Merge remote-tracking branch 'remotes/philmd-gitlab/tags/renesas-20201027' into staging
[qemu.git] / hw / arm / smmu-common.c
1 /*
2 * Copyright (C) 2014-2016 Broadcom Corporation
3 * Copyright (c) 2017 Red Hat, Inc.
4 * Written by Prem Mallappa, Eric Auger
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * Author: Prem Mallappa <pmallapp@broadcom.com>
16 *
17 */
18
19 #include "qemu/osdep.h"
20 #include "exec/address-spaces.h"
21 #include "trace.h"
22 #include "exec/target_page.h"
23 #include "hw/core/cpu.h"
24 #include "hw/qdev-properties.h"
25 #include "qapi/error.h"
26 #include "qemu/jhash.h"
27 #include "qemu/module.h"
28
29 #include "qemu/error-report.h"
30 #include "hw/arm/smmu-common.h"
31 #include "smmu-internal.h"
32
33 /* IOTLB Management */
34
35 static guint smmu_iotlb_key_hash(gconstpointer v)
36 {
37 SMMUIOTLBKey *key = (SMMUIOTLBKey *)v;
38 uint32_t a, b, c;
39
40 /* Jenkins hash */
41 a = b = c = JHASH_INITVAL + sizeof(*key);
42 a += key->asid + key->level + key->tg;
43 b += extract64(key->iova, 0, 32);
44 c += extract64(key->iova, 32, 32);
45
46 __jhash_mix(a, b, c);
47 __jhash_final(a, b, c);
48
49 return c;
50 }
51
52 static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
53 {
54 SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
55
56 return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
57 (k1->level == k2->level) && (k1->tg == k2->tg);
58 }
59
60 SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
61 uint8_t tg, uint8_t level)
62 {
63 SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
64
65 return key;
66 }
67
68 SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
69 SMMUTransTableInfo *tt, hwaddr iova)
70 {
71 uint8_t tg = (tt->granule_sz - 10) / 2;
72 uint8_t inputsize = 64 - tt->tsz;
73 uint8_t stride = tt->granule_sz - 3;
74 uint8_t level = 4 - (inputsize - 4) / stride;
75 SMMUTLBEntry *entry = NULL;
76
77 while (level <= 3) {
78 uint64_t subpage_size = 1ULL << level_shift(level, tt->granule_sz);
79 uint64_t mask = subpage_size - 1;
80 SMMUIOTLBKey key;
81
82 key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
83 entry = g_hash_table_lookup(bs->iotlb, &key);
84 if (entry) {
85 break;
86 }
87 level++;
88 }
89
90 if (entry) {
91 cfg->iotlb_hits++;
92 trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
93 cfg->iotlb_hits, cfg->iotlb_misses,
94 100 * cfg->iotlb_hits /
95 (cfg->iotlb_hits + cfg->iotlb_misses));
96 } else {
97 cfg->iotlb_misses++;
98 trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
99 cfg->iotlb_hits, cfg->iotlb_misses,
100 100 * cfg->iotlb_hits /
101 (cfg->iotlb_hits + cfg->iotlb_misses));
102 }
103 return entry;
104 }
105
106 void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
107 {
108 SMMUIOTLBKey *key = g_new0(SMMUIOTLBKey, 1);
109 uint8_t tg = (new->granule - 10) / 2;
110
111 if (g_hash_table_size(bs->iotlb) >= SMMU_IOTLB_MAX_SIZE) {
112 smmu_iotlb_inv_all(bs);
113 }
114
115 *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
116 trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
117 g_hash_table_insert(bs->iotlb, key, new);
118 }
119
120 inline void smmu_iotlb_inv_all(SMMUState *s)
121 {
122 trace_smmu_iotlb_inv_all();
123 g_hash_table_remove_all(s->iotlb);
124 }
125
126 static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
127 gpointer user_data)
128 {
129 uint16_t asid = *(uint16_t *)user_data;
130 SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
131
132 return SMMU_IOTLB_ASID(*iotlb_key) == asid;
133 }
134
135 static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
136 gpointer user_data)
137 {
138 SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
139 IOMMUTLBEntry *entry = &iter->entry;
140 SMMUIOTLBPageInvInfo *info = (SMMUIOTLBPageInvInfo *)user_data;
141 SMMUIOTLBKey iotlb_key = *(SMMUIOTLBKey *)key;
142
143 if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
144 return false;
145 }
146 return ((info->iova & ~entry->addr_mask) == entry->iova) ||
147 ((entry->iova & ~info->mask) == info->iova);
148 }
149
150 inline void
151 smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
152 uint8_t tg, uint64_t num_pages, uint8_t ttl)
153 {
154 if (ttl && (num_pages == 1)) {
155 SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
156
157 g_hash_table_remove(s->iotlb, &key);
158 } else {
159 /* if tg is not set we use 4KB range invalidation */
160 uint8_t granule = tg ? tg * 2 + 10 : 12;
161
162 SMMUIOTLBPageInvInfo info = {
163 .asid = asid, .iova = iova,
164 .mask = (num_pages * 1 << granule) - 1};
165
166 g_hash_table_foreach_remove(s->iotlb,
167 smmu_hash_remove_by_asid_iova,
168 &info);
169 }
170 }
171
172 inline void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
173 {
174 trace_smmu_iotlb_inv_asid(asid);
175 g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
176 }
177
178 /* VMSAv8-64 Translation */
179
180 /**
181 * get_pte - Get the content of a page table entry located at
182 * @base_addr[@index]
183 */
184 static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
185 SMMUPTWEventInfo *info)
186 {
187 int ret;
188 dma_addr_t addr = baseaddr + index * sizeof(*pte);
189
190 /* TODO: guarantee 64-bit single-copy atomicity */
191 ret = dma_memory_read(&address_space_memory, addr, pte, sizeof(*pte));
192
193 if (ret != MEMTX_OK) {
194 info->type = SMMU_PTW_ERR_WALK_EABT;
195 info->addr = addr;
196 return -EINVAL;
197 }
198 trace_smmu_get_pte(baseaddr, index, addr, *pte);
199 return 0;
200 }
201
202 /* VMSAv8-64 Translation Table Format Descriptor Decoding */
203
204 /**
205 * get_page_pte_address - returns the L3 descriptor output address,
206 * ie. the page frame
207 * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
208 */
209 static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
210 {
211 return PTE_ADDRESS(pte, granule_sz);
212 }
213
214 /**
215 * get_table_pte_address - return table descriptor output address,
216 * ie. address of next level table
217 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
218 */
219 static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
220 {
221 return PTE_ADDRESS(pte, granule_sz);
222 }
223
224 /**
225 * get_block_pte_address - return block descriptor output address and block size
226 * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
227 */
228 static inline hwaddr get_block_pte_address(uint64_t pte, int level,
229 int granule_sz, uint64_t *bsz)
230 {
231 int n = level_shift(level, granule_sz);
232
233 *bsz = 1ULL << n;
234 return PTE_ADDRESS(pte, n);
235 }
236
237 SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
238 {
239 bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
240 uint8_t tbi_byte = tbi * 8;
241
242 if (cfg->tt[0].tsz &&
243 !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
244 /* there is a ttbr0 region and we are in it (high bits all zero) */
245 return &cfg->tt[0];
246 } else if (cfg->tt[1].tsz &&
247 !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
248 /* there is a ttbr1 region and we are in it (high bits all one) */
249 return &cfg->tt[1];
250 } else if (!cfg->tt[0].tsz) {
251 /* ttbr0 region is "everything not in the ttbr1 region" */
252 return &cfg->tt[0];
253 } else if (!cfg->tt[1].tsz) {
254 /* ttbr1 region is "everything not in the ttbr0 region" */
255 return &cfg->tt[1];
256 }
257 /* in the gap between the two regions, this is a Translation fault */
258 return NULL;
259 }
260
261 /**
262 * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
263 * @cfg: translation config
264 * @iova: iova to translate
265 * @perm: access type
266 * @tlbe: SMMUTLBEntry (out)
267 * @info: handle to an error info
268 *
269 * Return 0 on success, < 0 on error. In case of error, @info is filled
270 * and tlbe->perm is set to IOMMU_NONE.
271 * Upon success, @tlbe is filled with translated_addr and entry
272 * permission rights.
273 */
274 static int smmu_ptw_64(SMMUTransCfg *cfg,
275 dma_addr_t iova, IOMMUAccessFlags perm,
276 SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
277 {
278 dma_addr_t baseaddr, indexmask;
279 int stage = cfg->stage;
280 SMMUTransTableInfo *tt = select_tt(cfg, iova);
281 uint8_t level, granule_sz, inputsize, stride;
282
283 if (!tt || tt->disabled) {
284 info->type = SMMU_PTW_ERR_TRANSLATION;
285 goto error;
286 }
287
288 granule_sz = tt->granule_sz;
289 stride = granule_sz - 3;
290 inputsize = 64 - tt->tsz;
291 level = 4 - (inputsize - 4) / stride;
292 indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
293 baseaddr = extract64(tt->ttb, 0, 48);
294 baseaddr &= ~indexmask;
295
296 while (level <= 3) {
297 uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
298 uint64_t mask = subpage_size - 1;
299 uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
300 uint64_t pte, gpa;
301 dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
302 uint8_t ap;
303
304 if (get_pte(baseaddr, offset, &pte, info)) {
305 goto error;
306 }
307 trace_smmu_ptw_level(level, iova, subpage_size,
308 baseaddr, offset, pte);
309
310 if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
311 trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
312 pte_addr, offset, pte);
313 break;
314 }
315
316 if (is_table_pte(pte, level)) {
317 ap = PTE_APTABLE(pte);
318
319 if (is_permission_fault(ap, perm) && !tt->had) {
320 info->type = SMMU_PTW_ERR_PERMISSION;
321 goto error;
322 }
323 baseaddr = get_table_pte_address(pte, granule_sz);
324 level++;
325 continue;
326 } else if (is_page_pte(pte, level)) {
327 gpa = get_page_pte_address(pte, granule_sz);
328 trace_smmu_ptw_page_pte(stage, level, iova,
329 baseaddr, pte_addr, pte, gpa);
330 } else {
331 uint64_t block_size;
332
333 gpa = get_block_pte_address(pte, level, granule_sz,
334 &block_size);
335 trace_smmu_ptw_block_pte(stage, level, baseaddr,
336 pte_addr, pte, iova, gpa,
337 block_size >> 20);
338 }
339 ap = PTE_AP(pte);
340 if (is_permission_fault(ap, perm)) {
341 info->type = SMMU_PTW_ERR_PERMISSION;
342 goto error;
343 }
344
345 tlbe->entry.translated_addr = gpa;
346 tlbe->entry.iova = iova & ~mask;
347 tlbe->entry.addr_mask = mask;
348 tlbe->entry.perm = PTE_AP_TO_PERM(ap);
349 tlbe->level = level;
350 tlbe->granule = granule_sz;
351 return 0;
352 }
353 info->type = SMMU_PTW_ERR_TRANSLATION;
354
355 error:
356 tlbe->entry.perm = IOMMU_NONE;
357 return -EINVAL;
358 }
359
360 /**
361 * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
362 *
363 * @cfg: translation configuration
364 * @iova: iova to translate
365 * @perm: tentative access type
366 * @tlbe: returned entry
367 * @info: ptw event handle
368 *
369 * return 0 on success
370 */
371 inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
372 SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
373 {
374 if (!cfg->aa64) {
375 /*
376 * This code path is not entered as we check this while decoding
377 * the configuration data in the derived SMMU model.
378 */
379 g_assert_not_reached();
380 }
381
382 return smmu_ptw_64(cfg, iova, perm, tlbe, info);
383 }
384
385 /**
386 * The bus number is used for lookup when SID based invalidation occurs.
387 * In that case we lazily populate the SMMUPciBus array from the bus hash
388 * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
389 * numbers may not be always initialized yet.
390 */
391 SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
392 {
393 SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
394 GHashTableIter iter;
395
396 if (smmu_pci_bus) {
397 return smmu_pci_bus;
398 }
399
400 g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
401 while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
402 if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
403 s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
404 return smmu_pci_bus;
405 }
406 }
407
408 return NULL;
409 }
410
411 static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
412 {
413 SMMUState *s = opaque;
414 SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
415 SMMUDevice *sdev;
416 static unsigned int index;
417
418 if (!sbus) {
419 sbus = g_malloc0(sizeof(SMMUPciBus) +
420 sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
421 sbus->bus = bus;
422 g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
423 }
424
425 sdev = sbus->pbdev[devfn];
426 if (!sdev) {
427 char *name = g_strdup_printf("%s-%d-%d", s->mrtypename, devfn, index++);
428
429 sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
430
431 sdev->smmu = s;
432 sdev->bus = bus;
433 sdev->devfn = devfn;
434
435 memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
436 s->mrtypename,
437 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
438 address_space_init(&sdev->as,
439 MEMORY_REGION(&sdev->iommu), name);
440 trace_smmu_add_mr(name);
441 g_free(name);
442 }
443
444 return &sdev->as;
445 }
446
447 IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid)
448 {
449 uint8_t bus_n, devfn;
450 SMMUPciBus *smmu_bus;
451 SMMUDevice *smmu;
452
453 bus_n = PCI_BUS_NUM(sid);
454 smmu_bus = smmu_find_smmu_pcibus(s, bus_n);
455 if (smmu_bus) {
456 devfn = SMMU_PCI_DEVFN(sid);
457 smmu = smmu_bus->pbdev[devfn];
458 if (smmu) {
459 return &smmu->iommu;
460 }
461 }
462 return NULL;
463 }
464
465 /* Unmap the whole notifier's range */
466 static void smmu_unmap_notifier_range(IOMMUNotifier *n)
467 {
468 IOMMUTLBEntry entry;
469
470 entry.target_as = &address_space_memory;
471 entry.iova = n->start;
472 entry.perm = IOMMU_NONE;
473 entry.addr_mask = n->end - n->start;
474
475 memory_region_notify_one(n, &entry);
476 }
477
478 /* Unmap all notifiers attached to @mr */
479 inline void smmu_inv_notifiers_mr(IOMMUMemoryRegion *mr)
480 {
481 IOMMUNotifier *n;
482
483 trace_smmu_inv_notifiers_mr(mr->parent_obj.name);
484 IOMMU_NOTIFIER_FOREACH(n, mr) {
485 smmu_unmap_notifier_range(n);
486 }
487 }
488
489 /* Unmap all notifiers of all mr's */
490 void smmu_inv_notifiers_all(SMMUState *s)
491 {
492 SMMUDevice *sdev;
493
494 QLIST_FOREACH(sdev, &s->devices_with_notifiers, next) {
495 smmu_inv_notifiers_mr(&sdev->iommu);
496 }
497 }
498
499 static void smmu_base_realize(DeviceState *dev, Error **errp)
500 {
501 SMMUState *s = ARM_SMMU(dev);
502 SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
503 Error *local_err = NULL;
504
505 sbc->parent_realize(dev, &local_err);
506 if (local_err) {
507 error_propagate(errp, local_err);
508 return;
509 }
510 s->configs = g_hash_table_new_full(NULL, NULL, NULL, g_free);
511 s->iotlb = g_hash_table_new_full(smmu_iotlb_key_hash, smmu_iotlb_key_equal,
512 g_free, g_free);
513 s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
514
515 if (s->primary_bus) {
516 pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
517 } else {
518 error_setg(errp, "SMMU is not attached to any PCI bus!");
519 }
520 }
521
522 static void smmu_base_reset(DeviceState *dev)
523 {
524 SMMUState *s = ARM_SMMU(dev);
525
526 g_hash_table_remove_all(s->configs);
527 g_hash_table_remove_all(s->iotlb);
528 }
529
530 static Property smmu_dev_properties[] = {
531 DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
532 DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus, "PCI", PCIBus *),
533 DEFINE_PROP_END_OF_LIST(),
534 };
535
536 static void smmu_base_class_init(ObjectClass *klass, void *data)
537 {
538 DeviceClass *dc = DEVICE_CLASS(klass);
539 SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass);
540
541 device_class_set_props(dc, smmu_dev_properties);
542 device_class_set_parent_realize(dc, smmu_base_realize,
543 &sbc->parent_realize);
544 dc->reset = smmu_base_reset;
545 }
546
547 static const TypeInfo smmu_base_info = {
548 .name = TYPE_ARM_SMMU,
549 .parent = TYPE_SYS_BUS_DEVICE,
550 .instance_size = sizeof(SMMUState),
551 .class_data = NULL,
552 .class_size = sizeof(SMMUBaseClass),
553 .class_init = smmu_base_class_init,
554 .abstract = true,
555 };
556
557 static void smmu_base_register_types(void)
558 {
559 type_register_static(&smmu_base_info);
560 }
561
562 type_init(smmu_base_register_types)
563