1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * IOMMU implementation for Cell Broadband Processor Architecture
4  *
5  * (C) Copyright IBM Corporation 2006-2008
6  *
7  * Author: Jeremy Kerr <jk@ozlabs.org>
8  */
9 
10 #undef DEBUG
11 
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/interrupt.h>
15 #include <linux/notifier.h>
16 #include <linux/of.h>
17 #include <linux/of_platform.h>
18 #include <linux/slab.h>
19 #include <linux/memblock.h>
20 
21 #include <asm/prom.h>
22 #include <asm/iommu.h>
23 #include <asm/machdep.h>
24 #include <asm/pci-bridge.h>
25 #include <asm/udbg.h>
26 #include <asm/firmware.h>
27 #include <asm/cell-regs.h>
28 
29 #include "cell.h"
30 #include "interrupt.h"
31 
32 /* Define CELL_IOMMU_REAL_UNMAP to actually unmap non-used pages
33  * instead of leaving them mapped to some dummy page. This can be
34  * enabled once the appropriate workarounds for spider bugs have
35  * been enabled
36  */
37 #define CELL_IOMMU_REAL_UNMAP
38 
39 /* Define CELL_IOMMU_STRICT_PROTECTION to enforce protection of
40  * IO PTEs based on the transfer direction. That can be enabled
41  * once spider-net has been fixed to pass the correct direction
42  * to the DMA mapping functions
43  */
44 #define CELL_IOMMU_STRICT_PROTECTION
45 
46 
47 #define NR_IOMMUS			2
48 
49 /* IOC mmap registers */
50 #define IOC_Reg_Size			0x2000
51 
52 #define IOC_IOPT_CacheInvd		0x908
53 #define IOC_IOPT_CacheInvd_NE_Mask	0xffe0000000000000ul
54 #define IOC_IOPT_CacheInvd_IOPTE_Mask	0x000003fffffffff8ul
55 #define IOC_IOPT_CacheInvd_Busy		0x0000000000000001ul
56 
57 #define IOC_IOST_Origin			0x918
58 #define IOC_IOST_Origin_E		0x8000000000000000ul
59 #define IOC_IOST_Origin_HW		0x0000000000000800ul
60 #define IOC_IOST_Origin_HL		0x0000000000000400ul
61 
62 #define IOC_IO_ExcpStat			0x920
63 #define IOC_IO_ExcpStat_V		0x8000000000000000ul
64 #define IOC_IO_ExcpStat_SPF_Mask	0x6000000000000000ul
65 #define IOC_IO_ExcpStat_SPF_S		0x6000000000000000ul
66 #define IOC_IO_ExcpStat_SPF_P		0x2000000000000000ul
67 #define IOC_IO_ExcpStat_ADDR_Mask	0x00000007fffff000ul
68 #define IOC_IO_ExcpStat_RW_Mask		0x0000000000000800ul
69 #define IOC_IO_ExcpStat_IOID_Mask	0x00000000000007fful
70 
71 #define IOC_IO_ExcpMask			0x928
72 #define IOC_IO_ExcpMask_SFE		0x4000000000000000ul
73 #define IOC_IO_ExcpMask_PFE		0x2000000000000000ul
74 
75 #define IOC_IOCmd_Offset		0x1000
76 
77 #define IOC_IOCmd_Cfg			0xc00
78 #define IOC_IOCmd_Cfg_TE		0x0000800000000000ul
79 
80 
81 /* Segment table entries */
82 #define IOSTE_V			0x8000000000000000ul /* valid */
83 #define IOSTE_H			0x4000000000000000ul /* cache hint */
84 #define IOSTE_PT_Base_RPN_Mask  0x3ffffffffffff000ul /* base RPN of IOPT */
85 #define IOSTE_NPPT_Mask		0x0000000000000fe0ul /* no. pages in IOPT */
86 #define IOSTE_PS_Mask		0x0000000000000007ul /* page size */
87 #define IOSTE_PS_4K		0x0000000000000001ul /*   - 4kB  */
88 #define IOSTE_PS_64K		0x0000000000000003ul /*   - 64kB */
89 #define IOSTE_PS_1M		0x0000000000000005ul /*   - 1MB  */
90 #define IOSTE_PS_16M		0x0000000000000007ul /*   - 16MB */
91 
92 
93 /* IOMMU sizing */
94 #define IO_SEGMENT_SHIFT	28
95 #define IO_PAGENO_BITS(shift)	(IO_SEGMENT_SHIFT - (shift))
96 
97 /* The high bit needs to be set on every DMA address */
98 #define SPIDER_DMA_OFFSET	0x80000000ul
99 
100 struct iommu_window {
101 	struct list_head list;
102 	struct cbe_iommu *iommu;
103 	unsigned long offset;
104 	unsigned long size;
105 	unsigned int ioid;
106 	struct iommu_table table;
107 };
108 
109 #define NAMESIZE 8
110 struct cbe_iommu {
111 	int nid;
112 	char name[NAMESIZE];
113 	void __iomem *xlate_regs;
114 	void __iomem *cmd_regs;
115 	unsigned long *stab;
116 	unsigned long *ptab;
117 	void *pad_page;
118 	struct list_head windows;
119 };
120 
121 /* Static array of iommus, one per node
122  *   each contains a list of windows, keyed from dma_window property
123  *   - on bus setup, look for a matching window, or create one
124  *   - on dev setup, assign iommu_table ptr
125  */
126 static struct cbe_iommu iommus[NR_IOMMUS];
127 static int cbe_nr_iommus;
128 
129 static void invalidate_tce_cache(struct cbe_iommu *iommu, unsigned long *pte,
130 		long n_ptes)
131 {
132 	u64 __iomem *reg;
133 	u64 val;
134 	long n;
135 
136 	reg = iommu->xlate_regs + IOC_IOPT_CacheInvd;
137 
138 	while (n_ptes > 0) {
139 		/* we can invalidate up to 1 << 11 PTEs at once */
140 		n = min(n_ptes, 1l << 11);
141 		val = (((n /*- 1*/) << 53) & IOC_IOPT_CacheInvd_NE_Mask)
142 			| (__pa(pte) & IOC_IOPT_CacheInvd_IOPTE_Mask)
143 		        | IOC_IOPT_CacheInvd_Busy;
144 
145 		out_be64(reg, val);
146 		while (in_be64(reg) & IOC_IOPT_CacheInvd_Busy)
147 			;
148 
149 		n_ptes -= n;
150 		pte += n;
151 	}
152 }
153 
154 static int tce_build_cell(struct iommu_table *tbl, long index, long npages,
155 		unsigned long uaddr, enum dma_data_direction direction,
156 		unsigned long attrs)
157 {
158 	int i;
159 	unsigned long *io_pte, base_pte;
160 	struct iommu_window *window =
161 		container_of(tbl, struct iommu_window, table);
162 
163 	/* implementing proper protection causes problems with the spidernet
164 	 * driver - check mapping directions later, but allow read & write by
165 	 * default for now.*/
166 #ifdef CELL_IOMMU_STRICT_PROTECTION
167 	/* to avoid referencing a global, we use a trick here to setup the
168 	 * protection bit. "prot" is setup to be 3 fields of 4 bits appended
169 	 * together for each of the 3 supported direction values. It is then
170 	 * shifted left so that the fields matching the desired direction
171 	 * lands on the appropriate bits, and other bits are masked out.
172 	 */
173 	const unsigned long prot = 0xc48;
174 	base_pte =
175 		((prot << (52 + 4 * direction)) &
176 		 (CBE_IOPTE_PP_W | CBE_IOPTE_PP_R)) |
177 		CBE_IOPTE_M | CBE_IOPTE_SO_RW |
178 		(window->ioid & CBE_IOPTE_IOID_Mask);
179 #else
180 	base_pte = CBE_IOPTE_PP_W | CBE_IOPTE_PP_R | CBE_IOPTE_M |
181 		CBE_IOPTE_SO_RW | (window->ioid & CBE_IOPTE_IOID_Mask);
182 #endif
183 	if (unlikely(attrs & DMA_ATTR_WEAK_ORDERING))
184 		base_pte &= ~CBE_IOPTE_SO_RW;
185 
186 	io_pte = (unsigned long *)tbl->it_base + (index - tbl->it_offset);
187 
188 	for (i = 0; i < npages; i++, uaddr += (1 << tbl->it_page_shift))
189 		io_pte[i] = base_pte | (__pa(uaddr) & CBE_IOPTE_RPN_Mask);
190 
191 	mb();
192 
193 	invalidate_tce_cache(window->iommu, io_pte, npages);
194 
195 	pr_debug("tce_build_cell(index=%lx,n=%lx,dir=%d,base_pte=%lx)\n",
196 		 index, npages, direction, base_pte);
197 	return 0;
198 }
199 
200 static void tce_free_cell(struct iommu_table *tbl, long index, long npages)
201 {
202 
203 	int i;
204 	unsigned long *io_pte, pte;
205 	struct iommu_window *window =
206 		container_of(tbl, struct iommu_window, table);
207 
208 	pr_debug("tce_free_cell(index=%lx,n=%lx)\n", index, npages);
209 
210 #ifdef CELL_IOMMU_REAL_UNMAP
211 	pte = 0;
212 #else
213 	/* spider bridge does PCI reads after freeing - insert a mapping
214 	 * to a scratch page instead of an invalid entry */
215 	pte = CBE_IOPTE_PP_R | CBE_IOPTE_M | CBE_IOPTE_SO_RW |
216 		__pa(window->iommu->pad_page) |
217 		(window->ioid & CBE_IOPTE_IOID_Mask);
218 #endif
219 
220 	io_pte = (unsigned long *)tbl->it_base + (index - tbl->it_offset);
221 
222 	for (i = 0; i < npages; i++)
223 		io_pte[i] = pte;
224 
225 	mb();
226 
227 	invalidate_tce_cache(window->iommu, io_pte, npages);
228 }
229 
230 static irqreturn_t ioc_interrupt(int irq, void *data)
231 {
232 	unsigned long stat, spf;
233 	struct cbe_iommu *iommu = data;
234 
235 	stat = in_be64(iommu->xlate_regs + IOC_IO_ExcpStat);
236 	spf = stat & IOC_IO_ExcpStat_SPF_Mask;
237 
238 	/* Might want to rate limit it */
239 	printk(KERN_ERR "iommu: DMA exception 0x%016lx\n", stat);
240 	printk(KERN_ERR "  V=%d, SPF=[%c%c], RW=%s, IOID=0x%04x\n",
241 	       !!(stat & IOC_IO_ExcpStat_V),
242 	       (spf == IOC_IO_ExcpStat_SPF_S) ? 'S' : ' ',
243 	       (spf == IOC_IO_ExcpStat_SPF_P) ? 'P' : ' ',
244 	       (stat & IOC_IO_ExcpStat_RW_Mask) ? "Read" : "Write",
245 	       (unsigned int)(stat & IOC_IO_ExcpStat_IOID_Mask));
246 	printk(KERN_ERR "  page=0x%016lx\n",
247 	       stat & IOC_IO_ExcpStat_ADDR_Mask);
248 
249 	/* clear interrupt */
250 	stat &= ~IOC_IO_ExcpStat_V;
251 	out_be64(iommu->xlate_regs + IOC_IO_ExcpStat, stat);
252 
253 	return IRQ_HANDLED;
254 }
255 
256 static int cell_iommu_find_ioc(int nid, unsigned long *base)
257 {
258 	struct device_node *np;
259 	struct resource r;
260 
261 	*base = 0;
262 
263 	/* First look for new style /be nodes */
264 	for_each_node_by_name(np, "ioc") {
265 		if (of_node_to_nid(np) != nid)
266 			continue;
267 		if (of_address_to_resource(np, 0, &r)) {
268 			printk(KERN_ERR "iommu: can't get address for %pOF\n",
269 			       np);
270 			continue;
271 		}
272 		*base = r.start;
273 		of_node_put(np);
274 		return 0;
275 	}
276 
277 	/* Ok, let's try the old way */
278 	for_each_node_by_type(np, "cpu") {
279 		const unsigned int *nidp;
280 		const unsigned long *tmp;
281 
282 		nidp = of_get_property(np, "node-id", NULL);
283 		if (nidp && *nidp == nid) {
284 			tmp = of_get_property(np, "ioc-translation", NULL);
285 			if (tmp) {
286 				*base = *tmp;
287 				of_node_put(np);
288 				return 0;
289 			}
290 		}
291 	}
292 
293 	return -ENODEV;
294 }
295 
296 static void cell_iommu_setup_stab(struct cbe_iommu *iommu,
297 				unsigned long dbase, unsigned long dsize,
298 				unsigned long fbase, unsigned long fsize)
299 {
300 	struct page *page;
301 	unsigned long segments, stab_size;
302 
303 	segments = max(dbase + dsize, fbase + fsize) >> IO_SEGMENT_SHIFT;
304 
305 	pr_debug("%s: iommu[%d]: segments: %lu\n",
306 			__func__, iommu->nid, segments);
307 
308 	/* set up the segment table */
309 	stab_size = segments * sizeof(unsigned long);
310 	page = alloc_pages_node(iommu->nid, GFP_KERNEL, get_order(stab_size));
311 	BUG_ON(!page);
312 	iommu->stab = page_address(page);
313 	memset(iommu->stab, 0, stab_size);
314 }
315 
316 static unsigned long *cell_iommu_alloc_ptab(struct cbe_iommu *iommu,
317 		unsigned long base, unsigned long size, unsigned long gap_base,
318 		unsigned long gap_size, unsigned long page_shift)
319 {
320 	struct page *page;
321 	int i;
322 	unsigned long reg, segments, pages_per_segment, ptab_size,
323 		      n_pte_pages, start_seg, *ptab;
324 
325 	start_seg = base >> IO_SEGMENT_SHIFT;
326 	segments  = size >> IO_SEGMENT_SHIFT;
327 	pages_per_segment = 1ull << IO_PAGENO_BITS(page_shift);
328 	/* PTEs for each segment must start on a 4K boundary */
329 	pages_per_segment = max(pages_per_segment,
330 				(1 << 12) / sizeof(unsigned long));
331 
332 	ptab_size = segments * pages_per_segment * sizeof(unsigned long);
333 	pr_debug("%s: iommu[%d]: ptab_size: %lu, order: %d\n", __func__,
334 			iommu->nid, ptab_size, get_order(ptab_size));
335 	page = alloc_pages_node(iommu->nid, GFP_KERNEL, get_order(ptab_size));
336 	BUG_ON(!page);
337 
338 	ptab = page_address(page);
339 	memset(ptab, 0, ptab_size);
340 
341 	/* number of 4K pages needed for a page table */
342 	n_pte_pages = (pages_per_segment * sizeof(unsigned long)) >> 12;
343 
344 	pr_debug("%s: iommu[%d]: stab at %p, ptab at %p, n_pte_pages: %lu\n",
345 			__func__, iommu->nid, iommu->stab, ptab,
346 			n_pte_pages);
347 
348 	/* initialise the STEs */
349 	reg = IOSTE_V | ((n_pte_pages - 1) << 5);
350 
351 	switch (page_shift) {
352 	case 12: reg |= IOSTE_PS_4K;  break;
353 	case 16: reg |= IOSTE_PS_64K; break;
354 	case 20: reg |= IOSTE_PS_1M;  break;
355 	case 24: reg |= IOSTE_PS_16M; break;
356 	default: BUG();
357 	}
358 
359 	gap_base = gap_base >> IO_SEGMENT_SHIFT;
360 	gap_size = gap_size >> IO_SEGMENT_SHIFT;
361 
362 	pr_debug("Setting up IOMMU stab:\n");
363 	for (i = start_seg; i < (start_seg + segments); i++) {
364 		if (i >= gap_base && i < (gap_base + gap_size)) {
365 			pr_debug("\toverlap at %d, skipping\n", i);
366 			continue;
367 		}
368 		iommu->stab[i] = reg | (__pa(ptab) + (n_pte_pages << 12) *
369 					(i - start_seg));
370 		pr_debug("\t[%d] 0x%016lx\n", i, iommu->stab[i]);
371 	}
372 
373 	return ptab;
374 }
375 
376 static void cell_iommu_enable_hardware(struct cbe_iommu *iommu)
377 {
378 	int ret;
379 	unsigned long reg, xlate_base;
380 	unsigned int virq;
381 
382 	if (cell_iommu_find_ioc(iommu->nid, &xlate_base))
383 		panic("%s: missing IOC register mappings for node %d\n",
384 		      __func__, iommu->nid);
385 
386 	iommu->xlate_regs = ioremap(xlate_base, IOC_Reg_Size);
387 	iommu->cmd_regs = iommu->xlate_regs + IOC_IOCmd_Offset;
388 
389 	/* ensure that the STEs have updated */
390 	mb();
391 
392 	/* setup interrupts for the iommu. */
393 	reg = in_be64(iommu->xlate_regs + IOC_IO_ExcpStat);
394 	out_be64(iommu->xlate_regs + IOC_IO_ExcpStat,
395 			reg & ~IOC_IO_ExcpStat_V);
396 	out_be64(iommu->xlate_regs + IOC_IO_ExcpMask,
397 			IOC_IO_ExcpMask_PFE | IOC_IO_ExcpMask_SFE);
398 
399 	virq = irq_create_mapping(NULL,
400 			IIC_IRQ_IOEX_ATI | (iommu->nid << IIC_IRQ_NODE_SHIFT));
401 	BUG_ON(!virq);
402 
403 	ret = request_irq(virq, ioc_interrupt, 0, iommu->name, iommu);
404 	BUG_ON(ret);
405 
406 	/* set the IOC segment table origin register (and turn on the iommu) */
407 	reg = IOC_IOST_Origin_E | __pa(iommu->stab) | IOC_IOST_Origin_HW;
408 	out_be64(iommu->xlate_regs + IOC_IOST_Origin, reg);
409 	in_be64(iommu->xlate_regs + IOC_IOST_Origin);
410 
411 	/* turn on IO translation */
412 	reg = in_be64(iommu->cmd_regs + IOC_IOCmd_Cfg) | IOC_IOCmd_Cfg_TE;
413 	out_be64(iommu->cmd_regs + IOC_IOCmd_Cfg, reg);
414 }
415 
416 static void cell_iommu_setup_hardware(struct cbe_iommu *iommu,
417 	unsigned long base, unsigned long size)
418 {
419 	cell_iommu_setup_stab(iommu, base, size, 0, 0);
420 	iommu->ptab = cell_iommu_alloc_ptab(iommu, base, size, 0, 0,
421 					    IOMMU_PAGE_SHIFT_4K);
422 	cell_iommu_enable_hardware(iommu);
423 }
424 
425 #if 0/* Unused for now */
426 static struct iommu_window *find_window(struct cbe_iommu *iommu,
427 		unsigned long offset, unsigned long size)
428 {
429 	struct iommu_window *window;
430 
431 	/* todo: check for overlapping (but not equal) windows) */
432 
433 	list_for_each_entry(window, &(iommu->windows), list) {
434 		if (window->offset == offset && window->size == size)
435 			return window;
436 	}
437 
438 	return NULL;
439 }
440 #endif
441 
442 static inline u32 cell_iommu_get_ioid(struct device_node *np)
443 {
444 	const u32 *ioid;
445 
446 	ioid = of_get_property(np, "ioid", NULL);
447 	if (ioid == NULL) {
448 		printk(KERN_WARNING "iommu: missing ioid for %pOF using 0\n",
449 		       np);
450 		return 0;
451 	}
452 
453 	return *ioid;
454 }
455 
456 static struct iommu_table_ops cell_iommu_ops = {
457 	.set = tce_build_cell,
458 	.clear = tce_free_cell
459 };
460 
461 static struct iommu_window * __init
462 cell_iommu_setup_window(struct cbe_iommu *iommu, struct device_node *np,
463 			unsigned long offset, unsigned long size,
464 			unsigned long pte_offset)
465 {
466 	struct iommu_window *window;
467 	struct page *page;
468 	u32 ioid;
469 
470 	ioid = cell_iommu_get_ioid(np);
471 
472 	window = kzalloc_node(sizeof(*window), GFP_KERNEL, iommu->nid);
473 	BUG_ON(window == NULL);
474 
475 	window->offset = offset;
476 	window->size = size;
477 	window->ioid = ioid;
478 	window->iommu = iommu;
479 
480 	window->table.it_blocksize = 16;
481 	window->table.it_base = (unsigned long)iommu->ptab;
482 	window->table.it_index = iommu->nid;
483 	window->table.it_page_shift = IOMMU_PAGE_SHIFT_4K;
484 	window->table.it_offset =
485 		(offset >> window->table.it_page_shift) + pte_offset;
486 	window->table.it_size = size >> window->table.it_page_shift;
487 	window->table.it_ops = &cell_iommu_ops;
488 
489 	iommu_init_table(&window->table, iommu->nid, 0, 0);
490 
491 	pr_debug("\tioid      %d\n", window->ioid);
492 	pr_debug("\tblocksize %ld\n", window->table.it_blocksize);
493 	pr_debug("\tbase      0x%016lx\n", window->table.it_base);
494 	pr_debug("\toffset    0x%lx\n", window->table.it_offset);
495 	pr_debug("\tsize      %ld\n", window->table.it_size);
496 
497 	list_add(&window->list, &iommu->windows);
498 
499 	if (offset != 0)
500 		return window;
501 
502 	/* We need to map and reserve the first IOMMU page since it's used
503 	 * by the spider workaround. In theory, we only need to do that when
504 	 * running on spider but it doesn't really matter.
505 	 *
506 	 * This code also assumes that we have a window that starts at 0,
507 	 * which is the case on all spider based blades.
508 	 */
509 	page = alloc_pages_node(iommu->nid, GFP_KERNEL, 0);
510 	BUG_ON(!page);
511 	iommu->pad_page = page_address(page);
512 	clear_page(iommu->pad_page);
513 
514 	__set_bit(0, window->table.it_map);
515 	tce_build_cell(&window->table, window->table.it_offset, 1,
516 		       (unsigned long)iommu->pad_page, DMA_TO_DEVICE, 0);
517 
518 	return window;
519 }
520 
521 static struct cbe_iommu *cell_iommu_for_node(int nid)
522 {
523 	int i;
524 
525 	for (i = 0; i < cbe_nr_iommus; i++)
526 		if (iommus[i].nid == nid)
527 			return &iommus[i];
528 	return NULL;
529 }
530 
531 static unsigned long cell_dma_nommu_offset;
532 
533 static unsigned long dma_iommu_fixed_base;
534 static bool cell_iommu_enabled;
535 
536 /* iommu_fixed_is_weak is set if booted with iommu_fixed=weak */
537 bool iommu_fixed_is_weak;
538 
539 static struct iommu_table *cell_get_iommu_table(struct device *dev)
540 {
541 	struct iommu_window *window;
542 	struct cbe_iommu *iommu;
543 
544 	/* Current implementation uses the first window available in that
545 	 * node's iommu. We -might- do something smarter later though it may
546 	 * never be necessary
547 	 */
548 	iommu = cell_iommu_for_node(dev_to_node(dev));
549 	if (iommu == NULL || list_empty(&iommu->windows)) {
550 		dev_err(dev, "iommu: missing iommu for %pOF (node %d)\n",
551 		       dev->of_node, dev_to_node(dev));
552 		return NULL;
553 	}
554 	window = list_entry(iommu->windows.next, struct iommu_window, list);
555 
556 	return &window->table;
557 }
558 
559 static u64 cell_iommu_get_fixed_address(struct device *dev);
560 
561 static void cell_dma_dev_setup(struct device *dev)
562 {
563 	if (cell_iommu_enabled) {
564 		u64 addr = cell_iommu_get_fixed_address(dev);
565 
566 		if (addr != OF_BAD_ADDR)
567 			dev->archdata.dma_offset = addr + dma_iommu_fixed_base;
568 		set_iommu_table_base(dev, cell_get_iommu_table(dev));
569 	} else {
570 		dev->archdata.dma_offset = cell_dma_nommu_offset;
571 	}
572 }
573 
574 static void cell_pci_dma_dev_setup(struct pci_dev *dev)
575 {
576 	cell_dma_dev_setup(&dev->dev);
577 }
578 
579 static int cell_of_bus_notify(struct notifier_block *nb, unsigned long action,
580 			      void *data)
581 {
582 	struct device *dev = data;
583 
584 	/* We are only intereted in device addition */
585 	if (action != BUS_NOTIFY_ADD_DEVICE)
586 		return 0;
587 
588 	if (cell_iommu_enabled)
589 		dev->dma_ops = &dma_iommu_ops;
590 	cell_dma_dev_setup(dev);
591 	return 0;
592 }
593 
594 static struct notifier_block cell_of_bus_notifier = {
595 	.notifier_call = cell_of_bus_notify
596 };
597 
598 static int __init cell_iommu_get_window(struct device_node *np,
599 					 unsigned long *base,
600 					 unsigned long *size)
601 {
602 	const __be32 *dma_window;
603 	unsigned long index;
604 
605 	/* Use ibm,dma-window if available, else, hard code ! */
606 	dma_window = of_get_property(np, "ibm,dma-window", NULL);
607 	if (dma_window == NULL) {
608 		*base = 0;
609 		*size = 0x80000000u;
610 		return -ENODEV;
611 	}
612 
613 	of_parse_dma_window(np, dma_window, &index, base, size);
614 	return 0;
615 }
616 
617 static struct cbe_iommu * __init cell_iommu_alloc(struct device_node *np)
618 {
619 	struct cbe_iommu *iommu;
620 	int nid, i;
621 
622 	/* Get node ID */
623 	nid = of_node_to_nid(np);
624 	if (nid < 0) {
625 		printk(KERN_ERR "iommu: failed to get node for %pOF\n",
626 		       np);
627 		return NULL;
628 	}
629 	pr_debug("iommu: setting up iommu for node %d (%pOF)\n",
630 		 nid, np);
631 
632 	/* XXX todo: If we can have multiple windows on the same IOMMU, which
633 	 * isn't the case today, we probably want here to check whether the
634 	 * iommu for that node is already setup.
635 	 * However, there might be issue with getting the size right so let's
636 	 * ignore that for now. We might want to completely get rid of the
637 	 * multiple window support since the cell iommu supports per-page ioids
638 	 */
639 
640 	if (cbe_nr_iommus >= NR_IOMMUS) {
641 		printk(KERN_ERR "iommu: too many IOMMUs detected ! (%pOF)\n",
642 		       np);
643 		return NULL;
644 	}
645 
646 	/* Init base fields */
647 	i = cbe_nr_iommus++;
648 	iommu = &iommus[i];
649 	iommu->stab = NULL;
650 	iommu->nid = nid;
651 	snprintf(iommu->name, sizeof(iommu->name), "iommu%d", i);
652 	INIT_LIST_HEAD(&iommu->windows);
653 
654 	return iommu;
655 }
656 
657 static void __init cell_iommu_init_one(struct device_node *np,
658 				       unsigned long offset)
659 {
660 	struct cbe_iommu *iommu;
661 	unsigned long base, size;
662 
663 	iommu = cell_iommu_alloc(np);
664 	if (!iommu)
665 		return;
666 
667 	/* Obtain a window for it */
668 	cell_iommu_get_window(np, &base, &size);
669 
670 	pr_debug("\ttranslating window 0x%lx...0x%lx\n",
671 		 base, base + size - 1);
672 
673 	/* Initialize the hardware */
674 	cell_iommu_setup_hardware(iommu, base, size);
675 
676 	/* Setup the iommu_table */
677 	cell_iommu_setup_window(iommu, np, base, size,
678 				offset >> IOMMU_PAGE_SHIFT_4K);
679 }
680 
681 static void __init cell_disable_iommus(void)
682 {
683 	int node;
684 	unsigned long base, val;
685 	void __iomem *xregs, *cregs;
686 
687 	/* Make sure IOC translation is disabled on all nodes */
688 	for_each_online_node(node) {
689 		if (cell_iommu_find_ioc(node, &base))
690 			continue;
691 		xregs = ioremap(base, IOC_Reg_Size);
692 		if (xregs == NULL)
693 			continue;
694 		cregs = xregs + IOC_IOCmd_Offset;
695 
696 		pr_debug("iommu: cleaning up iommu on node %d\n", node);
697 
698 		out_be64(xregs + IOC_IOST_Origin, 0);
699 		(void)in_be64(xregs + IOC_IOST_Origin);
700 		val = in_be64(cregs + IOC_IOCmd_Cfg);
701 		val &= ~IOC_IOCmd_Cfg_TE;
702 		out_be64(cregs + IOC_IOCmd_Cfg, val);
703 		(void)in_be64(cregs + IOC_IOCmd_Cfg);
704 
705 		iounmap(xregs);
706 	}
707 }
708 
709 static int __init cell_iommu_init_disabled(void)
710 {
711 	struct device_node *np = NULL;
712 	unsigned long base = 0, size;
713 
714 	/* When no iommu is present, we use direct DMA ops */
715 
716 	/* First make sure all IOC translation is turned off */
717 	cell_disable_iommus();
718 
719 	/* If we have no Axon, we set up the spider DMA magic offset */
720 	if (of_find_node_by_name(NULL, "axon") == NULL)
721 		cell_dma_nommu_offset = SPIDER_DMA_OFFSET;
722 
723 	/* Now we need to check to see where the memory is mapped
724 	 * in PCI space. We assume that all busses use the same dma
725 	 * window which is always the case so far on Cell, thus we
726 	 * pick up the first pci-internal node we can find and check
727 	 * the DMA window from there.
728 	 */
729 	for_each_node_by_name(np, "axon") {
730 		if (np->parent == NULL || np->parent->parent != NULL)
731 			continue;
732 		if (cell_iommu_get_window(np, &base, &size) == 0)
733 			break;
734 	}
735 	if (np == NULL) {
736 		for_each_node_by_name(np, "pci-internal") {
737 			if (np->parent == NULL || np->parent->parent != NULL)
738 				continue;
739 			if (cell_iommu_get_window(np, &base, &size) == 0)
740 				break;
741 		}
742 	}
743 	of_node_put(np);
744 
745 	/* If we found a DMA window, we check if it's big enough to enclose
746 	 * all of physical memory. If not, we force enable IOMMU
747 	 */
748 	if (np && size < memblock_end_of_DRAM()) {
749 		printk(KERN_WARNING "iommu: force-enabled, dma window"
750 		       " (%ldMB) smaller than total memory (%lldMB)\n",
751 		       size >> 20, memblock_end_of_DRAM() >> 20);
752 		return -ENODEV;
753 	}
754 
755 	cell_dma_nommu_offset += base;
756 
757 	if (cell_dma_nommu_offset != 0)
758 		cell_pci_controller_ops.dma_dev_setup = cell_pci_dma_dev_setup;
759 
760 	printk("iommu: disabled, direct DMA offset is 0x%lx\n",
761 	       cell_dma_nommu_offset);
762 
763 	return 0;
764 }
765 
766 /*
767  *  Fixed IOMMU mapping support
768  *
769  *  This code adds support for setting up a fixed IOMMU mapping on certain
770  *  cell machines. For 64-bit devices this avoids the performance overhead of
771  *  mapping and unmapping pages at runtime. 32-bit devices are unable to use
772  *  the fixed mapping.
773  *
774  *  The fixed mapping is established at boot, and maps all of physical memory
775  *  1:1 into device space at some offset. On machines with < 30 GB of memory
776  *  we setup the fixed mapping immediately above the normal IOMMU window.
777  *
778  *  For example a machine with 4GB of memory would end up with the normal
779  *  IOMMU window from 0-2GB and the fixed mapping window from 2GB to 6GB. In
780  *  this case a 64-bit device wishing to DMA to 1GB would be told to DMA to
781  *  3GB, plus any offset required by firmware. The firmware offset is encoded
782  *  in the "dma-ranges" property.
783  *
784  *  On machines with 30GB or more of memory, we are unable to place the fixed
785  *  mapping above the normal IOMMU window as we would run out of address space.
786  *  Instead we move the normal IOMMU window to coincide with the hash page
787  *  table, this region does not need to be part of the fixed mapping as no
788  *  device should ever be DMA'ing to it. We then setup the fixed mapping
789  *  from 0 to 32GB.
790  */
791 
792 static u64 cell_iommu_get_fixed_address(struct device *dev)
793 {
794 	u64 cpu_addr, size, best_size, dev_addr = OF_BAD_ADDR;
795 	struct device_node *np;
796 	const u32 *ranges = NULL;
797 	int i, len, best, naddr, nsize, pna, range_size;
798 
799 	/* We can be called for platform devices that have no of_node */
800 	np = of_node_get(dev->of_node);
801 	if (!np)
802 		goto out;
803 
804 	while (1) {
805 		naddr = of_n_addr_cells(np);
806 		nsize = of_n_size_cells(np);
807 		np = of_get_next_parent(np);
808 		if (!np)
809 			break;
810 
811 		ranges = of_get_property(np, "dma-ranges", &len);
812 
813 		/* Ignore empty ranges, they imply no translation required */
814 		if (ranges && len > 0)
815 			break;
816 	}
817 
818 	if (!ranges) {
819 		dev_dbg(dev, "iommu: no dma-ranges found\n");
820 		goto out;
821 	}
822 
823 	len /= sizeof(u32);
824 
825 	pna = of_n_addr_cells(np);
826 	range_size = naddr + nsize + pna;
827 
828 	/* dma-ranges format:
829 	 * child addr	: naddr cells
830 	 * parent addr	: pna cells
831 	 * size		: nsize cells
832 	 */
833 	for (i = 0, best = -1, best_size = 0; i < len; i += range_size) {
834 		cpu_addr = of_translate_dma_address(np, ranges + i + naddr);
835 		size = of_read_number(ranges + i + naddr + pna, nsize);
836 
837 		if (cpu_addr == 0 && size > best_size) {
838 			best = i;
839 			best_size = size;
840 		}
841 	}
842 
843 	if (best >= 0) {
844 		dev_addr = of_read_number(ranges + best, naddr);
845 	} else
846 		dev_dbg(dev, "iommu: no suitable range found!\n");
847 
848 out:
849 	of_node_put(np);
850 
851 	return dev_addr;
852 }
853 
854 static bool cell_pci_iommu_bypass_supported(struct pci_dev *pdev, u64 mask)
855 {
856 	return mask == DMA_BIT_MASK(64) &&
857 		cell_iommu_get_fixed_address(&pdev->dev) != OF_BAD_ADDR;
858 }
859 
860 static void insert_16M_pte(unsigned long addr, unsigned long *ptab,
861 			   unsigned long base_pte)
862 {
863 	unsigned long segment, offset;
864 
865 	segment = addr >> IO_SEGMENT_SHIFT;
866 	offset = (addr >> 24) - (segment << IO_PAGENO_BITS(24));
867 	ptab = ptab + (segment * (1 << 12) / sizeof(unsigned long));
868 
869 	pr_debug("iommu: addr %lx ptab %p segment %lx offset %lx\n",
870 		  addr, ptab, segment, offset);
871 
872 	ptab[offset] = base_pte | (__pa(addr) & CBE_IOPTE_RPN_Mask);
873 }
874 
875 static void cell_iommu_setup_fixed_ptab(struct cbe_iommu *iommu,
876 	struct device_node *np, unsigned long dbase, unsigned long dsize,
877 	unsigned long fbase, unsigned long fsize)
878 {
879 	unsigned long base_pte, uaddr, ioaddr, *ptab;
880 
881 	ptab = cell_iommu_alloc_ptab(iommu, fbase, fsize, dbase, dsize, 24);
882 
883 	dma_iommu_fixed_base = fbase;
884 
885 	pr_debug("iommu: mapping 0x%lx pages from 0x%lx\n", fsize, fbase);
886 
887 	base_pte = CBE_IOPTE_PP_W | CBE_IOPTE_PP_R | CBE_IOPTE_M |
888 		(cell_iommu_get_ioid(np) & CBE_IOPTE_IOID_Mask);
889 
890 	if (iommu_fixed_is_weak)
891 		pr_info("IOMMU: Using weak ordering for fixed mapping\n");
892 	else {
893 		pr_info("IOMMU: Using strong ordering for fixed mapping\n");
894 		base_pte |= CBE_IOPTE_SO_RW;
895 	}
896 
897 	for (uaddr = 0; uaddr < fsize; uaddr += (1 << 24)) {
898 		/* Don't touch the dynamic region */
899 		ioaddr = uaddr + fbase;
900 		if (ioaddr >= dbase && ioaddr < (dbase + dsize)) {
901 			pr_debug("iommu: fixed/dynamic overlap, skipping\n");
902 			continue;
903 		}
904 
905 		insert_16M_pte(uaddr, ptab, base_pte);
906 	}
907 
908 	mb();
909 }
910 
911 static int __init cell_iommu_fixed_mapping_init(void)
912 {
913 	unsigned long dbase, dsize, fbase, fsize, hbase, hend;
914 	struct cbe_iommu *iommu;
915 	struct device_node *np;
916 
917 	/* The fixed mapping is only supported on axon machines */
918 	np = of_find_node_by_name(NULL, "axon");
919 	of_node_put(np);
920 
921 	if (!np) {
922 		pr_debug("iommu: fixed mapping disabled, no axons found\n");
923 		return -1;
924 	}
925 
926 	/* We must have dma-ranges properties for fixed mapping to work */
927 	np = of_find_node_with_property(NULL, "dma-ranges");
928 	of_node_put(np);
929 
930 	if (!np) {
931 		pr_debug("iommu: no dma-ranges found, no fixed mapping\n");
932 		return -1;
933 	}
934 
935 	/* The default setup is to have the fixed mapping sit after the
936 	 * dynamic region, so find the top of the largest IOMMU window
937 	 * on any axon, then add the size of RAM and that's our max value.
938 	 * If that is > 32GB we have to do other shennanigans.
939 	 */
940 	fbase = 0;
941 	for_each_node_by_name(np, "axon") {
942 		cell_iommu_get_window(np, &dbase, &dsize);
943 		fbase = max(fbase, dbase + dsize);
944 	}
945 
946 	fbase = ALIGN(fbase, 1 << IO_SEGMENT_SHIFT);
947 	fsize = memblock_phys_mem_size();
948 
949 	if ((fbase + fsize) <= 0x800000000ul)
950 		hbase = 0; /* use the device tree window */
951 	else {
952 		/* If we're over 32 GB we need to cheat. We can't map all of
953 		 * RAM with the fixed mapping, and also fit the dynamic
954 		 * region. So try to place the dynamic region where the hash
955 		 * table sits, drivers never need to DMA to it, we don't
956 		 * need a fixed mapping for that area.
957 		 */
958 		if (!htab_address) {
959 			pr_debug("iommu: htab is NULL, on LPAR? Huh?\n");
960 			return -1;
961 		}
962 		hbase = __pa(htab_address);
963 		hend  = hbase + htab_size_bytes;
964 
965 		/* The window must start and end on a segment boundary */
966 		if ((hbase != ALIGN(hbase, 1 << IO_SEGMENT_SHIFT)) ||
967 		    (hend != ALIGN(hend, 1 << IO_SEGMENT_SHIFT))) {
968 			pr_debug("iommu: hash window not segment aligned\n");
969 			return -1;
970 		}
971 
972 		/* Check the hash window fits inside the real DMA window */
973 		for_each_node_by_name(np, "axon") {
974 			cell_iommu_get_window(np, &dbase, &dsize);
975 
976 			if (hbase < dbase || (hend > (dbase + dsize))) {
977 				pr_debug("iommu: hash window doesn't fit in"
978 					 "real DMA window\n");
979 				return -1;
980 			}
981 		}
982 
983 		fbase = 0;
984 	}
985 
986 	/* Setup the dynamic regions */
987 	for_each_node_by_name(np, "axon") {
988 		iommu = cell_iommu_alloc(np);
989 		BUG_ON(!iommu);
990 
991 		if (hbase == 0)
992 			cell_iommu_get_window(np, &dbase, &dsize);
993 		else {
994 			dbase = hbase;
995 			dsize = htab_size_bytes;
996 		}
997 
998 		printk(KERN_DEBUG "iommu: node %d, dynamic window 0x%lx-0x%lx "
999 			"fixed window 0x%lx-0x%lx\n", iommu->nid, dbase,
1000 			 dbase + dsize, fbase, fbase + fsize);
1001 
1002 		cell_iommu_setup_stab(iommu, dbase, dsize, fbase, fsize);
1003 		iommu->ptab = cell_iommu_alloc_ptab(iommu, dbase, dsize, 0, 0,
1004 						    IOMMU_PAGE_SHIFT_4K);
1005 		cell_iommu_setup_fixed_ptab(iommu, np, dbase, dsize,
1006 					     fbase, fsize);
1007 		cell_iommu_enable_hardware(iommu);
1008 		cell_iommu_setup_window(iommu, np, dbase, dsize, 0);
1009 	}
1010 
1011 	cell_pci_controller_ops.iommu_bypass_supported =
1012 		cell_pci_iommu_bypass_supported;
1013 	return 0;
1014 }
1015 
1016 static int iommu_fixed_disabled;
1017 
1018 static int __init setup_iommu_fixed(char *str)
1019 {
1020 	struct device_node *pciep;
1021 
1022 	if (strcmp(str, "off") == 0)
1023 		iommu_fixed_disabled = 1;
1024 
1025 	/* If we can find a pcie-endpoint in the device tree assume that
1026 	 * we're on a triblade or a CAB so by default the fixed mapping
1027 	 * should be set to be weakly ordered; but only if the boot
1028 	 * option WASN'T set for strong ordering
1029 	 */
1030 	pciep = of_find_node_by_type(NULL, "pcie-endpoint");
1031 
1032 	if (strcmp(str, "weak") == 0 || (pciep && strcmp(str, "strong") != 0))
1033 		iommu_fixed_is_weak = true;
1034 
1035 	of_node_put(pciep);
1036 
1037 	return 1;
1038 }
1039 __setup("iommu_fixed=", setup_iommu_fixed);
1040 
1041 static int __init cell_iommu_init(void)
1042 {
1043 	struct device_node *np;
1044 
1045 	/* If IOMMU is disabled or we have little enough RAM to not need
1046 	 * to enable it, we setup a direct mapping.
1047 	 *
1048 	 * Note: should we make sure we have the IOMMU actually disabled ?
1049 	 */
1050 	if (iommu_is_off ||
1051 	    (!iommu_force_on && memblock_end_of_DRAM() <= 0x80000000ull))
1052 		if (cell_iommu_init_disabled() == 0)
1053 			goto bail;
1054 
1055 	/* Setup various callbacks */
1056 	cell_pci_controller_ops.dma_dev_setup = cell_pci_dma_dev_setup;
1057 
1058 	if (!iommu_fixed_disabled && cell_iommu_fixed_mapping_init() == 0)
1059 		goto done;
1060 
1061 	/* Create an iommu for each /axon node.  */
1062 	for_each_node_by_name(np, "axon") {
1063 		if (np->parent == NULL || np->parent->parent != NULL)
1064 			continue;
1065 		cell_iommu_init_one(np, 0);
1066 	}
1067 
1068 	/* Create an iommu for each toplevel /pci-internal node for
1069 	 * old hardware/firmware
1070 	 */
1071 	for_each_node_by_name(np, "pci-internal") {
1072 		if (np->parent == NULL || np->parent->parent != NULL)
1073 			continue;
1074 		cell_iommu_init_one(np, SPIDER_DMA_OFFSET);
1075 	}
1076  done:
1077 	/* Setup default PCI iommu ops */
1078 	set_pci_dma_ops(&dma_iommu_ops);
1079 	cell_iommu_enabled = true;
1080  bail:
1081 	/* Register callbacks on OF platform device addition/removal
1082 	 * to handle linking them to the right DMA operations
1083 	 */
1084 	bus_register_notifier(&platform_bus_type, &cell_of_bus_notifier);
1085 
1086 	return 0;
1087 }
1088 machine_arch_initcall(cell, cell_iommu_init);
1089