1 /*
2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * Author: Prem Mallappa <pmallapp@broadcom.com>
16 *
17 */
18
19 #include "qemu/osdep.h"
20 #include "trace.h"
21 #include "exec/target_page.h"
22 #include "hw/core/cpu.h"
23 #include "hw/qdev-properties.h"
24 #include "qapi/error.h"
25 #include "qemu/jhash.h"
26 #include "qemu/module.h"
27
28 #include "qemu/error-report.h"
29 #include "hw/arm/smmu-common.h"
30 #include "smmu-internal.h"
31
32 /* IOTLB Management */
33
smmu_iotlb_key_hash(gconstpointer v)34 static guint smmu_iotlb_key_hash(gconstpointer v)
35 {
36 SMMUIOTLBKey *key = (SMMUIOTLBKey *)v;
37 uint32_t a, b, c;
38
39 /* Jenkins hash */
40 a = b = c = JHASH_INITVAL + sizeof(*key);
41 a += key->asid + key->vmid + key->level + key->tg;
42 b += extract64(key->iova, 0, 32);
43 c += extract64(key->iova, 32, 32);
44
45 __jhash_mix(a, b, c);
46 __jhash_final(a, b, c);
47
48 return c;
49 }
50
smmu_iotlb_key_equal(gconstpointer v1,gconstpointer v2)51 static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
52 {
53 SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
54
55 return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
56 (k1->level == k2->level) && (k1->tg == k2->tg) &&
57 (k1->vmid == k2->vmid);
58 }
59
smmu_get_iotlb_key(uint16_t asid,uint16_t vmid,uint64_t iova,uint8_t tg,uint8_t level)60 SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
61 uint8_t tg, uint8_t level)
62 {
63 SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
64 .tg = tg, .level = level};
65
66 return key;
67 }
68
smmu_iotlb_lookup(SMMUState * bs,SMMUTransCfg * cfg,SMMUTransTableInfo * tt,hwaddr iova)69 SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
70 SMMUTransTableInfo *tt, hwaddr iova)
71 {
72 uint8_t tg = (tt->granule_sz - 10) / 2;
73 uint8_t inputsize = 64 - tt->tsz;
74 uint8_t stride = tt->granule_sz - 3;
75 uint8_t level = 4 - (inputsize - 4) / stride;
76 SMMUTLBEntry *entry = NULL;
77
78 while (level <= 3) {
79 uint64_t subpage_size = 1ULL << level_shift(level, tt->granule_sz);
80 uint64_t mask = subpage_size - 1;
81 SMMUIOTLBKey key;
82
83 key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
84 iova & ~mask, tg, level);
85 entry = g_hash_table_lookup(bs->iotlb, &key);
86 if (entry) {
87 break;
88 }
89 level++;
90 }
91
92 if (entry) {
93 cfg->iotlb_hits++;
94 trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
95 cfg->iotlb_hits, cfg->iotlb_misses,
96 100 * cfg->iotlb_hits /
97 (cfg->iotlb_hits + cfg->iotlb_misses));
98 } else {
99 cfg->iotlb_misses++;
100 trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
101 cfg->iotlb_hits, cfg->iotlb_misses,
102 100 * cfg->iotlb_hits /
103 (cfg->iotlb_hits + cfg->iotlb_misses));
104 }
105 return entry;
106 }
107
smmu_iotlb_insert(SMMUState * bs,SMMUTransCfg * cfg,SMMUTLBEntry * new)108 void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
109 {
110 SMMUIOTLBKey *key = g_new0(SMMUIOTLBKey, 1);
111 uint8_t tg = (new->granule - 10) / 2;
112
113 if (g_hash_table_size(bs->iotlb) >= SMMU_IOTLB_MAX_SIZE) {
114 smmu_iotlb_inv_all(bs);
115 }
116
117 *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
118 tg, new->level);
119 trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
120 tg, new->level);
121 g_hash_table_insert(bs->iotlb, key, new);
122 }
123
smmu_iotlb_inv_all(SMMUState * s)124 void smmu_iotlb_inv_all(SMMUState *s)
125 {
126 trace_smmu_iotlb_inv_all();
127 g_hash_table_remove_all(s->iotlb);
128 }
129
smmu_hash_remove_by_asid(gpointer key,gpointer value,gpointer user_data)130 static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
131 gpointer user_data)
132 {
133 uint16_t asid = *(uint16_t *)user_data;
134 SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
135
136 return SMMU_IOTLB_ASID(*iotlb_key) == asid;
137 }
138
smmu_hash_remove_by_vmid(gpointer key,gpointer value,gpointer user_data)139 static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
140 gpointer user_data)
141 {
142 uint16_t vmid = *(uint16_t *)user_data;
143 SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
144
145 return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
146 }
147
smmu_hash_remove_by_asid_vmid_iova(gpointer key,gpointer value,gpointer user_data)148 static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
149 gpointer user_data)
150 {
151 SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
152 IOMMUTLBEntry *entry = &iter->entry;
153 SMMUIOTLBPageInvInfo *info = (SMMUIOTLBPageInvInfo *)user_data;
154 SMMUIOTLBKey iotlb_key = *(SMMUIOTLBKey *)key;
155
156 if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
157 return false;
158 }
159 if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
160 return false;
161 }
162 return ((info->iova & ~entry->addr_mask) == entry->iova) ||
163 ((entry->iova & ~info->mask) == info->iova);
164 }
165
smmu_iotlb_inv_iova(SMMUState * s,int asid,int vmid,dma_addr_t iova,uint8_t tg,uint64_t num_pages,uint8_t ttl)166 void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
167 uint8_t tg, uint64_t num_pages, uint8_t ttl)
168 {
169 /* if tg is not set we use 4KB range invalidation */
170 uint8_t granule = tg ? tg * 2 + 10 : 12;
171
172 if (ttl && (num_pages == 1) && (asid >= 0)) {
173 SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
174
175 if (g_hash_table_remove(s->iotlb, &key)) {
176 return;
177 }
178 /*
179 * if the entry is not found, let's see if it does not
180 * belong to a larger IOTLB entry
181 */
182 }
183
184 SMMUIOTLBPageInvInfo info = {
185 .asid = asid, .iova = iova,
186 .vmid = vmid,
187 .mask = (num_pages * 1 << granule) - 1};
188
189 g_hash_table_foreach_remove(s->iotlb,
190 smmu_hash_remove_by_asid_vmid_iova,
191 &info);
192 }
193
smmu_iotlb_inv_asid(SMMUState * s,uint16_t asid)194 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
195 {
196 trace_smmu_iotlb_inv_asid(asid);
197 g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
198 }
199
smmu_iotlb_inv_vmid(SMMUState * s,uint16_t vmid)200 void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
201 {
202 trace_smmu_iotlb_inv_vmid(vmid);
203 g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
204 }
205
206 /* VMSAv8-64 Translation */
207
208 /**
209 * get_pte - Get the content of a page table entry located at
210 * @base_addr[@index]
211 */
get_pte(dma_addr_t baseaddr,uint32_t index,uint64_t * pte,SMMUPTWEventInfo * info)212 static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
213 SMMUPTWEventInfo *info)
214 {
215 int ret;
216 dma_addr_t addr = baseaddr + index * sizeof(*pte);
217
218 /* TODO: guarantee 64-bit single-copy atomicity */
219 ret = ldq_le_dma(&address_space_memory, addr, pte, MEMTXATTRS_UNSPECIFIED);
220
221 if (ret != MEMTX_OK) {
222 info->type = SMMU_PTW_ERR_WALK_EABT;
223 info->addr = addr;
224 return -EINVAL;
225 }
226 trace_smmu_get_pte(baseaddr, index, addr, *pte);
227 return 0;
228 }
229
230 /* VMSAv8-64 Translation Table Format Descriptor Decoding */
231
232 /**
233 * get_page_pte_address - returns the L3 descriptor output address,
234 * ie. the page frame
235 * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
236 */
get_page_pte_address(uint64_t pte,int granule_sz)237 static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
238 {
239 return PTE_ADDRESS(pte, granule_sz);
240 }
241
242 /**
243 * get_table_pte_address - return table descriptor output address,
244 * ie. address of next level table
245 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
246 */
get_table_pte_address(uint64_t pte,int granule_sz)247 static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
248 {
249 return PTE_ADDRESS(pte, granule_sz);
250 }
251
252 /**
253 * get_block_pte_address - return block descriptor output address and block size
254 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
255 */
get_block_pte_address(uint64_t pte,int level,int granule_sz,uint64_t * bsz)256 static inline hwaddr get_block_pte_address(uint64_t pte, int level,
257 int granule_sz, uint64_t *bsz)
258 {
259 int n = level_shift(level, granule_sz);
260
261 *bsz = 1ULL << n;
262 return PTE_ADDRESS(pte, n);
263 }
264
select_tt(SMMUTransCfg * cfg,dma_addr_t iova)265 SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
266 {
267 bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
268 uint8_t tbi_byte = tbi * 8;
269
270 if (cfg->tt[0].tsz &&
271 !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
272 /* there is a ttbr0 region and we are in it (high bits all zero) */
273 return &cfg->tt[0];
274 } else if (cfg->tt[1].tsz &&
275 sextract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte) == -1) {
276 /* there is a ttbr1 region and we are in it (high bits all one) */
277 return &cfg->tt[1];
278 } else if (!cfg->tt[0].tsz) {
279 /* ttbr0 region is "everything not in the ttbr1 region" */
280 return &cfg->tt[0];
281 } else if (!cfg->tt[1].tsz) {
282 /* ttbr1 region is "everything not in the ttbr0 region" */
283 return &cfg->tt[1];
284 }
285 /* in the gap between the two regions, this is a Translation fault */
286 return NULL;
287 }
288
289 /**
290 * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
291 * @cfg: translation config
292 * @iova: iova to translate
293 * @perm: access type
294 * @tlbe: SMMUTLBEntry (out)
295 * @info: handle to an error info
296 *
297 * Return 0 on success, < 0 on error. In case of error, @info is filled
298 * and tlbe->perm is set to IOMMU_NONE.
299 * Upon success, @tlbe is filled with translated_addr and entry
300 * permission rights.
301 */
smmu_ptw_64_s1(SMMUTransCfg * cfg,dma_addr_t iova,IOMMUAccessFlags perm,SMMUTLBEntry * tlbe,SMMUPTWEventInfo * info)302 static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
303 dma_addr_t iova, IOMMUAccessFlags perm,
304 SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
305 {
306 dma_addr_t baseaddr, indexmask;
307 int stage = cfg->stage;
308 SMMUTransTableInfo *tt = select_tt(cfg, iova);
309 uint8_t level, granule_sz, inputsize, stride;
310
311 if (!tt || tt->disabled) {
312 info->type = SMMU_PTW_ERR_TRANSLATION;
313 goto error;
314 }
315
316 granule_sz = tt->granule_sz;
317 stride = VMSA_STRIDE(granule_sz);
318 inputsize = 64 - tt->tsz;
319 level = 4 - (inputsize - 4) / stride;
320 indexmask = VMSA_IDXMSK(inputsize, stride, level);
321 baseaddr = extract64(tt->ttb, 0, 48);
322 baseaddr &= ~indexmask;
323
324 while (level < VMSA_LEVELS) {
325 uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
326 uint64_t mask = subpage_size - 1;
327 uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
328 uint64_t pte, gpa;
329 dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
330 uint8_t ap;
331
332 if (get_pte(baseaddr, offset, &pte, info)) {
333 goto error;
334 }
335 trace_smmu_ptw_level(stage, level, iova, subpage_size,
336 baseaddr, offset, pte);
337
338 if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
339 trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
340 pte_addr, offset, pte);
341 break;
342 }
343
344 if (is_table_pte(pte, level)) {
345 ap = PTE_APTABLE(pte);
346
347 if (is_permission_fault(ap, perm) && !tt->had) {
348 info->type = SMMU_PTW_ERR_PERMISSION;
349 goto error;
350 }
351 baseaddr = get_table_pte_address(pte, granule_sz);
352 level++;
353 continue;
354 } else if (is_page_pte(pte, level)) {
355 gpa = get_page_pte_address(pte, granule_sz);
356 trace_smmu_ptw_page_pte(stage, level, iova,
357 baseaddr, pte_addr, pte, gpa);
358 } else {
359 uint64_t block_size;
360
361 gpa = get_block_pte_address(pte, level, granule_sz,
362 &block_size);
363 trace_smmu_ptw_block_pte(stage, level, baseaddr,
364 pte_addr, pte, iova, gpa,
365 block_size >> 20);
366 }
367
368 /*
369 * QEMU does not currently implement HTTU, so if AFFD and PTE.AF
370 * are 0 we take an Access flag fault. (5.4. Context Descriptor)
371 * An Access flag fault takes priority over a Permission fault.
372 */
373 if (!PTE_AF(pte) && !cfg->affd) {
374 info->type = SMMU_PTW_ERR_ACCESS;
375 goto error;
376 }
377
378 ap = PTE_AP(pte);
379 if (is_permission_fault(ap, perm)) {
380 info->type = SMMU_PTW_ERR_PERMISSION;
381 goto error;
382 }
383
384 tlbe->entry.translated_addr = gpa;
385 tlbe->entry.iova = iova & ~mask;
386 tlbe->entry.addr_mask = mask;
387 tlbe->entry.perm = PTE_AP_TO_PERM(ap);
388 tlbe->level = level;
389 tlbe->granule = granule_sz;
390 return 0;
391 }
392 info->type = SMMU_PTW_ERR_TRANSLATION;
393
394 error:
395 info->stage = 1;
396 tlbe->entry.perm = IOMMU_NONE;
397 return -EINVAL;
398 }
399
400 /**
401 * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
402 * for stage-2.
403 * @cfg: translation config
404 * @ipa: ipa to translate
405 * @perm: access type
406 * @tlbe: SMMUTLBEntry (out)
407 * @info: handle to an error info
408 *
409 * Return 0 on success, < 0 on error. In case of error, @info is filled
410 * and tlbe->perm is set to IOMMU_NONE.
411 * Upon success, @tlbe is filled with translated_addr and entry
412 * permission rights.
413 */
smmu_ptw_64_s2(SMMUTransCfg * cfg,dma_addr_t ipa,IOMMUAccessFlags perm,SMMUTLBEntry * tlbe,SMMUPTWEventInfo * info)414 static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
415 dma_addr_t ipa, IOMMUAccessFlags perm,
416 SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
417 {
418 const int stage = 2;
419 int granule_sz = cfg->s2cfg.granule_sz;
420 /* ARM DDI0487I.a: Table D8-7. */
421 int inputsize = 64 - cfg->s2cfg.tsz;
422 int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
423 int stride = VMSA_STRIDE(granule_sz);
424 int idx = pgd_concat_idx(level, granule_sz, ipa);
425 /*
426 * Get the ttb from concatenated structure.
427 * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
428 */
429 uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
430 idx * sizeof(uint64_t);
431 dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
432
433 baseaddr &= ~indexmask;
434
435 /*
436 * On input, a stage 2 Translation fault occurs if the IPA is outside the
437 * range configured by the relevant S2T0SZ field of the STE.
438 */
439 if (ipa >= (1ULL << inputsize)) {
440 info->type = SMMU_PTW_ERR_TRANSLATION;
441 goto error;
442 }
443
444 while (level < VMSA_LEVELS) {
445 uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
446 uint64_t mask = subpage_size - 1;
447 uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
448 uint64_t pte, gpa;
449 dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
450 uint8_t s2ap;
451
452 if (get_pte(baseaddr, offset, &pte, info)) {
453 goto error;
454 }
455 trace_smmu_ptw_level(stage, level, ipa, subpage_size,
456 baseaddr, offset, pte);
457 if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
458 trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
459 pte_addr, offset, pte);
460 break;
461 }
462
463 if (is_table_pte(pte, level)) {
464 baseaddr = get_table_pte_address(pte, granule_sz);
465 level++;
466 continue;
467 } else if (is_page_pte(pte, level)) {
468 gpa = get_page_pte_address(pte, granule_sz);
469 trace_smmu_ptw_page_pte(stage, level, ipa,
470 baseaddr, pte_addr, pte, gpa);
471 } else {
472 uint64_t block_size;
473
474 gpa = get_block_pte_address(pte, level, granule_sz,
475 &block_size);
476 trace_smmu_ptw_block_pte(stage, level, baseaddr,
477 pte_addr, pte, ipa, gpa,
478 block_size >> 20);
479 }
480
481 /*
482 * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
483 * An Access fault takes priority over a Permission fault.
484 */
485 if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
486 info->type = SMMU_PTW_ERR_ACCESS;
487 goto error;
488 }
489
490 s2ap = PTE_AP(pte);
491 if (is_permission_fault_s2(s2ap, perm)) {
492 info->type = SMMU_PTW_ERR_PERMISSION;
493 goto error;
494 }
495
496 /*
497 * The address output from the translation causes a stage 2 Address
498 * Size fault if it exceeds the effective PA output range.
499 */
500 if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
501 info->type = SMMU_PTW_ERR_ADDR_SIZE;
502 goto error;
503 }
504
505 tlbe->entry.translated_addr = gpa;
506 tlbe->entry.iova = ipa & ~mask;
507 tlbe->entry.addr_mask = mask;
508 tlbe->entry.perm = s2ap;
509 tlbe->level = level;
510 tlbe->granule = granule_sz;
511 return 0;
512 }
513 info->type = SMMU_PTW_ERR_TRANSLATION;
514
515 error:
516 info->stage = 2;
517 tlbe->entry.perm = IOMMU_NONE;
518 return -EINVAL;
519 }
520
521 /**
522 * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
523 *
524 * @cfg: translation configuration
525 * @iova: iova to translate
526 * @perm: tentative access type
527 * @tlbe: returned entry
528 * @info: ptw event handle
529 *
530 * return 0 on success
531 */
smmu_ptw(SMMUTransCfg * cfg,dma_addr_t iova,IOMMUAccessFlags perm,SMMUTLBEntry * tlbe,SMMUPTWEventInfo * info)532 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
533 SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
534 {
535 if (cfg->stage == 1) {
536 return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
537 } else if (cfg->stage == 2) {
538 /*
539 * If bypassing stage 1(or unimplemented), the input address is passed
540 * directly to stage 2 as IPA. If the input address of a transaction
541 * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
542 * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
543 */
544 if (iova >= (1ULL << cfg->oas)) {
545 info->type = SMMU_PTW_ERR_ADDR_SIZE;
546 info->stage = 1;
547 tlbe->entry.perm = IOMMU_NONE;
548 return -EINVAL;
549 }
550
551 return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
552 }
553
554 g_assert_not_reached();
555 }
556
557 /**
558 * The bus number is used for lookup when SID based invalidation occurs.
559 * In that case we lazily populate the SMMUPciBus array from the bus hash
560 * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
561 * numbers may not be always initialized yet.
562 */
smmu_find_smmu_pcibus(SMMUState * s,uint8_t bus_num)563 SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
564 {
565 SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
566 GHashTableIter iter;
567
568 if (smmu_pci_bus) {
569 return smmu_pci_bus;
570 }
571
572 g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
573 while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
574 if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
575 s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
576 return smmu_pci_bus;
577 }
578 }
579
580 return NULL;
581 }
582
smmu_find_add_as(PCIBus * bus,void * opaque,int devfn)583 static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
584 {
585 SMMUState *s = opaque;
586 SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
587 SMMUDevice *sdev;
588 static unsigned int index;
589
590 if (!sbus) {
591 sbus = g_malloc0(sizeof(SMMUPciBus) +
592 sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
593 sbus->bus = bus;
594 g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
595 }
596
597 sdev = sbus->pbdev[devfn];
598 if (!sdev) {
599 char *name = g_strdup_printf("%s-%d-%d", s->mrtypename, devfn, index++);
600
601 sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
602
603 sdev->smmu = s;
604 sdev->bus = bus;
605 sdev->devfn = devfn;
606
607 memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
608 s->mrtypename,
609 OBJECT(s), name, UINT64_MAX);
610 address_space_init(&sdev->as,
611 MEMORY_REGION(&sdev->iommu), name);
612 trace_smmu_add_mr(name);
613 g_free(name);
614 }
615
616 return &sdev->as;
617 }
618
619 static const PCIIOMMUOps smmu_ops = {
620 .get_address_space = smmu_find_add_as,
621 };
622
smmu_iommu_mr(SMMUState * s,uint32_t sid)623 IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid)
624 {
625 uint8_t bus_n, devfn;
626 SMMUPciBus *smmu_bus;
627 SMMUDevice *smmu;
628
629 bus_n = PCI_BUS_NUM(sid);
630 smmu_bus = smmu_find_smmu_pcibus(s, bus_n);
631 if (smmu_bus) {
632 devfn = SMMU_PCI_DEVFN(sid);
633 smmu = smmu_bus->pbdev[devfn];
634 if (smmu) {
635 return &smmu->iommu;
636 }
637 }
638 return NULL;
639 }
640
641 /* Unmap all notifiers attached to @mr */
smmu_inv_notifiers_mr(IOMMUMemoryRegion * mr)642 static void smmu_inv_notifiers_mr(IOMMUMemoryRegion *mr)
643 {
644 IOMMUNotifier *n;
645
646 trace_smmu_inv_notifiers_mr(mr->parent_obj.name);
647 IOMMU_NOTIFIER_FOREACH(n, mr) {
648 memory_region_unmap_iommu_notifier_range(n);
649 }
650 }
651
652 /* Unmap all notifiers of all mr's */
smmu_inv_notifiers_all(SMMUState * s)653 void smmu_inv_notifiers_all(SMMUState *s)
654 {
655 SMMUDevice *sdev;
656
657 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
658 smmu_inv_notifiers_mr(&sdev->iommu);
659 }
660 }
661
smmu_base_realize(DeviceState * dev,Error ** errp)662 static void smmu_base_realize(DeviceState *dev, Error **errp)
663 {
664 SMMUState *s = ARM_SMMU(dev);
665 SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
666 Error *local_err = NULL;
667
668 sbc->parent_realize(dev, &local_err);
669 if (local_err) {
670 error_propagate(errp, local_err);
671 return;
672 }
673 s->configs = g_hash_table_new_full(NULL, NULL, NULL, g_free);
674 s->iotlb = g_hash_table_new_full(smmu_iotlb_key_hash, smmu_iotlb_key_equal,
675 g_free, g_free);
676 s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
677
678 if (s->primary_bus) {
679 pci_setup_iommu(s->primary_bus, &smmu_ops, s);
680 } else {
681 error_setg(errp, "SMMU is not attached to any PCI bus!");
682 }
683 }
684
smmu_base_reset_hold(Object * obj,ResetType type)685 static void smmu_base_reset_hold(Object *obj, ResetType type)
686 {
687 SMMUState *s = ARM_SMMU(obj);
688
689 memset(s->smmu_pcibus_by_bus_num, 0, sizeof(s->smmu_pcibus_by_bus_num));
690
691 g_hash_table_remove_all(s->configs);
692 g_hash_table_remove_all(s->iotlb);
693 }
694
695 static Property smmu_dev_properties[] = {
696 DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
697 DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus,
698 TYPE_PCI_BUS, PCIBus *),
699 DEFINE_PROP_END_OF_LIST(),
700 };
701
smmu_base_class_init(ObjectClass * klass,void * data)702 static void smmu_base_class_init(ObjectClass *klass, void *data)
703 {
704 DeviceClass *dc = DEVICE_CLASS(klass);
705 ResettableClass *rc = RESETTABLE_CLASS(klass);
706 SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass);
707
708 device_class_set_props(dc, smmu_dev_properties);
709 device_class_set_parent_realize(dc, smmu_base_realize,
710 &sbc->parent_realize);
711 rc->phases.hold = smmu_base_reset_hold;
712 }
713
714 static const TypeInfo smmu_base_info = {
715 .name = TYPE_ARM_SMMU,
716 .parent = TYPE_SYS_BUS_DEVICE,
717 .instance_size = sizeof(SMMUState),
718 .class_data = NULL,
719 .class_size = sizeof(SMMUBaseClass),
720 .class_init = smmu_base_class_init,
721 .abstract = true,
722 };
723
smmu_base_register_types(void)724 static void smmu_base_register_types(void)
725 {
726 type_register_static(&smmu_base_info);
727 }
728
729 type_init(smmu_base_register_types)
730
731