xref: /linux/drivers/iommu/intel/prq.c (revision 93bd481b6076299256c96aa21362f09cea121c69)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (C) 2015 Intel Corporation
4  *
5  * Originally split from drivers/iommu/intel/svm.c
6  */
7 
8 #include <linux/pci.h>
9 #include <linux/pci-ats.h>
10 
11 #include "iommu.h"
12 #include "pasid.h"
13 #include "../iommu-pages.h"
14 #include "trace.h"
15 
16 /* Page request queue descriptor */
17 struct page_req_dsc {
18 	union {
19 		struct {
20 			u64 type:8;
21 			u64 pasid_present:1;
22 			u64 rsvd:7;
23 			u64 rid:16;
24 			u64 pasid:20;
25 			u64 exe_req:1;
26 			u64 pm_req:1;
27 			u64 rsvd2:10;
28 		};
29 		u64 qw_0;
30 	};
31 	union {
32 		struct {
33 			u64 rd_req:1;
34 			u64 wr_req:1;
35 			u64 lpig:1;
36 			u64 prg_index:9;
37 			u64 addr:52;
38 		};
39 		u64 qw_1;
40 	};
41 	u64 qw_2;
42 	u64 qw_3;
43 };
44 
45 /**
46  * intel_iommu_drain_pasid_prq - Drain page requests and responses for a pasid
47  * @dev: target device
48  * @pasid: pasid for draining
49  *
50  * Drain all pending page requests and responses related to @pasid in both
51  * software and hardware. This is supposed to be called after the device
52  * driver has stopped DMA, the pasid entry has been cleared, and both IOTLB
53  * and DevTLB have been invalidated.
54  *
55  * It waits until all pending page requests for @pasid in the page fault
56  * queue are completed by the prq handling thread. Then follow the steps
57  * described in VT-d spec CH7.10 to drain all page requests and page
58  * responses pending in the hardware.
59  */
intel_iommu_drain_pasid_prq(struct device * dev,u32 pasid)60 void intel_iommu_drain_pasid_prq(struct device *dev, u32 pasid)
61 {
62 	struct device_domain_info *info;
63 	struct dmar_domain *domain;
64 	struct intel_iommu *iommu;
65 	struct qi_desc desc[3];
66 	int head, tail;
67 	u16 sid, did;
68 
69 	info = dev_iommu_priv_get(dev);
70 	if (!info->pri_enabled)
71 		return;
72 
73 	iommu = info->iommu;
74 	domain = info->domain;
75 	sid = PCI_DEVID(info->bus, info->devfn);
76 	did = domain ? domain_id_iommu(domain, iommu) : FLPT_DEFAULT_DID;
77 
78 	/*
79 	 * Check and wait until all pending page requests in the queue are
80 	 * handled by the prq handling thread.
81 	 */
82 prq_retry:
83 	reinit_completion(&iommu->prq_complete);
84 	tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
85 	head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
86 	while (head != tail) {
87 		struct page_req_dsc *req;
88 
89 		req = &iommu->prq[head / sizeof(*req)];
90 		if (req->rid != sid ||
91 		    (req->pasid_present && pasid != req->pasid) ||
92 		    (!req->pasid_present && pasid != IOMMU_NO_PASID)) {
93 			head = (head + sizeof(*req)) & PRQ_RING_MASK;
94 			continue;
95 		}
96 
97 		wait_for_completion(&iommu->prq_complete);
98 		goto prq_retry;
99 	}
100 
101 	iopf_queue_flush_dev(dev);
102 
103 	/*
104 	 * Perform steps described in VT-d spec CH7.10 to drain page
105 	 * requests and responses in hardware.
106 	 */
107 	memset(desc, 0, sizeof(desc));
108 	desc[0].qw0 = QI_IWD_STATUS_DATA(QI_DONE) |
109 			QI_IWD_FENCE |
110 			QI_IWD_TYPE;
111 	if (pasid == IOMMU_NO_PASID) {
112 		qi_desc_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH, &desc[1]);
113 		qi_desc_dev_iotlb(sid, info->pfsid, info->ats_qdep, 0,
114 				  MAX_AGAW_PFN_WIDTH, &desc[2]);
115 	} else {
116 		qi_desc_piotlb(did, pasid, 0, -1, 0, &desc[1]);
117 		qi_desc_dev_iotlb_pasid(sid, info->pfsid, pasid, info->ats_qdep,
118 					0, MAX_AGAW_PFN_WIDTH, &desc[2]);
119 	}
120 qi_retry:
121 	reinit_completion(&iommu->prq_complete);
122 	qi_submit_sync(iommu, desc, 3, QI_OPT_WAIT_DRAIN);
123 	if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) {
124 		wait_for_completion(&iommu->prq_complete);
125 		goto qi_retry;
126 	}
127 }
128 
is_canonical_address(u64 addr)129 static bool is_canonical_address(u64 addr)
130 {
131 	int shift = 64 - (__VIRTUAL_MASK_SHIFT + 1);
132 	long saddr = (long)addr;
133 
134 	return (((saddr << shift) >> shift) == saddr);
135 }
136 
handle_bad_prq_event(struct intel_iommu * iommu,struct page_req_dsc * req,int result)137 static void handle_bad_prq_event(struct intel_iommu *iommu,
138 				 struct page_req_dsc *req, int result)
139 {
140 	struct qi_desc desc = { };
141 
142 	pr_err("%s: Invalid page request: %08llx %08llx\n",
143 	       iommu->name, ((unsigned long long *)req)[0],
144 	       ((unsigned long long *)req)[1]);
145 
146 	if (!req->lpig)
147 		return;
148 
149 	desc.qw0 = QI_PGRP_PASID(req->pasid) |
150 			QI_PGRP_DID(req->rid) |
151 			QI_PGRP_PASID_P(req->pasid_present) |
152 			QI_PGRP_RESP_CODE(result) |
153 			QI_PGRP_RESP_TYPE;
154 	desc.qw1 = QI_PGRP_IDX(req->prg_index) |
155 			QI_PGRP_LPIG(req->lpig);
156 
157 	qi_submit_sync(iommu, &desc, 1, 0);
158 }
159 
prq_to_iommu_prot(struct page_req_dsc * req)160 static int prq_to_iommu_prot(struct page_req_dsc *req)
161 {
162 	int prot = 0;
163 
164 	if (req->rd_req)
165 		prot |= IOMMU_FAULT_PERM_READ;
166 	if (req->wr_req)
167 		prot |= IOMMU_FAULT_PERM_WRITE;
168 	if (req->exe_req)
169 		prot |= IOMMU_FAULT_PERM_EXEC;
170 	if (req->pm_req)
171 		prot |= IOMMU_FAULT_PERM_PRIV;
172 
173 	return prot;
174 }
175 
intel_prq_report(struct intel_iommu * iommu,struct device * dev,struct page_req_dsc * desc)176 static void intel_prq_report(struct intel_iommu *iommu, struct device *dev,
177 			     struct page_req_dsc *desc)
178 {
179 	struct iopf_fault event = { };
180 
181 	/* Fill in event data for device specific processing */
182 	event.fault.type = IOMMU_FAULT_PAGE_REQ;
183 	event.fault.prm.addr = (u64)desc->addr << VTD_PAGE_SHIFT;
184 	event.fault.prm.pasid = desc->pasid;
185 	event.fault.prm.grpid = desc->prg_index;
186 	event.fault.prm.perm = prq_to_iommu_prot(desc);
187 
188 	if (desc->lpig)
189 		event.fault.prm.flags |= IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE;
190 	if (desc->pasid_present) {
191 		event.fault.prm.flags |= IOMMU_FAULT_PAGE_REQUEST_PASID_VALID;
192 		event.fault.prm.flags |= IOMMU_FAULT_PAGE_RESPONSE_NEEDS_PASID;
193 	}
194 
195 	iommu_report_device_fault(dev, &event);
196 }
197 
prq_event_thread(int irq,void * d)198 static irqreturn_t prq_event_thread(int irq, void *d)
199 {
200 	struct intel_iommu *iommu = d;
201 	struct page_req_dsc *req;
202 	int head, tail, handled;
203 	struct device *dev;
204 	u64 address;
205 
206 	/*
207 	 * Clear PPR bit before reading head/tail registers, to ensure that
208 	 * we get a new interrupt if needed.
209 	 */
210 	writel(DMA_PRS_PPR, iommu->reg + DMAR_PRS_REG);
211 
212 	tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
213 	head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
214 	handled = (head != tail);
215 	while (head != tail) {
216 		req = &iommu->prq[head / sizeof(*req)];
217 		address = (u64)req->addr << VTD_PAGE_SHIFT;
218 
219 		if (unlikely(!is_canonical_address(address))) {
220 			pr_err("IOMMU: %s: Address is not canonical\n",
221 			       iommu->name);
222 bad_req:
223 			handle_bad_prq_event(iommu, req, QI_RESP_INVALID);
224 			goto prq_advance;
225 		}
226 
227 		if (unlikely(req->pm_req && (req->rd_req | req->wr_req))) {
228 			pr_err("IOMMU: %s: Page request in Privilege Mode\n",
229 			       iommu->name);
230 			goto bad_req;
231 		}
232 
233 		if (unlikely(req->exe_req && req->rd_req)) {
234 			pr_err("IOMMU: %s: Execution request not supported\n",
235 			       iommu->name);
236 			goto bad_req;
237 		}
238 
239 		/* Drop Stop Marker message. No need for a response. */
240 		if (unlikely(req->lpig && !req->rd_req && !req->wr_req))
241 			goto prq_advance;
242 
243 		/*
244 		 * If prq is to be handled outside iommu driver via receiver of
245 		 * the fault notifiers, we skip the page response here.
246 		 */
247 		mutex_lock(&iommu->iopf_lock);
248 		dev = device_rbtree_find(iommu, req->rid);
249 		if (!dev) {
250 			mutex_unlock(&iommu->iopf_lock);
251 			goto bad_req;
252 		}
253 
254 		intel_prq_report(iommu, dev, req);
255 		trace_prq_report(iommu, dev, req->qw_0, req->qw_1,
256 				 req->qw_2, req->qw_3,
257 				 iommu->prq_seq_number++);
258 		mutex_unlock(&iommu->iopf_lock);
259 prq_advance:
260 		head = (head + sizeof(*req)) & PRQ_RING_MASK;
261 	}
262 
263 	dmar_writeq(iommu->reg + DMAR_PQH_REG, tail);
264 
265 	/*
266 	 * Clear the page request overflow bit and wake up all threads that
267 	 * are waiting for the completion of this handling.
268 	 */
269 	if (readl(iommu->reg + DMAR_PRS_REG) & DMA_PRS_PRO) {
270 		pr_info_ratelimited("IOMMU: %s: PRQ overflow detected\n",
271 				    iommu->name);
272 		head = dmar_readq(iommu->reg + DMAR_PQH_REG) & PRQ_RING_MASK;
273 		tail = dmar_readq(iommu->reg + DMAR_PQT_REG) & PRQ_RING_MASK;
274 		if (head == tail) {
275 			iopf_queue_discard_partial(iommu->iopf_queue);
276 			writel(DMA_PRS_PRO, iommu->reg + DMAR_PRS_REG);
277 			pr_info_ratelimited("IOMMU: %s: PRQ overflow cleared",
278 					    iommu->name);
279 		}
280 	}
281 
282 	if (!completion_done(&iommu->prq_complete))
283 		complete(&iommu->prq_complete);
284 
285 	return IRQ_RETVAL(handled);
286 }
287 
intel_iommu_enable_prq(struct intel_iommu * iommu)288 int intel_iommu_enable_prq(struct intel_iommu *iommu)
289 {
290 	struct iopf_queue *iopfq;
291 	int irq, ret;
292 
293 	iommu->prq = iommu_alloc_pages_node(iommu->node, GFP_KERNEL, PRQ_ORDER);
294 	if (!iommu->prq) {
295 		pr_warn("IOMMU: %s: Failed to allocate page request queue\n",
296 			iommu->name);
297 		return -ENOMEM;
298 	}
299 
300 	irq = dmar_alloc_hwirq(IOMMU_IRQ_ID_OFFSET_PRQ + iommu->seq_id, iommu->node, iommu);
301 	if (irq <= 0) {
302 		pr_err("IOMMU: %s: Failed to create IRQ vector for page request queue\n",
303 		       iommu->name);
304 		ret = -EINVAL;
305 		goto free_prq;
306 	}
307 	iommu->pr_irq = irq;
308 
309 	snprintf(iommu->iopfq_name, sizeof(iommu->iopfq_name),
310 		 "dmar%d-iopfq", iommu->seq_id);
311 	iopfq = iopf_queue_alloc(iommu->iopfq_name);
312 	if (!iopfq) {
313 		pr_err("IOMMU: %s: Failed to allocate iopf queue\n", iommu->name);
314 		ret = -ENOMEM;
315 		goto free_hwirq;
316 	}
317 	iommu->iopf_queue = iopfq;
318 
319 	snprintf(iommu->prq_name, sizeof(iommu->prq_name), "dmar%d-prq", iommu->seq_id);
320 
321 	ret = request_threaded_irq(irq, NULL, prq_event_thread, IRQF_ONESHOT,
322 				   iommu->prq_name, iommu);
323 	if (ret) {
324 		pr_err("IOMMU: %s: Failed to request IRQ for page request queue\n",
325 		       iommu->name);
326 		goto free_iopfq;
327 	}
328 	dmar_writeq(iommu->reg + DMAR_PQH_REG, 0ULL);
329 	dmar_writeq(iommu->reg + DMAR_PQT_REG, 0ULL);
330 	dmar_writeq(iommu->reg + DMAR_PQA_REG, virt_to_phys(iommu->prq) | PRQ_ORDER);
331 
332 	init_completion(&iommu->prq_complete);
333 
334 	return 0;
335 
336 free_iopfq:
337 	iopf_queue_free(iommu->iopf_queue);
338 	iommu->iopf_queue = NULL;
339 free_hwirq:
340 	dmar_free_hwirq(irq);
341 	iommu->pr_irq = 0;
342 free_prq:
343 	iommu_free_pages(iommu->prq, PRQ_ORDER);
344 	iommu->prq = NULL;
345 
346 	return ret;
347 }
348 
intel_iommu_finish_prq(struct intel_iommu * iommu)349 int intel_iommu_finish_prq(struct intel_iommu *iommu)
350 {
351 	dmar_writeq(iommu->reg + DMAR_PQH_REG, 0ULL);
352 	dmar_writeq(iommu->reg + DMAR_PQT_REG, 0ULL);
353 	dmar_writeq(iommu->reg + DMAR_PQA_REG, 0ULL);
354 
355 	if (iommu->pr_irq) {
356 		free_irq(iommu->pr_irq, iommu);
357 		dmar_free_hwirq(iommu->pr_irq);
358 		iommu->pr_irq = 0;
359 	}
360 
361 	if (iommu->iopf_queue) {
362 		iopf_queue_free(iommu->iopf_queue);
363 		iommu->iopf_queue = NULL;
364 	}
365 
366 	iommu_free_pages(iommu->prq, PRQ_ORDER);
367 	iommu->prq = NULL;
368 
369 	return 0;
370 }
371 
intel_iommu_page_response(struct device * dev,struct iopf_fault * evt,struct iommu_page_response * msg)372 void intel_iommu_page_response(struct device *dev, struct iopf_fault *evt,
373 			       struct iommu_page_response *msg)
374 {
375 	struct device_domain_info *info = dev_iommu_priv_get(dev);
376 	struct intel_iommu *iommu = info->iommu;
377 	u8 bus = info->bus, devfn = info->devfn;
378 	struct iommu_fault_page_request *prm;
379 	struct qi_desc desc;
380 	bool pasid_present;
381 	bool last_page;
382 	u16 sid;
383 
384 	prm = &evt->fault.prm;
385 	sid = PCI_DEVID(bus, devfn);
386 	pasid_present = prm->flags & IOMMU_FAULT_PAGE_REQUEST_PASID_VALID;
387 	last_page = prm->flags & IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE;
388 
389 	desc.qw0 = QI_PGRP_PASID(prm->pasid) | QI_PGRP_DID(sid) |
390 			QI_PGRP_PASID_P(pasid_present) |
391 			QI_PGRP_RESP_CODE(msg->code) |
392 			QI_PGRP_RESP_TYPE;
393 	desc.qw1 = QI_PGRP_IDX(prm->grpid) | QI_PGRP_LPIG(last_page);
394 	desc.qw2 = 0;
395 	desc.qw3 = 0;
396 
397 	qi_submit_sync(iommu, &desc, 1, 0);
398 }
399