qemu-e2k/include/hw/intc/arm_gicv3_its_common.h

127 lines
3.2 KiB
C
Raw Normal View History

/*
* ITS support for ARM GICv3
*
* Copyright (c) 2015 Samsung Electronics Co., Ltd.
* Written by Pavel Fedin
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, see <http://www.gnu.org/licenses/>.
*/
#ifndef QEMU_ARM_GICV3_ITS_COMMON_H
#define QEMU_ARM_GICV3_ITS_COMMON_H
#include "hw/sysbus.h"
#include "hw/intc/arm_gicv3_common.h"
#include "qom/object.h"
#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
#define ITS_CONTROL_SIZE 0x10000
#define ITS_TRANS_SIZE 0x10000
#define ITS_SIZE (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
#define GITS_CTLR 0x0
#define GITS_IIDR 0x4
#define GITS_TYPER 0x8
#define GITS_CBASER 0x80
#define GITS_CWRITER 0x88
#define GITS_CREADR 0x90
#define GITS_BASER 0x100
#define GITS_TRANSLATER 0x0040
typedef struct {
bool indirect;
uint16_t entry_sz;
uint32_t page_sz;
hw/intc/arm_gicv3_its: Fix various off-by-one errors The ITS code has to check whether various parameters passed in commands are in-bounds, where the limit is defined in terms of the number of bits that are available for the parameter. (For example, the GITS_TYPER.Devbits ID register field specifies the number of DeviceID bits minus 1, and device IDs passed in the MAPTI and MAPD command packets must fit in that many bits.) Currently we have off-by-one bugs in many of these bounds checks. The typical problem is that we define a max_foo as 1 << n. In the Devbits example, we set s->dt.max_ids = 1UL << (GITS_TYPER.Devbits + 1). However later when we do the bounds check we write if (devid > s->dt.max_ids) { /* command error */ } which incorrectly permits a devid of 1 << n. These bugs will not cause QEMU crashes because the ID values being checked are only used for accesses into tables held in guest memory which we access with address_space_*() functions, but they are incorrect behaviour of our emulation. Fix them by standardizing on this pattern: * bounds limits are named num_foos and are the 2^n value (equal to the number of valid foo values) * bounds checks are either if (fooid < num_foos) { good } or if (fooid >= num_foos) { bad } In this commit we fix the handling of the number of IDs in the device table and the collection table, and the number of commands that will fit in the command queue. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2022-01-07 18:08:00 +01:00
uint32_t num_entries;
uint64_t base_addr;
} TableDesc;
typedef struct {
hw/intc/arm_gicv3_its: Fix various off-by-one errors The ITS code has to check whether various parameters passed in commands are in-bounds, where the limit is defined in terms of the number of bits that are available for the parameter. (For example, the GITS_TYPER.Devbits ID register field specifies the number of DeviceID bits minus 1, and device IDs passed in the MAPTI and MAPD command packets must fit in that many bits.) Currently we have off-by-one bugs in many of these bounds checks. The typical problem is that we define a max_foo as 1 << n. In the Devbits example, we set s->dt.max_ids = 1UL << (GITS_TYPER.Devbits + 1). However later when we do the bounds check we write if (devid > s->dt.max_ids) { /* command error */ } which incorrectly permits a devid of 1 << n. These bugs will not cause QEMU crashes because the ID values being checked are only used for accesses into tables held in guest memory which we access with address_space_*() functions, but they are incorrect behaviour of our emulation. Fix them by standardizing on this pattern: * bounds limits are named num_foos and are the 2^n value (equal to the number of valid foo values) * bounds checks are either if (fooid < num_foos) { good } or if (fooid >= num_foos) { bad } In this commit we fix the handling of the number of IDs in the device table and the collection table, and the number of commands that will fit in the command queue. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
2022-01-07 18:08:00 +01:00
uint32_t num_entries;
uint64_t base_addr;
} CmdQDesc;
struct GICv3ITSState {
SysBusDevice parent_obj;
MemoryRegion iomem_main;
MemoryRegion iomem_its_cntrl;
MemoryRegion iomem_its_translation;
GICv3State *gicv3;
int dev_fd; /* kvm device fd if backed by kvm vgic support */
uint64_t gits_translater_gpa;
bool translater_gpa_known;
/* Registers */
uint32_t ctlr;
uint32_t iidr;
uint64_t typer;
uint64_t cbaser;
uint64_t cwriter;
uint64_t creadr;
uint64_t baser[8];
TableDesc dt;
TableDesc ct;
TableDesc vpet;
CmdQDesc cq;
Error *migration_blocker;
};
typedef struct GICv3ITSState GICv3ITSState;
void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
const MemoryRegionOps *tops);
/*
* The ITS should call this when it is realized to add itself
* to its GIC's list of connected ITSes.
*/
static inline void gicv3_add_its(GICv3State *s, DeviceState *its)
{
g_ptr_array_add(s->itslist, its);
}
hw/intc/arm_gicv3_its: Implement VMOVP Implement the GICv4 VMOVP command, which updates an entry in the vPE table to change its rdbase field. This command is unique in the ITS command set because its effects must be propagated to all the other ITSes connected to the same GIC as the ITS which executes the VMOVP command. The GICv4 spec allows two implementation choices for handling the propagation to other ITSes: * If GITS_TYPER.VMOVP is 1, the guest only needs to issue the command on one ITS, and the implementation handles the propagation to all ITSes * If GITS_TYPER.VMOVP is 0, the guest must issue the command on every ITS, and arrange for the ITSes to synchronize the updates with each other by setting ITSList and Sequence Number fields in the command packets We choose the GITS_TYPER.VMOVP = 1 approach, and synchronously execute the update on every ITS. For GICv4.1 this command has extra fields in the command packet and additional behaviour. We define the 4.1-only fields with the FIELD macro, but only implement the GICv4.0 version of the command. Note that we don't update the reported GITS_TYPER value here; we'll do that later in a commit which updates all the reported feature bit and ID register values for GICv4. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20220408141550.1271295-17-peter.maydell@linaro.org [PMM: Moved gicv3_foreach_its() to arm_gicv3_its_common.h, for consistency with gicv3_add_its()]
2022-04-08 16:15:25 +02:00
/*
* The ITS can use this for operations that must be performed on
* every ITS connected to the same GIC that it is
*/
static inline void gicv3_foreach_its(GICv3State *s, GFunc func, void *opaque)
{
g_ptr_array_foreach(s->itslist, func, opaque);
}
#define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSCommonClass,
ARM_GICV3_ITS_COMMON, TYPE_ARM_GICV3_ITS_COMMON)
struct GICv3ITSCommonClass {
/*< private >*/
SysBusDeviceClass parent_class;
/*< public >*/
int (*send_msi)(GICv3ITSState *s, uint32_t data, uint16_t devid);
void (*pre_save)(GICv3ITSState *s);
void (*post_load)(GICv3ITSState *s);
};
#endif