[qemu.git] / hw / arm / smmu-common.c

/*
 * Copyright (C) 2014-2016 Broadcom Corporation
 * Copyright (c) 2017 Red Hat, Inc.
 * Written by Prem Mallappa, Eric Auger
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * Author: Prem Mallappa <[email protected]>
 *
 */

#include "qemu/osdep.h"
#include "sysemu/sysemu.h"
#include "exec/address-spaces.h"
#include "trace.h"
#include "exec/target_page.h"
#include "qom/cpu.h"
#include "hw/qdev-properties.h"
#include "qapi/error.h"
#include "qemu/jhash.h"

#include "qemu/error-report.h"
#include "hw/arm/smmu-common.h"
#include "smmu-internal.h"

/* IOTLB Management */

inline void smmu_iotlb_inv_all(SMMUState *s)
{
    trace_smmu_iotlb_inv_all();
    g_hash_table_remove_all(s->iotlb);
}

static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
                                         gpointer user_data)
{
    uint16_t asid = *(uint16_t *)user_data;
    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;

    return iotlb_key->asid == asid;
}

inline void smmu_iotlb_inv_iova(SMMUState *s, uint16_t asid, dma_addr_t iova)
{
    SMMUIOTLBKey key = {.asid = asid, .iova = iova};

    trace_smmu_iotlb_inv_iova(asid, iova);
    g_hash_table_remove(s->iotlb, &key);
}

inline void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
{
    trace_smmu_iotlb_inv_asid(asid);
    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
}

/* VMSAv8-64 Translation */

/**
 * get_pte - Get the content of a page table entry located at
 * @base_addr[@index]
 */
static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
                   SMMUPTWEventInfo *info)
{
    int ret;
    dma_addr_t addr = baseaddr + index * sizeof(*pte);

    /* TODO: guarantee 64-bit single-copy atomicity */
    ret = dma_memory_read(&address_space_memory, addr,
                          (uint8_t *)pte, sizeof(*pte));

    if (ret != MEMTX_OK) {
        info->type = SMMU_PTW_ERR_WALK_EABT;
        info->addr = addr;
        return -EINVAL;
    }
    trace_smmu_get_pte(baseaddr, index, addr, *pte);
    return 0;
}

/* VMSAv8-64 Translation Table Format Descriptor Decoding */

/**
 * get_page_pte_address - returns the L3 descriptor output address,
 * ie. the page frame
 * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
 */
static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
{
    return PTE_ADDRESS(pte, granule_sz);
}

/**
 * get_table_pte_address - return table descriptor output address,
 * ie. address of next level table
 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
 */
static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
{
    return PTE_ADDRESS(pte, granule_sz);
}

/**
 * get_block_pte_address - return block descriptor output address and block size
 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
 */
static inline hwaddr get_block_pte_address(uint64_t pte, int level,
                                           int granule_sz, uint64_t *bsz)
{
    int n = level_shift(level, granule_sz);

    *bsz = 1ULL << n;
    return PTE_ADDRESS(pte, n);
}

SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
{
    bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
    uint8_t tbi_byte = tbi * 8;

    if (cfg->tt[0].tsz &&
        !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
        /* there is a ttbr0 region and we are in it (high bits all zero) */
        return &cfg->tt[0];
    } else if (cfg->tt[1].tsz &&
           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
        /* there is a ttbr1 region and we are in it (high bits all one) */
        return &cfg->tt[1];
    } else if (!cfg->tt[0].tsz) {
        /* ttbr0 region is "everything not in the ttbr1 region" */
        return &cfg->tt[0];
    } else if (!cfg->tt[1].tsz) {
        /* ttbr1 region is "everything not in the ttbr0 region" */
        return &cfg->tt[1];
    }
    /* in the gap between the two regions, this is a Translation fault */
    return NULL;
}

/**
 * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
 * @cfg: translation config
 * @iova: iova to translate
 * @perm: access type
 * @tlbe: IOMMUTLBEntry (out)
 * @info: handle to an error info
 *
 * Return 0 on success, < 0 on error. In case of error, @info is filled
 * and tlbe->perm is set to IOMMU_NONE.
 * Upon success, @tlbe is filled with translated_addr and entry
 * permission rights.
 */
static int smmu_ptw_64(SMMUTransCfg *cfg,
                       dma_addr_t iova, IOMMUAccessFlags perm,
                       IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
{
    dma_addr_t baseaddr, indexmask;
    int stage = cfg->stage;
    SMMUTransTableInfo *tt = select_tt(cfg, iova);
    uint8_t level, granule_sz, inputsize, stride;

    if (!tt || tt->disabled) {
        info->type = SMMU_PTW_ERR_TRANSLATION;
        goto error;
    }

    granule_sz = tt->granule_sz;
    stride = granule_sz - 3;
    inputsize = 64 - tt->tsz;
    level = 4 - (inputsize - 4) / stride;
    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
    baseaddr = extract64(tt->ttb, 0, 48);
    baseaddr &= ~indexmask;

    tlbe->iova = iova;
    tlbe->addr_mask = (1 << granule_sz) - 1;

    while (level <= 3) {
        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
        uint64_t mask = subpage_size - 1;
        uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
        uint64_t pte;
        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
        uint8_t ap;

        if (get_pte(baseaddr, offset, &pte, info)) {
                goto error;
        }
        trace_smmu_ptw_level(level, iova, subpage_size,
                             baseaddr, offset, pte);

        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
                                       pte_addr, offset, pte);
            info->type = SMMU_PTW_ERR_TRANSLATION;
            goto error;
        }

        if (is_page_pte(pte, level)) {
            uint64_t gpa = get_page_pte_address(pte, granule_sz);

            ap = PTE_AP(pte);
            if (is_permission_fault(ap, perm)) {
                info->type = SMMU_PTW_ERR_PERMISSION;
                goto error;
            }

            tlbe->translated_addr = gpa + (iova & mask);
            tlbe->perm = PTE_AP_TO_PERM(ap);
            trace_smmu_ptw_page_pte(stage, level, iova,
                                    baseaddr, pte_addr, pte, gpa);
            return 0;
        }
        if (is_block_pte(pte, level)) {
            uint64_t block_size;
            hwaddr gpa = get_block_pte_address(pte, level, granule_sz,
                                               &block_size);

            ap = PTE_AP(pte);
            if (is_permission_fault(ap, perm)) {
                info->type = SMMU_PTW_ERR_PERMISSION;
                goto error;
            }

            trace_smmu_ptw_block_pte(stage, level, baseaddr,
                                     pte_addr, pte, iova, gpa,
                                     block_size >> 20);

            tlbe->translated_addr = gpa + (iova & mask);
            tlbe->perm = PTE_AP_TO_PERM(ap);
            return 0;
        }

        /* table pte */
        ap = PTE_APTABLE(pte);

        if (is_permission_fault(ap, perm)) {
            info->type = SMMU_PTW_ERR_PERMISSION;
            goto error;
        }
        baseaddr = get_table_pte_address(pte, granule_sz);
        level++;
    }

    info->type = SMMU_PTW_ERR_TRANSLATION;

error:
    tlbe->perm = IOMMU_NONE;
    return -EINVAL;
}

/**
 * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
 *
 * @cfg: translation configuration
 * @iova: iova to translate
 * @perm: tentative access type
 * @tlbe: returned entry
 * @info: ptw event handle
 *
 * return 0 on success
 */
inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
{
    if (!cfg->aa64) {
        /*
         * This code path is not entered as we check this while decoding
         * the configuration data in the derived SMMU model.
         */
        g_assert_not_reached();
    }

    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
}

/**
 * The bus number is used for lookup when SID based invalidation occurs.
 * In that case we lazily populate the SMMUPciBus array from the bus hash
 * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
 * numbers may not be always initialized yet.
 */
SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
{
    SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];

    if (!smmu_pci_bus) {
        GHashTableIter iter;

        g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
        while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
            if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
                s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
                return smmu_pci_bus;
            }
        }
    }
    return smmu_pci_bus;
}

static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
{
    SMMUState *s = opaque;
    SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
    SMMUDevice *sdev;

    if (!sbus) {
        sbus = g_malloc0(sizeof(SMMUPciBus) +
                         sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
        sbus->bus = bus;
        g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
    }

    sdev = sbus->pbdev[devfn];
    if (!sdev) {
        char *name = g_strdup_printf("%s-%d-%d",
                                     s->mrtypename,
                                     pci_bus_num(bus), devfn);
        sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);

        sdev->smmu = s;
        sdev->bus = bus;
        sdev->devfn = devfn;

        memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
                                 s->mrtypename,
                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
        address_space_init(&sdev->as,
                           MEMORY_REGION(&sdev->iommu), name);
        trace_smmu_add_mr(name);
        g_free(name);
    }

    return &sdev->as;
}

IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid)
{
    uint8_t bus_n, devfn;
    SMMUPciBus *smmu_bus;
    SMMUDevice *smmu;

    bus_n = PCI_BUS_NUM(sid);
    smmu_bus = smmu_find_smmu_pcibus(s, bus_n);
    if (smmu_bus) {
        devfn = SMMU_PCI_DEVFN(sid);
        smmu = smmu_bus->pbdev[devfn];
        if (smmu) {
            return &smmu->iommu;
        }
    }
    return NULL;
}

static guint smmu_iotlb_key_hash(gconstpointer v)
{
    SMMUIOTLBKey *key = (SMMUIOTLBKey *)v;
    uint32_t a, b, c;

    /* Jenkins hash */
    a = b = c = JHASH_INITVAL + sizeof(*key);
    a += key->asid;
    b += extract64(key->iova, 0, 32);
    c += extract64(key->iova, 32, 32);

    __jhash_mix(a, b, c);
    __jhash_final(a, b, c);

    return c;
}

static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
{
    const SMMUIOTLBKey *k1 = v1;
    const SMMUIOTLBKey *k2 = v2;

    return (k1->asid == k2->asid) && (k1->iova == k2->iova);
}

/* Unmap the whole notifier's range */
static void smmu_unmap_notifier_range(IOMMUNotifier *n)
{
    IOMMUTLBEntry entry;

    entry.target_as = &address_space_memory;
    entry.iova = n->start;
    entry.perm = IOMMU_NONE;
    entry.addr_mask = n->end - n->start;

    memory_region_notify_one(n, &entry);
}

/* Unmap all notifiers attached to @mr */
inline void smmu_inv_notifiers_mr(IOMMUMemoryRegion *mr)
{
    IOMMUNotifier *n;

    trace_smmu_inv_notifiers_mr(mr->parent_obj.name);
    IOMMU_NOTIFIER_FOREACH(n, mr) {
        smmu_unmap_notifier_range(n);
    }
}

/* Unmap all notifiers of all mr's */
void smmu_inv_notifiers_all(SMMUState *s)
{
    SMMUNotifierNode *node;

    QLIST_FOREACH(node, &s->notifiers_list, next) {
        smmu_inv_notifiers_mr(&node->sdev->iommu);
    }
}

static void smmu_base_realize(DeviceState *dev, Error **errp)
{
    SMMUState *s = ARM_SMMU(dev);
    SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
    Error *local_err = NULL;

    sbc->parent_realize(dev, &local_err);
    if (local_err) {
        error_propagate(errp, local_err);
        return;
    }
    s->configs = g_hash_table_new_full(NULL, NULL, NULL, g_free);
    s->iotlb = g_hash_table_new_full(smmu_iotlb_key_hash, smmu_iotlb_key_equal,
                                     g_free, g_free);
    s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);

    if (s->primary_bus) {
        pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
    } else {
        error_setg(errp, "SMMU is not attached to any PCI bus!");
    }
}

static void smmu_base_reset(DeviceState *dev)
{
    SMMUState *s = ARM_SMMU(dev);

    g_hash_table_remove_all(s->configs);
    g_hash_table_remove_all(s->iotlb);
}

static Property smmu_dev_properties[] = {
    DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
    DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus, "PCI", PCIBus *),
    DEFINE_PROP_END_OF_LIST(),
};

static void smmu_base_class_init(ObjectClass *klass, void *data)
{
    DeviceClass *dc = DEVICE_CLASS(klass);
    SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass);

    dc->props = smmu_dev_properties;
    device_class_set_parent_realize(dc, smmu_base_realize,
                                    &sbc->parent_realize);
    dc->reset = smmu_base_reset;
}

static const TypeInfo smmu_base_info = {
    .name          = TYPE_ARM_SMMU,
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(SMMUState),
    .class_data    = NULL,
    .class_size    = sizeof(SMMUBaseClass),
    .class_init    = smmu_base_class_init,
    .abstract      = true,
};

static void smmu_base_register_types(void)
{
    type_register_static(&smmu_base_info);
}

type_init(smmu_base_register_types)
Commit	Line	Data
527773ee EA	1	/*
	2	* Copyright (C) 2014-2016 Broadcom Corporation
	3	* Copyright (c) 2017 Red Hat, Inc.
	4	* Written by Prem Mallappa, Eric Auger
	5	*
	6	* This program is free software; you can redistribute it and/or modify
	7	* it under the terms of the GNU General Public License version 2 as
	8	* published by the Free Software Foundation.
	9	*
	10	* This program is distributed in the hope that it will be useful,
	11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	13	* GNU General Public License for more details.
	14	*
	15	* Author: Prem Mallappa <[email protected]>
	16	*
	17	*/
	18
	19	#include "qemu/osdep.h"
	20	#include "sysemu/sysemu.h"
	21	#include "exec/address-spaces.h"
	22	#include "trace.h"
	23	#include "exec/target_page.h"
	24	#include "qom/cpu.h"
	25	#include "hw/qdev-properties.h"
	26	#include "qapi/error.h"
cc27ed81	27	#include "qemu/jhash.h"
527773ee EA	28
	29	#include "qemu/error-report.h"
	30	#include "hw/arm/smmu-common.h"
93641948 EA	31	#include "smmu-internal.h"
93641948 EA	32
cc27ed81 EA	33	/* IOTLB Management */
	34
	35	inline void smmu_iotlb_inv_all(SMMUState *s)
	36	{
	37	trace_smmu_iotlb_inv_all();
	38	g_hash_table_remove_all(s->iotlb);
	39	}
	40
	41	static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
	42	gpointer user_data)
	43	{
	44	uint16_t asid = (uint16_t )user_data;
	45	SMMUIOTLBKey iotlb_key = (SMMUIOTLBKey )key;
	46
	47	return iotlb_key->asid == asid;
	48	}
	49
	50	inline void smmu_iotlb_inv_iova(SMMUState *s, uint16_t asid, dma_addr_t iova)
	51	{
	52	SMMUIOTLBKey key = {.asid = asid, .iova = iova};
	53
	54	trace_smmu_iotlb_inv_iova(asid, iova);
	55	g_hash_table_remove(s->iotlb, &key);
	56	}
	57
	58	inline void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
	59	{
	60	trace_smmu_iotlb_inv_asid(asid);
	61	g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
	62	}
	63
93641948 EA	64	/* VMSAv8-64 Translation */
	65
	66	/**
	67	* get_pte - Get the content of a page table entry located at
	68	* @base_addr[@index]
	69	*/
	70	static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
	71	SMMUPTWEventInfo *info)
	72	{
	73	int ret;
	74	dma_addr_t addr = baseaddr + index * sizeof(*pte);
	75
	76	/* TODO: guarantee 64-bit single-copy atomicity */
	77	ret = dma_memory_read(&address_space_memory, addr,
	78	(uint8_t )pte, sizeof(pte));
	79
	80	if (ret != MEMTX_OK) {
	81	info->type = SMMU_PTW_ERR_WALK_EABT;
	82	info->addr = addr;
	83	return -EINVAL;
	84	}
	85	trace_smmu_get_pte(baseaddr, index, addr, *pte);
	86	return 0;
	87	}
	88
	89	/* VMSAv8-64 Translation Table Format Descriptor Decoding */
	90
	91	/**
	92	* get_page_pte_address - returns the L3 descriptor output address,
	93	* ie. the page frame
	94	* ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
	95	*/
	96	static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
	97	{
	98	return PTE_ADDRESS(pte, granule_sz);
	99	}
	100
	101	/**
	102	* get_table_pte_address - return table descriptor output address,
	103	* ie. address of next level table
	104	* ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
	105	*/
	106	static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
	107	{
	108	return PTE_ADDRESS(pte, granule_sz);
	109	}
	110
	111	/**
	112	* get_block_pte_address - return block descriptor output address and block size
	113	* ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
	114	*/
	115	static inline hwaddr get_block_pte_address(uint64_t pte, int level,
	116	int granule_sz, uint64_t *bsz)
	117	{
118eee6c	118	int n = level_shift(level, granule_sz);
93641948	119
118eee6c	120	*bsz = 1ULL << n;
93641948 EA	121	return PTE_ADDRESS(pte, n);
	122	}
	123
	124	SMMUTransTableInfo select_tt(SMMUTransCfg cfg, dma_addr_t iova)
	125	{
	126	bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
	127	uint8_t tbi_byte = tbi * 8;
	128
	129	if (cfg->tt[0].tsz &&
	130	!extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
	131	/* there is a ttbr0 region and we are in it (high bits all zero) */
	132	return &cfg->tt[0];
	133	} else if (cfg->tt[1].tsz &&
	134	!extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
	135	/* there is a ttbr1 region and we are in it (high bits all one) */
	136	return &cfg->tt[1];
	137	} else if (!cfg->tt[0].tsz) {
	138	/* ttbr0 region is "everything not in the ttbr1 region" */
	139	return &cfg->tt[0];
	140	} else if (!cfg->tt[1].tsz) {
	141	/* ttbr1 region is "everything not in the ttbr0 region" */
	142	return &cfg->tt[1];
	143	}
	144	/* in the gap between the two regions, this is a Translation fault */
	145	return NULL;
	146	}
	147
	148	/**
	149	* smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
	150	* @cfg: translation config
	151	* @iova: iova to translate
	152	* @perm: access type
	153	* @tlbe: IOMMUTLBEntry (out)
	154	* @info: handle to an error info
	155	*
	156	* Return 0 on success, < 0 on error. In case of error, @info is filled
	157	* and tlbe->perm is set to IOMMU_NONE.
	158	* Upon success, @tlbe is filled with translated_addr and entry
	159	* permission rights.
	160	*/
	161	static int smmu_ptw_64(SMMUTransCfg *cfg,
	162	dma_addr_t iova, IOMMUAccessFlags perm,
	163	IOMMUTLBEntry tlbe, SMMUPTWEventInfo info)
	164	{
	165	dma_addr_t baseaddr, indexmask;
	166	int stage = cfg->stage;
	167	SMMUTransTableInfo *tt = select_tt(cfg, iova);
	168	uint8_t level, granule_sz, inputsize, stride;
	169
	170	if (!tt \|\| tt->disabled) {
	171	info->type = SMMU_PTW_ERR_TRANSLATION;
	172	goto error;
	173	}
	174
	175	granule_sz = tt->granule_sz;
	176	stride = granule_sz - 3;
	177	inputsize = 64 - tt->tsz;
	178	level = 4 - (inputsize - 4) / stride;
	179	indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
	180	baseaddr = extract64(tt->ttb, 0, 48);
	181	baseaddr &= ~indexmask;
	182
	183	tlbe->iova = iova;
	184	tlbe->addr_mask = (1 << granule_sz) - 1;
185
186	while (level <= 3) {
187	uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
188	uint64_t mask = subpage_size - 1;
189	uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
190	uint64_t pte;
191	dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
192	uint8_t ap;
193
194	if (get_pte(baseaddr, offset, &pte, info)) {
195	goto error;
196	}
197	trace_smmu_ptw_level(level, iova, subpage_size,
198	baseaddr, offset, pte);
199
200	if (is_invalid_pte(pte) \|\| is_reserved_pte(pte, level)) {
201	trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
202	pte_addr, offset, pte);
203	info->type = SMMU_PTW_ERR_TRANSLATION;
204	goto error;
205	}
206
207	if (is_page_pte(pte, level)) {
208	uint64_t gpa = get_page_pte_address(pte, granule_sz);
209
210	ap = PTE_AP(pte);
211	if (is_permission_fault(ap, perm)) {
212	info->type = SMMU_PTW_ERR_PERMISSION;
213	goto error;
214	}
215
216	tlbe->translated_addr = gpa + (iova & mask);
217	tlbe->perm = PTE_AP_TO_PERM(ap);
218	trace_smmu_ptw_page_pte(stage, level, iova,
219	baseaddr, pte_addr, pte, gpa);
220	return 0;
221	}
222	if (is_block_pte(pte, level)) {
223	uint64_t block_size;
224	hwaddr gpa = get_block_pte_address(pte, level, granule_sz,
225	&block_size);
226
227	ap = PTE_AP(pte);
228	if (is_permission_fault(ap, perm)) {
229	info->type = SMMU_PTW_ERR_PERMISSION;
230	goto error;
231	}
232
233	trace_smmu_ptw_block_pte(stage, level, baseaddr,
234	pte_addr, pte, iova, gpa,
235	block_size >> 20);
236
237	tlbe->translated_addr = gpa + (iova & mask);
238	tlbe->perm = PTE_AP_TO_PERM(ap);
239	return 0;
240	}
241
242	/* table pte */
243	ap = PTE_APTABLE(pte);
244
245	if (is_permission_fault(ap, perm)) {
246	info->type = SMMU_PTW_ERR_PERMISSION;
247	goto error;
248	}
249	baseaddr = get_table_pte_address(pte, granule_sz);
250	level++;
251	}
252
253	info->type = SMMU_PTW_ERR_TRANSLATION;
254
255	error:
256	tlbe->perm = IOMMU_NONE;
257	return -EINVAL;
258	}
259
260	/**
261	* smmu_ptw - Walk the page tables for an IOVA, according to @cfg
262	*
263	* @cfg: translation configuration
264	* @iova: iova to translate
265	* @perm: tentative access type
266	* @tlbe: returned entry
267	* @info: ptw event handle
268	*
269	* return 0 on success
270	*/
271	inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
272	IOMMUTLBEntry tlbe, SMMUPTWEventInfo info)
273	{
274	if (!cfg->aa64) {
275	/*
276	* This code path is not entered as we check this while decoding
277	* the configuration data in the derived SMMU model.
278	*/
279	g_assert_not_reached();
280	}
281
282	return smmu_ptw_64(cfg, iova, perm, tlbe, info);
283	}
527773ee	284
cac994ef EA	285	/**
	286	* The bus number is used for lookup when SID based invalidation occurs.
	287	* In that case we lazily populate the SMMUPciBus array from the bus hash
	288	* table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
	289	* numbers may not be always initialized yet.
	290	*/
	291	SMMUPciBus smmu_find_smmu_pcibus(SMMUState s, uint8_t bus_num)
	292	{
	293	SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
	294
	295	if (!smmu_pci_bus) {
	296	GHashTableIter iter;
	297
	298	g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
	299	while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
	300	if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
	301	s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
	302	return smmu_pci_bus;
	303	}
	304	}
	305	}
	306	return smmu_pci_bus;
	307	}
	308
	309	static AddressSpace smmu_find_add_as(PCIBus bus, void *opaque, int devfn)
	310	{
	311	SMMUState *s = opaque;
	312	SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
	313	SMMUDevice *sdev;
	314
	315	if (!sbus) {
	316	sbus = g_malloc0(sizeof(SMMUPciBus) +
	317	sizeof(SMMUDevice ) SMMU_PCI_DEVFN_MAX);
	318	sbus->bus = bus;
	319	g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
	320	}
	321
	322	sdev = sbus->pbdev[devfn];
	323	if (!sdev) {
	324	char *name = g_strdup_printf("%s-%d-%d",
	325	s->mrtypename,
	326	pci_bus_num(bus), devfn);
	327	sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
	328
	329	sdev->smmu = s;
	330	sdev->bus = bus;
	331	sdev->devfn = devfn;
	332
	333	memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
	334	s->mrtypename,
	335	OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
	336	address_space_init(&sdev->as,
	337	MEMORY_REGION(&sdev->iommu), name);
	338	trace_smmu_add_mr(name);
	339	g_free(name);
	340	}
	341
	342	return &sdev->as;
	343	}
	344
32cfd7f3 EA	345	IOMMUMemoryRegion smmu_iommu_mr(SMMUState s, uint32_t sid)
	346	{
	347	uint8_t bus_n, devfn;
	348	SMMUPciBus *smmu_bus;
	349	SMMUDevice *smmu;
	350
	351	bus_n = PCI_BUS_NUM(sid);
	352	smmu_bus = smmu_find_smmu_pcibus(s, bus_n);
	353	if (smmu_bus) {
b78aae9b	354	devfn = SMMU_PCI_DEVFN(sid);
32cfd7f3 EA	355	smmu = smmu_bus->pbdev[devfn];
	356	if (smmu) {
	357	return &smmu->iommu;
	358	}
	359	}
	360	return NULL;
	361	}
	362
cc27ed81 EA	363	static guint smmu_iotlb_key_hash(gconstpointer v)
	364	{
	365	SMMUIOTLBKey key = (SMMUIOTLBKey )v;
	366	uint32_t a, b, c;
	367
	368	/* Jenkins hash */
	369	a = b = c = JHASH_INITVAL + sizeof(*key);
	370	a += key->asid;
	371	b += extract64(key->iova, 0, 32);
	372	c += extract64(key->iova, 32, 32);
	373
	374	__jhash_mix(a, b, c);
	375	__jhash_final(a, b, c);
	376
	377	return c;
	378	}
	379
	380	static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
	381	{
	382	const SMMUIOTLBKey *k1 = v1;
	383	const SMMUIOTLBKey *k2 = v2;
	384
	385	return (k1->asid == k2->asid) && (k1->iova == k2->iova);
	386	}
	387
832e4222 EA	388	/* Unmap the whole notifier's range */
	389	static void smmu_unmap_notifier_range(IOMMUNotifier *n)
	390	{
	391	IOMMUTLBEntry entry;
	392
	393	entry.target_as = &address_space_memory;
	394	entry.iova = n->start;
	395	entry.perm = IOMMU_NONE;
	396	entry.addr_mask = n->end - n->start;
	397
	398	memory_region_notify_one(n, &entry);
	399	}
	400
	401	/* Unmap all notifiers attached to @mr */
	402	inline void smmu_inv_notifiers_mr(IOMMUMemoryRegion *mr)
	403	{
	404	IOMMUNotifier *n;
	405
	406	trace_smmu_inv_notifiers_mr(mr->parent_obj.name);
	407	IOMMU_NOTIFIER_FOREACH(n, mr) {
	408	smmu_unmap_notifier_range(n);
	409	}
	410	}
	411
	412	/* Unmap all notifiers of all mr's */
	413	void smmu_inv_notifiers_all(SMMUState *s)
	414	{
	415	SMMUNotifierNode *node;
	416
	417	QLIST_FOREACH(node, &s->notifiers_list, next) {
	418	smmu_inv_notifiers_mr(&node->sdev->iommu);
	419	}
	420	}
	421
527773ee EA	422	static void smmu_base_realize(DeviceState dev, Error *errp)
527773ee EA	423	{
cac994ef	424	SMMUState *s = ARM_SMMU(dev);
527773ee EA	425	SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
	426	Error *local_err = NULL;
	427
	428	sbc->parent_realize(dev, &local_err);
	429	if (local_err) {
	430	error_propagate(errp, local_err);
	431	return;
	432	}
32cfd7f3	433	s->configs = g_hash_table_new_full(NULL, NULL, NULL, g_free);
cc27ed81 EA	434	s->iotlb = g_hash_table_new_full(smmu_iotlb_key_hash, smmu_iotlb_key_equal,
cc27ed81 EA	435	g_free, g_free);
cac994ef EA	436	s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
	437
	438	if (s->primary_bus) {
	439	pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
	440	} else {
	441	error_setg(errp, "SMMU is not attached to any PCI bus!");
	442	}
527773ee EA	443	}
	444
	445	static void smmu_base_reset(DeviceState *dev)
	446	{
32cfd7f3 EA	447	SMMUState *s = ARM_SMMU(dev);
	448
	449	g_hash_table_remove_all(s->configs);
cc27ed81	450	g_hash_table_remove_all(s->iotlb);
527773ee EA	451	}
	452
	453	static Property smmu_dev_properties[] = {
	454	DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
	455	DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus, "PCI", PCIBus *),
	456	DEFINE_PROP_END_OF_LIST(),
	457	};
	458
	459	static void smmu_base_class_init(ObjectClass klass, void data)
	460	{
	461	DeviceClass *dc = DEVICE_CLASS(klass);
	462	SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass);
	463
	464	dc->props = smmu_dev_properties;
	465	device_class_set_parent_realize(dc, smmu_base_realize,
	466	&sbc->parent_realize);
	467	dc->reset = smmu_base_reset;
	468	}
	469
	470	static const TypeInfo smmu_base_info = {
	471	.name = TYPE_ARM_SMMU,
	472	.parent = TYPE_SYS_BUS_DEVICE,
	473	.instance_size = sizeof(SMMUState),
	474	.class_data = NULL,
	475	.class_size = sizeof(SMMUBaseClass),
	476	.class_init = smmu_base_class_init,
	477	.abstract = true,
	478	};
	479
	480	static void smmu_base_register_types(void)
	481	{
	482	type_register_static(&smmu_base_info);
	483	}
	484
	485	type_init(smmu_base_register_types)
	486