AMD IOMMU emulation patchset

82 lines not on this page · raw message

260 lines not on this page · raw message

index be5ad67..deb71fd 100644
@@ -56,6 +56,8 @@ struct BusInfo {
     Property *props;
 };
 
+struct iommu;
+
 struct BusState {
     DeviceState *parent;
     BusInfo *info;

@@ -64,6 +66,10 @@ struct BusState {
     int qdev_allocated;
     QLIST_HEAD(, DeviceState) children;
     QLIST_ENTRY(BusState) sibling;
+
+#ifdef CONFIG_IOMMU
+    struct iommu *iommu;
+#endif
 };
 
 struct Property {

621 lines not on this page · raw message

index 186e322..4c929f9 100644
@@ -1066,6 +1066,10 @@ void pc_pci_device_init(PCIBus *pci_bus)
     int max_bus;
     int bus;
 
+#ifdef CONFIG_AMD_IOMMU
+    amd_iommu_init(pci_bus);
+#endif
+
     max_bus = drive_get_max_bus(IF_SCSI);
     for (bus = 0; bus <= max_bus; bus++) {
         pci_create_simple(pci_bus, -1, "lsi53c895a");

index 3ef2f75..255ad93 100644
@@ -191,4 +191,7 @@ void extboot_init(BlockDriverState *bs);
 
 int e820_add_entry(uint64_t, uint64_t, uint32_t);
 
+/* amd_iommu.c */
+void amd_iommu_init(PCIBus *bus);
+
 #endif

index 39e9f1d..d790312 100644
@@ -26,6 +26,7 @@
 
 #define PCI_CLASS_MEMORY_RAM             0x0500
 
+#define PCI_CLASS_SYSTEM_IOMMU           0x0806
 #define PCI_CLASS_SYSTEM_OTHER           0x0880
 
 #define PCI_CLASS_SERIAL_USB             0x0c03

@@ -56,6 +57,7 @@
 
 #define PCI_VENDOR_ID_AMD                0x1022
 #define PCI_DEVICE_ID_AMD_LANCE          0x2000
+#define PCI_DEVICE_ID_AMD_IOMMU          0x0000     /* FIXME */
 
 #define PCI_VENDOR_ID_MOTOROLA           0x1057
 #define PCI_DEVICE_ID_MOTOROLA_MPC106    0x0002

index 1c675dc..6399b5d 100644
@@ -216,6 +216,7 @@
 #define  PCI_CAP_ID_SHPC 	0x0C	/* PCI Standard Hot-Plug Controller */
 #define  PCI_CAP_ID_SSVID	0x0D	/* Bridge subsystem vendor/device ID */
 #define  PCI_CAP_ID_AGP3	0x0E	/* AGP Target PCI-PCI bridge */
+#define  PCI_CAP_ID_SEC     0x0F    /* Secure Device (AMD IOMMU) */
 #define  PCI_CAP_ID_EXP 	0x10	/* PCI Express */
 #define  PCI_CAP_ID_MSIX	0x11	/* MSI-X */
 #define  PCI_CAP_ID_AF		0x13	/* PCI Advanced Features */

index 6871728..9c5d706 100644
@@ -22,6 +22,7 @@
  * THE SOFTWARE.
  */
 #include "hw.h"
+#include "iommu.h"
 #include "pci.h"
 #include "monitor.h"
 #include "net.h"

@@ -733,12 +734,25 @@ static void do_pci_unregister_device(PCIDevice *pci_dev)
     pci_config_free(pci_dev);
 }
 
+#ifdef CONFIG_IOMMU
+static inline int pci_iommu_register_device(PCIBus *bus, PCIDevice *dev)
+{
+    return iommu_register_device(bus->qbus.iommu, &dev->qdev);
+}
+#else
+static inline int pci_iommu_register_device(PCIBus *bus, PCIDevice *dev)
+{
+    return 0;
+}
+#endif
+
 PCIDevice *pci_register_device(PCIBus *bus, const char *name,
                                int instance_size, int devfn,
                                PCIConfigReadFunc *config_read,
                                PCIConfigWriteFunc *config_write)
 {
     PCIDevice *pci_dev;
+    int err;
 
     pci_dev = qemu_mallocz(instance_size);
     pci_dev = do_pci_register_device(pci_dev, bus, name, devfn,

@@ -747,6 +761,13 @@ PCIDevice *pci_register_device(PCIBus *bus, const char *name,
     if (pci_dev == NULL) {
         hw_error("PCI: can't register device\n");
     }
+
+    err = pci_iommu_register_device(bus, pci_dev);
+    if (err) {
+        hw_error("PCI: can't register device with IOMMU\n");
+        return NULL;
+    }
+
     return pci_dev;
 }
 

index 0b3b7c2..7f8f7df 100644
@@ -26,6 +26,7 @@
 #include <hw/pc.h>
 #include <hw/pci.h>
 #include <hw/scsi.h>
+#include <hw/iommu.h>
 #include "qemu-timer.h"
 #include "sysemu.h"
 #include "dma.h"

@@ -433,7 +434,12 @@ static int dma_buf_prepare(BMDMAState *bm, int is_write)
         uint32_t addr;
         uint32_t size;
     } prd;
-    int l, len;
+    int l, len, err, io_len;
+    struct iommu *iommu;
+    DeviceState *dev;
+    target_phys_addr_t io_addr;
+
+    iommu = iommu_get(s->bus->qbus.parent, &dev);
 
     qemu_sglist_init(&s->sg, s->nsector / (IDE_PAGE_SIZE / 512) + 1);
     s->io_buffer_size = 0;

@@ -443,7 +449,7 @@ static int dma_buf_prepare(BMDMAState *bm, int is_write)
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= IDE_PAGE_SIZE)
                 return s->io_buffer_size != 0;
-            cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
+            err = iommu_read(iommu, dev, bm->cur_addr, (uint8_t *)&prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);

@@ -455,11 +461,22 @@ static int dma_buf_prepare(BMDMAState *bm, int is_write)
             bm->cur_prd_last = (prd.size & 0x80000000);
         }
         l = bm->cur_prd_len;
-        if (l > 0) {
-            qemu_sglist_add(&s->sg, bm->cur_prd_addr, l);
-            bm->cur_prd_addr += l;
-            bm->cur_prd_len -= l;
-            s->io_buffer_size += l;
+        while (l > 0) {
+            /*
+             * In case translation / access checking fails no
+             * transfer happens but we pretend it went through.
+             */
+            err = iommu_translate(iommu, dev, bm->cur_prd_addr,
+                                  &io_addr, &io_len, !is_write);
+            if (!err) {
+                if (io_len > l)
+                    io_len = l;
+                qemu_sglist_add(&s->sg, io_addr, io_len);
+            }
+            bm->cur_prd_addr += io_len;
+            bm->cur_prd_len -= io_len;
+            s->io_buffer_size += io_len;
+            l -= io_len;
         }
     }
     return 1;

@@ -516,6 +533,10 @@ static int dma_buf_rw(BMDMAState *bm, int is_write)
         uint32_t size;
     } prd;
     int l, len;
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(s->bus->qbus.parent, &dev);
 
     for(;;) {
         l = s->io_buffer_size - s->io_buffer_index;

@@ -526,7 +547,7 @@ static int dma_buf_rw(BMDMAState *bm, int is_write)
             if (bm->cur_prd_last ||
                 (bm->cur_addr - bm->addr) >= IDE_PAGE_SIZE)
                 return 0;
-            cpu_physical_memory_read(bm->cur_addr, (uint8_t *)&prd, 8);
+            iommu_read(iommu, dev, bm->cur_addr, (uint8_t *)&prd, 8);
             bm->cur_addr += 8;
             prd.addr = le32_to_cpu(prd.addr);
             prd.size = le32_to_cpu(prd.size);

@@ -540,13 +561,8 @@ static int dma_buf_rw(BMDMAState *bm, int is_write)
         if (l > bm->cur_prd_len)
             l = bm->cur_prd_len;
         if (l > 0) {
-            if (is_write) {
-                cpu_physical_memory_write(bm->cur_prd_addr,
-                                          s->io_buffer + s->io_buffer_index, l);
-            } else {
-                cpu_physical_memory_read(bm->cur_prd_addr,
-                                          s->io_buffer + s->io_buffer_index, l);
-            }
+            iommu_rw(iommu, dev, bm->cur_prd_addr,
+                     s->io_buffer + s->io_buffer_index, l, is_write);
             bm->cur_prd_addr += l;
             bm->cur_prd_len -= l;
             s->io_buffer_index += l;

index 72e2242..0f78a69 100644
@@ -48,6 +48,7 @@
  */
 
 #include "hw.h"
+#include "iommu.h"
 #include "pci.h"
 #include "qemu-timer.h"
 #include "net.h"

@@ -416,7 +417,7 @@ typedef struct RTL8139TallyCounters
 static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters);
 
 /* Writes tally counters to specified physical memory address */
-static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* counters);
+static void RTL8139TallyCounters_physical_memory_write(DeviceState *qdev, target_phys_addr_t tc_addr, RTL8139TallyCounters* counters);
 
 typedef struct RTL8139State {
     PCIDevice dev;

@@ -746,6 +747,11 @@ static int rtl8139_cp_transmitter_enabled(RTL8139State *s)
 
 static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     if (s->RxBufAddr + size > s->RxBufferSize)
     {
         int wrapped = MOD2(s->RxBufAddr + size, s->RxBufferSize);

@@ -757,15 +763,15 @@ static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
 
             if (size > wrapped)
             {
-                cpu_physical_memory_write( s->RxBuf + s->RxBufAddr,
-                                           buf, size-wrapped );
+                iommu_write(iommu, dev, s->RxBuf + s->RxBufAddr,
+                            buf, size - wrapped);
             }
 
             /* reset buffer pointer */
             s->RxBufAddr = 0;
 
-            cpu_physical_memory_write( s->RxBuf + s->RxBufAddr,
-                                       buf + (size-wrapped), wrapped );
+            iommu_write(iommu, dev, s->RxBuf + s->RxBufAddr,
+                        buf + (size - wrapped), wrapped);
 
             s->RxBufAddr = wrapped;
 

@@ -774,7 +780,7 @@ static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
     }
 
     /* non-wrapping path or overwrapping enabled */
-    cpu_physical_memory_write( s->RxBuf + s->RxBufAddr, buf, size );
+    iommu_write(iommu, dev, s->RxBuf + s->RxBufAddr, buf, size);
 
     s->RxBufAddr += size;
 }

@@ -822,6 +828,11 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
     static const uint8_t broadcast_macaddr[6] =
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     DEBUG_PRINT((">>> RTL8139: received len=%d\n", size));
 
     /* test if board clock is stopped */

@@ -968,13 +979,13 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 
         uint32_t val, rxdw0,rxdw1,rxbufLO,rxbufHI;
 
-        cpu_physical_memory_read(cplus_rx_ring_desc,    (uint8_t *)&val, 4);
+        iommu_read(iommu, dev, cplus_rx_ring_desc, (uint8_t *) &val, 4);
         rxdw0 = le32_to_cpu(val);
-        cpu_physical_memory_read(cplus_rx_ring_desc+4,  (uint8_t *)&val, 4);
+        iommu_read(iommu, dev, cplus_rx_ring_desc + 4, (uint8_t *) &val, 4);
         rxdw1 = le32_to_cpu(val);
-        cpu_physical_memory_read(cplus_rx_ring_desc+8,  (uint8_t *)&val, 4);
+        iommu_read(iommu, dev, cplus_rx_ring_desc + 8,  (uint8_t *) &val, 4);
         rxbufLO = le32_to_cpu(val);
-        cpu_physical_memory_read(cplus_rx_ring_desc+12, (uint8_t *)&val, 4);
+        iommu_read(iommu, dev, cplus_rx_ring_desc + 12, (uint8_t *) &val, 4);
         rxbufHI = le32_to_cpu(val);
 
         DEBUG_PRINT(("RTL8139: +++ C+ mode RX descriptor %d %08x %08x %08x %08x\n",

@@ -1019,7 +1030,7 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
         target_phys_addr_t rx_addr = rtl8139_addr64(rxbufLO, rxbufHI);
 
         /* receive/copy to target memory */
-        cpu_physical_memory_write( rx_addr, buf, size );
+        iommu_write(iommu, dev, rx_addr, buf, size);
 
         if (s->CpCmd & CPlusRxChkSum)
         {

@@ -1032,7 +1043,7 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 #else
         val = 0;
 #endif
-        cpu_physical_memory_write( rx_addr+size, (uint8_t *)&val, 4);
+        iommu_write(iommu, dev, rx_addr + size, (uint8_t *) &val, 4);
 
 /* first segment of received packet flag */
 #define CP_RX_STATUS_FS (1<<29)

@@ -1081,9 +1092,9 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 
         /* update ring data */
         val = cpu_to_le32(rxdw0);
-        cpu_physical_memory_write(cplus_rx_ring_desc,    (uint8_t *)&val, 4);
+        iommu_write(iommu, dev, cplus_rx_ring_desc, (uint8_t *) &val, 4);
         val = cpu_to_le32(rxdw1);
-        cpu_physical_memory_write(cplus_rx_ring_desc+4,  (uint8_t *)&val, 4);
+        iommu_write(iommu, dev, cplus_rx_ring_desc + 4, (uint8_t *) &val, 4);
 
         /* update tally counter */
         ++s->tally_counters.RxOk;

@@ -1279,50 +1290,54 @@ static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters)
     counters->TxUndrn = 0;
 }
 
-static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* tally_counters)
+static void RTL8139TallyCounters_physical_memory_write(DeviceState *qdev, target_phys_addr_t tc_addr, RTL8139TallyCounters* tally_counters)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
     uint16_t val16;
     uint32_t val32;
     uint64_t val64;
 
+    iommu = iommu_get(qdev, &dev);
+
     val64 = cpu_to_le64(tally_counters->TxOk);
-    cpu_physical_memory_write(tc_addr + 0,    (uint8_t *)&val64, 8);
+    iommu_write(iommu, dev, tc_addr + 0,     (uint8_t *) &val64, 8);
 
     val64 = cpu_to_le64(tally_counters->RxOk);
-    cpu_physical_memory_write(tc_addr + 8,    (uint8_t *)&val64, 8);
+    iommu_write(iommu, dev, tc_addr + 8,     (uint8_t *) &val64, 8);
 
     val64 = cpu_to_le64(tally_counters->TxERR);
-    cpu_physical_memory_write(tc_addr + 16,    (uint8_t *)&val64, 8);
+    iommu_write(iommu, dev, tc_addr + 16,    (uint8_t *) &val64, 8);
 
     val32 = cpu_to_le32(tally_counters->RxERR);
-    cpu_physical_memory_write(tc_addr + 24,    (uint8_t *)&val32, 4);
+    iommu_write(iommu, dev, tc_addr + 24,    (uint8_t *) &val32, 4);
 
     val16 = cpu_to_le16(tally_counters->MissPkt);
-    cpu_physical_memory_write(tc_addr + 28,    (uint8_t *)&val16, 2);
+    iommu_write(iommu, dev, tc_addr + 28,    (uint8_t *) &val16, 2);
 
     val16 = cpu_to_le16(tally_counters->FAE);
-    cpu_physical_memory_write(tc_addr + 30,    (uint8_t *)&val16, 2);
+    iommu_write(iommu, dev, tc_addr + 30,    (uint8_t *) &val16, 2);
 
     val32 = cpu_to_le32(tally_counters->Tx1Col);
-    cpu_physical_memory_write(tc_addr + 32,    (uint8_t *)&val32, 4);
+    iommu_write(iommu, dev, tc_addr + 32,    (uint8_t *) &val32, 4);
 
     val32 = cpu_to_le32(tally_counters->TxMCol);
-    cpu_physical_memory_write(tc_addr + 36,    (uint8_t *)&val32, 4);
+    iommu_write(iommu, dev, tc_addr + 36,    (uint8_t *) &val32, 4);
 
     val64 = cpu_to_le64(tally_counters->RxOkPhy);
-    cpu_physical_memory_write(tc_addr + 40,    (uint8_t *)&val64, 8);
+    iommu_write(iommu, dev, tc_addr + 40,    (uint8_t *) &val64, 8);
 
     val64 = cpu_to_le64(tally_counters->RxOkBrd);
-    cpu_physical_memory_write(tc_addr + 48,    (uint8_t *)&val64, 8);
+    iommu_write(iommu, dev, tc_addr + 48,    (uint8_t *) &val64, 8);
 
     val32 = cpu_to_le32(tally_counters->RxOkMul);
-    cpu_physical_memory_write(tc_addr + 56,    (uint8_t *)&val32, 4);
+    iommu_write(iommu, dev, tc_addr + 56,    (uint8_t *) &val32, 4);
 
     val16 = cpu_to_le16(tally_counters->TxAbt);
-    cpu_physical_memory_write(tc_addr + 60,    (uint8_t *)&val16, 2);
+    iommu_write(iommu, dev, tc_addr + 60,    (uint8_t *) &val16, 2);
 
     val16 = cpu_to_le16(tally_counters->TxUndrn);
-    cpu_physical_memory_write(tc_addr + 62,    (uint8_t *)&val16, 2);
+    iommu_write(iommu, dev, tc_addr + 62,    (uint8_t *) &val16, 2);
 }
 
 /* Loads values of tally counters from VM state file */

@@ -1758,6 +1773,11 @@ static void rtl8139_transfer_frame(RTL8139State *s, const uint8_t *buf, int size
 
 static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     if (!rtl8139_transmitter_enabled(s))
     {
         DEBUG_PRINT(("RTL8139: +++ cannot transmit from descriptor %d: transmitter disabled\n",

@@ -1780,7 +1800,7 @@ static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
     DEBUG_PRINT(("RTL8139: +++ transmit reading %d bytes from host memory at 0x%08x\n",
                  txsize, s->TxAddr[descriptor]));
 
-    cpu_physical_memory_read(s->TxAddr[descriptor], txbuffer, txsize);
+    iommu_read(iommu, dev, s->TxAddr[descriptor], txbuffer, txsize);
 
     /* Mark descriptor as transferred */
     s->TxStatus[descriptor] |= TxHostOwns;

@@ -1886,6 +1906,11 @@ static uint16_t ip_checksum(void *data, size_t len)
 
 static int rtl8139_cplus_transmit_one(RTL8139State *s)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     if (!rtl8139_transmitter_enabled(s))
     {
         DEBUG_PRINT(("RTL8139: +++ C+ mode: transmitter disabled\n"));

@@ -1911,14 +1936,14 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
     uint32_t val, txdw0,txdw1,txbufLO,txbufHI;
 
-    cpu_physical_memory_read(cplus_tx_ring_desc,    (uint8_t *)&val, 4);
+    iommu_read(iommu, dev, cplus_tx_ring_desc,    (uint8_t *) &val, 4);
     txdw0 = le32_to_cpu(val);
     /* TODO: implement VLAN tagging support, VLAN tag data is read to txdw1 */
-    cpu_physical_memory_read(cplus_tx_ring_desc+4,  (uint8_t *)&val, 4);
+    iommu_read(iommu, dev, cplus_tx_ring_desc+4,  (uint8_t *) &val, 4);
     txdw1 = le32_to_cpu(val);
-    cpu_physical_memory_read(cplus_tx_ring_desc+8,  (uint8_t *)&val, 4);
+    iommu_read(iommu, dev, cplus_tx_ring_desc+8,  (uint8_t *) &val, 4);
     txbufLO = le32_to_cpu(val);
-    cpu_physical_memory_read(cplus_tx_ring_desc+12, (uint8_t *)&val, 4);
+    iommu_read(iommu, dev, cplus_tx_ring_desc+12, (uint8_t *) &val, 4);
     txbufHI = le32_to_cpu(val);
 
     DEBUG_PRINT(("RTL8139: +++ C+ mode TX descriptor %d %08x %08x %08x %08x\n",

@@ -2025,7 +2050,8 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
     DEBUG_PRINT(("RTL8139: +++ C+ mode transmit reading %d bytes from host memory at %016" PRIx64 " to offset %d\n",
                  txsize, (uint64_t)tx_addr, s->cplus_txbuffer_offset));
 
-    cpu_physical_memory_read(tx_addr, s->cplus_txbuffer + s->cplus_txbuffer_offset, txsize);
+    iommu_read(iommu, dev, tx_addr,
+               s->cplus_txbuffer + s->cplus_txbuffer_offset, txsize);
     s->cplus_txbuffer_offset += txsize;
 
     /* seek to next Rx descriptor */

@@ -2052,7 +2078,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
     /* update ring data */
     val = cpu_to_le32(txdw0);
-    cpu_physical_memory_write(cplus_tx_ring_desc,    (uint8_t *)&val, 4);
+    iommu_write(iommu, dev, cplus_tx_ring_desc, (uint8_t *) &val, 4);
     /* TODO: implement VLAN tagging support, VLAN tag data is read to txdw1 */
 //    val = cpu_to_le32(txdw1);
 //    cpu_physical_memory_write(cplus_tx_ring_desc+4,  &val, 4);

@@ -2381,7 +2407,7 @@ static void rtl8139_TxStatus_write(RTL8139State *s, uint32_t txRegOffset, uint32
             target_phys_addr_t tc_addr = rtl8139_addr64(s->TxStatus[0] & ~0x3f, s->TxStatus[1]);
 
             /* dump tally counters to specified memory location */
-            RTL8139TallyCounters_physical_memory_write( tc_addr, &s->tally_counters);
+            RTL8139TallyCounters_physical_memory_write(&s->dev.qdev, tc_addr, &s->tally_counters);
 
             /* mark dump completed */
             s->TxStatus[0] &= ~0x8;

index 97afa2c..74e1d15 100644
@@ -43,6 +43,7 @@
 
 #include <stddef.h>             /* offsetof */
 #include "hw.h"
+#include "iommu.h"
 #include "pci.h"
 #include "net.h"
 #include "eeprom93xx.h"

@@ -306,10 +307,13 @@ static const uint16_t eepro100_mdi_mask[] = {
 };
 
 /* XXX: optimize */
-static void stl_le_phys(target_phys_addr_t addr, uint32_t val)
+static void stl_le_phys(struct iommu *iommu,
+                        DeviceState *dev,
+                        target_phys_addr_t addr,
+                        uint32_t val)
 {
     val = cpu_to_le32(val);
-    cpu_physical_memory_write(addr, (const uint8_t *)&val, sizeof(val));
+    iommu_write(iommu, dev, addr, (const uint8_t *)&val, sizeof(val));
 }
 
 #define POLYNOMIAL 0x04c11db6

@@ -687,17 +691,25 @@ static void set_ru_state(EEPRO100State * s, ru_state_t state)
 
 static void dump_statistics(EEPRO100State * s)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+    
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     /* Dump statistical data. Most data is never changed by the emulation
      * and always 0, so we first just copy the whole block and then those
      * values which really matter.
      * Number of data should check configuration!!!
      */
-    cpu_physical_memory_write(s->statsaddr,
-                              (uint8_t *) & s->statistics, s->stats_size);
-    stl_le_phys(s->statsaddr + 0, s->statistics.tx_good_frames);
-    stl_le_phys(s->statsaddr + 36, s->statistics.rx_good_frames);
-    stl_le_phys(s->statsaddr + 48, s->statistics.rx_resource_errors);
-    stl_le_phys(s->statsaddr + 60, s->statistics.rx_short_frame_errors);
+    err = iommu_write(iommu, dev, s->statsaddr,
+                      (uint8_t *) &s->statistics, s->stats_size);
+    stl_le_phys(iommu, dev, s->statsaddr + 0, s->statistics.tx_good_frames);
+    stl_le_phys(iommu, dev, s->statsaddr + 36, s->statistics.rx_good_frames);
+    stl_le_phys(iommu, dev,
+                s->statsaddr + 48, s->statistics.rx_resource_errors);
+    stl_le_phys(iommu, dev,
+                s->statsaddr + 60, s->statistics.rx_short_frame_errors);
 #if 0
     stw_le_phys(s->statsaddr + 76, s->statistics.xmt_tco_frames);
     stw_le_phys(s->statsaddr + 78, s->statistics.rcv_tco_frames);

@@ -707,7 +719,13 @@ static void dump_statistics(EEPRO100State * s)
 
 static void read_cb(EEPRO100State *s)
 {
-    cpu_physical_memory_read(s->cb_address, (uint8_t *) &s->tx, sizeof(s->tx));
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
+    err = iommu_read(iommu, dev, s->cb_address, (uint8_t *) &s->tx, sizeof(s->tx));
     s->tx.status = le16_to_cpu(s->tx.status);
     s->tx.command = le16_to_cpu(s->tx.command);
     s->tx.link = le32_to_cpu(s->tx.link);

@@ -723,6 +741,12 @@ static void tx_command(EEPRO100State *s)
     uint8_t buf[2600];
     uint16_t size = 0;
     uint32_t tbd_address = s->cb_address + 0x10;
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     TRACE(RXTX, logout
         ("transmit, TBD array address 0x%08x, TCB byte count 0x%04x, TBD count %u\n",
          tbd_array, tcb_bytes, s->tx.tbd_count));

@@ -737,18 +761,18 @@ static void tx_command(EEPRO100State *s)
     }
     assert(tcb_bytes <= sizeof(buf));
     while (size < tcb_bytes) {
-        uint32_t tx_buffer_address = ldl_phys(tbd_address);
-        uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
+        uint32_t tx_buffer_address = iommu_ldl(iommu, dev, tbd_address);
+        uint16_t tx_buffer_size = iommu_lduw(iommu, dev, tbd_address + 4);
 #if 0
-        uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+        uint16_t tx_buffer_el = iommu_lduw(tbd_address + 6);
 #endif
         tbd_address += 8;
         TRACE(RXTX, logout
             ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
              tx_buffer_address, tx_buffer_size));
         tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
-        cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                 tx_buffer_size);
+        err = iommu_read(iommu, dev,
+                         tx_buffer_address, &buf[size], tx_buffer_size);
         size += tx_buffer_size;
     }
     if (tbd_array == 0xffffffff) {

@@ -759,16 +783,18 @@ static void tx_command(EEPRO100State *s)
         if (s->has_extended_tcb_support && !(s->configuration[6] & BIT(4))) {
             /* Extended Flexible TCB. */
             for (; tbd_count < 2; tbd_count++) {
-                uint32_t tx_buffer_address = ldl_phys(tbd_address);
-                uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
-                uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+                uint32_t tx_buffer_address = iommu_ldl(iommu, dev,
+                                                       tbd_address);
+                uint16_t tx_buffer_size = iommu_lduw(iommu, dev,
+                                                     tbd_address + 4);
+                uint16_t tx_buffer_el = iommu_lduw(iommu, dev, tbd_address + 6);
                 tbd_address += 8;
                 TRACE(RXTX, logout
                     ("TBD (extended flexible mode): buffer address 0x%08x, size 0x%04x\n",
                      tx_buffer_address, tx_buffer_size));
                 tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
-                cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                         tx_buffer_size);
+                err = iommu_read(iommu, dev, tx_buffer_address,
+                                 &buf[size], tx_buffer_size);
                 size += tx_buffer_size;
                 if (tx_buffer_el & 1) {
                     break;

@@ -777,16 +803,16 @@ static void tx_command(EEPRO100State *s)
         }
         tbd_address = tbd_array;
         for (; tbd_count < s->tx.tbd_count; tbd_count++) {
-            uint32_t tx_buffer_address = ldl_phys(tbd_address);
-            uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
-            uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
+            uint32_t tx_buffer_address = iommu_ldl(iommu, dev, tbd_address);
+            uint16_t tx_buffer_size = iommu_lduw(iommu, dev, tbd_address + 4);
+            uint16_t tx_buffer_el = iommu_lduw(iommu, dev, tbd_address + 6);
             tbd_address += 8;
             TRACE(RXTX, logout
                 ("TBD (flexible mode): buffer address 0x%08x, size 0x%04x\n",
                  tx_buffer_address, tx_buffer_size));
             tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
-            cpu_physical_memory_read(tx_buffer_address, &buf[size],
-                                     tx_buffer_size);
+            err = iommu_read(iommu, dev,
+                             tx_buffer_address, &buf[size], tx_buffer_size);
             size += tx_buffer_size;
             if (tx_buffer_el & 1) {
                 break;

@@ -807,11 +833,17 @@ static void set_multicast_list(EEPRO100State *s)
 {
     uint16_t multicast_count = s->tx.tbd_array_addr & BITS(13, 0);
     uint16_t i;
+    struct iommu *iommu;
+    DeviceState *dev;
+    int err;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     memset(&s->mult[0], 0, sizeof(s->mult));
     TRACE(OTHER, logout("multicast list, multicast count = %u\n", multicast_count));
     for (i = 0; i < multicast_count; i += 6) {
         uint8_t multicast_addr[6];
-        cpu_physical_memory_read(s->cb_address + 10 + i, multicast_addr, 6);
+        err = iommu_read(iommu, dev, s->cb_address + 10 + i, multicast_addr, 6);
         TRACE(OTHER, logout("multicast entry %s\n", nic_dump(multicast_addr, 6)));
         unsigned mcast_idx = compute_mcast_idx(multicast_addr);
         assert(mcast_idx < 64);

@@ -821,6 +853,11 @@ static void set_multicast_list(EEPRO100State *s)
 
 static void action_command(EEPRO100State *s)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     for (;;) {
         bool bit_el;
         bool bit_s;

@@ -845,12 +882,14 @@ static void action_command(EEPRO100State *s)
             /* Do nothing. */
             break;
         case CmdIASetup:
-            cpu_physical_memory_read(s->cb_address + 8, &s->conf.macaddr.a[0], 6);
+            iommu_read(iommu, dev,
+                       s->cb_address + 8, &s->conf.macaddr.a[0], 6);
             TRACE(OTHER, logout("macaddr: %s\n", nic_dump(&s->conf.macaddr.a[0], 6)));
             break;
         case CmdConfigure:
-            cpu_physical_memory_read(s->cb_address + 8, &s->configuration[0],
-                                     sizeof(s->configuration));
+            iommu_read(iommu, dev,
+                       s->cb_address + 8, &s->configuration[0],
+                       sizeof(s->configuration));
             TRACE(OTHER, logout("configuration: %s\n", nic_dump(&s->configuration[0], 16)));
             break;
         case CmdMulticastList:

@@ -880,7 +919,8 @@ static void action_command(EEPRO100State *s)
             break;
         }
         /* Write new status. */
-        stw_phys(s->cb_address, s->tx.status | ok_status | STATUS_C);
+        iommu_stw(iommu, dev,
+                  s->cb_address, s->tx.status | ok_status | STATUS_C);
         if (bit_i) {
             /* CU completed action. */
             eepro100_cx_interrupt(s);

@@ -907,6 +947,11 @@ static void action_command(EEPRO100State *s)
 static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
 {
     cu_state_t cu_state;
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     switch (val) {
     case CU_NOP:
         /* No operation. */

@@ -947,7 +992,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
         /* Dump statistical counters. */
         TRACE(OTHER, logout("val=0x%02x (dump stats)\n", val));
         dump_statistics(s);
-        stl_le_phys(s->statsaddr + s->stats_size, 0xa005);
+        stl_le_phys(iommu, dev, s->statsaddr + s->stats_size, 0xa005);
         break;
     case CU_CMD_BASE:
         /* Load CU base. */

@@ -958,7 +1003,7 @@ static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
         /* Dump and reset statistical counters. */
         TRACE(OTHER, logout("val=0x%02x (dump stats and reset)\n", val));
         dump_statistics(s);
-        stl_le_phys(s->statsaddr + s->stats_size, 0xa007);
+        stl_le_phys(iommu, dev, s->statsaddr + s->stats_size, 0xa007);
         memset(&s->statistics, 0, sizeof(s->statistics));
         break;
     case CU_SRESUME:

@@ -1252,6 +1297,11 @@ static void eepro100_write_port(EEPRO100State * s, uint32_t val)
     val = le32_to_cpu(val);
     uint32_t address = (val & ~PORT_SELECTION_MASK);
     uint8_t selection = (val & PORT_SELECTION_MASK);
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     switch (selection) {
     case PORT_SOFTWARE_RESET:
         nic_reset(s);

@@ -1259,10 +1309,12 @@ static void eepro100_write_port(EEPRO100State * s, uint32_t val)
     case PORT_SELFTEST:
         TRACE(OTHER, logout("selftest address=0x%08x\n", address));
         eepro100_selftest_t data;
-        cpu_physical_memory_read(address, (uint8_t *) & data, sizeof(data));
+        iommu_read(iommu, dev,
+                   address, (uint8_t *) &data, sizeof(data));
         data.st_sign = 0xffffffff;
         data.st_result = 0;
-        cpu_physical_memory_write(address, (uint8_t *) & data, sizeof(data));
+        iommu_write(iommu, dev,
+                    address, (uint8_t *) &data, sizeof(data));
         break;
     case PORT_SELECTIVE_RESET:
         TRACE(OTHER, logout("selective reset, selftest address=0x%08x\n", address));

@@ -1646,6 +1698,10 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
     uint16_t rfd_status = 0xa000;
     static const uint8_t broadcast_macaddr[6] =
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
 
     /* TODO: check multiple IA bit. */
     if (s->configuration[20] & BIT(6)) {

@@ -1721,8 +1777,9 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
     }
     /* !!! */
     eepro100_rx_t rx;
-    cpu_physical_memory_read(s->ru_base + s->ru_offset, (uint8_t *) & rx,
-                             offsetof(eepro100_rx_t, packet));
+    iommu_read(iommu, dev,
+               s->ru_base + s->ru_offset, (uint8_t *) & rx,
+               offsetof(eepro100_rx_t, packet));
     uint16_t rfd_command = le16_to_cpu(rx.command);
     uint16_t rfd_size = le16_to_cpu(rx.size);
 

@@ -1736,9 +1793,12 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
     }
     TRACE(OTHER, logout("command 0x%04x, link 0x%08x, addr 0x%08x, size %u\n",
           rfd_command, rx.link, rx.rx_buf_addr, rfd_size));
-    stw_phys(s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, status),
-             rfd_status);
-    stw_phys(s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, count), size);
+    iommu_stw(iommu, dev,
+              s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, status),
+              rfd_status);
+    iommu_stw(iommu, dev,
+              s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, count),
+              size);
     /* Early receive interrupt not supported. */
 #if 0
     eepro100_er_interrupt(s);

@@ -1752,8 +1812,9 @@ static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size
 #if 0
     assert(!(s->configuration[17] & BIT(0)));
 #endif
-    cpu_physical_memory_write(s->ru_base + s->ru_offset +
-                              offsetof(eepro100_rx_t, packet), buf, size);
+    iommu_write(iommu, dev,
+                s->ru_base + s->ru_offset +
+                offsetof(eepro100_rx_t, packet), buf, size);
     s->statistics.rx_good_frames++;
     eepro100_fr_interrupt(s);
     s->ru_offset = le32_to_cpu(rx.link);

index 4319bc8..0e30d80 100644
@@ -15,6 +15,7 @@
  */
 
 #include "hw.h"
+#include "iommu.h"
 #include "audiodev.h"
 #include "audio/audio.h"
 #include "pci.h"

@@ -221,9 +222,13 @@ static void cold_reset (AC97LinkState * s)
 
 static void fetch_bd (AC97LinkState *s, AC97BusMasterRegs *r)
 {
+    struct iommu *iommu;
+    DeviceState *dev;
     uint8_t b[8];
 
-    cpu_physical_memory_read (r->bdbar + r->civ * 8, b, 8);
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
+    iommu_read (iommu, dev, r->bdbar + r->civ * 8, b, 8);
     r->bd_valid = 1;
     r->bd.addr = le32_to_cpu (*(uint32_t *) &b[0]) & ~3;
     r->bd.ctl_len = le32_to_cpu (*(uint32_t *) &b[4]);

@@ -962,6 +967,9 @@ static int write_audio (AC97LinkState *s, AC97BusMasterRegs *r,
     uint32_t temp = r->picb << 1;
     uint32_t written = 0;
     int to_copy = 0;
+    struct iommu *iommu;
+    DeviceState *dev;
+
     temp = audio_MIN (temp, max);
 
     if (!temp) {

@@ -969,10 +977,12 @@ static int write_audio (AC97LinkState *s, AC97BusMasterRegs *r,
         return 0;
     }
 
+    iommu = iommu_get(&s->dev.qdev, &dev);
+
     while (temp) {
         int copied;
         to_copy = audio_MIN (temp, sizeof (tmpbuf));
-        cpu_physical_memory_read (addr, tmpbuf, to_copy);
+        iommu_read (iommu, dev, addr, tmpbuf, to_copy);
         copied = AUD_write (s->voice_po, tmpbuf, to_copy);
         dolog ("write_audio max=%x to_copy=%x copied=%x\n",
                max, to_copy, copied);

@@ -1040,6 +1050,10 @@ static int read_audio (AC97LinkState *s, AC97BusMasterRegs *r,
     uint32_t nread = 0;
     int to_copy = 0;
     SWVoiceIn *voice = (r - s->bm_regs) == MC_INDEX ? s->voice_mc : s->voice_pi;
+    struct iommu *iommu;
+    DeviceState *dev;
+
+    iommu = iommu_get(&s->dev.qdev, &dev);
 
     temp = audio_MIN (temp, max);
 

@@ -1056,7 +1070,7 @@ static int read_audio (AC97LinkState *s, AC97BusMasterRegs *r,
             *stop = 1;
             break;
         }
-        cpu_physical_memory_write (addr, tmpbuf, acquired);
+        iommu_write (iommu, dev, addr, tmpbuf, acquired);
         temp -= acquired;
         addr += acquired;
         nread += acquired;