2 * QEMU Sun4m iommu emulation
4 * Copyright (c) 2003-2005 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
27 #include "hw/sparc/sun4m_iommu.h"
28 #include "hw/sysbus.h"
29 #include "qemu/module.h"
30 #include "exec/address-spaces.h"
34 * I/O MMU used by Sun4m systems
37 * "Sun-4M System Architecture (revision 2.0) by Chuck Narad", 950-1373-01,
38 * http://mediacast.sun.com/users/Barton808/media/Sun4M_SystemArchitecture_edited2.pdf
41 #define IOMMU_CTRL (0x0000 >> 2)
42 #define IOMMU_CTRL_IMPL 0xf0000000 /* Implementation */
43 #define IOMMU_CTRL_VERS 0x0f000000 /* Version */
44 #define IOMMU_CTRL_RNGE 0x0000001c /* Mapping RANGE */
45 #define IOMMU_RNGE_16MB 0x00000000 /* 0xff000000 -> 0xffffffff */
46 #define IOMMU_RNGE_32MB 0x00000004 /* 0xfe000000 -> 0xffffffff */
47 #define IOMMU_RNGE_64MB 0x00000008 /* 0xfc000000 -> 0xffffffff */
48 #define IOMMU_RNGE_128MB 0x0000000c /* 0xf8000000 -> 0xffffffff */
49 #define IOMMU_RNGE_256MB 0x00000010 /* 0xf0000000 -> 0xffffffff */
50 #define IOMMU_RNGE_512MB 0x00000014 /* 0xe0000000 -> 0xffffffff */
51 #define IOMMU_RNGE_1GB 0x00000018 /* 0xc0000000 -> 0xffffffff */
52 #define IOMMU_RNGE_2GB 0x0000001c /* 0x80000000 -> 0xffffffff */
53 #define IOMMU_CTRL_ENAB 0x00000001 /* IOMMU Enable */
54 #define IOMMU_CTRL_MASK 0x0000001d
56 #define IOMMU_BASE (0x0004 >> 2)
57 #define IOMMU_BASE_MASK 0x07fffc00
59 #define IOMMU_TLBFLUSH (0x0014 >> 2)
60 #define IOMMU_TLBFLUSH_MASK 0xffffffff
62 #define IOMMU_PGFLUSH (0x0018 >> 2)
63 #define IOMMU_PGFLUSH_MASK 0xffffffff
65 #define IOMMU_AFSR (0x1000 >> 2)
66 #define IOMMU_AFSR_ERR 0x80000000 /* LE, TO, or BE asserted */
67 #define IOMMU_AFSR_LE 0x40000000 /* SBUS reports error after
69 #define IOMMU_AFSR_TO 0x20000000 /* Write access took more than
71 #define IOMMU_AFSR_BE 0x10000000 /* Write access received error
73 #define IOMMU_AFSR_SIZE 0x0e000000 /* Size of transaction causing error */
74 #define IOMMU_AFSR_S 0x01000000 /* Sparc was in supervisor mode */
75 #define IOMMU_AFSR_RESV 0x00800000 /* Reserved, forced to 0x8 by
77 #define IOMMU_AFSR_ME 0x00080000 /* Multiple errors occurred */
78 #define IOMMU_AFSR_RD 0x00040000 /* A read operation was in progress */
79 #define IOMMU_AFSR_FAV 0x00020000 /* IOMMU afar has valid contents */
80 #define IOMMU_AFSR_MASK 0xff0fffff
82 #define IOMMU_AFAR (0x1004 >> 2)
84 #define IOMMU_AER (0x1008 >> 2) /* Arbiter Enable Register */
85 #define IOMMU_AER_EN_P0_ARB 0x00000001 /* MBus master 0x8 (Always 1) */
86 #define IOMMU_AER_EN_P1_ARB 0x00000002 /* MBus master 0x9 */
87 #define IOMMU_AER_EN_P2_ARB 0x00000004 /* MBus master 0xa */
88 #define IOMMU_AER_EN_P3_ARB 0x00000008 /* MBus master 0xb */
89 #define IOMMU_AER_EN_0 0x00010000 /* SBus slot 0 */
90 #define IOMMU_AER_EN_1 0x00020000 /* SBus slot 1 */
91 #define IOMMU_AER_EN_2 0x00040000 /* SBus slot 2 */
92 #define IOMMU_AER_EN_3 0x00080000 /* SBus slot 3 */
93 #define IOMMU_AER_EN_F 0x00100000 /* SBus on-board */
94 #define IOMMU_AER_SBW 0x80000000 /* S-to-M asynchronous writes */
95 #define IOMMU_AER_MASK 0x801f000f
97 #define IOMMU_SBCFG0 (0x1010 >> 2) /* SBUS configration per-slot */
98 #define IOMMU_SBCFG1 (0x1014 >> 2) /* SBUS configration per-slot */
99 #define IOMMU_SBCFG2 (0x1018 >> 2) /* SBUS configration per-slot */
100 #define IOMMU_SBCFG3 (0x101c >> 2) /* SBUS configration per-slot */
101 #define IOMMU_SBCFG_SAB30 0x00010000 /* Phys-address bit 30 when
103 #define IOMMU_SBCFG_BA16 0x00000004 /* Slave supports 16 byte bursts */
104 #define IOMMU_SBCFG_BA8 0x00000002 /* Slave supports 8 byte bursts */
105 #define IOMMU_SBCFG_BYPASS 0x00000001 /* Bypass IOMMU, treat all addresses
106 produced by this device as pure
108 #define IOMMU_SBCFG_MASK 0x00010003
110 #define IOMMU_ARBEN (0x2000 >> 2) /* SBUS arbitration enable */
111 #define IOMMU_ARBEN_MASK 0x001f0000
112 #define IOMMU_MID 0x00000008
114 #define IOMMU_MASK_ID (0x3018 >> 2) /* Mask ID */
115 #define IOMMU_MASK_ID_MASK 0x00ffffff
117 #define IOMMU_MSII_MASK 0x26000000 /* microSPARC II mask number */
118 #define IOMMU_TS_MASK 0x23000000 /* turboSPARC mask number */
120 /* The format of an iopte in the page tables */
121 #define IOPTE_PAGE 0xffffff00 /* Physical page number (PA[35:12]) */
122 #define IOPTE_CACHE 0x00000080 /* Cached (in vme IOCACHE or
124 #define IOPTE_WRITE 0x00000004 /* Writable */
125 #define IOPTE_VALID 0x00000002 /* IOPTE is valid */
126 #define IOPTE_WAZ 0x00000001 /* Write as zeros */
128 #define IOMMU_PAGE_SHIFT 12
129 #define IOMMU_PAGE_SIZE (1 << IOMMU_PAGE_SHIFT)
130 #define IOMMU_PAGE_MASK (~(IOMMU_PAGE_SIZE - 1))
132 static uint64_t iommu_mem_read(void *opaque
, hwaddr addr
,
135 IOMMUState
*s
= opaque
;
142 ret
= s
->regs
[saddr
];
146 ret
= s
->regs
[saddr
];
147 qemu_irq_lower(s
->irq
);
150 trace_sun4m_iommu_mem_readl(saddr
, ret
);
154 static void iommu_mem_write(void *opaque
, hwaddr addr
,
155 uint64_t val
, unsigned size
)
157 IOMMUState
*s
= opaque
;
161 trace_sun4m_iommu_mem_writel(saddr
, val
);
164 switch (val
& IOMMU_CTRL_RNGE
) {
165 case IOMMU_RNGE_16MB
:
166 s
->iostart
= 0xffffffffff000000ULL
;
168 case IOMMU_RNGE_32MB
:
169 s
->iostart
= 0xfffffffffe000000ULL
;
171 case IOMMU_RNGE_64MB
:
172 s
->iostart
= 0xfffffffffc000000ULL
;
174 case IOMMU_RNGE_128MB
:
175 s
->iostart
= 0xfffffffff8000000ULL
;
177 case IOMMU_RNGE_256MB
:
178 s
->iostart
= 0xfffffffff0000000ULL
;
180 case IOMMU_RNGE_512MB
:
181 s
->iostart
= 0xffffffffe0000000ULL
;
184 s
->iostart
= 0xffffffffc0000000ULL
;
188 s
->iostart
= 0xffffffff80000000ULL
;
191 trace_sun4m_iommu_mem_writel_ctrl(s
->iostart
);
192 s
->regs
[saddr
] = ((val
& IOMMU_CTRL_MASK
) | s
->version
);
195 s
->regs
[saddr
] = val
& IOMMU_BASE_MASK
;
198 trace_sun4m_iommu_mem_writel_tlbflush(val
);
199 s
->regs
[saddr
] = val
& IOMMU_TLBFLUSH_MASK
;
202 trace_sun4m_iommu_mem_writel_pgflush(val
);
203 s
->regs
[saddr
] = val
& IOMMU_PGFLUSH_MASK
;
206 s
->regs
[saddr
] = val
;
207 qemu_irq_lower(s
->irq
);
210 s
->regs
[saddr
] = (val
& IOMMU_AER_MASK
) | IOMMU_AER_EN_P0_ARB
;
213 s
->regs
[saddr
] = (val
& IOMMU_AFSR_MASK
) | IOMMU_AFSR_RESV
;
214 qemu_irq_lower(s
->irq
);
220 s
->regs
[saddr
] = val
& IOMMU_SBCFG_MASK
;
223 /* XXX implement SBus probing: fault when reading unmapped
224 addresses, fault cause and address stored to MMU/IOMMU */
225 s
->regs
[saddr
] = (val
& IOMMU_ARBEN_MASK
) | IOMMU_MID
;
228 s
->regs
[saddr
] |= val
& IOMMU_MASK_ID_MASK
;
231 s
->regs
[saddr
] = val
;
236 static const MemoryRegionOps iommu_mem_ops
= {
237 .read
= iommu_mem_read
,
238 .write
= iommu_mem_write
,
239 .endianness
= DEVICE_NATIVE_ENDIAN
,
241 .min_access_size
= 4,
242 .max_access_size
= 4,
246 static uint32_t iommu_page_get_flags(IOMMUState
*s
, hwaddr addr
)
252 iopte
= s
->regs
[IOMMU_BASE
] << 4;
254 iopte
+= (addr
>> (IOMMU_PAGE_SHIFT
- 2)) & ~3;
255 ret
= address_space_ldl_be(&address_space_memory
, iopte
,
256 MEMTXATTRS_UNSPECIFIED
, NULL
);
257 trace_sun4m_iommu_page_get_flags(pa
, iopte
, ret
);
261 static hwaddr
iommu_translate_pa(hwaddr addr
,
266 pa
= ((pte
& IOPTE_PAGE
) << 4) + (addr
& ~IOMMU_PAGE_MASK
);
267 trace_sun4m_iommu_translate_pa(addr
, pa
, pte
);
271 static void iommu_bad_addr(IOMMUState
*s
, hwaddr addr
,
274 trace_sun4m_iommu_bad_addr(addr
);
275 s
->regs
[IOMMU_AFSR
] = IOMMU_AFSR_ERR
| IOMMU_AFSR_LE
| IOMMU_AFSR_RESV
|
278 s
->regs
[IOMMU_AFSR
] |= IOMMU_AFSR_RD
;
280 s
->regs
[IOMMU_AFAR
] = addr
;
281 qemu_irq_raise(s
->irq
);
284 /* Called from RCU critical section */
285 static IOMMUTLBEntry
sun4m_translate_iommu(IOMMUMemoryRegion
*iommu
,
287 IOMMUAccessFlags flags
,
290 IOMMUState
*is
= container_of(iommu
, IOMMUState
, iommu
);
292 int is_write
= (flags
& IOMMU_WO
) ? 1 : 0;
294 IOMMUTLBEntry ret
= {
295 .target_as
= &address_space_memory
,
297 .translated_addr
= 0,
298 .addr_mask
= ~(hwaddr
)0,
302 page
= addr
& IOMMU_PAGE_MASK
;
303 pte
= iommu_page_get_flags(is
, page
);
304 if (!(pte
& IOPTE_VALID
)) {
305 iommu_bad_addr(is
, page
, is_write
);
309 pa
= iommu_translate_pa(addr
, pte
);
310 if (is_write
&& !(pte
& IOPTE_WRITE
)) {
311 iommu_bad_addr(is
, page
, is_write
);
315 if (pte
& IOPTE_WRITE
) {
322 ret
.translated_addr
= pa
;
323 ret
.addr_mask
= ~IOMMU_PAGE_MASK
;
328 static const VMStateDescription vmstate_iommu
= {
331 .minimum_version_id
= 2,
332 .fields
= (VMStateField
[]) {
333 VMSTATE_UINT32_ARRAY(regs
, IOMMUState
, IOMMU_NREGS
),
334 VMSTATE_UINT64(iostart
, IOMMUState
),
335 VMSTATE_END_OF_LIST()
339 static void iommu_reset(DeviceState
*d
)
341 IOMMUState
*s
= SUN4M_IOMMU(d
);
343 memset(s
->regs
, 0, IOMMU_NREGS
* 4);
345 s
->regs
[IOMMU_CTRL
] = s
->version
;
346 s
->regs
[IOMMU_ARBEN
] = IOMMU_MID
;
347 s
->regs
[IOMMU_AFSR
] = IOMMU_AFSR_RESV
;
348 s
->regs
[IOMMU_AER
] = IOMMU_AER_EN_P0_ARB
| IOMMU_AER_EN_P1_ARB
;
349 s
->regs
[IOMMU_MASK_ID
] = IOMMU_TS_MASK
;
352 static void iommu_init(Object
*obj
)
354 IOMMUState
*s
= SUN4M_IOMMU(obj
);
355 SysBusDevice
*dev
= SYS_BUS_DEVICE(obj
);
357 memory_region_init_iommu(&s
->iommu
, sizeof(s
->iommu
),
358 TYPE_SUN4M_IOMMU_MEMORY_REGION
, OBJECT(dev
),
359 "iommu-sun4m", UINT64_MAX
);
360 address_space_init(&s
->iommu_as
, MEMORY_REGION(&s
->iommu
), "iommu-as");
362 sysbus_init_irq(dev
, &s
->irq
);
364 memory_region_init_io(&s
->iomem
, obj
, &iommu_mem_ops
, s
, "iommu",
365 IOMMU_NREGS
* sizeof(uint32_t));
366 sysbus_init_mmio(dev
, &s
->iomem
);
369 static Property iommu_properties
[] = {
370 DEFINE_PROP_UINT32("version", IOMMUState
, version
, 0),
371 DEFINE_PROP_END_OF_LIST(),
374 static void iommu_class_init(ObjectClass
*klass
, void *data
)
376 DeviceClass
*dc
= DEVICE_CLASS(klass
);
378 dc
->reset
= iommu_reset
;
379 dc
->vmsd
= &vmstate_iommu
;
380 dc
->props
= iommu_properties
;
383 static const TypeInfo iommu_info
= {
384 .name
= TYPE_SUN4M_IOMMU
,
385 .parent
= TYPE_SYS_BUS_DEVICE
,
386 .instance_size
= sizeof(IOMMUState
),
387 .instance_init
= iommu_init
,
388 .class_init
= iommu_class_init
,
391 static void sun4m_iommu_memory_region_class_init(ObjectClass
*klass
, void *data
)
393 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
395 imrc
->translate
= sun4m_translate_iommu
;
398 static const TypeInfo sun4m_iommu_memory_region_info
= {
399 .parent
= TYPE_IOMMU_MEMORY_REGION
,
400 .name
= TYPE_SUN4M_IOMMU_MEMORY_REGION
,
401 .class_init
= sun4m_iommu_memory_region_class_init
,
404 static void iommu_register_types(void)
406 type_register_static(&iommu_info
);
407 type_register_static(&sun4m_iommu_memory_region_info
);
410 type_init(iommu_register_types
)