2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * Author: Prem Mallappa <pmallapp@broadcom.com>
19 #include "qemu/osdep.h"
21 #include "exec/target_page.h"
22 #include "hw/core/cpu.h"
23 #include "hw/qdev-properties.h"
24 #include "qapi/error.h"
25 #include "qemu/jhash.h"
26 #include "qemu/module.h"
28 #include "qemu/error-report.h"
29 #include "hw/arm/smmu-common.h"
30 #include "smmu-internal.h"
32 /* IOTLB Management */
34 static guint
smmu_iotlb_key_hash(gconstpointer v
)
36 SMMUIOTLBKey
*key
= (SMMUIOTLBKey
*)v
;
40 a
= b
= c
= JHASH_INITVAL
+ sizeof(*key
);
41 a
+= key
->asid
+ key
->vmid
+ key
->level
+ key
->tg
;
42 b
+= extract64(key
->iova
, 0, 32);
43 c
+= extract64(key
->iova
, 32, 32);
46 __jhash_final(a
, b
, c
);
51 static gboolean
smmu_iotlb_key_equal(gconstpointer v1
, gconstpointer v2
)
53 SMMUIOTLBKey
*k1
= (SMMUIOTLBKey
*)v1
, *k2
= (SMMUIOTLBKey
*)v2
;
55 return (k1
->asid
== k2
->asid
) && (k1
->iova
== k2
->iova
) &&
56 (k1
->level
== k2
->level
) && (k1
->tg
== k2
->tg
) &&
57 (k1
->vmid
== k2
->vmid
);
60 SMMUIOTLBKey
smmu_get_iotlb_key(int asid
, int vmid
, uint64_t iova
,
61 uint8_t tg
, uint8_t level
)
63 SMMUIOTLBKey key
= {.asid
= asid
, .vmid
= vmid
, .iova
= iova
,
64 .tg
= tg
, .level
= level
};
69 static SMMUTLBEntry
*smmu_iotlb_lookup_all_levels(SMMUState
*bs
,
71 SMMUTransTableInfo
*tt
,
74 uint8_t tg
= (tt
->granule_sz
- 10) / 2;
75 uint8_t inputsize
= 64 - tt
->tsz
;
76 uint8_t stride
= tt
->granule_sz
- 3;
77 uint8_t level
= 4 - (inputsize
- 4) / stride
;
78 SMMUTLBEntry
*entry
= NULL
;
81 uint64_t subpage_size
= 1ULL << level_shift(level
, tt
->granule_sz
);
82 uint64_t mask
= subpage_size
- 1;
85 key
= smmu_get_iotlb_key(cfg
->asid
, cfg
->s2cfg
.vmid
,
86 iova
& ~mask
, tg
, level
);
87 entry
= g_hash_table_lookup(bs
->iotlb
, &key
);
97 * smmu_iotlb_lookup - Look up for a TLB entry.
98 * @bs: SMMU state which includes the TLB instance
99 * @cfg: Configuration of the translation
100 * @tt: Translation table info (granule and tsz)
101 * @iova: IOVA address to lookup
103 * returns a valid entry on success, otherwise NULL.
104 * In case of nested translation, tt can be updated to include
105 * the granule of the found entry as it might different from
108 SMMUTLBEntry
*smmu_iotlb_lookup(SMMUState
*bs
, SMMUTransCfg
*cfg
,
109 SMMUTransTableInfo
*tt
, hwaddr iova
)
111 SMMUTLBEntry
*entry
= NULL
;
113 entry
= smmu_iotlb_lookup_all_levels(bs
, cfg
, tt
, iova
);
115 * For nested translation also try the s2 granule, as the TLB will insert
116 * it if the size of s2 tlb entry was smaller.
118 if (!entry
&& (cfg
->stage
== SMMU_NESTED
) &&
119 (cfg
->s2cfg
.granule_sz
!= tt
->granule_sz
)) {
120 tt
->granule_sz
= cfg
->s2cfg
.granule_sz
;
121 entry
= smmu_iotlb_lookup_all_levels(bs
, cfg
, tt
, iova
);
126 trace_smmu_iotlb_lookup_hit(cfg
->asid
, cfg
->s2cfg
.vmid
, iova
,
127 cfg
->iotlb_hits
, cfg
->iotlb_misses
,
128 100 * cfg
->iotlb_hits
/
129 (cfg
->iotlb_hits
+ cfg
->iotlb_misses
));
132 trace_smmu_iotlb_lookup_miss(cfg
->asid
, cfg
->s2cfg
.vmid
, iova
,
133 cfg
->iotlb_hits
, cfg
->iotlb_misses
,
134 100 * cfg
->iotlb_hits
/
135 (cfg
->iotlb_hits
+ cfg
->iotlb_misses
));
140 void smmu_iotlb_insert(SMMUState
*bs
, SMMUTransCfg
*cfg
, SMMUTLBEntry
*new)
142 SMMUIOTLBKey
*key
= g_new0(SMMUIOTLBKey
, 1);
143 uint8_t tg
= (new->granule
- 10) / 2;
145 if (g_hash_table_size(bs
->iotlb
) >= SMMU_IOTLB_MAX_SIZE
) {
146 smmu_iotlb_inv_all(bs
);
149 *key
= smmu_get_iotlb_key(cfg
->asid
, cfg
->s2cfg
.vmid
, new->entry
.iova
,
151 trace_smmu_iotlb_insert(cfg
->asid
, cfg
->s2cfg
.vmid
, new->entry
.iova
,
153 g_hash_table_insert(bs
->iotlb
, key
, new);
156 void smmu_iotlb_inv_all(SMMUState
*s
)
158 trace_smmu_iotlb_inv_all();
159 g_hash_table_remove_all(s
->iotlb
);
162 static gboolean
smmu_hash_remove_by_asid_vmid(gpointer key
, gpointer value
,
165 SMMUIOTLBPageInvInfo
*info
= (SMMUIOTLBPageInvInfo
*)user_data
;
166 SMMUIOTLBKey
*iotlb_key
= (SMMUIOTLBKey
*)key
;
168 return (SMMU_IOTLB_ASID(*iotlb_key
) == info
->asid
) &&
169 (SMMU_IOTLB_VMID(*iotlb_key
) == info
->vmid
);
172 static gboolean
smmu_hash_remove_by_vmid(gpointer key
, gpointer value
,
175 int vmid
= *(int *)user_data
;
176 SMMUIOTLBKey
*iotlb_key
= (SMMUIOTLBKey
*)key
;
178 return SMMU_IOTLB_VMID(*iotlb_key
) == vmid
;
181 static gboolean
smmu_hash_remove_by_vmid_s1(gpointer key
, gpointer value
,
184 int vmid
= *(int *)user_data
;
185 SMMUIOTLBKey
*iotlb_key
= (SMMUIOTLBKey
*)key
;
187 return (SMMU_IOTLB_VMID(*iotlb_key
) == vmid
) &&
188 (SMMU_IOTLB_ASID(*iotlb_key
) >= 0);
191 static gboolean
smmu_hash_remove_by_asid_vmid_iova(gpointer key
, gpointer value
,
194 SMMUTLBEntry
*iter
= (SMMUTLBEntry
*)value
;
195 IOMMUTLBEntry
*entry
= &iter
->entry
;
196 SMMUIOTLBPageInvInfo
*info
= (SMMUIOTLBPageInvInfo
*)user_data
;
197 SMMUIOTLBKey iotlb_key
= *(SMMUIOTLBKey
*)key
;
199 if (info
->asid
>= 0 && info
->asid
!= SMMU_IOTLB_ASID(iotlb_key
)) {
202 if (info
->vmid
>= 0 && info
->vmid
!= SMMU_IOTLB_VMID(iotlb_key
)) {
205 return ((info
->iova
& ~entry
->addr_mask
) == entry
->iova
) ||
206 ((entry
->iova
& ~info
->mask
) == info
->iova
);
209 static gboolean
smmu_hash_remove_by_vmid_ipa(gpointer key
, gpointer value
,
212 SMMUTLBEntry
*iter
= (SMMUTLBEntry
*)value
;
213 IOMMUTLBEntry
*entry
= &iter
->entry
;
214 SMMUIOTLBPageInvInfo
*info
= (SMMUIOTLBPageInvInfo
*)user_data
;
215 SMMUIOTLBKey iotlb_key
= *(SMMUIOTLBKey
*)key
;
217 if (SMMU_IOTLB_ASID(iotlb_key
) >= 0) {
218 /* This is a stage-1 address. */
221 if (info
->vmid
!= SMMU_IOTLB_VMID(iotlb_key
)) {
224 return ((info
->iova
& ~entry
->addr_mask
) == entry
->iova
) ||
225 ((entry
->iova
& ~info
->mask
) == info
->iova
);
228 void smmu_iotlb_inv_iova(SMMUState
*s
, int asid
, int vmid
, dma_addr_t iova
,
229 uint8_t tg
, uint64_t num_pages
, uint8_t ttl
)
231 /* if tg is not set we use 4KB range invalidation */
232 uint8_t granule
= tg
? tg
* 2 + 10 : 12;
234 if (ttl
&& (num_pages
== 1) && (asid
>= 0)) {
235 SMMUIOTLBKey key
= smmu_get_iotlb_key(asid
, vmid
, iova
, tg
, ttl
);
237 if (g_hash_table_remove(s
->iotlb
, &key
)) {
241 * if the entry is not found, let's see if it does not
242 * belong to a larger IOTLB entry
246 SMMUIOTLBPageInvInfo info
= {
247 .asid
= asid
, .iova
= iova
,
249 .mask
= (num_pages
* 1 << granule
) - 1};
251 g_hash_table_foreach_remove(s
->iotlb
,
252 smmu_hash_remove_by_asid_vmid_iova
,
257 * Similar to smmu_iotlb_inv_iova(), but for Stage-2, ASID is always -1,
258 * in Stage-1 invalidation ASID = -1, means don't care.
260 void smmu_iotlb_inv_ipa(SMMUState
*s
, int vmid
, dma_addr_t ipa
, uint8_t tg
,
261 uint64_t num_pages
, uint8_t ttl
)
263 uint8_t granule
= tg
? tg
* 2 + 10 : 12;
266 if (ttl
&& (num_pages
== 1)) {
267 SMMUIOTLBKey key
= smmu_get_iotlb_key(asid
, vmid
, ipa
, tg
, ttl
);
269 if (g_hash_table_remove(s
->iotlb
, &key
)) {
274 SMMUIOTLBPageInvInfo info
= {
277 .mask
= (num_pages
<< granule
) - 1};
279 g_hash_table_foreach_remove(s
->iotlb
,
280 smmu_hash_remove_by_vmid_ipa
,
284 void smmu_iotlb_inv_asid_vmid(SMMUState
*s
, int asid
, int vmid
)
286 SMMUIOTLBPageInvInfo info
= {
291 trace_smmu_iotlb_inv_asid_vmid(asid
, vmid
);
292 g_hash_table_foreach_remove(s
->iotlb
, smmu_hash_remove_by_asid_vmid
, &info
);
295 void smmu_iotlb_inv_vmid(SMMUState
*s
, int vmid
)
297 trace_smmu_iotlb_inv_vmid(vmid
);
298 g_hash_table_foreach_remove(s
->iotlb
, smmu_hash_remove_by_vmid
, &vmid
);
301 inline void smmu_iotlb_inv_vmid_s1(SMMUState
*s
, int vmid
)
303 trace_smmu_iotlb_inv_vmid_s1(vmid
);
304 g_hash_table_foreach_remove(s
->iotlb
, smmu_hash_remove_by_vmid_s1
, &vmid
);
307 /* VMSAv8-64 Translation */
310 * get_pte - Get the content of a page table entry located at
313 static int get_pte(dma_addr_t baseaddr
, uint32_t index
, uint64_t *pte
,
314 SMMUPTWEventInfo
*info
)
317 dma_addr_t addr
= baseaddr
+ index
* sizeof(*pte
);
319 /* TODO: guarantee 64-bit single-copy atomicity */
320 ret
= ldq_le_dma(&address_space_memory
, addr
, pte
, MEMTXATTRS_UNSPECIFIED
);
322 if (ret
!= MEMTX_OK
) {
323 info
->type
= SMMU_PTW_ERR_WALK_EABT
;
327 trace_smmu_get_pte(baseaddr
, index
, addr
, *pte
);
331 /* VMSAv8-64 Translation Table Format Descriptor Decoding */
334 * get_page_pte_address - returns the L3 descriptor output address,
336 * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
338 static inline hwaddr
get_page_pte_address(uint64_t pte
, int granule_sz
)
340 return PTE_ADDRESS(pte
, granule_sz
);
344 * get_table_pte_address - return table descriptor output address,
345 * ie. address of next level table
346 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
348 static inline hwaddr
get_table_pte_address(uint64_t pte
, int granule_sz
)
350 return PTE_ADDRESS(pte
, granule_sz
);
354 * get_block_pte_address - return block descriptor output address and block size
355 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
357 static inline hwaddr
get_block_pte_address(uint64_t pte
, int level
,
358 int granule_sz
, uint64_t *bsz
)
360 int n
= level_shift(level
, granule_sz
);
363 return PTE_ADDRESS(pte
, n
);
366 SMMUTransTableInfo
*select_tt(SMMUTransCfg
*cfg
, dma_addr_t iova
)
368 bool tbi
= extract64(iova
, 55, 1) ? TBI1(cfg
->tbi
) : TBI0(cfg
->tbi
);
369 uint8_t tbi_byte
= tbi
* 8;
371 if (cfg
->tt
[0].tsz
&&
372 !extract64(iova
, 64 - cfg
->tt
[0].tsz
, cfg
->tt
[0].tsz
- tbi_byte
)) {
373 /* there is a ttbr0 region and we are in it (high bits all zero) */
375 } else if (cfg
->tt
[1].tsz
&&
376 sextract64(iova
, 64 - cfg
->tt
[1].tsz
, cfg
->tt
[1].tsz
- tbi_byte
) == -1) {
377 /* there is a ttbr1 region and we are in it (high bits all one) */
379 } else if (!cfg
->tt
[0].tsz
) {
380 /* ttbr0 region is "everything not in the ttbr1 region" */
382 } else if (!cfg
->tt
[1].tsz
) {
383 /* ttbr1 region is "everything not in the ttbr0 region" */
386 /* in the gap between the two regions, this is a Translation fault */
390 /* Translate stage-1 table address using stage-2 page table. */
391 static inline int translate_table_addr_ipa(SMMUState
*bs
,
392 dma_addr_t
*table_addr
,
394 SMMUPTWEventInfo
*info
)
396 dma_addr_t addr
= *table_addr
;
397 SMMUTLBEntry
*cached_entry
;
401 * The translation table walks performed from TTB0 or TTB1 are always
402 * performed in IPA space if stage 2 translations are enabled.
405 cfg
->stage
= SMMU_STAGE_2
;
407 cached_entry
= smmu_translate(bs
, cfg
, addr
, IOMMU_RO
, info
);
409 cfg
->stage
= SMMU_NESTED
;
412 *table_addr
= CACHED_ENTRY_TO_ADDR(cached_entry
, addr
);
416 info
->stage
= SMMU_STAGE_2
;
418 info
->is_ipa_descriptor
= true;
423 * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
424 * @bs: smmu state which includes TLB instance
425 * @cfg: translation config
426 * @iova: iova to translate
428 * @tlbe: SMMUTLBEntry (out)
429 * @info: handle to an error info
431 * Return 0 on success, < 0 on error. In case of error, @info is filled
432 * and tlbe->perm is set to IOMMU_NONE.
433 * Upon success, @tlbe is filled with translated_addr and entry
436 static int smmu_ptw_64_s1(SMMUState
*bs
, SMMUTransCfg
*cfg
,
437 dma_addr_t iova
, IOMMUAccessFlags perm
,
438 SMMUTLBEntry
*tlbe
, SMMUPTWEventInfo
*info
)
440 dma_addr_t baseaddr
, indexmask
;
441 SMMUStage stage
= cfg
->stage
;
442 SMMUTransTableInfo
*tt
= select_tt(cfg
, iova
);
443 uint8_t level
, granule_sz
, inputsize
, stride
;
445 if (!tt
|| tt
->disabled
) {
446 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
450 granule_sz
= tt
->granule_sz
;
451 stride
= VMSA_STRIDE(granule_sz
);
452 inputsize
= 64 - tt
->tsz
;
453 level
= 4 - (inputsize
- 4) / stride
;
454 indexmask
= VMSA_IDXMSK(inputsize
, stride
, level
);
456 baseaddr
= extract64(tt
->ttb
, 0, cfg
->oas
);
457 baseaddr
&= ~indexmask
;
459 while (level
< VMSA_LEVELS
) {
460 uint64_t subpage_size
= 1ULL << level_shift(level
, granule_sz
);
461 uint64_t mask
= subpage_size
- 1;
462 uint32_t offset
= iova_level_offset(iova
, inputsize
, level
, granule_sz
);
464 dma_addr_t pte_addr
= baseaddr
+ offset
* sizeof(pte
);
467 if (get_pte(baseaddr
, offset
, &pte
, info
)) {
470 trace_smmu_ptw_level(stage
, level
, iova
, subpage_size
,
471 baseaddr
, offset
, pte
);
473 if (is_invalid_pte(pte
) || is_reserved_pte(pte
, level
)) {
474 trace_smmu_ptw_invalid_pte(stage
, level
, baseaddr
,
475 pte_addr
, offset
, pte
);
479 if (is_table_pte(pte
, level
)) {
480 ap
= PTE_APTABLE(pte
);
482 if (is_permission_fault(ap
, perm
) && !tt
->had
) {
483 info
->type
= SMMU_PTW_ERR_PERMISSION
;
486 baseaddr
= get_table_pte_address(pte
, granule_sz
);
487 if (cfg
->stage
== SMMU_NESTED
) {
488 if (translate_table_addr_ipa(bs
, &baseaddr
, cfg
, info
)) {
494 } else if (is_page_pte(pte
, level
)) {
495 gpa
= get_page_pte_address(pte
, granule_sz
);
496 trace_smmu_ptw_page_pte(stage
, level
, iova
,
497 baseaddr
, pte_addr
, pte
, gpa
);
501 gpa
= get_block_pte_address(pte
, level
, granule_sz
,
503 trace_smmu_ptw_block_pte(stage
, level
, baseaddr
,
504 pte_addr
, pte
, iova
, gpa
,
509 * QEMU does not currently implement HTTU, so if AFFD and PTE.AF
510 * are 0 we take an Access flag fault. (5.4. Context Descriptor)
511 * An Access flag fault takes priority over a Permission fault.
513 if (!PTE_AF(pte
) && !cfg
->affd
) {
514 info
->type
= SMMU_PTW_ERR_ACCESS
;
519 if (is_permission_fault(ap
, perm
)) {
520 info
->type
= SMMU_PTW_ERR_PERMISSION
;
525 * The address output from the translation causes a stage 1 Address
526 * Size fault if it exceeds the range of the effective IPA size for
529 if (gpa
>= (1ULL << cfg
->oas
)) {
530 info
->type
= SMMU_PTW_ERR_ADDR_SIZE
;
534 tlbe
->entry
.translated_addr
= gpa
;
535 tlbe
->entry
.iova
= iova
& ~mask
;
536 tlbe
->entry
.addr_mask
= mask
;
537 tlbe
->parent_perm
= PTE_AP_TO_PERM(ap
);
538 tlbe
->entry
.perm
= tlbe
->parent_perm
;
540 tlbe
->granule
= granule_sz
;
543 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
546 info
->stage
= SMMU_STAGE_1
;
547 tlbe
->entry
.perm
= IOMMU_NONE
;
552 * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
554 * @cfg: translation config
555 * @ipa: ipa to translate
557 * @tlbe: SMMUTLBEntry (out)
558 * @info: handle to an error info
560 * Return 0 on success, < 0 on error. In case of error, @info is filled
561 * and tlbe->perm is set to IOMMU_NONE.
562 * Upon success, @tlbe is filled with translated_addr and entry
565 static int smmu_ptw_64_s2(SMMUTransCfg
*cfg
,
566 dma_addr_t ipa
, IOMMUAccessFlags perm
,
567 SMMUTLBEntry
*tlbe
, SMMUPTWEventInfo
*info
)
569 const SMMUStage stage
= SMMU_STAGE_2
;
570 int granule_sz
= cfg
->s2cfg
.granule_sz
;
571 /* ARM DDI0487I.a: Table D8-7. */
572 int inputsize
= 64 - cfg
->s2cfg
.tsz
;
573 int level
= get_start_level(cfg
->s2cfg
.sl0
, granule_sz
);
574 int stride
= VMSA_STRIDE(granule_sz
);
575 int idx
= pgd_concat_idx(level
, granule_sz
, ipa
);
577 * Get the ttb from concatenated structure.
578 * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
580 uint64_t baseaddr
= extract64(cfg
->s2cfg
.vttb
, 0, cfg
->s2cfg
.eff_ps
) +
581 (1 << stride
) * idx
* sizeof(uint64_t);
582 dma_addr_t indexmask
= VMSA_IDXMSK(inputsize
, stride
, level
);
584 baseaddr
&= ~indexmask
;
587 * On input, a stage 2 Translation fault occurs if the IPA is outside the
588 * range configured by the relevant S2T0SZ field of the STE.
590 if (ipa
>= (1ULL << inputsize
)) {
591 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
595 while (level
< VMSA_LEVELS
) {
596 uint64_t subpage_size
= 1ULL << level_shift(level
, granule_sz
);
597 uint64_t mask
= subpage_size
- 1;
598 uint32_t offset
= iova_level_offset(ipa
, inputsize
, level
, granule_sz
);
600 dma_addr_t pte_addr
= baseaddr
+ offset
* sizeof(pte
);
603 if (get_pte(baseaddr
, offset
, &pte
, info
)) {
606 trace_smmu_ptw_level(stage
, level
, ipa
, subpage_size
,
607 baseaddr
, offset
, pte
);
608 if (is_invalid_pte(pte
) || is_reserved_pte(pte
, level
)) {
609 trace_smmu_ptw_invalid_pte(stage
, level
, baseaddr
,
610 pte_addr
, offset
, pte
);
614 if (is_table_pte(pte
, level
)) {
615 baseaddr
= get_table_pte_address(pte
, granule_sz
);
618 } else if (is_page_pte(pte
, level
)) {
619 gpa
= get_page_pte_address(pte
, granule_sz
);
620 trace_smmu_ptw_page_pte(stage
, level
, ipa
,
621 baseaddr
, pte_addr
, pte
, gpa
);
625 gpa
= get_block_pte_address(pte
, level
, granule_sz
,
627 trace_smmu_ptw_block_pte(stage
, level
, baseaddr
,
628 pte_addr
, pte
, ipa
, gpa
,
633 * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
634 * An Access fault takes priority over a Permission fault.
636 if (!PTE_AF(pte
) && !cfg
->s2cfg
.affd
) {
637 info
->type
= SMMU_PTW_ERR_ACCESS
;
642 if (is_permission_fault_s2(s2ap
, perm
)) {
643 info
->type
= SMMU_PTW_ERR_PERMISSION
;
648 * The address output from the translation causes a stage 2 Address
649 * Size fault if it exceeds the effective PA output range.
651 if (gpa
>= (1ULL << cfg
->s2cfg
.eff_ps
)) {
652 info
->type
= SMMU_PTW_ERR_ADDR_SIZE
;
656 tlbe
->entry
.translated_addr
= gpa
;
657 tlbe
->entry
.iova
= ipa
& ~mask
;
658 tlbe
->entry
.addr_mask
= mask
;
659 tlbe
->parent_perm
= s2ap
;
660 tlbe
->entry
.perm
= tlbe
->parent_perm
;
662 tlbe
->granule
= granule_sz
;
665 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
670 info
->stage
= SMMU_STAGE_2
;
671 tlbe
->entry
.perm
= IOMMU_NONE
;
676 * combine S1 and S2 TLB entries into a single entry.
677 * As a result the S1 entry is overriden with combined data.
679 static void combine_tlb(SMMUTLBEntry
*tlbe
, SMMUTLBEntry
*tlbe_s2
,
680 dma_addr_t iova
, SMMUTransCfg
*cfg
)
682 if (tlbe_s2
->entry
.addr_mask
< tlbe
->entry
.addr_mask
) {
683 tlbe
->entry
.addr_mask
= tlbe_s2
->entry
.addr_mask
;
684 tlbe
->granule
= tlbe_s2
->granule
;
685 tlbe
->level
= tlbe_s2
->level
;
688 tlbe
->entry
.translated_addr
= CACHED_ENTRY_TO_ADDR(tlbe_s2
,
689 tlbe
->entry
.translated_addr
);
691 tlbe
->entry
.iova
= iova
& ~tlbe
->entry
.addr_mask
;
692 /* parent_perm has s2 perm while perm keeps s1 perm. */
693 tlbe
->parent_perm
= tlbe_s2
->entry
.perm
;
698 * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
700 * @bs: smmu state which includes TLB instance
701 * @cfg: translation configuration
702 * @iova: iova to translate
703 * @perm: tentative access type
704 * @tlbe: returned entry
705 * @info: ptw event handle
707 * return 0 on success
709 int smmu_ptw(SMMUState
*bs
, SMMUTransCfg
*cfg
, dma_addr_t iova
,
710 IOMMUAccessFlags perm
, SMMUTLBEntry
*tlbe
, SMMUPTWEventInfo
*info
)
713 SMMUTLBEntry tlbe_s2
;
716 if (cfg
->stage
== SMMU_STAGE_1
) {
717 return smmu_ptw_64_s1(bs
, cfg
, iova
, perm
, tlbe
, info
);
718 } else if (cfg
->stage
== SMMU_STAGE_2
) {
720 * If bypassing stage 1(or unimplemented), the input address is passed
721 * directly to stage 2 as IPA. If the input address of a transaction
722 * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
723 * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
725 if (iova
>= (1ULL << cfg
->oas
)) {
726 info
->type
= SMMU_PTW_ERR_ADDR_SIZE
;
727 info
->stage
= SMMU_STAGE_1
;
728 tlbe
->entry
.perm
= IOMMU_NONE
;
732 return smmu_ptw_64_s2(cfg
, iova
, perm
, tlbe
, info
);
736 ret
= smmu_ptw_64_s1(bs
, cfg
, iova
, perm
, tlbe
, info
);
741 ipa
= CACHED_ENTRY_TO_ADDR(tlbe
, iova
);
742 ret
= smmu_ptw_64_s2(cfg
, ipa
, perm
, &tlbe_s2
, info
);
747 combine_tlb(tlbe
, &tlbe_s2
, iova
, cfg
);
751 SMMUTLBEntry
*smmu_translate(SMMUState
*bs
, SMMUTransCfg
*cfg
, dma_addr_t addr
,
752 IOMMUAccessFlags flag
, SMMUPTWEventInfo
*info
)
754 SMMUTLBEntry
*cached_entry
= NULL
;
755 SMMUTransTableInfo
*tt
;
759 * Combined attributes used for TLB lookup, holds the attributes for
762 SMMUTransTableInfo tt_combined
;
764 if (cfg
->stage
== SMMU_STAGE_2
) {
766 tt_combined
.granule_sz
= cfg
->s2cfg
.granule_sz
;
767 tt_combined
.tsz
= cfg
->s2cfg
.tsz
;
769 /* Select stage1 translation table. */
770 tt
= select_tt(cfg
, addr
);
772 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
773 info
->stage
= SMMU_STAGE_1
;
776 tt_combined
.granule_sz
= tt
->granule_sz
;
777 tt_combined
.tsz
= tt
->tsz
;
780 cached_entry
= smmu_iotlb_lookup(bs
, cfg
, &tt_combined
, addr
);
782 if ((flag
& IOMMU_WO
) && !(cached_entry
->entry
.perm
&
783 cached_entry
->parent_perm
& IOMMU_WO
)) {
784 info
->type
= SMMU_PTW_ERR_PERMISSION
;
785 info
->stage
= !(cached_entry
->entry
.perm
& IOMMU_WO
) ?
793 cached_entry
= g_new0(SMMUTLBEntry
, 1);
794 status
= smmu_ptw(bs
, cfg
, addr
, flag
, cached_entry
, info
);
796 g_free(cached_entry
);
799 smmu_iotlb_insert(bs
, cfg
, cached_entry
);
804 * The bus number is used for lookup when SID based invalidation occurs.
805 * In that case we lazily populate the SMMUPciBus array from the bus hash
806 * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
807 * numbers may not be always initialized yet.
809 SMMUPciBus
*smmu_find_smmu_pcibus(SMMUState
*s
, uint8_t bus_num
)
811 SMMUPciBus
*smmu_pci_bus
= s
->smmu_pcibus_by_bus_num
[bus_num
];
818 g_hash_table_iter_init(&iter
, s
->smmu_pcibus_by_busptr
);
819 while (g_hash_table_iter_next(&iter
, NULL
, (void **)&smmu_pci_bus
)) {
820 if (pci_bus_num(smmu_pci_bus
->bus
) == bus_num
) {
821 s
->smmu_pcibus_by_bus_num
[bus_num
] = smmu_pci_bus
;
829 static AddressSpace
*smmu_find_add_as(PCIBus
*bus
, void *opaque
, int devfn
)
831 SMMUState
*s
= opaque
;
832 SMMUPciBus
*sbus
= g_hash_table_lookup(s
->smmu_pcibus_by_busptr
, bus
);
834 static unsigned int index
;
837 sbus
= g_malloc0(sizeof(SMMUPciBus
) +
838 sizeof(SMMUDevice
*) * SMMU_PCI_DEVFN_MAX
);
840 g_hash_table_insert(s
->smmu_pcibus_by_busptr
, bus
, sbus
);
843 sdev
= sbus
->pbdev
[devfn
];
845 char *name
= g_strdup_printf("%s-%d-%d", s
->mrtypename
, devfn
, index
++);
847 sdev
= sbus
->pbdev
[devfn
] = g_new0(SMMUDevice
, 1);
853 memory_region_init_iommu(&sdev
->iommu
, sizeof(sdev
->iommu
),
855 OBJECT(s
), name
, UINT64_MAX
);
856 address_space_init(&sdev
->as
,
857 MEMORY_REGION(&sdev
->iommu
), name
);
858 trace_smmu_add_mr(name
);
865 static const PCIIOMMUOps smmu_ops
= {
866 .get_address_space
= smmu_find_add_as
,
869 SMMUDevice
*smmu_find_sdev(SMMUState
*s
, uint32_t sid
)
871 uint8_t bus_n
, devfn
;
872 SMMUPciBus
*smmu_bus
;
874 bus_n
= PCI_BUS_NUM(sid
);
875 smmu_bus
= smmu_find_smmu_pcibus(s
, bus_n
);
877 devfn
= SMMU_PCI_DEVFN(sid
);
878 return smmu_bus
->pbdev
[devfn
];
883 /* Unmap all notifiers attached to @mr */
884 static void smmu_inv_notifiers_mr(IOMMUMemoryRegion
*mr
)
888 trace_smmu_inv_notifiers_mr(mr
->parent_obj
.name
);
889 IOMMU_NOTIFIER_FOREACH(n
, mr
) {
890 memory_region_unmap_iommu_notifier_range(n
);
894 /* Unmap all notifiers of all mr's */
895 void smmu_inv_notifiers_all(SMMUState
*s
)
899 QLIST_FOREACH(sdev
, &s
->devices_with_notifiers
, next
) {
900 smmu_inv_notifiers_mr(&sdev
->iommu
);
904 static void smmu_base_realize(DeviceState
*dev
, Error
**errp
)
906 SMMUState
*s
= ARM_SMMU(dev
);
907 SMMUBaseClass
*sbc
= ARM_SMMU_GET_CLASS(dev
);
908 Error
*local_err
= NULL
;
910 sbc
->parent_realize(dev
, &local_err
);
912 error_propagate(errp
, local_err
);
915 s
->configs
= g_hash_table_new_full(NULL
, NULL
, NULL
, g_free
);
916 s
->iotlb
= g_hash_table_new_full(smmu_iotlb_key_hash
, smmu_iotlb_key_equal
,
918 s
->smmu_pcibus_by_busptr
= g_hash_table_new(NULL
, NULL
);
920 if (s
->primary_bus
) {
921 pci_setup_iommu(s
->primary_bus
, &smmu_ops
, s
);
923 error_setg(errp
, "SMMU is not attached to any PCI bus!");
927 static void smmu_base_reset_hold(Object
*obj
, ResetType type
)
929 SMMUState
*s
= ARM_SMMU(obj
);
931 memset(s
->smmu_pcibus_by_bus_num
, 0, sizeof(s
->smmu_pcibus_by_bus_num
));
933 g_hash_table_remove_all(s
->configs
);
934 g_hash_table_remove_all(s
->iotlb
);
937 static Property smmu_dev_properties
[] = {
938 DEFINE_PROP_UINT8("bus_num", SMMUState
, bus_num
, 0),
939 DEFINE_PROP_LINK("primary-bus", SMMUState
, primary_bus
,
940 TYPE_PCI_BUS
, PCIBus
*),
941 DEFINE_PROP_END_OF_LIST(),
944 static void smmu_base_class_init(ObjectClass
*klass
, void *data
)
946 DeviceClass
*dc
= DEVICE_CLASS(klass
);
947 ResettableClass
*rc
= RESETTABLE_CLASS(klass
);
948 SMMUBaseClass
*sbc
= ARM_SMMU_CLASS(klass
);
950 device_class_set_props(dc
, smmu_dev_properties
);
951 device_class_set_parent_realize(dc
, smmu_base_realize
,
952 &sbc
->parent_realize
);
953 rc
->phases
.hold
= smmu_base_reset_hold
;
956 static const TypeInfo smmu_base_info
= {
957 .name
= TYPE_ARM_SMMU
,
958 .parent
= TYPE_SYS_BUS_DEVICE
,
959 .instance_size
= sizeof(SMMUState
),
961 .class_size
= sizeof(SMMUBaseClass
),
962 .class_init
= smmu_base_class_init
,
966 static void smmu_base_register_types(void)
968 type_register_static(&smmu_base_info
);
971 type_init(smmu_base_register_types
)