[mirror_qemu.git] / hw / sparc / sun4m_iommu.c

/*
 * QEMU Sun4m iommu emulation
 *
 * Copyright (c) 2003-2005 Fabrice Bellard
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

#include "qemu/osdep.h"
#include "hw/irq.h"
#include "hw/qdev-properties.h"
#include "hw/sparc/sun4m_iommu.h"
#include "hw/sysbus.h"
#include "migration/vmstate.h"
#include "qemu/module.h"
#include "exec/address-spaces.h"
#include "trace.h"

/*
 * I/O MMU used by Sun4m systems
 *
 * Chipset docs:
 * "Sun-4M System Architecture (revision 2.0) by Chuck Narad", 950-1373-01,
 * http://mediacast.sun.com/users/Barton808/media/Sun4M_SystemArchitecture_edited2.pdf
 */

#define IOMMU_CTRL          (0x0000 >> 2)
#define IOMMU_CTRL_IMPL     0xf0000000 /* Implementation */
#define IOMMU_CTRL_VERS     0x0f000000 /* Version */
#define IOMMU_CTRL_RNGE     0x0000001c /* Mapping RANGE */
#define IOMMU_RNGE_16MB     0x00000000 /* 0xff000000 -> 0xffffffff */
#define IOMMU_RNGE_32MB     0x00000004 /* 0xfe000000 -> 0xffffffff */
#define IOMMU_RNGE_64MB     0x00000008 /* 0xfc000000 -> 0xffffffff */
#define IOMMU_RNGE_128MB    0x0000000c /* 0xf8000000 -> 0xffffffff */
#define IOMMU_RNGE_256MB    0x00000010 /* 0xf0000000 -> 0xffffffff */
#define IOMMU_RNGE_512MB    0x00000014 /* 0xe0000000 -> 0xffffffff */
#define IOMMU_RNGE_1GB      0x00000018 /* 0xc0000000 -> 0xffffffff */
#define IOMMU_RNGE_2GB      0x0000001c /* 0x80000000 -> 0xffffffff */
#define IOMMU_CTRL_ENAB     0x00000001 /* IOMMU Enable */
#define IOMMU_CTRL_MASK     0x0000001d

#define IOMMU_BASE          (0x0004 >> 2)
#define IOMMU_BASE_MASK     0x07fffc00

#define IOMMU_TLBFLUSH      (0x0014 >> 2)
#define IOMMU_TLBFLUSH_MASK 0xffffffff

#define IOMMU_PGFLUSH       (0x0018 >> 2)
#define IOMMU_PGFLUSH_MASK  0xffffffff

#define IOMMU_AFSR          (0x1000 >> 2)
#define IOMMU_AFSR_ERR      0x80000000 /* LE, TO, or BE asserted */
#define IOMMU_AFSR_LE       0x40000000 /* SBUS reports error after
                                          transaction */
#define IOMMU_AFSR_TO       0x20000000 /* Write access took more than
                                          12.8 us. */
#define IOMMU_AFSR_BE       0x10000000 /* Write access received error
                                          acknowledge */
#define IOMMU_AFSR_SIZE     0x0e000000 /* Size of transaction causing error */
#define IOMMU_AFSR_S        0x01000000 /* Sparc was in supervisor mode */
#define IOMMU_AFSR_RESV     0x00800000 /* Reserved, forced to 0x8 by
                                          hardware */
#define IOMMU_AFSR_ME       0x00080000 /* Multiple errors occurred */
#define IOMMU_AFSR_RD       0x00040000 /* A read operation was in progress */
#define IOMMU_AFSR_FAV      0x00020000 /* IOMMU afar has valid contents */
#define IOMMU_AFSR_MASK     0xff0fffff

#define IOMMU_AFAR          (0x1004 >> 2)

#define IOMMU_AER           (0x1008 >> 2) /* Arbiter Enable Register */
#define IOMMU_AER_EN_P0_ARB 0x00000001    /* MBus master 0x8 (Always 1) */
#define IOMMU_AER_EN_P1_ARB 0x00000002    /* MBus master 0x9 */
#define IOMMU_AER_EN_P2_ARB 0x00000004    /* MBus master 0xa */
#define IOMMU_AER_EN_P3_ARB 0x00000008    /* MBus master 0xb */
#define IOMMU_AER_EN_0      0x00010000    /* SBus slot 0 */
#define IOMMU_AER_EN_1      0x00020000    /* SBus slot 1 */
#define IOMMU_AER_EN_2      0x00040000    /* SBus slot 2 */
#define IOMMU_AER_EN_3      0x00080000    /* SBus slot 3 */
#define IOMMU_AER_EN_F      0x00100000    /* SBus on-board */
#define IOMMU_AER_SBW       0x80000000    /* S-to-M asynchronous writes */
#define IOMMU_AER_MASK      0x801f000f

#define IOMMU_SBCFG0        (0x1010 >> 2) /* SBUS configration per-slot */
#define IOMMU_SBCFG1        (0x1014 >> 2) /* SBUS configration per-slot */
#define IOMMU_SBCFG2        (0x1018 >> 2) /* SBUS configration per-slot */
#define IOMMU_SBCFG3        (0x101c >> 2) /* SBUS configration per-slot */
#define IOMMU_SBCFG_SAB30   0x00010000 /* Phys-address bit 30 when
                                          bypass enabled */
#define IOMMU_SBCFG_BA16    0x00000004 /* Slave supports 16 byte bursts */
#define IOMMU_SBCFG_BA8     0x00000002 /* Slave supports 8 byte bursts */
#define IOMMU_SBCFG_BYPASS  0x00000001 /* Bypass IOMMU, treat all addresses
                                          produced by this device as pure
                                          physical. */
#define IOMMU_SBCFG_MASK    0x00010003

#define IOMMU_ARBEN         (0x2000 >> 2) /* SBUS arbitration enable */
#define IOMMU_ARBEN_MASK    0x001f0000
#define IOMMU_MID           0x00000008

#define IOMMU_MASK_ID       (0x3018 >> 2) /* Mask ID */
#define IOMMU_MASK_ID_MASK  0x00ffffff

#define IOMMU_MSII_MASK     0x26000000 /* microSPARC II mask number */
#define IOMMU_TS_MASK       0x23000000 /* turboSPARC mask number */

/* The format of an iopte in the page tables */
#define IOPTE_PAGE          0xffffff00 /* Physical page number (PA[35:12]) */
#define IOPTE_CACHE         0x00000080 /* Cached (in vme IOCACHE or
                                          Viking/MXCC) */
#define IOPTE_WRITE         0x00000004 /* Writable */
#define IOPTE_VALID         0x00000002 /* IOPTE is valid */
#define IOPTE_WAZ           0x00000001 /* Write as zeros */

#define IOMMU_PAGE_SHIFT    12
#define IOMMU_PAGE_SIZE     (1 << IOMMU_PAGE_SHIFT)
#define IOMMU_PAGE_MASK     (~(IOMMU_PAGE_SIZE - 1))

static uint64_t iommu_mem_read(void *opaque, hwaddr addr,
                               unsigned size)
{
    IOMMUState *s = opaque;
    hwaddr saddr;
    uint32_t ret;

    saddr = addr >> 2;
    switch (saddr) {
    default:
        ret = s->regs[saddr];
        break;
    case IOMMU_AFAR:
    case IOMMU_AFSR:
        ret = s->regs[saddr];
        qemu_irq_lower(s->irq);
        break;
    }
    trace_sun4m_iommu_mem_readl(saddr, ret);
    return ret;
}

static void iommu_mem_write(void *opaque, hwaddr addr,
                            uint64_t val, unsigned size)
{
    IOMMUState *s = opaque;
    hwaddr saddr;

    saddr = addr >> 2;
    trace_sun4m_iommu_mem_writel(saddr, val);
    switch (saddr) {
    case IOMMU_CTRL:
        switch (val & IOMMU_CTRL_RNGE) {
        case IOMMU_RNGE_16MB:
            s->iostart = 0xffffffffff000000ULL;
            break;
        case IOMMU_RNGE_32MB:
            s->iostart = 0xfffffffffe000000ULL;
            break;
        case IOMMU_RNGE_64MB:
            s->iostart = 0xfffffffffc000000ULL;
            break;
        case IOMMU_RNGE_128MB:
            s->iostart = 0xfffffffff8000000ULL;
            break;
        case IOMMU_RNGE_256MB:
            s->iostart = 0xfffffffff0000000ULL;
            break;
        case IOMMU_RNGE_512MB:
            s->iostart = 0xffffffffe0000000ULL;
            break;
        case IOMMU_RNGE_1GB:
            s->iostart = 0xffffffffc0000000ULL;
            break;
        default:
        case IOMMU_RNGE_2GB:
            s->iostart = 0xffffffff80000000ULL;
            break;
        }
        trace_sun4m_iommu_mem_writel_ctrl(s->iostart);
        s->regs[saddr] = ((val & IOMMU_CTRL_MASK) | s->version);
        break;
    case IOMMU_BASE:
        s->regs[saddr] = val & IOMMU_BASE_MASK;
        break;
    case IOMMU_TLBFLUSH:
        trace_sun4m_iommu_mem_writel_tlbflush(val);
        s->regs[saddr] = val & IOMMU_TLBFLUSH_MASK;
        break;
    case IOMMU_PGFLUSH:
        trace_sun4m_iommu_mem_writel_pgflush(val);
        s->regs[saddr] = val & IOMMU_PGFLUSH_MASK;
        break;
    case IOMMU_AFAR:
        s->regs[saddr] = val;
        qemu_irq_lower(s->irq);
        break;
    case IOMMU_AER:
        s->regs[saddr] = (val & IOMMU_AER_MASK) | IOMMU_AER_EN_P0_ARB;
        break;
    case IOMMU_AFSR:
        s->regs[saddr] = (val & IOMMU_AFSR_MASK) | IOMMU_AFSR_RESV;
        qemu_irq_lower(s->irq);
        break;
    case IOMMU_SBCFG0:
    case IOMMU_SBCFG1:
    case IOMMU_SBCFG2:
    case IOMMU_SBCFG3:
        s->regs[saddr] = val & IOMMU_SBCFG_MASK;
        break;
    case IOMMU_ARBEN:
        /* XXX implement SBus probing: fault when reading unmapped
           addresses, fault cause and address stored to MMU/IOMMU */
        s->regs[saddr] = (val & IOMMU_ARBEN_MASK) | IOMMU_MID;
        break;
    case IOMMU_MASK_ID:
        s->regs[saddr] |= val & IOMMU_MASK_ID_MASK;
        break;
    default:
        s->regs[saddr] = val;
        break;
    }
}

static const MemoryRegionOps iommu_mem_ops = {
    .read = iommu_mem_read,
    .write = iommu_mem_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
    .valid = {
        .min_access_size = 4,
        .max_access_size = 4,
    },
};

static uint32_t iommu_page_get_flags(IOMMUState *s, hwaddr addr)
{
    uint32_t ret;
    hwaddr iopte;
    hwaddr pa = addr;

    iopte = s->regs[IOMMU_BASE] << 4;
    addr &= ~s->iostart;
    iopte += (addr >> (IOMMU_PAGE_SHIFT - 2)) & ~3;
    ret = address_space_ldl_be(&address_space_memory, iopte,
                               MEMTXATTRS_UNSPECIFIED, NULL);
    trace_sun4m_iommu_page_get_flags(pa, iopte, ret);
    return ret;
}

static hwaddr iommu_translate_pa(hwaddr addr,
                                             uint32_t pte)
{
    hwaddr pa;

    pa = ((pte & IOPTE_PAGE) << 4) + (addr & ~IOMMU_PAGE_MASK);
    trace_sun4m_iommu_translate_pa(addr, pa, pte);
    return pa;
}

static void iommu_bad_addr(IOMMUState *s, hwaddr addr,
                           int is_write)
{
    trace_sun4m_iommu_bad_addr(addr);
    s->regs[IOMMU_AFSR] = IOMMU_AFSR_ERR | IOMMU_AFSR_LE | IOMMU_AFSR_RESV |
        IOMMU_AFSR_FAV;
    if (!is_write) {
        s->regs[IOMMU_AFSR] |= IOMMU_AFSR_RD;
    }
    s->regs[IOMMU_AFAR] = addr;
    qemu_irq_raise(s->irq);
}

/* Called from RCU critical section */
static IOMMUTLBEntry sun4m_translate_iommu(IOMMUMemoryRegion *iommu,
                                           hwaddr addr,
                                           IOMMUAccessFlags flags,
                                           int iommu_idx)
{
    IOMMUState *is = container_of(iommu, IOMMUState, iommu);
    hwaddr page, pa;
    int is_write = (flags & IOMMU_WO) ? 1 : 0;
    uint32_t pte;
    IOMMUTLBEntry ret = {
        .target_as = &address_space_memory,
        .iova = 0,
        .translated_addr = 0,
        .addr_mask = ~(hwaddr)0,
        .perm = IOMMU_NONE,
    };

    page = addr & IOMMU_PAGE_MASK;
    pte = iommu_page_get_flags(is, page);
    if (!(pte & IOPTE_VALID)) {
        iommu_bad_addr(is, page, is_write);
        return ret;
    }

    pa = iommu_translate_pa(addr, pte);
    if (is_write && !(pte & IOPTE_WRITE)) {
        iommu_bad_addr(is, page, is_write);
        return ret;
    }

    if (pte & IOPTE_WRITE) {
        ret.perm = IOMMU_RW;
    } else {
        ret.perm = IOMMU_RO;
    }

    ret.iova = page;
    ret.translated_addr = pa;
    ret.addr_mask = ~IOMMU_PAGE_MASK;

    return ret;
}

static const VMStateDescription vmstate_iommu = {
    .name = "iommu",
    .version_id = 2,
    .minimum_version_id = 2,
    .fields = (VMStateField[]) {
        VMSTATE_UINT32_ARRAY(regs, IOMMUState, IOMMU_NREGS),
        VMSTATE_UINT64(iostart, IOMMUState),
        VMSTATE_END_OF_LIST()
    }
};

static void iommu_reset(DeviceState *d)
{
    IOMMUState *s = SUN4M_IOMMU(d);

    memset(s->regs, 0, IOMMU_NREGS * 4);
    s->iostart = 0;
    s->regs[IOMMU_CTRL] = s->version;
    s->regs[IOMMU_ARBEN] = IOMMU_MID;
    s->regs[IOMMU_AFSR] = IOMMU_AFSR_RESV;
    s->regs[IOMMU_AER] = IOMMU_AER_EN_P0_ARB | IOMMU_AER_EN_P1_ARB;
    s->regs[IOMMU_MASK_ID] = IOMMU_TS_MASK;
}

static void iommu_init(Object *obj)
{
    IOMMUState *s = SUN4M_IOMMU(obj);
    SysBusDevice *dev = SYS_BUS_DEVICE(obj);

    memory_region_init_iommu(&s->iommu, sizeof(s->iommu),
                             TYPE_SUN4M_IOMMU_MEMORY_REGION, OBJECT(dev),
                             "iommu-sun4m", UINT64_MAX);
    address_space_init(&s->iommu_as, MEMORY_REGION(&s->iommu), "iommu-as");

    sysbus_init_irq(dev, &s->irq);

    memory_region_init_io(&s->iomem, obj, &iommu_mem_ops, s, "iommu",
                          IOMMU_NREGS * sizeof(uint32_t));
    sysbus_init_mmio(dev, &s->iomem);
}

static Property iommu_properties[] = {
    DEFINE_PROP_UINT32("version", IOMMUState, version, 0),
    DEFINE_PROP_END_OF_LIST(),
};

static void iommu_class_init(ObjectClass *klass, void *data)
{
    DeviceClass *dc = DEVICE_CLASS(klass);

    dc->reset = iommu_reset;
    dc->vmsd = &vmstate_iommu;
    dc->props = iommu_properties;
}

static const TypeInfo iommu_info = {
    .name          = TYPE_SUN4M_IOMMU,
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(IOMMUState),
    .instance_init = iommu_init,
    .class_init    = iommu_class_init,
};

static void sun4m_iommu_memory_region_class_init(ObjectClass *klass, void *data)
{
    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);

    imrc->translate = sun4m_translate_iommu;
}

static const TypeInfo sun4m_iommu_memory_region_info = {
    .parent = TYPE_IOMMU_MEMORY_REGION,
    .name = TYPE_SUN4M_IOMMU_MEMORY_REGION,
    .class_init = sun4m_iommu_memory_region_class_init,
};

static void iommu_register_types(void)
{
    type_register_static(&iommu_info);
    type_register_static(&sun4m_iommu_memory_region_info);
}

type_init(iommu_register_types)
Commit	Line	Data
420557e8	1	/*
93c5a32f	2	* QEMU Sun4m iommu emulation
420557e8	3	*
66321a11	4	* Copyright (c) 2003-2005 Fabrice Bellard
5fafdf24	5	*
420557e8 FB	6	* Permission is hereby granted, free of charge, to any person obtaining a copy
	7	* of this software and associated documentation files (the "Software"), to deal
	8	* in the Software without restriction, including without limitation the rights
	9	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	10	* copies of the Software, and to permit persons to whom the Software is
	11	* furnished to do so, subject to the following conditions:
	12	*
	13	* The above copyright notice and this permission notice shall be included in
	14	* all copies or substantial portions of the Software.
	15	*
	16	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	17	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	18	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
	19	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	20	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	21	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
	22	* THE SOFTWARE.
	23	*/
5f750b2e	24
0430891c	25	#include "qemu/osdep.h"
64552b6b	26	#include "hw/irq.h"
a27bd6c7	27	#include "hw/qdev-properties.h"
1527f488	28	#include "hw/sparc/sun4m_iommu.h"
83c9f4ca	29	#include "hw/sysbus.h"
d6454270	30	#include "migration/vmstate.h"
0b8fa32f	31	#include "qemu/module.h"
fdfba1a2	32	#include "exec/address-spaces.h"
97bf4851	33	#include "trace.h"
420557e8	34
93c5a32f BS	35	/*
	36	* I/O MMU used by Sun4m systems
	37	*
	38	* Chipset docs:
	39	* "Sun-4M System Architecture (revision 2.0) by Chuck Narad", 950-1373-01,
	40	* http://mediacast.sun.com/users/Barton808/media/Sun4M_SystemArchitecture_edited2.pdf
	41	*/
	42
4e3b1ea1	43	#define IOMMU_CTRL (0x0000 >> 2)
420557e8 FB	44	#define IOMMU_CTRL_IMPL 0xf0000000 /* Implementation */
	45	#define IOMMU_CTRL_VERS 0x0f000000 /* Version */
	46	#define IOMMU_CTRL_RNGE 0x0000001c /* Mapping RANGE */
	47	#define IOMMU_RNGE_16MB 0x00000000 /* 0xff000000 -> 0xffffffff */
	48	#define IOMMU_RNGE_32MB 0x00000004 /* 0xfe000000 -> 0xffffffff */
	49	#define IOMMU_RNGE_64MB 0x00000008 /* 0xfc000000 -> 0xffffffff */
	50	#define IOMMU_RNGE_128MB 0x0000000c /* 0xf8000000 -> 0xffffffff */
	51	#define IOMMU_RNGE_256MB 0x00000010 /* 0xf0000000 -> 0xffffffff */
	52	#define IOMMU_RNGE_512MB 0x00000014 /* 0xe0000000 -> 0xffffffff */
	53	#define IOMMU_RNGE_1GB 0x00000018 /* 0xc0000000 -> 0xffffffff */
	54	#define IOMMU_RNGE_2GB 0x0000001c /* 0x80000000 -> 0xffffffff */
	55	#define IOMMU_CTRL_ENAB 0x00000001 /* IOMMU Enable */
4e3b1ea1 FB	56	#define IOMMU_CTRL_MASK 0x0000001d
	57
	58	#define IOMMU_BASE (0x0004 >> 2)
	59	#define IOMMU_BASE_MASK 0x07fffc00
	60
	61	#define IOMMU_TLBFLUSH (0x0014 >> 2)
	62	#define IOMMU_TLBFLUSH_MASK 0xffffffff
	63
	64	#define IOMMU_PGFLUSH (0x0018 >> 2)
	65	#define IOMMU_PGFLUSH_MASK 0xffffffff
	66
225d4be7 BS	67	#define IOMMU_AFSR (0x1000 >> 2)
225d4be7 BS	68	#define IOMMU_AFSR_ERR 0x80000000 /* LE, TO, or BE asserted */
5ad6bb97 BS	69	#define IOMMU_AFSR_LE 0x40000000 /* SBUS reports error after
	70	transaction */
	71	#define IOMMU_AFSR_TO 0x20000000 /* Write access took more than
	72	12.8 us. */
	73	#define IOMMU_AFSR_BE 0x10000000 /* Write access received error
	74	acknowledge */
225d4be7 BS	75	#define IOMMU_AFSR_SIZE 0x0e000000 /* Size of transaction causing error */
225d4be7 BS	76	#define IOMMU_AFSR_S 0x01000000 /* Sparc was in supervisor mode */
5ad6bb97 BS	77	#define IOMMU_AFSR_RESV 0x00800000 /* Reserved, forced to 0x8 by
5ad6bb97 BS	78	hardware */
225d4be7 BS	79	#define IOMMU_AFSR_ME 0x00080000 /* Multiple errors occurred */
	80	#define IOMMU_AFSR_RD 0x00040000 /* A read operation was in progress */
	81	#define IOMMU_AFSR_FAV 0x00020000 /* IOMMU afar has valid contents */
c52428fc	82	#define IOMMU_AFSR_MASK 0xff0fffff
225d4be7 BS	83
	84	#define IOMMU_AFAR (0x1004 >> 2)
	85
7b169687 BS	86	#define IOMMU_AER (0x1008 >> 2) /* Arbiter Enable Register */
	87	#define IOMMU_AER_EN_P0_ARB 0x00000001 /* MBus master 0x8 (Always 1) */
	88	#define IOMMU_AER_EN_P1_ARB 0x00000002 /* MBus master 0x9 */
	89	#define IOMMU_AER_EN_P2_ARB 0x00000004 /* MBus master 0xa */
	90	#define IOMMU_AER_EN_P3_ARB 0x00000008 /* MBus master 0xb */
	91	#define IOMMU_AER_EN_0 0x00010000 /* SBus slot 0 */
	92	#define IOMMU_AER_EN_1 0x00020000 /* SBus slot 1 */
	93	#define IOMMU_AER_EN_2 0x00040000 /* SBus slot 2 */
	94	#define IOMMU_AER_EN_3 0x00080000 /* SBus slot 3 */
	95	#define IOMMU_AER_EN_F 0x00100000 /* SBus on-board */
	96	#define IOMMU_AER_SBW 0x80000000 /* S-to-M asynchronous writes */
	97	#define IOMMU_AER_MASK 0x801f000f
	98
4e3b1ea1 FB	99	#define IOMMU_SBCFG0 (0x1010 >> 2) /* SBUS configration per-slot */
	100	#define IOMMU_SBCFG1 (0x1014 >> 2) /* SBUS configration per-slot */
	101	#define IOMMU_SBCFG2 (0x1018 >> 2) /* SBUS configration per-slot */
	102	#define IOMMU_SBCFG3 (0x101c >> 2) /* SBUS configration per-slot */
5ad6bb97 BS	103	#define IOMMU_SBCFG_SAB30 0x00010000 /* Phys-address bit 30 when
5ad6bb97 BS	104	bypass enabled */
4e3b1ea1 FB	105	#define IOMMU_SBCFG_BA16 0x00000004 /* Slave supports 16 byte bursts */
	106	#define IOMMU_SBCFG_BA8 0x00000002 /* Slave supports 8 byte bursts */
	107	#define IOMMU_SBCFG_BYPASS 0x00000001 /* Bypass IOMMU, treat all addresses
f930d07e	108	produced by this device as pure
4e3b1ea1 FB	109	physical. */
	110	#define IOMMU_SBCFG_MASK 0x00010003
	111
	112	#define IOMMU_ARBEN (0x2000 >> 2) /* SBUS arbitration enable */
	113	#define IOMMU_ARBEN_MASK 0x001f0000
	114	#define IOMMU_MID 0x00000008
420557e8	115
e5e38121 BS	116	#define IOMMU_MASK_ID (0x3018 >> 2) /* Mask ID */
	117	#define IOMMU_MASK_ID_MASK 0x00ffffff
	118
	119	#define IOMMU_MSII_MASK 0x26000000 /* microSPARC II mask number */
	120	#define IOMMU_TS_MASK 0x23000000 /* turboSPARC mask number */
	121
420557e8	122	/* The format of an iopte in the page tables */
498fbd8a	123	#define IOPTE_PAGE 0xffffff00 /* Physical page number (PA[35:12]) */
5ad6bb97 BS	124	#define IOPTE_CACHE 0x00000080 /* Cached (in vme IOCACHE or
5ad6bb97 BS	125	Viking/MXCC) */
ebabb67a	126	#define IOPTE_WRITE 0x00000004 /* Writable */
420557e8 FB	127	#define IOPTE_VALID 0x00000002 /* IOPTE is valid */
	128	#define IOPTE_WAZ 0x00000001 /* Write as zeros */
	129
8b0de438 BS	130	#define IOMMU_PAGE_SHIFT 12
8b0de438 BS	131	#define IOMMU_PAGE_SIZE (1 << IOMMU_PAGE_SHIFT)
ba51ef25	132	#define IOMMU_PAGE_MASK (~(IOMMU_PAGE_SIZE - 1))
420557e8	133
a8170e5e	134	static uint64_t iommu_mem_read(void *opaque, hwaddr addr,
d224136c	135	unsigned size)
420557e8 FB	136	{
420557e8 FB	137	IOMMUState *s = opaque;
a8170e5e	138	hwaddr saddr;
ff403da6	139	uint32_t ret;
420557e8	140
8da3ff18	141	saddr = addr >> 2;
420557e8 FB	142	switch (saddr) {
420557e8 FB	143	default:
ff403da6 BS	144	ret = s->regs[saddr];
	145	break;
	146	case IOMMU_AFAR:
	147	case IOMMU_AFSR:
	148	ret = s->regs[saddr];
	149	qemu_irq_lower(s->irq);
f930d07e	150	break;
420557e8	151	}
97bf4851	152	trace_sun4m_iommu_mem_readl(saddr, ret);
ff403da6	153	return ret;
420557e8 FB	154	}
420557e8 FB	155
a8170e5e	156	static void iommu_mem_write(void *opaque, hwaddr addr,
d224136c	157	uint64_t val, unsigned size)
420557e8 FB	158	{
420557e8 FB	159	IOMMUState *s = opaque;
a8170e5e	160	hwaddr saddr;
420557e8	161
8da3ff18	162	saddr = addr >> 2;
97bf4851	163	trace_sun4m_iommu_mem_writel(saddr, val);
420557e8	164	switch (saddr) {
4e3b1ea1	165	case IOMMU_CTRL:
f930d07e BS	166	switch (val & IOMMU_CTRL_RNGE) {
	167	case IOMMU_RNGE_16MB:
	168	s->iostart = 0xffffffffff000000ULL;
	169	break;
	170	case IOMMU_RNGE_32MB:
	171	s->iostart = 0xfffffffffe000000ULL;
	172	break;
	173	case IOMMU_RNGE_64MB:
	174	s->iostart = 0xfffffffffc000000ULL;
	175	break;
	176	case IOMMU_RNGE_128MB:
	177	s->iostart = 0xfffffffff8000000ULL;
	178	break;
	179	case IOMMU_RNGE_256MB:
	180	s->iostart = 0xfffffffff0000000ULL;
	181	break;
	182	case IOMMU_RNGE_512MB:
	183	s->iostart = 0xffffffffe0000000ULL;
	184	break;
	185	case IOMMU_RNGE_1GB:
	186	s->iostart = 0xffffffffc0000000ULL;
	187	break;
	188	default:
	189	case IOMMU_RNGE_2GB:
	190	s->iostart = 0xffffffff80000000ULL;
	191	break;
	192	}
97bf4851	193	trace_sun4m_iommu_mem_writel_ctrl(s->iostart);
7fbfb139	194	s->regs[saddr] = ((val & IOMMU_CTRL_MASK) \| s->version);
f930d07e	195	break;
4e3b1ea1	196	case IOMMU_BASE:
f930d07e BS	197	s->regs[saddr] = val & IOMMU_BASE_MASK;
f930d07e BS	198	break;
4e3b1ea1	199	case IOMMU_TLBFLUSH:
97bf4851	200	trace_sun4m_iommu_mem_writel_tlbflush(val);
f930d07e BS	201	s->regs[saddr] = val & IOMMU_TLBFLUSH_MASK;
f930d07e BS	202	break;
4e3b1ea1	203	case IOMMU_PGFLUSH:
97bf4851	204	trace_sun4m_iommu_mem_writel_pgflush(val);
f930d07e BS	205	s->regs[saddr] = val & IOMMU_PGFLUSH_MASK;
f930d07e BS	206	break;
ff403da6 BS	207	case IOMMU_AFAR:
	208	s->regs[saddr] = val;
	209	qemu_irq_lower(s->irq);
	210	break;
7b169687 BS	211	case IOMMU_AER:
	212	s->regs[saddr] = (val & IOMMU_AER_MASK) \| IOMMU_AER_EN_P0_ARB;
	213	break;
c52428fc BS	214	case IOMMU_AFSR:
c52428fc BS	215	s->regs[saddr] = (val & IOMMU_AFSR_MASK) \| IOMMU_AFSR_RESV;
ff403da6	216	qemu_irq_lower(s->irq);
c52428fc	217	break;
4e3b1ea1 FB	218	case IOMMU_SBCFG0:
	219	case IOMMU_SBCFG1:
	220	case IOMMU_SBCFG2:
	221	case IOMMU_SBCFG3:
f930d07e BS	222	s->regs[saddr] = val & IOMMU_SBCFG_MASK;
f930d07e BS	223	break;
4e3b1ea1	224	case IOMMU_ARBEN:
ba51ef25 MCA	225	/* XXX implement SBus probing: fault when reading unmapped
ba51ef25 MCA	226	addresses, fault cause and address stored to MMU/IOMMU */
f930d07e BS	227	s->regs[saddr] = (val & IOMMU_ARBEN_MASK) \| IOMMU_MID;
f930d07e BS	228	break;
e5e38121 BS	229	case IOMMU_MASK_ID:
	230	s->regs[saddr] \|= val & IOMMU_MASK_ID_MASK;
	231	break;
420557e8	232	default:
f930d07e BS	233	s->regs[saddr] = val;
f930d07e BS	234	break;
420557e8 FB	235	}
	236	}
	237
d224136c AK	238	static const MemoryRegionOps iommu_mem_ops = {
	239	.read = iommu_mem_read,
	240	.write = iommu_mem_write,
	241	.endianness = DEVICE_NATIVE_ENDIAN,
	242	.valid = {
	243	.min_access_size = 4,
	244	.max_access_size = 4,
	245	},
420557e8 FB	246	};
420557e8 FB	247
a8170e5e	248	static uint32_t iommu_page_get_flags(IOMMUState *s, hwaddr addr)
420557e8	249	{
5e3b100b	250	uint32_t ret;
a8170e5e AK	251	hwaddr iopte;
a8170e5e AK	252	hwaddr pa = addr;
420557e8	253
981a2e99	254	iopte = s->regs[IOMMU_BASE] << 4;
66321a11	255	addr &= ~s->iostart;
8b0de438	256	iopte += (addr >> (IOMMU_PAGE_SHIFT - 2)) & ~3;
42874d3a PM	257	ret = address_space_ldl_be(&address_space_memory, iopte,
42874d3a PM	258	MEMTXATTRS_UNSPECIFIED, NULL);
97bf4851	259	trace_sun4m_iommu_page_get_flags(pa, iopte, ret);
981a2e99	260	return ret;
a917d384 PB	261	}
a917d384 PB	262
a8170e5e	263	static hwaddr iommu_translate_pa(hwaddr addr,
5dcb6b91	264	uint32_t pte)
a917d384	265	{
a8170e5e	266	hwaddr pa;
5dcb6b91	267
8b0de438	268	pa = ((pte & IOPTE_PAGE) << 4) + (addr & ~IOMMU_PAGE_MASK);
97bf4851	269	trace_sun4m_iommu_translate_pa(addr, pa, pte);
66321a11	270	return pa;
420557e8 FB	271	}
420557e8 FB	272
a8170e5e	273	static void iommu_bad_addr(IOMMUState *s, hwaddr addr,
5ad6bb97	274	int is_write)
225d4be7	275	{
97bf4851	276	trace_sun4m_iommu_bad_addr(addr);
5ad6bb97	277	s->regs[IOMMU_AFSR] = IOMMU_AFSR_ERR \| IOMMU_AFSR_LE \| IOMMU_AFSR_RESV \|
225d4be7	278	IOMMU_AFSR_FAV;
ba51ef25	279	if (!is_write) {
225d4be7	280	s->regs[IOMMU_AFSR] \|= IOMMU_AFSR_RD;
ba51ef25	281	}
225d4be7	282	s->regs[IOMMU_AFAR] = addr;
ff403da6	283	qemu_irq_raise(s->irq);
225d4be7 BS	284	}
225d4be7 BS	285
84138466 MCA	286	/* Called from RCU critical section */
	287	static IOMMUTLBEntry sun4m_translate_iommu(IOMMUMemoryRegion *iommu,
	288	hwaddr addr,
2c91bcf2 PM	289	IOMMUAccessFlags flags,
2c91bcf2 PM	290	int iommu_idx)
84138466 MCA	291	{
	292	IOMMUState *is = container_of(iommu, IOMMUState, iommu);
	293	hwaddr page, pa;
	294	int is_write = (flags & IOMMU_WO) ? 1 : 0;
	295	uint32_t pte;
	296	IOMMUTLBEntry ret = {
	297	.target_as = &address_space_memory,
	298	.iova = 0,
	299	.translated_addr = 0,
	300	.addr_mask = ~(hwaddr)0,
	301	.perm = IOMMU_NONE,
	302	};
	303
	304	page = addr & IOMMU_PAGE_MASK;
	305	pte = iommu_page_get_flags(is, page);
	306	if (!(pte & IOPTE_VALID)) {
	307	iommu_bad_addr(is, page, is_write);
	308	return ret;
	309	}
	310
	311	pa = iommu_translate_pa(addr, pte);
	312	if (is_write && !(pte & IOPTE_WRITE)) {
	313	iommu_bad_addr(is, page, is_write);
	314	return ret;
	315	}
	316
	317	if (pte & IOPTE_WRITE) {
	318	ret.perm = IOMMU_RW;
	319	} else {
	320	ret.perm = IOMMU_RO;
	321	}
	322
	323	ret.iova = page;
	324	ret.translated_addr = pa;
	325	ret.addr_mask = ~IOMMU_PAGE_MASK;
	326
	327	return ret;
	328	}
	329
db3c9e08	330	static const VMStateDescription vmstate_iommu = {
ba51ef25	331	.name = "iommu",
db3c9e08 BS	332	.version_id = 2,
db3c9e08 BS	333	.minimum_version_id = 2,
35d08458	334	.fields = (VMStateField[]) {
db3c9e08 BS	335	VMSTATE_UINT32_ARRAY(regs, IOMMUState, IOMMU_NREGS),
	336	VMSTATE_UINT64(iostart, IOMMUState),
	337	VMSTATE_END_OF_LIST()
	338	}
	339	};
e80cfcfc	340
1a522e8a	341	static void iommu_reset(DeviceState *d)
e80cfcfc	342	{
049e7d22	343	IOMMUState *s = SUN4M_IOMMU(d);
e80cfcfc	344
66321a11	345	memset(s->regs, 0, IOMMU_NREGS * 4);
e80cfcfc	346	s->iostart = 0;
7fbfb139 BS	347	s->regs[IOMMU_CTRL] = s->version;
7fbfb139 BS	348	s->regs[IOMMU_ARBEN] = IOMMU_MID;
5ad6bb97	349	s->regs[IOMMU_AFSR] = IOMMU_AFSR_RESV;
7b169687	350	s->regs[IOMMU_AER] = IOMMU_AER_EN_P0_ARB \| IOMMU_AER_EN_P1_ARB;
e5e38121	351	s->regs[IOMMU_MASK_ID] = IOMMU_TS_MASK;
e80cfcfc FB	352	}
e80cfcfc FB	353
1c958ad3	354	static void iommu_init(Object *obj)
5f750b2e	355	{
1c958ad3 XZ	356	IOMMUState *s = SUN4M_IOMMU(obj);
1c958ad3 XZ	357	SysBusDevice *dev = SYS_BUS_DEVICE(obj);
420557e8	358
84138466 MCA	359	memory_region_init_iommu(&s->iommu, sizeof(s->iommu),
	360	TYPE_SUN4M_IOMMU_MEMORY_REGION, OBJECT(dev),
	361	"iommu-sun4m", UINT64_MAX);
	362	address_space_init(&s->iommu_as, MEMORY_REGION(&s->iommu), "iommu-as");
	363
5f750b2e	364	sysbus_init_irq(dev, &s->irq);
420557e8	365
1c958ad3	366	memory_region_init_io(&s->iomem, obj, &iommu_mem_ops, s, "iommu",
d224136c	367	IOMMU_NREGS * sizeof(uint32_t));
750ecd44	368	sysbus_init_mmio(dev, &s->iomem);
420557e8	369	}
5f750b2e	370
999e12bb	371	static Property iommu_properties[] = {
c7bcc85d	372	DEFINE_PROP_UINT32("version", IOMMUState, version, 0),
999e12bb AL	373	DEFINE_PROP_END_OF_LIST(),
	374	};
	375
	376	static void iommu_class_init(ObjectClass klass, void data)
	377	{
39bffca2	378	DeviceClass *dc = DEVICE_CLASS(klass);
999e12bb	379
39bffca2 AL	380	dc->reset = iommu_reset;
	381	dc->vmsd = &vmstate_iommu;
	382	dc->props = iommu_properties;
999e12bb AL	383	}
999e12bb AL	384
8c43a6f0	385	static const TypeInfo iommu_info = {
049e7d22	386	.name = TYPE_SUN4M_IOMMU,
39bffca2 AL	387	.parent = TYPE_SYS_BUS_DEVICE,
39bffca2 AL	388	.instance_size = sizeof(IOMMUState),
1c958ad3	389	.instance_init = iommu_init,
39bffca2	390	.class_init = iommu_class_init,
5f750b2e BS	391	};
5f750b2e BS	392
84138466 MCA	393	static void sun4m_iommu_memory_region_class_init(ObjectClass klass, void data)
	394	{
	395	IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
	396
	397	imrc->translate = sun4m_translate_iommu;
	398	}
	399
	400	static const TypeInfo sun4m_iommu_memory_region_info = {
	401	.parent = TYPE_IOMMU_MEMORY_REGION,
	402	.name = TYPE_SUN4M_IOMMU_MEMORY_REGION,
	403	.class_init = sun4m_iommu_memory_region_class_init,
	404	};
	405
83f7d43a	406	static void iommu_register_types(void)
5f750b2e	407	{
39bffca2	408	type_register_static(&iommu_info);
84138466	409	type_register_static(&sun4m_iommu_memory_region_info);
5f750b2e BS	410	}
5f750b2e BS	411
83f7d43a	412	type_init(iommu_register_types)