:
> On 2016-03-01 21:11, Michael S. Tsirkin wrote:
> > On Tue, Mar 01, 2016 at 03:00:09PM +0100, Jan Kiszka wrote:
> >> On 2016-03-01 14:48, Jan Kiszka wrote:
> >>> There is likely no way around write-protecting the IOMMU page tables (in
> >>> KVM mode) once we evaluated and cached them somewhere.
> >>
> >> I mean, when in kvm mode AND having something that caches enabled, of
> >> course.
> >
> > Just write-protecting won't be enough either, since
> > the moment you remove the protection, all bets are off,
> > and if you don't, guest will start from the same point
> > when you re-enter and fault again.
>
> We would not remove protection as long as the entry is in use by the
> IOMMU. There should be no difference from shadow MMU logic here: trap
> and emulate the write.
Oh that's a nice trick. So you only write-protect it when you detect
that a range was invalidated. Unfortunately it has page granularity so
a single invalid PTE causes faults for writes to all others sharing a
page with it.
> >
> > What this seems to call for is a new kind of protection
> > where yes PTE is write protected, but instead of
> > making PTE writeable (or killing guest)
> > KVM handles it as an MMIO: emulates the write and then skips the instruction.
> >
> > Emulation can be in kernel, just writing into guest memory
> > on behalf of the guest - with some kind of notifier
> > to flush the vfio cache - or instead it can exit to userspace
> > and have QEMU handle it like MMIO and write into guest memory.
>
> Exactly, but that's nothing new, is it? It's "just" slow, like other
> shadow MMUs.
>
> Jan
Well AFAIK KVM does not have such an option ATM: MMIO causes exits for
reads and writes. We want MMIO exits for writes but not reads.
I agree it should be easy to implement.
> --
> Siemens AG, Corporate Technology, CT RDA ITP SES-DE
> Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 20:39 ` Michael S. Tsirkin
@ 2016-03-01 21:23 ` Jan Kiszka
2016-03-01 22:35 ` Michael S. Tsirkin
0 siblings, 1 reply; 53+ messages in thread
From: Jan Kiszka @ 2016-03-01 21:23 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On 2016-03-01 21:39, Michael S. Tsirkin wrote:
> On Tue, Mar 01, 2016 at 09:17:58PM +0100, Jan Kiszka wrote:
>> On 2016-03-01 21:11, Michael S. Tsirkin wrote:
>>>
>>> What this seems to call for is a new kind of protection
>>> where yes PTE is write protected, but instead of
>>> making PTE writeable (or killing guest)
>>> KVM handles it as an MMIO: emulates the write and then skips the instruction.
>>>
>>> Emulation can be in kernel, just writing into guest memory
>>> on behalf of the guest - with some kind of notifier
>>> to flush the vfio cache - or instead it can exit to userspace
>>> and have QEMU handle it like MMIO and write into guest memory.
>>
>> Exactly, but that's nothing new, is it? It's "just" slow, like other
>> shadow MMUs.
>>
>> Jan
>
> Well AFAIK KVM does not have such an option ATM: MMIO causes exits for
> reads and writes. We want MMIO exits for writes but not reads.
> I agree it should be easy to implement.
We have read-only memory slot support for quite a while. It's used to
support execute (and read) from emulated ROM devices.
Jan
--
Siemens AG, Corporate Technology, CT RDA ITP SES-DE
Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 21:23 ` Jan Kiszka
@ 2016-03-01 22:35 ` Michael S. Tsirkin
0 siblings, 0 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-01 22:35 UTC (permalink / raw)
To: Jan Kiszka; +Cc: valentine.sinitsyn, marcel, David Kiarie, qemu-devel
On Tue, Mar 01, 2016 at 10:23:55PM +0100, Jan Kiszka wrote:
> On 2016-03-01 21:39, Michael S. Tsirkin wrote:
> > On Tue, Mar 01, 2016 at 09:17:58PM +0100, Jan Kiszka wrote:
> >> On 2016-03-01 21:11, Michael S. Tsirkin wrote:
> >>>
> >>> What this seems to call for is a new kind of protection
> >>> where yes PTE is write protected, but instead of
> >>> making PTE writeable (or killing guest)
> >>> KVM handles it as an MMIO: emulates the write and then skips the instruction.
> >>>
> >>> Emulation can be in kernel, just writing into guest memory
> >>> on behalf of the guest - with some kind of notifier
> >>> to flush the vfio cache - or instead it can exit to userspace
> >>> and have QEMU handle it like MMIO and write into guest memory.
> >>
> >> Exactly, but that's nothing new, is it? It's "just" slow, like other
> >> shadow MMUs.
> >>
> >> Jan
> >
> > Well AFAIK KVM does not have such an option ATM: MMIO causes exits for
> > reads and writes. We want MMIO exits for writes but not reads.
> > I agree it should be easy to implement.
>
> We have read-only memory slot support for quite a while. It's used to
> support execute (and read) from emulated ROM devices.
>
> Jan
I didn't realize this causes an mmio exit.
> --
> Siemens AG, Corporate Technology, CT RDA ITP SES-DE
> Corporate Competence Center Embedded Linux
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-02-26 6:23 ` David Kiarie
@ 2016-03-02 4:00 ` David Kiarie
2016-03-02 4:08 ` David Kiarie
2016-03-03 9:34 ` Marcel Apfelbaum
0 siblings, 2 replies; 53+ messages in thread
From: David Kiarie @ 2016-03-02 4:00 UTC (permalink / raw)
To: Marcel Apfelbaum
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers, Michael S. Tsirkin
On Fri, Feb 26, 2016 at 9:23 AM, David Kiarie <davidkiarie4@gmail.com> wrote:
> On Thu, Feb 25, 2016 at 6:43 PM, Marcel Apfelbaum <marcel@redhat.com> wrote:
>> On 02/21/2016 08:10 PM, David Kiarie wrote:
>>>
>>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>>> The IOMMU does basic translation, error checking and has a
>>> mininal IOTLB implementation
>>
>>
>> Hi,
>>
>>>
>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>> ---
>>> hw/i386/Makefile.objs | 1 +
>>> hw/i386/amd_iommu.c | 1432
>>> +++++++++++++++++++++++++++++++++++++++++++++++++
>>> hw/i386/amd_iommu.h | 395 ++++++++++++++
>>> include/hw/pci/pci.h | 2 +
>>> 4 files changed, 1830 insertions(+)
>>> create mode 100644 hw/i386/amd_iommu.c
>>> create mode 100644 hw/i386/amd_iommu.h
>>>
>>> diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
>>> index b52d5b8..2f1a265 100644
>>> --- a/hw/i386/Makefile.objs
>>> +++ b/hw/i386/Makefile.objs
>>> @@ -3,6 +3,7 @@ obj-y += multiboot.o
>>> obj-y += pc.o pc_piix.o pc_q35.o
>>> obj-y += pc_sysfw.o
>>> obj-y += intel_iommu.o
>>> +obj-y += amd_iommu.o
>>> obj-$(CONFIG_XEN) += ../xenpv/ xen/
>>>
>>> obj-y += kvmvapic.o
>>> diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
>>> new file mode 100644
>>> index 0000000..3dac043
>>> --- /dev/null
>>> +++ b/hw/i386/amd_iommu.c
>>> @@ -0,0 +1,1432 @@
>>> +/*
>>> + * QEMU emulation of AMD IOMMU (AMD-Vi)
>>> + *
>>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>>> + *
>>> + * This program is free software; you can redistribute it and/or modify
>>> + * it under the terms of the GNU General Public License as published by
>>> + * the Free Software Foundation; either version 2 of the License, or
>>> + * (at your option) any later version.
>>> +
>>> + * This program is distributed in the hope that it will be useful,
>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>>> + * GNU General Public License for more details.
>>> +
>>> + * You should have received a copy of the GNU General Public License
>>> along
>>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>>> + *
>>> + * Cache implementation inspired by hw/i386/intel_iommu.c
>>> + *
>>> + */
>>> +#include "hw/i386/amd_iommu.h"
>>> +
>>> +/*#define DEBUG_AMD_IOMMU*/
>>> +#ifdef DEBUG_AMD_IOMMU
>>> +enum {
>>> + DEBUG_GENERAL, DEBUG_CAPAB, DEBUG_MMIO, DEBUG_ELOG,
>>> + DEBUG_CACHE, DEBUG_COMMAND, DEBUG_MMU
>>> +};
>>> +
>>> +#define IOMMU_DBGBIT(x) (1 << DEBUG_##x)
>>> +static int iommu_dbgflags = IOMMU_DBGBIT(MMIO);
>>> +
>>> +#define IOMMU_DPRINTF(what, fmt, ...) do { \
>>> + if (iommu_dbgflags & IOMMU_DBGBIT(what)) { \
>>> + fprintf(stderr, "(amd-iommu)%s: " fmt "\n", __func__, \
>>> + ## __VA_ARGS__); } \
>>> + } while (0)
>>> +#else
>>> +#define IOMMU_DPRINTF(what, fmt, ...) do {} while (0)
>>> +#endif
>>> +
>>> +typedef struct AMDIOMMUAddressSpace {
>>> + uint8_t bus_num; /* bus number
>>> */
>>> + uint8_t devfn; /* device function
>>> */
>>> + AMDIOMMUState *iommu_state; /* IOMMU - one per machine
>>> */
>>> + MemoryRegion iommu; /* Device's iommu region
>>> */
>>> + AddressSpace as; /* device's corresponding address space
>>> */
>>> +} AMDIOMMUAddressSpace;
>>> +
>>> +/* IOMMU cache entry */
>>> +typedef struct IOMMUIOTLBEntry {
>>> + uint64_t gfn;
>>> + uint16_t domid;
>>> + uint64_t devid;
>>> + uint64_t perms;
>>> + uint64_t translated_addr;
>>> +} IOMMUIOTLBEntry;
>>> +
>>> +/* configure MMIO registers at startup/reset */
>>> +static void amd_iommu_set_quad(AMDIOMMUState *s, hwaddr addr, uint64_t
>>> val,
>>> + uint64_t romask, uint64_t w1cmask)
>>> +{
>>> + stq_le_p(&s->mmior[addr], val);
>>> + stq_le_p(&s->romask[addr], romask);
>>> + stq_le_p(&s->w1cmask[addr], w1cmask);
>>> +}
>>> +
>>> +static uint16_t amd_iommu_readw(AMDIOMMUState *s, hwaddr addr)
>>> +{
>>> + return lduw_le_p(&s->mmior[addr]);
>>> +}
>>> +
>>> +static uint32_t amd_iommu_readl(AMDIOMMUState *s, hwaddr addr)
>>> +{
>>> + return ldl_le_p(&s->mmior[addr]);
>>> +}
>>> +
>>> +static uint64_t amd_iommu_readq(AMDIOMMUState *s, hwaddr addr)
>>> +{
>>> + return ldq_le_p(&s->mmior[addr]);
>>> +}
>>> +
>>> +/* internal write */
>>> +static void amd_iommu_writeq_raw(AMDIOMMUState *s, uint64_t val, hwaddr
>>> addr)
>>> +{
>>> + stq_le_p(&s->mmior[addr], val);
>>> +}
>>> +
>>> +/* external write */
>>> +static void amd_iommu_writew(AMDIOMMUState *s, hwaddr addr, uint16_t val)
>>> +{
>>> + uint16_t romask = lduw_le_p(&s->romask[addr]);
>>> + uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
>>> + uint16_t oldval = lduw_le_p(&s->mmior[addr]);
>>> + stw_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>>> oldval));
>>> +}
>>> +
>>> +static void amd_iommu_writel(AMDIOMMUState *s, hwaddr addr, uint32_t val)
>>> +{
>>> + uint32_t romask = ldl_le_p(&s->romask[addr]);
>>> + uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
>>> + uint32_t oldval = ldl_le_p(&s->mmior[addr]);
>>> + stl_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>>> oldval));
>>> +}
>>> +
>>> +static void amd_iommu_writeq(AMDIOMMUState *s, hwaddr addr, uint64_t val)
>>> +{
>>> + uint64_t romask = ldq_le_p(&s->romask[addr]);
>>> + uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
>>> + uint32_t oldval = ldq_le_p(&s->mmior[addr]);
>>> + stq_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>>> oldval));
>>> +}
>>> +
>>> +static void amd_iommu_log_event(AMDIOMMUState *s, uint16_t *evt)
>>> +{
>>> + /* event logging not enabled */
>>> + if (!s->evtlog_enabled || *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |
>>> + IOMMU_MMIO_STATUS_EVT_OVF) {
>>> + return;
>>> + }
>>> +
>>> + /* event log buffer full */
>>> + if (s->evtlog_tail >= s->evtlog_len) {
>>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>>> IOMMU_MMIO_STATUS_EVT_OVF;
>>> + /* generate interrupt */
>>> + msi_notify(&s->dev, 0);
>>> + }
>>> +
>>> + if (dma_memory_write(&address_space_memory, s->evtlog_len +
>>> s->evtlog_tail,
>>> + &evt, IOMMU_EVENT_LEN)) {
>>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address 0x%"PRIx64
>>> + " + offset 0x%"PRIx32, s->evtlog, s->evtlog_tail);
>>> + }
>>> +
>>> + s->evtlog_tail += IOMMU_EVENT_LEN;
>>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>>> IOMMU_MMIO_STATUS_COMP_INT;
>>> +}
>>> +
>>> +/* log an error encountered page-walking
>>> + *
>>> + * @addr: virtual address in translation request
>>> + */
>>> +static void amd_iommu_page_fault(AMDIOMMUState *s, uint16_t devid,
>>> + dma_addr_t addr, uint16_t info)
>>> +{
>>> + IOMMU_DPRINTF(ELOG, "");
>>> +
>>> + uint16_t evt[8];
>>> +
>>> + info |= IOMMU_EVENT_IOPF_I;
>>> +
>>> + /* encode information */
>>> + *(uint16_t *)&evt[0] = devid;
>>> + *(uint16_t *)&evt[3] = info;
>>> + *(uint64_t *)&evt[4] = cpu_to_le64(addr);
>>> +
>>> + /* log a page fault */
>>> + amd_iommu_log_event(s, evt);
>>> +
>>> + /* Abort the translation */
>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>> +}
>>> +/*
>>> + * log a master abort accessing device table
>>> + * @devtab : address of device table entry
>>> + * @info : error flags
>>> + */
>>> +static void amd_iommu_log_devtab_error(AMDIOMMUState *s, uint16_t devid,
>>> + dma_addr_t devtab, uint16_t info)
>>> +{
>>> +
>>> + IOMMU_DPRINTF(ELOG, "");
>>> +
>>> + uint16_t evt[8];
>>> +
>>> + info |= IOMMU_EVENT_DEV_TAB_HW_ERROR;
>>> +
>>> + /* encode information */
>>> + *(uint16_t *)&evt[0] = devid;
>>> + *(uint8_t *)&evt[3] = info;
>>> + *(uint64_t *)&evt[4] = cpu_to_le64(devtab);
>>> +
>>> + amd_iommu_log_event(s, evt);
>>> +
>>> + /* Abort the translation */
>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>> +
>>> +}
>>> +
>>> +/* log a master abort encountered during a page-walk
>>> + * @addr : address that couldn't be accessed
>>> + */
>>> +static void amd_iommu_log_pagetab_error(AMDIOMMUState *s, uint16_t devid,
>>> + dma_addr_t addr, uint16_t info)
>>> +{
>>> + IOMMU_DPRINTF(ELOG, "");
>>> +
>>> + uint16_t evt[8];
>>> +
>>> + info |= IOMMU_EVENT_PAGE_TAB_HW_ERROR;
>>> +
>>> + /* encode information */
>>> + *(uint16_t *)&evt[0] = devid;
>>> + *(uint8_t *)&evt[3] = info;
>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>> +
>>> + amd_iommu_log_event(s, evt);
>>> +
>>> + /* Abort the translation */
>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>> +
>>> +}
>>> +
>>> +/* log an event trying to access command buffer
>>> + * @addr : address that couldn't be accessed
>>> + */
>>> +static void amd_iommu_log_command_error(AMDIOMMUState *s, dma_addr_t
>>> addr)
>>> +{
>>> + IOMMU_DPRINTF(ELOG, "");
>>> +
>>> + uint16_t evt[8];
>>> +
>>> + /* encode information */
>>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_COMMAND_HW_ERROR;
>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>> +
>>> + amd_iommu_log_event(s, evt);
>>> +
>>> + /* Abort the translation */
>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>> +}
>>> +
>>> +/* log an illegal comand event
>>> + * @addr : address of illegal command
>>> + */
>>> +static void amd_iommu_log_illegalcom_error(AMDIOMMUState *s, uint16_t
>>> info,
>>> + dma_addr_t addr)
>>> +{
>>> + IOMMU_DPRINTF(ELOG, "");
>>> +
>>> + uint16_t evt[8];
>>> +
>>> + /* encode information */
>>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_ILLEGAL_COMMAND_ERROR;
>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>
>>
>> Can you please use a macro instead of 3 literal?
>>
>>> +
>>> + amd_iommu_log_event(s, evt);
>>> +}
>>> +
>>> +/* log an error accessing device table
>>> + *
>>> + * @devid : device owning the table entry
>>> + * @devtab : address of device table entry
>>> + * @info : error flags
>>> + */
>>> +static void amd_iommu_log_illegaldevtab_error(AMDIOMMUState *s, uint16_t
>>> devid,
>>> + dma_addr_t addr, uint16_t
>>> info)
>>> +{
>>> + IOMMU_DPRINTF(ELOG, "");
>>> +
>>> + uint16_t evt[8];
>>> +
>>> + info |= IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY;
>>> +
>>> + *(uint16_t *)&evt[0] = devid;
>>> + *(uint8_t *)&evt[3] = info;
>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>> +
>>> + amd_iommu_log_event(s, evt);
>>> +}
>>
>>
>> It seems that the all log functions do the same:
>> create an event, log it and optionally set PCI_STATUS_SIG_TARGET_ABORT
>>
>> I would consider to unite them in the same function. (not a must)
I would prefer to leave the event code as separate but I could
probably add a macro. Currently we are logging just a lot less
information that we should be logging and with the logging of more
information it could become a bit ugly.
>>
>>> +
>>> +static gboolean amd_iommu_uint64_equal(gconstpointer v1, gconstpointer
>>> v2)
>>> +{
>>> + return *((const uint64_t *)v1) == *((const uint64_t *)v2);
>>> +}
>>> +
>>> +static guint amd_iommu_uint64_hash(gconstpointer v)
>>> +{
>>> + return (guint)*(const uint64_t *)v;
>>> +}
>>> +
>>> +static IOMMUIOTLBEntry *amd_iommu_iotlb_lookup(AMDIOMMUState *s, hwaddr
>>> addr,
>>> + uint64_t devid)
>>> +{
>>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>>> + return g_hash_table_lookup(s->iotlb, &key);
>>> +}
>>> +
>>> +static void amd_iommu_iotlb_reset(AMDIOMMUState *s)
>>> +{
>>> + assert(s->iotlb);
>>> + g_hash_table_remove_all(s->iotlb);
>>> +}
>>> +
>>> +static gboolean amd_iommu_iotlb_remove_by_devid(gpointer key, gpointer
>>> value,
>>> + gpointer user_data)
>>> +{
>>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>>> + uint16_t devid = *(uint16_t *)user_data;
>>> + return entry->devid == devid;
>>> +}
>>> +
>>> +static void amd_iommu_iotlb_remove_page(AMDIOMMUState *s, hwaddr addr,
>>> + uint64_t devid)
>>> +{
>>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>>> + g_hash_table_remove(s->iotlb, &key);
>>> +}
>>> +
>>> +/* extract device id */
>>> +static inline uint16_t devid_extract(uint8_t *cmd)
>>> +{
>>> + return (uint16_t)cmd[2] & IOMMU_INVAL_DEV_ID_MASK;
>>> +}
>>> +
>>> +static void amd_iommu_invalidate_iotlb(AMDIOMMUState *s, uint64_t *cmd)
>>> +{
>>> + uint16_t devid = devid_extract((uint8_t *)cmd);
>>> + /* if invalidation of more than one page requested */
>>> + if (IOMMU_INVAL_ALL(cmd[0])) {
>>> + g_hash_table_foreach_remove(s->iotlb,
>>> amd_iommu_iotlb_remove_by_devid,
>>> + &devid);
>>> + } else {
>>> + hwaddr addr = (hwaddr)(cmd[1] & IOMMU_INVAL_ADDR_MASK);
>>> + amd_iommu_iotlb_remove_page(s, addr, devid);
>>> + }
>>> +}
>>> +
>>> +static void amd_iommu_update_iotlb(AMDIOMMUState *s, uint16_t devid,
>>> + uint64_t gpa, uint64_t spa, uint64_t
>>> perms,
>>> + uint16_t domid)
>>> +{
>>> + IOMMUIOTLBEntry *entry = g_malloc(sizeof(*entry));
>>> + uint64_t *key = g_malloc(sizeof(key));
>>> + uint64_t gfn = gpa >> IOMMU_PAGE_SHIFT_4K;
>>> +
>>> + IOMMU_DPRINTF(CACHE, " update iotlb devid: %02x:%02x.%x gpa
>>> 0x%"PRIx64
>>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
>>> + PCI_FUNC(devid), gpa, spa);
>>> +
>>> + if (g_hash_table_size(s->iotlb) >= IOMMU_IOTLB_MAX_SIZE) {
>>> + IOMMU_DPRINTF(CACHE, "iotlb exceeds size limit - reset");
>>> + amd_iommu_iotlb_reset(s);
>>> + }
>>> +
>>> + entry->gfn = gfn;
>>> + entry->domid = domid;
>>> + entry->perms = perms;
>>> + entry->translated_addr = spa;
>>> + *key = gfn | ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>>> + g_hash_table_replace(s->iotlb, key, entry);
>>> +}
>>> +
>>> +/* execute a completion wait command */
>>> +static void amd_iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> + unsigned int addr;
>>> +
>>> + /* completion store */
>>> + if (cmd[0] & IOMMU_COM_COMPLETION_STORE_MASK) {
>>> + addr = le64_to_cpu(*(uint64_t *)cmd) &
>>> IOMMU_COM_STORE_ADDRESS_MASK;
>>> + if (dma_memory_write(&address_space_memory, addr, cmd + 8, 8)) {
>>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address
>>> 0%x"PRIx64,
>>> + addr);
>>> + }
>>> + }
>>> +
>>> + /* set completion interrupt */
>>> + if (cmd[0] & IOMMU_COM_COMPLETION_INTR) {
>>> + s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
>>> + }
>>> +}
>>> +
>>> +/* get command type */
>>> +static uint8_t opcode(uint8_t *cmd)
>>> +{
>>> + return cmd[IOMMU_CMDBUF_ID_BYTE] >> IOMMU_CMDBUF_ID_RSHIFT;
>>> +}
>>> +
>>> +/* linux seems to be using reserved bits so I just log without abortig
>>> bug */
>>
>>
>> I couldn't quite understand the comment
>>
>>> +static void iommu_inval_devtab_entry(AMDIOMMUState *s, uint8_t *cmd,
>>> + uint8_t type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + /* This command should invalidate internal caches of which there
>>> isn't */
>>> + if (*(uint64_t *)&cmd[0] & IOMMU_CMD_INVAL_DEV_RSVD ||
>>> + *(uint64_t *)&cmd[1]) {
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + }
>>> +#ifdef DEBUG_AMD_IOMMU
>>> + uint16_t devid = devid_extract(cmd);
>>> +#endif
>>> + IOMMU_DPRINTF(COMMAND, "device table entry for devid: %02x:%02x.%x"
>>> + "invalidated", PCI_BUS_NUM(devid), PCI_SLOT(devid),
>>> + PCI_FUNC(devid));
>>> +}
>>> +
>>> +static void iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>> type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + if (*(uint32_t *)&cmd[1] & IOMMU_COMPLETION_WAIT_RSVD) {
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + }
>>> + /* pretend to wait for command execution to complete */
>>> + IOMMU_DPRINTF(COMMAND, "completion wait requested with store address
>>> 0x%"
>>> + PRIx64 " and store data 0x%"PRIx64, (cmd[0] &
>>> + IOMMU_COM_STORE_ADDRESS_MASK), *(uint64_t *)(cmd + 8));
>>> + amd_iommu_completion_wait(s, cmd);
>>> +}
>>> +
>>> +static void iommu_complete_ppr(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>> type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_COMPLETE_PPR_RQ_RSVD) ||
>>> + *(uint64_t *)&cmd[1] & 0xffff000000000000) {
>>
>>
>>
>> Can you please document this mask?
>>
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + }
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "Execution of PPR queue requested");
>>> +}
>>> +
>>> +static void iommu_inval_all(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_ALL_RSVD) ||
>>> + *(uint64_t *)&cmd[1]) {
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + }
>>> +
>>> + amd_iommu_iotlb_reset(s);
>>> + IOMMU_DPRINTF(COMMAND, "Invalidation of all IOMMU cache requested");
>>> +}
>>> +
>>> +static inline uint16_t domid_extract(uint64_t *cmd)
>>> +{
>>> + return (uint16_t)cmd[0] & IOMMU_INVAL_PAGES_DOMID;
>>> +}
>>> +
>>> +static gboolean amd_iommu_iotlb_remove_by_domid(gpointer key, gpointer
>>> value,
>>> + gpointer user_data)
>>> +{
>>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>>> + uint16_t domid = *(uint16_t *)user_data;
>>> + return entry->domid == domid;
>>> +}
>>> +
>>> +/* we don't have devid - we can't remove pages by address */
>>> +static void iommu_inval_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>> type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> + uint16_t domid = domid_extract((uint64_t *)cmd);
>>> +
>>> + if (*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_PAGES_RSVD ||
>>> + *(uint32_t *)&cmd[1] & 0x00000ff0) {
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + }
>>> +
>>> + g_hash_table_foreach_remove(s->iotlb,
>>> amd_iommu_iotlb_remove_by_domid,
>>> + &domid);
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "IOMMU pages for domain 0x%"PRIx16
>>> "invalidated",
>>> + domid);
>>> +}
>>> +
>>> +static void iommu_prefetch_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>> type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_PRF_IOMMU_PAGES_RSVD) ||
>>> + (*(uint32_t *)&cmd[1] & 0x00000fd4)) {
>>
>>
>> Here the same, maybe you can name the mask, so we can easier follow the
>> spec.
>>
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + }
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "Pre-fetch of IOMMU pages requested");
>>> +}
>>> +
>>> +static void iommu_inval_inttable(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>> type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_INTR_TABLE_RSVD) ||
>>> + *(uint64_t *)&cmd[1]) {
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + return;
>>> + }
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "interrupt table invalidated");
>>> +}
>>> +
>>> +static void iommu_inval_iotlb(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>> type)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + if (*(uint32_t *)&cmd[2] & IOMMU_INVAL_IOTLB_PAGES_RSVD) {
>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>> s->cmdbuf_head);
>>> + return;
>>> + }
>>> +
>>> + amd_iommu_invalidate_iotlb(s, (uint64_t *)cmd);
>>> + IOMMU_DPRINTF(COMMAND, "IOTLB pages invalidated");
>>> +}
>>> +
>>> +/* not honouring reserved bits is regarded as an illegal command */
>>> +static void amd_iommu_cmdbuf_exec(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint8_t type;
>>> + uint8_t cmd[IOMMU_COMMAND_SIZE];
>>> +
>>> + memset(cmd, 0, IOMMU_COMMAND_SIZE);
>>> +
>>> + if (dma_memory_read(&address_space_memory, s->cmdbuf +
>>> s->cmdbuf_head, cmd,
>>> + IOMMU_COMMAND_SIZE)) {
>>> + IOMMU_DPRINTF(COMMAND, "error: fail to access memory at
>>> 0x%"PRIx64
>>> + " + 0x%"PRIu8, s->cmdbuf, s->cmdbuf_head);
>>> + amd_iommu_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
>>> + return;
>>> + }
>>> +
>>> + type = opcode(cmd);
>>> +
>>> + switch (type) {
>>> + case IOMMU_CMD_COMPLETION_WAIT:
>>> + iommu_completion_wait(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_INVAL_DEVTAB_ENTRY:
>>> + iommu_inval_devtab_entry(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_INVAL_IOMMU_PAGES:
>>> + iommu_inval_pages(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_INVAL_IOTLB_PAGES:
>>> + iommu_inval_iotlb(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_INVAL_INTR_TABLE:
>>> + iommu_inval_inttable(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_PREFETCH_IOMMU_PAGES:
>>> + iommu_prefetch_pages(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_COMPLETE_PPR_REQUEST:
>>> + iommu_complete_ppr(s, cmd, type);
>>> + break;
>>> +
>>> + case IOMMU_CMD_INVAL_IOMMU_ALL:
>>> + iommu_inval_all(s, cmd, type);
>>> + break;
>>> +
>>> + default:
>>> + IOMMU_DPRINTF(COMMAND, "unhandled command %d", type);
>>> + /* log illegal command */
>>> + amd_iommu_log_illegalcom_error(s, type,
>>> + s->cmdbuf + s->cmdbuf_head);
>>> + break;
>>> + }
>>> +
>>> +}
>>> +
>>> +static void amd_iommu_cmdbuf_run(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t *mmio_cmdbuf_head = (uint64_t *)(s->mmior +
>>> + IOMMU_MMIO_COMMAND_HEAD);
>>> +
>>> + if (!s->cmdbuf_enabled) {
>>> + IOMMU_DPRINTF(COMMAND, "error: IOMMU trying to execute commands
>>> with "
>>> + "command buffer disabled. IOMMU control value
>>> 0x%"PRIx64,
>>> + amd_iommu_readq(s, IOMMU_MMIO_CONTROL));
>>> + return;
>>> + }
>>> +
>>> + while (s->cmdbuf_head != s->cmdbuf_tail) {
>>> + /* check if there is work to do. */
>>> + IOMMU_DPRINTF(COMMAND, "command buffer head at 0x%"PRIx32 "
>>> command "
>>> + "buffer tail at 0x%"PRIx32" command buffer base at
>>> 0x%"
>>> + PRIx64, s->cmdbuf_head, s->cmdbuf_tail, s->cmdbuf);
>>> + amd_iommu_cmdbuf_exec(s);
>>> + s->cmdbuf_head += IOMMU_COMMAND_SIZE;
>>> + amd_iommu_writeq_raw(s, s->cmdbuf_head,
>>> IOMMU_MMIO_COMMAND_HEAD);
>>> +
>>> + /* wrap head pointer */
>>> + if (s->cmdbuf_head >= s->cmdbuf_len * IOMMU_COMMAND_SIZE) {
>>> + s->cmdbuf_head = 0;
>>> + }
>>> + }
>>> +
>>> + *mmio_cmdbuf_head = cpu_to_le64(s->cmdbuf_head);
>>> +}
>>> +
>>> +/* System Software might never read from some of this fields but anyways
>>> */
>>> +static uint64_t amd_iommu_mmio_read(void *opaque, hwaddr addr, unsigned
>>> size)
>>> +{
>>> + AMDIOMMUState *s = opaque;
>>> +
>>> + uint64_t val = -1;
>>
>>
>> The above might work, but it looks a little weird
>>
>>> + if (addr + size > IOMMU_MMIO_SIZE) {
>>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIX64
>>> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE,
>>> addr,
>>> + size);
>>> + return (uint64_t)-1;
>>> + }
>>> +
>>> + if (size == 2) {
>>> + val = amd_iommu_readw(s, addr);
>>> + } else if (size == 4) {
>>> + val = amd_iommu_readl(s, addr);
>>> + } else if (size == 8) {
>>> + val = amd_iommu_readq(s, addr);
>>> + }
>>> +
>>> + switch (addr & ~0x07) {
>>> + case IOMMU_MMIO_DEVICE_TABLE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_COMMAND_BASE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_BASE read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EVENT_BASE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_CONTROL:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_CONTROL read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EXCL_BASE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_BASE read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EXCL_LIMIT:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_COMMAND_HEAD:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_COMMAND_TAIL:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_TAIL read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EVENT_HEAD:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EVENT_TAIL:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_STATUS:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_STATUS read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EXT_FEATURES:
>>> + IOMMU_DPRINTF(MMU, "MMIO_EXT_FEATURES read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64 "value 0x%"PRIx64,
>>> + addr, size, addr & ~0x07, val);
>>> + break;
>>> +
>>> + default:
>>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO read addr 0x%"PRIx64
>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>> + addr & ~0x07);
>>> + }
>>> + return val;
>>> +}
>>> +
>>> +static void iommu_handle_control_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> + /*
>>> + * read whatever is already written in case
>>> + * software is writing in chucks less than 8 bytes
>>> + */
>>> + unsigned long control = amd_iommu_readq(s, IOMMU_MMIO_CONTROL);
>>> + s->enabled = !!(control & IOMMU_MMIO_CONTROL_IOMMUEN);
>>> +
>>> + s->ats_enabled = !!(control & IOMMU_MMIO_CONTROL_HTTUNEN);
>>> + s->evtlog_enabled = s->enabled && !!(control &
>>> + IOMMU_MMIO_CONTROL_EVENTLOGEN);
>>> +
>>> + s->evtlog_intr = !!(control & IOMMU_MMIO_CONTROL_EVENTINTEN);
>>> + s->completion_wait_intr = !!(control &
>>> IOMMU_MMIO_CONTROL_COMWAITINTEN);
>>> + s->cmdbuf_enabled = s->enabled && !!(control &
>>> + IOMMU_MMIO_CONTROL_CMDBUFLEN);
>>> +
>>> + /* update the flags depending on the control register */
>>> + if (s->cmdbuf_enabled) {
>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>>> + IOMMU_MMIO_STATUS_CMDBUF_RUN;
>>> + } else {
>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>>> + ~IOMMU_MMIO_STATUS_CMDBUF_RUN;
>>> + }
>>> + if (s->evtlog_enabled) {
>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>>> + IOMMU_MMIO_STATUS_EVT_RUN;
>>> + } else {
>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>>> + ~IOMMU_MMIO_STATUS_EVT_RUN;
>>> + }
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "MMIO_STATUS state 0x%"PRIx64, control);
>>> +
>>> + amd_iommu_cmdbuf_run(s);
>>> +}
>>> +
>>> +static inline void iommu_handle_devtab_write(AMDIOMMUState *s)
>>> +
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_DEVICE_TABLE);
>>> + s->devtab = (dma_addr_t)(val & IOMMU_MMIO_DEVTAB_BASE_MASK);
>>> +
>>> + /* set device table length */
>>> + s->devtab_len = ((val & IOMMU_MMIO_DEVTAB_SIZE_MASK) + 1 *
>>> + (IOMMU_MMIO_DEVTAB_SIZE_UNIT /
>>> + IOMMU_MMIO_DEVTAB_ENTRY_SIZE));
>>> +}
>>> +
>>> +static inline void iommu_handle_cmdhead_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + s->cmdbuf_head = (dma_addr_t)amd_iommu_readq(s,
>>> IOMMU_MMIO_COMMAND_HEAD)
>>> + & IOMMU_MMIO_CMDBUF_HEAD_MASK;
>>> + amd_iommu_cmdbuf_run(s);
>>> +}
>>> +
>>> +static inline void iommu_handle_cmdbase_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + s->cmdbuf = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_BASE)
>>> + & IOMMU_MMIO_CMDBUF_BASE_MASK;
>>> + s->cmdbuf_len = 1UL << (s->mmior[IOMMU_MMIO_CMDBUF_SIZE_BYTE]
>>> + & IOMMU_MMIO_CMDBUF_SIZE_MASK);
>>> + s->cmdbuf_head = s->cmdbuf_tail = 0;
>>> +
>>> +}
>>> +
>>> +static inline void iommu_handle_cmdtail_write(AMDIOMMUState *s)
>>> +{
>>> + s->cmdbuf_tail = amd_iommu_readq(s, IOMMU_MMIO_COMMAND_TAIL)
>>> + & IOMMU_MMIO_CMDBUF_TAIL_MASK;
>>> + amd_iommu_cmdbuf_run(s);
>>> +}
>>> +
>>> +static inline void iommu_handle_excllim_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EXCL_LIMIT);
>>> + s->excl_limit = (val & IOMMU_MMIO_EXCL_LIMIT_MASK) |
>>> + IOMMU_MMIO_EXCL_LIMIT_LOW;
>>> +}
>>> +
>>> +static inline void iommu_handle_evtbase_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_BASE);
>>> + s->evtlog = val & IOMMU_MMIO_EVTLOG_BASE_MASK;
>>> + s->evtlog_len = 1UL << (*(uint64_t
>>> *)&s->mmior[IOMMU_MMIO_EVTLOG_SIZE_BYTE]
>>> + & IOMMU_MMIO_EVTLOG_SIZE_MASK);
>>> +}
>>> +
>>> +static inline void iommu_handle_evttail_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_TAIL);
>>> + s->evtlog_tail = val & IOMMU_MMIO_EVTLOG_TAIL_MASK;
>>> +}
>>> +
>>> +static inline void iommu_handle_evthead_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_HEAD);
>>> + s->evtlog_head = val & IOMMU_MMIO_EVTLOG_HEAD_MASK;
>>> +}
>>> +
>>> +static inline void iommu_handle_pprbase_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_BASE);
>>> + s->ppr_log = val & IOMMU_MMIO_PPRLOG_BASE_MASK;
>>> + s->pprlog_len = 1UL << (*(uint64_t
>>> *)&s->mmior[IOMMU_MMIO_PPRLOG_SIZE_BYTE]
>>> + & IOMMU_MMIO_PPRLOG_SIZE_MASK);
>>> +}
>>> +
>>> +static inline void iommu_handle_pprhead_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_HEAD);
>>> + s->pprlog_head = val & IOMMU_MMIO_PPRLOG_HEAD_MASK;
>>> +}
>>> +
>>> +static inline void iommu_handle_pprtail_write(AMDIOMMUState *s)
>>> +{
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_TAIL);
>>> + s->pprlog_tail = val & IOMMU_MMIO_PPRLOG_TAIL_MASK;
>>> +}
>>> +
>>> +/* FIXME: something might go wrong if System Software writes in chunks
>>> + * of one byte but linux writes in chunks of 4 bytes so currently it
>>> + * works correctly with linux but will definitely be busted if software
>>> + * reads/writes 8 bytes
>>> + */
>>> +static void amd_iommu_mmio_write(void *opaque, hwaddr addr, uint64_t val,
>>> + unsigned size)
>>> +{
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "");
>>> +
>>> + AMDIOMMUState *s = opaque;
>>> + unsigned long offset = addr & 0x07;
>>> +
>>> + if (addr + size > IOMMU_MMIO_SIZE) {
>>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIx64
>>> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE,
>>> addr,
>>> + size);
>>> + return;
>>> + }
>>> +
>>> + switch (addr & ~0x07) {
>>> + case IOMMU_MMIO_CONTROL:
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> +
>>> + IOMMU_DPRINTF(COMMAND, "MMIO_CONTROL write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + iommu_handle_control_write(s);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_DEVICE_TABLE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> +
>>> + /* set device table address
>>> + * This also suffers from inability to tell whether software
>>> + * is done writing
>>> + */
>>> +
>>> + if (offset || (size == 8)) {
>>> + iommu_handle_devtab_write(s);
>>> + }
>>> + break;
>>> +
>>> + case IOMMU_MMIO_COMMAND_HEAD:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> +
>>> + iommu_handle_cmdhead_write(s);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_COMMAND_BASE:
>>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_BASE write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> +
>>> + /* FIXME - make sure System Software has finished writing incase
>>> + * it writes in chucks less than 8 bytes in a robust way.As for
>>> + * now, this hacks works for the linux driver
>>> + */
>>> + if (offset || (size == 8)) {
>>> + iommu_handle_cmdbase_write(s);
>>> + }
>>> + break;
>>> +
>>> + case IOMMU_MMIO_COMMAND_TAIL:
>>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_TAIL write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_cmdtail_write(s);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EVENT_BASE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_evtbase_write(s);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EVENT_HEAD:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_evthead_write(s);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EVENT_TAIL:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_evttail_write(s);
>>> + break;
>>> +
>>> + case IOMMU_MMIO_EXCL_LIMIT:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_excllim_write(s);
>>> + break;
>>> +
>>> + /* PPR log base - unused for now */
>>> + case IOMMU_MMIO_PPR_BASE:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_BASE write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_pprbase_write(s);
>>> + break;
>>> + /* PPR log head - also unused for now */
>>> + case IOMMU_MMIO_PPR_HEAD:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_HEAD write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_pprhead_write(s);
>>> + break;
>>> + /* PPR log tail - unused for now */
>>> + case IOMMU_MMIO_PPR_TAIL:
>>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_TAIL write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + if (size == 2) {
>>> + amd_iommu_writew(s, addr, val);
>>> + } else if (size == 4) {
>>> + amd_iommu_writel(s, addr, val);
>>> + } else if (size == 8) {
>>> + amd_iommu_writeq(s, addr, val);
>>> + }
>>> + iommu_handle_pprtail_write(s);
>>> + break;
>>> +
>>> + /* ignore write to ext_features */
>>> + default:
>>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO write addr 0x%"PRIx64
>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>> + addr, size, val, offset);
>>> + }
>>> +
>>> +}
>>> +
>>> +static inline uint64_t amd_iommu_get_perms(uint64_t entry)
>>> +{
>>> + return (entry & (IOMMU_DEV_PERM_READ | IOMMU_DEV_PERM_WRITE)) >>
>>> + IOMMU_DEV_PERM_SHIFT;
>>> +}
>>> +
>>> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn)
>>> +{
>>> + AMDIOMMUState *s = opaque;
>>> + AMDIOMMUAddressSpace **iommu_as;
>>> + int bus_num = pci_bus_num(bus);
>>> +
>>> + /* just in case */
>>
>>
>> This comment troubles me, do we need the assert?
In case the bus_num or devfn is invalid. Anyway, I could get of rid of
this assert.
>>
>>> + assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
>>
>>
>> bus_num < PCI_BUS_MAX, right ?
>>
>>> + assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
>>
>>
>> same with devfn I suppose.
>>
>>> +
>>> + iommu_as = s->address_spaces[bus_num];
>>> +
>>> + /* allocate memory during the first run */
>>> + if (!iommu_as) {
>>
>>
>> Why lazy init? We can do that at AMDIOMMUState init, right?
This code has to be called for all emulated devices when the bus is
initialized. If you have it on AMDIOMMUState init - it will only be
called for one or two devices already initiliazed.
>>
>>> + iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) *
>>> PCI_DEVFN_MAX);
>>> + s->address_spaces[bus_num] = iommu_as;
>>> + }
>>> +
>>> + /* set up IOMMU region */
>>> + if (!iommu_as[devfn]) {
>>> + iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
>>
>>
>> same here
>>
>>> + iommu_as[devfn]->bus_num = (uint8_t)bus_num;
>>> + iommu_as[devfn]->devfn = (uint8_t)devfn;
>>> + iommu_as[devfn]->iommu_state = s;
>>> +
>>> + memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
>>> + &s->iommu_ops, "amd-iommu", UINT64_MAX);
>>> + address_space_init(&iommu_as[devfn]->as, &iommu_as[devfn]->iommu,
>>> + "amd-iommu");
>>> + }
>>> + return &iommu_as[devfn]->as;
>>> +}
>>> +
>>> +/* validate a page table entry */
>>> +static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
>>> + uint64_t *dte)
>>> +{
>>> + if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
>>> + || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
>>> + || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
>>> + amd_iommu_log_illegaldevtab_error(s, devid,
>>> + s->devtab + devid *
>>> IOMMU_DEVTAB_ENTRY_SIZE, 0);
>>> + return false;
>>> + }
>>> +
>>> + return dte[0] & IOMMU_DEV_VALID && (dte[0] &
>>> IOMMU_DEV_TRANSLATION_VALID)
>>> + && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
>>> +}
>>> +
>>> +/* get a device table entry given the devid */
>>> +static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t
>>> *entry)
>>> +{
>>> + uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
>>> +
>>> + IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
>>> +
>>> + if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
>>> + IOMMU_DEVTAB_ENTRY_SIZE)) {
>>> + IOMMU_DPRINTF(MMU, "error: fail to access Device Entry devtab
>>> 0x%"PRIx64
>>> + "offset 0x%"PRIx32, s->devtab, offset);
>>> + /* log ever accessing dte */
>>> + amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
>>> + return false;
>>> + }
>>> +
>>> + if (!amd_iommu_validate_dte(s, devid, entry)) {
>>> + IOMMU_DPRINTF(MMU,
>>> + "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
>>> + return false;
>>> + }
>>> +
>>> + return true;
>>> +}
>>> +
>>> +/* get pte translation mode */
>>> +static inline uint8_t get_pte_translation_mode(uint64_t pte)
>>> +{
>>> + return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
>>> +}
>>> +
>>> +static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
>>> + IOMMUTLBEntry *ret, unsigned perms,
>>> + hwaddr addr)
>>> +{
>>> + uint8_t level, oldlevel;
>>> + unsigned present;
>>> + uint64_t pte, pte_addr;
>>> + uint64_t pte_perms;
>>> + pte = dte[0];
>>> +
>>> + level = get_pte_translation_mode(pte);
>>> +
>>> + if (level >= 7 || level == 0) {
>>> + IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 "
>>> detected"
>>> + "while translating 0x%"PRIx64, level, addr);
>>> + return -1;
>>> + }
>>> +
>>> + while (level > 0) {
>>> + pte_perms = amd_iommu_get_perms(pte);
>>> + present = pte & 1;
>>> + if (!present || perms != (perms & pte_perms)) {
>>> + amd_iommu_page_fault(as->iommu_state, as->devfn, addr,
>>> perms);
>>> + IOMMU_DPRINTF(MMU, "error: page fault accessing virtual addr
>>> 0x%"
>>> + PRIx64, addr);
>>> + return -1;
>>> + }
>>> +
>>> + /* go to the next lower level */
>>> + pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
>>> + /* add offset and load pte */
>>> + pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
>>> + pte = ldq_phys(&address_space_memory, pte_addr);
>>> + oldlevel = level;
>>> + level = get_pte_translation_mode(pte);
>>> +
>>> + /* PT is corrupted or not there */
>>> + if (level != oldlevel - 1) {
>>> + return -1;
>>> + }
>>> + }
>>> +
>>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>>> + ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) &
>>> IOMMU_PAGE_MASK_4K;
>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>> + ret->perm = IOMMU_RW;
>>> + return 0;
>>> +}
>>> +
>>> +/* TODO : Mark addresses as Accessed and Dirty */
>>
>>
>> If you don't mark addresses as dirty, can't this cause the sporadic errors
>> of arbitrary programs Jan talked about?
>
> I don't think this the issue, am seem to be receiving wrong 'host
> physical addresses' in the last few kernel version. This issue is not
> there in older kernels.
>
>>
>>> +static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr addr,
>>> + bool is_write, IOMMUTLBEntry *ret)
>>> +{
>>> + AMDIOMMUState *s = as->iommu_state;
>>> + uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
>>> + IOMMUIOTLBEntry *iotlb_entry;
>>> + uint8_t err;
>>> + uint64_t entry[4];
>>> +
>>> + /* try getting a cache entry first */
>>> + iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
>>> +
>>> + if (iotlb_entry) {
>>> + IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa
>>> 0x%"PRIx64
>>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid),
>>> PCI_SLOT(devid),
>>> + PCI_FUNC(devid), addr,
>>> iotlb_entry->translated_addr);
>>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>>> + ret->translated_addr = iotlb_entry->translated_addr;
>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>> + ret->perm = iotlb_entry->perms;
>>> + return;
>>> + } else {
>>
>>
>> you return from the if clause so you don't need the else
>>
>>> + if (!amd_iommu_get_dte(s, devid, entry)) {
>>
>>
>> is not an error if you did not find the device id?
>>
>>> + goto out;
>>> + }
>>> +
>>> + err = amd_iommu_page_walk(as, entry, ret,
>>> + is_write ? IOMMU_PERM_WRITE :
>>> IOMMU_PERM_READ,
>>> + addr);
>>> + if (err) {
>>> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page
>>> tables"
>>> + " while translating addr 0x%"PRIx64, addr);
>>> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
>>> + goto out;
>>> + }
>>> +
>>> + amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
>>> + ret->perm, entry[1] &
>>> IOMMU_DEV_DOMID_ID_MASK);
>>> + return;
>>> + }
>>> +
>>> +out:
>>> + ret->iova = addr;
>>> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>> + ret->perm = IOMMU_RW;
>>> + return;
>>
>>
>> you don't need the above return
>>
>>> +}
>>> +
>>> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr
>>> addr,
>>> + bool is_write)
>>> +{
>>> + IOMMU_DPRINTF(GENERAL, "");
>>> +
>>> + AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace,
>>> iommu);
>>> + AMDIOMMUState *s = as->iommu_state;
>>> +
>>> + IOMMUTLBEntry ret = {
>>> + .target_as = &address_space_memory,
>>> + .iova = addr,
>>> + .translated_addr = 0,
>>> + .addr_mask = ~(hwaddr)0,
>>> + .perm = IOMMU_NONE,
>>> + };
>>> +
>>> + if (!s->enabled) {
>>> + /* IOMMU disabled - corresponds to iommu=off not
>>> + * failure to provide any parameter
>>> + */
>>> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
>>> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
>>> + ret.perm = IOMMU_RW;
>>> + return ret;
>>> + }
>>> +
>>> + amd_iommu_do_translate(as, addr, is_write, &ret);
>>> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa
>>> 0x%"PRIx64,
>>> + as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn),
>>> addr,
>>> + ret.translated_addr);
>>> +
>>> + return ret;
>>> +}
>>> +
>>> +static const MemoryRegionOps mmio_mem_ops = {
>>> + .read = amd_iommu_mmio_read,
>>> + .write = amd_iommu_mmio_write,
>>> + .endianness = DEVICE_LITTLE_ENDIAN,
>>> + .impl = {
>>> + .min_access_size = 1,
>>> + .max_access_size = 8,
>>> + .unaligned = false,
>>> + },
>>> + .valid = {
>>> + .min_access_size = 1,
>>> + .max_access_size = 8,
>>> + }
>>> +};
>>> +
>>> +static void amd_iommu_init(AMDIOMMUState *s)
>>> +{
>>> + printf("amd_iommu_init");
>>
>>
>> you should use the debug macro here
>>
>>> +
>>> + amd_iommu_iotlb_reset(s);
>>> +
>>> + s->iommu_ops.translate = amd_iommu_translate;
>>> +
>>> + s->devtab_len = 0;
>>> + s->cmdbuf_len = 0;
>>> + s->cmdbuf_head = 0;
>>> + s->cmdbuf_tail = 0;
>>> + s->evtlog_head = 0;
>>> + s->evtlog_tail = 0;
>>> + s->excl_enabled = false;
>>> + s->excl_allow = false;
>>> + s->mmio_enabled = false;
>>> + s->enabled = false;
>>> + s->ats_enabled = false;
>>> + s->cmdbuf_enabled = false;
>>> +
>>> + /* reset MMIO */
>>> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
>>> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
>>> + 0xffffffffffffffef, 0);
>>> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
>>> + /* reset device ident */
>>> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
>>> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
>>> + pci_config_set_prog_interface(s->dev.config, 00);
>>> + pci_config_set_class(s->dev.config, 0x0806);
>>> +
>>> + /* reset IOMMU specific capabilities */
>>> + pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
>>> + s->mmio.addr & ~(0xffff0000));
>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
>>> + (s->mmio.addr & ~(0xffff)) >> 16);
>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
>>> + 0xff000000);
>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>>> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
>>
>>
>> All the capabilities are read-write? Otherwise you need to set the wmask
>> to indicate what fields are writable.
>>
>>> +}
>>> +
>>> +static void amd_iommu_reset(DeviceState *dev)
>>> +{
>>> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
>>> +
>>> + amd_iommu_init(s);
>>> +}
>>> +
>>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>>> +{
>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>> +
>>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>>> + amd_iommu_uint64_equal, g_free,
>>> g_free);
>>> +
>>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>>> + IOMMU_CAPAB_SIZE);
>>> +
>>> + /* add msi and hypertransport capabilities */
>>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
>>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
>>> +
>>> + amd_iommu_init(s);
>>> +
>>> + /* set up MMIO */
>>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
>>> + IOMMU_MMIO_SIZE);
>>> +
>>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>>
>>
>> I don't understand why is need here. realize is called only once in the init
>> process
>> and you set it a few lines below.
>>
>>> + return;
>>> + }
>>> +
>>> + s->mmio.addr = IOMMU_BASE_ADDR;
>>> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR,
>>> &s->mmio);
>>> +}
>>> +
>>> +static const VMStateDescription vmstate_amd_iommu = {
>>> + .name = "amd-iommu",
>>> + .fields = (VMStateField[]) {
>>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>>> + VMSTATE_END_OF_LIST()
>>> + }
>>> +};
>>> +
>>> +static Property amd_iommu_properties[] = {
>>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>>> + DEFINE_PROP_END_OF_LIST(),
>>> +};
>>> +
>>> +static void amd_iommu_uninit(PCIDevice *dev)
>>> +{
>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>> + amd_iommu_iotlb_reset(s);
>>
>>
>> at this point you also need to clean also the memory regions you use.
>>
>>> +}
>>> +
>>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>>> +{
>>> + DeviceClass *dc = DEVICE_CLASS(klass);
>>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>>> +
>>> + k->realize = amd_iommu_realize;
>>> + k->exit = amd_iommu_uninit;
>>> +
>>> + dc->reset = amd_iommu_reset;
>>> + dc->vmsd = &vmstate_amd_iommu;
>>> + dc->props = amd_iommu_properties;
>>> +}
>>> +
>>> +static const TypeInfo amd_iommu = {
>>> + .name = TYPE_AMD_IOMMU_DEVICE,
>>> + .parent = TYPE_PCI_DEVICE,
>>> + .instance_size = sizeof(AMDIOMMUState),
>>> + .class_init = amd_iommu_class_init
>>> +};
>>> +
>>> +static void amd_iommu_register_types(void)
>>> +{
>>> + type_register_static(&amd_iommu);
>>> +}
>>> +
>>> +type_init(amd_iommu_register_types);
>>> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
>>> new file mode 100644
>>> index 0000000..7d317e1
>>> --- /dev/null
>>> +++ b/hw/i386/amd_iommu.h
>>> @@ -0,0 +1,395 @@
>>> +/*
>>> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
>>> + *
>>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>>> + *
>>> + * This program is free software; you can redistribute it and/or modify
>>> + * it under the terms of the GNU General Public License as published by
>>> + * the Free Software Foundation; either version 2 of the License, or
>>> + * (at your option) any later version.
>>> +
>>> + * This program is distributed in the hope that it will be useful,
>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>>> + * GNU General Public License for more details.
>>> +
>>> + * You should have received a copy of the GNU General Public License
>>> along
>>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>>> + */
>>> +
>>> +#ifndef AMD_IOMMU_H_
>>> +#define AMD_IOMMU_H_
>>> +
>>> +#include "hw/hw.h"
>>> +#include "hw/pci/pci.h"
>>> +#include "hw/pci/msi.h"
>>> +#include "hw/sysbus.h"
>>> +#include "sysemu/dma.h"
>>> +
>>> +/* Capability registers */
>>> +#define IOMMU_CAPAB_HEADER 0x00
>>> +#define IOMMU_CAPAB_REV_TYPE 0x02
>>> +#define IOMMU_CAPAB_FLAGS 0x03
>>> +#define IOMMU_CAPAB_BAR_LOW 0x04
>>> +#define IOMMU_CAPAB_BAR_HIGH 0x08
>>> +#define IOMMU_CAPAB_RANGE 0x0C
>>> +#define IOMMU_CAPAB_MISC 0x10
>>> +#define IOMMU_CAPAB_MISC1 0x14
>>> +
>>> +#define IOMMU_CAPAB_SIZE 0x18
>>> +#define IOMMU_CAPAB_REG_SIZE 0x04
>>> +
>>> +/* Capability header data */
>>> +#define IOMMU_CAPAB_ID_SEC 0xf
>>> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
>>> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
>>> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
>>> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
>>> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
>>> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
>>> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
>>> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV |
>>> IOMMU_CAPAB_TYPE)
>>> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
>>> + IOMMU_CAPAB_FLAG_HTTUNNEL)
>>> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
>>> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
>>> +
>>> +/* MMIO registers */
>>> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
>>> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
>>> +#define IOMMU_MMIO_EVENT_BASE 0x0010
>>> +#define IOMMU_MMIO_CONTROL 0x0018
>>> +#define IOMMU_MMIO_EXCL_BASE 0x0020
>>> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
>>> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
>>> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
>>> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
>>> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
>>> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
>>> +#define IOMMU_MMIO_STATUS 0x2020
>>> +#define IOMMU_MMIO_PPR_BASE 0x0038
>>> +#define IOMMU_MMIO_PPR_HEAD 0x2030
>>> +#define IOMMU_MMIO_PPR_TAIL 0x2038
>>> +
>>> +#define IOMMU_MMIO_SIZE 0x4000
>>> +
>>> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
>>> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
>>> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
>>> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
>>> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
>>> +
>>> +/* some of this are similar but just for readability */
>>> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
>>> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
>>> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
>>> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>> +
>>> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
>>> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
>>> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
>>> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>> +
>>> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
>>> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
>>> +
>>> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
>>> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
>>> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
>>> +
>>> +/* mmio control register flags */
>>> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
>>> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
>>> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
>>> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
>>> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
>>> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
>>> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
>>> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
>>> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
>>> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
>>> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
>>> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
>>> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
>>> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
>>> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
>>> +
>>> +/* MMIO status register bits */
>>> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
>>> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
>>> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
>>> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
>>> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
>>> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
>>> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
>>> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
>>> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
>>> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
>>> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
>>> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
>>> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
>>> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
>>> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
>>> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
>>> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
>>> +
>>> +#define IOMMU_CMDBUF_ID_BYTE 0x07
>>> +#define IOMMU_CMDBUF_ID_RSHIFT 4
>>> +
>>> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
>>> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
>>> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
>>> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
>>> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
>>> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
>>> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
>>> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
>>> +
>>> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
>>> +
>>> +/* Device table entry bits 0:63 */
>>> +#define IOMMU_DEV_VALID (1ULL << 0)
>>> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
>>> +#define IOMMU_DEV_MODE_MASK 0x7
>>> +#define IOMMU_DEV_MODE_RSHIFT 9
>>> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
>>> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
>>> +#define IOMMU_DEV_PERM_SHIFT 61
>>> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
>>> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
>>> +
>>> +/* Device table entry bits 64:127 */
>>> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
>>> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
>>> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
>>> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
>>> +#define IOMMU_DEV_IOCTL_MASK (~3)
>>> +#define IOMMU_DEV_IOCTL_RSHIFT 20
>>> +#define IOMMU_DEV_IOCTL_DENY 0
>>> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
>>> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
>>> +#define IOMMU_DEV_CACHE (1ULL << 37)
>>> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
>>> +#define IOMMU_DEV_EXCL (1ULL << 39)
>>> +
>>> +/* Event codes and flags, as stored in the info field */
>>> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
>>> +#define IOMMU_EVENT_IOPF (0x2U << 12)
>>> +#define IOMMU_EVENT_IOPF_I (1U << 3)
>>> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
>>> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
>>> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
>>> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
>>> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
>>> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
>>> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
>>> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
>>> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
>>> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
>>> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
>>> +
>>> +#define IOMMU_EVENT_LEN 16
>>> +#define IOMMU_PERM_READ (1 << 0)
>>> +#define IOMMU_PERM_WRITE (1 << 1)
>>> +#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
>>> +
>>> +/* AMD RD890 Chipset */
>>> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
>>
>>
>> We keep the pci ids in include/hw/pci/pci_ids.h
This a dummy device id I use for IOMMU - IOMMU doesn't have a specific
device id. There's a device id on linux include files for a certain
AMD IOMMU but it makes IOMMU seem to be on a non-existant bus so I
don't use it.
>>
>>> +
>>> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
>>> +#define IOMMU_FEATURE_PPR (1ULL << 1)
>>> +#define IOMMU_FEATURE_NX (1ULL << 3)
>>> +#define IOMMU_FEATURE_GT (1ULL << 4)
>>> +#define IOMMU_FEATURE_IA (1ULL << 6)
>>> +#define IOMMU_FEATURE_GA (1ULL << 7)
>>> +#define IOMMU_FEATURE_HE (1ULL << 8)
>>> +#define IOMMU_FEATURE_PC (1ULL << 9)
>>> +
>>> +/* reserved DTE bits */
>>> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
>>> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
>>> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
>>> +
>>> +/* IOMMU paging mode */
>>> +#define IOMMU_GATS_MODE (6ULL << 12)
>>> +#define IOMMU_HATS_MODE (6ULL << 10)
>>> +
>>> +/* PCI SIG constants */
>>> +#define PCI_BUS_MAX 256
>>> +#define PCI_SLOT_MAX 32
>>> +#define PCI_FUNC_MAX 8
>>> +#define PCI_DEVFN_MAX 256
>>
>>
>> Maybe we can move the PCI macros to include/hw/pci/pci.h, those are not
>> IOMMU specific.
Yeah, this are PCI macros but they are a not copied from linux while
the macros in pci.h seem to have been copied from linux.
>>
>>> +
>>> +/* IOTLB */
>>> +#define IOMMU_IOTLB_MAX_SIZE 1024
>>> +#define IOMMU_DEVID_SHIFT 36
>>> +
>>> +/* extended feature support */
>>> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR |
>>> \
>>> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
>>> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
>>> + IOMMU_HATS_MODE)
>>> +
>>> +/* capabilities header */
>>> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
>>> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
>>> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
>>> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
>>> +
>>> +/* command constants */
>>> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
>>> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
>>> +#define IOMMU_COM_COMPLETION_INTR 0x2
>>> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
>>> +#define IOMMU_COMMAND_SIZE 0x10
>>> +
>>> +/* IOMMU default address */
>>> +#define IOMMU_BASE_ADDR 0xfed80000
>>> +
>>> +/* page management constants */
>>> +#define IOMMU_PAGE_SHIFT 12
>>> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
>>> +
>>> +#define IOMMU_PAGE_SHIFT_4K 12
>>> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
>>> +#define IOMMU_PAGE_SHIFT_2M 21
>>> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
>>> +#define IOMMU_PAGE_SHIFT_1G 30
>>> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
>>> +
>>> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
>>> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
>>> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
>>> +
>>> +/* invalidation command device id */
>>> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
>>> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) -
>>> 1))
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-03-02 4:00 ` David Kiarie
@ 2016-03-02 4:08 ` David Kiarie
2016-03-03 9:40 ` Marcel Apfelbaum
2016-03-03 9:34 ` Marcel Apfelbaum
1 sibling, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-02 4:08 UTC (permalink / raw)
To: Marcel Apfelbaum
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers, Michael S. Tsirkin
On Wed, Mar 2, 2016 at 7:00 AM, David Kiarie <davidkiarie4@gmail.com> wrote:
> On Fri, Feb 26, 2016 at 9:23 AM, David Kiarie <davidkiarie4@gmail.com> wrote:
>> On Thu, Feb 25, 2016 at 6:43 PM, Marcel Apfelbaum <marcel@redhat.com> wrote:
>>> On 02/21/2016 08:10 PM, David Kiarie wrote:
>>>>
>>>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>>>> The IOMMU does basic translation, error checking and has a
>>>> mininal IOTLB implementation
>>>
>>>
>>> Hi,
>>>
>>>>
>>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>>> ---
>>>> hw/i386/Makefile.objs | 1 +
>>>> hw/i386/amd_iommu.c | 1432
>>>> +++++++++++++++++++++++++++++++++++++++++++++++++
>>>> hw/i386/amd_iommu.h | 395 ++++++++++++++
>>>> include/hw/pci/pci.h | 2 +
>>>> 4 files changed, 1830 insertions(+)
>>>> create mode 100644 hw/i386/amd_iommu.c
>>>> create mode 100644 hw/i386/amd_iommu.h
>>>>
>>>> diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
>>>> index b52d5b8..2f1a265 100644
>>>> --- a/hw/i386/Makefile.objs
>>>> +++ b/hw/i386/Makefile.objs
>>>> @@ -3,6 +3,7 @@ obj-y += multiboot.o
>>>> obj-y += pc.o pc_piix.o pc_q35.o
>>>> obj-y += pc_sysfw.o
>>>> obj-y += intel_iommu.o
>>>> +obj-y += amd_iommu.o
>>>> obj-$(CONFIG_XEN) += ../xenpv/ xen/
>>>>
>>>> obj-y += kvmvapic.o
>>>> diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
>>>> new file mode 100644
>>>> index 0000000..3dac043
>>>> --- /dev/null
>>>> +++ b/hw/i386/amd_iommu.c
>>>> @@ -0,0 +1,1432 @@
>>>> +/*
>>>> + * QEMU emulation of AMD IOMMU (AMD-Vi)
>>>> + *
>>>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>>>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>>>> + *
>>>> + * This program is free software; you can redistribute it and/or modify
>>>> + * it under the terms of the GNU General Public License as published by
>>>> + * the Free Software Foundation; either version 2 of the License, or
>>>> + * (at your option) any later version.
>>>> +
>>>> + * This program is distributed in the hope that it will be useful,
>>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>>>> + * GNU General Public License for more details.
>>>> +
>>>> + * You should have received a copy of the GNU General Public License
>>>> along
>>>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>>>> + *
>>>> + * Cache implementation inspired by hw/i386/intel_iommu.c
>>>> + *
>>>> + */
>>>> +#include "hw/i386/amd_iommu.h"
>>>> +
>>>> +/*#define DEBUG_AMD_IOMMU*/
>>>> +#ifdef DEBUG_AMD_IOMMU
>>>> +enum {
>>>> + DEBUG_GENERAL, DEBUG_CAPAB, DEBUG_MMIO, DEBUG_ELOG,
>>>> + DEBUG_CACHE, DEBUG_COMMAND, DEBUG_MMU
>>>> +};
>>>> +
>>>> +#define IOMMU_DBGBIT(x) (1 << DEBUG_##x)
>>>> +static int iommu_dbgflags = IOMMU_DBGBIT(MMIO);
>>>> +
>>>> +#define IOMMU_DPRINTF(what, fmt, ...) do { \
>>>> + if (iommu_dbgflags & IOMMU_DBGBIT(what)) { \
>>>> + fprintf(stderr, "(amd-iommu)%s: " fmt "\n", __func__, \
>>>> + ## __VA_ARGS__); } \
>>>> + } while (0)
>>>> +#else
>>>> +#define IOMMU_DPRINTF(what, fmt, ...) do {} while (0)
>>>> +#endif
>>>> +
>>>> +typedef struct AMDIOMMUAddressSpace {
>>>> + uint8_t bus_num; /* bus number
>>>> */
>>>> + uint8_t devfn; /* device function
>>>> */
>>>> + AMDIOMMUState *iommu_state; /* IOMMU - one per machine
>>>> */
>>>> + MemoryRegion iommu; /* Device's iommu region
>>>> */
>>>> + AddressSpace as; /* device's corresponding address space
>>>> */
>>>> +} AMDIOMMUAddressSpace;
>>>> +
>>>> +/* IOMMU cache entry */
>>>> +typedef struct IOMMUIOTLBEntry {
>>>> + uint64_t gfn;
>>>> + uint16_t domid;
>>>> + uint64_t devid;
>>>> + uint64_t perms;
>>>> + uint64_t translated_addr;
>>>> +} IOMMUIOTLBEntry;
>>>> +
>>>> +/* configure MMIO registers at startup/reset */
>>>> +static void amd_iommu_set_quad(AMDIOMMUState *s, hwaddr addr, uint64_t
>>>> val,
>>>> + uint64_t romask, uint64_t w1cmask)
>>>> +{
>>>> + stq_le_p(&s->mmior[addr], val);
>>>> + stq_le_p(&s->romask[addr], romask);
>>>> + stq_le_p(&s->w1cmask[addr], w1cmask);
>>>> +}
>>>> +
>>>> +static uint16_t amd_iommu_readw(AMDIOMMUState *s, hwaddr addr)
>>>> +{
>>>> + return lduw_le_p(&s->mmior[addr]);
>>>> +}
>>>> +
>>>> +static uint32_t amd_iommu_readl(AMDIOMMUState *s, hwaddr addr)
>>>> +{
>>>> + return ldl_le_p(&s->mmior[addr]);
>>>> +}
>>>> +
>>>> +static uint64_t amd_iommu_readq(AMDIOMMUState *s, hwaddr addr)
>>>> +{
>>>> + return ldq_le_p(&s->mmior[addr]);
>>>> +}
>>>> +
>>>> +/* internal write */
>>>> +static void amd_iommu_writeq_raw(AMDIOMMUState *s, uint64_t val, hwaddr
>>>> addr)
>>>> +{
>>>> + stq_le_p(&s->mmior[addr], val);
>>>> +}
>>>> +
>>>> +/* external write */
>>>> +static void amd_iommu_writew(AMDIOMMUState *s, hwaddr addr, uint16_t val)
>>>> +{
>>>> + uint16_t romask = lduw_le_p(&s->romask[addr]);
>>>> + uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
>>>> + uint16_t oldval = lduw_le_p(&s->mmior[addr]);
>>>> + stw_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>>>> oldval));
>>>> +}
>>>> +
>>>> +static void amd_iommu_writel(AMDIOMMUState *s, hwaddr addr, uint32_t val)
>>>> +{
>>>> + uint32_t romask = ldl_le_p(&s->romask[addr]);
>>>> + uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
>>>> + uint32_t oldval = ldl_le_p(&s->mmior[addr]);
>>>> + stl_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>>>> oldval));
>>>> +}
>>>> +
>>>> +static void amd_iommu_writeq(AMDIOMMUState *s, hwaddr addr, uint64_t val)
>>>> +{
>>>> + uint64_t romask = ldq_le_p(&s->romask[addr]);
>>>> + uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
>>>> + uint32_t oldval = ldq_le_p(&s->mmior[addr]);
>>>> + stq_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>>>> oldval));
>>>> +}
>>>> +
>>>> +static void amd_iommu_log_event(AMDIOMMUState *s, uint16_t *evt)
>>>> +{
>>>> + /* event logging not enabled */
>>>> + if (!s->evtlog_enabled || *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |
>>>> + IOMMU_MMIO_STATUS_EVT_OVF) {
>>>> + return;
>>>> + }
>>>> +
>>>> + /* event log buffer full */
>>>> + if (s->evtlog_tail >= s->evtlog_len) {
>>>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>>>> IOMMU_MMIO_STATUS_EVT_OVF;
>>>> + /* generate interrupt */
>>>> + msi_notify(&s->dev, 0);
>>>> + }
>>>> +
>>>> + if (dma_memory_write(&address_space_memory, s->evtlog_len +
>>>> s->evtlog_tail,
>>>> + &evt, IOMMU_EVENT_LEN)) {
>>>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address 0x%"PRIx64
>>>> + " + offset 0x%"PRIx32, s->evtlog, s->evtlog_tail);
>>>> + }
>>>> +
>>>> + s->evtlog_tail += IOMMU_EVENT_LEN;
>>>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>>>> IOMMU_MMIO_STATUS_COMP_INT;
>>>> +}
>>>> +
>>>> +/* log an error encountered page-walking
>>>> + *
>>>> + * @addr: virtual address in translation request
>>>> + */
>>>> +static void amd_iommu_page_fault(AMDIOMMUState *s, uint16_t devid,
>>>> + dma_addr_t addr, uint16_t info)
>>>> +{
>>>> + IOMMU_DPRINTF(ELOG, "");
>>>> +
>>>> + uint16_t evt[8];
>>>> +
>>>> + info |= IOMMU_EVENT_IOPF_I;
>>>> +
>>>> + /* encode information */
>>>> + *(uint16_t *)&evt[0] = devid;
>>>> + *(uint16_t *)&evt[3] = info;
>>>> + *(uint64_t *)&evt[4] = cpu_to_le64(addr);
>>>> +
>>>> + /* log a page fault */
>>>> + amd_iommu_log_event(s, evt);
>>>> +
>>>> + /* Abort the translation */
>>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>>> +}
>>>> +/*
>>>> + * log a master abort accessing device table
>>>> + * @devtab : address of device table entry
>>>> + * @info : error flags
>>>> + */
>>>> +static void amd_iommu_log_devtab_error(AMDIOMMUState *s, uint16_t devid,
>>>> + dma_addr_t devtab, uint16_t info)
>>>> +{
>>>> +
>>>> + IOMMU_DPRINTF(ELOG, "");
>>>> +
>>>> + uint16_t evt[8];
>>>> +
>>>> + info |= IOMMU_EVENT_DEV_TAB_HW_ERROR;
>>>> +
>>>> + /* encode information */
>>>> + *(uint16_t *)&evt[0] = devid;
>>>> + *(uint8_t *)&evt[3] = info;
>>>> + *(uint64_t *)&evt[4] = cpu_to_le64(devtab);
>>>> +
>>>> + amd_iommu_log_event(s, evt);
>>>> +
>>>> + /* Abort the translation */
>>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>>> +
>>>> +}
>>>> +
>>>> +/* log a master abort encountered during a page-walk
>>>> + * @addr : address that couldn't be accessed
>>>> + */
>>>> +static void amd_iommu_log_pagetab_error(AMDIOMMUState *s, uint16_t devid,
>>>> + dma_addr_t addr, uint16_t info)
>>>> +{
>>>> + IOMMU_DPRINTF(ELOG, "");
>>>> +
>>>> + uint16_t evt[8];
>>>> +
>>>> + info |= IOMMU_EVENT_PAGE_TAB_HW_ERROR;
>>>> +
>>>> + /* encode information */
>>>> + *(uint16_t *)&evt[0] = devid;
>>>> + *(uint8_t *)&evt[3] = info;
>>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>>> +
>>>> + amd_iommu_log_event(s, evt);
>>>> +
>>>> + /* Abort the translation */
>>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>>> +
>>>> +}
>>>> +
>>>> +/* log an event trying to access command buffer
>>>> + * @addr : address that couldn't be accessed
>>>> + */
>>>> +static void amd_iommu_log_command_error(AMDIOMMUState *s, dma_addr_t
>>>> addr)
>>>> +{
>>>> + IOMMU_DPRINTF(ELOG, "");
>>>> +
>>>> + uint16_t evt[8];
>>>> +
>>>> + /* encode information */
>>>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_COMMAND_HW_ERROR;
>>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>>> +
>>>> + amd_iommu_log_event(s, evt);
>>>> +
>>>> + /* Abort the translation */
>>>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>>>> + PCI_STATUS_SIG_TARGET_ABORT);
>>>> +}
>>>> +
>>>> +/* log an illegal comand event
>>>> + * @addr : address of illegal command
>>>> + */
>>>> +static void amd_iommu_log_illegalcom_error(AMDIOMMUState *s, uint16_t
>>>> info,
>>>> + dma_addr_t addr)
>>>> +{
>>>> + IOMMU_DPRINTF(ELOG, "");
>>>> +
>>>> + uint16_t evt[8];
>>>> +
>>>> + /* encode information */
>>>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_ILLEGAL_COMMAND_ERROR;
>>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>>
>>>
>>> Can you please use a macro instead of 3 literal?
>>>
>>>> +
>>>> + amd_iommu_log_event(s, evt);
>>>> +}
>>>> +
>>>> +/* log an error accessing device table
>>>> + *
>>>> + * @devid : device owning the table entry
>>>> + * @devtab : address of device table entry
>>>> + * @info : error flags
>>>> + */
>>>> +static void amd_iommu_log_illegaldevtab_error(AMDIOMMUState *s, uint16_t
>>>> devid,
>>>> + dma_addr_t addr, uint16_t
>>>> info)
>>>> +{
>>>> + IOMMU_DPRINTF(ELOG, "");
>>>> +
>>>> + uint16_t evt[8];
>>>> +
>>>> + info |= IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY;
>>>> +
>>>> + *(uint16_t *)&evt[0] = devid;
>>>> + *(uint8_t *)&evt[3] = info;
>>>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>>>> +
>>>> + amd_iommu_log_event(s, evt);
>>>> +}
>>>
>>>
>>> It seems that the all log functions do the same:
>>> create an event, log it and optionally set PCI_STATUS_SIG_TARGET_ABORT
>>>
>>> I would consider to unite them in the same function. (not a must)
>
> I would prefer to leave the event code as separate but I could
> probably add a macro. Currently we are logging just a lot less
> information that we should be logging and with the logging of more
> information it could become a bit ugly.
>
>>>
>>>> +
>>>> +static gboolean amd_iommu_uint64_equal(gconstpointer v1, gconstpointer
>>>> v2)
>>>> +{
>>>> + return *((const uint64_t *)v1) == *((const uint64_t *)v2);
>>>> +}
>>>> +
>>>> +static guint amd_iommu_uint64_hash(gconstpointer v)
>>>> +{
>>>> + return (guint)*(const uint64_t *)v;
>>>> +}
>>>> +
>>>> +static IOMMUIOTLBEntry *amd_iommu_iotlb_lookup(AMDIOMMUState *s, hwaddr
>>>> addr,
>>>> + uint64_t devid)
>>>> +{
>>>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>>>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>>>> + return g_hash_table_lookup(s->iotlb, &key);
>>>> +}
>>>> +
>>>> +static void amd_iommu_iotlb_reset(AMDIOMMUState *s)
>>>> +{
>>>> + assert(s->iotlb);
>>>> + g_hash_table_remove_all(s->iotlb);
>>>> +}
>>>> +
>>>> +static gboolean amd_iommu_iotlb_remove_by_devid(gpointer key, gpointer
>>>> value,
>>>> + gpointer user_data)
>>>> +{
>>>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>>>> + uint16_t devid = *(uint16_t *)user_data;
>>>> + return entry->devid == devid;
>>>> +}
>>>> +
>>>> +static void amd_iommu_iotlb_remove_page(AMDIOMMUState *s, hwaddr addr,
>>>> + uint64_t devid)
>>>> +{
>>>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>>>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>>>> + g_hash_table_remove(s->iotlb, &key);
>>>> +}
>>>> +
>>>> +/* extract device id */
>>>> +static inline uint16_t devid_extract(uint8_t *cmd)
>>>> +{
>>>> + return (uint16_t)cmd[2] & IOMMU_INVAL_DEV_ID_MASK;
>>>> +}
>>>> +
>>>> +static void amd_iommu_invalidate_iotlb(AMDIOMMUState *s, uint64_t *cmd)
>>>> +{
>>>> + uint16_t devid = devid_extract((uint8_t *)cmd);
>>>> + /* if invalidation of more than one page requested */
>>>> + if (IOMMU_INVAL_ALL(cmd[0])) {
>>>> + g_hash_table_foreach_remove(s->iotlb,
>>>> amd_iommu_iotlb_remove_by_devid,
>>>> + &devid);
>>>> + } else {
>>>> + hwaddr addr = (hwaddr)(cmd[1] & IOMMU_INVAL_ADDR_MASK);
>>>> + amd_iommu_iotlb_remove_page(s, addr, devid);
>>>> + }
>>>> +}
>>>> +
>>>> +static void amd_iommu_update_iotlb(AMDIOMMUState *s, uint16_t devid,
>>>> + uint64_t gpa, uint64_t spa, uint64_t
>>>> perms,
>>>> + uint16_t domid)
>>>> +{
>>>> + IOMMUIOTLBEntry *entry = g_malloc(sizeof(*entry));
>>>> + uint64_t *key = g_malloc(sizeof(key));
>>>> + uint64_t gfn = gpa >> IOMMU_PAGE_SHIFT_4K;
>>>> +
>>>> + IOMMU_DPRINTF(CACHE, " update iotlb devid: %02x:%02x.%x gpa
>>>> 0x%"PRIx64
>>>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid), PCI_SLOT(devid),
>>>> + PCI_FUNC(devid), gpa, spa);
>>>> +
>>>> + if (g_hash_table_size(s->iotlb) >= IOMMU_IOTLB_MAX_SIZE) {
>>>> + IOMMU_DPRINTF(CACHE, "iotlb exceeds size limit - reset");
>>>> + amd_iommu_iotlb_reset(s);
>>>> + }
>>>> +
>>>> + entry->gfn = gfn;
>>>> + entry->domid = domid;
>>>> + entry->perms = perms;
>>>> + entry->translated_addr = spa;
>>>> + *key = gfn | ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>>>> + g_hash_table_replace(s->iotlb, key, entry);
>>>> +}
>>>> +
>>>> +/* execute a completion wait command */
>>>> +static void amd_iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> + unsigned int addr;
>>>> +
>>>> + /* completion store */
>>>> + if (cmd[0] & IOMMU_COM_COMPLETION_STORE_MASK) {
>>>> + addr = le64_to_cpu(*(uint64_t *)cmd) &
>>>> IOMMU_COM_STORE_ADDRESS_MASK;
>>>> + if (dma_memory_write(&address_space_memory, addr, cmd + 8, 8)) {
>>>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address
>>>> 0%x"PRIx64,
>>>> + addr);
>>>> + }
>>>> + }
>>>> +
>>>> + /* set completion interrupt */
>>>> + if (cmd[0] & IOMMU_COM_COMPLETION_INTR) {
>>>> + s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
>>>> + }
>>>> +}
>>>> +
>>>> +/* get command type */
>>>> +static uint8_t opcode(uint8_t *cmd)
>>>> +{
>>>> + return cmd[IOMMU_CMDBUF_ID_BYTE] >> IOMMU_CMDBUF_ID_RSHIFT;
>>>> +}
>>>> +
>>>> +/* linux seems to be using reserved bits so I just log without abortig
>>>> bug */
>>>
>>>
>>> I couldn't quite understand the comment
>>>
>>>> +static void iommu_inval_devtab_entry(AMDIOMMUState *s, uint8_t *cmd,
>>>> + uint8_t type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + /* This command should invalidate internal caches of which there
>>>> isn't */
>>>> + if (*(uint64_t *)&cmd[0] & IOMMU_CMD_INVAL_DEV_RSVD ||
>>>> + *(uint64_t *)&cmd[1]) {
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + }
>>>> +#ifdef DEBUG_AMD_IOMMU
>>>> + uint16_t devid = devid_extract(cmd);
>>>> +#endif
>>>> + IOMMU_DPRINTF(COMMAND, "device table entry for devid: %02x:%02x.%x"
>>>> + "invalidated", PCI_BUS_NUM(devid), PCI_SLOT(devid),
>>>> + PCI_FUNC(devid));
>>>> +}
>>>> +
>>>> +static void iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>>> type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + if (*(uint32_t *)&cmd[1] & IOMMU_COMPLETION_WAIT_RSVD) {
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + }
>>>> + /* pretend to wait for command execution to complete */
>>>> + IOMMU_DPRINTF(COMMAND, "completion wait requested with store address
>>>> 0x%"
>>>> + PRIx64 " and store data 0x%"PRIx64, (cmd[0] &
>>>> + IOMMU_COM_STORE_ADDRESS_MASK), *(uint64_t *)(cmd + 8));
>>>> + amd_iommu_completion_wait(s, cmd);
>>>> +}
>>>> +
>>>> +static void iommu_complete_ppr(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>>> type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_COMPLETE_PPR_RQ_RSVD) ||
>>>> + *(uint64_t *)&cmd[1] & 0xffff000000000000) {
>>>
>>>
>>>
>>> Can you please document this mask?
>>>
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + }
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "Execution of PPR queue requested");
>>>> +}
>>>> +
>>>> +static void iommu_inval_all(AMDIOMMUState *s, uint8_t *cmd, uint8_t type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_ALL_RSVD) ||
>>>> + *(uint64_t *)&cmd[1]) {
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + }
>>>> +
>>>> + amd_iommu_iotlb_reset(s);
>>>> + IOMMU_DPRINTF(COMMAND, "Invalidation of all IOMMU cache requested");
>>>> +}
>>>> +
>>>> +static inline uint16_t domid_extract(uint64_t *cmd)
>>>> +{
>>>> + return (uint16_t)cmd[0] & IOMMU_INVAL_PAGES_DOMID;
>>>> +}
>>>> +
>>>> +static gboolean amd_iommu_iotlb_remove_by_domid(gpointer key, gpointer
>>>> value,
>>>> + gpointer user_data)
>>>> +{
>>>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>>>> + uint16_t domid = *(uint16_t *)user_data;
>>>> + return entry->domid == domid;
>>>> +}
>>>> +
>>>> +/* we don't have devid - we can't remove pages by address */
>>>> +static void iommu_inval_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>>> type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> + uint16_t domid = domid_extract((uint64_t *)cmd);
>>>> +
>>>> + if (*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_PAGES_RSVD ||
>>>> + *(uint32_t *)&cmd[1] & 0x00000ff0) {
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + }
>>>> +
>>>> + g_hash_table_foreach_remove(s->iotlb,
>>>> amd_iommu_iotlb_remove_by_domid,
>>>> + &domid);
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "IOMMU pages for domain 0x%"PRIx16
>>>> "invalidated",
>>>> + domid);
>>>> +}
>>>> +
>>>> +static void iommu_prefetch_pages(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>>> type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_PRF_IOMMU_PAGES_RSVD) ||
>>>> + (*(uint32_t *)&cmd[1] & 0x00000fd4)) {
>>>
>>>
>>> Here the same, maybe you can name the mask, so we can easier follow the
>>> spec.
>>>
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + }
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "Pre-fetch of IOMMU pages requested");
>>>> +}
>>>> +
>>>> +static void iommu_inval_inttable(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>>> type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_INTR_TABLE_RSVD) ||
>>>> + *(uint64_t *)&cmd[1]) {
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + return;
>>>> + }
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "interrupt table invalidated");
>>>> +}
>>>> +
>>>> +static void iommu_inval_iotlb(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>>>> type)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + if (*(uint32_t *)&cmd[2] & IOMMU_INVAL_IOTLB_PAGES_RSVD) {
>>>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>>>> s->cmdbuf_head);
>>>> + return;
>>>> + }
>>>> +
>>>> + amd_iommu_invalidate_iotlb(s, (uint64_t *)cmd);
>>>> + IOMMU_DPRINTF(COMMAND, "IOTLB pages invalidated");
>>>> +}
>>>> +
>>>> +/* not honouring reserved bits is regarded as an illegal command */
>>>> +static void amd_iommu_cmdbuf_exec(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint8_t type;
>>>> + uint8_t cmd[IOMMU_COMMAND_SIZE];
>>>> +
>>>> + memset(cmd, 0, IOMMU_COMMAND_SIZE);
>>>> +
>>>> + if (dma_memory_read(&address_space_memory, s->cmdbuf +
>>>> s->cmdbuf_head, cmd,
>>>> + IOMMU_COMMAND_SIZE)) {
>>>> + IOMMU_DPRINTF(COMMAND, "error: fail to access memory at
>>>> 0x%"PRIx64
>>>> + " + 0x%"PRIu8, s->cmdbuf, s->cmdbuf_head);
>>>> + amd_iommu_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
>>>> + return;
>>>> + }
>>>> +
>>>> + type = opcode(cmd);
>>>> +
>>>> + switch (type) {
>>>> + case IOMMU_CMD_COMPLETION_WAIT:
>>>> + iommu_completion_wait(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_INVAL_DEVTAB_ENTRY:
>>>> + iommu_inval_devtab_entry(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_INVAL_IOMMU_PAGES:
>>>> + iommu_inval_pages(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_INVAL_IOTLB_PAGES:
>>>> + iommu_inval_iotlb(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_INVAL_INTR_TABLE:
>>>> + iommu_inval_inttable(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_PREFETCH_IOMMU_PAGES:
>>>> + iommu_prefetch_pages(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_COMPLETE_PPR_REQUEST:
>>>> + iommu_complete_ppr(s, cmd, type);
>>>> + break;
>>>> +
>>>> + case IOMMU_CMD_INVAL_IOMMU_ALL:
>>>> + iommu_inval_all(s, cmd, type);
>>>> + break;
>>>> +
>>>> + default:
>>>> + IOMMU_DPRINTF(COMMAND, "unhandled command %d", type);
>>>> + /* log illegal command */
>>>> + amd_iommu_log_illegalcom_error(s, type,
>>>> + s->cmdbuf + s->cmdbuf_head);
>>>> + break;
>>>> + }
>>>> +
>>>> +}
>>>> +
>>>> +static void amd_iommu_cmdbuf_run(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t *mmio_cmdbuf_head = (uint64_t *)(s->mmior +
>>>> + IOMMU_MMIO_COMMAND_HEAD);
>>>> +
>>>> + if (!s->cmdbuf_enabled) {
>>>> + IOMMU_DPRINTF(COMMAND, "error: IOMMU trying to execute commands
>>>> with "
>>>> + "command buffer disabled. IOMMU control value
>>>> 0x%"PRIx64,
>>>> + amd_iommu_readq(s, IOMMU_MMIO_CONTROL));
>>>> + return;
>>>> + }
>>>> +
>>>> + while (s->cmdbuf_head != s->cmdbuf_tail) {
>>>> + /* check if there is work to do. */
>>>> + IOMMU_DPRINTF(COMMAND, "command buffer head at 0x%"PRIx32 "
>>>> command "
>>>> + "buffer tail at 0x%"PRIx32" command buffer base at
>>>> 0x%"
>>>> + PRIx64, s->cmdbuf_head, s->cmdbuf_tail, s->cmdbuf);
>>>> + amd_iommu_cmdbuf_exec(s);
>>>> + s->cmdbuf_head += IOMMU_COMMAND_SIZE;
>>>> + amd_iommu_writeq_raw(s, s->cmdbuf_head,
>>>> IOMMU_MMIO_COMMAND_HEAD);
>>>> +
>>>> + /* wrap head pointer */
>>>> + if (s->cmdbuf_head >= s->cmdbuf_len * IOMMU_COMMAND_SIZE) {
>>>> + s->cmdbuf_head = 0;
>>>> + }
>>>> + }
>>>> +
>>>> + *mmio_cmdbuf_head = cpu_to_le64(s->cmdbuf_head);
>>>> +}
>>>> +
>>>> +/* System Software might never read from some of this fields but anyways
>>>> */
>>>> +static uint64_t amd_iommu_mmio_read(void *opaque, hwaddr addr, unsigned
>>>> size)
>>>> +{
>>>> + AMDIOMMUState *s = opaque;
>>>> +
>>>> + uint64_t val = -1;
>>>
>>>
>>> The above might work, but it looks a little weird
>>>
>>>> + if (addr + size > IOMMU_MMIO_SIZE) {
>>>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIX64
>>>> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE,
>>>> addr,
>>>> + size);
>>>> + return (uint64_t)-1;
>>>> + }
>>>> +
>>>> + if (size == 2) {
>>>> + val = amd_iommu_readw(s, addr);
>>>> + } else if (size == 4) {
>>>> + val = amd_iommu_readl(s, addr);
>>>> + } else if (size == 8) {
>>>> + val = amd_iommu_readq(s, addr);
>>>> + }
>>>> +
>>>> + switch (addr & ~0x07) {
>>>> + case IOMMU_MMIO_DEVICE_TABLE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_COMMAND_BASE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_BASE read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EVENT_BASE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_CONTROL:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_CONTROL read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EXCL_BASE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_BASE read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EXCL_LIMIT:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_COMMAND_HEAD:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_COMMAND_TAIL:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_TAIL read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EVENT_HEAD:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EVENT_TAIL:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_STATUS:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_STATUS read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EXT_FEATURES:
>>>> + IOMMU_DPRINTF(MMU, "MMIO_EXT_FEATURES read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64 "value 0x%"PRIx64,
>>>> + addr, size, addr & ~0x07, val);
>>>> + break;
>>>> +
>>>> + default:
>>>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO read addr 0x%"PRIx64
>>>> + ", size %d offset 0x%"PRIx64, addr, size,
>>>> + addr & ~0x07);
>>>> + }
>>>> + return val;
>>>> +}
>>>> +
>>>> +static void iommu_handle_control_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> + /*
>>>> + * read whatever is already written in case
>>>> + * software is writing in chucks less than 8 bytes
>>>> + */
>>>> + unsigned long control = amd_iommu_readq(s, IOMMU_MMIO_CONTROL);
>>>> + s->enabled = !!(control & IOMMU_MMIO_CONTROL_IOMMUEN);
>>>> +
>>>> + s->ats_enabled = !!(control & IOMMU_MMIO_CONTROL_HTTUNEN);
>>>> + s->evtlog_enabled = s->enabled && !!(control &
>>>> + IOMMU_MMIO_CONTROL_EVENTLOGEN);
>>>> +
>>>> + s->evtlog_intr = !!(control & IOMMU_MMIO_CONTROL_EVENTINTEN);
>>>> + s->completion_wait_intr = !!(control &
>>>> IOMMU_MMIO_CONTROL_COMWAITINTEN);
>>>> + s->cmdbuf_enabled = s->enabled && !!(control &
>>>> + IOMMU_MMIO_CONTROL_CMDBUFLEN);
>>>> +
>>>> + /* update the flags depending on the control register */
>>>> + if (s->cmdbuf_enabled) {
>>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>>>> + IOMMU_MMIO_STATUS_CMDBUF_RUN;
>>>> + } else {
>>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>>>> + ~IOMMU_MMIO_STATUS_CMDBUF_RUN;
>>>> + }
>>>> + if (s->evtlog_enabled) {
>>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>>>> + IOMMU_MMIO_STATUS_EVT_RUN;
>>>> + } else {
>>>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>>>> + ~IOMMU_MMIO_STATUS_EVT_RUN;
>>>> + }
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "MMIO_STATUS state 0x%"PRIx64, control);
>>>> +
>>>> + amd_iommu_cmdbuf_run(s);
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_devtab_write(AMDIOMMUState *s)
>>>> +
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_DEVICE_TABLE);
>>>> + s->devtab = (dma_addr_t)(val & IOMMU_MMIO_DEVTAB_BASE_MASK);
>>>> +
>>>> + /* set device table length */
>>>> + s->devtab_len = ((val & IOMMU_MMIO_DEVTAB_SIZE_MASK) + 1 *
>>>> + (IOMMU_MMIO_DEVTAB_SIZE_UNIT /
>>>> + IOMMU_MMIO_DEVTAB_ENTRY_SIZE));
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_cmdhead_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + s->cmdbuf_head = (dma_addr_t)amd_iommu_readq(s,
>>>> IOMMU_MMIO_COMMAND_HEAD)
>>>> + & IOMMU_MMIO_CMDBUF_HEAD_MASK;
>>>> + amd_iommu_cmdbuf_run(s);
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_cmdbase_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + s->cmdbuf = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_BASE)
>>>> + & IOMMU_MMIO_CMDBUF_BASE_MASK;
>>>> + s->cmdbuf_len = 1UL << (s->mmior[IOMMU_MMIO_CMDBUF_SIZE_BYTE]
>>>> + & IOMMU_MMIO_CMDBUF_SIZE_MASK);
>>>> + s->cmdbuf_head = s->cmdbuf_tail = 0;
>>>> +
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_cmdtail_write(AMDIOMMUState *s)
>>>> +{
>>>> + s->cmdbuf_tail = amd_iommu_readq(s, IOMMU_MMIO_COMMAND_TAIL)
>>>> + & IOMMU_MMIO_CMDBUF_TAIL_MASK;
>>>> + amd_iommu_cmdbuf_run(s);
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_excllim_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EXCL_LIMIT);
>>>> + s->excl_limit = (val & IOMMU_MMIO_EXCL_LIMIT_MASK) |
>>>> + IOMMU_MMIO_EXCL_LIMIT_LOW;
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_evtbase_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_BASE);
>>>> + s->evtlog = val & IOMMU_MMIO_EVTLOG_BASE_MASK;
>>>> + s->evtlog_len = 1UL << (*(uint64_t
>>>> *)&s->mmior[IOMMU_MMIO_EVTLOG_SIZE_BYTE]
>>>> + & IOMMU_MMIO_EVTLOG_SIZE_MASK);
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_evttail_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_TAIL);
>>>> + s->evtlog_tail = val & IOMMU_MMIO_EVTLOG_TAIL_MASK;
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_evthead_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_HEAD);
>>>> + s->evtlog_head = val & IOMMU_MMIO_EVTLOG_HEAD_MASK;
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_pprbase_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_BASE);
>>>> + s->ppr_log = val & IOMMU_MMIO_PPRLOG_BASE_MASK;
>>>> + s->pprlog_len = 1UL << (*(uint64_t
>>>> *)&s->mmior[IOMMU_MMIO_PPRLOG_SIZE_BYTE]
>>>> + & IOMMU_MMIO_PPRLOG_SIZE_MASK);
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_pprhead_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_HEAD);
>>>> + s->pprlog_head = val & IOMMU_MMIO_PPRLOG_HEAD_MASK;
>>>> +}
>>>> +
>>>> +static inline void iommu_handle_pprtail_write(AMDIOMMUState *s)
>>>> +{
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_TAIL);
>>>> + s->pprlog_tail = val & IOMMU_MMIO_PPRLOG_TAIL_MASK;
>>>> +}
>>>> +
>>>> +/* FIXME: something might go wrong if System Software writes in chunks
>>>> + * of one byte but linux writes in chunks of 4 bytes so currently it
>>>> + * works correctly with linux but will definitely be busted if software
>>>> + * reads/writes 8 bytes
>>>> + */
>>>> +static void amd_iommu_mmio_write(void *opaque, hwaddr addr, uint64_t val,
>>>> + unsigned size)
>>>> +{
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "");
>>>> +
>>>> + AMDIOMMUState *s = opaque;
>>>> + unsigned long offset = addr & 0x07;
>>>> +
>>>> + if (addr + size > IOMMU_MMIO_SIZE) {
>>>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIx64
>>>> + ", got 0x%"PRIx64 " %d", (uint64_t)IOMMU_MMIO_SIZE,
>>>> addr,
>>>> + size);
>>>> + return;
>>>> + }
>>>> +
>>>> + switch (addr & ~0x07) {
>>>> + case IOMMU_MMIO_CONTROL:
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> +
>>>> + IOMMU_DPRINTF(COMMAND, "MMIO_CONTROL write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + iommu_handle_control_write(s);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_DEVICE_TABLE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> +
>>>> + /* set device table address
>>>> + * This also suffers from inability to tell whether software
>>>> + * is done writing
>>>> + */
>>>> +
>>>> + if (offset || (size == 8)) {
>>>> + iommu_handle_devtab_write(s);
>>>> + }
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_COMMAND_HEAD:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> +
>>>> + iommu_handle_cmdhead_write(s);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_COMMAND_BASE:
>>>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_BASE write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> +
>>>> + /* FIXME - make sure System Software has finished writing incase
>>>> + * it writes in chucks less than 8 bytes in a robust way.As for
>>>> + * now, this hacks works for the linux driver
>>>> + */
>>>> + if (offset || (size == 8)) {
>>>> + iommu_handle_cmdbase_write(s);
>>>> + }
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_COMMAND_TAIL:
>>>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_TAIL write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_cmdtail_write(s);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EVENT_BASE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_evtbase_write(s);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EVENT_HEAD:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_evthead_write(s);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EVENT_TAIL:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_evttail_write(s);
>>>> + break;
>>>> +
>>>> + case IOMMU_MMIO_EXCL_LIMIT:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_excllim_write(s);
>>>> + break;
>>>> +
>>>> + /* PPR log base - unused for now */
>>>> + case IOMMU_MMIO_PPR_BASE:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_BASE write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_pprbase_write(s);
>>>> + break;
>>>> + /* PPR log head - also unused for now */
>>>> + case IOMMU_MMIO_PPR_HEAD:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_HEAD write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_pprhead_write(s);
>>>> + break;
>>>> + /* PPR log tail - unused for now */
>>>> + case IOMMU_MMIO_PPR_TAIL:
>>>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_TAIL write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + if (size == 2) {
>>>> + amd_iommu_writew(s, addr, val);
>>>> + } else if (size == 4) {
>>>> + amd_iommu_writel(s, addr, val);
>>>> + } else if (size == 8) {
>>>> + amd_iommu_writeq(s, addr, val);
>>>> + }
>>>> + iommu_handle_pprtail_write(s);
>>>> + break;
>>>> +
>>>> + /* ignore write to ext_features */
>>>> + default:
>>>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO write addr 0x%"PRIx64
>>>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>>>> + addr, size, val, offset);
>>>> + }
>>>> +
>>>> +}
>>>> +
>>>> +static inline uint64_t amd_iommu_get_perms(uint64_t entry)
>>>> +{
>>>> + return (entry & (IOMMU_DEV_PERM_READ | IOMMU_DEV_PERM_WRITE)) >>
>>>> + IOMMU_DEV_PERM_SHIFT;
>>>> +}
>>>> +
>>>> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn)
>>>> +{
>>>> + AMDIOMMUState *s = opaque;
>>>> + AMDIOMMUAddressSpace **iommu_as;
>>>> + int bus_num = pci_bus_num(bus);
>>>> +
>>>> + /* just in case */
>>>
>>>
>>> This comment troubles me, do we need the assert?
>
> In case the bus_num or devfn is invalid. Anyway, I could get of rid of
> this assert.
>
>>>
>>>> + assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
>>>
>>>
>>> bus_num < PCI_BUS_MAX, right ?
>>>
>>>> + assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
>>>
>>>
>>> same with devfn I suppose.
>>>
>>>> +
>>>> + iommu_as = s->address_spaces[bus_num];
>>>> +
>>>> + /* allocate memory during the first run */
>>>> + if (!iommu_as) {
>>>
>>>
>>> Why lazy init? We can do that at AMDIOMMUState init, right?
>
> This code has to be called for all emulated devices when the bus is
> initialized. If you have it on AMDIOMMUState init - it will only be
> called for one or two devices already initiliazed.
>
>>>
>>>> + iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) *
>>>> PCI_DEVFN_MAX);
>>>> + s->address_spaces[bus_num] = iommu_as;
>>>> + }
>>>> +
>>>> + /* set up IOMMU region */
>>>> + if (!iommu_as[devfn]) {
>>>> + iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
>>>
>>>
>>> same here
>>>
>>>> + iommu_as[devfn]->bus_num = (uint8_t)bus_num;
>>>> + iommu_as[devfn]->devfn = (uint8_t)devfn;
>>>> + iommu_as[devfn]->iommu_state = s;
>>>> +
>>>> + memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
>>>> + &s->iommu_ops, "amd-iommu", UINT64_MAX);
>>>> + address_space_init(&iommu_as[devfn]->as, &iommu_as[devfn]->iommu,
>>>> + "amd-iommu");
>>>> + }
>>>> + return &iommu_as[devfn]->as;
>>>> +}
>>>> +
>>>> +/* validate a page table entry */
>>>> +static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
>>>> + uint64_t *dte)
>>>> +{
>>>> + if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
>>>> + || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
>>>> + || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
>>>> + amd_iommu_log_illegaldevtab_error(s, devid,
>>>> + s->devtab + devid *
>>>> IOMMU_DEVTAB_ENTRY_SIZE, 0);
>>>> + return false;
>>>> + }
>>>> +
>>>> + return dte[0] & IOMMU_DEV_VALID && (dte[0] &
>>>> IOMMU_DEV_TRANSLATION_VALID)
>>>> + && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
>>>> +}
>>>> +
>>>> +/* get a device table entry given the devid */
>>>> +static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t
>>>> *entry)
>>>> +{
>>>> + uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
>>>> +
>>>> + IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
>>>> +
>>>> + if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
>>>> + IOMMU_DEVTAB_ENTRY_SIZE)) {
>>>> + IOMMU_DPRINTF(MMU, "error: fail to access Device Entry devtab
>>>> 0x%"PRIx64
>>>> + "offset 0x%"PRIx32, s->devtab, offset);
>>>> + /* log ever accessing dte */
>>>> + amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
>>>> + return false;
>>>> + }
>>>> +
>>>> + if (!amd_iommu_validate_dte(s, devid, entry)) {
>>>> + IOMMU_DPRINTF(MMU,
>>>> + "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
>>>> + return false;
>>>> + }
>>>> +
>>>> + return true;
>>>> +}
>>>> +
>>>> +/* get pte translation mode */
>>>> +static inline uint8_t get_pte_translation_mode(uint64_t pte)
>>>> +{
>>>> + return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
>>>> +}
>>>> +
>>>> +static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
>>>> + IOMMUTLBEntry *ret, unsigned perms,
>>>> + hwaddr addr)
>>>> +{
>>>> + uint8_t level, oldlevel;
>>>> + unsigned present;
>>>> + uint64_t pte, pte_addr;
>>>> + uint64_t pte_perms;
>>>> + pte = dte[0];
>>>> +
>>>> + level = get_pte_translation_mode(pte);
>>>> +
>>>> + if (level >= 7 || level == 0) {
>>>> + IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 "
>>>> detected"
>>>> + "while translating 0x%"PRIx64, level, addr);
>>>> + return -1;
>>>> + }
>>>> +
>>>> + while (level > 0) {
>>>> + pte_perms = amd_iommu_get_perms(pte);
>>>> + present = pte & 1;
>>>> + if (!present || perms != (perms & pte_perms)) {
>>>> + amd_iommu_page_fault(as->iommu_state, as->devfn, addr,
>>>> perms);
>>>> + IOMMU_DPRINTF(MMU, "error: page fault accessing virtual addr
>>>> 0x%"
>>>> + PRIx64, addr);
>>>> + return -1;
>>>> + }
>>>> +
>>>> + /* go to the next lower level */
>>>> + pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
>>>> + /* add offset and load pte */
>>>> + pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
>>>> + pte = ldq_phys(&address_space_memory, pte_addr);
>>>> + oldlevel = level;
>>>> + level = get_pte_translation_mode(pte);
>>>> +
>>>> + /* PT is corrupted or not there */
>>>> + if (level != oldlevel - 1) {
>>>> + return -1;
>>>> + }
>>>> + }
>>>> +
>>>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) &
>>>> IOMMU_PAGE_MASK_4K;
>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret->perm = IOMMU_RW;
>>>> + return 0;
>>>> +}
>>>> +
>>>> +/* TODO : Mark addresses as Accessed and Dirty */
>>>
>>>
>>> If you don't mark addresses as dirty, can't this cause the sporadic errors
>>> of arbitrary programs Jan talked about?
>>
>> I don't think this the issue, am seem to be receiving wrong 'host
>> physical addresses' in the last few kernel version. This issue is not
>> there in older kernels.
>>
>>>
>>>> +static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr addr,
>>>> + bool is_write, IOMMUTLBEntry *ret)
>>>> +{
>>>> + AMDIOMMUState *s = as->iommu_state;
>>>> + uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
>>>> + IOMMUIOTLBEntry *iotlb_entry;
>>>> + uint8_t err;
>>>> + uint64_t entry[4];
>>>> +
>>>> + /* try getting a cache entry first */
>>>> + iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
>>>> +
>>>> + if (iotlb_entry) {
>>>> + IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa
>>>> 0x%"PRIx64
>>>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid),
>>>> PCI_SLOT(devid),
>>>> + PCI_FUNC(devid), addr,
>>>> iotlb_entry->translated_addr);
>>>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret->translated_addr = iotlb_entry->translated_addr;
>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret->perm = iotlb_entry->perms;
>>>> + return;
>>>> + } else {
>>>
>>>
>>> you return from the if clause so you don't need the else
>>>
>>>> + if (!amd_iommu_get_dte(s, devid, entry)) {
>>>
>>>
>>> is not an error if you did not find the device id?
I get device id from Qemu - so I assume it's correct.
>>>
>>>> + goto out;
>>>> + }
>>>> +
>>>> + err = amd_iommu_page_walk(as, entry, ret,
>>>> + is_write ? IOMMU_PERM_WRITE :
>>>> IOMMU_PERM_READ,
>>>> + addr);
>>>> + if (err) {
>>>> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page
>>>> tables"
>>>> + " while translating addr 0x%"PRIx64, addr);
>>>> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
>>>> + goto out;
>>>> + }
>>>> +
>>>> + amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
>>>> + ret->perm, entry[1] &
>>>> IOMMU_DEV_DOMID_ID_MASK);
>>>> + return;
>>>> + }
>>>> +
>>>> +out:
>>>> + ret->iova = addr;
>>>> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret->perm = IOMMU_RW;
>>>> + return;
>>>
>>>
>>> you don't need the above return
>>>
>>>> +}
>>>> +
>>>> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr
>>>> addr,
>>>> + bool is_write)
>>>> +{
>>>> + IOMMU_DPRINTF(GENERAL, "");
>>>> +
>>>> + AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace,
>>>> iommu);
>>>> + AMDIOMMUState *s = as->iommu_state;
>>>> +
>>>> + IOMMUTLBEntry ret = {
>>>> + .target_as = &address_space_memory,
>>>> + .iova = addr,
>>>> + .translated_addr = 0,
>>>> + .addr_mask = ~(hwaddr)0,
>>>> + .perm = IOMMU_NONE,
>>>> + };
>>>> +
>>>> + if (!s->enabled) {
>>>> + /* IOMMU disabled - corresponds to iommu=off not
>>>> + * failure to provide any parameter
>>>> + */
>>>> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret.perm = IOMMU_RW;
>>>> + return ret;
>>>> + }
>>>> +
>>>> + amd_iommu_do_translate(as, addr, is_write, &ret);
>>>> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa
>>>> 0x%"PRIx64,
>>>> + as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn),
>>>> addr,
>>>> + ret.translated_addr);
>>>> +
>>>> + return ret;
>>>> +}
>>>> +
>>>> +static const MemoryRegionOps mmio_mem_ops = {
>>>> + .read = amd_iommu_mmio_read,
>>>> + .write = amd_iommu_mmio_write,
>>>> + .endianness = DEVICE_LITTLE_ENDIAN,
>>>> + .impl = {
>>>> + .min_access_size = 1,
>>>> + .max_access_size = 8,
>>>> + .unaligned = false,
>>>> + },
>>>> + .valid = {
>>>> + .min_access_size = 1,
>>>> + .max_access_size = 8,
>>>> + }
>>>> +};
>>>> +
>>>> +static void amd_iommu_init(AMDIOMMUState *s)
>>>> +{
>>>> + printf("amd_iommu_init");
>>>
>>>
>>> you should use the debug macro here
>>>
>>>> +
>>>> + amd_iommu_iotlb_reset(s);
>>>> +
>>>> + s->iommu_ops.translate = amd_iommu_translate;
>>>> +
>>>> + s->devtab_len = 0;
>>>> + s->cmdbuf_len = 0;
>>>> + s->cmdbuf_head = 0;
>>>> + s->cmdbuf_tail = 0;
>>>> + s->evtlog_head = 0;
>>>> + s->evtlog_tail = 0;
>>>> + s->excl_enabled = false;
>>>> + s->excl_allow = false;
>>>> + s->mmio_enabled = false;
>>>> + s->enabled = false;
>>>> + s->ats_enabled = false;
>>>> + s->cmdbuf_enabled = false;
>>>> +
>>>> + /* reset MMIO */
>>>> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
>>>> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
>>>> + 0xffffffffffffffef, 0);
>>>> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
>>>> + /* reset device ident */
>>>> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
>>>> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
>>>> + pci_config_set_prog_interface(s->dev.config, 00);
>>>> + pci_config_set_class(s->dev.config, 0x0806);
>>>> +
>>>> + /* reset IOMMU specific capabilities */
>>>> + pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
>>>> + s->mmio.addr & ~(0xffff0000));
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
>>>> + (s->mmio.addr & ~(0xffff)) >> 16);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
>>>> + 0xff000000);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>>>> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
>>>
>>>
>>> All the capabilities are read-write? Otherwise you need to set the wmask
>>> to indicate what fields are writable.
>>>
>>>> +}
>>>> +
>>>> +static void amd_iommu_reset(DeviceState *dev)
>>>> +{
>>>> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
>>>> +
>>>> + amd_iommu_init(s);
>>>> +}
>>>> +
>>>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>>>> +{
>>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>>> +
>>>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>>>> + amd_iommu_uint64_equal, g_free,
>>>> g_free);
>>>> +
>>>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>>>> + IOMMU_CAPAB_SIZE);
>>>> +
>>>> + /* add msi and hypertransport capabilities */
>>>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
>>>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
>>>> +
>>>> + amd_iommu_init(s);
>>>> +
>>>> + /* set up MMIO */
>>>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
>>>> + IOMMU_MMIO_SIZE);
>>>> +
>>>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>>>
>>>
>>> I don't understand why is need here. realize is called only once in the init
>>> process
>>> and you set it a few lines below.
>>>
>>>> + return;
>>>> + }
>>>> +
>>>> + s->mmio.addr = IOMMU_BASE_ADDR;
>>>> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR,
>>>> &s->mmio);
>>>> +}
>>>> +
>>>> +static const VMStateDescription vmstate_amd_iommu = {
>>>> + .name = "amd-iommu",
>>>> + .fields = (VMStateField[]) {
>>>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>>>> + VMSTATE_END_OF_LIST()
>>>> + }
>>>> +};
>>>> +
>>>> +static Property amd_iommu_properties[] = {
>>>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>>>> + DEFINE_PROP_END_OF_LIST(),
>>>> +};
>>>> +
>>>> +static void amd_iommu_uninit(PCIDevice *dev)
>>>> +{
>>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>>> + amd_iommu_iotlb_reset(s);
>>>
>>>
>>> at this point you also need to clean also the memory regions you use.
>>>
>>>> +}
>>>> +
>>>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>>>> +{
>>>> + DeviceClass *dc = DEVICE_CLASS(klass);
>>>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>>>> +
>>>> + k->realize = amd_iommu_realize;
>>>> + k->exit = amd_iommu_uninit;
>>>> +
>>>> + dc->reset = amd_iommu_reset;
>>>> + dc->vmsd = &vmstate_amd_iommu;
>>>> + dc->props = amd_iommu_properties;
>>>> +}
>>>> +
>>>> +static const TypeInfo amd_iommu = {
>>>> + .name = TYPE_AMD_IOMMU_DEVICE,
>>>> + .parent = TYPE_PCI_DEVICE,
>>>> + .instance_size = sizeof(AMDIOMMUState),
>>>> + .class_init = amd_iommu_class_init
>>>> +};
>>>> +
>>>> +static void amd_iommu_register_types(void)
>>>> +{
>>>> + type_register_static(&amd_iommu);
>>>> +}
>>>> +
>>>> +type_init(amd_iommu_register_types);
>>>> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
>>>> new file mode 100644
>>>> index 0000000..7d317e1
>>>> --- /dev/null
>>>> +++ b/hw/i386/amd_iommu.h
>>>> @@ -0,0 +1,395 @@
>>>> +/*
>>>> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
>>>> + *
>>>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>>>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>>>> + *
>>>> + * This program is free software; you can redistribute it and/or modify
>>>> + * it under the terms of the GNU General Public License as published by
>>>> + * the Free Software Foundation; either version 2 of the License, or
>>>> + * (at your option) any later version.
>>>> +
>>>> + * This program is distributed in the hope that it will be useful,
>>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>>>> + * GNU General Public License for more details.
>>>> +
>>>> + * You should have received a copy of the GNU General Public License
>>>> along
>>>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>>>> + */
>>>> +
>>>> +#ifndef AMD_IOMMU_H_
>>>> +#define AMD_IOMMU_H_
>>>> +
>>>> +#include "hw/hw.h"
>>>> +#include "hw/pci/pci.h"
>>>> +#include "hw/pci/msi.h"
>>>> +#include "hw/sysbus.h"
>>>> +#include "sysemu/dma.h"
>>>> +
>>>> +/* Capability registers */
>>>> +#define IOMMU_CAPAB_HEADER 0x00
>>>> +#define IOMMU_CAPAB_REV_TYPE 0x02
>>>> +#define IOMMU_CAPAB_FLAGS 0x03
>>>> +#define IOMMU_CAPAB_BAR_LOW 0x04
>>>> +#define IOMMU_CAPAB_BAR_HIGH 0x08
>>>> +#define IOMMU_CAPAB_RANGE 0x0C
>>>> +#define IOMMU_CAPAB_MISC 0x10
>>>> +#define IOMMU_CAPAB_MISC1 0x14
>>>> +
>>>> +#define IOMMU_CAPAB_SIZE 0x18
>>>> +#define IOMMU_CAPAB_REG_SIZE 0x04
>>>> +
>>>> +/* Capability header data */
>>>> +#define IOMMU_CAPAB_ID_SEC 0xf
>>>> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
>>>> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
>>>> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
>>>> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
>>>> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
>>>> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
>>>> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
>>>> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV |
>>>> IOMMU_CAPAB_TYPE)
>>>> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
>>>> + IOMMU_CAPAB_FLAG_HTTUNNEL)
>>>> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
>>>> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
>>>> +
>>>> +/* MMIO registers */
>>>> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
>>>> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
>>>> +#define IOMMU_MMIO_EVENT_BASE 0x0010
>>>> +#define IOMMU_MMIO_CONTROL 0x0018
>>>> +#define IOMMU_MMIO_EXCL_BASE 0x0020
>>>> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
>>>> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
>>>> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
>>>> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
>>>> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
>>>> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
>>>> +#define IOMMU_MMIO_STATUS 0x2020
>>>> +#define IOMMU_MMIO_PPR_BASE 0x0038
>>>> +#define IOMMU_MMIO_PPR_HEAD 0x2030
>>>> +#define IOMMU_MMIO_PPR_TAIL 0x2038
>>>> +
>>>> +#define IOMMU_MMIO_SIZE 0x4000
>>>> +
>>>> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
>>>> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
>>>> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
>>>> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
>>>> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
>>>> +
>>>> +/* some of this are similar but just for readability */
>>>> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
>>>> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
>>>> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
>>>> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>>> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +
>>>> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>>> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
>>>> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
>>>> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
>>>> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>>> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +
>>>> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>>> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
>>>> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
>>>> +
>>>> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
>>>> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
>>>> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
>>>> +
>>>> +/* mmio control register flags */
>>>> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
>>>> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
>>>> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
>>>> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
>>>> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
>>>> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
>>>> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
>>>> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
>>>> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
>>>> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
>>>> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
>>>> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
>>>> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
>>>> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
>>>> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
>>>> +
>>>> +/* MMIO status register bits */
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
>>>> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
>>>> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
>>>> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
>>>> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
>>>> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
>>>> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
>>>> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
>>>> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
>>>> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
>>>> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
>>>> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
>>>> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
>>>> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
>>>> +
>>>> +#define IOMMU_CMDBUF_ID_BYTE 0x07
>>>> +#define IOMMU_CMDBUF_ID_RSHIFT 4
>>>> +
>>>> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
>>>> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
>>>> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
>>>> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
>>>> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
>>>> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
>>>> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
>>>> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
>>>> +
>>>> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
>>>> +
>>>> +/* Device table entry bits 0:63 */
>>>> +#define IOMMU_DEV_VALID (1ULL << 0)
>>>> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
>>>> +#define IOMMU_DEV_MODE_MASK 0x7
>>>> +#define IOMMU_DEV_MODE_RSHIFT 9
>>>> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
>>>> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
>>>> +#define IOMMU_DEV_PERM_SHIFT 61
>>>> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
>>>> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
>>>> +
>>>> +/* Device table entry bits 64:127 */
>>>> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
>>>> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
>>>> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
>>>> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
>>>> +#define IOMMU_DEV_IOCTL_MASK (~3)
>>>> +#define IOMMU_DEV_IOCTL_RSHIFT 20
>>>> +#define IOMMU_DEV_IOCTL_DENY 0
>>>> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
>>>> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
>>>> +#define IOMMU_DEV_CACHE (1ULL << 37)
>>>> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
>>>> +#define IOMMU_DEV_EXCL (1ULL << 39)
>>>> +
>>>> +/* Event codes and flags, as stored in the info field */
>>>> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
>>>> +#define IOMMU_EVENT_IOPF (0x2U << 12)
>>>> +#define IOMMU_EVENT_IOPF_I (1U << 3)
>>>> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
>>>> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
>>>> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
>>>> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
>>>> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
>>>> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
>>>> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
>>>> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
>>>> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
>>>> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
>>>> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
>>>> +
>>>> +#define IOMMU_EVENT_LEN 16
>>>> +#define IOMMU_PERM_READ (1 << 0)
>>>> +#define IOMMU_PERM_WRITE (1 << 1)
>>>> +#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
>>>> +
>>>> +/* AMD RD890 Chipset */
>>>> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
>
>
>>>
>>>
>>> We keep the pci ids in include/hw/pci/pci_ids.h
>
> This a dummy device id I use for IOMMU - IOMMU doesn't have a specific
> device id. There's a device id on linux include files for a certain
> AMD IOMMU but it makes IOMMU seem to be on a non-existant bus so I
> don't use it.
>
>>>
>>>> +
>>>> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
>>>> +#define IOMMU_FEATURE_PPR (1ULL << 1)
>>>> +#define IOMMU_FEATURE_NX (1ULL << 3)
>>>> +#define IOMMU_FEATURE_GT (1ULL << 4)
>>>> +#define IOMMU_FEATURE_IA (1ULL << 6)
>>>> +#define IOMMU_FEATURE_GA (1ULL << 7)
>>>> +#define IOMMU_FEATURE_HE (1ULL << 8)
>>>> +#define IOMMU_FEATURE_PC (1ULL << 9)
>>>> +
>>>> +/* reserved DTE bits */
>>>> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
>>>> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
>>>> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
>>>> +
>>>> +/* IOMMU paging mode */
>>>> +#define IOMMU_GATS_MODE (6ULL << 12)
>>>> +#define IOMMU_HATS_MODE (6ULL << 10)
>>>> +
>>>> +/* PCI SIG constants */
>>>> +#define PCI_BUS_MAX 256
>>>> +#define PCI_SLOT_MAX 32
>>>> +#define PCI_FUNC_MAX 8
>>>> +#define PCI_DEVFN_MAX 256
>>>
>>>
>>> Maybe we can move the PCI macros to include/hw/pci/pci.h, those are not
>>> IOMMU specific.
>
> Yeah, this are PCI macros but they are a not copied from linux while
> the macros in pci.h seem to have been copied from linux.
>
>>>
>>>> +
>>>> +/* IOTLB */
>>>> +#define IOMMU_IOTLB_MAX_SIZE 1024
>>>> +#define IOMMU_DEVID_SHIFT 36
>>>> +
>>>> +/* extended feature support */
>>>> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR |
>>>> \
>>>> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
>>>> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
>>>> + IOMMU_HATS_MODE)
>>>> +
>>>> +/* capabilities header */
>>>> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
>>>> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
>>>> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
>>>> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
>>>> +
>>>> +/* command constants */
>>>> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
>>>> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
>>>> +#define IOMMU_COM_COMPLETION_INTR 0x2
>>>> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
>>>> +#define IOMMU_COMMAND_SIZE 0x10
>>>> +
>>>> +/* IOMMU default address */
>>>> +#define IOMMU_BASE_ADDR 0xfed80000
>>>> +
>>>> +/* page management constants */
>>>> +#define IOMMU_PAGE_SHIFT 12
>>>> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
>>>> +
>>>> +#define IOMMU_PAGE_SHIFT_4K 12
>>>> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
>>>> +#define IOMMU_PAGE_SHIFT_2M 21
>>>> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
>>>> +#define IOMMU_PAGE_SHIFT_1G 30
>>>> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
>>>> +
>>>> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
>>>> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
>>>> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
>>>> +
>>>> +/* invalidation command device id */
>>>> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
>>>> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) -
>>>> 1))
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-02-25 15:43 ` Marcel Apfelbaum
2016-02-26 6:23 ` David Kiarie
@ 2016-03-02 19:11 ` David Kiarie
2016-03-03 12:16 ` Marcel Apfelbaum
1 sibling, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-02 19:11 UTC (permalink / raw)
To: Marcel Apfelbaum, qemu-devel; +Cc: valentine.sinitsyn, jan.kiszka, mst
On 25/02/16 18:43, Marcel Apfelbaum wrote:
> On 02/21/2016 08:10 PM, David Kiarie wrote:
>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>> The IOMMU does basic translation, error checking and has a
>> mininal IOTLB implementation
>
> Hi,
>
>>
>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> ---
>> hw/i386/Makefile.objs | 1 +
>> hw/i386/amd_iommu.c | 1432
>> +++++++++++++++++++++++++++++++++++++++++++++++++
>> hw/i386/amd_iommu.h | 395 ++++++++++++++
>> include/hw/pci/pci.h | 2 +
>> 4 files changed, 1830 insertions(+)
>> create mode 100644 hw/i386/amd_iommu.c
>> create mode 100644 hw/i386/amd_iommu.h
>>
>> diff --git a/hw/i386/Makefile.objs b/hw/i386/Makefile.objs
>> index b52d5b8..2f1a265 100644
>> --- a/hw/i386/Makefile.objs
>> +++ b/hw/i386/Makefile.objs
>> @@ -3,6 +3,7 @@ obj-y += multiboot.o
>> obj-y += pc.o pc_piix.o pc_q35.o
>> obj-y += pc_sysfw.o
>> obj-y += intel_iommu.o
>> +obj-y += amd_iommu.o
>> obj-$(CONFIG_XEN) += ../xenpv/ xen/
>>
>> obj-y += kvmvapic.o
>> diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
>> new file mode 100644
>> index 0000000..3dac043
>> --- /dev/null
>> +++ b/hw/i386/amd_iommu.c
>> @@ -0,0 +1,1432 @@
>> +/*
>> + * QEMU emulation of AMD IOMMU (AMD-Vi)
>> + *
>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License as published by
>> + * the Free Software Foundation; either version 2 of the License, or
>> + * (at your option) any later version.
>> +
>> + * This program is distributed in the hope that it will be useful,
>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>> + * GNU General Public License for more details.
>> +
>> + * You should have received a copy of the GNU General Public License
>> along
>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>> + *
>> + * Cache implementation inspired by hw/i386/intel_iommu.c
>> + *
>> + */
>> +#include "hw/i386/amd_iommu.h"
>> +
>> +/*#define DEBUG_AMD_IOMMU*/
>> +#ifdef DEBUG_AMD_IOMMU
>> +enum {
>> + DEBUG_GENERAL, DEBUG_CAPAB, DEBUG_MMIO, DEBUG_ELOG,
>> + DEBUG_CACHE, DEBUG_COMMAND, DEBUG_MMU
>> +};
>> +
>> +#define IOMMU_DBGBIT(x) (1 << DEBUG_##x)
>> +static int iommu_dbgflags = IOMMU_DBGBIT(MMIO);
>> +
>> +#define IOMMU_DPRINTF(what, fmt, ...) do { \
>> + if (iommu_dbgflags & IOMMU_DBGBIT(what)) { \
>> + fprintf(stderr, "(amd-iommu)%s: " fmt "\n", __func__, \
>> + ## __VA_ARGS__); } \
>> + } while (0)
>> +#else
>> +#define IOMMU_DPRINTF(what, fmt, ...) do {} while (0)
>> +#endif
>> +
>> +typedef struct AMDIOMMUAddressSpace {
>> + uint8_t bus_num; /* bus
>> number */
>> + uint8_t devfn; /* device
>> function */
>> + AMDIOMMUState *iommu_state; /* IOMMU - one per
>> machine */
>> + MemoryRegion iommu; /* Device's iommu
>> region */
>> + AddressSpace as; /* device's corresponding address
>> space */
>> +} AMDIOMMUAddressSpace;
>> +
>> +/* IOMMU cache entry */
>> +typedef struct IOMMUIOTLBEntry {
>> + uint64_t gfn;
>> + uint16_t domid;
>> + uint64_t devid;
>> + uint64_t perms;
>> + uint64_t translated_addr;
>> +} IOMMUIOTLBEntry;
>> +
>> +/* configure MMIO registers at startup/reset */
>> +static void amd_iommu_set_quad(AMDIOMMUState *s, hwaddr addr,
>> uint64_t val,
>> + uint64_t romask, uint64_t w1cmask)
>> +{
>> + stq_le_p(&s->mmior[addr], val);
>> + stq_le_p(&s->romask[addr], romask);
>> + stq_le_p(&s->w1cmask[addr], w1cmask);
>> +}
>> +
>> +static uint16_t amd_iommu_readw(AMDIOMMUState *s, hwaddr addr)
>> +{
>> + return lduw_le_p(&s->mmior[addr]);
>> +}
>> +
>> +static uint32_t amd_iommu_readl(AMDIOMMUState *s, hwaddr addr)
>> +{
>> + return ldl_le_p(&s->mmior[addr]);
>> +}
>> +
>> +static uint64_t amd_iommu_readq(AMDIOMMUState *s, hwaddr addr)
>> +{
>> + return ldq_le_p(&s->mmior[addr]);
>> +}
>> +
>> +/* internal write */
>> +static void amd_iommu_writeq_raw(AMDIOMMUState *s, uint64_t val,
>> hwaddr addr)
>> +{
>> + stq_le_p(&s->mmior[addr], val);
>> +}
>> +
>> +/* external write */
>> +static void amd_iommu_writew(AMDIOMMUState *s, hwaddr addr, uint16_t
>> val)
>> +{
>> + uint16_t romask = lduw_le_p(&s->romask[addr]);
>> + uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
>> + uint16_t oldval = lduw_le_p(&s->mmior[addr]);
>> + stw_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>> oldval));
>> +}
>> +
>> +static void amd_iommu_writel(AMDIOMMUState *s, hwaddr addr, uint32_t
>> val)
>> +{
>> + uint32_t romask = ldl_le_p(&s->romask[addr]);
>> + uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
>> + uint32_t oldval = ldl_le_p(&s->mmior[addr]);
>> + stl_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>> oldval));
>> +}
>> +
>> +static void amd_iommu_writeq(AMDIOMMUState *s, hwaddr addr, uint64_t
>> val)
>> +{
>> + uint64_t romask = ldq_le_p(&s->romask[addr]);
>> + uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
>> + uint32_t oldval = ldq_le_p(&s->mmior[addr]);
>> + stq_le_p(&s->mmior[addr], (val & ~(val & w1cmask)) | (romask &
>> oldval));
>> +}
>> +
>> +static void amd_iommu_log_event(AMDIOMMUState *s, uint16_t *evt)
>> +{
>> + /* event logging not enabled */
>> + if (!s->evtlog_enabled || *(uint64_t
>> *)&s->mmior[IOMMU_MMIO_STATUS] |
>> + IOMMU_MMIO_STATUS_EVT_OVF) {
>> + return;
>> + }
>> +
>> + /* event log buffer full */
>> + if (s->evtlog_tail >= s->evtlog_len) {
>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>> IOMMU_MMIO_STATUS_EVT_OVF;
>> + /* generate interrupt */
>> + msi_notify(&s->dev, 0);
>> + }
>> +
>> + if (dma_memory_write(&address_space_memory, s->evtlog_len +
>> s->evtlog_tail,
>> + &evt, IOMMU_EVENT_LEN)) {
>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address 0x%"PRIx64
>> + " + offset 0x%"PRIx32, s->evtlog,
>> s->evtlog_tail);
>> + }
>> +
>> + s->evtlog_tail += IOMMU_EVENT_LEN;
>> + *(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS] |=
>> IOMMU_MMIO_STATUS_COMP_INT;
>> +}
>> +
>> +/* log an error encountered page-walking
>> + *
>> + * @addr: virtual address in translation request
>> + */
>> +static void amd_iommu_page_fault(AMDIOMMUState *s, uint16_t devid,
>> + dma_addr_t addr, uint16_t info)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_IOPF_I;
>> +
>> + /* encode information */
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint16_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = cpu_to_le64(addr);
>> +
>> + /* log a page fault */
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +}
>> +/*
>> + * log a master abort accessing device table
>> + * @devtab : address of device table entry
>> + * @info : error flags
>> + */
>> +static void amd_iommu_log_devtab_error(AMDIOMMUState *s, uint16_t
>> devid,
>> + dma_addr_t devtab, uint16_t
>> info)
>> +{
>> +
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_DEV_TAB_HW_ERROR;
>> +
>> + /* encode information */
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint8_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = cpu_to_le64(devtab);
>> +
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +
>> +}
>> +
>> +/* log a master abort encountered during a page-walk
>> + * @addr : address that couldn't be accessed
>> + */
>> +static void amd_iommu_log_pagetab_error(AMDIOMMUState *s, uint16_t
>> devid,
>> + dma_addr_t addr, uint16_t info)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_PAGE_TAB_HW_ERROR;
>> +
>> + /* encode information */
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint8_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>> +
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +
>> +}
>> +
>> +/* log an event trying to access command buffer
>> + * @addr : address that couldn't be accessed
>> + */
>> +static void amd_iommu_log_command_error(AMDIOMMUState *s, dma_addr_t
>> addr)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + /* encode information */
>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_COMMAND_HW_ERROR;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>> +
>> + amd_iommu_log_event(s, evt);
>> +
>> + /* Abort the translation */
>> + pci_word_test_and_set_mask(s->dev.config + PCI_STATUS,
>> + PCI_STATUS_SIG_TARGET_ABORT);
>> +}
>> +
>> +/* log an illegal comand event
>> + * @addr : address of illegal command
>> + */
>> +static void amd_iommu_log_illegalcom_error(AMDIOMMUState *s,
>> uint16_t info,
>> + dma_addr_t addr)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + /* encode information */
>> + *(uint8_t *)&evt[3] = (uint8_t)IOMMU_EVENT_ILLEGAL_COMMAND_ERROR;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>
> Can you please use a macro instead of 3 literal?
>
>> +
>> + amd_iommu_log_event(s, evt);
>> +}
>> +
>> +/* log an error accessing device table
>> + *
>> + * @devid : device owning the table entry
>> + * @devtab : address of device table entry
>> + * @info : error flags
>> + */
>> +static void amd_iommu_log_illegaldevtab_error(AMDIOMMUState *s,
>> uint16_t devid,
>> + dma_addr_t addr,
>> uint16_t info)
>> +{
>> + IOMMU_DPRINTF(ELOG, "");
>> +
>> + uint16_t evt[8];
>> +
>> + info |= IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY;
>> +
>> + *(uint16_t *)&evt[0] = devid;
>> + *(uint8_t *)&evt[3] = info;
>> + *(uint64_t *)&evt[4] = (cpu_to_le64(addr) >> 3);
>> +
>> + amd_iommu_log_event(s, evt);
>> +}
>
> It seems that the all log functions do the same:
> create an event, log it and optionally set PCI_STATUS_SIG_TARGET_ABORT
>
> I would consider to unite them in the same function. (not a must)
>
>> +
>> +static gboolean amd_iommu_uint64_equal(gconstpointer v1,
>> gconstpointer v2)
>> +{
>> + return *((const uint64_t *)v1) == *((const uint64_t *)v2);
>> +}
>> +
>> +static guint amd_iommu_uint64_hash(gconstpointer v)
>> +{
>> + return (guint)*(const uint64_t *)v;
>> +}
>> +
>> +static IOMMUIOTLBEntry *amd_iommu_iotlb_lookup(AMDIOMMUState *s,
>> hwaddr addr,
>> + uint64_t devid)
>> +{
>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>> + return g_hash_table_lookup(s->iotlb, &key);
>> +}
>> +
>> +static void amd_iommu_iotlb_reset(AMDIOMMUState *s)
>> +{
>> + assert(s->iotlb);
>> + g_hash_table_remove_all(s->iotlb);
>> +}
>> +
>> +static gboolean amd_iommu_iotlb_remove_by_devid(gpointer key,
>> gpointer value,
>> + gpointer user_data)
>> +{
>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>> + uint16_t devid = *(uint16_t *)user_data;
>> + return entry->devid == devid;
>> +}
>> +
>> +static void amd_iommu_iotlb_remove_page(AMDIOMMUState *s, hwaddr addr,
>> + uint64_t devid)
>> +{
>> + uint64_t key = (addr >> IOMMU_PAGE_SHIFT_4K) |
>> + ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>> + g_hash_table_remove(s->iotlb, &key);
>> +}
>> +
>> +/* extract device id */
>> +static inline uint16_t devid_extract(uint8_t *cmd)
>> +{
>> + return (uint16_t)cmd[2] & IOMMU_INVAL_DEV_ID_MASK;
>> +}
>> +
>> +static void amd_iommu_invalidate_iotlb(AMDIOMMUState *s, uint64_t *cmd)
>> +{
>> + uint16_t devid = devid_extract((uint8_t *)cmd);
>> + /* if invalidation of more than one page requested */
>> + if (IOMMU_INVAL_ALL(cmd[0])) {
>> + g_hash_table_foreach_remove(s->iotlb,
>> amd_iommu_iotlb_remove_by_devid,
>> + &devid);
>> + } else {
>> + hwaddr addr = (hwaddr)(cmd[1] & IOMMU_INVAL_ADDR_MASK);
>> + amd_iommu_iotlb_remove_page(s, addr, devid);
>> + }
>> +}
>> +
>> +static void amd_iommu_update_iotlb(AMDIOMMUState *s, uint16_t devid,
>> + uint64_t gpa, uint64_t spa,
>> uint64_t perms,
>> + uint16_t domid)
>> +{
>> + IOMMUIOTLBEntry *entry = g_malloc(sizeof(*entry));
>> + uint64_t *key = g_malloc(sizeof(key));
>> + uint64_t gfn = gpa >> IOMMU_PAGE_SHIFT_4K;
>> +
>> + IOMMU_DPRINTF(CACHE, " update iotlb devid: %02x:%02x.%x gpa
>> 0x%"PRIx64
>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid),
>> PCI_SLOT(devid),
>> + PCI_FUNC(devid), gpa, spa);
>> +
>> + if (g_hash_table_size(s->iotlb) >= IOMMU_IOTLB_MAX_SIZE) {
>> + IOMMU_DPRINTF(CACHE, "iotlb exceeds size limit - reset");
>> + amd_iommu_iotlb_reset(s);
>> + }
>> +
>> + entry->gfn = gfn;
>> + entry->domid = domid;
>> + entry->perms = perms;
>> + entry->translated_addr = spa;
>> + *key = gfn | ((uint64_t)(devid) << IOMMU_DEVID_SHIFT);
>> + g_hash_table_replace(s->iotlb, key, entry);
>> +}
>> +
>> +/* execute a completion wait command */
>> +static void amd_iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> + unsigned int addr;
>> +
>> + /* completion store */
>> + if (cmd[0] & IOMMU_COM_COMPLETION_STORE_MASK) {
>> + addr = le64_to_cpu(*(uint64_t *)cmd) &
>> IOMMU_COM_STORE_ADDRESS_MASK;
>> + if (dma_memory_write(&address_space_memory, addr, cmd + 8,
>> 8)) {
>> + IOMMU_DPRINTF(ELOG, "error: fail to write at address
>> 0%x"PRIx64,
>> + addr);
>> + }
>> + }
>> +
>> + /* set completion interrupt */
>> + if (cmd[0] & IOMMU_COM_COMPLETION_INTR) {
>> + s->mmior[IOMMU_MMIO_STATUS] |= IOMMU_MMIO_STATUS_COMP_INT;
>> + }
>> +}
>> +
>> +/* get command type */
>> +static uint8_t opcode(uint8_t *cmd)
>> +{
>> + return cmd[IOMMU_CMDBUF_ID_BYTE] >> IOMMU_CMDBUF_ID_RSHIFT;
>> +}
>> +
>> +/* linux seems to be using reserved bits so I just log without
>> abortig bug */
>
> I couldn't quite understand the comment
>
>> +static void iommu_inval_devtab_entry(AMDIOMMUState *s, uint8_t *cmd,
>> + uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + /* This command should invalidate internal caches of which there
>> isn't */
>> + if (*(uint64_t *)&cmd[0] & IOMMU_CMD_INVAL_DEV_RSVD ||
>> + *(uint64_t *)&cmd[1]) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +#ifdef DEBUG_AMD_IOMMU
>> + uint16_t devid = devid_extract(cmd);
>> +#endif
>> + IOMMU_DPRINTF(COMMAND, "device table entry for devid: %02x:%02x.%x"
>> + "invalidated", PCI_BUS_NUM(devid), PCI_SLOT(devid),
>> + PCI_FUNC(devid));
>> +}
>> +
>> +static void iommu_completion_wait(AMDIOMMUState *s, uint8_t *cmd,
>> uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if (*(uint32_t *)&cmd[1] & IOMMU_COMPLETION_WAIT_RSVD) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> + /* pretend to wait for command execution to complete */
>> + IOMMU_DPRINTF(COMMAND, "completion wait requested with store
>> address 0x%"
>> + PRIx64 " and store data 0x%"PRIx64, (cmd[0] &
>> + IOMMU_COM_STORE_ADDRESS_MASK), *(uint64_t *)(cmd +
>> 8));
>> + amd_iommu_completion_wait(s, cmd);
>> +}
>> +
>> +static void iommu_complete_ppr(AMDIOMMUState *s, uint8_t *cmd,
>> uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_COMPLETE_PPR_RQ_RSVD) ||
>> + *(uint64_t *)&cmd[1] & 0xffff000000000000) {
>
>
> Can you please document this mask?
>
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "Execution of PPR queue requested");
>> +}
>> +
>> +static void iommu_inval_all(AMDIOMMUState *s, uint8_t *cmd, uint8_t
>> type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_ALL_RSVD) ||
>> + *(uint64_t *)&cmd[1]) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + amd_iommu_iotlb_reset(s);
>> + IOMMU_DPRINTF(COMMAND, "Invalidation of all IOMMU cache
>> requested");
>> +}
>> +
>> +static inline uint16_t domid_extract(uint64_t *cmd)
>> +{
>> + return (uint16_t)cmd[0] & IOMMU_INVAL_PAGES_DOMID;
>> +}
>> +
>> +static gboolean amd_iommu_iotlb_remove_by_domid(gpointer key,
>> gpointer value,
>> + gpointer user_data)
>> +{
>> + IOMMUIOTLBEntry *entry = (IOMMUIOTLBEntry *)value;
>> + uint16_t domid = *(uint16_t *)user_data;
>> + return entry->domid == domid;
>> +}
>> +
>> +/* we don't have devid - we can't remove pages by address */
>> +static void iommu_inval_pages(AMDIOMMUState *s, uint8_t *cmd,
>> uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> + uint16_t domid = domid_extract((uint64_t *)cmd);
>> +
>> + if (*(uint64_t *)&cmd[0] & IOMMU_INVAL_IOMMU_PAGES_RSVD ||
>> + *(uint32_t *)&cmd[1] & 0x00000ff0) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + g_hash_table_foreach_remove(s->iotlb,
>> amd_iommu_iotlb_remove_by_domid,
>> + &domid);
>> +
>> + IOMMU_DPRINTF(COMMAND, "IOMMU pages for domain 0x%"PRIx16
>> "invalidated",
>> + domid);
>> +}
>> +
>> +static void iommu_prefetch_pages(AMDIOMMUState *s, uint8_t *cmd,
>> uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_PRF_IOMMU_PAGES_RSVD) ||
>> + (*(uint32_t *)&cmd[1] & 0x00000fd4)) {
>
> Here the same, maybe you can name the mask, so we can easier follow
> the spec.
>
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "Pre-fetch of IOMMU pages requested");
>> +}
>> +
>> +static void iommu_inval_inttable(AMDIOMMUState *s, uint8_t *cmd,
>> uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if ((*(uint64_t *)&cmd[0] & IOMMU_INVAL_INTR_TABLE_RSVD) ||
>> + *(uint64_t *)&cmd[1]) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + return;
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "interrupt table invalidated");
>> +}
>> +
>> +static void iommu_inval_iotlb(AMDIOMMUState *s, uint8_t *cmd,
>> uint8_t type)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + if (*(uint32_t *)&cmd[2] & IOMMU_INVAL_IOTLB_PAGES_RSVD) {
>> + amd_iommu_log_illegalcom_error(s, type, s->cmdbuf +
>> s->cmdbuf_head);
>> + return;
>> + }
>> +
>> + amd_iommu_invalidate_iotlb(s, (uint64_t *)cmd);
>> + IOMMU_DPRINTF(COMMAND, "IOTLB pages invalidated");
>> +}
>> +
>> +/* not honouring reserved bits is regarded as an illegal command */
>> +static void amd_iommu_cmdbuf_exec(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint8_t type;
>> + uint8_t cmd[IOMMU_COMMAND_SIZE];
>> +
>> + memset(cmd, 0, IOMMU_COMMAND_SIZE);
>> +
>> + if (dma_memory_read(&address_space_memory, s->cmdbuf +
>> s->cmdbuf_head, cmd,
>> + IOMMU_COMMAND_SIZE)) {
>> + IOMMU_DPRINTF(COMMAND, "error: fail to access memory at
>> 0x%"PRIx64
>> + " + 0x%"PRIu8, s->cmdbuf, s->cmdbuf_head);
>> + amd_iommu_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
>> + return;
>> + }
>> +
>> + type = opcode(cmd);
>> +
>> + switch (type) {
>> + case IOMMU_CMD_COMPLETION_WAIT:
>> + iommu_completion_wait(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_DEVTAB_ENTRY:
>> + iommu_inval_devtab_entry(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_IOMMU_PAGES:
>> + iommu_inval_pages(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_IOTLB_PAGES:
>> + iommu_inval_iotlb(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_INTR_TABLE:
>> + iommu_inval_inttable(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_PREFETCH_IOMMU_PAGES:
>> + iommu_prefetch_pages(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_COMPLETE_PPR_REQUEST:
>> + iommu_complete_ppr(s, cmd, type);
>> + break;
>> +
>> + case IOMMU_CMD_INVAL_IOMMU_ALL:
>> + iommu_inval_all(s, cmd, type);
>> + break;
>> +
>> + default:
>> + IOMMU_DPRINTF(COMMAND, "unhandled command %d", type);
>> + /* log illegal command */
>> + amd_iommu_log_illegalcom_error(s, type,
>> + s->cmdbuf + s->cmdbuf_head);
>> + break;
>> + }
>> +
>> +}
>> +
>> +static void amd_iommu_cmdbuf_run(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t *mmio_cmdbuf_head = (uint64_t *)(s->mmior +
>> + IOMMU_MMIO_COMMAND_HEAD);
>> +
>> + if (!s->cmdbuf_enabled) {
>> + IOMMU_DPRINTF(COMMAND, "error: IOMMU trying to execute
>> commands with "
>> + "command buffer disabled. IOMMU control value
>> 0x%"PRIx64,
>> + amd_iommu_readq(s, IOMMU_MMIO_CONTROL));
>> + return;
>> + }
>> +
>> + while (s->cmdbuf_head != s->cmdbuf_tail) {
>> + /* check if there is work to do. */
>> + IOMMU_DPRINTF(COMMAND, "command buffer head at 0x%"PRIx32 "
>> command "
>> + "buffer tail at 0x%"PRIx32" command buffer
>> base at 0x%"
>> + PRIx64, s->cmdbuf_head, s->cmdbuf_tail,
>> s->cmdbuf);
>> + amd_iommu_cmdbuf_exec(s);
>> + s->cmdbuf_head += IOMMU_COMMAND_SIZE;
>> + amd_iommu_writeq_raw(s, s->cmdbuf_head,
>> IOMMU_MMIO_COMMAND_HEAD);
>> +
>> + /* wrap head pointer */
>> + if (s->cmdbuf_head >= s->cmdbuf_len * IOMMU_COMMAND_SIZE) {
>> + s->cmdbuf_head = 0;
>> + }
>> + }
>> +
>> + *mmio_cmdbuf_head = cpu_to_le64(s->cmdbuf_head);
>> +}
>> +
>> +/* System Software might never read from some of this fields but
>> anyways */
>> +static uint64_t amd_iommu_mmio_read(void *opaque, hwaddr addr,
>> unsigned size)
>> +{
>> + AMDIOMMUState *s = opaque;
>> +
>> + uint64_t val = -1;
>
> The above might work, but it looks a little weird
>
>> + if (addr + size > IOMMU_MMIO_SIZE) {
>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIX64
>> + ", got 0x%"PRIx64 " %d",
>> (uint64_t)IOMMU_MMIO_SIZE, addr,
>> + size);
>> + return (uint64_t)-1;
>> + }
>> +
>> + if (size == 2) {
>> + val = amd_iommu_readw(s, addr);
>> + } else if (size == 4) {
>> + val = amd_iommu_readl(s, addr);
>> + } else if (size == 8) {
>> + val = amd_iommu_readq(s, addr);
>> + }
>> +
>> + switch (addr & ~0x07) {
>> + case IOMMU_MMIO_DEVICE_TABLE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_BASE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_CONTROL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_CONTROL read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EXCL_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_BASE read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EXCL_LIMIT:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_TAIL read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_STATUS:
>> + IOMMU_DPRINTF(MMIO, "MMIO_STATUS read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + break;
>> +
>> + case IOMMU_MMIO_EXT_FEATURES:
>> + IOMMU_DPRINTF(MMU, "MMIO_EXT_FEATURES read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64 "value 0x%"PRIx64,
>> + addr, size, addr & ~0x07, val);
>> + break;
>> +
>> + default:
>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO read addr 0x%"PRIx64
>> + ", size %d offset 0x%"PRIx64, addr, size,
>> + addr & ~0x07);
>> + }
>> + return val;
>> +}
>> +
>> +static void iommu_handle_control_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> + /*
>> + * read whatever is already written in case
>> + * software is writing in chucks less than 8 bytes
>> + */
>> + unsigned long control = amd_iommu_readq(s, IOMMU_MMIO_CONTROL);
>> + s->enabled = !!(control & IOMMU_MMIO_CONTROL_IOMMUEN);
>> +
>> + s->ats_enabled = !!(control & IOMMU_MMIO_CONTROL_HTTUNEN);
>> + s->evtlog_enabled = s->enabled && !!(control &
>> + IOMMU_MMIO_CONTROL_EVENTLOGEN);
>> +
>> + s->evtlog_intr = !!(control & IOMMU_MMIO_CONTROL_EVENTINTEN);
>> + s->completion_wait_intr = !!(control &
>> IOMMU_MMIO_CONTROL_COMWAITINTEN);
>> + s->cmdbuf_enabled = s->enabled && !!(control &
>> + IOMMU_MMIO_CONTROL_CMDBUFLEN);
>> +
>> + /* update the flags depending on the control register */
>> + if (s->cmdbuf_enabled) {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>> + IOMMU_MMIO_STATUS_CMDBUF_RUN;
>> + } else {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>> + ~IOMMU_MMIO_STATUS_CMDBUF_RUN;
>> + }
>> + if (s->evtlog_enabled) {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) |=
>> + IOMMU_MMIO_STATUS_EVT_RUN;
>> + } else {
>> + (*(uint64_t *)&s->mmior[IOMMU_MMIO_STATUS]) &=
>> + ~IOMMU_MMIO_STATUS_EVT_RUN;
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "MMIO_STATUS state 0x%"PRIx64, control);
>> +
>> + amd_iommu_cmdbuf_run(s);
>> +}
>> +
>> +static inline void iommu_handle_devtab_write(AMDIOMMUState *s)
>> +
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_DEVICE_TABLE);
>> + s->devtab = (dma_addr_t)(val & IOMMU_MMIO_DEVTAB_BASE_MASK);
>> +
>> + /* set device table length */
>> + s->devtab_len = ((val & IOMMU_MMIO_DEVTAB_SIZE_MASK) + 1 *
>> + (IOMMU_MMIO_DEVTAB_SIZE_UNIT /
>> + IOMMU_MMIO_DEVTAB_ENTRY_SIZE));
>> +}
>> +
>> +static inline void iommu_handle_cmdhead_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + s->cmdbuf_head = (dma_addr_t)amd_iommu_readq(s,
>> IOMMU_MMIO_COMMAND_HEAD)
>> + & IOMMU_MMIO_CMDBUF_HEAD_MASK;
>> + amd_iommu_cmdbuf_run(s);
>> +}
>> +
>> +static inline void iommu_handle_cmdbase_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + s->cmdbuf = (dma_addr_t)amd_iommu_readq(s, IOMMU_MMIO_COMMAND_BASE)
>> + & IOMMU_MMIO_CMDBUF_BASE_MASK;
>> + s->cmdbuf_len = 1UL << (s->mmior[IOMMU_MMIO_CMDBUF_SIZE_BYTE]
>> + & IOMMU_MMIO_CMDBUF_SIZE_MASK);
>> + s->cmdbuf_head = s->cmdbuf_tail = 0;
>> +
>> +}
>> +
>> +static inline void iommu_handle_cmdtail_write(AMDIOMMUState *s)
>> +{
>> + s->cmdbuf_tail = amd_iommu_readq(s, IOMMU_MMIO_COMMAND_TAIL)
>> + & IOMMU_MMIO_CMDBUF_TAIL_MASK;
>> + amd_iommu_cmdbuf_run(s);
>> +}
>> +
>> +static inline void iommu_handle_excllim_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EXCL_LIMIT);
>> + s->excl_limit = (val & IOMMU_MMIO_EXCL_LIMIT_MASK) |
>> + IOMMU_MMIO_EXCL_LIMIT_LOW;
>> +}
>> +
>> +static inline void iommu_handle_evtbase_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_BASE);
>> + s->evtlog = val & IOMMU_MMIO_EVTLOG_BASE_MASK;
>> + s->evtlog_len = 1UL << (*(uint64_t
>> *)&s->mmior[IOMMU_MMIO_EVTLOG_SIZE_BYTE]
>> + & IOMMU_MMIO_EVTLOG_SIZE_MASK);
>> +}
>> +
>> +static inline void iommu_handle_evttail_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_TAIL);
>> + s->evtlog_tail = val & IOMMU_MMIO_EVTLOG_TAIL_MASK;
>> +}
>> +
>> +static inline void iommu_handle_evthead_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_EVENT_HEAD);
>> + s->evtlog_head = val & IOMMU_MMIO_EVTLOG_HEAD_MASK;
>> +}
>> +
>> +static inline void iommu_handle_pprbase_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_BASE);
>> + s->ppr_log = val & IOMMU_MMIO_PPRLOG_BASE_MASK;
>> + s->pprlog_len = 1UL << (*(uint64_t
>> *)&s->mmior[IOMMU_MMIO_PPRLOG_SIZE_BYTE]
>> + & IOMMU_MMIO_PPRLOG_SIZE_MASK);
>> +}
>> +
>> +static inline void iommu_handle_pprhead_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_HEAD);
>> + s->pprlog_head = val & IOMMU_MMIO_PPRLOG_HEAD_MASK;
>> +}
>> +
>> +static inline void iommu_handle_pprtail_write(AMDIOMMUState *s)
>> +{
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + uint64_t val = amd_iommu_readq(s, IOMMU_MMIO_PPR_TAIL);
>> + s->pprlog_tail = val & IOMMU_MMIO_PPRLOG_TAIL_MASK;
>> +}
>> +
>> +/* FIXME: something might go wrong if System Software writes in chunks
>> + * of one byte but linux writes in chunks of 4 bytes so currently it
>> + * works correctly with linux but will definitely be busted if software
>> + * reads/writes 8 bytes
>> + */
>> +static void amd_iommu_mmio_write(void *opaque, hwaddr addr, uint64_t
>> val,
>> + unsigned size)
>> +{
>> +
>> + IOMMU_DPRINTF(COMMAND, "");
>> +
>> + AMDIOMMUState *s = opaque;
>> + unsigned long offset = addr & 0x07;
>> +
>> + if (addr + size > IOMMU_MMIO_SIZE) {
>> + IOMMU_DPRINTF(MMIO, "error: addr outside region: max 0x%"PRIx64
>> + ", got 0x%"PRIx64 " %d",
>> (uint64_t)IOMMU_MMIO_SIZE, addr,
>> + size);
>> + return;
>> + }
>> +
>> + switch (addr & ~0x07) {
>> + case IOMMU_MMIO_CONTROL:
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + IOMMU_DPRINTF(COMMAND, "MMIO_CONTROL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + iommu_handle_control_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_DEVICE_TABLE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_DEVICE_TABLE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + /* set device table address
>> + * This also suffers from inability to tell whether software
>> + * is done writing
>> + */
>> +
>> + if (offset || (size == 8)) {
>> + iommu_handle_devtab_write(s);
>> + }
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_COMMAND_HEAD write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + iommu_handle_cmdhead_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_BASE:
>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_BASE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> +
>> + /* FIXME - make sure System Software has finished writing
>> incase
>> + * it writes in chucks less than 8 bytes in a robust way.As for
>> + * now, this hacks works for the linux driver
>> + */
>> + if (offset || (size == 8)) {
>> + iommu_handle_cmdbase_write(s);
>> + }
>> + break;
>> +
>> + case IOMMU_MMIO_COMMAND_TAIL:
>> + IOMMU_DPRINTF(COMMAND, "MMIO_COMMAND_TAIL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_cmdtail_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_BASE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_evtbase_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_HEAD write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_evthead_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EVENT_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EVENT_TAIL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_evttail_write(s);
>> + break;
>> +
>> + case IOMMU_MMIO_EXCL_LIMIT:
>> + IOMMU_DPRINTF(MMIO, "MMIO_EXCL_LIMIT write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_excllim_write(s);
>> + break;
>> +
>> + /* PPR log base - unused for now */
>> + case IOMMU_MMIO_PPR_BASE:
>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_BASE write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_pprbase_write(s);
>> + break;
>> + /* PPR log head - also unused for now */
>> + case IOMMU_MMIO_PPR_HEAD:
>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_HEAD write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_pprhead_write(s);
>> + break;
>> + /* PPR log tail - unused for now */
>> + case IOMMU_MMIO_PPR_TAIL:
>> + IOMMU_DPRINTF(MMIO, "MMIO_PPR_TAIL write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + if (size == 2) {
>> + amd_iommu_writew(s, addr, val);
>> + } else if (size == 4) {
>> + amd_iommu_writel(s, addr, val);
>> + } else if (size == 8) {
>> + amd_iommu_writeq(s, addr, val);
>> + }
>> + iommu_handle_pprtail_write(s);
>> + break;
>> +
>> + /* ignore write to ext_features */
>> + default:
>> + IOMMU_DPRINTF(MMIO, "UNHANDLED MMIO write addr 0x%"PRIx64
>> + ", size %d, val 0x%"PRIx64 ", offset 0x%"PRIx64,
>> + addr, size, val, offset);
>> + }
>> +
>> +}
>> +
>> +static inline uint64_t amd_iommu_get_perms(uint64_t entry)
>> +{
>> + return (entry & (IOMMU_DEV_PERM_READ | IOMMU_DEV_PERM_WRITE)) >>
>> + IOMMU_DEV_PERM_SHIFT;
>> +}
>> +
>> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int
>> devfn)
>> +{
>> + AMDIOMMUState *s = opaque;
>> + AMDIOMMUAddressSpace **iommu_as;
>> + int bus_num = pci_bus_num(bus);
>> +
>> + /* just in case */
>
> This comment troubles me, do we need the assert?
>
>> + assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
>
> bus_num < PCI_BUS_MAX, right ?
>
>> + assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
>
> same with devfn I suppose.
>
>> +
>> + iommu_as = s->address_spaces[bus_num];
>> +
>> + /* allocate memory during the first run */
>> + if (!iommu_as) {
>
> Why lazy init? We can do that at AMDIOMMUState init, right?
>
>> + iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) *
>> PCI_DEVFN_MAX);
>> + s->address_spaces[bus_num] = iommu_as;
>> + }
>> +
>> + /* set up IOMMU region */
>> + if (!iommu_as[devfn]) {
>> + iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
>
> same here
>
>> + iommu_as[devfn]->bus_num = (uint8_t)bus_num;
>> + iommu_as[devfn]->devfn = (uint8_t)devfn;
>> + iommu_as[devfn]->iommu_state = s;
>> +
>> + memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
>> + &s->iommu_ops, "amd-iommu",
>> UINT64_MAX);
>> + address_space_init(&iommu_as[devfn]->as,
>> &iommu_as[devfn]->iommu,
>> + "amd-iommu");
>> + }
>> + return &iommu_as[devfn]->as;
>> +}
>> +
>> +/* validate a page table entry */
>> +static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
>> + uint64_t *dte)
>> +{
>> + if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
>> + || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
>> + || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
>> + amd_iommu_log_illegaldevtab_error(s, devid,
>> + s->devtab + devid *
>> IOMMU_DEVTAB_ENTRY_SIZE, 0);
>> + return false;
>> + }
>> +
>> + return dte[0] & IOMMU_DEV_VALID && (dte[0] &
>> IOMMU_DEV_TRANSLATION_VALID)
>> + && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
>> +}
>> +
>> +/* get a device table entry given the devid */
>> +static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t
>> *entry)
>> +{
>> + uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
>> +
>> + IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
>> +
>> + if (dma_memory_read(&address_space_memory, s->devtab + offset,
>> entry,
>> + IOMMU_DEVTAB_ENTRY_SIZE)) {
>> + IOMMU_DPRINTF(MMU, "error: fail to access Device Entry
>> devtab 0x%"PRIx64
>> + "offset 0x%"PRIx32, s->devtab, offset);
>> + /* log ever accessing dte */
>> + amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
>> + return false;
>> + }
>> +
>> + if (!amd_iommu_validate_dte(s, devid, entry)) {
>> + IOMMU_DPRINTF(MMU,
>> + "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
>> + return false;
>> + }
>> +
>> + return true;
>> +}
>> +
>> +/* get pte translation mode */
>> +static inline uint8_t get_pte_translation_mode(uint64_t pte)
>> +{
>> + return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
>> +}
>> +
>> +static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
>> + IOMMUTLBEntry *ret, unsigned perms,
>> + hwaddr addr)
>> +{
>> + uint8_t level, oldlevel;
>> + unsigned present;
>> + uint64_t pte, pte_addr;
>> + uint64_t pte_perms;
>> + pte = dte[0];
>> +
>> + level = get_pte_translation_mode(pte);
>> +
>> + if (level >= 7 || level == 0) {
>> + IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 "
>> detected"
>> + "while translating 0x%"PRIx64, level, addr);
>> + return -1;
>> + }
>> +
>> + while (level > 0) {
>> + pte_perms = amd_iommu_get_perms(pte);
>> + present = pte & 1;
>> + if (!present || perms != (perms & pte_perms)) {
>> + amd_iommu_page_fault(as->iommu_state, as->devfn, addr,
>> perms);
>> + IOMMU_DPRINTF(MMU, "error: page fault accessing virtual
>> addr 0x%"
>> + PRIx64, addr);
>> + return -1;
>> + }
>> +
>> + /* go to the next lower level */
>> + pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
>> + /* add offset and load pte */
>> + pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
>> + pte = ldq_phys(&address_space_memory, pte_addr);
>> + oldlevel = level;
>> + level = get_pte_translation_mode(pte);
>> +
>> + /* PT is corrupted or not there */
>> + if (level != oldlevel - 1) {
>> + return -1;
>> + }
>> + }
>> +
>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>> + ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) &
>> IOMMU_PAGE_MASK_4K;
>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret->perm = IOMMU_RW;
>> + return 0;
>> +}
>> +
>> +/* TODO : Mark addresses as Accessed and Dirty */
>
> If you don't mark addresses as dirty, can't this cause the sporadic
> errors
> of arbitrary programs Jan talked about?
>
>> +static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr
>> addr,
>> + bool is_write, IOMMUTLBEntry *ret)
>> +{
>> + AMDIOMMUState *s = as->iommu_state;
>> + uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
>> + IOMMUIOTLBEntry *iotlb_entry;
>> + uint8_t err;
>> + uint64_t entry[4];
>> +
>> + /* try getting a cache entry first */
>> + iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
>> +
>> + if (iotlb_entry) {
>> + IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa
>> 0x%"PRIx64
>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid),
>> PCI_SLOT(devid),
>> + PCI_FUNC(devid), addr,
>> iotlb_entry->translated_addr);
>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>> + ret->translated_addr = iotlb_entry->translated_addr;
>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret->perm = iotlb_entry->perms;
>> + return;
>> + } else {
>
> you return from the if clause so you don't need the else
>
>> + if (!amd_iommu_get_dte(s, devid, entry)) {
>
> is not an error if you did not find the device id?
>
>> + goto out;
>> + }
>> +
>> + err = amd_iommu_page_walk(as, entry, ret,
>> + is_write ? IOMMU_PERM_WRITE :
>> IOMMU_PERM_READ,
>> + addr);
>> + if (err) {
>> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page
>> tables"
>> + " while translating addr 0x%"PRIx64, addr);
>> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
>> + goto out;
>> + }
>> +
>> + amd_iommu_update_iotlb(s, as->devfn, addr,
>> ret->translated_addr,
>> + ret->perm, entry[1] &
>> IOMMU_DEV_DOMID_ID_MASK);
>> + return;
>> + }
>> +
>> +out:
>> + ret->iova = addr;
>> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret->perm = IOMMU_RW;
>> + return;
>
> you don't need the above return
>
>> +}
>> +
>> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr
>> addr,
>> + bool is_write)
>> +{
>> + IOMMU_DPRINTF(GENERAL, "");
>> +
>> + AMDIOMMUAddressSpace *as = container_of(iommu,
>> AMDIOMMUAddressSpace, iommu);
>> + AMDIOMMUState *s = as->iommu_state;
>> +
>> + IOMMUTLBEntry ret = {
>> + .target_as = &address_space_memory,
>> + .iova = addr,
>> + .translated_addr = 0,
>> + .addr_mask = ~(hwaddr)0,
>> + .perm = IOMMU_NONE,
>> + };
>> +
>> + if (!s->enabled) {
>> + /* IOMMU disabled - corresponds to iommu=off not
>> + * failure to provide any parameter
>> + */
>> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
>> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
>> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
>> + ret.perm = IOMMU_RW;
>> + return ret;
>> + }
>> +
>> + amd_iommu_do_translate(as, addr, is_write, &ret);
>> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa
>> 0x%"PRIx64,
>> + as->bus_num, PCI_SLOT(as->devfn),
>> PCI_FUNC(as->devfn), addr,
>> + ret.translated_addr);
>> +
>> + return ret;
>> +}
>> +
>> +static const MemoryRegionOps mmio_mem_ops = {
>> + .read = amd_iommu_mmio_read,
>> + .write = amd_iommu_mmio_write,
>> + .endianness = DEVICE_LITTLE_ENDIAN,
>> + .impl = {
>> + .min_access_size = 1,
>> + .max_access_size = 8,
>> + .unaligned = false,
>> + },
>> + .valid = {
>> + .min_access_size = 1,
>> + .max_access_size = 8,
>> + }
>> +};
>> +
>> +static void amd_iommu_init(AMDIOMMUState *s)
>> +{
>> + printf("amd_iommu_init");
>
> you should use the debug macro here
>
>> +
>> + amd_iommu_iotlb_reset(s);
>> +
>> + s->iommu_ops.translate = amd_iommu_translate;
>> +
>> + s->devtab_len = 0;
>> + s->cmdbuf_len = 0;
>> + s->cmdbuf_head = 0;
>> + s->cmdbuf_tail = 0;
>> + s->evtlog_head = 0;
>> + s->evtlog_tail = 0;
>> + s->excl_enabled = false;
>> + s->excl_allow = false;
>> + s->mmio_enabled = false;
>> + s->enabled = false;
>> + s->ats_enabled = false;
>> + s->cmdbuf_enabled = false;
>> +
>> + /* reset MMIO */
>> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
>> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
>> + 0xffffffffffffffef, 0);
>> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
>> + /* reset device ident */
>> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
>> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
>> + pci_config_set_prog_interface(s->dev.config, 00);
>> + pci_config_set_class(s->dev.config, 0x0806);
>> +
>> + /* reset IOMMU specific capabilities */
>> + pci_set_long(s->dev.config + s->capab_offset,
>> IOMMU_CAPAB_FEATURES);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
>> + s->mmio.addr & ~(0xffff0000));
>> + pci_set_long(s->dev.config + s->capab_offset +
>> IOMMU_CAPAB_BAR_HIGH,
>> + (s->mmio.addr & ~(0xffff)) >> 16);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
>> + 0xff000000);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>> 0);
>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR |
>> IOMMU_MAX_VA_ADDR);
>
> All the capabilities are read-write? Otherwise you need to set the wmask
> to indicate what fields are writable.
Some bits are r/w but I don't think they are relevant for now - we could
just leave this a r/o
>
>> +}
>> +
>> +static void amd_iommu_reset(DeviceState *dev)
>> +{
>> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
>> +
>> + amd_iommu_init(s);
>> +}
>> +
>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>> +{
>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>> +
>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>> + amd_iommu_uint64_equal, g_free,
>> g_free);
>> +
>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>> + IOMMU_CAPAB_SIZE);
>> +
>> + /* add msi and hypertransport capabilities */
>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0,
>> IOMMU_CAPAB_REG_SIZE);
>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0,
>> IOMMU_CAPAB_REG_SIZE);
>> +
>> + amd_iommu_init(s);
>> +
>> + /* set up MMIO */
>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s,
>> "mmio",
>> + IOMMU_MMIO_SIZE);
>> +
>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>
> I don't understand why is need here. realize is called only once in
> the init process
> and you set it a few lines below.
>
>> + return;
>> + }
>> +
>> + s->mmio.addr = IOMMU_BASE_ADDR;
>> + memory_region_add_subregion(get_system_memory(),
>> IOMMU_BASE_ADDR, &s->mmio);
>> +}
>> +
>> +static const VMStateDescription vmstate_amd_iommu = {
>> + .name = "amd-iommu",
>> + .fields = (VMStateField[]) {
>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>> + VMSTATE_END_OF_LIST()
>> + }
>> +};
>> +
>> +static Property amd_iommu_properties[] = {
>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>> + DEFINE_PROP_END_OF_LIST(),
>> +};
>> +
>> +static void amd_iommu_uninit(PCIDevice *dev)
>> +{
>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>> + amd_iommu_iotlb_reset(s);
>
> at this point you also need to clean also the memory regions you use.
What exactly do you mean by clean up the memory regions ?
>
>> +}
>> +
>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>> +{
>> + DeviceClass *dc = DEVICE_CLASS(klass);
>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>> +
>> + k->realize = amd_iommu_realize;
>> + k->exit = amd_iommu_uninit;
>> +
>> + dc->reset = amd_iommu_reset;
>> + dc->vmsd = &vmstate_amd_iommu;
>> + dc->props = amd_iommu_properties;
>> +}
>> +
>> +static const TypeInfo amd_iommu = {
>> + .name = TYPE_AMD_IOMMU_DEVICE,
>> + .parent = TYPE_PCI_DEVICE,
>> + .instance_size = sizeof(AMDIOMMUState),
>> + .class_init = amd_iommu_class_init
>> +};
>> +
>> +static void amd_iommu_register_types(void)
>> +{
>> + type_register_static(&amd_iommu);
>> +}
>> +
>> +type_init(amd_iommu_register_types);
>> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
>> new file mode 100644
>> index 0000000..7d317e1
>> --- /dev/null
>> +++ b/hw/i386/amd_iommu.h
>> @@ -0,0 +1,395 @@
>> +/*
>> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
>> + *
>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>> + *
>> + * This program is free software; you can redistribute it and/or modify
>> + * it under the terms of the GNU General Public License as published by
>> + * the Free Software Foundation; either version 2 of the License, or
>> + * (at your option) any later version.
>> +
>> + * This program is distributed in the hope that it will be useful,
>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>> + * GNU General Public License for more details.
>> +
>> + * You should have received a copy of the GNU General Public License
>> along
>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>> + */
>> +
>> +#ifndef AMD_IOMMU_H_
>> +#define AMD_IOMMU_H_
>> +
>> +#include "hw/hw.h"
>> +#include "hw/pci/pci.h"
>> +#include "hw/pci/msi.h"
>> +#include "hw/sysbus.h"
>> +#include "sysemu/dma.h"
>> +
>> +/* Capability registers */
>> +#define IOMMU_CAPAB_HEADER 0x00
>> +#define IOMMU_CAPAB_REV_TYPE 0x02
>> +#define IOMMU_CAPAB_FLAGS 0x03
>> +#define IOMMU_CAPAB_BAR_LOW 0x04
>> +#define IOMMU_CAPAB_BAR_HIGH 0x08
>> +#define IOMMU_CAPAB_RANGE 0x0C
>> +#define IOMMU_CAPAB_MISC 0x10
>> +#define IOMMU_CAPAB_MISC1 0x14
>> +
>> +#define IOMMU_CAPAB_SIZE 0x18
>> +#define IOMMU_CAPAB_REG_SIZE 0x04
>> +
>> +/* Capability header data */
>> +#define IOMMU_CAPAB_ID_SEC 0xf
>> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
>> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
>> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
>> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
>> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
>> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
>> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
>> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV |
>> IOMMU_CAPAB_TYPE)
>> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
>> + IOMMU_CAPAB_FLAG_HTTUNNEL)
>> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
>> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
>> +
>> +/* MMIO registers */
>> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
>> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
>> +#define IOMMU_MMIO_EVENT_BASE 0x0010
>> +#define IOMMU_MMIO_CONTROL 0x0018
>> +#define IOMMU_MMIO_EXCL_BASE 0x0020
>> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
>> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
>> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
>> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
>> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
>> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
>> +#define IOMMU_MMIO_STATUS 0x2020
>> +#define IOMMU_MMIO_PPR_BASE 0x0038
>> +#define IOMMU_MMIO_PPR_HEAD 0x2030
>> +#define IOMMU_MMIO_PPR_TAIL 0x2038
>> +
>> +#define IOMMU_MMIO_SIZE 0x4000
>> +
>> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
>> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
>> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
>> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
>> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
>> +
>> +/* some of this are similar but just for readability */
>> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
>> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
>> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
>> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +
>> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
>> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
>> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
>> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +
>> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
>> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
>> +
>> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
>> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
>> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
>> +
>> +/* mmio control register flags */
>> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
>> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
>> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
>> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
>> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
>> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
>> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
>> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
>> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
>> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
>> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
>> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
>> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
>> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
>> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
>> +
>> +/* MMIO status register bits */
>> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
>> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
>> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
>> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
>> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
>> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
>> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
>> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
>> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
>> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
>> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
>> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
>> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
>> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
>> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
>> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
>> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
>> +
>> +#define IOMMU_CMDBUF_ID_BYTE 0x07
>> +#define IOMMU_CMDBUF_ID_RSHIFT 4
>> +
>> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
>> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
>> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
>> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
>> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
>> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
>> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
>> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
>> +
>> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
>> +
>> +/* Device table entry bits 0:63 */
>> +#define IOMMU_DEV_VALID (1ULL << 0)
>> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
>> +#define IOMMU_DEV_MODE_MASK 0x7
>> +#define IOMMU_DEV_MODE_RSHIFT 9
>> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
>> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
>> +#define IOMMU_DEV_PERM_SHIFT 61
>> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
>> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
>> +
>> +/* Device table entry bits 64:127 */
>> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
>> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
>> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
>> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
>> +#define IOMMU_DEV_IOCTL_MASK (~3)
>> +#define IOMMU_DEV_IOCTL_RSHIFT 20
>> +#define IOMMU_DEV_IOCTL_DENY 0
>> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
>> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
>> +#define IOMMU_DEV_CACHE (1ULL << 37)
>> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
>> +#define IOMMU_DEV_EXCL (1ULL << 39)
>> +
>> +/* Event codes and flags, as stored in the info field */
>> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
>> +#define IOMMU_EVENT_IOPF (0x2U << 12)
>> +#define IOMMU_EVENT_IOPF_I (1U << 3)
>> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
>> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
>> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
>> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
>> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
>> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
>> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
>> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
>> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
>> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
>> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
>> +
>> +#define IOMMU_EVENT_LEN 16
>> +#define IOMMU_PERM_READ (1 << 0)
>> +#define IOMMU_PERM_WRITE (1 << 1)
>> +#define IOMMU_PERM_RW (IOMMU_PERM_READ |
>> IOMMU_PERM_WRITE)
>> +
>> +/* AMD RD890 Chipset */
>> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
>
> We keep the pci ids in include/hw/pci/pci_ids.h
>
>> +
>> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
>> +#define IOMMU_FEATURE_PPR (1ULL << 1)
>> +#define IOMMU_FEATURE_NX (1ULL << 3)
>> +#define IOMMU_FEATURE_GT (1ULL << 4)
>> +#define IOMMU_FEATURE_IA (1ULL << 6)
>> +#define IOMMU_FEATURE_GA (1ULL << 7)
>> +#define IOMMU_FEATURE_HE (1ULL << 8)
>> +#define IOMMU_FEATURE_PC (1ULL << 9)
>> +
>> +/* reserved DTE bits */
>> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
>> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
>> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
>> +
>> +/* IOMMU paging mode */
>> +#define IOMMU_GATS_MODE (6ULL << 12)
>> +#define IOMMU_HATS_MODE (6ULL << 10)
>> +
>> +/* PCI SIG constants */
>> +#define PCI_BUS_MAX 256
>> +#define PCI_SLOT_MAX 32
>> +#define PCI_FUNC_MAX 8
>> +#define PCI_DEVFN_MAX 256
>
> Maybe we can move the PCI macros to include/hw/pci/pci.h, those are
> not IOMMU specific.
>
>> +
>> +/* IOTLB */
>> +#define IOMMU_IOTLB_MAX_SIZE 1024
>> +#define IOMMU_DEVID_SHIFT 36
>> +
>> +/* extended feature support */
>> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH |
>> IOMMU_FEATURE_PPR | \
>> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
>> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
>> + IOMMU_HATS_MODE)
>> +
>> +/* capabilities header */
>> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
>> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
>> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
>> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
>> +
>> +/* command constants */
>> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
>> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
>> +#define IOMMU_COM_COMPLETION_INTR 0x2
>> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
>> +#define IOMMU_COMMAND_SIZE 0x10
>> +
>> +/* IOMMU default address */
>> +#define IOMMU_BASE_ADDR 0xfed80000
>> +
>> +/* page management constants */
>> +#define IOMMU_PAGE_SHIFT 12
>> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
>> +
>> +#define IOMMU_PAGE_SHIFT_4K 12
>> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
>> +#define IOMMU_PAGE_SHIFT_2M 21
>> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
>> +#define IOMMU_PAGE_SHIFT_1G 30
>> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
>> +
>> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
>> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
>> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
>> +
>> +/* invalidation command device id */
>> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
>> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL <<
>> IOMMU_INVAL_DEV_ID_SHIFT) - 1))
>> +
>> +/* invalidation address */
>> +#define IOMMU_INVAL_ADDR_MASK_SHIFT 12
>> +#define IOMMU_INVAL_ADDR_MASK (~((1UL <<
>> IOMMU_INVAL_ADDR_MASK_SHIFT) - 1))
>> +
>> +/* invalidation S bit mask */
>> +#define IOMMU_INVAL_ALL(val) ((val) & (0x1))
>> +
>> +/* reserved bits */
>> +#define IOMMU_COMPLETION_WAIT_RSVD 0x0ff000000
>> +#define IOMMU_CMD_INVAL_DEV_RSVD 0xffff00000fffffff
>> +#define IOMMU_INVAL_IOMMU_PAGES_RSVD 0xfff000000fff0000
>> +#define IOMMU_INVAL_IOTLB_PAGES_RSVD 0x00000ff4
>> +#define IOMMU_INVAL_INTR_TABLE_RSVD 0xffff00000fffffff
>> +#define IOMMU_PRF_IOMMU_PAGES_RSVD 0x00ff00000ff00000
>> +#define IOMMU_COMPLETE_PPR_RQ_RSVD 0xffff00000ff00000
>> +#define IOMMU_INVAL_IOMMU_ALL_RSVD 0x0fffffff00000000
>> +
>> +/* command masks - inval iommu pages */
>> +#define IOMMU_INVAL_PAGES_PASID (~((1UL << 20) - 1))
>> +#define IOMMU_INVAL_PAGES_DOMID (((1UL << 16) - 1) << 32)
>> +#define IOMMU_INVAL_PAGES_ADDRESS (~((1UL << 12) - 1))
>> +#define IOMMU_INVAL_PAGES_SBIT (1UL << 0)
>> +#define IOMMU_INVAL_PAGES_PDE (1UL << 1)
>> +#define IOMMU_INVAL_PAGES_GN (1UL << 2)
>> +
>> +/* masks - inval iotlb pages */
>> +#define IOMMU_INVAL_IOTLB_DEVID (~((1UL << 16) - 1))
>> +#define IOMMU_INVAL_IOTLB_PASID_LOW (0xff << 15)
>> +#define IOMMU_INVAL_IOTLB_MAXPEND (0xff << 23)
>> +#define IOMMU_INVAL_IOTLB_QUEUEID (~((1UL << 16) - 1))
>> +#define IOMMU_INVAL_IOTLB_PASID_HIGH (0xff << 46)
>> +#define IOMMU_INVAL_IOTLB_GN IOMMU_INVAL_PAGES_GN
>> +#define IOMMU_INVAL_IOTLB_S IOMMU_INVAL_PAGES_S
>> +#define IOMMU_INVAL_IOTLB_ADDRESS IOMMU_INVAL_PAGES_ADDRESS
>> +#define IOMMU_INVAL_IOTLB_MAKEPASID(low, high)
>> +
>> +/* masks - prefetch pages */
>> +#define IOMMU_PREFETCH_PAGES_DEVID IOMMU_INVAL_IOTLB_DEVID
>> +#define IOMMU_PREFETCH_PAGES_PFCOUNT IOMMU_INVAL_IOTLB_MAXPEND
>> +
>> +#define TYPE_AMD_IOMMU_DEVICE "amd-iommu"
>> +#define AMD_IOMMU_DEVICE(obj)\
>> + OBJECT_CHECK(AMDIOMMUState, (obj), TYPE_AMD_IOMMU_DEVICE)
>> +
>> +#define AMD_IOMMU_STR "amd"
>> +
>> +typedef struct AMDIOMMUAddressSpace AMDIOMMUAddressSpace;
>> +
>> +typedef struct AMDIOMMUState {
>> + PCIDevice dev; /* The PCI device itself */
>> +
>> + uint32_t version;
>> +
>> + uint32_t capab_offset; /* capability offset pointer */
>> + uint64_t mmio_addr;
>> + uint8_t *capab; /* capabilities registers */
>> +
>> + bool enabled; /* IOMMU enabled */
>> + bool ats_enabled; /* address translation enabled */
>> + bool cmdbuf_enabled; /* command buffer enabled */
>> + bool evtlog_enabled; /* event log enabled */
>> + bool excl_enabled;
>> +
>> + dma_addr_t devtab; /* base address device table */
>> + size_t devtab_len; /* device table length */
>> +
>> + dma_addr_t cmdbuf; /* command buffer base address */
>> + uint64_t cmdbuf_len; /* command buffer length */
>> + uint32_t cmdbuf_head; /* current IOMMU read position */
>> + uint32_t cmdbuf_tail; /* next Software write position */
>> + bool completion_wait_intr;
>> +
>> + dma_addr_t evtlog; /* base address event log */
>> + bool evtlog_intr;
>> + uint32_t evtlog_len; /* event log length */
>> + uint32_t evtlog_head; /* current IOMMU write position */
>> + uint32_t evtlog_tail; /* current Software read position */
>> +
>> + /* unused for now */
>
> I suggest what is not used to remove for now
>
>> + dma_addr_t excl_base; /* base DVA - IOMMU exclusion range */
>> + dma_addr_t excl_limit; /* limit of IOMMU exclusion range */
>> + bool excl_allow; /* translate accesses to the
>> exclusion range */
>> + bool excl_enable; /* exclusion range enabled */
>> +
>> + dma_addr_t ppr_log; /* base address ppr log */
>> + uint32_t pprlog_len; /* ppr log len */
>> + uint32_t pprlog_head; /* ppr log head */
>> + uint32_t pprlog_tail; /* ppr log tail */
>> +
>> + MemoryRegion mmio; /* MMIO region */
>> + uint8_t mmior[IOMMU_MMIO_SIZE]; /* read/write
>> MMIO */
>> + uint8_t w1cmask[IOMMU_MMIO_SIZE]; /* read/write 1 clear
>> mask */
>> + uint8_t romask[IOMMU_MMIO_SIZE]; /* MMIO read/only
>> mask */
>> + bool mmio_enabled;
>> +
>> + /* IOMMU function */
>> + MemoryRegionIOMMUOps iommu_ops;
>> +
>> + /* for each served device */
>> + AMDIOMMUAddressSpace **address_spaces[PCI_BUS_MAX];
>> +
>> + /* IOTLB */
>> + GHashTable *iotlb;
>> +} AMDIOMMUState;
>> +
>> +/*
>> + * bridge_host_amd_iommu: setup an IOMMU function on a bus
>> + *
>> + * called for all PCI devices
>> + *
>> + * @bus: PCI bus to host the IOMMU
>> + * @opaque: opaque pointer to AMDIOMMUState struct
>> + * @defvn: PCI function of device for which to setup IOMMU region for
>> + *
>> + */
>> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int
>> devfn);
>> +
>> +#endif
>> diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
>> index dedf277..61deace 100644
>> --- a/include/hw/pci/pci.h
>> +++ b/include/hw/pci/pci.h
>> @@ -15,6 +15,8 @@
>>
>> /* PCI bus */
>>
>> +#define PCI_BUS_NUM(x) (((x) >> 8) & 0xff)
>> +#define PCI_DEVID(bus, devfn) ((((uint16_t)(bus)) << 8) | (devfn))
>> #define PCI_DEVFN(slot, func) ((((slot) & 0x1f) << 3) | ((func) &
>> 0x07))
>> #define PCI_SLOT(devfn) (((devfn) >> 3) & 0x1f)
>> #define PCI_FUNC(devfn) ((devfn) & 0x07)
>>
>
>
> Thanks,
> Marcel
>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties
2016-02-21 20:09 ` Jan Kiszka
@ 2016-03-02 20:51 ` David Kiarie
2016-03-03 9:28 ` Marcel Apfelbaum
0 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-02 20:51 UTC (permalink / raw)
To: Jan Kiszka, qemu-devel; +Cc: marcel, valentine.sinitsyn, mst
On 21/02/16 23:09, Jan Kiszka wrote:
> On 2016-02-21 19:10, David Kiarie wrote:
>> diff --git a/qemu-options.hx b/qemu-options.hx
>> index 2f0465e..dad160f 100644
>> --- a/qemu-options.hx
>> +++ b/qemu-options.hx
>> @@ -38,7 +38,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
>> " kvm_shadow_mem=size of KVM shadow MMU\n"
>> " dump-guest-core=on|off include guest memory in a core dump (default=on)\n"
>> " mem-merge=on|off controls memory merge support (default: on)\n"
>> - " iommu=on|off controls emulated Intel IOMMU (VT-d) support (default=off)\n"
>> + " iommu=amd|intel enables and selects the emulated IOMMU (default: off)\n"
> We should also support "iommu=off" or "none" to explicitly disable it.
> That is consistent with other switches, and maybe there will once be a
> machine type (chipset) with IOMMU enabled by default.
We could have such but this will not be referenced anywhere in the code
as the IOMMU is 'off' by default. Most of the other such switches relate
to properties that are 'on' by default.
>
> Jan
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-01 13:48 ` Jan Kiszka
2016-03-01 13:55 ` Michael S. Tsirkin
2016-03-01 14:00 ` Jan Kiszka
@ 2016-03-02 21:17 ` David Kiarie
2016-03-02 21:32 ` Michael S. Tsirkin
2 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-02 21:17 UTC (permalink / raw)
To: Jan Kiszka, Michael S. Tsirkin; +Cc: marcel, valentine.sinitsyn, qemu-devel
On 01/03/16 16:48, Jan Kiszka wrote:
> On 2016-03-01 14:07, Michael S. Tsirkin wrote:
>> On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
>>> Hello there,
>>>
>>> Repost, AMD IOMMU patches version 6.
>>>
>>> Changes since version 5
>>> -Fixed macro formating issues
>>> -changed occurences of IO MMU to IOMMU for consistency
>>> -Fixed capability registers duplication
>>> -Rebased to current master
>>>
>>> David Kiarie (4):
>>> hw/i386: Introduce AMD IOMMU
>>> hw/core: Add AMD IOMMU to machine properties
>>> hw/i386: ACPI table for AMD IOMMU
>>> hw/pci-host: Emulate AMD IOMMU
>> I went over AMD IOMMU spec.
>> I'm concerned that it appears that there's no chance for it to
>> work correctly if host caches invalid PTE entries.
>>
>> The spec vaguely discusses write-protecting such PTEs but
>> that would be very complex if it can be made to work at all.
>>
>> This means that this can't work with e.g. VFIO.
>> It can only work with emulated devices.
> You mean it can't work if we program a real IOMMU (for VFIO) with
> translated data from the emulated one but cannot track any updates of
> the related page tables because the guest is not required to issue
> traceable flush requests? Hmm, too bad.
>
>> OTOH VTD can easily support PTE shadowing by setting a flag.
> Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
> implementations are expected to NOT require explicit software flushing
> of write buffers and report RWBF=0 in the Capability register", we may
> eventually run into guests that no longer check that flag if we expose
> something that looks like a "newer" implementation.
>
> However, this flag is not set right now in our VT-d model.
>
>> I'd like us to find some way to avoid possibility
>> of user error creating a configuration mixing e.g.
>> vfio with the amd iommu.
>>
>> I'm not sure how to do this.
>>
>> Any idea?
> There is likely no way around write-protecting the IOMMU page tables (in
> KVM mode) once we evaluated and cached them somewhere. For now, I would
> simply deny vfio while an IOMMU is active on x86.
Should I implement this, in the meantime ?
>
> Jan
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
[not found] ` <56D75688.1020500@gmail.com>
@ 2016-03-02 21:17 ` Michael S. Tsirkin
2016-03-02 22:04 ` David Kiarie
0 siblings, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-02 21:17 UTC (permalink / raw)
To: David Kiarie; +Cc: Marcel Apfelbaum, valentine.sinitsyn, jan.kiszka, qemu-devel
On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>
>
> On 22/02/16 14:22, Marcel Apfelbaum wrote:
> >On 02/21/2016 08:11 PM, David Kiarie wrote:
> >>Add AMD IOMMU emulation support to q35 chipset
> >>
> >>Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> >>---
> >> hw/pci-host/piix.c | 1 +
> >> hw/pci-host/q35.c | 14 ++++++++++++--
> >> include/hw/i386/intel_iommu.h | 1 +
> >> 3 files changed, 14 insertions(+), 2 deletions(-)
> >>
> >>diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
> >>index 41aa66f..ab2e24a 100644
> >>--- a/hw/pci-host/piix.c
> >>+++ b/hw/pci-host/piix.c
> >>@@ -36,6 +36,7 @@
> >> #include "hw/i386/ioapic.h"
> >> #include "qapi/visitor.h"
> >> #include "qemu/error-report.h"
> >>+#include "hw/i386/amd_iommu.h"
> >
> >Hi,
> >
> >I think you don't need this include anymore.
> >
> >>
> >> /*
> >> * I440FX chipset data sheet.
> >>diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> >>index 115fb8c..355fb32 100644
> >>--- a/hw/pci-host/q35.c
> >>+++ b/hw/pci-host/q35.c
> >>@@ -31,6 +31,7 @@
> >> #include "hw/hw.h"
> >> #include "hw/pci-host/q35.h"
> >> #include "qapi/visitor.h"
> >>+#include "hw/i386/amd_iommu.h"
> >>
> >>/****************************************************************************
> >> * Q35 host
> >>@@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
> >> mch->pci_address_space, &mch->pam_regions[i+1],
> >> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
> >> }
> >>- /* Intel IOMMU (VT-d) */
> >>- if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
> >>+
> >>+ if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
> >>== 0) {
> >>+ /* Intel IOMMU (VT-d) */
> >> mch_init_dmar(mch);
> >>+ } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
> >>AMD_IOMMU_STR)
> >>+ == 0) {
> >>+ AMDIOMMUState *iommu_state;
> >>+ PCIDevice *iommu;
> >>+ PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
> >>+ iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
Pls don't hardcode paths like this. Set addr property instead.
> >>+ iommu_state = AMD_IOMMU_DEVICE(iommu);
> >>+ pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
> >
> >pci_setup_iommu third parameter is void*, so you don't need to cast to
> >AMDIOMMUState
> >before passing it.
>
> This include is necessary for the definition of "AMD_IOMMU_STR" either way
> so am leaving this as is.
This option parsing is just too ugly.
Looks like it was a mistake to support the iommu
machine property, but I see no reason to add to the
existing mess.
Can't users create iommu with -device amd-iommu ?
It's necessary if we are to support multiple IOMMUs, anyway.
> >
> >Thanks,
> >Marcel
> >
> >> }
> >> }
> >>
> >>diff --git a/include/hw/i386/intel_iommu.h
> >>b/include/hw/i386/intel_iommu.h
> >>index b024ffa..539530c 100644
> >>--- a/include/hw/i386/intel_iommu.h
> >>+++ b/include/hw/i386/intel_iommu.h
> >>@@ -27,6 +27,7 @@
> >> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
> >> #define INTEL_IOMMU_DEVICE(obj) \
> >> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
> >>+#define INTEL_IOMMU_STR "intel"
> >>
> >> /* DMAR Hardware Unit Definition address (IOMMU unit) */
> >> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
> >>
> >
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 0/4] AMD IOMMU
2016-03-02 21:17 ` David Kiarie
@ 2016-03-02 21:32 ` Michael S. Tsirkin
0 siblings, 0 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-02 21:32 UTC (permalink / raw)
To: David Kiarie; +Cc: marcel, Jan Kiszka, valentine.sinitsyn, qemu-devel
On Thu, Mar 03, 2016 at 12:17:27AM +0300, David Kiarie wrote:
>
>
> On 01/03/16 16:48, Jan Kiszka wrote:
> >On 2016-03-01 14:07, Michael S. Tsirkin wrote:
> >>On Sun, Feb 21, 2016 at 09:10:56PM +0300, David Kiarie wrote:
> >>>Hello there,
> >>>
> >>>Repost, AMD IOMMU patches version 6.
> >>>
> >>>Changes since version 5
> >>> -Fixed macro formating issues
> >>> -changed occurences of IO MMU to IOMMU for consistency
> >>> -Fixed capability registers duplication
> >>> -Rebased to current master
> >>>
> >>>David Kiarie (4):
> >>> hw/i386: Introduce AMD IOMMU
> >>> hw/core: Add AMD IOMMU to machine properties
> >>> hw/i386: ACPI table for AMD IOMMU
> >>> hw/pci-host: Emulate AMD IOMMU
> >>I went over AMD IOMMU spec.
> >>I'm concerned that it appears that there's no chance for it to
> >>work correctly if host caches invalid PTE entries.
> >>
> >>The spec vaguely discusses write-protecting such PTEs but
> >>that would be very complex if it can be made to work at all.
> >>
> >>This means that this can't work with e.g. VFIO.
> >>It can only work with emulated devices.
> >You mean it can't work if we program a real IOMMU (for VFIO) with
> >translated data from the emulated one but cannot track any updates of
> >the related page tables because the guest is not required to issue
> >traceable flush requests? Hmm, too bad.
> >
> >>OTOH VTD can easily support PTE shadowing by setting a flag.
> >Do you mean RWBF=1 in the CAP register? Given that "Newer hardware
> >implementations are expected to NOT require explicit software flushing
> >of write buffers and report RWBF=0 in the Capability register", we may
> >eventually run into guests that no longer check that flag if we expose
> >something that looks like a "newer" implementation.
> >
> >However, this flag is not set right now in our VT-d model.
> >
> >>I'd like us to find some way to avoid possibility
> >>of user error creating a configuration mixing e.g.
> >>vfio with the amd iommu.
> >>
> >>I'm not sure how to do this.
> >>
> >>Any idea?
> >There is likely no way around write-protecting the IOMMU page tables (in
> >KVM mode) once we evaluated and cached them somewhere. For now, I would
> >simply deny vfio while an IOMMU is active on x86.
> Should I implement this, in the meantime ?
Why not :)
> >
> >Jan
> >
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-02 21:17 ` Michael S. Tsirkin
@ 2016-03-02 22:04 ` David Kiarie
2016-03-03 9:49 ` Michael S. Tsirkin
0 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-02 22:04 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com> wrote:
> On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>>
>>
>> On 22/02/16 14:22, Marcel Apfelbaum wrote:
>> >On 02/21/2016 08:11 PM, David Kiarie wrote:
>> >>Add AMD IOMMU emulation support to q35 chipset
>> >>
>> >>Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> >>---
>> >> hw/pci-host/piix.c | 1 +
>> >> hw/pci-host/q35.c | 14 ++++++++++++--
>> >> include/hw/i386/intel_iommu.h | 1 +
>> >> 3 files changed, 14 insertions(+), 2 deletions(-)
>> >>
>> >>diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>> >>index 41aa66f..ab2e24a 100644
>> >>--- a/hw/pci-host/piix.c
>> >>+++ b/hw/pci-host/piix.c
>> >>@@ -36,6 +36,7 @@
>> >> #include "hw/i386/ioapic.h"
>> >> #include "qapi/visitor.h"
>> >> #include "qemu/error-report.h"
>> >>+#include "hw/i386/amd_iommu.h"
>> >
>> >Hi,
>> >
>> >I think you don't need this include anymore.
>> >
>> >>
>> >> /*
>> >> * I440FX chipset data sheet.
>> >>diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>> >>index 115fb8c..355fb32 100644
>> >>--- a/hw/pci-host/q35.c
>> >>+++ b/hw/pci-host/q35.c
>> >>@@ -31,6 +31,7 @@
>> >> #include "hw/hw.h"
>> >> #include "hw/pci-host/q35.h"
>> >> #include "qapi/visitor.h"
>> >>+#include "hw/i386/amd_iommu.h"
>> >>
>> >>/****************************************************************************
>> >> * Q35 host
>> >>@@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
>> >> mch->pci_address_space, &mch->pam_regions[i+1],
>> >> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
>> >> }
>> >>- /* Intel IOMMU (VT-d) */
>> >>- if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
>> >>+
>> >>+ if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
>> >>== 0) {
>> >>+ /* Intel IOMMU (VT-d) */
>> >> mch_init_dmar(mch);
>> >>+ } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>> >>AMD_IOMMU_STR)
>> >>+ == 0) {
>> >>+ AMDIOMMUState *iommu_state;
>> >>+ PCIDevice *iommu;
>> >>+ PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>> >>+ iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
>
> Pls don't hardcode paths like this. Set addr property instead.
>
>> >>+ iommu_state = AMD_IOMMU_DEVICE(iommu);
>> >>+ pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>> >
>> >pci_setup_iommu third parameter is void*, so you don't need to cast to
>> >AMDIOMMUState
>> >before passing it.
>>
>> This include is necessary for the definition of "AMD_IOMMU_STR" either way
>> so am leaving this as is.
>
> This option parsing is just too ugly.
>
> Looks like it was a mistake to support the iommu
> machine property, but I see no reason to add to the
> existing mess.
>
> Can't users create iommu with -device amd-iommu ?
You mean getting rid of the above code and starting device with
'-device amd-iommu' ? This way am not able to setup IOMMU regions for
devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
sets up IOMMU region for IOMMU only. Calling this from the bus sets up
IOMMU regions for all devices though.
I need to setup IOMMU regions for all devices from the bus, to be able
to do that I need to have created the IOMMU device first.
>
> It's necessary if we are to support multiple IOMMUs, anyway.
>
>> >
>> >Thanks,
>> >Marcel
>> >
>> >> }
>> >> }
>> >>
>> >>diff --git a/include/hw/i386/intel_iommu.h
>> >>b/include/hw/i386/intel_iommu.h
>> >>index b024ffa..539530c 100644
>> >>--- a/include/hw/i386/intel_iommu.h
>> >>+++ b/include/hw/i386/intel_iommu.h
>> >>@@ -27,6 +27,7 @@
>> >> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>> >> #define INTEL_IOMMU_DEVICE(obj) \
>> >> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
>> >>+#define INTEL_IOMMU_STR "intel"
>> >>
>> >> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>> >> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>> >>
>> >
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties
2016-03-02 20:51 ` David Kiarie
@ 2016-03-03 9:28 ` Marcel Apfelbaum
0 siblings, 0 replies; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-03-03 9:28 UTC (permalink / raw)
To: David Kiarie, Jan Kiszka, qemu-devel; +Cc: valentine.sinitsyn, mst
On 03/02/2016 10:51 PM, David Kiarie wrote:
>
>
> On 21/02/16 23:09, Jan Kiszka wrote:
>> On 2016-02-21 19:10, David Kiarie wrote:
>>> diff --git a/qemu-options.hx b/qemu-options.hx
>>> index 2f0465e..dad160f 100644
>>> --- a/qemu-options.hx
>>> +++ b/qemu-options.hx
>>> @@ -38,7 +38,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
>>> " kvm_shadow_mem=size of KVM shadow MMU\n"
>>> " dump-guest-core=on|off include guest memory in a core dump (default=on)\n"
>>> " mem-merge=on|off controls memory merge support (default: on)\n"
>>> - " iommu=on|off controls emulated Intel IOMMU (VT-d) support (default=off)\n"
>>> + " iommu=amd|intel enables and selects the emulated IOMMU (default: off)\n"
>> We should also support "iommu=off" or "none" to explicitly disable it.
>> That is consistent with other switches, and maybe there will once be a
>> machine type (chipset) with IOMMU enabled by default.
>
> We could have such but this will not be referenced anywhere in the code as the IOMMU is 'off' by default. Most of the other such switches relate to properties that are 'on' by default.
It doesn't matter if is not used, some management systems would prefer to pass an "off" value rather than not adding the property.
Also you need a default value. Even in the description you mention it as "off".
Thanks,
Marcel
>
>>
>> Jan
>>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-03-02 4:00 ` David Kiarie
2016-03-02 4:08 ` David Kiarie
@ 2016-03-03 9:34 ` Marcel Apfelbaum
1 sibling, 0 replies; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-03-03 9:34 UTC (permalink / raw)
To: David Kiarie
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers, Michael S. Tsirkin
On 03/02/2016 06:00 AM, David Kiarie wrote:
> On Fri, Feb 26, 2016 at 9:23 AM, David Kiarie <davidkiarie4@gmail.com> wrote:
>> On Thu, Feb 25, 2016 at 6:43 PM, Marcel Apfelbaum <marcel@redhat.com> wrote:
>>> On 02/21/2016 08:10 PM, David Kiarie wrote:
>>>>
>>>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>>>> The IOMMU does basic translation, error checking and has a
>>>> mininal IOTLB implementation
>>>
>>>
>>> Hi,
>>>
>>>>
>>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>>> ---
>>>> hw/i386/Makefile.objs | 1 +
>>>> hw/i386/amd_iommu.c | 1432
>>>> +++++++++++++++++++++++++++++++++++++++++++++++++
>>>> hw/i386/amd_iommu.h | 395 ++++++++++++++
>>>> include/hw/pci/pci.h | 2 +
>>>> 4 files changed, 1830 insertions(+)
>>>> create mode 100644 hw/i386/amd_iommu.c
>>>> create mode 100644 hw/i386/amd_iommu.h
>>>>
[...]
>>>> +
>>>> +AddressSpace *bridge_host_amd_iommu(PCIBus *bus, void *opaque, int devfn)
>>>> +{
>>>> + AMDIOMMUState *s = opaque;
>>>> + AMDIOMMUAddressSpace **iommu_as;
>>>> + int bus_num = pci_bus_num(bus);
>>>> +
>>>> + /* just in case */
>>>
>>>
>>> This comment troubles me, do we need the assert?
>
> In case the bus_num or devfn is invalid. Anyway, I could get of rid of
> this assert.
>
>>>
>>>> + assert(0 <= bus_num && bus_num <= PCI_BUS_MAX);
>>>
>>>
>>> bus_num < PCI_BUS_MAX, right ?
>>>
>>>> + assert(0 <= devfn && devfn <= PCI_DEVFN_MAX);
>>>
>>>
>>> same with devfn I suppose.
>>>
>>>> +
>>>> + iommu_as = s->address_spaces[bus_num];
>>>> +
>>>> + /* allocate memory during the first run */
>>>> + if (!iommu_as) {
>>>
>>>
>>> Why lazy init? We can do that at AMDIOMMUState init, right?
>
> This code has to be called for all emulated devices when the bus is
> initialized. If you have it on AMDIOMMUState init - it will only be
> called for one or two devices already initiliazed.
I was talking about the allocation, not the method.
You can make the allocations on init/realize so you don't need the
if (!iommu_as) {
iommu_as = g_malloc0(...
Thanks,
Marcel
>
>>>
>>>> + iommu_as = g_malloc0(sizeof(AMDIOMMUAddressSpace *) *
>>>> PCI_DEVFN_MAX);
>>>> + s->address_spaces[bus_num] = iommu_as;
>>>> + }
>>>> +
>>>> + /* set up IOMMU region */
>>>> + if (!iommu_as[devfn]) {
>>>> + iommu_as[devfn] = g_malloc0(sizeof(AMDIOMMUAddressSpace));
>>>
>>>
>>> same here
>>>
>>>> + iommu_as[devfn]->bus_num = (uint8_t)bus_num;
>>>> + iommu_as[devfn]->devfn = (uint8_t)devfn;
>>>> + iommu_as[devfn]->iommu_state = s;
>>>> +
>>>> + memory_region_init_iommu(&iommu_as[devfn]->iommu, OBJECT(s),
>>>> + &s->iommu_ops, "amd-iommu", UINT64_MAX);
>>>> + address_space_init(&iommu_as[devfn]->as, &iommu_as[devfn]->iommu,
>>>> + "amd-iommu");
>>>> + }
>>>> + return &iommu_as[devfn]->as;
>>>> +}
>>>> +
>>>> +/* validate a page table entry */
>>>> +static bool amd_iommu_validate_dte(AMDIOMMUState *s, uint16_t devid,
>>>> + uint64_t *dte)
>>>> +{
>>>> + if ((dte[0] & IOMMU_DTE_LOWER_QUAD_RESERVED)
>>>> + || (dte[1] & IOMMU_DTE_MIDDLE_QUAD_RESERVED)
>>>> + || (dte[2] & IOMMU_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
>>>> + amd_iommu_log_illegaldevtab_error(s, devid,
>>>> + s->devtab + devid *
>>>> IOMMU_DEVTAB_ENTRY_SIZE, 0);
>>>> + return false;
>>>> + }
>>>> +
>>>> + return dte[0] & IOMMU_DEV_VALID && (dte[0] &
>>>> IOMMU_DEV_TRANSLATION_VALID)
>>>> + && (dte[0] & IOMMU_DEV_PT_ROOT_MASK);
>>>> +}
>>>> +
>>>> +/* get a device table entry given the devid */
>>>> +static bool amd_iommu_get_dte(AMDIOMMUState *s, int devid, uint64_t
>>>> *entry)
>>>> +{
>>>> + uint32_t offset = devid * IOMMU_DEVTAB_ENTRY_SIZE;
>>>> +
>>>> + IOMMU_DPRINTF(MMU, "Device Table at 0x%"PRIx64, s->devtab);
>>>> +
>>>> + if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
>>>> + IOMMU_DEVTAB_ENTRY_SIZE)) {
>>>> + IOMMU_DPRINTF(MMU, "error: fail to access Device Entry devtab
>>>> 0x%"PRIx64
>>>> + "offset 0x%"PRIx32, s->devtab, offset);
>>>> + /* log ever accessing dte */
>>>> + amd_iommu_log_devtab_error(s, devid, s->devtab + offset, 0);
>>>> + return false;
>>>> + }
>>>> +
>>>> + if (!amd_iommu_validate_dte(s, devid, entry)) {
>>>> + IOMMU_DPRINTF(MMU,
>>>> + "Pte entry at 0x%"PRIx64" is invalid", entry[0]);
>>>> + return false;
>>>> + }
>>>> +
>>>> + return true;
>>>> +}
>>>> +
>>>> +/* get pte translation mode */
>>>> +static inline uint8_t get_pte_translation_mode(uint64_t pte)
>>>> +{
>>>> + return (pte >> IOMMU_DEV_MODE_RSHIFT) & IOMMU_DEV_MODE_MASK;
>>>> +}
>>>> +
>>>> +static int amd_iommu_page_walk(AMDIOMMUAddressSpace *as, uint64_t *dte,
>>>> + IOMMUTLBEntry *ret, unsigned perms,
>>>> + hwaddr addr)
>>>> +{
>>>> + uint8_t level, oldlevel;
>>>> + unsigned present;
>>>> + uint64_t pte, pte_addr;
>>>> + uint64_t pte_perms;
>>>> + pte = dte[0];
>>>> +
>>>> + level = get_pte_translation_mode(pte);
>>>> +
>>>> + if (level >= 7 || level == 0) {
>>>> + IOMMU_DPRINTF(MMU, "error: translation level 0x%"PRIu8 "
>>>> detected"
>>>> + "while translating 0x%"PRIx64, level, addr);
>>>> + return -1;
>>>> + }
>>>> +
>>>> + while (level > 0) {
>>>> + pte_perms = amd_iommu_get_perms(pte);
>>>> + present = pte & 1;
>>>> + if (!present || perms != (perms & pte_perms)) {
>>>> + amd_iommu_page_fault(as->iommu_state, as->devfn, addr,
>>>> perms);
>>>> + IOMMU_DPRINTF(MMU, "error: page fault accessing virtual addr
>>>> 0x%"
>>>> + PRIx64, addr);
>>>> + return -1;
>>>> + }
>>>> +
>>>> + /* go to the next lower level */
>>>> + pte_addr = pte & IOMMU_DEV_PT_ROOT_MASK;
>>>> + /* add offset and load pte */
>>>> + pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
>>>> + pte = ldq_phys(&address_space_memory, pte_addr);
>>>> + oldlevel = level;
>>>> + level = get_pte_translation_mode(pte);
>>>> +
>>>> + /* PT is corrupted or not there */
>>>> + if (level != oldlevel - 1) {
>>>> + return -1;
>>>> + }
>>>> + }
>>>> +
>>>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret->translated_addr = (pte & IOMMU_DEV_PT_ROOT_MASK) &
>>>> IOMMU_PAGE_MASK_4K;
>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret->perm = IOMMU_RW;
>>>> + return 0;
>>>> +}
>>>> +
>>>> +/* TODO : Mark addresses as Accessed and Dirty */
>>>
>>>
>>> If you don't mark addresses as dirty, can't this cause the sporadic errors
>>> of arbitrary programs Jan talked about?
>>
>> I don't think this the issue, am seem to be receiving wrong 'host
>> physical addresses' in the last few kernel version. This issue is not
>> there in older kernels.
>>
>>>
>>>> +static void amd_iommu_do_translate(AMDIOMMUAddressSpace *as, hwaddr addr,
>>>> + bool is_write, IOMMUTLBEntry *ret)
>>>> +{
>>>> + AMDIOMMUState *s = as->iommu_state;
>>>> + uint16_t devid = PCI_DEVID(as->bus_num, as->devfn);
>>>> + IOMMUIOTLBEntry *iotlb_entry;
>>>> + uint8_t err;
>>>> + uint64_t entry[4];
>>>> +
>>>> + /* try getting a cache entry first */
>>>> + iotlb_entry = amd_iommu_iotlb_lookup(s, addr, as->devfn);
>>>> +
>>>> + if (iotlb_entry) {
>>>> + IOMMU_DPRINTF(CACHE, "hit iotlb devid: %02x:%02x.%x gpa
>>>> 0x%"PRIx64
>>>> + " hpa 0x%"PRIx64, PCI_BUS_NUM(devid),
>>>> PCI_SLOT(devid),
>>>> + PCI_FUNC(devid), addr,
>>>> iotlb_entry->translated_addr);
>>>> + ret->iova = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret->translated_addr = iotlb_entry->translated_addr;
>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret->perm = iotlb_entry->perms;
>>>> + return;
>>>> + } else {
>>>
>>>
>>> you return from the if clause so you don't need the else
>>>
>>>> + if (!amd_iommu_get_dte(s, devid, entry)) {
>>>
>>>
>>> is not an error if you did not find the device id?
>>>
>>>> + goto out;
>>>> + }
>>>> +
>>>> + err = amd_iommu_page_walk(as, entry, ret,
>>>> + is_write ? IOMMU_PERM_WRITE :
>>>> IOMMU_PERM_READ,
>>>> + addr);
>>>> + if (err) {
>>>> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page
>>>> tables"
>>>> + " while translating addr 0x%"PRIx64, addr);
>>>> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
>>>> + goto out;
>>>> + }
>>>> +
>>>> + amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
>>>> + ret->perm, entry[1] &
>>>> IOMMU_DEV_DOMID_ID_MASK);
>>>> + return;
>>>> + }
>>>> +
>>>> +out:
>>>> + ret->iova = addr;
>>>> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret->perm = IOMMU_RW;
>>>> + return;
>>>
>>>
>>> you don't need the above return
>>>
>>>> +}
>>>> +
>>>> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr
>>>> addr,
>>>> + bool is_write)
>>>> +{
>>>> + IOMMU_DPRINTF(GENERAL, "");
>>>> +
>>>> + AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace,
>>>> iommu);
>>>> + AMDIOMMUState *s = as->iommu_state;
>>>> +
>>>> + IOMMUTLBEntry ret = {
>>>> + .target_as = &address_space_memory,
>>>> + .iova = addr,
>>>> + .translated_addr = 0,
>>>> + .addr_mask = ~(hwaddr)0,
>>>> + .perm = IOMMU_NONE,
>>>> + };
>>>> +
>>>> + if (!s->enabled) {
>>>> + /* IOMMU disabled - corresponds to iommu=off not
>>>> + * failure to provide any parameter
>>>> + */
>>>> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>>> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>> + ret.perm = IOMMU_RW;
>>>> + return ret;
>>>> + }
>>>> +
>>>> + amd_iommu_do_translate(as, addr, is_write, &ret);
>>>> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa
>>>> 0x%"PRIx64,
>>>> + as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn),
>>>> addr,
>>>> + ret.translated_addr);
>>>> +
>>>> + return ret;
>>>> +}
>>>> +
>>>> +static const MemoryRegionOps mmio_mem_ops = {
>>>> + .read = amd_iommu_mmio_read,
>>>> + .write = amd_iommu_mmio_write,
>>>> + .endianness = DEVICE_LITTLE_ENDIAN,
>>>> + .impl = {
>>>> + .min_access_size = 1,
>>>> + .max_access_size = 8,
>>>> + .unaligned = false,
>>>> + },
>>>> + .valid = {
>>>> + .min_access_size = 1,
>>>> + .max_access_size = 8,
>>>> + }
>>>> +};
>>>> +
>>>> +static void amd_iommu_init(AMDIOMMUState *s)
>>>> +{
>>>> + printf("amd_iommu_init");
>>>
>>>
>>> you should use the debug macro here
>>>
>>>> +
>>>> + amd_iommu_iotlb_reset(s);
>>>> +
>>>> + s->iommu_ops.translate = amd_iommu_translate;
>>>> +
>>>> + s->devtab_len = 0;
>>>> + s->cmdbuf_len = 0;
>>>> + s->cmdbuf_head = 0;
>>>> + s->cmdbuf_tail = 0;
>>>> + s->evtlog_head = 0;
>>>> + s->evtlog_tail = 0;
>>>> + s->excl_enabled = false;
>>>> + s->excl_allow = false;
>>>> + s->mmio_enabled = false;
>>>> + s->enabled = false;
>>>> + s->ats_enabled = false;
>>>> + s->cmdbuf_enabled = false;
>>>> +
>>>> + /* reset MMIO */
>>>> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
>>>> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
>>>> + 0xffffffffffffffef, 0);
>>>> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
>>>> + /* reset device ident */
>>>> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
>>>> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
>>>> + pci_config_set_prog_interface(s->dev.config, 00);
>>>> + pci_config_set_class(s->dev.config, 0x0806);
>>>> +
>>>> + /* reset IOMMU specific capabilities */
>>>> + pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
>>>> + s->mmio.addr & ~(0xffff0000));
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
>>>> + (s->mmio.addr & ~(0xffff)) >> 16);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
>>>> + 0xff000000);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>>>> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
>>>
>>>
>>> All the capabilities are read-write? Otherwise you need to set the wmask
>>> to indicate what fields are writable.
>>>
>>>> +}
>>>> +
>>>> +static void amd_iommu_reset(DeviceState *dev)
>>>> +{
>>>> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
>>>> +
>>>> + amd_iommu_init(s);
>>>> +}
>>>> +
>>>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>>>> +{
>>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>>> +
>>>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>>>> + amd_iommu_uint64_equal, g_free,
>>>> g_free);
>>>> +
>>>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>>>> + IOMMU_CAPAB_SIZE);
>>>> +
>>>> + /* add msi and hypertransport capabilities */
>>>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
>>>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
>>>> +
>>>> + amd_iommu_init(s);
>>>> +
>>>> + /* set up MMIO */
>>>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
>>>> + IOMMU_MMIO_SIZE);
>>>> +
>>>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>>>
>>>
>>> I don't understand why is need here. realize is called only once in the init
>>> process
>>> and you set it a few lines below.
>>>
>>>> + return;
>>>> + }
>>>> +
>>>> + s->mmio.addr = IOMMU_BASE_ADDR;
>>>> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR,
>>>> &s->mmio);
>>>> +}
>>>> +
>>>> +static const VMStateDescription vmstate_amd_iommu = {
>>>> + .name = "amd-iommu",
>>>> + .fields = (VMStateField[]) {
>>>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>>>> + VMSTATE_END_OF_LIST()
>>>> + }
>>>> +};
>>>> +
>>>> +static Property amd_iommu_properties[] = {
>>>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>>>> + DEFINE_PROP_END_OF_LIST(),
>>>> +};
>>>> +
>>>> +static void amd_iommu_uninit(PCIDevice *dev)
>>>> +{
>>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>>> + amd_iommu_iotlb_reset(s);
>>>
>>>
>>> at this point you also need to clean also the memory regions you use.
>>>
>>>> +}
>>>> +
>>>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>>>> +{
>>>> + DeviceClass *dc = DEVICE_CLASS(klass);
>>>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>>>> +
>>>> + k->realize = amd_iommu_realize;
>>>> + k->exit = amd_iommu_uninit;
>>>> +
>>>> + dc->reset = amd_iommu_reset;
>>>> + dc->vmsd = &vmstate_amd_iommu;
>>>> + dc->props = amd_iommu_properties;
>>>> +}
>>>> +
>>>> +static const TypeInfo amd_iommu = {
>>>> + .name = TYPE_AMD_IOMMU_DEVICE,
>>>> + .parent = TYPE_PCI_DEVICE,
>>>> + .instance_size = sizeof(AMDIOMMUState),
>>>> + .class_init = amd_iommu_class_init
>>>> +};
>>>> +
>>>> +static void amd_iommu_register_types(void)
>>>> +{
>>>> + type_register_static(&amd_iommu);
>>>> +}
>>>> +
>>>> +type_init(amd_iommu_register_types);
>>>> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
>>>> new file mode 100644
>>>> index 0000000..7d317e1
>>>> --- /dev/null
>>>> +++ b/hw/i386/amd_iommu.h
>>>> @@ -0,0 +1,395 @@
>>>> +/*
>>>> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
>>>> + *
>>>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>>>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>>>> + *
>>>> + * This program is free software; you can redistribute it and/or modify
>>>> + * it under the terms of the GNU General Public License as published by
>>>> + * the Free Software Foundation; either version 2 of the License, or
>>>> + * (at your option) any later version.
>>>> +
>>>> + * This program is distributed in the hope that it will be useful,
>>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>>>> + * GNU General Public License for more details.
>>>> +
>>>> + * You should have received a copy of the GNU General Public License
>>>> along
>>>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>>>> + */
>>>> +
>>>> +#ifndef AMD_IOMMU_H_
>>>> +#define AMD_IOMMU_H_
>>>> +
>>>> +#include "hw/hw.h"
>>>> +#include "hw/pci/pci.h"
>>>> +#include "hw/pci/msi.h"
>>>> +#include "hw/sysbus.h"
>>>> +#include "sysemu/dma.h"
>>>> +
>>>> +/* Capability registers */
>>>> +#define IOMMU_CAPAB_HEADER 0x00
>>>> +#define IOMMU_CAPAB_REV_TYPE 0x02
>>>> +#define IOMMU_CAPAB_FLAGS 0x03
>>>> +#define IOMMU_CAPAB_BAR_LOW 0x04
>>>> +#define IOMMU_CAPAB_BAR_HIGH 0x08
>>>> +#define IOMMU_CAPAB_RANGE 0x0C
>>>> +#define IOMMU_CAPAB_MISC 0x10
>>>> +#define IOMMU_CAPAB_MISC1 0x14
>>>> +
>>>> +#define IOMMU_CAPAB_SIZE 0x18
>>>> +#define IOMMU_CAPAB_REG_SIZE 0x04
>>>> +
>>>> +/* Capability header data */
>>>> +#define IOMMU_CAPAB_ID_SEC 0xf
>>>> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
>>>> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
>>>> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
>>>> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
>>>> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
>>>> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
>>>> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
>>>> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV |
>>>> IOMMU_CAPAB_TYPE)
>>>> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
>>>> + IOMMU_CAPAB_FLAG_HTTUNNEL)
>>>> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
>>>> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
>>>> +
>>>> +/* MMIO registers */
>>>> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
>>>> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
>>>> +#define IOMMU_MMIO_EVENT_BASE 0x0010
>>>> +#define IOMMU_MMIO_CONTROL 0x0018
>>>> +#define IOMMU_MMIO_EXCL_BASE 0x0020
>>>> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
>>>> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
>>>> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
>>>> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
>>>> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
>>>> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
>>>> +#define IOMMU_MMIO_STATUS 0x2020
>>>> +#define IOMMU_MMIO_PPR_BASE 0x0038
>>>> +#define IOMMU_MMIO_PPR_HEAD 0x2030
>>>> +#define IOMMU_MMIO_PPR_TAIL 0x2038
>>>> +
>>>> +#define IOMMU_MMIO_SIZE 0x4000
>>>> +
>>>> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
>>>> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
>>>> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
>>>> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
>>>> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
>>>> +
>>>> +/* some of this are similar but just for readability */
>>>> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
>>>> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
>>>> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
>>>> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>>> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +
>>>> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>>> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
>>>> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
>>>> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
>>>> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>>> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +
>>>> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>>> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
>>>> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
>>>> +
>>>> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
>>>> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
>>>> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
>>>> +
>>>> +/* mmio control register flags */
>>>> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
>>>> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
>>>> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
>>>> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
>>>> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
>>>> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
>>>> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
>>>> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
>>>> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
>>>> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
>>>> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
>>>> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
>>>> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
>>>> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
>>>> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
>>>> +
>>>> +/* MMIO status register bits */
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
>>>> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
>>>> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
>>>> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
>>>> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
>>>> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
>>>> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
>>>> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
>>>> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
>>>> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
>>>> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
>>>> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
>>>> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
>>>> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
>>>> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
>>>> +
>>>> +#define IOMMU_CMDBUF_ID_BYTE 0x07
>>>> +#define IOMMU_CMDBUF_ID_RSHIFT 4
>>>> +
>>>> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
>>>> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
>>>> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
>>>> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
>>>> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
>>>> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
>>>> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
>>>> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
>>>> +
>>>> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
>>>> +
>>>> +/* Device table entry bits 0:63 */
>>>> +#define IOMMU_DEV_VALID (1ULL << 0)
>>>> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
>>>> +#define IOMMU_DEV_MODE_MASK 0x7
>>>> +#define IOMMU_DEV_MODE_RSHIFT 9
>>>> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
>>>> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
>>>> +#define IOMMU_DEV_PERM_SHIFT 61
>>>> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
>>>> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
>>>> +
>>>> +/* Device table entry bits 64:127 */
>>>> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
>>>> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
>>>> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
>>>> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
>>>> +#define IOMMU_DEV_IOCTL_MASK (~3)
>>>> +#define IOMMU_DEV_IOCTL_RSHIFT 20
>>>> +#define IOMMU_DEV_IOCTL_DENY 0
>>>> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
>>>> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
>>>> +#define IOMMU_DEV_CACHE (1ULL << 37)
>>>> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
>>>> +#define IOMMU_DEV_EXCL (1ULL << 39)
>>>> +
>>>> +/* Event codes and flags, as stored in the info field */
>>>> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
>>>> +#define IOMMU_EVENT_IOPF (0x2U << 12)
>>>> +#define IOMMU_EVENT_IOPF_I (1U << 3)
>>>> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
>>>> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
>>>> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
>>>> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
>>>> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
>>>> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
>>>> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
>>>> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
>>>> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
>>>> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
>>>> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
>>>> +
>>>> +#define IOMMU_EVENT_LEN 16
>>>> +#define IOMMU_PERM_READ (1 << 0)
>>>> +#define IOMMU_PERM_WRITE (1 << 1)
>>>> +#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
>>>> +
>>>> +/* AMD RD890 Chipset */
>>>> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
>
>
>>>
>>>
>>> We keep the pci ids in include/hw/pci/pci_ids.h
>
> This a dummy device id I use for IOMMU - IOMMU doesn't have a specific
> device id. There's a device id on linux include files for a certain
> AMD IOMMU but it makes IOMMU seem to be on a non-existant bus so I
> don't use it.
>
>>>
>>>> +
>>>> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
>>>> +#define IOMMU_FEATURE_PPR (1ULL << 1)
>>>> +#define IOMMU_FEATURE_NX (1ULL << 3)
>>>> +#define IOMMU_FEATURE_GT (1ULL << 4)
>>>> +#define IOMMU_FEATURE_IA (1ULL << 6)
>>>> +#define IOMMU_FEATURE_GA (1ULL << 7)
>>>> +#define IOMMU_FEATURE_HE (1ULL << 8)
>>>> +#define IOMMU_FEATURE_PC (1ULL << 9)
>>>> +
>>>> +/* reserved DTE bits */
>>>> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
>>>> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
>>>> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
>>>> +
>>>> +/* IOMMU paging mode */
>>>> +#define IOMMU_GATS_MODE (6ULL << 12)
>>>> +#define IOMMU_HATS_MODE (6ULL << 10)
>>>> +
>>>> +/* PCI SIG constants */
>>>> +#define PCI_BUS_MAX 256
>>>> +#define PCI_SLOT_MAX 32
>>>> +#define PCI_FUNC_MAX 8
>>>> +#define PCI_DEVFN_MAX 256
>>>
>>>
>>> Maybe we can move the PCI macros to include/hw/pci/pci.h, those are not
>>> IOMMU specific.
>
> Yeah, this are PCI macros but they are a not copied from linux while
> the macros in pci.h seem to have been copied from linux.
>
>>>
>>>> +
>>>> +/* IOTLB */
>>>> +#define IOMMU_IOTLB_MAX_SIZE 1024
>>>> +#define IOMMU_DEVID_SHIFT 36
>>>> +
>>>> +/* extended feature support */
>>>> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR |
>>>> \
>>>> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
>>>> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
>>>> + IOMMU_HATS_MODE)
>>>> +
>>>> +/* capabilities header */
>>>> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
>>>> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
>>>> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
>>>> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
>>>> +
>>>> +/* command constants */
>>>> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
>>>> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
>>>> +#define IOMMU_COM_COMPLETION_INTR 0x2
>>>> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
>>>> +#define IOMMU_COMMAND_SIZE 0x10
>>>> +
>>>> +/* IOMMU default address */
>>>> +#define IOMMU_BASE_ADDR 0xfed80000
>>>> +
>>>> +/* page management constants */
>>>> +#define IOMMU_PAGE_SHIFT 12
>>>> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
>>>> +
>>>> +#define IOMMU_PAGE_SHIFT_4K 12
>>>> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
>>>> +#define IOMMU_PAGE_SHIFT_2M 21
>>>> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
>>>> +#define IOMMU_PAGE_SHIFT_1G 30
>>>> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
>>>> +
>>>> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
>>>> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
>>>> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
>>>> +
>>>> +/* invalidation command device id */
>>>> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
>>>> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) -
>>>> 1))
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-03-02 4:08 ` David Kiarie
@ 2016-03-03 9:40 ` Marcel Apfelbaum
0 siblings, 0 replies; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-03-03 9:40 UTC (permalink / raw)
To: David Kiarie
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers, Michael S. Tsirkin
On 03/02/2016 06:08 AM, David Kiarie wrote:
> On Wed, Mar 2, 2016 at 7:00 AM, David Kiarie <davidkiarie4@gmail.com> wrote:
>> On Fri, Feb 26, 2016 at 9:23 AM, David Kiarie <davidkiarie4@gmail.com> wrote:
>>> On Thu, Feb 25, 2016 at 6:43 PM, Marcel Apfelbaum <marcel@redhat.com> wrote:
>>>> On 02/21/2016 08:10 PM, David Kiarie wrote:
>>>>>
>>>>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>>>>> The IOMMU does basic translation, error checking and has a
>>>>> mininal IOTLB implementation
>>>>
>>>>
>>>> Hi,
>>>>
>>>>>
>>>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>>>> ---
>>>>> hw/i386/Makefile.objs | 1 +
>>>>> hw/i386/amd_iommu.c | 1432
>>>>> +++++++++++++++++++++++++++++++++++++++++++++++++
>>>>> hw/i386/amd_iommu.h | 395 ++++++++++++++
>>>>> include/hw/pci/pci.h | 2 +
>>>>> 4 files changed, 1830 insertions(+)
>>>>> create mode 100644 hw/i386/amd_iommu.c
>>>>> create mode 100644 hw/i386/amd_iommu.h
>>>>>
[...]
>>>>
>>>>
>>>> you return from the if clause so you don't need the else
>>>>
>>>>> + if (!amd_iommu_get_dte(s, devid, entry)) {
>>>>
>>>>
>>>> is not an error if you did not find the device id?
>
> I get device id from Qemu - so I assume it's correct.
I don't get it, if you assume is correct, why do you use the "if" clause?
If you think the id should be OK. maybe you want to assert here?
Currently it looks like a silent failure.
Thanks,
Marcel
>
>>>>
>>>>> + goto out;
>>>>> + }
>>>>> +
>>>>> + err = amd_iommu_page_walk(as, entry, ret,
>>>>> + is_write ? IOMMU_PERM_WRITE :
>>>>> IOMMU_PERM_READ,
>>>>> + addr);
>>>>> + if (err) {
>>>>> + IOMMU_DPRINTF(MMU, "error: hardware error accessing page
>>>>> tables"
>>>>> + " while translating addr 0x%"PRIx64, addr);
>>>>> + amd_iommu_log_pagetab_error(s, as->devfn, addr, 0);
>>>>> + goto out;
>>>>> + }
>>>>> +
>>>>> + amd_iommu_update_iotlb(s, as->devfn, addr, ret->translated_addr,
>>>>> + ret->perm, entry[1] &
>>>>> IOMMU_DEV_DOMID_ID_MASK);
>>>>> + return;
>>>>> + }
>>>>> +
>>>>> +out:
>>>>> + ret->iova = addr;
>>>>> + ret->translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>>>> + ret->addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>>> + ret->perm = IOMMU_RW;
>>>>> + return;
>>>>
>>>>
>>>> you don't need the above return
>>>>
>>>>> +}
>>>>> +
>>>>> +static IOMMUTLBEntry amd_iommu_translate(MemoryRegion *iommu, hwaddr
>>>>> addr,
>>>>> + bool is_write)
>>>>> +{
>>>>> + IOMMU_DPRINTF(GENERAL, "");
>>>>> +
>>>>> + AMDIOMMUAddressSpace *as = container_of(iommu, AMDIOMMUAddressSpace,
>>>>> iommu);
>>>>> + AMDIOMMUState *s = as->iommu_state;
>>>>> +
>>>>> + IOMMUTLBEntry ret = {
>>>>> + .target_as = &address_space_memory,
>>>>> + .iova = addr,
>>>>> + .translated_addr = 0,
>>>>> + .addr_mask = ~(hwaddr)0,
>>>>> + .perm = IOMMU_NONE,
>>>>> + };
>>>>> +
>>>>> + if (!s->enabled) {
>>>>> + /* IOMMU disabled - corresponds to iommu=off not
>>>>> + * failure to provide any parameter
>>>>> + */
>>>>> + ret.iova = addr & IOMMU_PAGE_MASK_4K;
>>>>> + ret.translated_addr = addr & IOMMU_PAGE_MASK_4K;
>>>>> + ret.addr_mask = ~IOMMU_PAGE_MASK_4K;
>>>>> + ret.perm = IOMMU_RW;
>>>>> + return ret;
>>>>> + }
>>>>> +
>>>>> + amd_iommu_do_translate(as, addr, is_write, &ret);
>>>>> + IOMMU_DPRINTF(MMU, "devid: %02x:%02x.%x gpa 0x%"PRIx64 " hpa
>>>>> 0x%"PRIx64,
>>>>> + as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn),
>>>>> addr,
>>>>> + ret.translated_addr);
>>>>> +
>>>>> + return ret;
>>>>> +}
>>>>> +
>>>>> +static const MemoryRegionOps mmio_mem_ops = {
>>>>> + .read = amd_iommu_mmio_read,
>>>>> + .write = amd_iommu_mmio_write,
>>>>> + .endianness = DEVICE_LITTLE_ENDIAN,
>>>>> + .impl = {
>>>>> + .min_access_size = 1,
>>>>> + .max_access_size = 8,
>>>>> + .unaligned = false,
>>>>> + },
>>>>> + .valid = {
>>>>> + .min_access_size = 1,
>>>>> + .max_access_size = 8,
>>>>> + }
>>>>> +};
>>>>> +
>>>>> +static void amd_iommu_init(AMDIOMMUState *s)
>>>>> +{
>>>>> + printf("amd_iommu_init");
>>>>
>>>>
>>>> you should use the debug macro here
>>>>
>>>>> +
>>>>> + amd_iommu_iotlb_reset(s);
>>>>> +
>>>>> + s->iommu_ops.translate = amd_iommu_translate;
>>>>> +
>>>>> + s->devtab_len = 0;
>>>>> + s->cmdbuf_len = 0;
>>>>> + s->cmdbuf_head = 0;
>>>>> + s->cmdbuf_tail = 0;
>>>>> + s->evtlog_head = 0;
>>>>> + s->evtlog_tail = 0;
>>>>> + s->excl_enabled = false;
>>>>> + s->excl_allow = false;
>>>>> + s->mmio_enabled = false;
>>>>> + s->enabled = false;
>>>>> + s->ats_enabled = false;
>>>>> + s->cmdbuf_enabled = false;
>>>>> +
>>>>> + /* reset MMIO */
>>>>> + memset(s->mmior, 0, IOMMU_MMIO_SIZE);
>>>>> + amd_iommu_set_quad(s, IOMMU_MMIO_EXT_FEATURES, IOMMU_EXT_FEATURES,
>>>>> + 0xffffffffffffffef, 0);
>>>>> + amd_iommu_set_quad(s, IOMMU_MMIO_STATUS, 0, 0x98, 0x67);
>>>>> + /* reset device ident */
>>>>> + pci_config_set_vendor_id(s->dev.config, PCI_VENDOR_ID_AMD);
>>>>> + pci_config_set_device_id(s->dev.config, PCI_DEVICE_ID_RD890_IOMMU);
>>>>> + pci_config_set_prog_interface(s->dev.config, 00);
>>>>> + pci_config_set_class(s->dev.config, 0x0806);
>>>>> +
>>>>> + /* reset IOMMU specific capabilities */
>>>>> + pci_set_long(s->dev.config + s->capab_offset, IOMMU_CAPAB_FEATURES);
>>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_LOW,
>>>>> + s->mmio.addr & ~(0xffff0000));
>>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_BAR_HIGH,
>>>>> + (s->mmio.addr & ~(0xffff)) >> 16);
>>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_RANGE,
>>>>> + 0xff000000);
>>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC, 0);
>>>>> + pci_set_long(s->dev.config + s->capab_offset + IOMMU_CAPAB_MISC,
>>>>> + IOMMU_MAX_PH_ADDR | IOMMU_MAX_GVA_ADDR | IOMMU_MAX_VA_ADDR);
>>>>
>>>>
>>>> All the capabilities are read-write? Otherwise you need to set the wmask
>>>> to indicate what fields are writable.
>>>>
>>>>> +}
>>>>> +
>>>>> +static void amd_iommu_reset(DeviceState *dev)
>>>>> +{
>>>>> + AMDIOMMUState *s = AMD_IOMMU_DEVICE(dev);
>>>>> +
>>>>> + amd_iommu_init(s);
>>>>> +}
>>>>> +
>>>>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>>>>> +{
>>>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>>>> +
>>>>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>>>>> + amd_iommu_uint64_equal, g_free,
>>>>> g_free);
>>>>> +
>>>>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>>>>> + IOMMU_CAPAB_SIZE);
>>>>> +
>>>>> + /* add msi and hypertransport capabilities */
>>>>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
>>>>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
>>>>> +
>>>>> + amd_iommu_init(s);
>>>>> +
>>>>> + /* set up MMIO */
>>>>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
>>>>> + IOMMU_MMIO_SIZE);
>>>>> +
>>>>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>>>>
>>>>
>>>> I don't understand why is need here. realize is called only once in the init
>>>> process
>>>> and you set it a few lines below.
>>>>
>>>>> + return;
>>>>> + }
>>>>> +
>>>>> + s->mmio.addr = IOMMU_BASE_ADDR;
>>>>> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR,
>>>>> &s->mmio);
>>>>> +}
>>>>> +
>>>>> +static const VMStateDescription vmstate_amd_iommu = {
>>>>> + .name = "amd-iommu",
>>>>> + .fields = (VMStateField[]) {
>>>>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>>>>> + VMSTATE_END_OF_LIST()
>>>>> + }
>>>>> +};
>>>>> +
>>>>> +static Property amd_iommu_properties[] = {
>>>>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>>>>> + DEFINE_PROP_END_OF_LIST(),
>>>>> +};
>>>>> +
>>>>> +static void amd_iommu_uninit(PCIDevice *dev)
>>>>> +{
>>>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>>>> + amd_iommu_iotlb_reset(s);
>>>>
>>>>
>>>> at this point you also need to clean also the memory regions you use.
>>>>
>>>>> +}
>>>>> +
>>>>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>>>>> +{
>>>>> + DeviceClass *dc = DEVICE_CLASS(klass);
>>>>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>>>>> +
>>>>> + k->realize = amd_iommu_realize;
>>>>> + k->exit = amd_iommu_uninit;
>>>>> +
>>>>> + dc->reset = amd_iommu_reset;
>>>>> + dc->vmsd = &vmstate_amd_iommu;
>>>>> + dc->props = amd_iommu_properties;
>>>>> +}
>>>>> +
>>>>> +static const TypeInfo amd_iommu = {
>>>>> + .name = TYPE_AMD_IOMMU_DEVICE,
>>>>> + .parent = TYPE_PCI_DEVICE,
>>>>> + .instance_size = sizeof(AMDIOMMUState),
>>>>> + .class_init = amd_iommu_class_init
>>>>> +};
>>>>> +
>>>>> +static void amd_iommu_register_types(void)
>>>>> +{
>>>>> + type_register_static(&amd_iommu);
>>>>> +}
>>>>> +
>>>>> +type_init(amd_iommu_register_types);
>>>>> diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
>>>>> new file mode 100644
>>>>> index 0000000..7d317e1
>>>>> --- /dev/null
>>>>> +++ b/hw/i386/amd_iommu.h
>>>>> @@ -0,0 +1,395 @@
>>>>> +/*
>>>>> + * QEMU emulation of an AMD IOMMU (AMD-Vi)
>>>>> + *
>>>>> + * Copyright (C) 2011 Eduard - Gabriel Munteanu
>>>>> + * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
>>>>> + *
>>>>> + * This program is free software; you can redistribute it and/or modify
>>>>> + * it under the terms of the GNU General Public License as published by
>>>>> + * the Free Software Foundation; either version 2 of the License, or
>>>>> + * (at your option) any later version.
>>>>> +
>>>>> + * This program is distributed in the hope that it will be useful,
>>>>> + * but WITHOUT ANY WARRANTY; without even the implied warranty of
>>>>> + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
>>>>> + * GNU General Public License for more details.
>>>>> +
>>>>> + * You should have received a copy of the GNU General Public License
>>>>> along
>>>>> + * with this program; if not, see <http://www.gnu.org/licenses/>.
>>>>> + */
>>>>> +
>>>>> +#ifndef AMD_IOMMU_H_
>>>>> +#define AMD_IOMMU_H_
>>>>> +
>>>>> +#include "hw/hw.h"
>>>>> +#include "hw/pci/pci.h"
>>>>> +#include "hw/pci/msi.h"
>>>>> +#include "hw/sysbus.h"
>>>>> +#include "sysemu/dma.h"
>>>>> +
>>>>> +/* Capability registers */
>>>>> +#define IOMMU_CAPAB_HEADER 0x00
>>>>> +#define IOMMU_CAPAB_REV_TYPE 0x02
>>>>> +#define IOMMU_CAPAB_FLAGS 0x03
>>>>> +#define IOMMU_CAPAB_BAR_LOW 0x04
>>>>> +#define IOMMU_CAPAB_BAR_HIGH 0x08
>>>>> +#define IOMMU_CAPAB_RANGE 0x0C
>>>>> +#define IOMMU_CAPAB_MISC 0x10
>>>>> +#define IOMMU_CAPAB_MISC1 0x14
>>>>> +
>>>>> +#define IOMMU_CAPAB_SIZE 0x18
>>>>> +#define IOMMU_CAPAB_REG_SIZE 0x04
>>>>> +
>>>>> +/* Capability header data */
>>>>> +#define IOMMU_CAPAB_ID_SEC 0xf
>>>>> +#define IOMMU_CAPAB_FLAT_EXT (1 << 28)
>>>>> +#define IOMMU_CAPAB_EFR_SUP (1 << 27)
>>>>> +#define IOMMU_CAPAB_FLAG_NPCACHE (1 << 26)
>>>>> +#define IOMMU_CAPAB_FLAG_HTTUNNEL (1 << 25)
>>>>> +#define IOMMU_CAPAB_FLAG_IOTLBSUP (1 << 24)
>>>>> +#define IOMMU_CAPAB_INIT_REV (1 << 19)
>>>>> +#define IOMMU_CAPAB_INIT_TYPE (3 << 16)
>>>>> +#define IOMMU_CAPAB_INIT_REV_TYPE (IOMMU_CAPAB_REV |
>>>>> IOMMU_CAPAB_TYPE)
>>>>> +#define IOMMU_CAPAB_INIT_FLAGS (IOMMU_CAPAB_FLAG_NPCACHE | \
>>>>> + IOMMU_CAPAB_FLAG_HTTUNNEL)
>>>>> +#define IOMMU_CAPAB_INIT_MISC ((64 << 15) | (48 << 8))
>>>>> +#define IOMMU_CAPAB_BAR_MASK (~((1UL << 14) - 1))
>>>>> +
>>>>> +/* MMIO registers */
>>>>> +#define IOMMU_MMIO_DEVICE_TABLE 0x0000
>>>>> +#define IOMMU_MMIO_COMMAND_BASE 0x0008
>>>>> +#define IOMMU_MMIO_EVENT_BASE 0x0010
>>>>> +#define IOMMU_MMIO_CONTROL 0x0018
>>>>> +#define IOMMU_MMIO_EXCL_BASE 0x0020
>>>>> +#define IOMMU_MMIO_EXCL_LIMIT 0x0028
>>>>> +#define IOMMU_MMIO_EXT_FEATURES 0x0030
>>>>> +#define IOMMU_MMIO_COMMAND_HEAD 0x2000
>>>>> +#define IOMMU_MMIO_COMMAND_TAIL 0x2008
>>>>> +#define IOMMU_MMIO_EVENT_HEAD 0x2010
>>>>> +#define IOMMU_MMIO_EVENT_TAIL 0x2018
>>>>> +#define IOMMU_MMIO_STATUS 0x2020
>>>>> +#define IOMMU_MMIO_PPR_BASE 0x0038
>>>>> +#define IOMMU_MMIO_PPR_HEAD 0x2030
>>>>> +#define IOMMU_MMIO_PPR_TAIL 0x2038
>>>>> +
>>>>> +#define IOMMU_MMIO_SIZE 0x4000
>>>>> +
>>>>> +#define IOMMU_MMIO_DEVTAB_SIZE_MASK ((1ULL << 12) - 1)
>>>>> +#define IOMMU_MMIO_DEVTAB_BASE_MASK (((1ULL << 52) - 1) & ~ \
>>>>> + IOMMU_MMIO_DEVTAB_SIZE_MASK)
>>>>> +#define IOMMU_MMIO_DEVTAB_ENTRY_SIZE 32
>>>>> +#define IOMMU_MMIO_DEVTAB_SIZE_UNIT 4096
>>>>> +
>>>>> +/* some of this are similar but just for readability */
>>>>> +#define IOMMU_MMIO_CMDBUF_SIZE_BYTE (IOMMU_MMIO_COMMAND_BASE + 7)
>>>>> +#define IOMMU_MMIO_CMDBUF_SIZE_MASK 0x0F
>>>>> +#define IOMMU_MMIO_CMDBUF_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>>> +#define IOMMU_MMIO_CMDBUF_DEFAULT_SIZE 8
>>>>> +#define IOMMU_MMIO_CMDBUF_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>>>> +#define IOMMU_MMIO_CMDBUF_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>>> +
>>>>> +#define IOMMU_MMIO_EVTLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>>>> +#define IOMMU_MMIO_EVTLOG_SIZE_MASK IOMMU_MMIO_CMDBUF_SIZE_MASK
>>>>> +#define IOMMU_MMIO_EVTLOG_BASE_MASK IOMMU_MMIO_CMDBUF_BASE_MASK
>>>>> +#define IOMMU_MMIO_EVTLOG_DEFAULT_SIZE IOMMU_MMIO_CMDBUF_DEFAULT_SIZE
>>>>> +#define IOMMU_MMIO_EVTLOG_HEAD_MASK (((1ULL << 19) - 1) & ~0x0F)
>>>>> +#define IOMMU_MMIO_EVTLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>>> +
>>>>> +#define IOMMU_MMIO_PPRLOG_SIZE_BYTE (IOMMU_MMIO_EVENT_BASE + 7)
>>>>> +#define IOMMU_MMIO_PPRLOG_HEAD_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>>> +#define IOMMU_MMIO_PPRLOG_TAIL_MASK IOMMU_MMIO_EVTLOG_HEAD_MASK
>>>>> +#define IOMMU_MMIO_PPRLOG_BASE_MASK IOMMU_MMIO_EVTLOG_BASE_MASK
>>>>> +#define IOMMU_MMIO_PPRLOG_SIZE_MASK IOMMU_MMIO_EVTLOG_SIZE_MASK
>>>>> +
>>>>> +#define IOMMU_MMIO_EXCL_BASE_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>>> +#define IOMMU_MMIO_EXCL_ENABLED_MASK (1ULL << 0)
>>>>> +#define IOMMU_MMIO_EXCL_ALLOW_MASK (1ULL << 1)
>>>>> +#define IOMMU_MMIO_EXCL_LIMIT_MASK IOMMU_MMIO_DEVTAB_BASE_MASK
>>>>> +#define IOMMU_MMIO_EXCL_LIMIT_LOW 0xFFF
>>>>> +
>>>>> +/* mmio control register flags */
>>>>> +#define IOMMU_MMIO_CONTROL_IOMMUEN (1ULL << 0)
>>>>> +#define IOMMU_MMIO_CONTROL_HTTUNEN (1ULL << 1)
>>>>> +#define IOMMU_MMIO_CONTROL_EVENTLOGEN (1ULL << 2)
>>>>> +#define IOMMU_MMIO_CONTROL_EVENTINTEN (1ULL << 3)
>>>>> +#define IOMMU_MMIO_CONTROL_COMWAITINTEN (1ULL << 4)
>>>>> +#define IOMMU_MMIO_CONTROL_PASSPW (1ULL << 7)
>>>>> +#define IOMMU_MMIO_CONTROL_REPASSPW (1ULL << 9)
>>>>> +#define IOMMU_MMIO_CONTROL_COHERENT (1ULL << 10)
>>>>> +#define IOMMU_MMIO_CONTROL_ISOC (1ULL << 11)
>>>>> +#define IOMMU_MMIO_CONTROL_CMDBUFLEN (1ULL << 12)
>>>>> +#define IOMMU_MMIO_CONTROL_PPRLOGEN (1ULL << 13)
>>>>> +#define IOMMU_MMIO_CONTROL_PPRINTEN (1ULL << 14)
>>>>> +#define IOMMU_MMIO_CONTROL_PPREN (1ULL << 15)
>>>>> +#define IOMMU_MMIO_CONTROL_GAEN (1ULL << 16)
>>>>> +#define IOMMU_MMIO_CONTROL_GTEN (1ULL << 17)
>>>>> +
>>>>> +/* MMIO status register bits */
>>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFE (1 << 18)
>>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFEB (1 << 17)
>>>>> +#define IOMMU_MMIO_STATUS_EVT_ACTIVE (1 << 16)
>>>>> +#define IOMMU_MMIO_STATUS_EVT_OVFB (1 << 15)
>>>>> +#define IOMMU_MMIO_STATUS_PPR_ACTIVE (1 << 12)
>>>>> +#define IOMMU_MMIO_STATUS_PPR_OVFB (1 << 11)
>>>>> +#define IOMMU_MMIO_STATUS_GA_INT (1 << 10)
>>>>> +#define IOMMU_MMIO_STATUS_GA_RUN (1 << 9)
>>>>> +#define IOMMU_MMIO_STATUS_GA_OVF (1 << 8)
>>>>> +#define IOMMU_MMIO_STATUS_PPR_RUN (1 << 7)
>>>>> +#define IOMMU_MMIO_STATUS_PPR_INT (1 << 6)
>>>>> +#define IOMMU_MMIO_STATUS_PPR_OVF (1 << 5)
>>>>> +#define IOMMU_MMIO_STATUS_CMDBUF_RUN (1 << 4)
>>>>> +#define IOMMU_MMIO_STATUS_EVT_RUN (1 << 3)
>>>>> +#define IOMMU_MMIO_STATUS_COMP_INT (1 << 2)
>>>>> +#define IOMMU_MMIO_STATUS_EVT_INT (1 << 1)
>>>>> +#define IOMMU_MMIO_STATUS_EVT_OVF (1 << 0)
>>>>> +
>>>>> +#define IOMMU_CMDBUF_ID_BYTE 0x07
>>>>> +#define IOMMU_CMDBUF_ID_RSHIFT 4
>>>>> +
>>>>> +#define IOMMU_CMD_COMPLETION_WAIT 0x01
>>>>> +#define IOMMU_CMD_INVAL_DEVTAB_ENTRY 0x02
>>>>> +#define IOMMU_CMD_INVAL_IOMMU_PAGES 0x03
>>>>> +#define IOMMU_CMD_INVAL_IOTLB_PAGES 0x04
>>>>> +#define IOMMU_CMD_INVAL_INTR_TABLE 0x05
>>>>> +#define IOMMU_CMD_PREFETCH_IOMMU_PAGES 0x06
>>>>> +#define IOMMU_CMD_COMPLETE_PPR_REQUEST 0x07
>>>>> +#define IOMMU_CMD_INVAL_IOMMU_ALL 0x08
>>>>> +
>>>>> +#define IOMMU_DEVTAB_ENTRY_SIZE 32
>>>>> +
>>>>> +/* Device table entry bits 0:63 */
>>>>> +#define IOMMU_DEV_VALID (1ULL << 0)
>>>>> +#define IOMMU_DEV_TRANSLATION_VALID (1ULL << 1)
>>>>> +#define IOMMU_DEV_MODE_MASK 0x7
>>>>> +#define IOMMU_DEV_MODE_RSHIFT 9
>>>>> +#define IOMMU_DEV_PT_ROOT_MASK 0xFFFFFFFFFF000
>>>>> +#define IOMMU_DEV_PT_ROOT_RSHIFT 12
>>>>> +#define IOMMU_DEV_PERM_SHIFT 61
>>>>> +#define IOMMU_DEV_PERM_READ (1ULL << 61)
>>>>> +#define IOMMU_DEV_PERM_WRITE (1ULL << 62)
>>>>> +
>>>>> +/* Device table entry bits 64:127 */
>>>>> +#define IOMMU_DEV_DOMID_ID_MASK ((1ULL << 16) - 1)
>>>>> +#define IOMMU_DEV_IOTLB_SUPPORT (1ULL << 17)
>>>>> +#define IOMMU_DEV_SUPPRESS_PF (1ULL << 18)
>>>>> +#define IOMMU_DEV_SUPPRESS_ALL_PF (1ULL << 19)
>>>>> +#define IOMMU_DEV_IOCTL_MASK (~3)
>>>>> +#define IOMMU_DEV_IOCTL_RSHIFT 20
>>>>> +#define IOMMU_DEV_IOCTL_DENY 0
>>>>> +#define IOMMU_DEV_IOCTL_PASSTHROUGH 1
>>>>> +#define IOMMU_DEV_IOCTL_TRANSLATE 2
>>>>> +#define IOMMU_DEV_CACHE (1ULL << 37)
>>>>> +#define IOMMU_DEV_SNOOP_DISABLE (1ULL << 38)
>>>>> +#define IOMMU_DEV_EXCL (1ULL << 39)
>>>>> +
>>>>> +/* Event codes and flags, as stored in the info field */
>>>>> +#define IOMMU_EVENT_ILLEGAL_DEVTAB_ENTRY (0x1U << 12)
>>>>> +#define IOMMU_EVENT_IOPF (0x2U << 12)
>>>>> +#define IOMMU_EVENT_IOPF_I (1U << 3)
>>>>> +#define IOMMU_EVENT_IOPF_PR (1U << 4)
>>>>> +#define IOMMU_EVENT_IOPF_RW (1U << 5)
>>>>> +#define IOMMU_EVENT_IOPF_PE (1U << 6)
>>>>> +#define IOMMU_EVENT_IOPF_RZ (1U << 7)
>>>>> +#define IOMMU_EVENT_IOPF_TR (1U << 8)
>>>>> +#define IOMMU_EVENT_DEV_TAB_HW_ERROR (0x3U << 12)
>>>>> +#define IOMMU_EVENT_PAGE_TAB_HW_ERROR (0x4U << 12)
>>>>> +#define IOMMU_EVENT_ILLEGAL_COMMAND_ERROR (0x5U << 12)
>>>>> +#define IOMMU_EVENT_COMMAND_HW_ERROR (0x6U << 12)
>>>>> +#define IOMMU_EVENT_IOTLB_INV_TIMEOUT (0x7U << 12)
>>>>> +#define IOMMU_EVENT_INVALID_DEV_REQUEST (0x8U << 12)
>>>>> +
>>>>> +#define IOMMU_EVENT_LEN 16
>>>>> +#define IOMMU_PERM_READ (1 << 0)
>>>>> +#define IOMMU_PERM_WRITE (1 << 1)
>>>>> +#define IOMMU_PERM_RW (IOMMU_PERM_READ | IOMMU_PERM_WRITE)
>>>>> +
>>>>> +/* AMD RD890 Chipset */
>>>>> +#define PCI_DEVICE_ID_RD890_IOMMU 0x20
>>
>>
>>>>
>>>>
>>>> We keep the pci ids in include/hw/pci/pci_ids.h
>>
>> This a dummy device id I use for IOMMU - IOMMU doesn't have a specific
>> device id. There's a device id on linux include files for a certain
>> AMD IOMMU but it makes IOMMU seem to be on a non-existant bus so I
>> don't use it.
>>
>>>>
>>>>> +
>>>>> +#define IOMMU_FEATURE_PREFETCH (1ULL << 0)
>>>>> +#define IOMMU_FEATURE_PPR (1ULL << 1)
>>>>> +#define IOMMU_FEATURE_NX (1ULL << 3)
>>>>> +#define IOMMU_FEATURE_GT (1ULL << 4)
>>>>> +#define IOMMU_FEATURE_IA (1ULL << 6)
>>>>> +#define IOMMU_FEATURE_GA (1ULL << 7)
>>>>> +#define IOMMU_FEATURE_HE (1ULL << 8)
>>>>> +#define IOMMU_FEATURE_PC (1ULL << 9)
>>>>> +
>>>>> +/* reserved DTE bits */
>>>>> +#define IOMMU_DTE_LOWER_QUAD_RESERVED 0x80300000000000fc
>>>>> +#define IOMMU_DTE_MIDDLE_QUAD_RESERVED 0x0000000000000100
>>>>> +#define IOMMU_DTE_UPPER_QUAD_RESERVED 0x08f0000000000000
>>>>> +
>>>>> +/* IOMMU paging mode */
>>>>> +#define IOMMU_GATS_MODE (6ULL << 12)
>>>>> +#define IOMMU_HATS_MODE (6ULL << 10)
>>>>> +
>>>>> +/* PCI SIG constants */
>>>>> +#define PCI_BUS_MAX 256
>>>>> +#define PCI_SLOT_MAX 32
>>>>> +#define PCI_FUNC_MAX 8
>>>>> +#define PCI_DEVFN_MAX 256
>>>>
>>>>
>>>> Maybe we can move the PCI macros to include/hw/pci/pci.h, those are not
>>>> IOMMU specific.
>>
>> Yeah, this are PCI macros but they are a not copied from linux while
>> the macros in pci.h seem to have been copied from linux.
>>
>>>>
>>>>> +
>>>>> +/* IOTLB */
>>>>> +#define IOMMU_IOTLB_MAX_SIZE 1024
>>>>> +#define IOMMU_DEVID_SHIFT 36
>>>>> +
>>>>> +/* extended feature support */
>>>>> +#define IOMMU_EXT_FEATURES (IOMMU_FEATURE_PREFETCH | IOMMU_FEATURE_PPR |
>>>>> \
>>>>> + IOMMU_FEATURE_NX | IOMMU_FEATURE_IA | IOMMU_FEATURE_GT | \
>>>>> + IOMMU_FEATURE_GA | IOMMU_FEATURE_HE | IOMMU_GATS_MODE | \
>>>>> + IOMMU_HATS_MODE)
>>>>> +
>>>>> +/* capabilities header */
>>>>> +#define IOMMU_CAPAB_FEATURES (IOMMU_CAPAB_FLAT_EXT | \
>>>>> + IOMMU_CAPAB_FLAG_NPCACHE | IOMMU_CAPAB_FLAG_IOTLBSUP \
>>>>> + | IOMMU_CAPAB_ID_SEC | IOMMU_CAPAB_INIT_TYPE | \
>>>>> + IOMMU_CAPAB_FLAG_HTTUNNEL | IOMMU_CAPAB_EFR_SUP)
>>>>> +
>>>>> +/* command constants */
>>>>> +#define IOMMU_COM_STORE_ADDRESS_MASK 0xffffffffffff8
>>>>> +#define IOMMU_COM_COMPLETION_STORE_MASK 0x1
>>>>> +#define IOMMU_COM_COMPLETION_INTR 0x2
>>>>> +#define IOMMU_COM_COMPLETION_DATA_OFF 0x8
>>>>> +#define IOMMU_COMMAND_SIZE 0x10
>>>>> +
>>>>> +/* IOMMU default address */
>>>>> +#define IOMMU_BASE_ADDR 0xfed80000
>>>>> +
>>>>> +/* page management constants */
>>>>> +#define IOMMU_PAGE_SHIFT 12
>>>>> +#define IOMMU_PAGE_SIZE (1ULL << IOMMU_PAGE_SHIFT)
>>>>> +
>>>>> +#define IOMMU_PAGE_SHIFT_4K 12
>>>>> +#define IOMMU_PAGE_MASK_4K (~((1ULL << IOMMU_PAGE_SHIFT_4K) - 1))
>>>>> +#define IOMMU_PAGE_SHIFT_2M 21
>>>>> +#define IOMMU_PAGE_MASK_2M (~((1ULL << IOMMU_PAGE_SHIFT_2M) - 1))
>>>>> +#define IOMMU_PAGE_SHIFT_1G 30
>>>>> +#define IOMMU_PAGE_MASK_1G (~((1ULL << IOMMU_PAGE_SHIFT_1G) - 1))
>>>>> +
>>>>> +#define IOMMU_MAX_VA_ADDR (48UL << 5)
>>>>> +#define IOMMU_MAX_PH_ADDR (40UL << 8)
>>>>> +#define IOMMU_MAX_GVA_ADDR (48UL << 15)
>>>>> +
>>>>> +/* invalidation command device id */
>>>>> +#define IOMMU_INVAL_DEV_ID_SHIFT 32
>>>>> +#define IOMMU_INVAL_DEV_ID_MASK (~((1UL << IOMMU_INVAL_DEV_ID_SHIFT) -
>>>>> 1))
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-02 22:04 ` David Kiarie
@ 2016-03-03 9:49 ` Michael S. Tsirkin
2016-03-03 11:47 ` David Kiarie
2016-03-08 17:15 ` David Kiarie
0 siblings, 2 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-03 9:49 UTC (permalink / raw)
To: David Kiarie
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Thu, Mar 03, 2016 at 01:04:31AM +0300, David Kiarie wrote:
> On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com> wrote:
> > On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
> >>
> >>
> >> On 22/02/16 14:22, Marcel Apfelbaum wrote:
> >> >On 02/21/2016 08:11 PM, David Kiarie wrote:
> >> >>Add AMD IOMMU emulation support to q35 chipset
> >> >>
> >> >>Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> >> >>---
> >> >> hw/pci-host/piix.c | 1 +
> >> >> hw/pci-host/q35.c | 14 ++++++++++++--
> >> >> include/hw/i386/intel_iommu.h | 1 +
> >> >> 3 files changed, 14 insertions(+), 2 deletions(-)
> >> >>
> >> >>diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
> >> >>index 41aa66f..ab2e24a 100644
> >> >>--- a/hw/pci-host/piix.c
> >> >>+++ b/hw/pci-host/piix.c
> >> >>@@ -36,6 +36,7 @@
> >> >> #include "hw/i386/ioapic.h"
> >> >> #include "qapi/visitor.h"
> >> >> #include "qemu/error-report.h"
> >> >>+#include "hw/i386/amd_iommu.h"
> >> >
> >> >Hi,
> >> >
> >> >I think you don't need this include anymore.
> >> >
> >> >>
> >> >> /*
> >> >> * I440FX chipset data sheet.
> >> >>diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> >> >>index 115fb8c..355fb32 100644
> >> >>--- a/hw/pci-host/q35.c
> >> >>+++ b/hw/pci-host/q35.c
> >> >>@@ -31,6 +31,7 @@
> >> >> #include "hw/hw.h"
> >> >> #include "hw/pci-host/q35.h"
> >> >> #include "qapi/visitor.h"
> >> >>+#include "hw/i386/amd_iommu.h"
> >> >>
> >> >>/****************************************************************************
> >> >> * Q35 host
> >> >>@@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
> >> >> mch->pci_address_space, &mch->pam_regions[i+1],
> >> >> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
> >> >> }
> >> >>- /* Intel IOMMU (VT-d) */
> >> >>- if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
> >> >>+
> >> >>+ if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
> >> >>== 0) {
> >> >>+ /* Intel IOMMU (VT-d) */
> >> >> mch_init_dmar(mch);
> >> >>+ } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
> >> >>AMD_IOMMU_STR)
> >> >>+ == 0) {
> >> >>+ AMDIOMMUState *iommu_state;
> >> >>+ PCIDevice *iommu;
> >> >>+ PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
> >> >>+ iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
> >
> > Pls don't hardcode paths like this. Set addr property instead.
> >
> >> >>+ iommu_state = AMD_IOMMU_DEVICE(iommu);
> >> >>+ pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
> >> >
> >> >pci_setup_iommu third parameter is void*, so you don't need to cast to
> >> >AMDIOMMUState
> >> >before passing it.
> >>
> >> This include is necessary for the definition of "AMD_IOMMU_STR" either way
> >> so am leaving this as is.
> >
> > This option parsing is just too ugly.
> >
> > Looks like it was a mistake to support the iommu
> > machine property, but I see no reason to add to the
> > existing mess.
> >
> > Can't users create iommu with -device amd-iommu ?
>
> You mean getting rid of the above code and starting device with
> '-device amd-iommu' ? This way am not able to setup IOMMU regions for
> devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
> sets up IOMMU region for IOMMU only. Calling this from the bus sets up
> IOMMU regions for all devices though.
>
> I need to setup IOMMU regions for all devices from the bus, to be able
> to do that I need to have created the IOMMU device first.
I agree it's unfortunate, but I don't think internal limitations
should affect the user interface like this.
I wish we had a way to specify initialization order for devices in some
way, such that system devices are created before others.
For now, can you call pci_setup_iommu in the machine done callback?
> >
> > It's necessary if we are to support multiple IOMMUs, anyway.
> >
> >> >
> >> >Thanks,
> >> >Marcel
> >> >
> >> >> }
> >> >> }
> >> >>
> >> >>diff --git a/include/hw/i386/intel_iommu.h
> >> >>b/include/hw/i386/intel_iommu.h
> >> >>index b024ffa..539530c 100644
> >> >>--- a/include/hw/i386/intel_iommu.h
> >> >>+++ b/include/hw/i386/intel_iommu.h
> >> >>@@ -27,6 +27,7 @@
> >> >> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
> >> >> #define INTEL_IOMMU_DEVICE(obj) \
> >> >> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
> >> >>+#define INTEL_IOMMU_STR "intel"
> >> >>
> >> >> /* DMAR Hardware Unit Definition address (IOMMU unit) */
> >> >> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
> >> >>
> >> >
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-03 9:49 ` Michael S. Tsirkin
@ 2016-03-03 11:47 ` David Kiarie
2016-03-03 12:02 ` Marcel Apfelbaum
2016-03-08 17:15 ` David Kiarie
1 sibling, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-03 11:47 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Thu, Mar 3, 2016 at 12:49 PM, Michael S. Tsirkin <mst@redhat.com> wrote:
> On Thu, Mar 03, 2016 at 01:04:31AM +0300, David Kiarie wrote:
>> On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com> wrote:
>> > On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>> >>
>> >>
>> >> On 22/02/16 14:22, Marcel Apfelbaum wrote:
>> >> >On 02/21/2016 08:11 PM, David Kiarie wrote:
>> >> >>Add AMD IOMMU emulation support to q35 chipset
>> >> >>
>> >> >>Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> >> >>---
>> >> >> hw/pci-host/piix.c | 1 +
>> >> >> hw/pci-host/q35.c | 14 ++++++++++++--
>> >> >> include/hw/i386/intel_iommu.h | 1 +
>> >> >> 3 files changed, 14 insertions(+), 2 deletions(-)
>> >> >>
>> >> >>diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>> >> >>index 41aa66f..ab2e24a 100644
>> >> >>--- a/hw/pci-host/piix.c
>> >> >>+++ b/hw/pci-host/piix.c
>> >> >>@@ -36,6 +36,7 @@
>> >> >> #include "hw/i386/ioapic.h"
>> >> >> #include "qapi/visitor.h"
>> >> >> #include "qemu/error-report.h"
>> >> >>+#include "hw/i386/amd_iommu.h"
>> >> >
>> >> >Hi,
>> >> >
>> >> >I think you don't need this include anymore.
>> >> >
>> >> >>
>> >> >> /*
>> >> >> * I440FX chipset data sheet.
>> >> >>diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>> >> >>index 115fb8c..355fb32 100644
>> >> >>--- a/hw/pci-host/q35.c
>> >> >>+++ b/hw/pci-host/q35.c
>> >> >>@@ -31,6 +31,7 @@
>> >> >> #include "hw/hw.h"
>> >> >> #include "hw/pci-host/q35.h"
>> >> >> #include "qapi/visitor.h"
>> >> >>+#include "hw/i386/amd_iommu.h"
>> >> >>
>> >> >>/****************************************************************************
>> >> >> * Q35 host
>> >> >>@@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
>> >> >> mch->pci_address_space, &mch->pam_regions[i+1],
>> >> >> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
>> >> >> }
>> >> >>- /* Intel IOMMU (VT-d) */
>> >> >>- if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
>> >> >>+
>> >> >>+ if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
>> >> >>== 0) {
>> >> >>+ /* Intel IOMMU (VT-d) */
>> >> >> mch_init_dmar(mch);
>> >> >>+ } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>> >> >>AMD_IOMMU_STR)
>> >> >>+ == 0) {
>> >> >>+ AMDIOMMUState *iommu_state;
>> >> >>+ PCIDevice *iommu;
>> >> >>+ PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>> >> >>+ iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
>> >
>> > Pls don't hardcode paths like this. Set addr property instead.
>> >
>> >> >>+ iommu_state = AMD_IOMMU_DEVICE(iommu);
>> >> >>+ pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>> >> >
>> >> >pci_setup_iommu third parameter is void*, so you don't need to cast to
>> >> >AMDIOMMUState
>> >> >before passing it.
>> >>
>> >> This include is necessary for the definition of "AMD_IOMMU_STR" either way
>> >> so am leaving this as is.
>> >
>> > This option parsing is just too ugly.
>> >
>> > Looks like it was a mistake to support the iommu
>> > machine property, but I see no reason to add to the
>> > existing mess.
>> >
>> > Can't users create iommu with -device amd-iommu ?
>>
>> You mean getting rid of the above code and starting device with
>> '-device amd-iommu' ? This way am not able to setup IOMMU regions for
>> devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
>> sets up IOMMU region for IOMMU only. Calling this from the bus sets up
>> IOMMU regions for all devices though.
>>
>> I need to setup IOMMU regions for all devices from the bus, to be able
>> to do that I need to have created the IOMMU device first.
>
> I agree it's unfortunate, but I don't think internal limitations
> should affect the user interface like this.
>
> I wish we had a way to specify initialization order for devices in some
> way, such that system devices are created before others.
>
> For now, can you call pci_setup_iommu in the machine done callback?
>
>> >
>> > It's necessary if we are to support multiple IOMMUs, anyway.
If this is mainly to allow users run multiple IOMMUs I think the
greatest limitation is that Qemu only have one PCI bus which can only
host one IOMMU, AFAIK so unless there are huge structural changes
running multiple IOMMU on Qemu may not be possible.
>> >
>> >> >
>> >> >Thanks,
>> >> >Marcel
>> >> >
>> >> >> }
>> >> >> }
>> >> >>
>> >> >>diff --git a/include/hw/i386/intel_iommu.h
>> >> >>b/include/hw/i386/intel_iommu.h
>> >> >>index b024ffa..539530c 100644
>> >> >>--- a/include/hw/i386/intel_iommu.h
>> >> >>+++ b/include/hw/i386/intel_iommu.h
>> >> >>@@ -27,6 +27,7 @@
>> >> >> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>> >> >> #define INTEL_IOMMU_DEVICE(obj) \
>> >> >> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
>> >> >>+#define INTEL_IOMMU_STR "intel"
>> >> >>
>> >> >> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>> >> >> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>> >> >>
>> >> >
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-03 11:47 ` David Kiarie
@ 2016-03-03 12:02 ` Marcel Apfelbaum
2016-03-03 12:06 ` Marcel Apfelbaum
0 siblings, 1 reply; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-03-03 12:02 UTC (permalink / raw)
To: David Kiarie, Michael S. Tsirkin
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On 03/03/2016 01:47 PM, David Kiarie wrote:
> On Thu, Mar 3, 2016 at 12:49 PM, Michael S. Tsirkin <mst@redhat.com> wrote:
>> On Thu, Mar 03, 2016 at 01:04:31AM +0300, David Kiarie wrote:
>>> On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com> wrote:
>>>> On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>>>>>
>>>>>
>>>>> On 22/02/16 14:22, Marcel Apfelbaum wrote:
>>>>>> On 02/21/2016 08:11 PM, David Kiarie wrote:
>>>>>>> Add AMD IOMMU emulation support to q35 chipset
>>>>>>>
>>>>>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>>>>>> ---
>>>>>>> hw/pci-host/piix.c | 1 +
>>>>>>> hw/pci-host/q35.c | 14 ++++++++++++--
>>>>>>> include/hw/i386/intel_iommu.h | 1 +
>>>>>>> 3 files changed, 14 insertions(+), 2 deletions(-)
>>>>>>>
>>>>>>> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>>>>>>> index 41aa66f..ab2e24a 100644
>>>>>>> --- a/hw/pci-host/piix.c
>>>>>>> +++ b/hw/pci-host/piix.c
>>>>>>> @@ -36,6 +36,7 @@
>>>>>>> #include "hw/i386/ioapic.h"
>>>>>>> #include "qapi/visitor.h"
>>>>>>> #include "qemu/error-report.h"
>>>>>>> +#include "hw/i386/amd_iommu.h"
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> I think you don't need this include anymore.
>>>>>>
>>>>>>>
>>>>>>> /*
>>>>>>> * I440FX chipset data sheet.
>>>>>>> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>>>>>>> index 115fb8c..355fb32 100644
>>>>>>> --- a/hw/pci-host/q35.c
>>>>>>> +++ b/hw/pci-host/q35.c
>>>>>>> @@ -31,6 +31,7 @@
>>>>>>> #include "hw/hw.h"
>>>>>>> #include "hw/pci-host/q35.h"
>>>>>>> #include "qapi/visitor.h"
>>>>>>> +#include "hw/i386/amd_iommu.h"
>>>>>>>
>>>>>>> /****************************************************************************
>>>>>>> * Q35 host
>>>>>>> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
>>>>>>> mch->pci_address_space, &mch->pam_regions[i+1],
>>>>>>> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
>>>>>>> }
>>>>>>> - /* Intel IOMMU (VT-d) */
>>>>>>> - if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
>>>>>>> +
>>>>>>> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
>>>>>>> == 0) {
>>>>>>> + /* Intel IOMMU (VT-d) */
>>>>>>> mch_init_dmar(mch);
>>>>>>> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>>>>>>> AMD_IOMMU_STR)
>>>>>>> + == 0) {
>>>>>>> + AMDIOMMUState *iommu_state;
>>>>>>> + PCIDevice *iommu;
>>>>>>> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>>>>>>> + iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
>>>>
>>>> Pls don't hardcode paths like this. Set addr property instead.
>>>>
>>>>>>> + iommu_state = AMD_IOMMU_DEVICE(iommu);
>>>>>>> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>>>>>>
>>>>>> pci_setup_iommu third parameter is void*, so you don't need to cast to
>>>>>> AMDIOMMUState
>>>>>> before passing it.
>>>>>
>>>>> This include is necessary for the definition of "AMD_IOMMU_STR" either way
>>>>> so am leaving this as is.
>>>>
>>>> This option parsing is just too ugly.
>>>>
>>>> Looks like it was a mistake to support the iommu
>>>> machine property, but I see no reason to add to the
>>>> existing mess.
>>>>
>>>> Can't users create iommu with -device amd-iommu ?
>>>
>>> You mean getting rid of the above code and starting device with
>>> '-device amd-iommu' ? This way am not able to setup IOMMU regions for
>>> devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
>>> sets up IOMMU region for IOMMU only. Calling this from the bus sets up
>>> IOMMU regions for all devices though.
>>>
>>> I need to setup IOMMU regions for all devices from the bus, to be able
>>> to do that I need to have created the IOMMU device first.
>>
>> I agree it's unfortunate, but I don't think internal limitations
>> should affect the user interface like this.
>>
>> I wish we had a way to specify initialization order for devices in some
>> way, such that system devices are created before others.
>>
>> For now, can you call pci_setup_iommu in the machine done callback?
>>
>>>>
>>>> It's necessary if we are to support multiple IOMMUs, anyway.
>
> If this is mainly to allow users run multiple IOMMUs I think the
> greatest limitation is that Qemu only have one PCI bus which can only
> host one IOMMU, AFAIK so unless there are huge structural changes
> running multiple IOMMU on Qemu may not be possible.
Actually we have good news on this front.
You can use as many pxb-pcie devices as you want to create extra PCI root buses.
Assigning them different IOMMUs would be great. (long term, of course)
Thanks,
Marcel
>
>>>>
>>>>>>
>>>>>> Thanks,
>>>>>> Marcel
>>>>>>
>>>>>>> }
>>>>>>> }
>>>>>>>
>>>>>>> diff --git a/include/hw/i386/intel_iommu.h
>>>>>>> b/include/hw/i386/intel_iommu.h
>>>>>>> index b024ffa..539530c 100644
>>>>>>> --- a/include/hw/i386/intel_iommu.h
>>>>>>> +++ b/include/hw/i386/intel_iommu.h
>>>>>>> @@ -27,6 +27,7 @@
>>>>>>> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>>>>>>> #define INTEL_IOMMU_DEVICE(obj) \
>>>>>>> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
>>>>>>> +#define INTEL_IOMMU_STR "intel"
>>>>>>>
>>>>>>> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>>>>>>> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>>>>>>>
>>>>>>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-03 12:02 ` Marcel Apfelbaum
@ 2016-03-03 12:06 ` Marcel Apfelbaum
2016-03-03 12:18 ` David Kiarie
0 siblings, 1 reply; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-03-03 12:06 UTC (permalink / raw)
To: David Kiarie, Michael S. Tsirkin
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On 03/03/2016 02:02 PM, Marcel Apfelbaum wrote:
> On 03/03/2016 01:47 PM, David Kiarie wrote:
>> On Thu, Mar 3, 2016 at 12:49 PM, Michael S. Tsirkin <mst@redhat.com> wrote:
>>> On Thu, Mar 03, 2016 at 01:04:31AM +0300, David Kiarie wrote:
>>>> On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com> wrote:
>>>>> On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>>>>>>
>>>>>>
>>>>>> On 22/02/16 14:22, Marcel Apfelbaum wrote:
>>>>>>> On 02/21/2016 08:11 PM, David Kiarie wrote:
>>>>>>>> Add AMD IOMMU emulation support to q35 chipset
>>>>>>>>
>>>>>>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>>>>>>> ---
>>>>>>>> hw/pci-host/piix.c | 1 +
>>>>>>>> hw/pci-host/q35.c | 14 ++++++++++++--
>>>>>>>> include/hw/i386/intel_iommu.h | 1 +
>>>>>>>> 3 files changed, 14 insertions(+), 2 deletions(-)
>>>>>>>>
>>>>>>>> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>>>>>>>> index 41aa66f..ab2e24a 100644
>>>>>>>> --- a/hw/pci-host/piix.c
>>>>>>>> +++ b/hw/pci-host/piix.c
>>>>>>>> @@ -36,6 +36,7 @@
>>>>>>>> #include "hw/i386/ioapic.h"
>>>>>>>> #include "qapi/visitor.h"
>>>>>>>> #include "qemu/error-report.h"
>>>>>>>> +#include "hw/i386/amd_iommu.h"
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> I think you don't need this include anymore.
>>>>>>>
>>>>>>>>
>>>>>>>> /*
>>>>>>>> * I440FX chipset data sheet.
>>>>>>>> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>>>>>>>> index 115fb8c..355fb32 100644
>>>>>>>> --- a/hw/pci-host/q35.c
>>>>>>>> +++ b/hw/pci-host/q35.c
>>>>>>>> @@ -31,6 +31,7 @@
>>>>>>>> #include "hw/hw.h"
>>>>>>>> #include "hw/pci-host/q35.h"
>>>>>>>> #include "qapi/visitor.h"
>>>>>>>> +#include "hw/i386/amd_iommu.h"
>>>>>>>>
>>>>>>>> /****************************************************************************
>>>>>>>> * Q35 host
>>>>>>>> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
>>>>>>>> mch->pci_address_space, &mch->pam_regions[i+1],
>>>>>>>> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
>>>>>>>> }
>>>>>>>> - /* Intel IOMMU (VT-d) */
>>>>>>>> - if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
>>>>>>>> +
>>>>>>>> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
>>>>>>>> == 0) {
>>>>>>>> + /* Intel IOMMU (VT-d) */
>>>>>>>> mch_init_dmar(mch);
>>>>>>>> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>>>>>>>> AMD_IOMMU_STR)
>>>>>>>> + == 0) {
>>>>>>>> + AMDIOMMUState *iommu_state;
>>>>>>>> + PCIDevice *iommu;
>>>>>>>> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>>>>>>>> + iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
>>>>>
>>>>> Pls don't hardcode paths like this. Set addr property instead.
>>>>>
>>>>>>>> + iommu_state = AMD_IOMMU_DEVICE(iommu);
>>>>>>>> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>>>>>>>
>>>>>>> pci_setup_iommu third parameter is void*, so you don't need to cast to
>>>>>>> AMDIOMMUState
>>>>>>> before passing it.
>>>>>>
>>>>>> This include is necessary for the definition of "AMD_IOMMU_STR" either way
>>>>>> so am leaving this as is.
>>>>>
>>>>> This option parsing is just too ugly.
>>>>>
>>>>> Looks like it was a mistake to support the iommu
>>>>> machine property, but I see no reason to add to the
>>>>> existing mess.
>>>>>
>>>>> Can't users create iommu with -device amd-iommu ?
>>>>
>>>> You mean getting rid of the above code and starting device with
>>>> '-device amd-iommu' ? This way am not able to setup IOMMU regions for
>>>> devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
>>>> sets up IOMMU region for IOMMU only. Calling this from the bus sets up
>>>> IOMMU regions for all devices though.
>>>>
>>>> I need to setup IOMMU regions for all devices from the bus, to be able
>>>> to do that I need to have created the IOMMU device first.
>>>
>>> I agree it's unfortunate, but I don't think internal limitations
>>> should affect the user interface like this.
>>>
>>> I wish we had a way to specify initialization order for devices in some
>>> way, such that system devices are created before others.
>>>
>>> For now, can you call pci_setup_iommu in the machine done callback?
>>>
>>>>>
>>>>> It's necessary if we are to support multiple IOMMUs, anyway.
>>
>> If this is mainly to allow users run multiple IOMMUs I think the
>> greatest limitation is that Qemu only have one PCI bus which can only
>> host one IOMMU, AFAIK so unless there are huge structural changes
>> running multiple IOMMU on Qemu may not be possible.
>
> Actually we have good news on this front.
> You can use as many pxb-pcie devices as you want to create extra PCI root buses.
> Assigning them different IOMMUs would be great. (long term, of course)
>
Even without pxb-pcie, you can add a pci-bridge to expose a secondary PCI bus
and limit IOMMU scope to that PCI bridge.
Thanks,
Marcel
>
> Thanks,
> Marcel
>
>>
>>>>>
>>>>>>>
>>>>>>> Thanks,
>>>>>>> Marcel
>>>>>>>
>>>>>>>> }
>>>>>>>> }
>>>>>>>>
>>>>>>>> diff --git a/include/hw/i386/intel_iommu.h
>>>>>>>> b/include/hw/i386/intel_iommu.h
>>>>>>>> index b024ffa..539530c 100644
>>>>>>>> --- a/include/hw/i386/intel_iommu.h
>>>>>>>> +++ b/include/hw/i386/intel_iommu.h
>>>>>>>> @@ -27,6 +27,7 @@
>>>>>>>> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>>>>>>>> #define INTEL_IOMMU_DEVICE(obj) \
>>>>>>>> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
>>>>>>>> +#define INTEL_IOMMU_STR "intel"
>>>>>>>>
>>>>>>>> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>>>>>>>> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>>>>>>>>
>>>>>>>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 1/4] hw/i386: Introduce AMD IOMMU
2016-03-02 19:11 ` David Kiarie
@ 2016-03-03 12:16 ` Marcel Apfelbaum
0 siblings, 0 replies; 53+ messages in thread
From: Marcel Apfelbaum @ 2016-03-03 12:16 UTC (permalink / raw)
To: David Kiarie, qemu-devel; +Cc: valentine.sinitsyn, jan.kiszka, mst
On 03/02/2016 09:11 PM, David Kiarie wrote:
>
>
> On 25/02/16 18:43, Marcel Apfelbaum wrote:
>> On 02/21/2016 08:10 PM, David Kiarie wrote:
>>> Add AMD IOMMU emulaton to Qemu in addition to Intel IOMMU
>>> The IOMMU does basic translation, error checking and has a
>>> mininal IOTLB implementation
>>
>> Hi,
>>
>>>
>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>> ---
>
[...]
>>> +
>>> +static void amd_iommu_realize(PCIDevice *dev, Error **error)
>>> +{
>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>> +
>>> + s->iotlb = g_hash_table_new_full(amd_iommu_uint64_hash,
>>> + amd_iommu_uint64_equal, g_free, g_free);
>>> +
>>> + s->capab_offset = pci_add_capability(dev, IOMMU_CAPAB_ID_SEC, 0,
>>> + IOMMU_CAPAB_SIZE);
>>> +
>>> + /* add msi and hypertransport capabilities */
>>> + pci_add_capability(&s->dev, PCI_CAP_ID_MSI, 0, IOMMU_CAPAB_REG_SIZE);
>>> + pci_add_capability(&s->dev, PCI_CAP_ID_HT, 0, IOMMU_CAPAB_REG_SIZE);
>>> +
>>> + amd_iommu_init(s);
>>> +
>>> + /* set up MMIO */
>>> + memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "mmio",
>>> + IOMMU_MMIO_SIZE);
>>> +
>>> + if (s->mmio.addr == IOMMU_BASE_ADDR) {
>>
>> I don't understand why is need here. realize is called only once in the init process
>> and you set it a few lines below.
>>
>>> + return;
>>> + }
>>> +
>>> + s->mmio.addr = IOMMU_BASE_ADDR;
>>> + memory_region_add_subregion(get_system_memory(), IOMMU_BASE_ADDR, &s->mmio);
>>> +}
>>> +
>>> +static const VMStateDescription vmstate_amd_iommu = {
>>> + .name = "amd-iommu",
>>> + .fields = (VMStateField[]) {
>>> + VMSTATE_PCI_DEVICE(dev, AMDIOMMUState),
>>> + VMSTATE_END_OF_LIST()
>>> + }
>>> +};
>>> +
>>> +static Property amd_iommu_properties[] = {
>>> + DEFINE_PROP_UINT32("version", AMDIOMMUState, version, 2),
>>> + DEFINE_PROP_END_OF_LIST(),
>>> +};
>>> +
>>> +static void amd_iommu_uninit(PCIDevice *dev)
>>> +{
>>> + AMDIOMMUState *s = container_of(dev, AMDIOMMUState, dev);
>>> + amd_iommu_iotlb_reset(s);
>>
>> at this point you also need to clean also the memory regions you use.
>
> What exactly do you mean by clean up the memory regions ?
>
You have an memory_region_add_subregion on realize, you need
a memory_region_del_subregion on exit.
Thanks,
Marcel
>>
>>> +}
>>> +
>>> +static void amd_iommu_class_init(ObjectClass *klass, void* data)
>>> +{
>>> + DeviceClass *dc = DEVICE_CLASS(klass);
>>> + PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
>>> +
>>> + k->realize = amd_iommu_realize;
>>> + k->exit = amd_iommu_uninit;
>>> +
>>> + dc->reset = amd_iommu_reset;
>>> + dc->vmsd = &vmstate_amd_iommu;
>>> + dc->props = amd_iommu_properties;
>>> +}
>>> +
>>> +static const TypeInfo amd_iommu = {
>>> + .name = TYPE_AMD_IOMMU_DEVICE,
>>> + .parent = TYPE_PCI_DEVICE,
>>> + .instance_size = sizeof(AMDIOMMUState),
>>> + .class_init = amd_iommu_class_init
>>> +};
>>> +
>>> +static void amd_iommu_register_types(void)
>>> +{
>>> + type_register_static(&amd_iommu);
>>> +}
>>> +
>>> +type_init(amd_iommu_register_types);
[...]
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-03 12:06 ` Marcel Apfelbaum
@ 2016-03-03 12:18 ` David Kiarie
2016-03-03 12:58 ` Michael S. Tsirkin
0 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-03 12:18 UTC (permalink / raw)
To: Marcel Apfelbaum
Cc: Valentine Sinitsyn, Jan Kiszka, QEMU Developers, Michael S. Tsirkin
On Thu, Mar 3, 2016 at 3:06 PM, Marcel Apfelbaum <marcel@redhat.com> wrote:
> On 03/03/2016 02:02 PM, Marcel Apfelbaum wrote:
>>
>> On 03/03/2016 01:47 PM, David Kiarie wrote:
>>>
>>> On Thu, Mar 3, 2016 at 12:49 PM, Michael S. Tsirkin <mst@redhat.com>
>>> wrote:
>>>>
>>>> On Thu, Mar 03, 2016 at 01:04:31AM +0300, David Kiarie wrote:
>>>>>
>>>>> On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com>
>>>>> wrote:
>>>>>>
>>>>>> On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> On 22/02/16 14:22, Marcel Apfelbaum wrote:
>>>>>>>>
>>>>>>>> On 02/21/2016 08:11 PM, David Kiarie wrote:
>>>>>>>>>
>>>>>>>>> Add AMD IOMMU emulation support to q35 chipset
>>>>>>>>>
>>>>>>>>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>>>>>>>>> ---
>>>>>>>>> hw/pci-host/piix.c | 1 +
>>>>>>>>> hw/pci-host/q35.c | 14 ++++++++++++--
>>>>>>>>> include/hw/i386/intel_iommu.h | 1 +
>>>>>>>>> 3 files changed, 14 insertions(+), 2 deletions(-)
>>>>>>>>>
>>>>>>>>> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>>>>>>>>> index 41aa66f..ab2e24a 100644
>>>>>>>>> --- a/hw/pci-host/piix.c
>>>>>>>>> +++ b/hw/pci-host/piix.c
>>>>>>>>> @@ -36,6 +36,7 @@
>>>>>>>>> #include "hw/i386/ioapic.h"
>>>>>>>>> #include "qapi/visitor.h"
>>>>>>>>> #include "qemu/error-report.h"
>>>>>>>>> +#include "hw/i386/amd_iommu.h"
>>>>>>>>
>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> I think you don't need this include anymore.
>>>>>>>>
>>>>>>>>>
>>>>>>>>> /*
>>>>>>>>> * I440FX chipset data sheet.
>>>>>>>>> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>>>>>>>>> index 115fb8c..355fb32 100644
>>>>>>>>> --- a/hw/pci-host/q35.c
>>>>>>>>> +++ b/hw/pci-host/q35.c
>>>>>>>>> @@ -31,6 +31,7 @@
>>>>>>>>> #include "hw/hw.h"
>>>>>>>>> #include "hw/pci-host/q35.h"
>>>>>>>>> #include "qapi/visitor.h"
>>>>>>>>> +#include "hw/i386/amd_iommu.h"
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> /****************************************************************************
>>>>>>>>> * Q35 host
>>>>>>>>> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error
>>>>>>>>> **errp)
>>>>>>>>> mch->pci_address_space, &mch->pam_regions[i+1],
>>>>>>>>> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE,
>>>>>>>>> PAM_EXPAN_SIZE);
>>>>>>>>> }
>>>>>>>>> - /* Intel IOMMU (VT-d) */
>>>>>>>>> - if (object_property_get_bool(qdev_get_machine(), "iommu",
>>>>>>>>> NULL)) {
>>>>>>>>> +
>>>>>>>>> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>>>>>>>>> INTEL_IOMMU_STR)
>>>>>>>>> == 0) {
>>>>>>>>> + /* Intel IOMMU (VT-d) */
>>>>>>>>> mch_init_dmar(mch);
>>>>>>>>> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>>>>>>>>> AMD_IOMMU_STR)
>>>>>>>>> + == 0) {
>>>>>>>>> + AMDIOMMUState *iommu_state;
>>>>>>>>> + PCIDevice *iommu;
>>>>>>>>> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>>>>>>>>> + iommu = pci_create_simple(bus, 0x20,
>>>>>>>>> TYPE_AMD_IOMMU_DEVICE);
>>>>>>
>>>>>>
>>>>>> Pls don't hardcode paths like this. Set addr property instead.
>>>>>>
>>>>>>>>> + iommu_state = AMD_IOMMU_DEVICE(iommu);
>>>>>>>>> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>>>>>>>>
>>>>>>>>
>>>>>>>> pci_setup_iommu third parameter is void*, so you don't need to cast
>>>>>>>> to
>>>>>>>> AMDIOMMUState
>>>>>>>> before passing it.
>>>>>>>
>>>>>>>
>>>>>>> This include is necessary for the definition of "AMD_IOMMU_STR"
>>>>>>> either way
>>>>>>> so am leaving this as is.
>>>>>>
>>>>>>
>>>>>> This option parsing is just too ugly.
>>>>>>
>>>>>> Looks like it was a mistake to support the iommu
>>>>>> machine property, but I see no reason to add to the
>>>>>> existing mess.
>>>>>>
>>>>>> Can't users create iommu with -device amd-iommu ?
>>>>>
>>>>>
>>>>> You mean getting rid of the above code and starting device with
>>>>> '-device amd-iommu' ? This way am not able to setup IOMMU regions for
>>>>> devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
>>>>> sets up IOMMU region for IOMMU only. Calling this from the bus sets up
>>>>> IOMMU regions for all devices though.
>>>>>
>>>>> I need to setup IOMMU regions for all devices from the bus, to be able
>>>>> to do that I need to have created the IOMMU device first.
>>>>
>>>>
>>>> I agree it's unfortunate, but I don't think internal limitations
>>>> should affect the user interface like this.
>>>>
>>>> I wish we had a way to specify initialization order for devices in some
>>>> way, such that system devices are created before others.
>>>>
>>>> For now, can you call pci_setup_iommu in the machine done callback?
>>>>
>>>>>>
>>>>>> It's necessary if we are to support multiple IOMMUs, anyway.
>>>
>>>
>>> If this is mainly to allow users run multiple IOMMUs I think the
>>> greatest limitation is that Qemu only have one PCI bus which can only
>>> host one IOMMU, AFAIK so unless there are huge structural changes
>>> running multiple IOMMU on Qemu may not be possible.
>>
>>
>> Actually we have good news on this front.
>> You can use as many pxb-pcie devices as you want to create extra PCI root
>> buses.
>> Assigning them different IOMMUs would be great. (long term, of course)
>>
>
> Even without pxb-pcie, you can add a pci-bridge to expose a secondary PCI
> bus
> and limit IOMMU scope to that PCI bridge.
Hmmh, good to know. Will look at that.
>
> Thanks,
> Marcel
>
>
>>
>> Thanks,
>> Marcel
>>
>>>
>>>>>>
>>>>>>>>
>>>>>>>> Thanks,
>>>>>>>> Marcel
>>>>>>>>
>>>>>>>>> }
>>>>>>>>> }
>>>>>>>>>
>>>>>>>>> diff --git a/include/hw/i386/intel_iommu.h
>>>>>>>>> b/include/hw/i386/intel_iommu.h
>>>>>>>>> index b024ffa..539530c 100644
>>>>>>>>> --- a/include/hw/i386/intel_iommu.h
>>>>>>>>> +++ b/include/hw/i386/intel_iommu.h
>>>>>>>>> @@ -27,6 +27,7 @@
>>>>>>>>> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>>>>>>>>> #define INTEL_IOMMU_DEVICE(obj) \
>>>>>>>>> OBJECT_CHECK(IntelIOMMUState, (obj),
>>>>>>>>> TYPE_INTEL_IOMMU_DEVICE)
>>>>>>>>> +#define INTEL_IOMMU_STR "intel"
>>>>>>>>>
>>>>>>>>> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>>>>>>>>> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>>>>>>>>>
>>>>>>>>
>>
>
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-03 12:18 ` David Kiarie
@ 2016-03-03 12:58 ` Michael S. Tsirkin
0 siblings, 0 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-03 12:58 UTC (permalink / raw)
To: David Kiarie
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Thu, Mar 03, 2016 at 03:18:18PM +0300, David Kiarie wrote:
> >> Actually we have good news on this front.
> >> You can use as many pxb-pcie devices as you want to create extra PCI root
> >> buses.
> >> Assigning them different IOMMUs would be great. (long term, of course)
> >>
> >
> > Even without pxb-pcie, you can add a pci-bridge to expose a secondary PCI
> > bus
> > and limit IOMMU scope to that PCI bridge.
>
> Hmmh, good to know. Will look at that.
OK but there's no rush wrt that.
What I chiefly would like is getting command line right
so we don't need to maintain legacy command line syntax.
Support for many iommus can come later,
--
MST
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-03 9:49 ` Michael S. Tsirkin
2016-03-03 11:47 ` David Kiarie
@ 2016-03-08 17:15 ` David Kiarie
1 sibling, 0 replies; 53+ messages in thread
From: David Kiarie @ 2016-03-08 17:15 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Thu, Mar 3, 2016 at 12:49 PM, Michael S. Tsirkin <mst@redhat.com> wrote:
> On Thu, Mar 03, 2016 at 01:04:31AM +0300, David Kiarie wrote:
>> On Thu, Mar 3, 2016 at 12:17 AM, Michael S. Tsirkin <mst@redhat.com> wrote:
>> > On Thu, Mar 03, 2016 at 12:09:28AM +0300, David Kiarie wrote:
>> >>
>> >>
>> >> On 22/02/16 14:22, Marcel Apfelbaum wrote:
>> >> >On 02/21/2016 08:11 PM, David Kiarie wrote:
>> >> >>Add AMD IOMMU emulation support to q35 chipset
>> >> >>
>> >> >>Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> >> >>---
>> >> >> hw/pci-host/piix.c | 1 +
>> >> >> hw/pci-host/q35.c | 14 ++++++++++++--
>> >> >> include/hw/i386/intel_iommu.h | 1 +
>> >> >> 3 files changed, 14 insertions(+), 2 deletions(-)
>> >> >>
>> >> >>diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>> >> >>index 41aa66f..ab2e24a 100644
>> >> >>--- a/hw/pci-host/piix.c
>> >> >>+++ b/hw/pci-host/piix.c
>> >> >>@@ -36,6 +36,7 @@
>> >> >> #include "hw/i386/ioapic.h"
>> >> >> #include "qapi/visitor.h"
>> >> >> #include "qemu/error-report.h"
>> >> >>+#include "hw/i386/amd_iommu.h"
>> >> >
>> >> >Hi,
>> >> >
>> >> >I think you don't need this include anymore.
>> >> >
>> >> >>
>> >> >> /*
>> >> >> * I440FX chipset data sheet.
>> >> >>diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>> >> >>index 115fb8c..355fb32 100644
>> >> >>--- a/hw/pci-host/q35.c
>> >> >>+++ b/hw/pci-host/q35.c
>> >> >>@@ -31,6 +31,7 @@
>> >> >> #include "hw/hw.h"
>> >> >> #include "hw/pci-host/q35.h"
>> >> >> #include "qapi/visitor.h"
>> >> >>+#include "hw/i386/amd_iommu.h"
>> >> >>
>> >> >>/****************************************************************************
>> >> >> * Q35 host
>> >> >>@@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
>> >> >> mch->pci_address_space, &mch->pam_regions[i+1],
>> >> >> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
>> >> >> }
>> >> >>- /* Intel IOMMU (VT-d) */
>> >> >>- if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
>> >> >>+
>> >> >>+ if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR)
>> >> >>== 0) {
>> >> >>+ /* Intel IOMMU (VT-d) */
>> >> >> mch_init_dmar(mch);
>> >> >>+ } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu,
>> >> >>AMD_IOMMU_STR)
>> >> >>+ == 0) {
>> >> >>+ AMDIOMMUState *iommu_state;
>> >> >>+ PCIDevice *iommu;
>> >> >>+ PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>> >> >>+ iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
>> >
>> > Pls don't hardcode paths like this. Set addr property instead.
>> >
>> >> >>+ iommu_state = AMD_IOMMU_DEVICE(iommu);
>> >> >>+ pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>> >> >
>> >> >pci_setup_iommu third parameter is void*, so you don't need to cast to
>> >> >AMDIOMMUState
>> >> >before passing it.
>> >>
>> >> This include is necessary for the definition of "AMD_IOMMU_STR" either way
>> >> so am leaving this as is.
>> >
>> > This option parsing is just too ugly.
>> >
>> > Looks like it was a mistake to support the iommu
>> > machine property, but I see no reason to add to the
>> > existing mess.
>> >
>> > Can't users create iommu with -device amd-iommu ?
>>
>> You mean getting rid of the above code and starting device with
>> '-device amd-iommu' ? This way am not able to setup IOMMU regions for
>> devices correctly. IIRC 'pci_setup_iommu' when called from IOMMU code
>> sets up IOMMU region for IOMMU only. Calling this from the bus sets up
>> IOMMU regions for all devices though.
>>
>> I need to setup IOMMU regions for all devices from the bus, to be able
>> to do that I need to have created the IOMMU device first.
>
> I agree it's unfortunate, but I don't think internal limitations
> should affect the user interface like this.
>
> I wish we had a way to specify initialization order for devices in some
> way, such that system devices are created before others.
>
> For now, can you call pci_setup_iommu in the machine done callback?
Looking at this, machine_done seems to be happening too late. It seems
IOMMU regions are setup by 'pcidev->realize'( at which time you need
to have supplied the bus-IOMMU-regions-setup callback).
pci_iommu_setup is the function that sets up the
bus-IOMMU-regions-setup callback. There could be some other way am
missing but the problem that comes to my head is that if we are not
guaranteed the IOMMU device will be created first. we could still have
problems with some devices having IOMMU regions while others don't.
>
>> >
>> > It's necessary if we are to support multiple IOMMUs, anyway.
>> >
>> >> >
>> >> >Thanks,
>> >> >Marcel
>> >> >
>> >> >> }
>> >> >> }
>> >> >>
>> >> >>diff --git a/include/hw/i386/intel_iommu.h
>> >> >>b/include/hw/i386/intel_iommu.h
>> >> >>index b024ffa..539530c 100644
>> >> >>--- a/include/hw/i386/intel_iommu.h
>> >> >>+++ b/include/hw/i386/intel_iommu.h
>> >> >>@@ -27,6 +27,7 @@
>> >> >> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>> >> >> #define INTEL_IOMMU_DEVICE(obj) \
>> >> >> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
>> >> >>+#define INTEL_IOMMU_STR "intel"
>> >> >>
>> >> >> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>> >> >> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>> >> >>
>> >> >
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties
2016-02-21 18:10 ` [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties David Kiarie
2016-02-21 20:09 ` Jan Kiszka
@ 2016-03-11 13:20 ` Michael S. Tsirkin
1 sibling, 0 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-11 13:20 UTC (permalink / raw)
To: David Kiarie; +Cc: marcel, valentine.sinitsyn, jan.kiszka, qemu-devel
On Sun, Feb 21, 2016 at 09:10:58PM +0300, David Kiarie wrote:
> Add IOMMU as a string to machine properties which is
> used to control whether and the type of IOMMU to emulate
>
> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> ---
> hw/core/machine.c | 28 ++++++++++++++++++++--------
> include/hw/boards.h | 3 ++-
> qemu-options.hx | 6 +++---
> util/qemu-config.c | 4 ++--
> 4 files changed, 27 insertions(+), 14 deletions(-)
>
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 6d1a0d8..001ace9 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -14,6 +14,8 @@
> #include "hw/boards.h"
> #include "qapi-visit.h"
> #include "qapi/visitor.h"
> +#include "hw/i386/amd_iommu.h"
> +#include "hw/i386/intel_iommu.h"
> #include "hw/sysbus.h"
> #include "sysemu/sysemu.h"
> #include "qemu/error-report.h"
> @@ -284,18 +286,28 @@ static void machine_set_firmware(Object *obj, const char *value, Error **errp)
> ms->firmware = g_strdup(value);
> }
>
> -static bool machine_get_iommu(Object *obj, Error **errp)
> +static char *machine_get_iommu(Object *obj, Error **errp)
> {
> MachineState *ms = MACHINE(obj);
>
> - return ms->iommu;
> + return g_strdup(ms->iommu);
> }
>
> -static void machine_set_iommu(Object *obj, bool value, Error **errp)
> +static void machine_set_iommu(Object *obj, const char *value, Error **errp)
> {
> MachineState *ms = MACHINE(obj);
> + Error *err = NULL;
> +
> + g_free(ms->iommu);
> +
> + if (g_strcmp0(value, AMD_IOMMU_STR) &&
> + g_strcmp0(value, INTEL_IOMMU_STR)) {
> + error_setg(errp, "Invalid IOMMU type %s", value);
> + error_propagate(errp, err);
> + return;
> + }
>
> - ms->iommu = value;
> + ms->iommu = g_strdup(value);
> }
>
> static void machine_set_suppress_vmdesc(Object *obj, bool value, Error **errp)
> @@ -455,11 +467,10 @@ static void machine_initfn(Object *obj)
> object_property_set_description(obj, "firmware",
> "Firmware image",
> NULL);
> - object_property_add_bool(obj, "iommu",
> - machine_get_iommu,
> - machine_set_iommu, NULL);
> + object_property_add_str(obj, "iommu",
> + machine_get_iommu, machine_set_iommu, NULL);
> object_property_set_description(obj, "iommu",
> - "Set on/off to enable/disable Intel IOMMU (VT-d)",
> + "IOMMU list",
> NULL);
> object_property_add_bool(obj, "suppress-vmdesc",
> machine_get_suppress_vmdesc,
> @@ -485,6 +496,7 @@ static void machine_finalize(Object *obj)
> g_free(ms->dumpdtb);
> g_free(ms->dt_compatible);
> g_free(ms->firmware);
> + g_free(ms->iommu);
> }
>
> bool machine_usb(MachineState *machine)
> diff --git a/include/hw/boards.h b/include/hw/boards.h
> index 0f30959..b119245 100644
> --- a/include/hw/boards.h
> +++ b/include/hw/boards.h
> @@ -36,6 +36,7 @@ bool machine_usb(MachineState *machine);
> bool machine_kernel_irqchip_allowed(MachineState *machine);
> bool machine_kernel_irqchip_required(MachineState *machine);
> bool machine_kernel_irqchip_split(MachineState *machine);
> +bool machine_amd_iommu(MachineState *machine);
> int machine_kvm_shadow_mem(MachineState *machine);
> int machine_phandle_start(MachineState *machine);
> bool machine_dump_guest_core(MachineState *machine);
> @@ -126,7 +127,7 @@ struct MachineState {
> bool usb_disabled;
> bool igd_gfx_passthru;
> char *firmware;
> - bool iommu;
> + char *iommu;
> bool suppress_vmdesc;
>
> ram_addr_t ram_size;
> diff --git a/qemu-options.hx b/qemu-options.hx
> index 2f0465e..dad160f 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -38,7 +38,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
> " kvm_shadow_mem=size of KVM shadow MMU\n"
> " dump-guest-core=on|off include guest memory in a core dump (default=on)\n"
> " mem-merge=on|off controls memory merge support (default: on)\n"
> - " iommu=on|off controls emulated Intel IOMMU (VT-d) support (default=off)\n"
> + " iommu=amd|intel enables and selects the emulated IOMMU (default: off)\n"
Besides what Jan said (it says default:off so off should be
available as an option), "on" should be available as an option
too, to
1. make qemu select an automatic model if user does not care
2. keep compatibility with existing users
Given this code is still kind of rough, how about a separate
x-iommu-type property to override type from intel to AMD?
> " igd-passthru=on|off controls IGD GFX passthrough support (default=off)\n"
> " aes-key-wrap=on|off controls support for AES key wrapping (default=on)\n"
> " dea-key-wrap=on|off controls support for DEA key wrapping (default=on)\n"
> @@ -72,8 +72,8 @@ Include guest memory in a core dump. The default is on.
> Enables or disables memory merge support. This feature, when supported by
> the host, de-duplicates identical memory pages among VMs instances
> (enabled by default).
> -@item iommu=on|off
> -Enables or disables emulated Intel IOMMU (VT-d) support. The default is off.
> +@item iommu=intel|amd
> +Enables and selects the emulated IOMMU. The default is off.
> @item aes-key-wrap=on|off
> Enables or disables AES key wrapping support on s390-ccw hosts. This feature
> controls whether AES wrapping keys will be created to allow
> diff --git a/util/qemu-config.c b/util/qemu-config.c
> index fb97307..f1b5a3b 100644
> --- a/util/qemu-config.c
> +++ b/util/qemu-config.c
> @@ -213,8 +213,8 @@ static QemuOptsList machine_opts = {
> .help = "firmware image",
> },{
> .name = "iommu",
> - .type = QEMU_OPT_BOOL,
> - .help = "Set on/off to enable/disable Intel IOMMU (VT-d)",
> + .type = QEMU_OPT_STRING,
> + .help = "Enables IOMMU and sets the emulated type",
> },{
> .name = "suppress-vmdesc",
> .type = QEMU_OPT_BOOL,
> --
> 2.1.4
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-02-21 18:11 ` [Qemu-devel] [V6 4/4] hw/pci-host: Emulate " David Kiarie
2016-02-22 11:22 ` Marcel Apfelbaum
@ 2016-03-11 13:22 ` Michael S. Tsirkin
2016-03-13 0:14 ` David Kiarie
1 sibling, 1 reply; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-11 13:22 UTC (permalink / raw)
To: David Kiarie; +Cc: marcel, valentine.sinitsyn, jan.kiszka, qemu-devel
On Sun, Feb 21, 2016 at 09:11:00PM +0300, David Kiarie wrote:
> Add AMD IOMMU emulation support to q35 chipset
>
> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> ---
> hw/pci-host/piix.c | 1 +
> hw/pci-host/q35.c | 14 ++++++++++++--
> include/hw/i386/intel_iommu.h | 1 +
> 3 files changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
> index 41aa66f..ab2e24a 100644
> --- a/hw/pci-host/piix.c
> +++ b/hw/pci-host/piix.c
> @@ -36,6 +36,7 @@
> #include "hw/i386/ioapic.h"
> #include "qapi/visitor.h"
> #include "qemu/error-report.h"
> +#include "hw/i386/amd_iommu.h"
>
> /*
> * I440FX chipset data sheet.
Why is this needed?
> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> index 115fb8c..355fb32 100644
> --- a/hw/pci-host/q35.c
> +++ b/hw/pci-host/q35.c
> @@ -31,6 +31,7 @@
> #include "hw/hw.h"
> #include "hw/pci-host/q35.h"
> #include "qapi/visitor.h"
> +#include "hw/i386/amd_iommu.h"
>
> /****************************************************************************
> * Q35 host
> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
> mch->pci_address_space, &mch->pam_regions[i+1],
> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
> }
> - /* Intel IOMMU (VT-d) */
> - if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
> +
> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR) == 0) {
> + /* Intel IOMMU (VT-d) */
> mch_init_dmar(mch);
> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, AMD_IOMMU_STR)
> + == 0) {
> + AMDIOMMUState *iommu_state;
> + PCIDevice *iommu;
> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
> + iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
address can be set through a property.
> + iommu_state = AMD_IOMMU_DEVICE(iommu);
> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
It would be better to move this chunk to a separate function.
> }
> }
>
> diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
> index b024ffa..539530c 100644
> --- a/include/hw/i386/intel_iommu.h
> +++ b/include/hw/i386/intel_iommu.h
> @@ -27,6 +27,7 @@
> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
> #define INTEL_IOMMU_DEVICE(obj) \
> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
> +#define INTEL_IOMMU_STR "intel"
>
> /* DMAR Hardware Unit Definition address (IOMMU unit) */
> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
> --
> 2.1.4
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-11 13:22 ` Michael S. Tsirkin
@ 2016-03-13 0:14 ` David Kiarie
2016-03-13 13:59 ` Michael S. Tsirkin
0 siblings, 1 reply; 53+ messages in thread
From: David Kiarie @ 2016-03-13 0:14 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Fri, Mar 11, 2016 at 4:22 PM, Michael S. Tsirkin <mst@redhat.com> wrote:
> On Sun, Feb 21, 2016 at 09:11:00PM +0300, David Kiarie wrote:
>> Add AMD IOMMU emulation support to q35 chipset
>>
>> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
>> ---
>> hw/pci-host/piix.c | 1 +
>> hw/pci-host/q35.c | 14 ++++++++++++--
>> include/hw/i386/intel_iommu.h | 1 +
>> 3 files changed, 14 insertions(+), 2 deletions(-)
>>
>> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
>> index 41aa66f..ab2e24a 100644
>> --- a/hw/pci-host/piix.c
>> +++ b/hw/pci-host/piix.c
>> @@ -36,6 +36,7 @@
>> #include "hw/i386/ioapic.h"
>> #include "qapi/visitor.h"
>> #include "qemu/error-report.h"
>> +#include "hw/i386/amd_iommu.h"
>>
>> /*
>> * I440FX chipset data sheet.
>
> Why is this needed?
>
>> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
>> index 115fb8c..355fb32 100644
>> --- a/hw/pci-host/q35.c
>> +++ b/hw/pci-host/q35.c
>> @@ -31,6 +31,7 @@
>> #include "hw/hw.h"
>> #include "hw/pci-host/q35.h"
>> #include "qapi/visitor.h"
>> +#include "hw/i386/amd_iommu.h"
>>
>> /****************************************************************************
>> * Q35 host
>> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
>> mch->pci_address_space, &mch->pam_regions[i+1],
>> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
>> }
>> - /* Intel IOMMU (VT-d) */
>> - if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
>> +
>> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR) == 0) {
>> + /* Intel IOMMU (VT-d) */
>> mch_init_dmar(mch);
>> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, AMD_IOMMU_STR)
>> + == 0) {
>> + AMDIOMMUState *iommu_state;
>> + PCIDevice *iommu;
>> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
>> + iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
>
> address can be set through a property.
I missed something here, what is the problem ?Is it the hardcoded address ?
>
>> + iommu_state = AMD_IOMMU_DEVICE(iommu);
>> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
>
>
> It would be better to move this chunk to a separate function.
>
>> }
>> }
>>
>> diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
>> index b024ffa..539530c 100644
>> --- a/include/hw/i386/intel_iommu.h
>> +++ b/include/hw/i386/intel_iommu.h
>> @@ -27,6 +27,7 @@
>> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
>> #define INTEL_IOMMU_DEVICE(obj) \
>> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
>> +#define INTEL_IOMMU_STR "intel"
>>
>> /* DMAR Hardware Unit Definition address (IOMMU unit) */
>> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
>> --
>> 2.1.4
^ permalink raw reply [flat|nested] 53+ messages in thread
* Re: [Qemu-devel] [V6 4/4] hw/pci-host: Emulate AMD IOMMU
2016-03-13 0:14 ` David Kiarie
@ 2016-03-13 13:59 ` Michael S. Tsirkin
0 siblings, 0 replies; 53+ messages in thread
From: Michael S. Tsirkin @ 2016-03-13 13:59 UTC (permalink / raw)
To: David Kiarie
Cc: Marcel Apfelbaum, Valentine Sinitsyn, Jan Kiszka, QEMU Developers
On Sun, Mar 13, 2016 at 03:14:37AM +0300, David Kiarie wrote:
> On Fri, Mar 11, 2016 at 4:22 PM, Michael S. Tsirkin <mst@redhat.com> wrote:
> > On Sun, Feb 21, 2016 at 09:11:00PM +0300, David Kiarie wrote:
> >> Add AMD IOMMU emulation support to q35 chipset
> >>
> >> Signed-off-by: David Kiarie <davidkiarie4@gmail.com>
> >> ---
> >> hw/pci-host/piix.c | 1 +
> >> hw/pci-host/q35.c | 14 ++++++++++++--
> >> include/hw/i386/intel_iommu.h | 1 +
> >> 3 files changed, 14 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/hw/pci-host/piix.c b/hw/pci-host/piix.c
> >> index 41aa66f..ab2e24a 100644
> >> --- a/hw/pci-host/piix.c
> >> +++ b/hw/pci-host/piix.c
> >> @@ -36,6 +36,7 @@
> >> #include "hw/i386/ioapic.h"
> >> #include "qapi/visitor.h"
> >> #include "qemu/error-report.h"
> >> +#include "hw/i386/amd_iommu.h"
> >>
> >> /*
> >> * I440FX chipset data sheet.
> >
> > Why is this needed?
> >
> >> diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
> >> index 115fb8c..355fb32 100644
> >> --- a/hw/pci-host/q35.c
> >> +++ b/hw/pci-host/q35.c
> >> @@ -31,6 +31,7 @@
> >> #include "hw/hw.h"
> >> #include "hw/pci-host/q35.h"
> >> #include "qapi/visitor.h"
> >> +#include "hw/i386/amd_iommu.h"
> >>
> >> /****************************************************************************
> >> * Q35 host
> >> @@ -505,9 +506,18 @@ static void mch_realize(PCIDevice *d, Error **errp)
> >> mch->pci_address_space, &mch->pam_regions[i+1],
> >> PAM_EXPAN_BASE + i * PAM_EXPAN_SIZE, PAM_EXPAN_SIZE);
> >> }
> >> - /* Intel IOMMU (VT-d) */
> >> - if (object_property_get_bool(qdev_get_machine(), "iommu", NULL)) {
> >> +
> >> + if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, INTEL_IOMMU_STR) == 0) {
> >> + /* Intel IOMMU (VT-d) */
> >> mch_init_dmar(mch);
> >> + } else if (g_strcmp0(MACHINE(qdev_get_machine())->iommu, AMD_IOMMU_STR)
> >> + == 0) {
> >> + AMDIOMMUState *iommu_state;
> >> + PCIDevice *iommu;
> >> + PCIBus *bus = PCI_BUS(qdev_get_parent_bus(DEVICE(mch)));
> >> + iommu = pci_create_simple(bus, 0x20, TYPE_AMD_IOMMU_DEVICE);
> >
> > address can be set through a property.
>
> I missed something here, what is the problem ?Is it the hardcoded address ?
As long as you use pci_create_simple, it's not a problem.
If eventually we manage to switch to using -device,
it'll be useful that by setting address property
machine can influence address for the device.
> >
> >> + iommu_state = AMD_IOMMU_DEVICE(iommu);
> >> + pci_setup_iommu(bus, bridge_host_amd_iommu, iommu_state);
> >
> >
> > It would be better to move this chunk to a separate function.
> >
> >> }
> >> }
> >>
> >> diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
> >> index b024ffa..539530c 100644
> >> --- a/include/hw/i386/intel_iommu.h
> >> +++ b/include/hw/i386/intel_iommu.h
> >> @@ -27,6 +27,7 @@
> >> #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
> >> #define INTEL_IOMMU_DEVICE(obj) \
> >> OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
> >> +#define INTEL_IOMMU_STR "intel"
> >>
> >> /* DMAR Hardware Unit Definition address (IOMMU unit) */
> >> #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
> >> --
> >> 2.1.4
^ permalink raw reply [flat|nested] 53+ messages in thread
end of thread, other threads:[~2016-03-13 13:59 UTC | newest]
Thread overview: 53+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-02-21 18:10 [Qemu-devel] [V6 0/4] AMD IOMMU David Kiarie
2016-02-21 18:10 ` [Qemu-devel] [V6 1/4] hw/i386: Introduce " David Kiarie
2016-02-25 15:43 ` Marcel Apfelbaum
2016-02-26 6:23 ` David Kiarie
2016-03-02 4:00 ` David Kiarie
2016-03-02 4:08 ` David Kiarie
2016-03-03 9:40 ` Marcel Apfelbaum
2016-03-03 9:34 ` Marcel Apfelbaum
2016-03-02 19:11 ` David Kiarie
2016-03-03 12:16 ` Marcel Apfelbaum
2016-02-21 18:10 ` [Qemu-devel] [V6 2/4] hw/core: Add AMD IOMMU to machine properties David Kiarie
2016-02-21 20:09 ` Jan Kiszka
2016-03-02 20:51 ` David Kiarie
2016-03-03 9:28 ` Marcel Apfelbaum
2016-03-11 13:20 ` Michael S. Tsirkin
2016-02-21 18:10 ` [Qemu-devel] [V6 3/4] hw/i386: ACPI table for AMD IOMMU David Kiarie
2016-02-21 18:20 ` Jan Kiszka
2016-02-21 19:00 ` David Kiarie
2016-02-21 18:11 ` [Qemu-devel] [V6 4/4] hw/pci-host: Emulate " David Kiarie
2016-02-22 11:22 ` Marcel Apfelbaum
[not found] ` <56D75688.1020500@gmail.com>
2016-03-02 21:17 ` Michael S. Tsirkin
2016-03-02 22:04 ` David Kiarie
2016-03-03 9:49 ` Michael S. Tsirkin
2016-03-03 11:47 ` David Kiarie
2016-03-03 12:02 ` Marcel Apfelbaum
2016-03-03 12:06 ` Marcel Apfelbaum
2016-03-03 12:18 ` David Kiarie
2016-03-03 12:58 ` Michael S. Tsirkin
2016-03-08 17:15 ` David Kiarie
2016-03-11 13:22 ` Michael S. Tsirkin
2016-03-13 0:14 ` David Kiarie
2016-03-13 13:59 ` Michael S. Tsirkin
2016-02-21 20:20 ` [Qemu-devel] [V6 0/4] " Jan Kiszka
2016-02-22 5:57 ` David Kiarie
2016-02-22 7:29 ` Jan Kiszka
2016-02-22 11:05 ` David Kiarie
2016-02-22 11:12 ` Jan Kiszka
2016-03-01 13:07 ` Michael S. Tsirkin
2016-03-01 13:48 ` Jan Kiszka
2016-03-01 13:55 ` Michael S. Tsirkin
2016-03-01 14:12 ` Jan Kiszka
2016-03-01 14:18 ` Jan Kiszka
2016-03-01 14:30 ` Michael S. Tsirkin
2016-03-01 14:35 ` Jan Kiszka
2016-03-01 14:19 ` Michael S. Tsirkin
2016-03-01 14:00 ` Jan Kiszka
2016-03-01 20:11 ` Michael S. Tsirkin
2016-03-01 20:17 ` Jan Kiszka
2016-03-01 20:39 ` Michael S. Tsirkin
2016-03-01 21:23 ` Jan Kiszka
2016-03-01 22:35 ` Michael S. Tsirkin
2016-03-02 21:17 ` David Kiarie
2016-03-02 21:32 ` Michael S. Tsirkin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.