| 1 | /* |
| 2 | * Copyright (C) 2014-2016 Broadcom Corporation |
| 3 | * Copyright (c) 2017 Red Hat, Inc. |
| 4 | * Written by Prem Mallappa, Eric Auger |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or modify |
| 7 | * it under the terms of the GNU General Public License version 2 as |
| 8 | * published by the Free Software Foundation. |
| 9 | * |
| 10 | * This program is distributed in the hope that it will be useful, |
| 11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 13 | * GNU General Public License for more details. |
| 14 | * |
| 15 | * Author: Prem Mallappa <pmallapp@broadcom.com> |
| 16 | * |
| 17 | */ |
| 18 | |
| 19 | #include "qemu/osdep.h" |
| 20 | #include "trace.h" |
| 21 | #include "exec/target_page.h" |
| 22 | #include "hw/core/cpu.h" |
| 23 | #include "hw/pci/pci_bridge.h" |
| 24 | #include "hw/core/qdev-properties.h" |
| 25 | #include "qapi/error.h" |
| 26 | #include "qemu/jhash.h" |
| 27 | #include "qemu/module.h" |
| 28 | |
| 29 | #include "qemu/error-report.h" |
| 30 | #include "hw/arm/smmu-common.h" |
| 31 | #include "smmu-internal.h" |
| 32 | |
| 33 | /* IOTLB Management */ |
| 34 | |
| 35 | static guint smmu_iotlb_key_hash(gconstpointer v) |
| 36 | { |
| 37 | SMMUIOTLBKey *key = (SMMUIOTLBKey *)v; |
| 38 | uint32_t a, b, c; |
| 39 | |
| 40 | /* Jenkins hash */ |
| 41 | a = b = c = JHASH_INITVAL + sizeof(*key); |
| 42 | a += key->asid + key->vmid + key->level + key->tg; |
| 43 | b += extract64(key->iova, 0, 32); |
| 44 | c += extract64(key->iova, 32, 32); |
| 45 | |
| 46 | __jhash_mix(a, b, c); |
| 47 | __jhash_final(a, b, c); |
| 48 | |
| 49 | return c; |
| 50 | } |
| 51 | |
| 52 | static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2) |
| 53 | { |
| 54 | SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2; |
| 55 | |
| 56 | return (k1->asid == k2->asid) && (k1->iova == k2->iova) && |
| 57 | (k1->level == k2->level) && (k1->tg == k2->tg) && |
| 58 | (k1->vmid == k2->vmid); |
| 59 | } |
| 60 | |
| 61 | SMMUIOTLBKey smmu_get_iotlb_key(int asid, int vmid, uint64_t iova, |
| 62 | uint8_t tg, uint8_t level) |
| 63 | { |
| 64 | SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova, |
| 65 | .tg = tg, .level = level}; |
| 66 | |
| 67 | return key; |
| 68 | } |
| 69 | |
| 70 | static SMMUTLBEntry *smmu_iotlb_lookup_all_levels(SMMUState *bs, |
| 71 | SMMUTransCfg *cfg, |
| 72 | SMMUTransTableInfo *tt, |
| 73 | hwaddr iova) |
| 74 | { |
| 75 | uint8_t tg = (tt->granule_sz - 10) / 2; |
| 76 | uint8_t inputsize = 64 - tt->tsz; |
| 77 | uint8_t stride = tt->granule_sz - 3; |
| 78 | uint8_t level = 4 - (inputsize - 4) / stride; |
| 79 | SMMUTLBEntry *entry = NULL; |
| 80 | |
| 81 | while (level <= 3) { |
| 82 | uint64_t subpage_size = 1ULL << level_shift(level, tt->granule_sz); |
| 83 | uint64_t mask = subpage_size - 1; |
| 84 | SMMUIOTLBKey key; |
| 85 | |
| 86 | key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, |
| 87 | iova & ~mask, tg, level); |
| 88 | entry = g_hash_table_lookup(bs->iotlb, &key); |
| 89 | if (entry) { |
| 90 | break; |
| 91 | } |
| 92 | level++; |
| 93 | } |
| 94 | return entry; |
| 95 | } |
| 96 | |
| 97 | /** |
| 98 | * smmu_iotlb_lookup - Look up for a TLB entry. |
| 99 | * @bs: SMMU state which includes the TLB instance |
| 100 | * @cfg: Configuration of the translation |
| 101 | * @tt: Translation table info (granule and tsz) |
| 102 | * @iova: IOVA address to lookup |
| 103 | * |
| 104 | * returns a valid entry on success, otherwise NULL. |
| 105 | * In case of nested translation, tt can be updated to include |
| 106 | * the granule of the found entry as it might different from |
| 107 | * the IOVA granule. |
| 108 | */ |
| 109 | SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg, |
| 110 | SMMUTransTableInfo *tt, hwaddr iova) |
| 111 | { |
| 112 | SMMUTLBEntry *entry = NULL; |
| 113 | |
| 114 | entry = smmu_iotlb_lookup_all_levels(bs, cfg, tt, iova); |
| 115 | /* |
| 116 | * For nested translation also try the s2 granule, as the TLB will insert |
| 117 | * it if the size of s2 tlb entry was smaller. |
| 118 | */ |
| 119 | if (!entry && (cfg->stage == SMMU_NESTED) && |
| 120 | (cfg->s2cfg.granule_sz != tt->granule_sz)) { |
| 121 | tt->granule_sz = cfg->s2cfg.granule_sz; |
| 122 | entry = smmu_iotlb_lookup_all_levels(bs, cfg, tt, iova); |
| 123 | } |
| 124 | |
| 125 | if (entry) { |
| 126 | cfg->iotlb_hits++; |
| 127 | trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova, |
| 128 | cfg->iotlb_hits, cfg->iotlb_misses, |
| 129 | 100 * cfg->iotlb_hits / |
| 130 | (cfg->iotlb_hits + cfg->iotlb_misses)); |
| 131 | } else { |
| 132 | cfg->iotlb_misses++; |
| 133 | trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova, |
| 134 | cfg->iotlb_hits, cfg->iotlb_misses, |
| 135 | 100 * cfg->iotlb_hits / |
| 136 | (cfg->iotlb_hits + cfg->iotlb_misses)); |
| 137 | } |
| 138 | return entry; |
| 139 | } |
| 140 | |
| 141 | void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new) |
| 142 | { |
| 143 | SMMUIOTLBKey *key = g_new0(SMMUIOTLBKey, 1); |
| 144 | uint8_t tg = (new->granule - 10) / 2; |
| 145 | |
| 146 | if (g_hash_table_size(bs->iotlb) >= SMMU_IOTLB_MAX_SIZE) { |
| 147 | smmu_iotlb_inv_all(bs); |
| 148 | } |
| 149 | |
| 150 | *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova, |
| 151 | tg, new->level); |
| 152 | trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova, |
| 153 | tg, new->level); |
| 154 | g_hash_table_insert(bs->iotlb, key, new); |
| 155 | } |
| 156 | |
| 157 | void smmu_iotlb_inv_all(SMMUState *s) |
| 158 | { |
| 159 | trace_smmu_iotlb_inv_all(); |
| 160 | g_hash_table_remove_all(s->iotlb); |
| 161 | } |
| 162 | |
| 163 | static gboolean smmu_hash_remove_by_asid_vmid(gpointer key, gpointer value, |
| 164 | gpointer user_data) |
| 165 | { |
| 166 | SMMUIOTLBPageInvInfo *info = (SMMUIOTLBPageInvInfo *)user_data; |
| 167 | SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key; |
| 168 | |
| 169 | return (SMMU_IOTLB_ASID(*iotlb_key) == info->asid) && |
| 170 | (SMMU_IOTLB_VMID(*iotlb_key) == info->vmid); |
| 171 | } |
| 172 | |
| 173 | static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value, |
| 174 | gpointer user_data) |
| 175 | { |
| 176 | int vmid = *(int *)user_data; |
| 177 | SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key; |
| 178 | |
| 179 | return SMMU_IOTLB_VMID(*iotlb_key) == vmid; |
| 180 | } |
| 181 | |
| 182 | static gboolean smmu_hash_remove_by_vmid_s1(gpointer key, gpointer value, |
| 183 | gpointer user_data) |
| 184 | { |
| 185 | int vmid = *(int *)user_data; |
| 186 | SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key; |
| 187 | |
| 188 | return (SMMU_IOTLB_VMID(*iotlb_key) == vmid) && |
| 189 | (SMMU_IOTLB_ASID(*iotlb_key) >= 0); |
| 190 | } |
| 191 | |
| 192 | static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value, |
| 193 | gpointer user_data) |
| 194 | { |
| 195 | SMMUTLBEntry *iter = (SMMUTLBEntry *)value; |
| 196 | IOMMUTLBEntry *entry = &iter->entry; |
| 197 | SMMUIOTLBPageInvInfo *info = (SMMUIOTLBPageInvInfo *)user_data; |
| 198 | SMMUIOTLBKey iotlb_key = *(SMMUIOTLBKey *)key; |
| 199 | |
| 200 | if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) { |
| 201 | return false; |
| 202 | } |
| 203 | if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) { |
| 204 | return false; |
| 205 | } |
| 206 | return ((info->iova & ~entry->addr_mask) == entry->iova) || |
| 207 | ((entry->iova & ~info->mask) == info->iova); |
| 208 | } |
| 209 | |
| 210 | static gboolean smmu_hash_remove_by_vmid_ipa(gpointer key, gpointer value, |
| 211 | gpointer user_data) |
| 212 | { |
| 213 | SMMUTLBEntry *iter = (SMMUTLBEntry *)value; |
| 214 | IOMMUTLBEntry *entry = &iter->entry; |
| 215 | SMMUIOTLBPageInvInfo *info = (SMMUIOTLBPageInvInfo *)user_data; |
| 216 | SMMUIOTLBKey iotlb_key = *(SMMUIOTLBKey *)key; |
| 217 | |
| 218 | if (SMMU_IOTLB_ASID(iotlb_key) >= 0) { |
| 219 | /* This is a stage-1 address. */ |
| 220 | return false; |
| 221 | } |
| 222 | if (info->vmid != SMMU_IOTLB_VMID(iotlb_key)) { |
| 223 | return false; |
| 224 | } |
| 225 | return ((info->iova & ~entry->addr_mask) == entry->iova) || |
| 226 | ((entry->iova & ~info->mask) == info->iova); |
| 227 | } |
| 228 | |
| 229 | static gboolean |
| 230 | smmu_hash_remove_by_sid_range(gpointer key, gpointer value, gpointer user_data) |
| 231 | { |
| 232 | SMMUDevice *sdev = (SMMUDevice *)key; |
| 233 | uint32_t sid = smmu_get_sid(sdev); |
| 234 | SMMUSIDRange *sid_range = (SMMUSIDRange *)user_data; |
| 235 | |
| 236 | if (sid < sid_range->start || sid > sid_range->end) { |
| 237 | return false; |
| 238 | } |
| 239 | trace_smmu_config_cache_inv(sid); |
| 240 | return true; |
| 241 | } |
| 242 | |
| 243 | void smmu_configs_inv_sid_range(SMMUState *s, SMMUSIDRange sid_range) |
| 244 | { |
| 245 | trace_smmu_configs_inv_sid_range(sid_range.start, sid_range.end); |
| 246 | g_hash_table_foreach_remove(s->configs, smmu_hash_remove_by_sid_range, |
| 247 | &sid_range); |
| 248 | } |
| 249 | |
| 250 | void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova, |
| 251 | uint8_t tg, uint64_t num_pages, uint8_t ttl) |
| 252 | { |
| 253 | /* if tg is not set we use 4KB range invalidation */ |
| 254 | uint8_t granule = tg ? tg * 2 + 10 : 12; |
| 255 | |
| 256 | if (ttl && (num_pages == 1) && (asid >= 0)) { |
| 257 | SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl); |
| 258 | |
| 259 | if (g_hash_table_remove(s->iotlb, &key)) { |
| 260 | return; |
| 261 | } |
| 262 | /* |
| 263 | * if the entry is not found, let's see if it does not |
| 264 | * belong to a larger IOTLB entry |
| 265 | */ |
| 266 | } |
| 267 | |
| 268 | SMMUIOTLBPageInvInfo info = { |
| 269 | .asid = asid, .iova = iova, |
| 270 | .vmid = vmid, |
| 271 | .mask = (num_pages * 1 << granule) - 1}; |
| 272 | |
| 273 | g_hash_table_foreach_remove(s->iotlb, |
| 274 | smmu_hash_remove_by_asid_vmid_iova, |
| 275 | &info); |
| 276 | } |
| 277 | |
| 278 | /* |
| 279 | * Similar to smmu_iotlb_inv_iova(), but for Stage-2, ASID is always -1, |
| 280 | * in Stage-1 invalidation ASID = -1, means don't care. |
| 281 | */ |
| 282 | void smmu_iotlb_inv_ipa(SMMUState *s, int vmid, dma_addr_t ipa, uint8_t tg, |
| 283 | uint64_t num_pages, uint8_t ttl) |
| 284 | { |
| 285 | uint8_t granule = tg ? tg * 2 + 10 : 12; |
| 286 | int asid = -1; |
| 287 | |
| 288 | if (ttl && (num_pages == 1)) { |
| 289 | SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, ipa, tg, ttl); |
| 290 | |
| 291 | if (g_hash_table_remove(s->iotlb, &key)) { |
| 292 | return; |
| 293 | } |
| 294 | } |
| 295 | |
| 296 | SMMUIOTLBPageInvInfo info = { |
| 297 | .iova = ipa, |
| 298 | .vmid = vmid, |
| 299 | .mask = (num_pages << granule) - 1}; |
| 300 | |
| 301 | g_hash_table_foreach_remove(s->iotlb, |
| 302 | smmu_hash_remove_by_vmid_ipa, |
| 303 | &info); |
| 304 | } |
| 305 | |
| 306 | void smmu_iotlb_inv_asid_vmid(SMMUState *s, int asid, int vmid) |
| 307 | { |
| 308 | SMMUIOTLBPageInvInfo info = { |
| 309 | .asid = asid, |
| 310 | .vmid = vmid, |
| 311 | }; |
| 312 | |
| 313 | trace_smmu_iotlb_inv_asid_vmid(asid, vmid); |
| 314 | g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid_vmid, &info); |
| 315 | } |
| 316 | |
| 317 | void smmu_iotlb_inv_vmid(SMMUState *s, int vmid) |
| 318 | { |
| 319 | trace_smmu_iotlb_inv_vmid(vmid); |
| 320 | g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid); |
| 321 | } |
| 322 | |
| 323 | void smmu_iotlb_inv_vmid_s1(SMMUState *s, int vmid) |
| 324 | { |
| 325 | trace_smmu_iotlb_inv_vmid_s1(vmid); |
| 326 | g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid_s1, &vmid); |
| 327 | } |
| 328 | |
| 329 | /* VMSAv8-64 Translation */ |
| 330 | |
| 331 | /** |
| 332 | * get_pte - Get the content of a page table entry located at |
| 333 | * @base_addr[@index] |
| 334 | */ |
| 335 | static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte, |
| 336 | SMMUPTWEventInfo *info) |
| 337 | { |
| 338 | int ret; |
| 339 | dma_addr_t addr = baseaddr + index * sizeof(*pte); |
| 340 | |
| 341 | /* TODO: guarantee 64-bit single-copy atomicity */ |
| 342 | ret = ldq_le_dma(&address_space_memory, addr, pte, MEMTXATTRS_UNSPECIFIED); |
| 343 | |
| 344 | if (ret != MEMTX_OK) { |
| 345 | info->type = SMMU_PTW_ERR_WALK_EABT; |
| 346 | info->addr = addr; |
| 347 | return -EINVAL; |
| 348 | } |
| 349 | trace_smmu_get_pte(baseaddr, index, addr, *pte); |
| 350 | return 0; |
| 351 | } |
| 352 | |
| 353 | /* VMSAv8-64 Translation Table Format Descriptor Decoding */ |
| 354 | |
| 355 | /** |
| 356 | * get_page_pte_address - returns the L3 descriptor output address, |
| 357 | * ie. the page frame |
| 358 | * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format |
| 359 | */ |
| 360 | static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz) |
| 361 | { |
| 362 | return PTE_ADDRESS(pte, granule_sz); |
| 363 | } |
| 364 | |
| 365 | /** |
| 366 | * get_table_pte_address - return table descriptor output address, |
| 367 | * ie. address of next level table |
| 368 | * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats |
| 369 | */ |
| 370 | static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz) |
| 371 | { |
| 372 | return PTE_ADDRESS(pte, granule_sz); |
| 373 | } |
| 374 | |
| 375 | /** |
| 376 | * get_block_pte_address - return block descriptor output address and block size |
| 377 | * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats |
| 378 | */ |
| 379 | static inline hwaddr get_block_pte_address(uint64_t pte, int level, |
| 380 | int granule_sz, uint64_t *bsz) |
| 381 | { |
| 382 | int n = level_shift(level, granule_sz); |
| 383 | |
| 384 | *bsz = 1ULL << n; |
| 385 | return PTE_ADDRESS(pte, n); |
| 386 | } |
| 387 | |
| 388 | SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova) |
| 389 | { |
| 390 | bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi); |
| 391 | uint8_t tbi_byte = tbi * 8; |
| 392 | |
| 393 | if (cfg->tt[0].tsz && |
| 394 | !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) { |
| 395 | /* there is a ttbr0 region and we are in it (high bits all zero) */ |
| 396 | return &cfg->tt[0]; |
| 397 | } else if (cfg->tt[1].tsz && |
| 398 | sextract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte) == -1) { |
| 399 | /* there is a ttbr1 region and we are in it (high bits all one) */ |
| 400 | return &cfg->tt[1]; |
| 401 | } else if (!cfg->tt[0].tsz) { |
| 402 | /* ttbr0 region is "everything not in the ttbr1 region" */ |
| 403 | return &cfg->tt[0]; |
| 404 | } else if (!cfg->tt[1].tsz) { |
| 405 | /* ttbr1 region is "everything not in the ttbr0 region" */ |
| 406 | return &cfg->tt[1]; |
| 407 | } |
| 408 | /* in the gap between the two regions, this is a Translation fault */ |
| 409 | return NULL; |
| 410 | } |
| 411 | |
| 412 | /* Translate stage-1 table address using stage-2 page table. */ |
| 413 | static inline int translate_table_addr_ipa(SMMUState *bs, |
| 414 | dma_addr_t *table_addr, |
| 415 | SMMUTransCfg *cfg, |
| 416 | SMMUPTWEventInfo *info) |
| 417 | { |
| 418 | dma_addr_t addr = *table_addr; |
| 419 | SMMUTLBEntry *cached_entry; |
| 420 | int asid; |
| 421 | |
| 422 | /* |
| 423 | * The translation table walks performed from TTB0 or TTB1 are always |
| 424 | * performed in IPA space if stage 2 translations are enabled. |
| 425 | */ |
| 426 | asid = cfg->asid; |
| 427 | cfg->stage = SMMU_STAGE_2; |
| 428 | cfg->asid = -1; |
| 429 | cached_entry = smmu_translate(bs, cfg, addr, IOMMU_RO, info); |
| 430 | cfg->asid = asid; |
| 431 | cfg->stage = SMMU_NESTED; |
| 432 | |
| 433 | if (cached_entry) { |
| 434 | *table_addr = CACHED_ENTRY_TO_ADDR(cached_entry, addr); |
| 435 | return 0; |
| 436 | } |
| 437 | |
| 438 | info->stage = SMMU_STAGE_2; |
| 439 | info->addr = addr; |
| 440 | info->is_ipa_descriptor = true; |
| 441 | return -EINVAL; |
| 442 | } |
| 443 | |
| 444 | /** |
| 445 | * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA |
| 446 | * @bs: smmu state which includes TLB instance |
| 447 | * @cfg: translation config |
| 448 | * @iova: iova to translate |
| 449 | * @perm: access type |
| 450 | * @tlbe: SMMUTLBEntry (out) |
| 451 | * @info: handle to an error info |
| 452 | * |
| 453 | * Return 0 on success, < 0 on error. In case of error, @info is filled |
| 454 | * and tlbe->perm is set to IOMMU_NONE. |
| 455 | * Upon success, @tlbe is filled with translated_addr and entry |
| 456 | * permission rights. |
| 457 | */ |
| 458 | static int smmu_ptw_64_s1(SMMUState *bs, SMMUTransCfg *cfg, |
| 459 | dma_addr_t iova, IOMMUAccessFlags perm, |
| 460 | SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info) |
| 461 | { |
| 462 | dma_addr_t baseaddr, indexmask; |
| 463 | SMMUStage stage = cfg->stage; |
| 464 | SMMUTransTableInfo *tt = select_tt(cfg, iova); |
| 465 | uint8_t level, granule_sz, inputsize, stride; |
| 466 | |
| 467 | if (!tt || tt->disabled) { |
| 468 | info->type = SMMU_PTW_ERR_TRANSLATION; |
| 469 | goto error; |
| 470 | } |
| 471 | |
| 472 | granule_sz = tt->granule_sz; |
| 473 | stride = VMSA_STRIDE(granule_sz); |
| 474 | inputsize = 64 - tt->tsz; |
| 475 | level = 4 - (inputsize - 4) / stride; |
| 476 | indexmask = VMSA_IDXMSK(inputsize, stride, level); |
| 477 | |
| 478 | baseaddr = extract64(tt->ttb, 0, cfg->oas); |
| 479 | baseaddr &= ~indexmask; |
| 480 | |
| 481 | while (level < VMSA_LEVELS) { |
| 482 | uint64_t subpage_size = 1ULL << level_shift(level, granule_sz); |
| 483 | uint64_t mask = subpage_size - 1; |
| 484 | uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz); |
| 485 | uint64_t pte, gpa; |
| 486 | dma_addr_t pte_addr = baseaddr + offset * sizeof(pte); |
| 487 | uint8_t ap; |
| 488 | |
| 489 | if (get_pte(baseaddr, offset, &pte, info)) { |
| 490 | goto error; |
| 491 | } |
| 492 | trace_smmu_ptw_level(stage, level, iova, subpage_size, |
| 493 | baseaddr, offset, pte); |
| 494 | |
| 495 | if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) { |
| 496 | trace_smmu_ptw_invalid_pte(stage, level, baseaddr, |
| 497 | pte_addr, offset, pte); |
| 498 | break; |
| 499 | } |
| 500 | |
| 501 | if (is_table_pte(pte, level)) { |
| 502 | ap = PTE_APTABLE(pte); |
| 503 | |
| 504 | if (is_permission_fault(ap, perm) && !tt->had) { |
| 505 | info->type = SMMU_PTW_ERR_PERMISSION; |
| 506 | goto error; |
| 507 | } |
| 508 | baseaddr = get_table_pte_address(pte, granule_sz); |
| 509 | if (cfg->stage == SMMU_NESTED) { |
| 510 | if (translate_table_addr_ipa(bs, &baseaddr, cfg, info)) { |
| 511 | goto error; |
| 512 | } |
| 513 | } |
| 514 | level++; |
| 515 | continue; |
| 516 | } else if (is_page_pte(pte, level)) { |
| 517 | gpa = get_page_pte_address(pte, granule_sz); |
| 518 | trace_smmu_ptw_page_pte(stage, level, iova, |
| 519 | baseaddr, pte_addr, pte, gpa); |
| 520 | } else { |
| 521 | uint64_t block_size; |
| 522 | |
| 523 | gpa = get_block_pte_address(pte, level, granule_sz, |
| 524 | &block_size); |
| 525 | trace_smmu_ptw_block_pte(stage, level, baseaddr, |
| 526 | pte_addr, pte, iova, gpa, |
| 527 | block_size >> 20); |
| 528 | } |
| 529 | |
| 530 | /* |
| 531 | * QEMU does not currently implement HTTU, so if AFFD and PTE.AF |
| 532 | * are 0 we take an Access flag fault. (5.4. Context Descriptor) |
| 533 | * An Access flag fault takes priority over a Permission fault. |
| 534 | */ |
| 535 | if (!PTE_AF(pte) && !cfg->affd) { |
| 536 | info->type = SMMU_PTW_ERR_ACCESS; |
| 537 | goto error; |
| 538 | } |
| 539 | |
| 540 | ap = PTE_AP(pte); |
| 541 | if (is_permission_fault(ap, perm)) { |
| 542 | info->type = SMMU_PTW_ERR_PERMISSION; |
| 543 | goto error; |
| 544 | } |
| 545 | |
| 546 | /* |
| 547 | * The address output from the translation causes a stage 1 Address |
| 548 | * Size fault if it exceeds the range of the effective IPA size for |
| 549 | * the given CD. |
| 550 | */ |
| 551 | if (gpa >= (1ULL << cfg->oas)) { |
| 552 | info->type = SMMU_PTW_ERR_ADDR_SIZE; |
| 553 | goto error; |
| 554 | } |
| 555 | |
| 556 | tlbe->entry.translated_addr = gpa; |
| 557 | tlbe->entry.iova = iova & ~mask; |
| 558 | tlbe->entry.addr_mask = mask; |
| 559 | tlbe->parent_perm = PTE_AP_TO_PERM(ap); |
| 560 | tlbe->entry.perm = tlbe->parent_perm; |
| 561 | tlbe->level = level; |
| 562 | tlbe->granule = granule_sz; |
| 563 | return 0; |
| 564 | } |
| 565 | info->type = SMMU_PTW_ERR_TRANSLATION; |
| 566 | |
| 567 | error: |
| 568 | info->stage = SMMU_STAGE_1; |
| 569 | tlbe->entry.perm = IOMMU_NONE; |
| 570 | return -EINVAL; |
| 571 | } |
| 572 | |
| 573 | /** |
| 574 | * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa |
| 575 | * for stage-2. |
| 576 | * @cfg: translation config |
| 577 | * @ipa: ipa to translate |
| 578 | * @perm: access type |
| 579 | * @tlbe: SMMUTLBEntry (out) |
| 580 | * @info: handle to an error info |
| 581 | * |
| 582 | * Return 0 on success, < 0 on error. In case of error, @info is filled |
| 583 | * and tlbe->perm is set to IOMMU_NONE. |
| 584 | * Upon success, @tlbe is filled with translated_addr and entry |
| 585 | * permission rights. |
| 586 | */ |
| 587 | static int smmu_ptw_64_s2(SMMUTransCfg *cfg, |
| 588 | dma_addr_t ipa, IOMMUAccessFlags perm, |
| 589 | SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info) |
| 590 | { |
| 591 | const SMMUStage stage = SMMU_STAGE_2; |
| 592 | int granule_sz = cfg->s2cfg.granule_sz; |
| 593 | /* ARM DDI0487I.a: Table D8-7. */ |
| 594 | int inputsize = 64 - cfg->s2cfg.tsz; |
| 595 | int level = get_start_level(cfg->s2cfg.sl0, granule_sz); |
| 596 | int stride = VMSA_STRIDE(granule_sz); |
| 597 | int idx = pgd_concat_idx(level, granule_sz, ipa); |
| 598 | /* |
| 599 | * Get the ttb from concatenated structure. |
| 600 | * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte)) |
| 601 | */ |
| 602 | uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, cfg->s2cfg.eff_ps) + |
| 603 | (1 << stride) * idx * sizeof(uint64_t); |
| 604 | dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level); |
| 605 | |
| 606 | baseaddr &= ~indexmask; |
| 607 | |
| 608 | /* |
| 609 | * On input, a stage 2 Translation fault occurs if the IPA is outside the |
| 610 | * range configured by the relevant S2T0SZ field of the STE. |
| 611 | */ |
| 612 | if (ipa >= (1ULL << inputsize)) { |
| 613 | info->type = SMMU_PTW_ERR_TRANSLATION; |
| 614 | goto error_ipa; |
| 615 | } |
| 616 | |
| 617 | while (level < VMSA_LEVELS) { |
| 618 | uint64_t subpage_size = 1ULL << level_shift(level, granule_sz); |
| 619 | uint64_t mask = subpage_size - 1; |
| 620 | uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz); |
| 621 | uint64_t pte, gpa; |
| 622 | dma_addr_t pte_addr = baseaddr + offset * sizeof(pte); |
| 623 | uint8_t s2ap; |
| 624 | |
| 625 | if (get_pte(baseaddr, offset, &pte, info)) { |
| 626 | goto error; |
| 627 | } |
| 628 | trace_smmu_ptw_level(stage, level, ipa, subpage_size, |
| 629 | baseaddr, offset, pte); |
| 630 | if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) { |
| 631 | trace_smmu_ptw_invalid_pte(stage, level, baseaddr, |
| 632 | pte_addr, offset, pte); |
| 633 | break; |
| 634 | } |
| 635 | |
| 636 | if (is_table_pte(pte, level)) { |
| 637 | baseaddr = get_table_pte_address(pte, granule_sz); |
| 638 | level++; |
| 639 | continue; |
| 640 | } else if (is_page_pte(pte, level)) { |
| 641 | gpa = get_page_pte_address(pte, granule_sz); |
| 642 | trace_smmu_ptw_page_pte(stage, level, ipa, |
| 643 | baseaddr, pte_addr, pte, gpa); |
| 644 | } else { |
| 645 | uint64_t block_size; |
| 646 | |
| 647 | gpa = get_block_pte_address(pte, level, granule_sz, |
| 648 | &block_size); |
| 649 | trace_smmu_ptw_block_pte(stage, level, baseaddr, |
| 650 | pte_addr, pte, ipa, gpa, |
| 651 | block_size >> 20); |
| 652 | } |
| 653 | |
| 654 | /* |
| 655 | * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry) |
| 656 | * An Access fault takes priority over a Permission fault. |
| 657 | */ |
| 658 | if (!PTE_AF(pte) && !cfg->s2cfg.affd) { |
| 659 | info->type = SMMU_PTW_ERR_ACCESS; |
| 660 | goto error_ipa; |
| 661 | } |
| 662 | |
| 663 | s2ap = PTE_AP(pte); |
| 664 | if (is_permission_fault_s2(s2ap, perm)) { |
| 665 | info->type = SMMU_PTW_ERR_PERMISSION; |
| 666 | goto error_ipa; |
| 667 | } |
| 668 | |
| 669 | /* |
| 670 | * The address output from the translation causes a stage 2 Address |
| 671 | * Size fault if it exceeds the effective PA output range. |
| 672 | */ |
| 673 | if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) { |
| 674 | info->type = SMMU_PTW_ERR_ADDR_SIZE; |
| 675 | goto error_ipa; |
| 676 | } |
| 677 | |
| 678 | tlbe->entry.translated_addr = gpa; |
| 679 | tlbe->entry.iova = ipa & ~mask; |
| 680 | tlbe->entry.addr_mask = mask; |
| 681 | tlbe->parent_perm = s2ap; |
| 682 | tlbe->entry.perm = tlbe->parent_perm; |
| 683 | tlbe->level = level; |
| 684 | tlbe->granule = granule_sz; |
| 685 | return 0; |
| 686 | } |
| 687 | info->type = SMMU_PTW_ERR_TRANSLATION; |
| 688 | |
| 689 | error_ipa: |
| 690 | info->addr = ipa; |
| 691 | error: |
| 692 | info->stage = SMMU_STAGE_2; |
| 693 | tlbe->entry.perm = IOMMU_NONE; |
| 694 | return -EINVAL; |
| 695 | } |
| 696 | |
| 697 | /* |
| 698 | * combine S1 and S2 TLB entries into a single entry. |
| 699 | * As a result the S1 entry is overridden with combined data. |
| 700 | */ |
| 701 | static void combine_tlb(SMMUTLBEntry *tlbe, SMMUTLBEntry *tlbe_s2, |
| 702 | dma_addr_t iova, SMMUTransCfg *cfg) |
| 703 | { |
| 704 | if (tlbe_s2->entry.addr_mask < tlbe->entry.addr_mask) { |
| 705 | tlbe->entry.addr_mask = tlbe_s2->entry.addr_mask; |
| 706 | tlbe->granule = tlbe_s2->granule; |
| 707 | tlbe->level = tlbe_s2->level; |
| 708 | } |
| 709 | |
| 710 | tlbe->entry.translated_addr = CACHED_ENTRY_TO_ADDR(tlbe_s2, |
| 711 | tlbe->entry.translated_addr); |
| 712 | |
| 713 | tlbe->entry.iova = iova & ~tlbe->entry.addr_mask; |
| 714 | /* parent_perm has s2 perm while perm keeps s1 perm. */ |
| 715 | tlbe->parent_perm = tlbe_s2->entry.perm; |
| 716 | } |
| 717 | |
| 718 | /** |
| 719 | * smmu_ptw - Walk the page tables for an IOVA, according to @cfg |
| 720 | * |
| 721 | * @bs: smmu state which includes TLB instance |
| 722 | * @cfg: translation configuration |
| 723 | * @iova: iova to translate |
| 724 | * @perm: tentative access type |
| 725 | * @tlbe: returned entry |
| 726 | * @info: ptw event handle |
| 727 | * |
| 728 | * return 0 on success |
| 729 | */ |
| 730 | int smmu_ptw(SMMUState *bs, SMMUTransCfg *cfg, dma_addr_t iova, |
| 731 | IOMMUAccessFlags perm, SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info) |
| 732 | { |
| 733 | int ret; |
| 734 | SMMUTLBEntry tlbe_s2; |
| 735 | dma_addr_t ipa; |
| 736 | |
| 737 | if (cfg->stage == SMMU_STAGE_1) { |
| 738 | return smmu_ptw_64_s1(bs, cfg, iova, perm, tlbe, info); |
| 739 | } else if (cfg->stage == SMMU_STAGE_2) { |
| 740 | /* |
| 741 | * If bypassing stage 1(or unimplemented), the input address is passed |
| 742 | * directly to stage 2 as IPA. If the input address of a transaction |
| 743 | * exceeds the size of the IAS, a stage 1 Address Size fault occurs. |
| 744 | * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes" |
| 745 | */ |
| 746 | if (iova >= (1ULL << cfg->oas)) { |
| 747 | info->type = SMMU_PTW_ERR_ADDR_SIZE; |
| 748 | info->stage = SMMU_STAGE_1; |
| 749 | tlbe->entry.perm = IOMMU_NONE; |
| 750 | return -EINVAL; |
| 751 | } |
| 752 | |
| 753 | return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info); |
| 754 | } |
| 755 | |
| 756 | /* SMMU_NESTED. */ |
| 757 | ret = smmu_ptw_64_s1(bs, cfg, iova, perm, tlbe, info); |
| 758 | if (ret) { |
| 759 | return ret; |
| 760 | } |
| 761 | |
| 762 | ipa = CACHED_ENTRY_TO_ADDR(tlbe, iova); |
| 763 | ret = smmu_ptw_64_s2(cfg, ipa, perm, &tlbe_s2, info); |
| 764 | if (ret) { |
| 765 | return ret; |
| 766 | } |
| 767 | |
| 768 | combine_tlb(tlbe, &tlbe_s2, iova, cfg); |
| 769 | return 0; |
| 770 | } |
| 771 | |
| 772 | SMMUTLBEntry *smmu_translate(SMMUState *bs, SMMUTransCfg *cfg, dma_addr_t addr, |
| 773 | IOMMUAccessFlags flag, SMMUPTWEventInfo *info) |
| 774 | { |
| 775 | SMMUTLBEntry *cached_entry = NULL; |
| 776 | SMMUTransTableInfo *tt; |
| 777 | int status; |
| 778 | |
| 779 | /* |
| 780 | * Combined attributes used for TLB lookup, holds the attributes for |
| 781 | * the input stage. |
| 782 | */ |
| 783 | SMMUTransTableInfo tt_combined; |
| 784 | |
| 785 | if (cfg->stage == SMMU_STAGE_2) { |
| 786 | /* Stage2. */ |
| 787 | tt_combined.granule_sz = cfg->s2cfg.granule_sz; |
| 788 | tt_combined.tsz = cfg->s2cfg.tsz; |
| 789 | } else { |
| 790 | /* Select stage1 translation table. */ |
| 791 | tt = select_tt(cfg, addr); |
| 792 | if (!tt) { |
| 793 | info->type = SMMU_PTW_ERR_TRANSLATION; |
| 794 | info->stage = SMMU_STAGE_1; |
| 795 | return NULL; |
| 796 | } |
| 797 | tt_combined.granule_sz = tt->granule_sz; |
| 798 | tt_combined.tsz = tt->tsz; |
| 799 | } |
| 800 | |
| 801 | cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, addr); |
| 802 | if (cached_entry) { |
| 803 | if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & |
| 804 | cached_entry->parent_perm & IOMMU_WO)) { |
| 805 | info->type = SMMU_PTW_ERR_PERMISSION; |
| 806 | info->stage = !(cached_entry->entry.perm & IOMMU_WO) ? |
| 807 | SMMU_STAGE_1 : |
| 808 | SMMU_STAGE_2; |
| 809 | return NULL; |
| 810 | } |
| 811 | return cached_entry; |
| 812 | } |
| 813 | |
| 814 | cached_entry = g_new0(SMMUTLBEntry, 1); |
| 815 | status = smmu_ptw(bs, cfg, addr, flag, cached_entry, info); |
| 816 | if (status) { |
| 817 | g_free(cached_entry); |
| 818 | return NULL; |
| 819 | } |
| 820 | smmu_iotlb_insert(bs, cfg, cached_entry); |
| 821 | return cached_entry; |
| 822 | } |
| 823 | |
| 824 | /** |
| 825 | * The bus number is used for lookup when SID based invalidation occurs. |
| 826 | * In that case we lazily populate the SMMUPciBus array from the bus hash |
| 827 | * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus |
| 828 | * numbers may not be always initialized yet. |
| 829 | */ |
| 830 | SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num) |
| 831 | { |
| 832 | SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num]; |
| 833 | GHashTableIter iter; |
| 834 | |
| 835 | if (smmu_pci_bus) { |
| 836 | return smmu_pci_bus; |
| 837 | } |
| 838 | |
| 839 | g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr); |
| 840 | while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) { |
| 841 | if (pci_bus_num(smmu_pci_bus->bus) == bus_num) { |
| 842 | s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus; |
| 843 | return smmu_pci_bus; |
| 844 | } |
| 845 | } |
| 846 | |
| 847 | return NULL; |
| 848 | } |
| 849 | |
| 850 | void smmu_init_sdev(SMMUState *s, SMMUDevice *sdev, PCIBus *bus, int devfn) |
| 851 | { |
| 852 | static unsigned int index; |
| 853 | g_autofree char *name = g_strdup_printf("%s-%d-%d", s->mrtypename, devfn, |
| 854 | index++); |
| 855 | sdev->smmu = s; |
| 856 | sdev->bus = bus; |
| 857 | sdev->devfn = devfn; |
| 858 | |
| 859 | memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu), |
| 860 | s->mrtypename, OBJECT(s), name, UINT64_MAX); |
| 861 | address_space_init(&sdev->as, MEMORY_REGION(&sdev->iommu), name); |
| 862 | trace_smmu_add_mr(name); |
| 863 | } |
| 864 | |
| 865 | SMMUPciBus *smmu_get_sbus(SMMUState *s, PCIBus *bus) |
| 866 | { |
| 867 | SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus); |
| 868 | |
| 869 | if (!sbus) { |
| 870 | sbus = g_malloc0(sizeof(SMMUPciBus) + |
| 871 | sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX); |
| 872 | sbus->bus = bus; |
| 873 | g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus); |
| 874 | } |
| 875 | |
| 876 | return sbus; |
| 877 | } |
| 878 | |
| 879 | static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn) |
| 880 | { |
| 881 | SMMUState *s = opaque; |
| 882 | SMMUPciBus *sbus = smmu_get_sbus(s, bus); |
| 883 | SMMUDevice *sdev; |
| 884 | |
| 885 | sdev = sbus->pbdev[devfn]; |
| 886 | if (!sdev) { |
| 887 | sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1); |
| 888 | smmu_init_sdev(s, sdev, bus, devfn); |
| 889 | } |
| 890 | |
| 891 | return &sdev->as; |
| 892 | } |
| 893 | |
| 894 | static const PCIIOMMUOps smmu_ops = { |
| 895 | .get_address_space = smmu_find_add_as, |
| 896 | }; |
| 897 | |
| 898 | SMMUDevice *smmu_find_sdev(SMMUState *s, uint32_t sid) |
| 899 | { |
| 900 | uint8_t bus_n, devfn; |
| 901 | SMMUPciBus *smmu_bus; |
| 902 | |
| 903 | bus_n = PCI_BUS_NUM(sid); |
| 904 | smmu_bus = smmu_find_smmu_pcibus(s, bus_n); |
| 905 | if (smmu_bus) { |
| 906 | devfn = SMMU_PCI_DEVFN(sid); |
| 907 | return smmu_bus->pbdev[devfn]; |
| 908 | } |
| 909 | return NULL; |
| 910 | } |
| 911 | |
| 912 | /* Unmap all notifiers attached to @mr */ |
| 913 | static void smmu_inv_notifiers_mr(IOMMUMemoryRegion *mr) |
| 914 | { |
| 915 | IOMMUNotifier *n; |
| 916 | |
| 917 | trace_smmu_inv_notifiers_mr(mr->parent_obj.name); |
| 918 | IOMMU_NOTIFIER_FOREACH(n, mr) { |
| 919 | memory_region_unmap_iommu_notifier_range(n); |
| 920 | } |
| 921 | } |
| 922 | |
| 923 | /* Unmap all notifiers of all mr's */ |
| 924 | void smmu_inv_notifiers_all(SMMUState *s) |
| 925 | { |
| 926 | SMMUDevice *sdev; |
| 927 | |
| 928 | QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) { |
| 929 | smmu_inv_notifiers_mr(&sdev->iommu); |
| 930 | } |
| 931 | } |
| 932 | |
| 933 | static void smmu_base_realize(DeviceState *dev, Error **errp) |
| 934 | { |
| 935 | SMMUState *s = ARM_SMMU(dev); |
| 936 | SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev); |
| 937 | PCIBus *pci_bus = s->primary_bus; |
| 938 | Error *local_err = NULL; |
| 939 | |
| 940 | sbc->parent_realize(dev, &local_err); |
| 941 | if (local_err) { |
| 942 | error_propagate(errp, local_err); |
| 943 | return; |
| 944 | } |
| 945 | s->configs = g_hash_table_new_full(NULL, NULL, NULL, g_free); |
| 946 | s->iotlb = g_hash_table_new_full(smmu_iotlb_key_hash, smmu_iotlb_key_equal, |
| 947 | g_free, g_free); |
| 948 | s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL); |
| 949 | |
| 950 | if (!pci_bus) { |
| 951 | error_setg(errp, "SMMU is not attached to any PCI bus!"); |
| 952 | return; |
| 953 | } |
| 954 | |
| 955 | g_assert(s->memory); |
| 956 | address_space_init(&s->memory_as, s->memory, "smmu-memory-view"); |
| 957 | if (s->secure_memory) { |
| 958 | address_space_init(&s->secure_memory_as, s->secure_memory, |
| 959 | "smmu-secure-memory-view"); |
| 960 | } |
| 961 | |
| 962 | if (!s->iommu_ops) { |
| 963 | s->iommu_ops = &smmu_ops; |
| 964 | } |
| 965 | /* |
| 966 | * We only allow default PCIe Root Complex(pcie.0) or pxb-pcie based extra |
| 967 | * root complexes to be associated with SMMU. |
| 968 | */ |
| 969 | if (pci_bus_is_express(pci_bus) && pci_bus_is_root(pci_bus) && |
| 970 | object_dynamic_cast(OBJECT(pci_bus)->parent, TYPE_PCI_HOST_BRIDGE)) { |
| 971 | /* |
| 972 | * This condition matches either the default pcie.0, pxb-pcie, or |
| 973 | * pxb-cxl. For both pxb-pcie and pxb-cxl, parent_dev will be set. |
| 974 | * Currently, we don't allow pxb-cxl as it requires further |
| 975 | * verification. Therefore, make sure this is indeed pxb-pcie. |
| 976 | */ |
| 977 | if (pci_bus->parent_dev) { |
| 978 | if (!object_dynamic_cast(OBJECT(pci_bus), TYPE_PXB_PCIE_BUS)) { |
| 979 | goto out_err; |
| 980 | } |
| 981 | } |
| 982 | |
| 983 | if (s->smmu_per_bus) { |
| 984 | if (!pci_setup_iommu_per_bus(pci_bus, s->iommu_ops, s, errp)) { |
| 985 | return; |
| 986 | } |
| 987 | } else { |
| 988 | pci_setup_iommu(pci_bus, s->iommu_ops, s); |
| 989 | } |
| 990 | return; |
| 991 | } |
| 992 | out_err: |
| 993 | error_setg(errp, "SMMU should be attached to a default PCIe root complex" |
| 994 | "(pcie.0) or a pxb-pcie based root complex"); |
| 995 | } |
| 996 | |
| 997 | /* |
| 998 | * Make sure the IOMMU is reset in 'exit' phase after |
| 999 | * all outstanding DMA requests have been quiesced during |
| 1000 | * the 'enter' or 'hold' reset phases |
| 1001 | */ |
| 1002 | static void smmu_base_reset_exit(Object *obj, ResetType type) |
| 1003 | { |
| 1004 | SMMUState *s = ARM_SMMU(obj); |
| 1005 | |
| 1006 | memset(s->smmu_pcibus_by_bus_num, 0, sizeof(s->smmu_pcibus_by_bus_num)); |
| 1007 | |
| 1008 | g_hash_table_remove_all(s->configs); |
| 1009 | g_hash_table_remove_all(s->iotlb); |
| 1010 | } |
| 1011 | |
| 1012 | static const Property smmu_dev_properties[] = { |
| 1013 | DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0), |
| 1014 | DEFINE_PROP_BOOL("smmu_per_bus", SMMUState, smmu_per_bus, false), |
| 1015 | DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus, |
| 1016 | TYPE_PCI_BUS, PCIBus *), |
| 1017 | DEFINE_PROP_LINK("memory", SMMUState, memory, |
| 1018 | TYPE_MEMORY_REGION, MemoryRegion *), |
| 1019 | DEFINE_PROP_LINK("secure-memory", SMMUState, secure_memory, |
| 1020 | TYPE_MEMORY_REGION, MemoryRegion *), |
| 1021 | }; |
| 1022 | |
| 1023 | static void smmu_base_class_init(ObjectClass *klass, const void *data) |
| 1024 | { |
| 1025 | DeviceClass *dc = DEVICE_CLASS(klass); |
| 1026 | ResettableClass *rc = RESETTABLE_CLASS(klass); |
| 1027 | SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass); |
| 1028 | |
| 1029 | device_class_set_props(dc, smmu_dev_properties); |
| 1030 | device_class_set_parent_realize(dc, smmu_base_realize, |
| 1031 | &sbc->parent_realize); |
| 1032 | rc->phases.exit = smmu_base_reset_exit; |
| 1033 | } |
| 1034 | |
| 1035 | static const TypeInfo smmu_base_info = { |
| 1036 | .name = TYPE_ARM_SMMU, |
| 1037 | .parent = TYPE_SYS_BUS_DEVICE, |
| 1038 | .instance_size = sizeof(SMMUState), |
| 1039 | .class_data = NULL, |
| 1040 | .class_size = sizeof(SMMUBaseClass), |
| 1041 | .class_init = smmu_base_class_init, |
| 1042 | .abstract = true, |
| 1043 | }; |
| 1044 | |
| 1045 | static void smmu_base_register_types(void) |
| 1046 | { |
| 1047 | type_register_static(&smmu_base_info); |
| 1048 | } |
| 1049 | |
| 1050 | type_init(smmu_base_register_types) |
| 1051 |