2 * QEMU emulation of an Intel IOMMU (VT-d)
3 * (DMA Remapping device)
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, see <http://www.gnu.org/licenses/>.
25 #include "sysemu/dma.h"
26 #include "hw/i386/x86-iommu.h"
27 #include "hw/i386/ioapic.h"
28 #include "hw/pci/msi.h"
29 #include "hw/sysbus.h"
31 #define TYPE_INTEL_IOMMU_DEVICE "intel-iommu"
32 #define INTEL_IOMMU_DEVICE(obj) \
33 OBJECT_CHECK(IntelIOMMUState, (obj), TYPE_INTEL_IOMMU_DEVICE)
35 #define TYPE_INTEL_IOMMU_MEMORY_REGION "intel-iommu-iommu-memory-region"
37 /* DMAR Hardware Unit Definition address (IOMMU unit) */
38 #define Q35_HOST_BRIDGE_IOMMU_ADDR 0xfed90000ULL
40 #define VTD_PCI_BUS_MAX 256
41 #define VTD_PCI_SLOT_MAX 32
42 #define VTD_PCI_FUNC_MAX 8
43 #define VTD_PCI_SLOT(devfn) (((devfn) >> 3) & 0x1f)
44 #define VTD_PCI_FUNC(devfn) ((devfn) & 0x07)
45 #define VTD_SID_TO_BUS(sid) (((sid) >> 8) & 0xff)
46 #define VTD_SID_TO_DEVFN(sid) ((sid) & 0xff)
48 #define DMAR_REG_SIZE 0x230
49 #define VTD_HOST_ADDRESS_WIDTH 39
50 #define VTD_HAW_MASK ((1ULL << VTD_HOST_ADDRESS_WIDTH) - 1)
52 #define DMAR_REPORT_F_INTR (1)
54 #define VTD_MSI_ADDR_HI_MASK (0xffffffff00000000ULL)
55 #define VTD_MSI_ADDR_HI_SHIFT (32)
56 #define VTD_MSI_ADDR_LO_MASK (0x00000000ffffffffULL)
58 typedef struct VTDContextEntry VTDContextEntry;
59 typedef struct VTDContextCacheEntry VTDContextCacheEntry;
60 typedef struct IntelIOMMUState IntelIOMMUState;
61 typedef struct VTDAddressSpace VTDAddressSpace;
62 typedef struct VTDIOTLBEntry VTDIOTLBEntry;
63 typedef struct VTDBus VTDBus;
64 typedef union VTD_IR_TableEntry VTD_IR_TableEntry;
65 typedef union VTD_IR_MSIAddress VTD_IR_MSIAddress;
66 typedef struct VTDIrq VTDIrq;
67 typedef struct VTD_MSIMessage VTD_MSIMessage;
68 typedef struct IntelIOMMUNotifierNode IntelIOMMUNotifierNode;
71 struct VTDContextEntry {
76 struct VTDContextCacheEntry {
77 /* The cache entry is obsolete if
78 * context_cache_gen!=IntelIOMMUState.context_cache_gen
80 uint32_t context_cache_gen;
81 struct VTDContextEntry context_entry;
84 struct VTDAddressSpace {
88 IOMMUMemoryRegion iommu;
90 MemoryRegion sys_alias;
91 MemoryRegion iommu_ir; /* Interrupt region: 0xfeeXXXXX */
92 IntelIOMMUState *iommu_state;
93 VTDContextCacheEntry context_cache_entry;
97 PCIBus* bus; /* A reference to the bus to provide translation for */
98 VTDAddressSpace *dev_as[0]; /* A table of VTDAddressSpace objects indexed by devfn */
101 struct VTDIOTLBEntry {
110 /* VT-d Source-ID Qualifier types */
112 VTD_SQ_FULL = 0x00, /* Full SID verification */
113 VTD_SQ_IGN_3 = 0x01, /* Ignore bit 3 */
114 VTD_SQ_IGN_2_3 = 0x02, /* Ignore bits 2 & 3 */
115 VTD_SQ_IGN_1_3 = 0x03, /* Ignore bits 1-3 */
119 /* VT-d Source Validation Types */
121 VTD_SVT_NONE = 0x00, /* No validation */
122 VTD_SVT_ALL = 0x01, /* Do full validation */
123 VTD_SVT_BUS = 0x02, /* Validate bus range */
127 /* Interrupt Remapping Table Entry Definition */
128 union VTD_IR_TableEntry {
130 #ifdef HOST_WORDS_BIGENDIAN
131 uint32_t __reserved_1:8; /* Reserved 1 */
132 uint32_t vector:8; /* Interrupt Vector */
133 uint32_t irte_mode:1; /* IRTE Mode */
134 uint32_t __reserved_0:3; /* Reserved 0 */
135 uint32_t __avail:4; /* Available spaces for software */
136 uint32_t delivery_mode:3; /* Delivery Mode */
137 uint32_t trigger_mode:1; /* Trigger Mode */
138 uint32_t redir_hint:1; /* Redirection Hint */
139 uint32_t dest_mode:1; /* Destination Mode */
140 uint32_t fault_disable:1; /* Fault Processing Disable */
141 uint32_t present:1; /* Whether entry present/available */
143 uint32_t present:1; /* Whether entry present/available */
144 uint32_t fault_disable:1; /* Fault Processing Disable */
145 uint32_t dest_mode:1; /* Destination Mode */
146 uint32_t redir_hint:1; /* Redirection Hint */
147 uint32_t trigger_mode:1; /* Trigger Mode */
148 uint32_t delivery_mode:3; /* Delivery Mode */
149 uint32_t __avail:4; /* Available spaces for software */
150 uint32_t __reserved_0:3; /* Reserved 0 */
151 uint32_t irte_mode:1; /* IRTE Mode */
152 uint32_t vector:8; /* Interrupt Vector */
153 uint32_t __reserved_1:8; /* Reserved 1 */
155 uint32_t dest_id; /* Destination ID */
156 uint16_t source_id; /* Source-ID */
157 #ifdef HOST_WORDS_BIGENDIAN
158 uint64_t __reserved_2:44; /* Reserved 2 */
159 uint64_t sid_vtype:2; /* Source-ID Validation Type */
160 uint64_t sid_q:2; /* Source-ID Qualifier */
162 uint64_t sid_q:2; /* Source-ID Qualifier */
163 uint64_t sid_vtype:2; /* Source-ID Validation Type */
164 uint64_t __reserved_2:44; /* Reserved 2 */
170 #define VTD_IR_INT_FORMAT_COMPAT (0) /* Compatible Interrupt */
171 #define VTD_IR_INT_FORMAT_REMAP (1) /* Remappable Interrupt */
173 /* Programming format for MSI/MSI-X addresses */
174 union VTD_IR_MSIAddress {
176 #ifdef HOST_WORDS_BIGENDIAN
177 uint32_t __head:12; /* Should always be: 0x0fee */
178 uint32_t index_l:15; /* Interrupt index bit 14-0 */
179 uint32_t int_mode:1; /* Interrupt format */
180 uint32_t sub_valid:1; /* SHV: Sub-Handle Valid bit */
181 uint32_t index_h:1; /* Interrupt index bit 15 */
182 uint32_t __not_care:2;
184 uint32_t __not_care:2;
185 uint32_t index_h:1; /* Interrupt index bit 15 */
186 uint32_t sub_valid:1; /* SHV: Sub-Handle Valid bit */
187 uint32_t int_mode:1; /* Interrupt format */
188 uint32_t index_l:15; /* Interrupt index bit 14-0 */
189 uint32_t __head:12; /* Should always be: 0x0fee */
195 /* Generic IRQ entry information */
197 /* Used by both IOAPIC/MSI interrupt remapping */
198 uint8_t trigger_mode;
200 uint8_t delivery_mode;
204 /* only used by MSI interrupt remapping */
206 uint8_t msi_addr_last_bits;
209 struct VTD_MSIMessage {
212 #ifdef HOST_WORDS_BIGENDIAN
213 uint32_t __addr_head:12; /* 0xfee */
215 uint32_t __reserved:8;
216 uint32_t redir_hint:1;
217 uint32_t dest_mode:1;
218 uint32_t __not_used:2;
220 uint32_t __not_used:2;
221 uint32_t dest_mode:1;
222 uint32_t redir_hint:1;
223 uint32_t __reserved:8;
225 uint32_t __addr_head:12; /* 0xfee */
233 #ifdef HOST_WORDS_BIGENDIAN
234 uint16_t trigger_mode:1;
237 uint16_t delivery_mode:3;
241 uint16_t delivery_mode:3;
244 uint16_t trigger_mode:1;
252 /* When IR is enabled, all MSI/MSI-X data bits should be zero */
253 #define VTD_IR_MSI_DATA (0)
255 struct IntelIOMMUNotifierNode {
256 VTDAddressSpace *vtd_as;
257 QLIST_ENTRY(IntelIOMMUNotifierNode) next;
260 /* The iommu (DMAR) device state struct */
261 struct IntelIOMMUState {
262 X86IOMMUState x86_iommu;
264 uint8_t csr[DMAR_REG_SIZE]; /* register values */
265 uint8_t wmask[DMAR_REG_SIZE]; /* R/W bytes */
266 uint8_t w1cmask[DMAR_REG_SIZE]; /* RW1C(Write 1 to Clear) bytes */
267 uint8_t womask[DMAR_REG_SIZE]; /* WO (write only - read returns 0) */
270 bool caching_mode; /* RO - is cap CM enabled? */
272 dma_addr_t root; /* Current root table pointer */
273 bool root_extended; /* Type of root table (extended or not) */
274 bool dmar_enabled; /* Set if DMA remapping is enabled */
276 uint16_t iq_head; /* Current invalidation queue head */
277 uint16_t iq_tail; /* Current invalidation queue tail */
278 dma_addr_t iq; /* Current invalidation queue pointer */
279 uint16_t iq_size; /* IQ Size in number of entries */
280 bool qi_enabled; /* Set if the QI is enabled */
281 uint8_t iq_last_desc_type; /* The type of last completed descriptor */
283 /* The index of the Fault Recording Register to be used next.
284 * Wraps around from N-1 to 0, where N is the number of FRCD_REG.
286 uint16_t next_frcd_reg;
288 uint64_t cap; /* The value of capability reg */
289 uint64_t ecap; /* The value of extended capability reg */
291 uint32_t context_cache_gen; /* Should be in [1,MAX] */
292 GHashTable *iotlb; /* IOTLB */
294 GHashTable *vtd_as_by_busptr; /* VTDBus objects indexed by PCIBus* reference */
295 VTDBus *vtd_as_by_bus_num[VTD_PCI_BUS_MAX]; /* VTDBus objects indexed by bus number */
296 /* list of registered notifiers */
297 QLIST_HEAD(, IntelIOMMUNotifierNode) notifiers_list;
299 /* interrupt remapping */
300 bool intr_enabled; /* Whether guest enabled IR */
301 dma_addr_t intr_root; /* Interrupt remapping table pointer */
302 uint32_t intr_size; /* Number of IR table entries */
303 bool intr_eime; /* Extended interrupt mode enabled */
304 OnOffAuto intr_eim; /* Toggle for EIM cabability */
305 bool buggy_eim; /* Force buggy EIM unless eim=off */
308 /* Find the VTD Address space associated with the given bus pointer,
309 * create a new one if none exists
311 VTDAddressSpace *vtd_find_add_as(IntelIOMMUState *s, PCIBus *bus, int devfn);