qemu/hw/i386/amd_iommu.c
<<
>>
Prefs
   1/*
   2 * QEMU emulation of AMD IOMMU (AMD-Vi)
   3 *
   4 * Copyright (C) 2011 Eduard - Gabriel Munteanu
   5 * Copyright (C) 2015 David Kiarie, <davidkiarie4@gmail.com>
   6 *
   7 * This program is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 2 of the License, or
  10 * (at your option) any later version.
  11
  12 * This program is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16
  17 * You should have received a copy of the GNU General Public License along
  18 * with this program; if not, see <http://www.gnu.org/licenses/>.
  19 *
  20 * Cache implementation inspired by hw/i386/intel_iommu.c
  21 */
  22#include "qemu/osdep.h"
  23#include "hw/i386/amd_iommu.h"
  24#include "qapi/error.h"
  25#include "qemu/error-report.h"
  26#include "trace.h"
  27
  28/* used AMD-Vi MMIO registers */
  29const char *amdvi_mmio_low[] = {
  30    "AMDVI_MMIO_DEVTAB_BASE",
  31    "AMDVI_MMIO_CMDBUF_BASE",
  32    "AMDVI_MMIO_EVTLOG_BASE",
  33    "AMDVI_MMIO_CONTROL",
  34    "AMDVI_MMIO_EXCL_BASE",
  35    "AMDVI_MMIO_EXCL_LIMIT",
  36    "AMDVI_MMIO_EXT_FEATURES",
  37    "AMDVI_MMIO_PPR_BASE",
  38    "UNHANDLED"
  39};
  40const char *amdvi_mmio_high[] = {
  41    "AMDVI_MMIO_COMMAND_HEAD",
  42    "AMDVI_MMIO_COMMAND_TAIL",
  43    "AMDVI_MMIO_EVTLOG_HEAD",
  44    "AMDVI_MMIO_EVTLOG_TAIL",
  45    "AMDVI_MMIO_STATUS",
  46    "AMDVI_MMIO_PPR_HEAD",
  47    "AMDVI_MMIO_PPR_TAIL",
  48    "UNHANDLED"
  49};
  50
  51struct AMDVIAddressSpace {
  52    uint8_t bus_num;            /* bus number                           */
  53    uint8_t devfn;              /* device function                      */
  54    AMDVIState *iommu_state;    /* AMDVI - one per machine              */
  55    IOMMUMemoryRegion iommu;    /* Device's address translation region  */
  56    MemoryRegion iommu_ir;      /* Device's interrupt remapping region  */
  57    AddressSpace as;            /* device's corresponding address space */
  58};
  59
  60/* AMDVI cache entry */
  61typedef struct AMDVIIOTLBEntry {
  62    uint16_t domid;             /* assigned domain id  */
  63    uint16_t devid;             /* device owning entry */
  64    uint64_t perms;             /* access permissions  */
  65    uint64_t translated_addr;   /* translated address  */
  66    uint64_t page_mask;         /* physical page size  */
  67} AMDVIIOTLBEntry;
  68
  69/* configure MMIO registers at startup/reset */
  70static void amdvi_set_quad(AMDVIState *s, hwaddr addr, uint64_t val,
  71                           uint64_t romask, uint64_t w1cmask)
  72{
  73    stq_le_p(&s->mmior[addr], val);
  74    stq_le_p(&s->romask[addr], romask);
  75    stq_le_p(&s->w1cmask[addr], w1cmask);
  76}
  77
  78static uint16_t amdvi_readw(AMDVIState *s, hwaddr addr)
  79{
  80    return lduw_le_p(&s->mmior[addr]);
  81}
  82
  83static uint32_t amdvi_readl(AMDVIState *s, hwaddr addr)
  84{
  85    return ldl_le_p(&s->mmior[addr]);
  86}
  87
  88static uint64_t amdvi_readq(AMDVIState *s, hwaddr addr)
  89{
  90    return ldq_le_p(&s->mmior[addr]);
  91}
  92
  93/* internal write */
  94static void amdvi_writeq_raw(AMDVIState *s, uint64_t val, hwaddr addr)
  95{
  96    stq_le_p(&s->mmior[addr], val);
  97}
  98
  99/* external write */
 100static void amdvi_writew(AMDVIState *s, hwaddr addr, uint16_t val)
 101{
 102    uint16_t romask = lduw_le_p(&s->romask[addr]);
 103    uint16_t w1cmask = lduw_le_p(&s->w1cmask[addr]);
 104    uint16_t oldval = lduw_le_p(&s->mmior[addr]);
 105    stw_le_p(&s->mmior[addr],
 106            ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
 107}
 108
 109static void amdvi_writel(AMDVIState *s, hwaddr addr, uint32_t val)
 110{
 111    uint32_t romask = ldl_le_p(&s->romask[addr]);
 112    uint32_t w1cmask = ldl_le_p(&s->w1cmask[addr]);
 113    uint32_t oldval = ldl_le_p(&s->mmior[addr]);
 114    stl_le_p(&s->mmior[addr],
 115            ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
 116}
 117
 118static void amdvi_writeq(AMDVIState *s, hwaddr addr, uint64_t val)
 119{
 120    uint64_t romask = ldq_le_p(&s->romask[addr]);
 121    uint64_t w1cmask = ldq_le_p(&s->w1cmask[addr]);
 122    uint32_t oldval = ldq_le_p(&s->mmior[addr]);
 123    stq_le_p(&s->mmior[addr],
 124            ((oldval & romask) | (val & ~romask)) & ~(val & w1cmask));
 125}
 126
 127/* OR a 64-bit register with a 64-bit value */
 128static bool amdvi_test_mask(AMDVIState *s, hwaddr addr, uint64_t val)
 129{
 130    return amdvi_readq(s, addr) | val;
 131}
 132
 133/* OR a 64-bit register with a 64-bit value storing result in the register */
 134static void amdvi_assign_orq(AMDVIState *s, hwaddr addr, uint64_t val)
 135{
 136    amdvi_writeq_raw(s, addr, amdvi_readq(s, addr) | val);
 137}
 138
 139/* AND a 64-bit register with a 64-bit value storing result in the register */
 140static void amdvi_assign_andq(AMDVIState *s, hwaddr addr, uint64_t val)
 141{
 142   amdvi_writeq_raw(s, addr, amdvi_readq(s, addr) & val);
 143}
 144
 145static void amdvi_generate_msi_interrupt(AMDVIState *s)
 146{
 147    MSIMessage msg = {};
 148    MemTxAttrs attrs = {
 149        .requester_id = pci_requester_id(&s->pci.dev)
 150    };
 151
 152    if (msi_enabled(&s->pci.dev)) {
 153        msg = msi_get_message(&s->pci.dev, 0);
 154        address_space_stl_le(&address_space_memory, msg.address, msg.data,
 155                             attrs, NULL);
 156    }
 157}
 158
 159static void amdvi_log_event(AMDVIState *s, uint64_t *evt)
 160{
 161    /* event logging not enabled */
 162    if (!s->evtlog_enabled || amdvi_test_mask(s, AMDVI_MMIO_STATUS,
 163        AMDVI_MMIO_STATUS_EVT_OVF)) {
 164        return;
 165    }
 166
 167    /* event log buffer full */
 168    if (s->evtlog_tail >= s->evtlog_len) {
 169        amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_EVT_OVF);
 170        /* generate interrupt */
 171        amdvi_generate_msi_interrupt(s);
 172        return;
 173    }
 174
 175    if (dma_memory_write(&address_space_memory, s->evtlog + s->evtlog_tail,
 176        &evt, AMDVI_EVENT_LEN)) {
 177        trace_amdvi_evntlog_fail(s->evtlog, s->evtlog_tail);
 178    }
 179
 180    s->evtlog_tail += AMDVI_EVENT_LEN;
 181    amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_COMP_INT);
 182    amdvi_generate_msi_interrupt(s);
 183}
 184
 185static void amdvi_setevent_bits(uint64_t *buffer, uint64_t value, int start,
 186                                int length)
 187{
 188    int index = start / 64, bitpos = start % 64;
 189    uint64_t mask = MAKE_64BIT_MASK(start, length);
 190    buffer[index] &= ~mask;
 191    buffer[index] |= (value << bitpos) & mask;
 192}
 193/*
 194 * AMDVi event structure
 195 *    0:15   -> DeviceID
 196 *    55:63  -> event type + miscellaneous info
 197 *    63:127 -> related address
 198 */
 199static void amdvi_encode_event(uint64_t *evt, uint16_t devid, uint64_t addr,
 200                               uint16_t info)
 201{
 202    amdvi_setevent_bits(evt, devid, 0, 16);
 203    amdvi_setevent_bits(evt, info, 55, 8);
 204    amdvi_setevent_bits(evt, addr, 63, 64);
 205}
 206/* log an error encountered during a page walk
 207 *
 208 * @addr: virtual address in translation request
 209 */
 210static void amdvi_page_fault(AMDVIState *s, uint16_t devid,
 211                             hwaddr addr, uint16_t info)
 212{
 213    uint64_t evt[4];
 214
 215    info |= AMDVI_EVENT_IOPF_I | AMDVI_EVENT_IOPF;
 216    amdvi_encode_event(evt, devid, addr, info);
 217    amdvi_log_event(s, evt);
 218    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
 219            PCI_STATUS_SIG_TARGET_ABORT);
 220}
 221/*
 222 * log a master abort accessing device table
 223 *  @devtab : address of device table entry
 224 *  @info : error flags
 225 */
 226static void amdvi_log_devtab_error(AMDVIState *s, uint16_t devid,
 227                                   hwaddr devtab, uint16_t info)
 228{
 229    uint64_t evt[4];
 230
 231    info |= AMDVI_EVENT_DEV_TAB_HW_ERROR;
 232
 233    amdvi_encode_event(evt, devid, devtab, info);
 234    amdvi_log_event(s, evt);
 235    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
 236            PCI_STATUS_SIG_TARGET_ABORT);
 237}
 238/* log an event trying to access command buffer
 239 *   @addr : address that couldn't be accessed
 240 */
 241static void amdvi_log_command_error(AMDVIState *s, hwaddr addr)
 242{
 243    uint64_t evt[4], info = AMDVI_EVENT_COMMAND_HW_ERROR;
 244
 245    amdvi_encode_event(evt, 0, addr, info);
 246    amdvi_log_event(s, evt);
 247    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
 248            PCI_STATUS_SIG_TARGET_ABORT);
 249}
 250/* log an illegal comand event
 251 *   @addr : address of illegal command
 252 */
 253static void amdvi_log_illegalcom_error(AMDVIState *s, uint16_t info,
 254                                       hwaddr addr)
 255{
 256    uint64_t evt[4];
 257
 258    info |= AMDVI_EVENT_ILLEGAL_COMMAND_ERROR;
 259    amdvi_encode_event(evt, 0, addr, info);
 260    amdvi_log_event(s, evt);
 261}
 262/* log an error accessing device table
 263 *
 264 *  @devid : device owning the table entry
 265 *  @devtab : address of device table entry
 266 *  @info : error flags
 267 */
 268static void amdvi_log_illegaldevtab_error(AMDVIState *s, uint16_t devid,
 269                                          hwaddr addr, uint16_t info)
 270{
 271    uint64_t evt[4];
 272
 273    info |= AMDVI_EVENT_ILLEGAL_DEVTAB_ENTRY;
 274    amdvi_encode_event(evt, devid, addr, info);
 275    amdvi_log_event(s, evt);
 276}
 277/* log an error accessing a PTE entry
 278 * @addr : address that couldn't be accessed
 279 */
 280static void amdvi_log_pagetab_error(AMDVIState *s, uint16_t devid,
 281                                    hwaddr addr, uint16_t info)
 282{
 283    uint64_t evt[4];
 284
 285    info |= AMDVI_EVENT_PAGE_TAB_HW_ERROR;
 286    amdvi_encode_event(evt, devid, addr, info);
 287    amdvi_log_event(s, evt);
 288    pci_word_test_and_set_mask(s->pci.dev.config + PCI_STATUS,
 289             PCI_STATUS_SIG_TARGET_ABORT);
 290}
 291
 292static gboolean amdvi_uint64_equal(gconstpointer v1, gconstpointer v2)
 293{
 294    return *((const uint64_t *)v1) == *((const uint64_t *)v2);
 295}
 296
 297static guint amdvi_uint64_hash(gconstpointer v)
 298{
 299    return (guint)*(const uint64_t *)v;
 300}
 301
 302static AMDVIIOTLBEntry *amdvi_iotlb_lookup(AMDVIState *s, hwaddr addr,
 303                                           uint64_t devid)
 304{
 305    uint64_t key = (addr >> AMDVI_PAGE_SHIFT_4K) |
 306                   ((uint64_t)(devid) << AMDVI_DEVID_SHIFT);
 307    return g_hash_table_lookup(s->iotlb, &key);
 308}
 309
 310static void amdvi_iotlb_reset(AMDVIState *s)
 311{
 312    assert(s->iotlb);
 313    trace_amdvi_iotlb_reset();
 314    g_hash_table_remove_all(s->iotlb);
 315}
 316
 317static gboolean amdvi_iotlb_remove_by_devid(gpointer key, gpointer value,
 318                                            gpointer user_data)
 319{
 320    AMDVIIOTLBEntry *entry = (AMDVIIOTLBEntry *)value;
 321    uint16_t devid = *(uint16_t *)user_data;
 322    return entry->devid == devid;
 323}
 324
 325static void amdvi_iotlb_remove_page(AMDVIState *s, hwaddr addr,
 326                                    uint64_t devid)
 327{
 328    uint64_t key = (addr >> AMDVI_PAGE_SHIFT_4K) |
 329                   ((uint64_t)(devid) << AMDVI_DEVID_SHIFT);
 330    g_hash_table_remove(s->iotlb, &key);
 331}
 332
 333static void amdvi_update_iotlb(AMDVIState *s, uint16_t devid,
 334                               uint64_t gpa, IOMMUTLBEntry to_cache,
 335                               uint16_t domid)
 336{
 337    AMDVIIOTLBEntry *entry = g_new(AMDVIIOTLBEntry, 1);
 338    uint64_t *key = g_new(uint64_t, 1);
 339    uint64_t gfn = gpa >> AMDVI_PAGE_SHIFT_4K;
 340
 341    /* don't cache erroneous translations */
 342    if (to_cache.perm != IOMMU_NONE) {
 343        trace_amdvi_cache_update(domid, PCI_BUS_NUM(devid), PCI_SLOT(devid),
 344                PCI_FUNC(devid), gpa, to_cache.translated_addr);
 345
 346        if (g_hash_table_size(s->iotlb) >= AMDVI_IOTLB_MAX_SIZE) {
 347            amdvi_iotlb_reset(s);
 348        }
 349
 350        entry->domid = domid;
 351        entry->perms = to_cache.perm;
 352        entry->translated_addr = to_cache.translated_addr;
 353        entry->page_mask = to_cache.addr_mask;
 354        *key = gfn | ((uint64_t)(devid) << AMDVI_DEVID_SHIFT);
 355        g_hash_table_replace(s->iotlb, key, entry);
 356    }
 357}
 358
 359static void amdvi_completion_wait(AMDVIState *s, uint64_t *cmd)
 360{
 361    /* pad the last 3 bits */
 362    hwaddr addr = cpu_to_le64(extract64(cmd[0], 3, 49)) << 3;
 363    uint64_t data = cpu_to_le64(cmd[1]);
 364
 365    if (extract64(cmd[0], 51, 8)) {
 366        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 367                                   s->cmdbuf + s->cmdbuf_head);
 368    }
 369    if (extract64(cmd[0], 0, 1)) {
 370        if (dma_memory_write(&address_space_memory, addr, &data,
 371            AMDVI_COMPLETION_DATA_SIZE)) {
 372            trace_amdvi_completion_wait_fail(addr);
 373        }
 374    }
 375    /* set completion interrupt */
 376    if (extract64(cmd[0], 1, 1)) {
 377        amdvi_test_mask(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_COMP_INT);
 378        /* generate interrupt */
 379        amdvi_generate_msi_interrupt(s);
 380    }
 381    trace_amdvi_completion_wait(addr, data);
 382}
 383
 384/* log error without aborting since linux seems to be using reserved bits */
 385static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 386{
 387    uint16_t devid = cpu_to_le16((uint16_t)extract64(cmd[0], 0, 16));
 388
 389    /* This command should invalidate internal caches of which there isn't */
 390    if (extract64(cmd[0], 15, 16) || cmd[1]) {
 391        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 392                                   s->cmdbuf + s->cmdbuf_head);
 393    }
 394    trace_amdvi_devtab_inval(PCI_BUS_NUM(devid), PCI_SLOT(devid),
 395                             PCI_FUNC(devid));
 396}
 397
 398static void amdvi_complete_ppr(AMDVIState *s, uint64_t *cmd)
 399{
 400    if (extract64(cmd[0], 15, 16) ||  extract64(cmd[0], 19, 8) ||
 401        extract64(cmd[1], 0, 2) || extract64(cmd[1], 3, 29)
 402        || extract64(cmd[1], 47, 16)) {
 403        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 404                                   s->cmdbuf + s->cmdbuf_head);
 405    }
 406    trace_amdvi_ppr_exec();
 407}
 408
 409static void amdvi_inval_all(AMDVIState *s, uint64_t *cmd)
 410{
 411    if (extract64(cmd[0], 0, 60) || cmd[1]) {
 412        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 413                                   s->cmdbuf + s->cmdbuf_head);
 414    }
 415
 416    amdvi_iotlb_reset(s);
 417    trace_amdvi_all_inval();
 418}
 419
 420static gboolean amdvi_iotlb_remove_by_domid(gpointer key, gpointer value,
 421                                            gpointer user_data)
 422{
 423    AMDVIIOTLBEntry *entry = (AMDVIIOTLBEntry *)value;
 424    uint16_t domid = *(uint16_t *)user_data;
 425    return entry->domid == domid;
 426}
 427
 428/* we don't have devid - we can't remove pages by address */
 429static void amdvi_inval_pages(AMDVIState *s, uint64_t *cmd)
 430{
 431    uint16_t domid = cpu_to_le16((uint16_t)extract64(cmd[0], 32, 16));
 432
 433    if (extract64(cmd[0], 20, 12) || extract64(cmd[0], 16, 12) ||
 434        extract64(cmd[0], 3, 10)) {
 435        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 436                                   s->cmdbuf + s->cmdbuf_head);
 437    }
 438
 439    g_hash_table_foreach_remove(s->iotlb, amdvi_iotlb_remove_by_domid,
 440                                &domid);
 441    trace_amdvi_pages_inval(domid);
 442}
 443
 444static void amdvi_prefetch_pages(AMDVIState *s, uint64_t *cmd)
 445{
 446    if (extract64(cmd[0], 16, 8) || extract64(cmd[0], 20, 8) ||
 447        extract64(cmd[1], 1, 1) || extract64(cmd[1], 3, 1) ||
 448        extract64(cmd[1], 5, 7)) {
 449        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 450                                   s->cmdbuf + s->cmdbuf_head);
 451    }
 452
 453    trace_amdvi_prefetch_pages();
 454}
 455
 456static void amdvi_inval_inttable(AMDVIState *s, uint64_t *cmd)
 457{
 458    if (extract64(cmd[0], 16, 16) || cmd[1]) {
 459        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 460                                   s->cmdbuf + s->cmdbuf_head);
 461        return;
 462    }
 463
 464    trace_amdvi_intr_inval();
 465}
 466
 467/* FIXME: Try to work with the specified size instead of all the pages
 468 * when the S bit is on
 469 */
 470static void iommu_inval_iotlb(AMDVIState *s, uint64_t *cmd)
 471{
 472
 473    uint16_t devid = extract64(cmd[0], 0, 16);
 474    if (extract64(cmd[1], 1, 1) || extract64(cmd[1], 3, 9)) {
 475        amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
 476                                   s->cmdbuf + s->cmdbuf_head);
 477        return;
 478    }
 479
 480    if (extract64(cmd[1], 0, 1)) {
 481        g_hash_table_foreach_remove(s->iotlb, amdvi_iotlb_remove_by_devid,
 482                                    &devid);
 483    } else {
 484        amdvi_iotlb_remove_page(s, cpu_to_le64(extract64(cmd[1], 12, 52)) << 12,
 485                                cpu_to_le16(extract64(cmd[1], 0, 16)));
 486    }
 487    trace_amdvi_iotlb_inval();
 488}
 489
 490/* not honouring reserved bits is regarded as an illegal command */
 491static void amdvi_cmdbuf_exec(AMDVIState *s)
 492{
 493    uint64_t cmd[2];
 494
 495    if (dma_memory_read(&address_space_memory, s->cmdbuf + s->cmdbuf_head,
 496        cmd, AMDVI_COMMAND_SIZE)) {
 497        trace_amdvi_command_read_fail(s->cmdbuf, s->cmdbuf_head);
 498        amdvi_log_command_error(s, s->cmdbuf + s->cmdbuf_head);
 499        return;
 500    }
 501
 502    switch (extract64(cmd[0], 60, 4)) {
 503    case AMDVI_CMD_COMPLETION_WAIT:
 504        amdvi_completion_wait(s, cmd);
 505        break;
 506    case AMDVI_CMD_INVAL_DEVTAB_ENTRY:
 507        amdvi_inval_devtab_entry(s, cmd);
 508        break;
 509    case AMDVI_CMD_INVAL_AMDVI_PAGES:
 510        amdvi_inval_pages(s, cmd);
 511        break;
 512    case AMDVI_CMD_INVAL_IOTLB_PAGES:
 513        iommu_inval_iotlb(s, cmd);
 514        break;
 515    case AMDVI_CMD_INVAL_INTR_TABLE:
 516        amdvi_inval_inttable(s, cmd);
 517        break;
 518    case AMDVI_CMD_PREFETCH_AMDVI_PAGES:
 519        amdvi_prefetch_pages(s, cmd);
 520        break;
 521    case AMDVI_CMD_COMPLETE_PPR_REQUEST:
 522        amdvi_complete_ppr(s, cmd);
 523        break;
 524    case AMDVI_CMD_INVAL_AMDVI_ALL:
 525        amdvi_inval_all(s, cmd);
 526        break;
 527    default:
 528        trace_amdvi_unhandled_command(extract64(cmd[1], 60, 4));
 529        /* log illegal command */
 530        amdvi_log_illegalcom_error(s, extract64(cmd[1], 60, 4),
 531                                   s->cmdbuf + s->cmdbuf_head);
 532    }
 533}
 534
 535static void amdvi_cmdbuf_run(AMDVIState *s)
 536{
 537    if (!s->cmdbuf_enabled) {
 538        trace_amdvi_command_error(amdvi_readq(s, AMDVI_MMIO_CONTROL));
 539        return;
 540    }
 541
 542    /* check if there is work to do. */
 543    while (s->cmdbuf_head != s->cmdbuf_tail) {
 544        trace_amdvi_command_exec(s->cmdbuf_head, s->cmdbuf_tail, s->cmdbuf);
 545        amdvi_cmdbuf_exec(s);
 546        s->cmdbuf_head += AMDVI_COMMAND_SIZE;
 547        amdvi_writeq_raw(s, s->cmdbuf_head, AMDVI_MMIO_COMMAND_HEAD);
 548
 549        /* wrap head pointer */
 550        if (s->cmdbuf_head >= s->cmdbuf_len * AMDVI_COMMAND_SIZE) {
 551            s->cmdbuf_head = 0;
 552        }
 553    }
 554}
 555
 556static void amdvi_mmio_trace(hwaddr addr, unsigned size)
 557{
 558    uint8_t index = (addr & ~0x2000) / 8;
 559
 560    if ((addr & 0x2000)) {
 561        /* high table */
 562        index = index >= AMDVI_MMIO_REGS_HIGH ? AMDVI_MMIO_REGS_HIGH : index;
 563        trace_amdvi_mmio_read(amdvi_mmio_high[index], addr, size, addr & ~0x07);
 564    } else {
 565        index = index >= AMDVI_MMIO_REGS_LOW ? AMDVI_MMIO_REGS_LOW : index;
 566        trace_amdvi_mmio_read(amdvi_mmio_low[index], addr, size, addr & ~0x07);
 567    }
 568}
 569
 570static uint64_t amdvi_mmio_read(void *opaque, hwaddr addr, unsigned size)
 571{
 572    AMDVIState *s = opaque;
 573
 574    uint64_t val = -1;
 575    if (addr + size > AMDVI_MMIO_SIZE) {
 576        trace_amdvi_mmio_read_invalid(AMDVI_MMIO_SIZE, addr, size);
 577        return (uint64_t)-1;
 578    }
 579
 580    if (size == 2) {
 581        val = amdvi_readw(s, addr);
 582    } else if (size == 4) {
 583        val = amdvi_readl(s, addr);
 584    } else if (size == 8) {
 585        val = amdvi_readq(s, addr);
 586    }
 587    amdvi_mmio_trace(addr, size);
 588
 589    return val;
 590}
 591
 592static void amdvi_handle_control_write(AMDVIState *s)
 593{
 594    unsigned long control = amdvi_readq(s, AMDVI_MMIO_CONTROL);
 595    s->enabled = !!(control & AMDVI_MMIO_CONTROL_AMDVIEN);
 596
 597    s->ats_enabled = !!(control & AMDVI_MMIO_CONTROL_HTTUNEN);
 598    s->evtlog_enabled = s->enabled && !!(control &
 599                        AMDVI_MMIO_CONTROL_EVENTLOGEN);
 600
 601    s->evtlog_intr = !!(control & AMDVI_MMIO_CONTROL_EVENTINTEN);
 602    s->completion_wait_intr = !!(control & AMDVI_MMIO_CONTROL_COMWAITINTEN);
 603    s->cmdbuf_enabled = s->enabled && !!(control &
 604                        AMDVI_MMIO_CONTROL_CMDBUFLEN);
 605
 606    /* update the flags depending on the control register */
 607    if (s->cmdbuf_enabled) {
 608        amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_CMDBUF_RUN);
 609    } else {
 610        amdvi_assign_andq(s, AMDVI_MMIO_STATUS, ~AMDVI_MMIO_STATUS_CMDBUF_RUN);
 611    }
 612    if (s->evtlog_enabled) {
 613        amdvi_assign_orq(s, AMDVI_MMIO_STATUS, AMDVI_MMIO_STATUS_EVT_RUN);
 614    } else {
 615        amdvi_assign_andq(s, AMDVI_MMIO_STATUS, ~AMDVI_MMIO_STATUS_EVT_RUN);
 616    }
 617
 618    trace_amdvi_control_status(control);
 619    amdvi_cmdbuf_run(s);
 620}
 621
 622static inline void amdvi_handle_devtab_write(AMDVIState *s)
 623
 624{
 625    uint64_t val = amdvi_readq(s, AMDVI_MMIO_DEVICE_TABLE);
 626    s->devtab = (val & AMDVI_MMIO_DEVTAB_BASE_MASK);
 627
 628    /* set device table length */
 629    s->devtab_len = ((val & AMDVI_MMIO_DEVTAB_SIZE_MASK) + 1 *
 630                    (AMDVI_MMIO_DEVTAB_SIZE_UNIT /
 631                     AMDVI_MMIO_DEVTAB_ENTRY_SIZE));
 632}
 633
 634static inline void amdvi_handle_cmdhead_write(AMDVIState *s)
 635{
 636    s->cmdbuf_head = amdvi_readq(s, AMDVI_MMIO_COMMAND_HEAD)
 637                     & AMDVI_MMIO_CMDBUF_HEAD_MASK;
 638    amdvi_cmdbuf_run(s);
 639}
 640
 641static inline void amdvi_handle_cmdbase_write(AMDVIState *s)
 642{
 643    s->cmdbuf = amdvi_readq(s, AMDVI_MMIO_COMMAND_BASE)
 644                & AMDVI_MMIO_CMDBUF_BASE_MASK;
 645    s->cmdbuf_len = 1UL << (amdvi_readq(s, AMDVI_MMIO_CMDBUF_SIZE_BYTE)
 646                    & AMDVI_MMIO_CMDBUF_SIZE_MASK);
 647    s->cmdbuf_head = s->cmdbuf_tail = 0;
 648}
 649
 650static inline void amdvi_handle_cmdtail_write(AMDVIState *s)
 651{
 652    s->cmdbuf_tail = amdvi_readq(s, AMDVI_MMIO_COMMAND_TAIL)
 653                     & AMDVI_MMIO_CMDBUF_TAIL_MASK;
 654    amdvi_cmdbuf_run(s);
 655}
 656
 657static inline void amdvi_handle_excllim_write(AMDVIState *s)
 658{
 659    uint64_t val = amdvi_readq(s, AMDVI_MMIO_EXCL_LIMIT);
 660    s->excl_limit = (val & AMDVI_MMIO_EXCL_LIMIT_MASK) |
 661                    AMDVI_MMIO_EXCL_LIMIT_LOW;
 662}
 663
 664static inline void amdvi_handle_evtbase_write(AMDVIState *s)
 665{
 666    uint64_t val = amdvi_readq(s, AMDVI_MMIO_EVENT_BASE);
 667    s->evtlog = val & AMDVI_MMIO_EVTLOG_BASE_MASK;
 668    s->evtlog_len = 1UL << (amdvi_readq(s, AMDVI_MMIO_EVTLOG_SIZE_BYTE)
 669                    & AMDVI_MMIO_EVTLOG_SIZE_MASK);
 670}
 671
 672static inline void amdvi_handle_evttail_write(AMDVIState *s)
 673{
 674    uint64_t val = amdvi_readq(s, AMDVI_MMIO_EVENT_TAIL);
 675    s->evtlog_tail = val & AMDVI_MMIO_EVTLOG_TAIL_MASK;
 676}
 677
 678static inline void amdvi_handle_evthead_write(AMDVIState *s)
 679{
 680    uint64_t val = amdvi_readq(s, AMDVI_MMIO_EVENT_HEAD);
 681    s->evtlog_head = val & AMDVI_MMIO_EVTLOG_HEAD_MASK;
 682}
 683
 684static inline void amdvi_handle_pprbase_write(AMDVIState *s)
 685{
 686    uint64_t val = amdvi_readq(s, AMDVI_MMIO_PPR_BASE);
 687    s->ppr_log = val & AMDVI_MMIO_PPRLOG_BASE_MASK;
 688    s->pprlog_len = 1UL << (amdvi_readq(s, AMDVI_MMIO_PPRLOG_SIZE_BYTE)
 689                    & AMDVI_MMIO_PPRLOG_SIZE_MASK);
 690}
 691
 692static inline void amdvi_handle_pprhead_write(AMDVIState *s)
 693{
 694    uint64_t val = amdvi_readq(s, AMDVI_MMIO_PPR_HEAD);
 695    s->pprlog_head = val & AMDVI_MMIO_PPRLOG_HEAD_MASK;
 696}
 697
 698static inline void amdvi_handle_pprtail_write(AMDVIState *s)
 699{
 700    uint64_t val = amdvi_readq(s, AMDVI_MMIO_PPR_TAIL);
 701    s->pprlog_tail = val & AMDVI_MMIO_PPRLOG_TAIL_MASK;
 702}
 703
 704/* FIXME: something might go wrong if System Software writes in chunks
 705 * of one byte but linux writes in chunks of 4 bytes so currently it
 706 * works correctly with linux but will definitely be busted if software
 707 * reads/writes 8 bytes
 708 */
 709static void amdvi_mmio_reg_write(AMDVIState *s, unsigned size, uint64_t val,
 710                                 hwaddr addr)
 711{
 712    if (size == 2) {
 713        amdvi_writew(s, addr, val);
 714    } else if (size == 4) {
 715        amdvi_writel(s, addr, val);
 716    } else if (size == 8) {
 717        amdvi_writeq(s, addr, val);
 718    }
 719}
 720
 721static void amdvi_mmio_write(void *opaque, hwaddr addr, uint64_t val,
 722                             unsigned size)
 723{
 724    AMDVIState *s = opaque;
 725    unsigned long offset = addr & 0x07;
 726
 727    if (addr + size > AMDVI_MMIO_SIZE) {
 728        trace_amdvi_mmio_write("error: addr outside region: max ",
 729                (uint64_t)AMDVI_MMIO_SIZE, size, val, offset);
 730        return;
 731    }
 732
 733    amdvi_mmio_trace(addr, size);
 734    switch (addr & ~0x07) {
 735    case AMDVI_MMIO_CONTROL:
 736        amdvi_mmio_reg_write(s, size, val, addr);
 737        amdvi_handle_control_write(s);
 738        break;
 739    case AMDVI_MMIO_DEVICE_TABLE:
 740        amdvi_mmio_reg_write(s, size, val, addr);
 741       /*  set device table address
 742        *   This also suffers from inability to tell whether software
 743        *   is done writing
 744        */
 745        if (offset || (size == 8)) {
 746            amdvi_handle_devtab_write(s);
 747        }
 748        break;
 749    case AMDVI_MMIO_COMMAND_HEAD:
 750        amdvi_mmio_reg_write(s, size, val, addr);
 751        amdvi_handle_cmdhead_write(s);
 752        break;
 753    case AMDVI_MMIO_COMMAND_BASE:
 754        amdvi_mmio_reg_write(s, size, val, addr);
 755        /* FIXME - make sure System Software has finished writing incase
 756         * it writes in chucks less than 8 bytes in a robust way.As for
 757         * now, this hacks works for the linux driver
 758         */
 759        if (offset || (size == 8)) {
 760            amdvi_handle_cmdbase_write(s);
 761        }
 762        break;
 763    case AMDVI_MMIO_COMMAND_TAIL:
 764        amdvi_mmio_reg_write(s, size, val, addr);
 765        amdvi_handle_cmdtail_write(s);
 766        break;
 767    case AMDVI_MMIO_EVENT_BASE:
 768        amdvi_mmio_reg_write(s, size, val, addr);
 769        amdvi_handle_evtbase_write(s);
 770        break;
 771    case AMDVI_MMIO_EVENT_HEAD:
 772        amdvi_mmio_reg_write(s, size, val, addr);
 773        amdvi_handle_evthead_write(s);
 774        break;
 775    case AMDVI_MMIO_EVENT_TAIL:
 776        amdvi_mmio_reg_write(s, size, val, addr);
 777        amdvi_handle_evttail_write(s);
 778        break;
 779    case AMDVI_MMIO_EXCL_LIMIT:
 780        amdvi_mmio_reg_write(s, size, val, addr);
 781        amdvi_handle_excllim_write(s);
 782        break;
 783        /* PPR log base - unused for now */
 784    case AMDVI_MMIO_PPR_BASE:
 785        amdvi_mmio_reg_write(s, size, val, addr);
 786        amdvi_handle_pprbase_write(s);
 787        break;
 788        /* PPR log head - also unused for now */
 789    case AMDVI_MMIO_PPR_HEAD:
 790        amdvi_mmio_reg_write(s, size, val, addr);
 791        amdvi_handle_pprhead_write(s);
 792        break;
 793        /* PPR log tail - unused for now */
 794    case AMDVI_MMIO_PPR_TAIL:
 795        amdvi_mmio_reg_write(s, size, val, addr);
 796        amdvi_handle_pprtail_write(s);
 797        break;
 798    }
 799}
 800
 801static inline uint64_t amdvi_get_perms(uint64_t entry)
 802{
 803    return (entry & (AMDVI_DEV_PERM_READ | AMDVI_DEV_PERM_WRITE)) >>
 804           AMDVI_DEV_PERM_SHIFT;
 805}
 806
 807/* a valid entry should have V = 1 and reserved bits honoured */
 808static bool amdvi_validate_dte(AMDVIState *s, uint16_t devid,
 809                               uint64_t *dte)
 810{
 811    if ((dte[0] & AMDVI_DTE_LOWER_QUAD_RESERVED)
 812        || (dte[1] & AMDVI_DTE_MIDDLE_QUAD_RESERVED)
 813        || (dte[2] & AMDVI_DTE_UPPER_QUAD_RESERVED) || dte[3]) {
 814        amdvi_log_illegaldevtab_error(s, devid,
 815                                      s->devtab +
 816                                      devid * AMDVI_DEVTAB_ENTRY_SIZE, 0);
 817        return false;
 818    }
 819
 820    return dte[0] & AMDVI_DEV_VALID;
 821}
 822
 823/* get a device table entry given the devid */
 824static bool amdvi_get_dte(AMDVIState *s, int devid, uint64_t *entry)
 825{
 826    uint32_t offset = devid * AMDVI_DEVTAB_ENTRY_SIZE;
 827
 828    if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
 829        AMDVI_DEVTAB_ENTRY_SIZE)) {
 830        trace_amdvi_dte_get_fail(s->devtab, offset);
 831        /* log error accessing dte */
 832        amdvi_log_devtab_error(s, devid, s->devtab + offset, 0);
 833        return false;
 834    }
 835
 836    *entry = le64_to_cpu(*entry);
 837    if (!amdvi_validate_dte(s, devid, entry)) {
 838        trace_amdvi_invalid_dte(entry[0]);
 839        return false;
 840    }
 841
 842    return true;
 843}
 844
 845/* get pte translation mode */
 846static inline uint8_t get_pte_translation_mode(uint64_t pte)
 847{
 848    return (pte >> AMDVI_DEV_MODE_RSHIFT) & AMDVI_DEV_MODE_MASK;
 849}
 850
 851static inline uint64_t pte_override_page_mask(uint64_t pte)
 852{
 853    uint8_t page_mask = 12;
 854    uint64_t addr = (pte & AMDVI_DEV_PT_ROOT_MASK) ^ AMDVI_DEV_PT_ROOT_MASK;
 855    /* find the first zero bit */
 856    while (addr & 1) {
 857        page_mask++;
 858        addr = addr >> 1;
 859    }
 860
 861    return ~((1ULL << page_mask) - 1);
 862}
 863
 864static inline uint64_t pte_get_page_mask(uint64_t oldlevel)
 865{
 866    return ~((1UL << ((oldlevel * 9) + 3)) - 1);
 867}
 868
 869static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
 870                                          uint16_t devid)
 871{
 872    uint64_t pte;
 873
 874    if (dma_memory_read(&address_space_memory, pte_addr, &pte, sizeof(pte))) {
 875        trace_amdvi_get_pte_hwerror(pte_addr);
 876        amdvi_log_pagetab_error(s, devid, pte_addr, 0);
 877        pte = 0;
 878        return pte;
 879    }
 880
 881    pte = le64_to_cpu(pte);
 882    return pte;
 883}
 884
 885static void amdvi_page_walk(AMDVIAddressSpace *as, uint64_t *dte,
 886                            IOMMUTLBEntry *ret, unsigned perms,
 887                            hwaddr addr)
 888{
 889    unsigned level, present, pte_perms, oldlevel;
 890    uint64_t pte = dte[0], pte_addr, page_mask;
 891
 892    /* make sure the DTE has TV = 1 */
 893    if (pte & AMDVI_DEV_TRANSLATION_VALID) {
 894        level = get_pte_translation_mode(pte);
 895        if (level >= 7) {
 896            trace_amdvi_mode_invalid(level, addr);
 897            return;
 898        }
 899        if (level == 0) {
 900            goto no_remap;
 901        }
 902
 903        /* we are at the leaf page table or page table encodes a huge page */
 904        while (level > 0) {
 905            pte_perms = amdvi_get_perms(pte);
 906            present = pte & 1;
 907            if (!present || perms != (perms & pte_perms)) {
 908                amdvi_page_fault(as->iommu_state, as->devfn, addr, perms);
 909                trace_amdvi_page_fault(addr);
 910                return;
 911            }
 912
 913            /* go to the next lower level */
 914            pte_addr = pte & AMDVI_DEV_PT_ROOT_MASK;
 915            /* add offset and load pte */
 916            pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
 917            pte = amdvi_get_pte_entry(as->iommu_state, pte_addr, as->devfn);
 918            if (!pte) {
 919                return;
 920            }
 921            oldlevel = level;
 922            level = get_pte_translation_mode(pte);
 923            if (level == 0x7) {
 924                break;
 925            }
 926        }
 927
 928        if (level == 0x7) {
 929            page_mask = pte_override_page_mask(pte);
 930        } else {
 931            page_mask = pte_get_page_mask(oldlevel);
 932        }
 933
 934        /* get access permissions from pte */
 935        ret->iova = addr & page_mask;
 936        ret->translated_addr = (pte & AMDVI_DEV_PT_ROOT_MASK) & page_mask;
 937        ret->addr_mask = ~page_mask;
 938        ret->perm = amdvi_get_perms(pte);
 939        return;
 940    }
 941no_remap:
 942    ret->iova = addr & AMDVI_PAGE_MASK_4K;
 943    ret->translated_addr = addr & AMDVI_PAGE_MASK_4K;
 944    ret->addr_mask = ~AMDVI_PAGE_MASK_4K;
 945    ret->perm = amdvi_get_perms(pte);
 946}
 947
 948static void amdvi_do_translate(AMDVIAddressSpace *as, hwaddr addr,
 949                               bool is_write, IOMMUTLBEntry *ret)
 950{
 951    AMDVIState *s = as->iommu_state;
 952    uint16_t devid = PCI_BUILD_BDF(as->bus_num, as->devfn);
 953    AMDVIIOTLBEntry *iotlb_entry = amdvi_iotlb_lookup(s, addr, devid);
 954    uint64_t entry[4];
 955
 956    if (iotlb_entry) {
 957        trace_amdvi_iotlb_hit(PCI_BUS_NUM(devid), PCI_SLOT(devid),
 958                PCI_FUNC(devid), addr, iotlb_entry->translated_addr);
 959        ret->iova = addr & ~iotlb_entry->page_mask;
 960        ret->translated_addr = iotlb_entry->translated_addr;
 961        ret->addr_mask = iotlb_entry->page_mask;
 962        ret->perm = iotlb_entry->perms;
 963        return;
 964    }
 965
 966    /* devices with V = 0 are not translated */
 967    if (!amdvi_get_dte(s, devid, entry)) {
 968        goto out;
 969    }
 970
 971    amdvi_page_walk(as, entry, ret,
 972                    is_write ? AMDVI_PERM_WRITE : AMDVI_PERM_READ, addr);
 973
 974    amdvi_update_iotlb(s, devid, addr, *ret,
 975                       entry[1] & AMDVI_DEV_DOMID_ID_MASK);
 976    return;
 977
 978out:
 979    ret->iova = addr & AMDVI_PAGE_MASK_4K;
 980    ret->translated_addr = addr & AMDVI_PAGE_MASK_4K;
 981    ret->addr_mask = ~AMDVI_PAGE_MASK_4K;
 982    ret->perm = IOMMU_RW;
 983}
 984
 985static inline bool amdvi_is_interrupt_addr(hwaddr addr)
 986{
 987    return addr >= AMDVI_INT_ADDR_FIRST && addr <= AMDVI_INT_ADDR_LAST;
 988}
 989
 990static IOMMUTLBEntry amdvi_translate(IOMMUMemoryRegion *iommu, hwaddr addr,
 991                                     IOMMUAccessFlags flag)
 992{
 993    AMDVIAddressSpace *as = container_of(iommu, AMDVIAddressSpace, iommu);
 994    AMDVIState *s = as->iommu_state;
 995    IOMMUTLBEntry ret = {
 996        .target_as = &address_space_memory,
 997        .iova = addr,
 998        .translated_addr = 0,
 999        .addr_mask = ~(hwaddr)0,
1000        .perm = IOMMU_NONE
1001    };
1002
1003    if (!s->enabled) {
1004        /* AMDVI disabled - corresponds to iommu=off not
1005         * failure to provide any parameter
1006         */
1007        ret.iova = addr & AMDVI_PAGE_MASK_4K;
1008        ret.translated_addr = addr & AMDVI_PAGE_MASK_4K;
1009        ret.addr_mask = ~AMDVI_PAGE_MASK_4K;
1010        ret.perm = IOMMU_RW;
1011        return ret;
1012    } else if (amdvi_is_interrupt_addr(addr)) {
1013        ret.iova = addr & AMDVI_PAGE_MASK_4K;
1014        ret.translated_addr = addr & AMDVI_PAGE_MASK_4K;
1015        ret.addr_mask = ~AMDVI_PAGE_MASK_4K;
1016        ret.perm = IOMMU_WO;
1017        return ret;
1018    }
1019
1020    amdvi_do_translate(as, addr, flag & IOMMU_WO, &ret);
1021    trace_amdvi_translation_result(as->bus_num, PCI_SLOT(as->devfn),
1022            PCI_FUNC(as->devfn), addr, ret.translated_addr);
1023    return ret;
1024}
1025
1026static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
1027{
1028    AMDVIState *s = opaque;
1029    AMDVIAddressSpace **iommu_as;
1030    int bus_num = pci_bus_num(bus);
1031
1032    iommu_as = s->address_spaces[bus_num];
1033
1034    /* allocate memory during the first run */
1035    if (!iommu_as) {
1036        iommu_as = g_malloc0(sizeof(AMDVIAddressSpace *) * PCI_DEVFN_MAX);
1037        s->address_spaces[bus_num] = iommu_as;
1038    }
1039
1040    /* set up AMD-Vi region */
1041    if (!iommu_as[devfn]) {
1042        iommu_as[devfn] = g_malloc0(sizeof(AMDVIAddressSpace));
1043        iommu_as[devfn]->bus_num = (uint8_t)bus_num;
1044        iommu_as[devfn]->devfn = (uint8_t)devfn;
1045        iommu_as[devfn]->iommu_state = s;
1046
1047        memory_region_init_iommu(&iommu_as[devfn]->iommu,
1048                                 sizeof(iommu_as[devfn]->iommu),
1049                                 TYPE_AMD_IOMMU_MEMORY_REGION,
1050                                 OBJECT(s),
1051                                 "amd-iommu", UINT64_MAX);
1052        address_space_init(&iommu_as[devfn]->as,
1053                           MEMORY_REGION(&iommu_as[devfn]->iommu),
1054                           "amd-iommu");
1055    }
1056    return &iommu_as[devfn]->as;
1057}
1058
1059static const MemoryRegionOps mmio_mem_ops = {
1060    .read = amdvi_mmio_read,
1061    .write = amdvi_mmio_write,
1062    .endianness = DEVICE_LITTLE_ENDIAN,
1063    .impl = {
1064        .min_access_size = 1,
1065        .max_access_size = 8,
1066        .unaligned = false,
1067    },
1068    .valid = {
1069        .min_access_size = 1,
1070        .max_access_size = 8,
1071    }
1072};
1073
1074static void amdvi_iommu_notify_flag_changed(IOMMUMemoryRegion *iommu,
1075                                            IOMMUNotifierFlag old,
1076                                            IOMMUNotifierFlag new)
1077{
1078    AMDVIAddressSpace *as = container_of(iommu, AMDVIAddressSpace, iommu);
1079
1080    if (new & IOMMU_NOTIFIER_MAP) {
1081        error_report("device %02x.%02x.%x requires iommu notifier which is not "
1082                     "currently supported", as->bus_num, PCI_SLOT(as->devfn),
1083                     PCI_FUNC(as->devfn));
1084        exit(1);
1085    }
1086}
1087
1088static void amdvi_init(AMDVIState *s)
1089{
1090    amdvi_iotlb_reset(s);
1091
1092    s->devtab_len = 0;
1093    s->cmdbuf_len = 0;
1094    s->cmdbuf_head = 0;
1095    s->cmdbuf_tail = 0;
1096    s->evtlog_head = 0;
1097    s->evtlog_tail = 0;
1098    s->excl_enabled = false;
1099    s->excl_allow = false;
1100    s->mmio_enabled = false;
1101    s->enabled = false;
1102    s->ats_enabled = false;
1103    s->cmdbuf_enabled = false;
1104
1105    /* reset MMIO */
1106    memset(s->mmior, 0, AMDVI_MMIO_SIZE);
1107    amdvi_set_quad(s, AMDVI_MMIO_EXT_FEATURES, AMDVI_EXT_FEATURES,
1108            0xffffffffffffffef, 0);
1109    amdvi_set_quad(s, AMDVI_MMIO_STATUS, 0, 0x98, 0x67);
1110
1111    /* reset device ident */
1112    pci_config_set_vendor_id(s->pci.dev.config, PCI_VENDOR_ID_AMD);
1113    pci_config_set_prog_interface(s->pci.dev.config, 00);
1114    pci_config_set_device_id(s->pci.dev.config, s->devid);
1115    pci_config_set_class(s->pci.dev.config, 0x0806);
1116
1117    /* reset AMDVI specific capabilities, all r/o */
1118    pci_set_long(s->pci.dev.config + s->capab_offset, AMDVI_CAPAB_FEATURES);
1119    pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_BAR_LOW,
1120                 s->mmio.addr & ~(0xffff0000));
1121    pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_BAR_HIGH,
1122                (s->mmio.addr & ~(0xffff)) >> 16);
1123    pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_RANGE,
1124                 0xff000000);
1125    pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_MISC, 0);
1126    pci_set_long(s->pci.dev.config + s->capab_offset + AMDVI_CAPAB_MISC,
1127            AMDVI_MAX_PH_ADDR | AMDVI_MAX_GVA_ADDR | AMDVI_MAX_VA_ADDR);
1128}
1129
1130static void amdvi_reset(DeviceState *dev)
1131{
1132    AMDVIState *s = AMD_IOMMU_DEVICE(dev);
1133
1134    msi_reset(&s->pci.dev);
1135    amdvi_init(s);
1136}
1137
1138static void amdvi_realize(DeviceState *dev, Error **err)
1139{
1140    int ret = 0;
1141    AMDVIState *s = AMD_IOMMU_DEVICE(dev);
1142    X86IOMMUState *x86_iommu = X86_IOMMU_DEVICE(dev);
1143    MachineState *ms = MACHINE(qdev_get_machine());
1144    MachineClass *mc = MACHINE_GET_CLASS(ms);
1145    PCMachineState *pcms =
1146        PC_MACHINE(object_dynamic_cast(OBJECT(ms), TYPE_PC_MACHINE));
1147    PCIBus *bus;
1148
1149    if (!pcms) {
1150        error_setg(err, "Machine-type '%s' not supported by amd-iommu",
1151                   mc->name);
1152        return;
1153    }
1154
1155    bus = pcms->bus;
1156    s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
1157                                     amdvi_uint64_equal, g_free, g_free);
1158
1159    /* This device should take care of IOMMU PCI properties */
1160    x86_iommu->type = TYPE_AMD;
1161    qdev_set_parent_bus(DEVICE(&s->pci), &bus->qbus);
1162    object_property_set_bool(OBJECT(&s->pci), true, "realized", err);
1163    ret = pci_add_capability(&s->pci.dev, AMDVI_CAPAB_ID_SEC, 0,
1164                                         AMDVI_CAPAB_SIZE, err);
1165    if (ret < 0) {
1166        return;
1167    }
1168    s->capab_offset = ret;
1169
1170    ret = pci_add_capability(&s->pci.dev, PCI_CAP_ID_MSI, 0,
1171                             AMDVI_CAPAB_REG_SIZE, err);
1172    if (ret < 0) {
1173        return;
1174    }
1175    ret = pci_add_capability(&s->pci.dev, PCI_CAP_ID_HT, 0,
1176                             AMDVI_CAPAB_REG_SIZE, err);
1177    if (ret < 0) {
1178        return;
1179    }
1180
1181    /* set up MMIO */
1182    memory_region_init_io(&s->mmio, OBJECT(s), &mmio_mem_ops, s, "amdvi-mmio",
1183                          AMDVI_MMIO_SIZE);
1184
1185    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->mmio);
1186    sysbus_mmio_map(SYS_BUS_DEVICE(s), 0, AMDVI_BASE_ADDR);
1187    pci_setup_iommu(bus, amdvi_host_dma_iommu, s);
1188    s->devid = object_property_get_int(OBJECT(&s->pci), "addr", err);
1189    msi_init(&s->pci.dev, 0, 1, true, false, err);
1190    amdvi_init(s);
1191}
1192
1193static const VMStateDescription vmstate_amdvi = {
1194    .name = "amd-iommu",
1195    .unmigratable = 1
1196};
1197
1198static void amdvi_instance_init(Object *klass)
1199{
1200    AMDVIState *s = AMD_IOMMU_DEVICE(klass);
1201
1202    object_initialize(&s->pci, sizeof(s->pci), TYPE_AMD_IOMMU_PCI);
1203}
1204
1205static void amdvi_class_init(ObjectClass *klass, void* data)
1206{
1207    DeviceClass *dc = DEVICE_CLASS(klass);
1208    X86IOMMUClass *dc_class = X86_IOMMU_CLASS(klass);
1209
1210    dc->reset = amdvi_reset;
1211    dc->vmsd = &vmstate_amdvi;
1212    dc->hotpluggable = false;
1213    dc_class->realize = amdvi_realize;
1214    /* Supported by the pc-q35-* machine types */
1215    dc->user_creatable = true;
1216}
1217
1218static const TypeInfo amdvi = {
1219    .name = TYPE_AMD_IOMMU_DEVICE,
1220    .parent = TYPE_X86_IOMMU_DEVICE,
1221    .instance_size = sizeof(AMDVIState),
1222    .instance_init = amdvi_instance_init,
1223    .class_init = amdvi_class_init
1224};
1225
1226static const TypeInfo amdviPCI = {
1227    .name = "AMDVI-PCI",
1228    .parent = TYPE_PCI_DEVICE,
1229    .instance_size = sizeof(AMDVIPCIState),
1230};
1231
1232static void amdvi_iommu_memory_region_class_init(ObjectClass *klass, void *data)
1233{
1234    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
1235
1236    imrc->translate = amdvi_translate;
1237    imrc->notify_flag_changed = amdvi_iommu_notify_flag_changed;
1238}
1239
1240static const TypeInfo amdvi_iommu_memory_region_info = {
1241    .parent = TYPE_IOMMU_MEMORY_REGION,
1242    .name = TYPE_AMD_IOMMU_MEMORY_REGION,
1243    .class_init = amdvi_iommu_memory_region_class_init,
1244};
1245
1246static void amdviPCI_register_types(void)
1247{
1248    type_register_static(&amdviPCI);
1249    type_register_static(&amdvi);
1250    type_register_static(&amdvi_iommu_memory_region_info);
1251}
1252
1253type_init(amdviPCI_register_types);
1254