2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * Author: Prem Mallappa <pmallapp@broadcom.com>
19 #include "qemu/osdep.h"
20 #include "exec/address-spaces.h"
22 #include "exec/target_page.h"
23 #include "hw/core/cpu.h"
24 #include "hw/qdev-properties.h"
25 #include "qapi/error.h"
26 #include "qemu/jhash.h"
27 #include "qemu/module.h"
29 #include "qemu/error-report.h"
30 #include "hw/arm/smmu-common.h"
31 #include "smmu-internal.h"
33 /* IOTLB Management */
35 inline void smmu_iotlb_inv_all(SMMUState
*s
)
37 trace_smmu_iotlb_inv_all();
38 g_hash_table_remove_all(s
->iotlb
);
41 static gboolean
smmu_hash_remove_by_asid(gpointer key
, gpointer value
,
44 uint16_t asid
= *(uint16_t *)user_data
;
45 SMMUIOTLBKey
*iotlb_key
= (SMMUIOTLBKey
*)key
;
47 return iotlb_key
->asid
== asid
;
50 inline void smmu_iotlb_inv_iova(SMMUState
*s
, uint16_t asid
, dma_addr_t iova
)
52 SMMUIOTLBKey key
= {.asid
= asid
, .iova
= iova
};
54 trace_smmu_iotlb_inv_iova(asid
, iova
);
55 g_hash_table_remove(s
->iotlb
, &key
);
58 inline void smmu_iotlb_inv_asid(SMMUState
*s
, uint16_t asid
)
60 trace_smmu_iotlb_inv_asid(asid
);
61 g_hash_table_foreach_remove(s
->iotlb
, smmu_hash_remove_by_asid
, &asid
);
64 /* VMSAv8-64 Translation */
67 * get_pte - Get the content of a page table entry located at
70 static int get_pte(dma_addr_t baseaddr
, uint32_t index
, uint64_t *pte
,
71 SMMUPTWEventInfo
*info
)
74 dma_addr_t addr
= baseaddr
+ index
* sizeof(*pte
);
76 /* TODO: guarantee 64-bit single-copy atomicity */
77 ret
= dma_memory_read(&address_space_memory
, addr
,
78 (uint8_t *)pte
, sizeof(*pte
));
80 if (ret
!= MEMTX_OK
) {
81 info
->type
= SMMU_PTW_ERR_WALK_EABT
;
85 trace_smmu_get_pte(baseaddr
, index
, addr
, *pte
);
89 /* VMSAv8-64 Translation Table Format Descriptor Decoding */
92 * get_page_pte_address - returns the L3 descriptor output address,
94 * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
96 static inline hwaddr
get_page_pte_address(uint64_t pte
, int granule_sz
)
98 return PTE_ADDRESS(pte
, granule_sz
);
102 * get_table_pte_address - return table descriptor output address,
103 * ie. address of next level table
104 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
106 static inline hwaddr
get_table_pte_address(uint64_t pte
, int granule_sz
)
108 return PTE_ADDRESS(pte
, granule_sz
);
112 * get_block_pte_address - return block descriptor output address and block size
113 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
115 static inline hwaddr
get_block_pte_address(uint64_t pte
, int level
,
116 int granule_sz
, uint64_t *bsz
)
118 int n
= level_shift(level
, granule_sz
);
121 return PTE_ADDRESS(pte
, n
);
124 SMMUTransTableInfo
*select_tt(SMMUTransCfg
*cfg
, dma_addr_t iova
)
126 bool tbi
= extract64(iova
, 55, 1) ? TBI1(cfg
->tbi
) : TBI0(cfg
->tbi
);
127 uint8_t tbi_byte
= tbi
* 8;
129 if (cfg
->tt
[0].tsz
&&
130 !extract64(iova
, 64 - cfg
->tt
[0].tsz
, cfg
->tt
[0].tsz
- tbi_byte
)) {
131 /* there is a ttbr0 region and we are in it (high bits all zero) */
133 } else if (cfg
->tt
[1].tsz
&&
134 !extract64(iova
, 64 - cfg
->tt
[1].tsz
, cfg
->tt
[1].tsz
- tbi_byte
)) {
135 /* there is a ttbr1 region and we are in it (high bits all one) */
137 } else if (!cfg
->tt
[0].tsz
) {
138 /* ttbr0 region is "everything not in the ttbr1 region" */
140 } else if (!cfg
->tt
[1].tsz
) {
141 /* ttbr1 region is "everything not in the ttbr0 region" */
144 /* in the gap between the two regions, this is a Translation fault */
149 * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
150 * @cfg: translation config
151 * @iova: iova to translate
153 * @tlbe: IOMMUTLBEntry (out)
154 * @info: handle to an error info
156 * Return 0 on success, < 0 on error. In case of error, @info is filled
157 * and tlbe->perm is set to IOMMU_NONE.
158 * Upon success, @tlbe is filled with translated_addr and entry
161 static int smmu_ptw_64(SMMUTransCfg
*cfg
,
162 dma_addr_t iova
, IOMMUAccessFlags perm
,
163 IOMMUTLBEntry
*tlbe
, SMMUPTWEventInfo
*info
)
165 dma_addr_t baseaddr
, indexmask
;
166 int stage
= cfg
->stage
;
167 SMMUTransTableInfo
*tt
= select_tt(cfg
, iova
);
168 uint8_t level
, granule_sz
, inputsize
, stride
;
170 if (!tt
|| tt
->disabled
) {
171 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
175 granule_sz
= tt
->granule_sz
;
176 stride
= granule_sz
- 3;
177 inputsize
= 64 - tt
->tsz
;
178 level
= 4 - (inputsize
- 4) / stride
;
179 indexmask
= (1ULL << (inputsize
- (stride
* (4 - level
)))) - 1;
180 baseaddr
= extract64(tt
->ttb
, 0, 48);
181 baseaddr
&= ~indexmask
;
184 tlbe
->addr_mask
= (1 << granule_sz
) - 1;
187 uint64_t subpage_size
= 1ULL << level_shift(level
, granule_sz
);
188 uint64_t mask
= subpage_size
- 1;
189 uint32_t offset
= iova_level_offset(iova
, inputsize
, level
, granule_sz
);
191 dma_addr_t pte_addr
= baseaddr
+ offset
* sizeof(pte
);
194 if (get_pte(baseaddr
, offset
, &pte
, info
)) {
197 trace_smmu_ptw_level(level
, iova
, subpage_size
,
198 baseaddr
, offset
, pte
);
200 if (is_invalid_pte(pte
) || is_reserved_pte(pte
, level
)) {
201 trace_smmu_ptw_invalid_pte(stage
, level
, baseaddr
,
202 pte_addr
, offset
, pte
);
203 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
207 if (is_page_pte(pte
, level
)) {
208 uint64_t gpa
= get_page_pte_address(pte
, granule_sz
);
211 if (is_permission_fault(ap
, perm
)) {
212 info
->type
= SMMU_PTW_ERR_PERMISSION
;
216 tlbe
->translated_addr
= gpa
+ (iova
& mask
);
217 tlbe
->perm
= PTE_AP_TO_PERM(ap
);
218 trace_smmu_ptw_page_pte(stage
, level
, iova
,
219 baseaddr
, pte_addr
, pte
, gpa
);
222 if (is_block_pte(pte
, level
)) {
224 hwaddr gpa
= get_block_pte_address(pte
, level
, granule_sz
,
228 if (is_permission_fault(ap
, perm
)) {
229 info
->type
= SMMU_PTW_ERR_PERMISSION
;
233 trace_smmu_ptw_block_pte(stage
, level
, baseaddr
,
234 pte_addr
, pte
, iova
, gpa
,
237 tlbe
->translated_addr
= gpa
+ (iova
& mask
);
238 tlbe
->perm
= PTE_AP_TO_PERM(ap
);
243 ap
= PTE_APTABLE(pte
);
245 if (is_permission_fault(ap
, perm
)) {
246 info
->type
= SMMU_PTW_ERR_PERMISSION
;
249 baseaddr
= get_table_pte_address(pte
, granule_sz
);
253 info
->type
= SMMU_PTW_ERR_TRANSLATION
;
256 tlbe
->perm
= IOMMU_NONE
;
261 * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
263 * @cfg: translation configuration
264 * @iova: iova to translate
265 * @perm: tentative access type
266 * @tlbe: returned entry
267 * @info: ptw event handle
269 * return 0 on success
271 inline int smmu_ptw(SMMUTransCfg
*cfg
, dma_addr_t iova
, IOMMUAccessFlags perm
,
272 IOMMUTLBEntry
*tlbe
, SMMUPTWEventInfo
*info
)
276 * This code path is not entered as we check this while decoding
277 * the configuration data in the derived SMMU model.
279 g_assert_not_reached();
282 return smmu_ptw_64(cfg
, iova
, perm
, tlbe
, info
);
286 * The bus number is used for lookup when SID based invalidation occurs.
287 * In that case we lazily populate the SMMUPciBus array from the bus hash
288 * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
289 * numbers may not be always initialized yet.
291 SMMUPciBus
*smmu_find_smmu_pcibus(SMMUState
*s
, uint8_t bus_num
)
293 SMMUPciBus
*smmu_pci_bus
= s
->smmu_pcibus_by_bus_num
[bus_num
];
298 g_hash_table_iter_init(&iter
, s
->smmu_pcibus_by_busptr
);
299 while (g_hash_table_iter_next(&iter
, NULL
, (void **)&smmu_pci_bus
)) {
300 if (pci_bus_num(smmu_pci_bus
->bus
) == bus_num
) {
301 s
->smmu_pcibus_by_bus_num
[bus_num
] = smmu_pci_bus
;
309 static AddressSpace
*smmu_find_add_as(PCIBus
*bus
, void *opaque
, int devfn
)
311 SMMUState
*s
= opaque
;
312 SMMUPciBus
*sbus
= g_hash_table_lookup(s
->smmu_pcibus_by_busptr
, bus
);
314 static unsigned int index
;
317 sbus
= g_malloc0(sizeof(SMMUPciBus
) +
318 sizeof(SMMUDevice
*) * SMMU_PCI_DEVFN_MAX
);
320 g_hash_table_insert(s
->smmu_pcibus_by_busptr
, bus
, sbus
);
323 sdev
= sbus
->pbdev
[devfn
];
325 char *name
= g_strdup_printf("%s-%d-%d", s
->mrtypename
, devfn
, index
++);
327 sdev
= sbus
->pbdev
[devfn
] = g_new0(SMMUDevice
, 1);
333 memory_region_init_iommu(&sdev
->iommu
, sizeof(sdev
->iommu
),
335 OBJECT(s
), name
, 1ULL << SMMU_MAX_VA_BITS
);
336 address_space_init(&sdev
->as
,
337 MEMORY_REGION(&sdev
->iommu
), name
);
338 trace_smmu_add_mr(name
);
345 IOMMUMemoryRegion
*smmu_iommu_mr(SMMUState
*s
, uint32_t sid
)
347 uint8_t bus_n
, devfn
;
348 SMMUPciBus
*smmu_bus
;
351 bus_n
= PCI_BUS_NUM(sid
);
352 smmu_bus
= smmu_find_smmu_pcibus(s
, bus_n
);
354 devfn
= SMMU_PCI_DEVFN(sid
);
355 smmu
= smmu_bus
->pbdev
[devfn
];
363 static guint
smmu_iotlb_key_hash(gconstpointer v
)
365 SMMUIOTLBKey
*key
= (SMMUIOTLBKey
*)v
;
369 a
= b
= c
= JHASH_INITVAL
+ sizeof(*key
);
371 b
+= extract64(key
->iova
, 0, 32);
372 c
+= extract64(key
->iova
, 32, 32);
374 __jhash_mix(a
, b
, c
);
375 __jhash_final(a
, b
, c
);
380 static gboolean
smmu_iotlb_key_equal(gconstpointer v1
, gconstpointer v2
)
382 const SMMUIOTLBKey
*k1
= v1
;
383 const SMMUIOTLBKey
*k2
= v2
;
385 return (k1
->asid
== k2
->asid
) && (k1
->iova
== k2
->iova
);
388 /* Unmap the whole notifier's range */
389 static void smmu_unmap_notifier_range(IOMMUNotifier
*n
)
393 entry
.target_as
= &address_space_memory
;
394 entry
.iova
= n
->start
;
395 entry
.perm
= IOMMU_NONE
;
396 entry
.addr_mask
= n
->end
- n
->start
;
398 memory_region_notify_one(n
, &entry
);
401 /* Unmap all notifiers attached to @mr */
402 inline void smmu_inv_notifiers_mr(IOMMUMemoryRegion
*mr
)
406 trace_smmu_inv_notifiers_mr(mr
->parent_obj
.name
);
407 IOMMU_NOTIFIER_FOREACH(n
, mr
) {
408 smmu_unmap_notifier_range(n
);
412 /* Unmap all notifiers of all mr's */
413 void smmu_inv_notifiers_all(SMMUState
*s
)
417 QLIST_FOREACH(sdev
, &s
->devices_with_notifiers
, next
) {
418 smmu_inv_notifiers_mr(&sdev
->iommu
);
422 static void smmu_base_realize(DeviceState
*dev
, Error
**errp
)
424 SMMUState
*s
= ARM_SMMU(dev
);
425 SMMUBaseClass
*sbc
= ARM_SMMU_GET_CLASS(dev
);
426 Error
*local_err
= NULL
;
428 sbc
->parent_realize(dev
, &local_err
);
430 error_propagate(errp
, local_err
);
433 s
->configs
= g_hash_table_new_full(NULL
, NULL
, NULL
, g_free
);
434 s
->iotlb
= g_hash_table_new_full(smmu_iotlb_key_hash
, smmu_iotlb_key_equal
,
436 s
->smmu_pcibus_by_busptr
= g_hash_table_new(NULL
, NULL
);
438 if (s
->primary_bus
) {
439 pci_setup_iommu(s
->primary_bus
, smmu_find_add_as
, s
);
441 error_setg(errp
, "SMMU is not attached to any PCI bus!");
445 static void smmu_base_reset(DeviceState
*dev
)
447 SMMUState
*s
= ARM_SMMU(dev
);
449 g_hash_table_remove_all(s
->configs
);
450 g_hash_table_remove_all(s
->iotlb
);
453 static Property smmu_dev_properties
[] = {
454 DEFINE_PROP_UINT8("bus_num", SMMUState
, bus_num
, 0),
455 DEFINE_PROP_LINK("primary-bus", SMMUState
, primary_bus
, "PCI", PCIBus
*),
456 DEFINE_PROP_END_OF_LIST(),
459 static void smmu_base_class_init(ObjectClass
*klass
, void *data
)
461 DeviceClass
*dc
= DEVICE_CLASS(klass
);
462 SMMUBaseClass
*sbc
= ARM_SMMU_CLASS(klass
);
464 device_class_set_props(dc
, smmu_dev_properties
);
465 device_class_set_parent_realize(dc
, smmu_base_realize
,
466 &sbc
->parent_realize
);
467 dc
->reset
= smmu_base_reset
;
470 static const TypeInfo smmu_base_info
= {
471 .name
= TYPE_ARM_SMMU
,
472 .parent
= TYPE_SYS_BUS_DEVICE
,
473 .instance_size
= sizeof(SMMUState
),
475 .class_size
= sizeof(SMMUBaseClass
),
476 .class_init
= smmu_base_class_init
,
480 static void smmu_base_register_types(void)
482 type_register_static(&smmu_base_info
);
485 type_init(smmu_base_register_types
)