Re: [PATCH v4 02/22] xen/arm: smmuv3: Add support for stage-1 and nested stage translation

[Milan Djokic <milan_djokic@xxxxxxxx>]

Hi Oleksandr,

On 10/9/26 19:37, Oleksandr Tyshchenko wrote:
> [You don't often get email from olekstysh@xxxxxxxxx. Learn why this is 
> important at https://aka.ms/LearnAboutSenderIdentification ]
>
> On 10/7/26 03:06, Milan Djokic wrote:
>
> Hello Milan
>
> > From: Rahul Singh <rahul.singh@xxxxxxx>
> >
> > Xen SMMUv3 driver only supports stage-2 translation. Add support for
> > Stage-1 translation that is required to support nested stage
> > translation.
> >
> > In true nested mode, both s1_cfg and s2_cfg will coexist.
> > Let's remove the union. When nested stage translation is setup, both
> > s1_cfg and s2_cfg are valid.
> >
> > We introduce a new smmu_domain abort field that will be set
> > upon guest stage-1 configuration passing. If no guest stage-1
> > config has been attached, it is ignored when writing the STE.
> >
> > arm_smmu_write_strtab_ent() is modified to write both stage
> > fields in the STE and deal with the abort field.
> >
> > Signed-off-by: Rahul Singh <rahul.singh@xxxxxxx>
> > Signed-off-by: Milan Djokic <milan_djokic@xxxxxxxx>
> > ---
> >    xen/drivers/passthrough/arm/smmu-v3.c | 96 +++++++++++++++++++++++----
> >    xen/drivers/passthrough/arm/smmu-v3.h |  9 +++
> >    2 files changed, 93 insertions(+), 12 deletions(-)
> >
> > diff --git a/xen/drivers/passthrough/arm/smmu-v3.c 
> > b/xen/drivers/passthrough/arm/smmu-v3.c
> > index 7162473d62..d3e88d5a55 100644
> > --- a/xen/drivers/passthrough/arm/smmu-v3.c
> > +++ b/xen/drivers/passthrough/arm/smmu-v3.c
> > @@ -683,8 +683,10 @@ static void arm_smmu_write_strtab_ent(struct 
> > arm_smmu_master *master, u32 sid,
> >         * 3. Update Config, sync
> >         */
> >        u64 val = le64_to_cpu(dst[0]);
> > -     bool ste_live = false;
> > +     bool s1_live = false, s2_live = false, ste_live = false;
> > +     bool abort, translate = false;
> >        struct arm_smmu_device *smmu = NULL;
> > +     struct arm_smmu_s1_cfg *s1_cfg = NULL;
> >        struct arm_smmu_s2_cfg *s2_cfg = NULL;
> >        struct arm_smmu_domain *smmu_domain = NULL;
> >        struct arm_smmu_cmdq_ent prefetch_cmd = {
> > @@ -699,30 +701,57 @@ static void arm_smmu_write_strtab_ent(struct 
> > arm_smmu_master *master, u32 sid,
> >                smmu = master->smmu;
> >        }
> >
> > -     if (smmu_domain)
> > -             s2_cfg = &smmu_domain->s2_cfg;
> > +     if (smmu_domain) {
> > +             switch (smmu_domain->stage) {
> > +             case ARM_SMMU_DOMAIN_S1:
> > +                     s1_cfg = &smmu_domain->s1_cfg;
> > +                     break;
> > +             case ARM_SMMU_DOMAIN_NESTED:
> > +                     s1_cfg = &smmu_domain->s1_cfg;
> > +                     fallthrough;
> > +             case ARM_SMMU_DOMAIN_S2:
> > +                     s2_cfg = &smmu_domain->s2_cfg;
> > +                     break;
> > +             default:
> > +                     break;
> > +             }
> > +             translate = s1_cfg || s2_cfg;
> > +     }
> >
> >        if (val & STRTAB_STE_0_V) {
> >                switch (FIELD_GET(STRTAB_STE_0_CFG, val)) {
> >                case STRTAB_STE_0_CFG_BYPASS:
> >                        break;
> > +             case STRTAB_STE_0_CFG_S1_TRANS:
> > +                     s1_live = true;
> > +                     break;
> >                case STRTAB_STE_0_CFG_S2_TRANS:
> > -                     ste_live = true;
> > +                     s2_live = true;
> > +                     break;
> > +             case STRTAB_STE_0_CFG_NESTED:
> > +                     s1_live = true;
> > +                     s2_live = true;
> >                        break;
> >                case STRTAB_STE_0_CFG_ABORT:
> > -                     BUG_ON(!disable_bypass);
> >                        break;
> >                default:
> >                        BUG(); /* STE corruption */
> >                }
> >        }
> >
> > +     ste_live = s1_live || s2_live;
> > +
> >        /* Nuke the existing STE_0 value, as we're going to rewrite it */
> >        val = STRTAB_STE_0_V;
> >
> >        /* Bypass/fault */
> > -     if (!smmu_domain || !(s2_cfg)) {
> > -             if (!smmu_domain && disable_bypass)
> > +     if (!smmu_domain)
> > +             abort = disable_bypass;
> > +     else
> > +             abort = smmu_domain->abort;
> > +
> > +     if (abort || !translate) {
> > +             if (abort)
> >                        val |= FIELD_PREP(STRTAB_STE_0_CFG, 
> > STRTAB_STE_0_CFG_ABORT);
> >                else
> >                        val |= FIELD_PREP(STRTAB_STE_0_CFG, 
> > STRTAB_STE_0_CFG_BYPASS);
> > @@ -740,7 +769,32 @@ static void arm_smmu_write_strtab_ent(struct 
> > arm_smmu_master *master, u32 sid,
> >                return;
> >        }
> >
> > +     if (ste_live) {
> > +             /* First invalidate the live STE */
> > +             dst[0] = cpu_to_le64(STRTAB_STE_0_CFG_ABORT);
> > +             arm_smmu_sync_ste_for_sid(smmu, sid);
> > +     }
> > +
> > +     if (s1_cfg) {
> > +             dst[1] = cpu_to_le64(
> > +                      FIELD_PREP(STRTAB_STE_1_S1DSS, STRTAB_STE_1_S1DSS_SSID0) 
> > |
> > +                      FIELD_PREP(STRTAB_STE_1_S1CIR, 
> > STRTAB_STE_1_S1C_CACHE_WBRA) |
> > +                      FIELD_PREP(STRTAB_STE_1_S1COR, 
> > STRTAB_STE_1_S1C_CACHE_WBRA) |
> > +                      FIELD_PREP(STRTAB_STE_1_S1CSH, ARM_SMMU_SH_ISH) |
> > +                      FIELD_PREP(STRTAB_STE_1_STRW, STRTAB_STE_1_STRW_NSEL1));
> > +
> > +             if (smmu->features & ARM_SMMU_FEAT_STALLS &&
> > +                !(smmu->features & ARM_SMMU_FEAT_STALL_FORCE))
> > +                     dst[1] |= cpu_to_le64(STRTAB_STE_1_S1STALLD);
> > +
> > +             val |= (s1_cfg->s1ctxptr & STRTAB_STE_0_S1CTXPTR_MASK) |
> > +                     FIELD_PREP(STRTAB_STE_0_CFG, STRTAB_STE_0_CFG_S1_TRANS) |
> > +                     FIELD_PREP(STRTAB_STE_0_S1CDMAX, s1_cfg->s1cdmax) |
> > +                     FIELD_PREP(STRTAB_STE_0_S1FMT, s1_cfg->s1fmt);
> > +     }
> > +
> >        if (s2_cfg) {
> > +             u64 vttbr = s2_cfg->vttbr & STRTAB_STE_3_S2TTB_MASK;
> >                u64 strtab =
> >                         FIELD_PREP(STRTAB_STE_2_S2VMID, s2_cfg->vmid) |
> >                         FIELD_PREP(STRTAB_STE_2_VTCR, s2_cfg->vtcr) |
> > @@ -750,12 +804,19 @@ static void arm_smmu_write_strtab_ent(struct 
> > arm_smmu_master *master, u32 sid,
> >                         STRTAB_STE_2_S2PTW | STRTAB_STE_2_S2AA64 |
> >                         STRTAB_STE_2_S2R;
> >
> > -             BUG_ON(ste_live);
> > +             if (s2_live) {
> > +                     u64 s2ttb = le64_to_cpu(dst[3]) & STRTAB_STE_3_S2TTB_MASK;
> > +                     BUG_ON(s2ttb != vttbr);
> > +             }
> > +
> >                dst[2] = cpu_to_le64(strtab);
> >
> > -             dst[3] = cpu_to_le64(s2_cfg->vttbr & STRTAB_STE_3_S2TTB_MASK);
> > +             dst[3] = cpu_to_le64(vttbr);
> >
> >                val |= FIELD_PREP(STRTAB_STE_0_CFG, STRTAB_STE_0_CFG_S2_TRANS);
> > +     } else {
> > +             dst[2] = 0;
> > +             dst[3] = 0;
> >        }
> >
> >        if (master->ats_enabled)
> > @@ -1254,8 +1315,16 @@ static int arm_smmu_domain_finalise(struct iommu_domain 
> > *domain,
> >    {
> >        int ret;
> >        struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
> > +     struct arm_smmu_device *smmu = smmu_domain->smmu;
> > +
> > +     if (!(smmu->features & ARM_SMMU_FEAT_TRANS_S2))
> > +             return 0;
>
> I am not fully confident I understood all the magic here correctly, but
> it appears the initial state may be broken on SMMUs without stage-2
> (stage-1-only hosts).
>
> Here we return early without setting a stage, and the zeroed domain has
> stage-1 (enum value 0). So a new domain is left in a default stage-1
> state with no real config. The first attach then writes a live S1 STE
> with s1ctxptr = 0 in arm_smmu_write_strtab_ent(), so the hardware reads
> a context descriptor from physical address 0. I wonder we should default
> the domain to abort.
>
> Could you please double-check?
Yes, this is a valid point. The first STE write shall install the 
incorrect configuration. I will default the domain to abort when
stage-2 is not supported.

> Also, it is my understanding that without stage-2 translation the
> guest’s s1ctxptr and the stage-1 output address are used as host
> physical addresses. The guest decides where the hardware reads and
> writes. I wonder whether we should refuse this mode for non-hardware
> (non-direct-mapped) domains.
Same here. I'll update the implementation to allow Stage-1-only mode 
only for direct-mapped domains.
> Apologies if this has already been discussed.
>
> > -     /* Restrict the stage to what we can actually support */
> > +     /*
> > +      * Default to stage-2 support and initialize it. Stage-1 will be
> > +      * initialized during guest config attachment, if nested or stage-1
> > +      * mode is required
> > +      */
> >        smmu_domain->stage = ARM_SMMU_DOMAIN_S2;
> >
> >        ret = arm_smmu_domain_finalise_s2(smmu_domain, master);
> > @@ -2398,11 +2467,14 @@ static int arm_smmu_device_hw_probe(struct 
> > arm_smmu_device *smmu)
> >                break;
> >        }
> >
> > +     if (reg & IDR0_S1P)
> > +             smmu->features |= ARM_SMMU_FEAT_TRANS_S1;
> > +
> >        if (reg & IDR0_S2P)
> >                smmu->features |= ARM_SMMU_FEAT_TRANS_S2;
> >
> > -     if (!(reg & IDR0_S2P)) {
> > -             dev_err(smmu->dev, "no stage-2 translation support!\n");
> > +     if (!(reg & (IDR0_S1P | IDR0_S2P))) {
> > +             dev_err(smmu->dev, "no translation support!\n");
> >                return -ENXIO;
> >        }
> >
> > diff --git a/xen/drivers/passthrough/arm/smmu-v3.h 
> > b/xen/drivers/passthrough/arm/smmu-v3.h
> > index ab1f29f6c7..e257de6db9 100644
> > --- a/xen/drivers/passthrough/arm/smmu-v3.h
> > +++ b/xen/drivers/passthrough/arm/smmu-v3.h
> > @@ -197,6 +197,7 @@
> >    #define STRTAB_STE_0_CFG_BYPASS             4
> >    #define STRTAB_STE_0_CFG_S1_TRANS   5
> >    #define STRTAB_STE_0_CFG_S2_TRANS   6
> > +#define STRTAB_STE_0_CFG_NESTED              7
> >
> >    #define STRTAB_STE_0_S1FMT          GENMASK_ULL(5, 4)
> >    #define STRTAB_STE_0_S1FMT_LINEAR   0
> > @@ -549,6 +550,12 @@ struct arm_smmu_strtab_l1_desc {
> >        dma_addr_t                      l2ptr_dma;
> >    };
> >
> > +struct arm_smmu_s1_cfg {
> > +     u64                             s1ctxptr;
> > +     u8                              s1fmt;
> > +     u8                              s1cdmax;
> > +};
> > +
> >    struct arm_smmu_s2_cfg {
> >        u16                             vmid;
> >        u64                             vttbr;
> > @@ -669,6 +676,8 @@ struct arm_smmu_domain {
> >        atomic_t                        nr_ats_masters;
> >
> >        enum arm_smmu_domain_stage      stage;
> > +     bool                    abort;
> > +     struct arm_smmu_s1_cfg  s1_cfg;
> >        struct arm_smmu_s2_cfg  s2_cfg;
> >
> >        /* Xen domain associated with this SMMU domain */
BR,
Milan