diff mbox series

[v4,06/17] intel_iommu: Implement stage-1 translation

Message ID 20240930092631.2997543-7-zhenzhong.duan@intel.com
State New
Headers show
Series intel_iommu: Enable stage-1 translation for emulated device | expand

Commit Message

Duan, Zhenzhong Sept. 30, 2024, 9:26 a.m. UTC 
From: Yi Liu <yi.l.liu@intel.com>

This adds stage-1 page table walking to support stage-1 only
translation in scalable modern mode.

Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Co-developed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Signed-off-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Acked-by: Jason Wang <jasowang@redhat.com>
---
 hw/i386/intel_iommu_internal.h |  24 ++++++
 hw/i386/intel_iommu.c          | 143 ++++++++++++++++++++++++++++++++-
 2 files changed, 163 insertions(+), 4 deletions(-)

Comments

Yi Liu Nov. 3, 2024, 2:21 p.m. UTC | #1 
On 2024/9/30 17:26, Zhenzhong Duan wrote:
> From: Yi Liu <yi.l.liu@intel.com>
> 
> This adds stage-1 page table walking to support stage-1 only
> translation in scalable modern mode.
> 
> Signed-off-by: Yi Liu <yi.l.liu@intel.com>
> Co-developed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
> Signed-off-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
> Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> Acked-by: Jason Wang <jasowang@redhat.com>
> ---
>   hw/i386/intel_iommu_internal.h |  24 ++++++
>   hw/i386/intel_iommu.c          | 143 ++++++++++++++++++++++++++++++++-
>   2 files changed, 163 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
> index 20fcc73938..38bf0c7a06 100644
> --- a/hw/i386/intel_iommu_internal.h
> +++ b/hw/i386/intel_iommu_internal.h
> @@ -428,6 +428,22 @@ typedef union VTDInvDesc VTDInvDesc;
>   #define VTD_SPTE_LPAGE_L3_RSVD_MASK(aw) \
>           (0x3ffff800ULL | ~(VTD_HAW_MASK(aw) | VTD_SL_IGN_COM))
>   
> +/* Rsvd field masks for fpte */
> +#define VTD_FS_UPPER_IGNORED 0xfff0000000000000ULL
> +#define VTD_FPTE_PAGE_L1_RSVD_MASK(aw) \
> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
> +#define VTD_FPTE_PAGE_L2_RSVD_MASK(aw) \
> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
> +#define VTD_FPTE_PAGE_L3_RSVD_MASK(aw) \
> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
> +#define VTD_FPTE_PAGE_L4_RSVD_MASK(aw) \
> +        (0x80ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
> +
> +#define VTD_FPTE_LPAGE_L2_RSVD_MASK(aw) \
> +        (0x1fe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
> +#define VTD_FPTE_LPAGE_L3_RSVD_MASK(aw) \
> +        (0x3fffe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
> +
>   /* Masks for PIOTLB Invalidate Descriptor */
>   #define VTD_INV_DESC_PIOTLB_G             (3ULL << 4)
>   #define VTD_INV_DESC_PIOTLB_ALL_IN_PASID  (2ULL << 4)
> @@ -520,6 +536,14 @@ typedef struct VTDRootEntry VTDRootEntry;
>   #define VTD_SM_PASID_ENTRY_AW          7ULL /* Adjusted guest-address-width */
>   #define VTD_SM_PASID_ENTRY_DID(val)    ((val) & VTD_DOMAIN_ID_MASK)
>   
> +#define VTD_SM_PASID_ENTRY_FLPM          3ULL
> +#define VTD_SM_PASID_ENTRY_FLPTPTR       (~0xfffULL)
> +
> +/* First Level Paging Structure */
> +/* Masks for First Level Paging Entry */
> +#define VTD_FL_P                    1ULL
> +#define VTD_FL_RW                   (1ULL << 1)
> +
>   /* Second Level Page Translation Pointer*/
>   #define VTD_SM_PASID_ENTRY_SLPTPTR     (~0xfffULL)
>   
> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
> index 6f2414898c..56d5933e93 100644
> --- a/hw/i386/intel_iommu.c
> +++ b/hw/i386/intel_iommu.c
> @@ -48,6 +48,8 @@
>   
>   /* pe operations */
>   #define VTD_PE_GET_TYPE(pe) ((pe)->val[0] & VTD_SM_PASID_ENTRY_PGTT)
> +#define VTD_PE_GET_FL_LEVEL(pe) \
> +    (4 + (((pe)->val[2] >> 2) & VTD_SM_PASID_ENTRY_FLPM))
>   #define VTD_PE_GET_SL_LEVEL(pe) \
>       (2 + (((pe)->val[0] >> 2) & VTD_SM_PASID_ENTRY_AW))
>   
> @@ -755,6 +757,11 @@ static inline bool vtd_is_sl_level_supported(IntelIOMMUState *s, uint32_t level)
>              (1ULL << (level - 2 + VTD_CAP_SAGAW_SHIFT));
>   }
>   
> +static inline bool vtd_is_fl_level_supported(IntelIOMMUState *s, uint32_t level)
> +{
> +    return level == VTD_PML4_LEVEL;
> +}
> +
>   /* Return true if check passed, otherwise false */
>   static inline bool vtd_pe_type_check(X86IOMMUState *x86_iommu,
>                                        VTDPASIDEntry *pe)
> @@ -838,6 +845,11 @@ static int vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
>               return -VTD_FR_PASID_TABLE_ENTRY_INV;
>       }
>   
> +    if (pgtt == VTD_SM_PASID_ENTRY_FLT &&
> +        !vtd_is_fl_level_supported(s, VTD_PE_GET_FL_LEVEL(pe))) {
> +            return -VTD_FR_PASID_TABLE_ENTRY_INV;
> +    }
> +
>       return 0;
>   }
>   
> @@ -973,7 +985,11 @@ static uint32_t vtd_get_iova_level(IntelIOMMUState *s,
>   
>       if (s->root_scalable) {
>           vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
> -        return VTD_PE_GET_SL_LEVEL(&pe);
> +        if (s->scalable_modern) {
> +            return VTD_PE_GET_FL_LEVEL(&pe);
> +        } else {
> +            return VTD_PE_GET_SL_LEVEL(&pe);
> +        }
>       }
>   
>       return vtd_ce_get_level(ce);
> @@ -1060,7 +1076,11 @@ static dma_addr_t vtd_get_iova_pgtbl_base(IntelIOMMUState *s,
>   
>       if (s->root_scalable) {
>           vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
> -        return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
> +        if (s->scalable_modern) {
> +            return pe.val[2] & VTD_SM_PASID_ENTRY_FLPTPTR;
> +        } else {
> +            return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
> +        }
>       }
>   
>       return vtd_ce_get_slpt_base(ce);
> @@ -1862,6 +1882,104 @@ out:
>       trace_vtd_pt_enable_fast_path(source_id, success);
>   }
>   
> +/*
> + * Rsvd field masks for fpte:
> + *     vtd_fpte_rsvd 4k pages
> + *     vtd_fpte_rsvd_large large pages
> + *
> + * We support only 4-level page tables.
> + */
> +#define VTD_FPTE_RSVD_LEN 5
> +static uint64_t vtd_fpte_rsvd[VTD_FPTE_RSVD_LEN];
> +static uint64_t vtd_fpte_rsvd_large[VTD_FPTE_RSVD_LEN];
> +
> +static bool vtd_flpte_nonzero_rsvd(uint64_t flpte, uint32_t level)
> +{
> +    uint64_t rsvd_mask;
> +
> +    /*
> +     * We should have caught a guest-mis-programmed level earlier,
> +     * via vtd_is_fl_level_supported.
> +     */
> +    assert(level < VTD_FPTE_RSVD_LEN);
> +    /*
> +     * Zero level doesn't exist. The smallest level is VTD_PT_LEVEL=1 and
> +     * checked by vtd_is_last_pte().
> +     */
> +    assert(level);
> +
> +    if ((level == VTD_PD_LEVEL || level == VTD_PDP_LEVEL) &&
> +        (flpte & VTD_PT_PAGE_SIZE_MASK)) {
> +        /* large page */
> +        rsvd_mask = vtd_fpte_rsvd_large[level];
> +    } else {
> +        rsvd_mask = vtd_fpte_rsvd[level];
> +    }
> +
> +    return flpte & rsvd_mask;
> +}
> +
> +static inline bool vtd_flpte_present(uint64_t flpte)
> +{
> +    return !!(flpte & VTD_FL_P);
> +}
> +
> +/*
> + * Given the @iova, get relevant @flptep. @flpte_level will be the last level
> + * of the translation, can be used for deciding the size of large page.
> + */
> +static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
> +                             uint64_t iova, bool is_write,
> +                             uint64_t *flptep, uint32_t *flpte_level,
> +                             bool *reads, bool *writes, uint8_t aw_bits,
> +                             uint32_t pasid)
> +{
> +    dma_addr_t addr = vtd_get_iova_pgtbl_base(s, ce, pasid);
> +    uint32_t level = vtd_get_iova_level(s, ce, pasid);
> +    uint32_t offset;
> +    uint64_t flpte;
> +
> +    while (true) {
> +        offset = vtd_iova_level_offset(iova, level);
> +        flpte = vtd_get_pte(addr, offset);
> +
> +        if (flpte == (uint64_t)-1) {
> +            if (level == vtd_get_iova_level(s, ce, pasid)) {
> +                /* Invalid programming of context-entry */
> +                return -VTD_FR_CONTEXT_ENTRY_INV;
> +            } else {
> +                return -VTD_FR_PAGING_ENTRY_INV;
> +            }
> +        }
> +        if (!vtd_flpte_present(flpte)) {
> +            *reads = false;
> +            *writes = false;
> +            return -VTD_FR_PAGING_ENTRY_INV;
> +        }
> +        *reads = true;
> +        *writes = (*writes) && (flpte & VTD_FL_RW);
> +        if (is_write && !(flpte & VTD_FL_RW)) {
> +            return -VTD_FR_WRITE;
> +        }
> +        if (vtd_flpte_nonzero_rsvd(flpte, level)) {
> +            error_report_once("%s: detected flpte reserved non-zero "
> +                              "iova=0x%" PRIx64 ", level=0x%" PRIx32
> +                              "flpte=0x%" PRIx64 ", pasid=0x%" PRIX32 ")",
> +                              __func__, iova, level, flpte, pasid);
> +            return -VTD_FR_PAGING_ENTRY_RSVD;
> +        }
> +
> +        if (vtd_is_last_pte(flpte, level)) {
> +            *flptep = flpte;
> +            *flpte_level = level;
> +            return 0;
> +        }
> +
> +        addr = vtd_get_pte_addr(flpte, aw_bits);
> +        level--;
> +    }

As I replied in last version, it should check the ir range for the
translation result. I saw your reply, but that only covers the input
address, my comment is about the output addr.

[1] 
https://lore.kernel.org/qemu-devel/SJ0PR11MB6744D2B572D278DAF8BF267692762@SJ0PR11MB6744.namprd11.prod.outlook.com/

> +}
> +
>   static void vtd_report_fault(IntelIOMMUState *s,
>                                int err, bool is_fpd_set,
>                                uint16_t source_id,
> @@ -2010,8 +2128,13 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
>           }
>       }
>   
> -    ret_fr = vtd_iova_to_slpte(s, &ce, addr, is_write, &pte, &level,
> -                               &reads, &writes, s->aw_bits, pasid);
> +    if (s->scalable_modern && s->root_scalable) {
> +        ret_fr = vtd_iova_to_flpte(s, &ce, addr, is_write, &pte, &level,
> +                                   &reads, &writes, s->aw_bits, pasid);
> +    } else {
> +        ret_fr = vtd_iova_to_slpte(s, &ce, addr, is_write, &pte, &level,
> +                                   &reads, &writes, s->aw_bits, pasid);
> +    }
>       if (ret_fr) {
>           vtd_report_fault(s, -ret_fr, is_fpd_set, source_id,
>                            addr, is_write, pasid != PCI_NO_PASID, pasid);
> @@ -4239,6 +4362,18 @@ static void vtd_init(IntelIOMMUState *s)
>       vtd_spte_rsvd_large[2] = VTD_SPTE_LPAGE_L2_RSVD_MASK(s->aw_bits);
>       vtd_spte_rsvd_large[3] = VTD_SPTE_LPAGE_L3_RSVD_MASK(s->aw_bits);
>   
> +    /*
> +     * Rsvd field masks for fpte
> +     */
> +    vtd_fpte_rsvd[0] = ~0ULL;
> +    vtd_fpte_rsvd[1] = VTD_FPTE_PAGE_L1_RSVD_MASK(s->aw_bits);
> +    vtd_fpte_rsvd[2] = VTD_FPTE_PAGE_L2_RSVD_MASK(s->aw_bits);
> +    vtd_fpte_rsvd[3] = VTD_FPTE_PAGE_L3_RSVD_MASK(s->aw_bits);
> +    vtd_fpte_rsvd[4] = VTD_FPTE_PAGE_L4_RSVD_MASK(s->aw_bits);
> +
> +    vtd_fpte_rsvd_large[2] = VTD_FPTE_LPAGE_L2_RSVD_MASK(s->aw_bits);
> +    vtd_fpte_rsvd_large[3] = VTD_FPTE_LPAGE_L3_RSVD_MASK(s->aw_bits);
> +
>       if (s->scalable_mode || s->snoop_control) {
>           vtd_spte_rsvd[1] &= ~VTD_SPTE_SNP;
>           vtd_spte_rsvd_large[2] &= ~VTD_SPTE_SNP;
Duan, Zhenzhong Nov. 4, 2024, 3:05 a.m. UTC | #2 
>-----Original Message-----
>From: Liu, Yi L <yi.l.liu@intel.com>
>Sent: Sunday, November 3, 2024 10:22 PM
>Subject: Re: [PATCH v4 06/17] intel_iommu: Implement stage-1 translation
>
>On 2024/9/30 17:26, Zhenzhong Duan wrote:
>> From: Yi Liu <yi.l.liu@intel.com>
>>
>> This adds stage-1 page table walking to support stage-1 only
>> translation in scalable modern mode.
>>
>> Signed-off-by: Yi Liu <yi.l.liu@intel.com>
>> Co-developed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
>> Signed-off-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
>> Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
>> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
>> Acked-by: Jason Wang <jasowang@redhat.com>
>> ---
>>   hw/i386/intel_iommu_internal.h |  24 ++++++
>>   hw/i386/intel_iommu.c          | 143 ++++++++++++++++++++++++++++++++-
>>   2 files changed, 163 insertions(+), 4 deletions(-)
>>
>> diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
>> index 20fcc73938..38bf0c7a06 100644
>> --- a/hw/i386/intel_iommu_internal.h
>> +++ b/hw/i386/intel_iommu_internal.h
>> @@ -428,6 +428,22 @@ typedef union VTDInvDesc VTDInvDesc;
>>   #define VTD_SPTE_LPAGE_L3_RSVD_MASK(aw) \
>>           (0x3ffff800ULL | ~(VTD_HAW_MASK(aw) | VTD_SL_IGN_COM))
>>
>> +/* Rsvd field masks for fpte */
>> +#define VTD_FS_UPPER_IGNORED 0xfff0000000000000ULL
>> +#define VTD_FPTE_PAGE_L1_RSVD_MASK(aw) \
>> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>> +#define VTD_FPTE_PAGE_L2_RSVD_MASK(aw) \
>> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>> +#define VTD_FPTE_PAGE_L3_RSVD_MASK(aw) \
>> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>> +#define VTD_FPTE_PAGE_L4_RSVD_MASK(aw) \
>> +        (0x80ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>> +
>> +#define VTD_FPTE_LPAGE_L2_RSVD_MASK(aw) \
>> +        (0x1fe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>> +#define VTD_FPTE_LPAGE_L3_RSVD_MASK(aw) \
>> +        (0x3fffe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>> +
>>   /* Masks for PIOTLB Invalidate Descriptor */
>>   #define VTD_INV_DESC_PIOTLB_G             (3ULL << 4)
>>   #define VTD_INV_DESC_PIOTLB_ALL_IN_PASID  (2ULL << 4)
>> @@ -520,6 +536,14 @@ typedef struct VTDRootEntry VTDRootEntry;
>>   #define VTD_SM_PASID_ENTRY_AW          7ULL /* Adjusted guest-address-
>width */
>>   #define VTD_SM_PASID_ENTRY_DID(val)    ((val) & VTD_DOMAIN_ID_MASK)
>>
>> +#define VTD_SM_PASID_ENTRY_FLPM          3ULL
>> +#define VTD_SM_PASID_ENTRY_FLPTPTR       (~0xfffULL)
>> +
>> +/* First Level Paging Structure */
>> +/* Masks for First Level Paging Entry */
>> +#define VTD_FL_P                    1ULL
>> +#define VTD_FL_RW                   (1ULL << 1)
>> +
>>   /* Second Level Page Translation Pointer*/
>>   #define VTD_SM_PASID_ENTRY_SLPTPTR     (~0xfffULL)
>>
>> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
>> index 6f2414898c..56d5933e93 100644
>> --- a/hw/i386/intel_iommu.c
>> +++ b/hw/i386/intel_iommu.c
>> @@ -48,6 +48,8 @@
>>
>>   /* pe operations */
>>   #define VTD_PE_GET_TYPE(pe) ((pe)->val[0] & VTD_SM_PASID_ENTRY_PGTT)
>> +#define VTD_PE_GET_FL_LEVEL(pe) \
>> +    (4 + (((pe)->val[2] >> 2) & VTD_SM_PASID_ENTRY_FLPM))
>>   #define VTD_PE_GET_SL_LEVEL(pe) \
>>       (2 + (((pe)->val[0] >> 2) & VTD_SM_PASID_ENTRY_AW))
>>
>> @@ -755,6 +757,11 @@ static inline bool
>vtd_is_sl_level_supported(IntelIOMMUState *s, uint32_t level)
>>              (1ULL << (level - 2 + VTD_CAP_SAGAW_SHIFT));
>>   }
>>
>> +static inline bool vtd_is_fl_level_supported(IntelIOMMUState *s, uint32_t
>level)
>> +{
>> +    return level == VTD_PML4_LEVEL;
>> +}
>> +
>>   /* Return true if check passed, otherwise false */
>>   static inline bool vtd_pe_type_check(X86IOMMUState *x86_iommu,
>>                                        VTDPASIDEntry *pe)
>> @@ -838,6 +845,11 @@ static int
>vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
>>               return -VTD_FR_PASID_TABLE_ENTRY_INV;
>>       }
>>
>> +    if (pgtt == VTD_SM_PASID_ENTRY_FLT &&
>> +        !vtd_is_fl_level_supported(s, VTD_PE_GET_FL_LEVEL(pe))) {
>> +            return -VTD_FR_PASID_TABLE_ENTRY_INV;
>> +    }
>> +
>>       return 0;
>>   }
>>
>> @@ -973,7 +985,11 @@ static uint32_t vtd_get_iova_level(IntelIOMMUState
>*s,
>>
>>       if (s->root_scalable) {
>>           vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
>> -        return VTD_PE_GET_SL_LEVEL(&pe);
>> +        if (s->scalable_modern) {
>> +            return VTD_PE_GET_FL_LEVEL(&pe);
>> +        } else {
>> +            return VTD_PE_GET_SL_LEVEL(&pe);
>> +        }
>>       }
>>
>>       return vtd_ce_get_level(ce);
>> @@ -1060,7 +1076,11 @@ static dma_addr_t
>vtd_get_iova_pgtbl_base(IntelIOMMUState *s,
>>
>>       if (s->root_scalable) {
>>           vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
>> -        return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
>> +        if (s->scalable_modern) {
>> +            return pe.val[2] & VTD_SM_PASID_ENTRY_FLPTPTR;
>> +        } else {
>> +            return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
>> +        }
>>       }
>>
>>       return vtd_ce_get_slpt_base(ce);
>> @@ -1862,6 +1882,104 @@ out:
>>       trace_vtd_pt_enable_fast_path(source_id, success);
>>   }
>>
>> +/*
>> + * Rsvd field masks for fpte:
>> + *     vtd_fpte_rsvd 4k pages
>> + *     vtd_fpte_rsvd_large large pages
>> + *
>> + * We support only 4-level page tables.
>> + */
>> +#define VTD_FPTE_RSVD_LEN 5
>> +static uint64_t vtd_fpte_rsvd[VTD_FPTE_RSVD_LEN];
>> +static uint64_t vtd_fpte_rsvd_large[VTD_FPTE_RSVD_LEN];
>> +
>> +static bool vtd_flpte_nonzero_rsvd(uint64_t flpte, uint32_t level)
>> +{
>> +    uint64_t rsvd_mask;
>> +
>> +    /*
>> +     * We should have caught a guest-mis-programmed level earlier,
>> +     * via vtd_is_fl_level_supported.
>> +     */
>> +    assert(level < VTD_FPTE_RSVD_LEN);
>> +    /*
>> +     * Zero level doesn't exist. The smallest level is VTD_PT_LEVEL=1 and
>> +     * checked by vtd_is_last_pte().
>> +     */
>> +    assert(level);
>> +
>> +    if ((level == VTD_PD_LEVEL || level == VTD_PDP_LEVEL) &&
>> +        (flpte & VTD_PT_PAGE_SIZE_MASK)) {
>> +        /* large page */
>> +        rsvd_mask = vtd_fpte_rsvd_large[level];
>> +    } else {
>> +        rsvd_mask = vtd_fpte_rsvd[level];
>> +    }
>> +
>> +    return flpte & rsvd_mask;
>> +}
>> +
>> +static inline bool vtd_flpte_present(uint64_t flpte)
>> +{
>> +    return !!(flpte & VTD_FL_P);
>> +}
>> +
>> +/*
>> + * Given the @iova, get relevant @flptep. @flpte_level will be the last level
>> + * of the translation, can be used for deciding the size of large page.
>> + */
>> +static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
>> +                             uint64_t iova, bool is_write,
>> +                             uint64_t *flptep, uint32_t *flpte_level,
>> +                             bool *reads, bool *writes, uint8_t aw_bits,
>> +                             uint32_t pasid)
>> +{
>> +    dma_addr_t addr = vtd_get_iova_pgtbl_base(s, ce, pasid);
>> +    uint32_t level = vtd_get_iova_level(s, ce, pasid);
>> +    uint32_t offset;
>> +    uint64_t flpte;
>> +
>> +    while (true) {
>> +        offset = vtd_iova_level_offset(iova, level);
>> +        flpte = vtd_get_pte(addr, offset);
>> +
>> +        if (flpte == (uint64_t)-1) {
>> +            if (level == vtd_get_iova_level(s, ce, pasid)) {
>> +                /* Invalid programming of context-entry */
>> +                return -VTD_FR_CONTEXT_ENTRY_INV;
>> +            } else {
>> +                return -VTD_FR_PAGING_ENTRY_INV;
>> +            }
>> +        }
>> +        if (!vtd_flpte_present(flpte)) {
>> +            *reads = false;
>> +            *writes = false;
>> +            return -VTD_FR_PAGING_ENTRY_INV;
>> +        }
>> +        *reads = true;
>> +        *writes = (*writes) && (flpte & VTD_FL_RW);
>> +        if (is_write && !(flpte & VTD_FL_RW)) {
>> +            return -VTD_FR_WRITE;
>> +        }
>> +        if (vtd_flpte_nonzero_rsvd(flpte, level)) {
>> +            error_report_once("%s: detected flpte reserved non-zero "
>> +                              "iova=0x%" PRIx64 ", level=0x%" PRIx32
>> +                              "flpte=0x%" PRIx64 ", pasid=0x%" PRIX32 ")",
>> +                              __func__, iova, level, flpte, pasid);
>> +            return -VTD_FR_PAGING_ENTRY_RSVD;
>> +        }
>> +
>> +        if (vtd_is_last_pte(flpte, level)) {
>> +            *flptep = flpte;
>> +            *flpte_level = level;
>> +            return 0;
>> +        }
>> +
>> +        addr = vtd_get_pte_addr(flpte, aw_bits);
>> +        level--;
>> +    }
>
>As I replied in last version, it should check the ir range for the
>translation result. I saw your reply, but that only covers the input
>address, my comment is about the output addr.
>
>[1]
>https://lore.kernel.org/qemu-
>devel/SJ0PR11MB6744D2B572D278DAF8BF267692762@SJ0PR11MB6744.nampr
>d11.prod.outlook.com/

Oh, I see, you are right! As the check for ir range is common for both stage-2 and stage-1,
I plan to move it to common place with a separate patch like below, let me know if you
prefer to have separate check for both stage-2 and stage-1.

--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -1235,7 +1235,6 @@ static int vtd_iova_to_slpte(IntelIOMMUState *s, VTDContextEntry *ce,
     uint32_t offset;
     uint64_t slpte;
     uint64_t access_right_check;
-    uint64_t xlat, size;

     if (!vtd_iova_sl_range_check(s, iova, ce, aw_bits, pasid)) {
         error_report_once("%s: detected IOVA overflow (iova=0x%" PRIx64 ","
@@ -1288,28 +1287,7 @@ static int vtd_iova_to_slpte(IntelIOMMUState *s, VTDContextEntry *ce,
         level--;
     }

-    xlat = vtd_get_pte_addr(*slptep, aw_bits);
-    size = ~vtd_pt_level_page_mask(level) + 1;
-
-    /*
-     * From VT-d spec 3.14: Untranslated requests and translation
-     * requests that result in an address in the interrupt range will be
-     * blocked with condition code LGN.4 or SGN.8.
-     */
-    if ((xlat > VTD_INTERRUPT_ADDR_LAST ||
-         xlat + size - 1 < VTD_INTERRUPT_ADDR_FIRST)) {
-        return 0;
-    } else {
-        error_report_once("%s: xlat address is in interrupt range "
-                          "(iova=0x%" PRIx64 ", level=0x%" PRIx32 ", "
-                          "slpte=0x%" PRIx64 ", write=%d, "
-                          "xlat=0x%" PRIx64 ", size=0x%" PRIx64 ", "
-                          "pasid=0x%" PRIx32 ")",
-                          __func__, iova, level, slpte, is_write,
-                          xlat, size, pasid);
-        return s->scalable_mode ? -VTD_FR_SM_INTERRUPT_ADDR :
-                                  -VTD_FR_INTERRUPT_ADDR;
-    }
+    return 0;
 }

 typedef int (*vtd_page_walk_hook)(const IOMMUTLBEvent *event, void *private);
@@ -2201,6 +2179,7 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
     uint8_t access_flags, pgtt;
     bool rid2pasid = (pasid == PCI_NO_PASID) && s->root_scalable;
     VTDIOTLBEntry *iotlb_entry;
+    uint64_t xlat, size;

     /*
      * We have standalone memory region for interrupt addresses, we
@@ -2312,6 +2291,29 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
                                    &reads, &writes, s->aw_bits, pasid);
         pgtt = VTD_SM_PASID_ENTRY_SLT;
     }
+    if (!ret_fr) {
+        xlat = vtd_get_pte_addr(pte, s->aw_bits);
+        size = ~vtd_pt_level_page_mask(level) + 1;
+
+        /*
+         * From VT-d spec 3.14: Untranslated requests and translation
+         * requests that result in an address in the interrupt range will be
+         * blocked with condition code LGN.4 or SGN.8.
+         */
+        if ((xlat <= VTD_INTERRUPT_ADDR_LAST &&
+             xlat + size - 1 >= VTD_INTERRUPT_ADDR_FIRST)) {
+            error_report_once("%s: xlat address is in interrupt range "
+                              "(iova=0x%" PRIx64 ", level=0x%" PRIx32 ", "
+                              "pte=0x%" PRIx64 ", write=%d, "
+                              "xlat=0x%" PRIx64 ", size=0x%" PRIx64 ", "
+                              "pasid=0x%" PRIx32 ")",
+                              __func__, addr, level, pte, is_write,
+                              xlat, size, pasid);
+            ret_fr = s->scalable_mode ? -VTD_FR_SM_INTERRUPT_ADDR :
+                                        -VTD_FR_INTERRUPT_ADDR;
+        }
+    }
+
     if (ret_fr) {
         vtd_report_fault(s, -ret_fr, is_fpd_set, source_id,
                          addr, is_write, pasid != PCI_NO_PASID, pasid);
Yi Liu Nov. 4, 2024, 7:02 a.m. UTC | #3 
On 2024/11/4 11:05, Duan, Zhenzhong wrote:
> 
> 
>> -----Original Message-----
>> From: Liu, Yi L <yi.l.liu@intel.com>
>> Sent: Sunday, November 3, 2024 10:22 PM
>> Subject: Re: [PATCH v4 06/17] intel_iommu: Implement stage-1 translation
>>
>> On 2024/9/30 17:26, Zhenzhong Duan wrote:
>>> From: Yi Liu <yi.l.liu@intel.com>
>>>
>>> This adds stage-1 page table walking to support stage-1 only
>>> translation in scalable modern mode.
>>>
>>> Signed-off-by: Yi Liu <yi.l.liu@intel.com>
>>> Co-developed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
>>> Signed-off-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
>>> Signed-off-by: Yi Sun <yi.y.sun@linux.intel.com>
>>> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
>>> Acked-by: Jason Wang <jasowang@redhat.com>
>>> ---
>>>    hw/i386/intel_iommu_internal.h |  24 ++++++
>>>    hw/i386/intel_iommu.c          | 143 ++++++++++++++++++++++++++++++++-
>>>    2 files changed, 163 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
>>> index 20fcc73938..38bf0c7a06 100644
>>> --- a/hw/i386/intel_iommu_internal.h
>>> +++ b/hw/i386/intel_iommu_internal.h
>>> @@ -428,6 +428,22 @@ typedef union VTDInvDesc VTDInvDesc;
>>>    #define VTD_SPTE_LPAGE_L3_RSVD_MASK(aw) \
>>>            (0x3ffff800ULL | ~(VTD_HAW_MASK(aw) | VTD_SL_IGN_COM))
>>>
>>> +/* Rsvd field masks for fpte */
>>> +#define VTD_FS_UPPER_IGNORED 0xfff0000000000000ULL
>>> +#define VTD_FPTE_PAGE_L1_RSVD_MASK(aw) \
>>> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>>> +#define VTD_FPTE_PAGE_L2_RSVD_MASK(aw) \
>>> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>>> +#define VTD_FPTE_PAGE_L3_RSVD_MASK(aw) \
>>> +        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>>> +#define VTD_FPTE_PAGE_L4_RSVD_MASK(aw) \
>>> +        (0x80ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>>> +
>>> +#define VTD_FPTE_LPAGE_L2_RSVD_MASK(aw) \
>>> +        (0x1fe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>>> +#define VTD_FPTE_LPAGE_L3_RSVD_MASK(aw) \
>>> +        (0x3fffe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
>>> +
>>>    /* Masks for PIOTLB Invalidate Descriptor */
>>>    #define VTD_INV_DESC_PIOTLB_G             (3ULL << 4)
>>>    #define VTD_INV_DESC_PIOTLB_ALL_IN_PASID  (2ULL << 4)
>>> @@ -520,6 +536,14 @@ typedef struct VTDRootEntry VTDRootEntry;
>>>    #define VTD_SM_PASID_ENTRY_AW          7ULL /* Adjusted guest-address-
>> width */
>>>    #define VTD_SM_PASID_ENTRY_DID(val)    ((val) & VTD_DOMAIN_ID_MASK)
>>>
>>> +#define VTD_SM_PASID_ENTRY_FLPM          3ULL
>>> +#define VTD_SM_PASID_ENTRY_FLPTPTR       (~0xfffULL)
>>> +
>>> +/* First Level Paging Structure */
>>> +/* Masks for First Level Paging Entry */
>>> +#define VTD_FL_P                    1ULL
>>> +#define VTD_FL_RW                   (1ULL << 1)
>>> +
>>>    /* Second Level Page Translation Pointer*/
>>>    #define VTD_SM_PASID_ENTRY_SLPTPTR     (~0xfffULL)
>>>
>>> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
>>> index 6f2414898c..56d5933e93 100644
>>> --- a/hw/i386/intel_iommu.c
>>> +++ b/hw/i386/intel_iommu.c
>>> @@ -48,6 +48,8 @@
>>>
>>>    /* pe operations */
>>>    #define VTD_PE_GET_TYPE(pe) ((pe)->val[0] & VTD_SM_PASID_ENTRY_PGTT)
>>> +#define VTD_PE_GET_FL_LEVEL(pe) \
>>> +    (4 + (((pe)->val[2] >> 2) & VTD_SM_PASID_ENTRY_FLPM))
>>>    #define VTD_PE_GET_SL_LEVEL(pe) \
>>>        (2 + (((pe)->val[0] >> 2) & VTD_SM_PASID_ENTRY_AW))
>>>
>>> @@ -755,6 +757,11 @@ static inline bool
>> vtd_is_sl_level_supported(IntelIOMMUState *s, uint32_t level)
>>>               (1ULL << (level - 2 + VTD_CAP_SAGAW_SHIFT));
>>>    }
>>>
>>> +static inline bool vtd_is_fl_level_supported(IntelIOMMUState *s, uint32_t
>> level)
>>> +{
>>> +    return level == VTD_PML4_LEVEL;
>>> +}
>>> +
>>>    /* Return true if check passed, otherwise false */
>>>    static inline bool vtd_pe_type_check(X86IOMMUState *x86_iommu,
>>>                                         VTDPASIDEntry *pe)
>>> @@ -838,6 +845,11 @@ static int
>> vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
>>>                return -VTD_FR_PASID_TABLE_ENTRY_INV;
>>>        }
>>>
>>> +    if (pgtt == VTD_SM_PASID_ENTRY_FLT &&
>>> +        !vtd_is_fl_level_supported(s, VTD_PE_GET_FL_LEVEL(pe))) {
>>> +            return -VTD_FR_PASID_TABLE_ENTRY_INV;
>>> +    }
>>> +
>>>        return 0;
>>>    }
>>>
>>> @@ -973,7 +985,11 @@ static uint32_t vtd_get_iova_level(IntelIOMMUState
>> *s,
>>>
>>>        if (s->root_scalable) {
>>>            vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
>>> -        return VTD_PE_GET_SL_LEVEL(&pe);
>>> +        if (s->scalable_modern) {
>>> +            return VTD_PE_GET_FL_LEVEL(&pe);
>>> +        } else {
>>> +            return VTD_PE_GET_SL_LEVEL(&pe);
>>> +        }
>>>        }
>>>
>>>        return vtd_ce_get_level(ce);
>>> @@ -1060,7 +1076,11 @@ static dma_addr_t
>> vtd_get_iova_pgtbl_base(IntelIOMMUState *s,
>>>
>>>        if (s->root_scalable) {
>>>            vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
>>> -        return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
>>> +        if (s->scalable_modern) {
>>> +            return pe.val[2] & VTD_SM_PASID_ENTRY_FLPTPTR;
>>> +        } else {
>>> +            return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
>>> +        }
>>>        }
>>>
>>>        return vtd_ce_get_slpt_base(ce);
>>> @@ -1862,6 +1882,104 @@ out:
>>>        trace_vtd_pt_enable_fast_path(source_id, success);
>>>    }
>>>
>>> +/*
>>> + * Rsvd field masks for fpte:
>>> + *     vtd_fpte_rsvd 4k pages
>>> + *     vtd_fpte_rsvd_large large pages
>>> + *
>>> + * We support only 4-level page tables.
>>> + */
>>> +#define VTD_FPTE_RSVD_LEN 5
>>> +static uint64_t vtd_fpte_rsvd[VTD_FPTE_RSVD_LEN];
>>> +static uint64_t vtd_fpte_rsvd_large[VTD_FPTE_RSVD_LEN];
>>> +
>>> +static bool vtd_flpte_nonzero_rsvd(uint64_t flpte, uint32_t level)
>>> +{
>>> +    uint64_t rsvd_mask;
>>> +
>>> +    /*
>>> +     * We should have caught a guest-mis-programmed level earlier,
>>> +     * via vtd_is_fl_level_supported.
>>> +     */
>>> +    assert(level < VTD_FPTE_RSVD_LEN);
>>> +    /*
>>> +     * Zero level doesn't exist. The smallest level is VTD_PT_LEVEL=1 and
>>> +     * checked by vtd_is_last_pte().
>>> +     */
>>> +    assert(level);
>>> +
>>> +    if ((level == VTD_PD_LEVEL || level == VTD_PDP_LEVEL) &&
>>> +        (flpte & VTD_PT_PAGE_SIZE_MASK)) {
>>> +        /* large page */
>>> +        rsvd_mask = vtd_fpte_rsvd_large[level];
>>> +    } else {
>>> +        rsvd_mask = vtd_fpte_rsvd[level];
>>> +    }
>>> +
>>> +    return flpte & rsvd_mask;
>>> +}
>>> +
>>> +static inline bool vtd_flpte_present(uint64_t flpte)
>>> +{
>>> +    return !!(flpte & VTD_FL_P);
>>> +}
>>> +
>>> +/*
>>> + * Given the @iova, get relevant @flptep. @flpte_level will be the last level
>>> + * of the translation, can be used for deciding the size of large page.
>>> + */
>>> +static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
>>> +                             uint64_t iova, bool is_write,
>>> +                             uint64_t *flptep, uint32_t *flpte_level,
>>> +                             bool *reads, bool *writes, uint8_t aw_bits,
>>> +                             uint32_t pasid)
>>> +{
>>> +    dma_addr_t addr = vtd_get_iova_pgtbl_base(s, ce, pasid);
>>> +    uint32_t level = vtd_get_iova_level(s, ce, pasid);
>>> +    uint32_t offset;
>>> +    uint64_t flpte;
>>> +
>>> +    while (true) {
>>> +        offset = vtd_iova_level_offset(iova, level);
>>> +        flpte = vtd_get_pte(addr, offset);
>>> +
>>> +        if (flpte == (uint64_t)-1) {
>>> +            if (level == vtd_get_iova_level(s, ce, pasid)) {
>>> +                /* Invalid programming of context-entry */
>>> +                return -VTD_FR_CONTEXT_ENTRY_INV;
>>> +            } else {
>>> +                return -VTD_FR_PAGING_ENTRY_INV;
>>> +            }
>>> +        }
>>> +        if (!vtd_flpte_present(flpte)) {
>>> +            *reads = false;
>>> +            *writes = false;
>>> +            return -VTD_FR_PAGING_ENTRY_INV;
>>> +        }
>>> +        *reads = true;
>>> +        *writes = (*writes) && (flpte & VTD_FL_RW);
>>> +        if (is_write && !(flpte & VTD_FL_RW)) {
>>> +            return -VTD_FR_WRITE;
>>> +        }
>>> +        if (vtd_flpte_nonzero_rsvd(flpte, level)) {
>>> +            error_report_once("%s: detected flpte reserved non-zero "
>>> +                              "iova=0x%" PRIx64 ", level=0x%" PRIx32
>>> +                              "flpte=0x%" PRIx64 ", pasid=0x%" PRIX32 ")",
>>> +                              __func__, iova, level, flpte, pasid);
>>> +            return -VTD_FR_PAGING_ENTRY_RSVD;
>>> +        }
>>> +
>>> +        if (vtd_is_last_pte(flpte, level)) {
>>> +            *flptep = flpte;
>>> +            *flpte_level = level;
>>> +            return 0;
>>> +        }
>>> +
>>> +        addr = vtd_get_pte_addr(flpte, aw_bits);
>>> +        level--;
>>> +    }
>>
>> As I replied in last version, it should check the ir range for the
>> translation result. I saw your reply, but that only covers the input
>> address, my comment is about the output addr.
>>
>> [1]
>> https://lore.kernel.org/qemu-
>> devel/SJ0PR11MB6744D2B572D278DAF8BF267692762@SJ0PR11MB6744.nampr
>> d11.prod.outlook.com/
> 
> Oh, I see, you are right! As the check for ir range is common for both stage-2 and stage-1,
> I plan to move it to common place with a separate patch like below, let me know if you
> prefer to have separate check for both stage-2 and stage-1.

checking it in the common place is ok.

> 
> --- a/hw/i386/intel_iommu.c
> +++ b/hw/i386/intel_iommu.c
> @@ -1235,7 +1235,6 @@ static int vtd_iova_to_slpte(IntelIOMMUState *s, VTDContextEntry *ce,
>       uint32_t offset;
>       uint64_t slpte;
>       uint64_t access_right_check;
> -    uint64_t xlat, size;
> 
>       if (!vtd_iova_sl_range_check(s, iova, ce, aw_bits, pasid)) {
>           error_report_once("%s: detected IOVA overflow (iova=0x%" PRIx64 ","
> @@ -1288,28 +1287,7 @@ static int vtd_iova_to_slpte(IntelIOMMUState *s, VTDContextEntry *ce,
>           level--;
>       }
> 
> -    xlat = vtd_get_pte_addr(*slptep, aw_bits);
> -    size = ~vtd_pt_level_page_mask(level) + 1;
> -
> -    /*
> -     * From VT-d spec 3.14: Untranslated requests and translation
> -     * requests that result in an address in the interrupt range will be
> -     * blocked with condition code LGN.4 or SGN.8.
> -     */
> -    if ((xlat > VTD_INTERRUPT_ADDR_LAST ||
> -         xlat + size - 1 < VTD_INTERRUPT_ADDR_FIRST)) {
> -        return 0;
> -    } else {
> -        error_report_once("%s: xlat address is in interrupt range "
> -                          "(iova=0x%" PRIx64 ", level=0x%" PRIx32 ", "
> -                          "slpte=0x%" PRIx64 ", write=%d, "
> -                          "xlat=0x%" PRIx64 ", size=0x%" PRIx64 ", "
> -                          "pasid=0x%" PRIx32 ")",
> -                          __func__, iova, level, slpte, is_write,
> -                          xlat, size, pasid);
> -        return s->scalable_mode ? -VTD_FR_SM_INTERRUPT_ADDR :
> -                                  -VTD_FR_INTERRUPT_ADDR;
> -    }
> +    return 0;
>   }
> 
>   typedef int (*vtd_page_walk_hook)(const IOMMUTLBEvent *event, void *private);
> @@ -2201,6 +2179,7 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
>       uint8_t access_flags, pgtt;
>       bool rid2pasid = (pasid == PCI_NO_PASID) && s->root_scalable;
>       VTDIOTLBEntry *iotlb_entry;
> +    uint64_t xlat, size;
> 
>       /*
>        * We have standalone memory region for interrupt addresses, we
> @@ -2312,6 +2291,29 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
>                                      &reads, &writes, s->aw_bits, pasid);
>           pgtt = VTD_SM_PASID_ENTRY_SLT;
>       }
> +    if (!ret_fr) {
> +        xlat = vtd_get_pte_addr(pte, s->aw_bits);
> +        size = ~vtd_pt_level_page_mask(level) + 1;
> +
> +        /*
> +         * From VT-d spec 3.14: Untranslated requests and translation
> +         * requests that result in an address in the interrupt range will be
> +         * blocked with condition code LGN.4 or SGN.8.
> +         */
> +        if ((xlat <= VTD_INTERRUPT_ADDR_LAST &&
> +             xlat + size - 1 >= VTD_INTERRUPT_ADDR_FIRST)) {
> +            error_report_once("%s: xlat address is in interrupt range "
> +                              "(iova=0x%" PRIx64 ", level=0x%" PRIx32 ", "
> +                              "pte=0x%" PRIx64 ", write=%d, "
> +                              "xlat=0x%" PRIx64 ", size=0x%" PRIx64 ", "
> +                              "pasid=0x%" PRIx32 ")",
> +                              __func__, addr, level, pte, is_write,
> +                              xlat, size, pasid);
> +            ret_fr = s->scalable_mode ? -VTD_FR_SM_INTERRUPT_ADDR :
> +                                        -VTD_FR_INTERRUPT_ADDR;
> +        }
> +    }
> +
>       if (ret_fr) {
>           vtd_report_fault(s, -ret_fr, is_fpd_set, source_id,
>                            addr, is_write, pasid != PCI_NO_PASID, pasid);
diff mbox series

Patch

diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index 20fcc73938..38bf0c7a06 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -428,6 +428,22 @@  typedef union VTDInvDesc VTDInvDesc;
 #define VTD_SPTE_LPAGE_L3_RSVD_MASK(aw) \
         (0x3ffff800ULL | ~(VTD_HAW_MASK(aw) | VTD_SL_IGN_COM))
 
+/* Rsvd field masks for fpte */
+#define VTD_FS_UPPER_IGNORED 0xfff0000000000000ULL
+#define VTD_FPTE_PAGE_L1_RSVD_MASK(aw) \
+        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
+#define VTD_FPTE_PAGE_L2_RSVD_MASK(aw) \
+        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
+#define VTD_FPTE_PAGE_L3_RSVD_MASK(aw) \
+        (~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
+#define VTD_FPTE_PAGE_L4_RSVD_MASK(aw) \
+        (0x80ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
+
+#define VTD_FPTE_LPAGE_L2_RSVD_MASK(aw) \
+        (0x1fe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
+#define VTD_FPTE_LPAGE_L3_RSVD_MASK(aw) \
+        (0x3fffe000ULL | ~(VTD_HAW_MASK(aw) | VTD_FS_UPPER_IGNORED))
+
 /* Masks for PIOTLB Invalidate Descriptor */
 #define VTD_INV_DESC_PIOTLB_G             (3ULL << 4)
 #define VTD_INV_DESC_PIOTLB_ALL_IN_PASID  (2ULL << 4)
@@ -520,6 +536,14 @@  typedef struct VTDRootEntry VTDRootEntry;
 #define VTD_SM_PASID_ENTRY_AW          7ULL /* Adjusted guest-address-width */
 #define VTD_SM_PASID_ENTRY_DID(val)    ((val) & VTD_DOMAIN_ID_MASK)
 
+#define VTD_SM_PASID_ENTRY_FLPM          3ULL
+#define VTD_SM_PASID_ENTRY_FLPTPTR       (~0xfffULL)
+
+/* First Level Paging Structure */
+/* Masks for First Level Paging Entry */
+#define VTD_FL_P                    1ULL
+#define VTD_FL_RW                   (1ULL << 1)
+
 /* Second Level Page Translation Pointer*/
 #define VTD_SM_PASID_ENTRY_SLPTPTR     (~0xfffULL)
 
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 6f2414898c..56d5933e93 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -48,6 +48,8 @@ 
 
 /* pe operations */
 #define VTD_PE_GET_TYPE(pe) ((pe)->val[0] & VTD_SM_PASID_ENTRY_PGTT)
+#define VTD_PE_GET_FL_LEVEL(pe) \
+    (4 + (((pe)->val[2] >> 2) & VTD_SM_PASID_ENTRY_FLPM))
 #define VTD_PE_GET_SL_LEVEL(pe) \
     (2 + (((pe)->val[0] >> 2) & VTD_SM_PASID_ENTRY_AW))
 
@@ -755,6 +757,11 @@  static inline bool vtd_is_sl_level_supported(IntelIOMMUState *s, uint32_t level)
            (1ULL << (level - 2 + VTD_CAP_SAGAW_SHIFT));
 }
 
+static inline bool vtd_is_fl_level_supported(IntelIOMMUState *s, uint32_t level)
+{
+    return level == VTD_PML4_LEVEL;
+}
+
 /* Return true if check passed, otherwise false */
 static inline bool vtd_pe_type_check(X86IOMMUState *x86_iommu,
                                      VTDPASIDEntry *pe)
@@ -838,6 +845,11 @@  static int vtd_get_pe_in_pasid_leaf_table(IntelIOMMUState *s,
             return -VTD_FR_PASID_TABLE_ENTRY_INV;
     }
 
+    if (pgtt == VTD_SM_PASID_ENTRY_FLT &&
+        !vtd_is_fl_level_supported(s, VTD_PE_GET_FL_LEVEL(pe))) {
+            return -VTD_FR_PASID_TABLE_ENTRY_INV;
+    }
+
     return 0;
 }
 
@@ -973,7 +985,11 @@  static uint32_t vtd_get_iova_level(IntelIOMMUState *s,
 
     if (s->root_scalable) {
         vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
-        return VTD_PE_GET_SL_LEVEL(&pe);
+        if (s->scalable_modern) {
+            return VTD_PE_GET_FL_LEVEL(&pe);
+        } else {
+            return VTD_PE_GET_SL_LEVEL(&pe);
+        }
     }
 
     return vtd_ce_get_level(ce);
@@ -1060,7 +1076,11 @@  static dma_addr_t vtd_get_iova_pgtbl_base(IntelIOMMUState *s,
 
     if (s->root_scalable) {
         vtd_ce_get_rid2pasid_entry(s, ce, &pe, pasid);
-        return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
+        if (s->scalable_modern) {
+            return pe.val[2] & VTD_SM_PASID_ENTRY_FLPTPTR;
+        } else {
+            return pe.val[0] & VTD_SM_PASID_ENTRY_SLPTPTR;
+        }
     }
 
     return vtd_ce_get_slpt_base(ce);
@@ -1862,6 +1882,104 @@  out:
     trace_vtd_pt_enable_fast_path(source_id, success);
 }
 
+/*
+ * Rsvd field masks for fpte:
+ *     vtd_fpte_rsvd 4k pages
+ *     vtd_fpte_rsvd_large large pages
+ *
+ * We support only 4-level page tables.
+ */
+#define VTD_FPTE_RSVD_LEN 5
+static uint64_t vtd_fpte_rsvd[VTD_FPTE_RSVD_LEN];
+static uint64_t vtd_fpte_rsvd_large[VTD_FPTE_RSVD_LEN];
+
+static bool vtd_flpte_nonzero_rsvd(uint64_t flpte, uint32_t level)
+{
+    uint64_t rsvd_mask;
+
+    /*
+     * We should have caught a guest-mis-programmed level earlier,
+     * via vtd_is_fl_level_supported.
+     */
+    assert(level < VTD_FPTE_RSVD_LEN);
+    /*
+     * Zero level doesn't exist. The smallest level is VTD_PT_LEVEL=1 and
+     * checked by vtd_is_last_pte().
+     */
+    assert(level);
+
+    if ((level == VTD_PD_LEVEL || level == VTD_PDP_LEVEL) &&
+        (flpte & VTD_PT_PAGE_SIZE_MASK)) {
+        /* large page */
+        rsvd_mask = vtd_fpte_rsvd_large[level];
+    } else {
+        rsvd_mask = vtd_fpte_rsvd[level];
+    }
+
+    return flpte & rsvd_mask;
+}
+
+static inline bool vtd_flpte_present(uint64_t flpte)
+{
+    return !!(flpte & VTD_FL_P);
+}
+
+/*
+ * Given the @iova, get relevant @flptep. @flpte_level will be the last level
+ * of the translation, can be used for deciding the size of large page.
+ */
+static int vtd_iova_to_flpte(IntelIOMMUState *s, VTDContextEntry *ce,
+                             uint64_t iova, bool is_write,
+                             uint64_t *flptep, uint32_t *flpte_level,
+                             bool *reads, bool *writes, uint8_t aw_bits,
+                             uint32_t pasid)
+{
+    dma_addr_t addr = vtd_get_iova_pgtbl_base(s, ce, pasid);
+    uint32_t level = vtd_get_iova_level(s, ce, pasid);
+    uint32_t offset;
+    uint64_t flpte;
+
+    while (true) {
+        offset = vtd_iova_level_offset(iova, level);
+        flpte = vtd_get_pte(addr, offset);
+
+        if (flpte == (uint64_t)-1) {
+            if (level == vtd_get_iova_level(s, ce, pasid)) {
+                /* Invalid programming of context-entry */
+                return -VTD_FR_CONTEXT_ENTRY_INV;
+            } else {
+                return -VTD_FR_PAGING_ENTRY_INV;
+            }
+        }
+        if (!vtd_flpte_present(flpte)) {
+            *reads = false;
+            *writes = false;
+            return -VTD_FR_PAGING_ENTRY_INV;
+        }
+        *reads = true;
+        *writes = (*writes) && (flpte & VTD_FL_RW);
+        if (is_write && !(flpte & VTD_FL_RW)) {
+            return -VTD_FR_WRITE;
+        }
+        if (vtd_flpte_nonzero_rsvd(flpte, level)) {
+            error_report_once("%s: detected flpte reserved non-zero "
+                              "iova=0x%" PRIx64 ", level=0x%" PRIx32
+                              "flpte=0x%" PRIx64 ", pasid=0x%" PRIX32 ")",
+                              __func__, iova, level, flpte, pasid);
+            return -VTD_FR_PAGING_ENTRY_RSVD;
+        }
+
+        if (vtd_is_last_pte(flpte, level)) {
+            *flptep = flpte;
+            *flpte_level = level;
+            return 0;
+        }
+
+        addr = vtd_get_pte_addr(flpte, aw_bits);
+        level--;
+    }
+}
+
 static void vtd_report_fault(IntelIOMMUState *s,
                              int err, bool is_fpd_set,
                              uint16_t source_id,
@@ -2010,8 +2128,13 @@  static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus,
         }
     }
 
-    ret_fr = vtd_iova_to_slpte(s, &ce, addr, is_write, &pte, &level,
-                               &reads, &writes, s->aw_bits, pasid);
+    if (s->scalable_modern && s->root_scalable) {
+        ret_fr = vtd_iova_to_flpte(s, &ce, addr, is_write, &pte, &level,
+                                   &reads, &writes, s->aw_bits, pasid);
+    } else {
+        ret_fr = vtd_iova_to_slpte(s, &ce, addr, is_write, &pte, &level,
+                                   &reads, &writes, s->aw_bits, pasid);
+    }
     if (ret_fr) {
         vtd_report_fault(s, -ret_fr, is_fpd_set, source_id,
                          addr, is_write, pasid != PCI_NO_PASID, pasid);
@@ -4239,6 +4362,18 @@  static void vtd_init(IntelIOMMUState *s)
     vtd_spte_rsvd_large[2] = VTD_SPTE_LPAGE_L2_RSVD_MASK(s->aw_bits);
     vtd_spte_rsvd_large[3] = VTD_SPTE_LPAGE_L3_RSVD_MASK(s->aw_bits);
 
+    /*
+     * Rsvd field masks for fpte
+     */
+    vtd_fpte_rsvd[0] = ~0ULL;
+    vtd_fpte_rsvd[1] = VTD_FPTE_PAGE_L1_RSVD_MASK(s->aw_bits);
+    vtd_fpte_rsvd[2] = VTD_FPTE_PAGE_L2_RSVD_MASK(s->aw_bits);
+    vtd_fpte_rsvd[3] = VTD_FPTE_PAGE_L3_RSVD_MASK(s->aw_bits);
+    vtd_fpte_rsvd[4] = VTD_FPTE_PAGE_L4_RSVD_MASK(s->aw_bits);
+
+    vtd_fpte_rsvd_large[2] = VTD_FPTE_LPAGE_L2_RSVD_MASK(s->aw_bits);
+    vtd_fpte_rsvd_large[3] = VTD_FPTE_LPAGE_L3_RSVD_MASK(s->aw_bits);
+
     if (s->scalable_mode || s->snoop_control) {
         vtd_spte_rsvd[1] &= ~VTD_SPTE_SNP;
         vtd_spte_rsvd_large[2] &= ~VTD_SPTE_SNP;