Skip to contentSkip to conversation

of/device: add blacklist for iommu dma_ops

PATCH In review Rob Clark 9 participants 28 messages Dec 1, 2018 – Jun 5, 2019

Subsystems (6)
lore
Share & tools
lore

Rob Clark

author
#0 lore raw

PATCH 1/1 of/device: add blacklist for iommu dma_ops

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +22 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
 	return device_add(&ofdev->dev);
 }
 
+static const struct of_device_id iommu_blacklist[] = {
+	{ .compatible = "qcom,mdp4" },
+	{ .compatible = "qcom,mdss" },
+	{ .compatible = "qcom,sdm845-mdss" },
+	{ .compatible = "qcom,adreno" },
+	{}
+};
+
 /**
  * of_dma_configure - Setup DMA configuration
  * @dev:	Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
 	dev_dbg(dev, "device is%sbehind an iommu\n",
 		iommu ? " " : " not ");
 
+	/*
+	 * There is at least one case where the driver wants to directly
+	 * manage the IOMMU, but if we end up with iommu dma_ops, that
+	 * interferes with the drivers ability to use dma_map_sg() for
+	 * cache operations.  Since we don't currently have a better
+	 * solution, and this code runs before the driver is probed and
+	 * has a chance to intervene, use a simple blacklist to avoid
+	 * ending up with iommu dma_ops:
+	 */
+	if (of_match_device(iommu_blacklist, dev)) {
+		dev_dbg(dev, "skipping iommu hookup\n");
+		iommu = NULL;
+	}
+
 	arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
 	return 0;
Signature · 1 line
2.19.2
Reviewed-by on v1 1/1
#1 lore raw
Quoted 135 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +22 -1
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};
+
 /**
  * of_dma_configure - Setup DMA configuration
  * @dev:       Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
        dev_dbg(dev, "device is%sbehind an iommu\n",
                iommu ? " " : " not ");
 
+       /*
+        * There is at least one case where the driver wants to directly
+        * manage the IOMMU, but if we end up with iommu dma_ops, that
+        * interferes with the drivers ability to use dma_map_sg() for
+        * cache operations.  Since we don't currently have a better
+        * solution, and this code runs before the driver is probed and
+        * has a chance to intervene, use a simple blacklist to avoid
+        * ending up with iommu dma_ops:
+        */
+       if (of_match_device(iommu_blacklist, dev)) {
+               dev_dbg(dev, "skipping iommu hookup\n");
+               iommu = NULL;
+       }
+
        arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
        return 0;
--
Quoted 2 lines

2.19.2

+Marek Szyprowski who I believe had a similar problem with Exynos DRM before.

Best regards,
Tomasz

#2 lore raw

Hi Tomasz,

Quoted 133 lines · Tomasz Figa
Quoted 132 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +22 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};
+
 /**
  * of_dma_configure - Setup DMA configuration
  * @dev:       Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
        dev_dbg(dev, "device is%sbehind an iommu\n",
                iommu ? " " : " not ");
 
+       /*
+        * There is at least one case where the driver wants to directly
+        * manage the IOMMU, but if we end up with iommu dma_ops, that
+        * interferes with the drivers ability to use dma_map_sg() for
+        * cache operations.  Since we don't currently have a better
+        * solution, and this code runs before the driver is probed and
+        * has a chance to intervene, use a simple blacklist to avoid
+        * ending up with iommu dma_ops:
+        */
+       if (of_match_device(iommu_blacklist, dev)) {
+               dev_dbg(dev, "skipping iommu hookup\n");
+               iommu = NULL;
+       }
+
        arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
Quoted 7 lines
Quoted 4 lines
drivers/of/device.c +0 -1
        return 0;
--

2.19.2

+Marek Szyprowski who I believe had a similar problem with Exynos DRM before.

Thanks for adding me. So far Exynos DRM use other workaround, see commit 1feda5eb77fc ("drm/exynos: Use selected dma_dev default iommu domain instead of a fake one"). Here is the link to the thread with more comments and background:
https://www.spinics.net/lists/arm-kernel/msg676100.html

Best regards

Signature · 7 lines
Marek Szyprowski, PhD
Samsung R&D Institute Poland

_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno
reviewer
#3 lore raw
In reply to Rob Clark

Hi Rob,

Quoted 67 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none
Quoted 3 lines

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

Does this crash still happen with 4.20-rc? Because as of 6af588fed391 it really shouldn't.

Quoted 9 lines

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

s/solved/worked around/

If you want a guarantee of actually getting a specific hardware context allocated for a given domain, there needs to be code in the IOMMU driver to understand and honour that. Implicitly depending on whatever happens to fall out of current driver behaviour on current systems is not a real solution.

Quoted 1 line
Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

That's rather misleading, since the crash described above depends on at least two other major changes which came long after that commit.

It's not that I don't understand exactly what you want here - just that this commit message isn't a coherent justification for that ;)

Quoted 37 lines

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +11 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
  	return device_add(&ofdev->dev);
  }
 
+static const struct of_device_id iommu_blacklist[] = {
+	{ .compatible = "qcom,mdp4" },
+	{ .compatible = "qcom,mdss" },
+	{ .compatible = "qcom,sdm845-mdss" },
+	{ .compatible = "qcom,adreno" },
+	{}
+};
+
  /**
   * of_dma_configure - Setup DMA configuration
   * @dev:	Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
  	dev_dbg(dev, "device is%sbehind an iommu\n",
  		iommu ? " " : " not ");
 
+	/*
+	 * There is at least one case where the driver wants to directly
+	 * manage the IOMMU, but if we end up with iommu dma_ops, that

drivers/of/device.c int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) · line 187

Quoted 10 lines
drivers/of/device.c +10 -0
+	 * interferes with the drivers ability to use dma_map_sg() for
+	 * cache operations.  Since we don't currently have a better
+	 * solution, and this code runs before the driver is probed and
+	 * has a chance to intervene, use a simple blacklist to avoid
+	 * ending up with iommu dma_ops:
+	 */
+	if (of_match_device(iommu_blacklist, dev)) {
+		dev_dbg(dev, "skipping iommu hookup\n");
+		iommu = NULL;
+	}

Given that a default domain will already have been allocated by the time we get here, regardless of whether we pretend of_iommu_configure() did nothing, I'm puzzled as to how this change is 'solving' that aspect as claimed :/

Is CONFIG_IOMMU_DEFAULT_PASSTHROUGH a sufficient workaround for msm at the moment, or do you have other devices which do actually want iommu_dma_ops?

Robin.

drivers/of/device.c int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) · line 191

Quoted 5 lines
drivers/of/device.c +1 -0
+
  	arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
  	return 0;

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

author
#4 lore raw
Quoted 71 lines · Robin Murphy

Hi Rob,

Quoted 67 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none
Quoted 6 lines
Quoted 3 lines

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

Does this crash still happen with 4.20-rc? Because as of 6af588fed391 it really shouldn't.

for this hw, I'm still on 4.19, although that does look like it would avoid the issue.

Quoted 10 lines
Quoted 9 lines

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Quoted 7 lines

s/solved/worked around/

If you want a guarantee of actually getting a specific hardware context allocated for a given domain, there needs to be code in the IOMMU driver to understand and honour that. Implicitly depending on whatever happens to fall out of current driver behaviour on current systems is not a real solution.

ok, fair.. but I'll settle for "works" in the absence of better options..

At some level, it would be nice to be able to optionally specify a context-bank in the iommu bindings. But not sure how to make that fit w/ cb allocated per domain. And I assume I'm the only one who has this problem?

Quoted 4 lines
Quoted 1 line
Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

That's rather misleading, since the crash described above depends on at least two other major changes which came long after that commit.

Fair, when I realized it was the difference in where the iommu attaches between dpu1 (sdm845) and everything coming before, I should have removed the tag.

BR,
-R

Quoted 67 lines

It's not that I don't understand exactly what you want here - just that this commit message isn't a coherent justification for that ;)

Quoted 37 lines

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +11 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
      return device_add(&ofdev->dev);
  }
 
+static const struct of_device_id iommu_blacklist[] = {
+     { .compatible = "qcom,mdp4" },
+     { .compatible = "qcom,mdss" },
+     { .compatible = "qcom,sdm845-mdss" },
+     { .compatible = "qcom,adreno" },
+     {}
+};
+
  /**
   * of_dma_configure - Setup DMA configuration
   * @dev:    Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
      dev_dbg(dev, "device is%sbehind an iommu\n",
              iommu ? " " : " not ");
 
+     /*
+      * There is at least one case where the driver wants to directly
+      * manage the IOMMU, but if we end up with iommu dma_ops, that

drivers/of/device.c int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) · line 187

Quoted 10 lines
drivers/of/device.c +10 -0
+      * interferes with the drivers ability to use dma_map_sg() for
+      * cache operations.  Since we don't currently have a better
+      * solution, and this code runs before the driver is probed and
+      * has a chance to intervene, use a simple blacklist to avoid
+      * ending up with iommu dma_ops:
+      */
+     if (of_match_device(iommu_blacklist, dev)) {
+             dev_dbg(dev, "skipping iommu hookup\n");
+             iommu = NULL;
+     }

Given that a default domain will already have been allocated by the time we get here, regardless of whether we pretend of_iommu_configure() did nothing, I'm puzzled as to how this change is 'solving' that aspect as claimed :/

Is CONFIG_IOMMU_DEFAULT_PASSTHROUGH a sufficient workaround for msm at the moment, or do you have other devices which do actually want iommu_dma_ops?

Robin.

Quoted 5 lines
drivers/of/device.c +1 -0
+
      arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
      return 0;
author
#5 lore raw
In reply to Robin Murphy
Quoted 148 lines · Robin Murphy

Hi Rob,

Quoted 67 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none
Quoted 3 lines

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

Does this crash still happen with 4.20-rc? Because as of 6af588fed391 it really shouldn't.

Quoted 9 lines

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

s/solved/worked around/

If you want a guarantee of actually getting a specific hardware context allocated for a given domain, there needs to be code in the IOMMU driver to understand and honour that. Implicitly depending on whatever happens to fall out of current driver behaviour on current systems is not a real solution.

Quoted 1 line
Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

That's rather misleading, since the crash described above depends on at least two other major changes which came long after that commit.

It's not that I don't understand exactly what you want here - just that this commit message isn't a coherent justification for that ;)

Quoted 44 lines

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +18 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
      return device_add(&ofdev->dev);
  }
 
+static const struct of_device_id iommu_blacklist[] = {
+     { .compatible = "qcom,mdp4" },
+     { .compatible = "qcom,mdss" },
+     { .compatible = "qcom,sdm845-mdss" },
+     { .compatible = "qcom,adreno" },
+     {}
+};
+
  /**
   * of_dma_configure - Setup DMA configuration
   * @dev:    Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
      dev_dbg(dev, "device is%sbehind an iommu\n",
              iommu ? " " : " not ");
 
+     /*
+      * There is at least one case where the driver wants to directly
+      * manage the IOMMU, but if we end up with iommu dma_ops, that
+      * interferes with the drivers ability to use dma_map_sg() for
+      * cache operations.  Since we don't currently have a better
+      * solution, and this code runs before the driver is probed and
+      * has a chance to intervene, use a simple blacklist to avoid
+      * ending up with iommu dma_ops:
+      */
+     if (of_match_device(iommu_blacklist, dev)) {
Quoted 8 lines

drivers/of/device.c int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) · line 187

Quoted 3 lines
drivers/of/device.c +3 -0
+             dev_dbg(dev, "skipping iommu hookup\n");
+             iommu = NULL;
+     }

Given that a default domain will already have been allocated by the time we get here, regardless of whether we pretend of_iommu_configure() did nothing, I'm puzzled as to how this change is 'solving' that aspect as claimed :/

Possibly I'm reading this wrong.. I thought it is not created until arm_iommu_create_mapping()..

but hmm, I guess I was looking at the armv7 code. Seems to be different on arm64.. ugg..

Quoted 3 lines

Is CONFIG_IOMMU_DEFAULT_PASSTHROUGH a sufficient workaround for msm at the moment, or do you have other devices which do actually want iommu_dma_ops?

I think there are at least a few other devices (venus, camera, maybe some others that are not wired up yet?)

BR,
-R

Quoted 8 lines

Robin.

Quoted 5 lines
drivers/of/device.c +1 -0
+
      arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
      return 0;

_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#6 lore raw
Quoted 165 lines · Rob Clark
Quoted 148 lines · Robin Murphy

Hi Rob,

Quoted 67 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none
Quoted 3 lines

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

Does this crash still happen with 4.20-rc? Because as of 6af588fed391 it really shouldn't.

Quoted 9 lines

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

s/solved/worked around/

If you want a guarantee of actually getting a specific hardware context allocated for a given domain, there needs to be code in the IOMMU driver to understand and honour that. Implicitly depending on whatever happens to fall out of current driver behaviour on current systems is not a real solution.

Quoted 1 line
Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

That's rather misleading, since the crash described above depends on at least two other major changes which came long after that commit.

It's not that I don't understand exactly what you want here - just that this commit message isn't a coherent justification for that ;)

Quoted 44 lines

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +18 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
      return device_add(&ofdev->dev);
  }
 
+static const struct of_device_id iommu_blacklist[] = {
+     { .compatible = "qcom,mdp4" },
+     { .compatible = "qcom,mdss" },
+     { .compatible = "qcom,sdm845-mdss" },
+     { .compatible = "qcom,adreno" },
+     {}
+};
+
  /**
   * of_dma_configure - Setup DMA configuration
   * @dev:    Device to apply DMA configuration
@@ -164,6 +172,20 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma)
      dev_dbg(dev, "device is%sbehind an iommu\n",
              iommu ? " " : " not ");
 
+     /*
+      * There is at least one case where the driver wants to directly
+      * manage the IOMMU, but if we end up with iommu dma_ops, that
+      * interferes with the drivers ability to use dma_map_sg() for
+      * cache operations.  Since we don't currently have a better
+      * solution, and this code runs before the driver is probed and
+      * has a chance to intervene, use a simple blacklist to avoid
+      * ending up with iommu dma_ops:
+      */
+     if (of_match_device(iommu_blacklist, dev)) {
Quoted 8 lines

drivers/of/device.c int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) · line 187

Quoted 3 lines
drivers/of/device.c +3 -0
+             dev_dbg(dev, "skipping iommu hookup\n");
+             iommu = NULL;
+     }

Given that a default domain will already have been allocated by the time we get here, regardless of whether we pretend of_iommu_configure() did nothing, I'm puzzled as to how this change is 'solving' that aspect as claimed :/

Possibly I'm reading this wrong.. I thought it is not created until arm_iommu_create_mapping()..

but hmm, I guess I was looking at the armv7 code. Seems to be different on arm64.. ugg..

Quoted 6 lines
Quoted 3 lines

Is CONFIG_IOMMU_DEFAULT_PASSTHROUGH a sufficient workaround for msm at the moment, or do you have other devices which do actually want iommu_dma_ops?

I think there are at least a few other devices (venus, camera, maybe some others that are not wired up yet?)

Yes, for msm, the drm devices do not want the default DMA domain, whereas the V4L devices - video and camera rely completely on DMA iommu domain and use the dma mapping apis to manage things.
So enabling CONFIG_IOMMU_DEFAULT_PASSTHROUGH for msm platforms is not the desired configuration.
Moreover, we can't enable this config with upstream kernels anyways.

Thanks
Vivek

Quoted 16 lines

BR,
-R

Quoted 8 lines

Robin.

Quoted 5 lines
drivers/of/device.c +1 -0
+
      arch_setup_dma_ops(dev, dma_addr, size, iommu, coherent);
 
      return 0;

_______________________________________________
iommu mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/iommu

Signature · 6 lines
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno
#7 lore raw
In reply to Rob Clark
Quoted 99 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 10 lines
drivers/of/device.c +7 -0
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Rob
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

author
#8 lore raw
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

author
#9 lore raw
Quoted 119 lines · Rob Clark
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Quoted 3 lines

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

BR,
-R

Quoted 11 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Quoted 6 lines

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#10 lore raw
Quoted 132 lines · Rob Clark
Quoted 119 lines · Rob Clark
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Quoted 3 lines

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Adding Marek who had the same problem on Exynos.

Best regards,
Tomasz

Quoted 21 lines

BR,
-R

Quoted 17 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

#11 lore raw
Quoted 119 lines · Tomasz Figa
Quoted 118 lines · Rob Clark
Quoted 117 lines · Rob Clark
Quoted 102 lines · Rob Herring
Quoted 101 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
         return device_add(&ofdev->dev);
  }
 
Quoted 11 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

Quoted 6 lines
Quoted 6 lines

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Things are bad for MTP sdm845 too where the bootloader sets up iommu to display splash screen, and when the kernel resets the iommu, the mappings go for a toss resulting in fatal faults.
Bjorn was working on something recently to address this. Adding him to the thread.

Best regards
Vivek

Quoted 31 lines
Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Adding Marek who had the same problem on Exynos.

Best regards,
Tomasz

Quoted 19 lines

BR,
-R

Quoted 16 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

author
#12 lore raw
Quoted 130 lines · Vivek Gautam
Quoted 119 lines · Tomasz Figa
Quoted 118 lines · Rob Clark
Quoted 117 lines · Rob Clark
Quoted 102 lines · Rob Herring
Quoted 101 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
         return device_add(&ofdev->dev);
  }
 
Quoted 11 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

Quoted 6 lines
Quoted 6 lines

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Quoted 6 lines

Things are bad for MTP sdm845 too where the bootloader sets up iommu to display splash screen, and when the kernel resets the iommu, the mappings go for a toss resulting in fatal faults.
Bjorn was working on something recently to address this. Adding him to the thread.

yeah, I was hitting it on the yoga c630 laptop, but it is the identical problem.

We'd worked around it so far with a hack in arm-smmu to temporarily ioremap the display controller block and disable INTF1, which is *defn* not a good solution ;-)

BR,
-R

Quoted 36 lines

Best regards
Vivek

Quoted 31 lines
Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Adding Marek who had the same problem on Exynos.

Best regards,
Tomasz

Quoted 19 lines

BR,
-R

Quoted 16 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

author
#16 lore raw
In reply to Tomasz Figa
Quoted 138 lines · Tomasz Figa
Quoted 132 lines · Rob Clark
Quoted 119 lines · Rob Clark
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Quoted 3 lines

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

Quoted 5 lines

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

BR,
-R

Quoted 24 lines

Best regards,
Tomasz

Quoted 21 lines

BR,
-R

Quoted 17 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#13 lore raw
In reply to Rob Clark
Quoted 140 lines · Rob Clark
Quoted 130 lines · Vivek Gautam
Quoted 119 lines · Tomasz Figa
Quoted 118 lines · Rob Clark
Quoted 117 lines · Rob Clark
Quoted 102 lines · Rob Herring
Quoted 101 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
         return device_add(&ofdev->dev);
  }
 
Quoted 11 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

Quoted 6 lines
Quoted 6 lines

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Quoted 6 lines

Things are bad for MTP sdm845 too where the bootloader sets up iommu to display splash screen, and when the kernel resets the iommu, the mappings go for a toss resulting in fatal faults.
Bjorn was working on something recently to address this. Adding him to the thread.

Quoted 5 lines

yeah, I was hitting it on the yoga c630 laptop, but it is the identical problem.

We'd worked around it so far with a hack in arm-smmu to temporarily ioremap the display controller block and disable INTF1, which is *defn* not a good solution ;-)

Right, but this doesn't always work for MTP. I believe Bjorn has something more inline with downstream.

Regards

Quoted 44 lines

BR,
-R

Quoted 36 lines

Best regards
Vivek

Quoted 31 lines
Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Adding Marek who had the same problem on Exynos.

Best regards,
Tomasz

Quoted 19 lines

BR,
-R

Quoted 16 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

_______________________________________________
iommu mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/iommu

Signature · 2 lines
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation
reviewer
#17 lore raw
In reply to Rob Clark
Quoted 135 lines · Rob Clark
Quoted 134 lines · Tomasz Figa
Quoted 132 lines · Rob Clark
Quoted 119 lines · Rob Clark
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
         return device_add(&ofdev->dev);
  }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Quoted 3 lines

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Quoted 7 lines
Quoted 7 lines
Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Right, it's not about "being clever", it's about not adding opt-in code to the hundreds and hundreds and hundreds of drivers which *might* ever find themselves used on a system where they would need the IOMMU's help for DMA.

Quoted 8 lines
Quoted 1 line

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Wouldn't help much. That particular issue is nothing to do with DMA ops really, it's about IOMMU initialisation. On something like SMMUv3 there is literally no way to turn the thing on without blocking unknown traffic - it *has* to have stream table entries programmed before it can even allow stuff to bypass.

The answer is either to either pay attention to the "Quiesce all DMA capable devices" part of the boot protocol (which has been there since pretty much forever), or to come up with some robust way of communicating "live" boot-time mappings to IOMMU drivers so that they can program themselves appropriately during probe.

Robin.
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#14 lore raw
In reply to Vivek Gautam

If you (and a few others actors in the thread) want people to actually read what you wrote please follow proper mailing list ettiquette. I've given up on reading all the recent mails after scrolling through two pages of full quotes.

#15 lore raw
Quoted 5 lines · Christoph Hellwig

If you (and a few others actors in the thread) want people to actually read what you wrote please follow proper mailing list ettiquette. I've given up on reading all the recent mails after scrolling through two pages of full quotes.

Apologies for not cutting down the quoted text. I will be more careful next time onwards.

Regards
Vivek

Signature · 6 lines
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno
author
#18 lore raw
In reply to Robin Murphy
Quoted 17 lines · Robin Murphy
Quoted 15 lines · Rob Clark
Quoted 14 lines · Tomasz Figa
Quoted 11 lines · Rob Clark

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

Quoted 8 lines
Quoted 3 lines
Quoted 3 lines

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Right, it's not about "being clever", it's about not adding opt-in code to the hundreds and hundreds and hundreds of drivers which *might* ever find themselves used on a system where they would need the IOMMU's help for DMA.

Well, I mean, at one point we didn't do the automatic iommu hookup, we could have just stuck with that and added a helper so drivers could request the hookup. Things wouldn't have been any more broken than before, and when people bring up systems where iommu is required, they could have added the necessary dma_iommu_configure() call. But that is water under the bridge now.

Quoted 9 lines
Quoted 8 lines
Quoted 1 line

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Quoted 5 lines

Wouldn't help much. That particular issue is nothing to do with DMA ops really, it's about IOMMU initialisation. On something like SMMUv3 there is literally no way to turn the thing on without blocking unknown traffic - it *has* to have stream table entries programmed before it can even allow stuff to bypass.

fwiw, on these sdm850 laptops (and I think sdm845 boards like mtp and db845c) the SMMU (v2) is taken out of bypass by the bootloader. Bjorn has some patches for arm-smmu to read-back the state at boot.

(Although older devices were booting with display enabled but SMMU in bypass.)

Quoted 5 lines

The answer is either to either pay attention to the "Quiesce all DMA capable devices" part of the boot protocol (which has been there since pretty much forever), or to come up with some robust way of communicating "live" boot-time mappings to IOMMU drivers so that they can program themselves appropriately during probe.

Unfortunately display lit up by bootloader is basically ubiquitous. Every single android phone does it. All of the windows-arm laptops do it. Basically 99.9% of things that have a display do it. It's a tough problem to solve involving clks, gdsc, regulators, etc, in addition to the display driver.. and sadly now smmu. And devices where we can make changes to and update the firmware are rather rare. So there is really no option to ignore this problem.

I guess if we had some early-quirks mechanism like x86 does, we could mash the display off early in boot. That would be an easy solution. Although I'd prefer a proper solution so that android phones aren't carrying around enormous stacks of hack patches to achieve a smooth flicker-free boot.

I suppose arm-smmu could realize that the context bank is already taken out of bypass.. although I'm not entirely sure if we can assume that the CPU would be able to read back the pagetable setup by the bootloader. Maybe Vivek has an idea about that?

BR,
-R
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#23 lore raw
In reply to Robin Murphy
Quoted 163 lines · Robin Murphy
Quoted 135 lines · Rob Clark
Quoted 134 lines · Tomasz Figa
Quoted 132 lines · Rob Clark
Quoted 119 lines · Rob Clark
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

   [0000000000000038] user address but active_mm is swapper
   Internal error: Oops: 96000005 [#1] PREEMPT SMP
   Modules linked in:
   CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
   Hardware name: xxx (DT)
   Workqueue: events deferred_probe_work_func
   pstate: 80c00009 (Nzcv daif +PAN +UAO)
   pc : iommu_dma_map_sg+0x7c/0x2c8
   lr : iommu_dma_map_sg+0x40/0x2c8
   sp : ffffff80095eb4f0
   x29: ffffff80095eb4f0 x28: 0000000000000000
   x27: ffffffc0f9431578 x26: 0000000000000000
   x25: 00000000ffffffff x24: 0000000000000003
   x23: 0000000000000001 x22: ffffffc0fa9ac010
   x21: 0000000000000000 x20: ffffffc0fab40980
   x19: ffffffc0fab40980 x18: 0000000000000003
   x17: 00000000000001c4 x16: 0000000000000007
   x15: 000000000000000e x14: ffffffffffffffff
   x13: ffff000000000000 x12: 0000000000000028
   x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
   x9 : 0000000000000000 x8 : ffffffc0fab409a0
   x7 : 0000000000000000 x6 : 0000000000000002
   x5 : 0000000100000000 x4 : 0000000000000000
   x3 : 0000000000000001 x2 : 0000000000000002
   x1 : ffffffc0f9431578 x0 : 0000000000000000
   Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
   Call trace:
    iommu_dma_map_sg+0x7c/0x2c8
    __iommu_map_sg_attrs+0x70/0x84
    get_pages+0x170/0x1e8
    msm_gem_get_iova+0x8c/0x128
    _msm_gem_kernel_new+0x6c/0xc8
    msm_gem_kernel_new+0x4c/0x58
    dsi_tx_buf_alloc_6g+0x4c/0x8c
    msm_dsi_host_modeset_init+0xc8/0x108
    msm_dsi_modeset_init+0x54/0x18c
    _dpu_kms_drm_obj_init+0x430/0x474
    dpu_kms_hw_init+0x5f8/0x6b4
    msm_drm_bind+0x360/0x6c8
    try_to_bring_up_master.part.7+0x28/0x70
    component_master_add_with_match+0xe8/0x124
    msm_pdev_probe+0x294/0x2b4
    platform_drv_probe+0x58/0xa4
    really_probe+0x150/0x294
    driver_probe_device+0xac/0xe8
    __device_attach_driver+0xa4/0xb4
    bus_for_each_drv+0x98/0xc8
    __device_attach+0xac/0x12c
    device_initial_probe+0x24/0x30
    bus_probe_device+0x38/0x98
    deferred_probe_work_func+0x78/0xa4
    process_one_work+0x24c/0x3dc
    worker_thread+0x280/0x360
    kthread+0x134/0x13c
    ret_from_fork+0x10/0x18
   Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
   ---[ end trace f22dda57f3648e2c ]---
   Kernel panic - not syncing: Fatal exception
   SMP: stopping secondary CPUs
   Kernel Offset: disabled
   CPU features: 0x0,22802a18
   Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

  drivers/of/device.c | 22 ++++++++++++++++++++++
  1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
         return device_add(&ofdev->dev);
  }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Quoted 3 lines

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

Quoted 7 lines
Quoted 7 lines
Quoted 3 lines

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Right, it's not about "being clever", it's about not adding opt-in code to the hundreds and hundreds and hundreds of drivers which *might* ever find themselves used on a system where they would need the IOMMU's help for DMA.

Quoted 8 lines
Quoted 1 line

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Wouldn't help much. That particular issue is nothing to do with DMA ops really, it's about IOMMU initialisation. On something like SMMUv3 there is literally no way to turn the thing on without blocking unknown traffic - it *has* to have stream table entries programmed before it can even allow stuff to bypass.

Quoted 5 lines

The answer is either to either pay attention to the "Quiesce all DMA capable devices" part of the boot protocol (which has been there since pretty much forever), or to come up with some robust way of communicating "live" boot-time mappings to IOMMU drivers so that they can program themselves appropriately during probe.

I ran into a similar issue not too long ago and I've been working on what I think is a correct fix for this problem. Unfortunately I went down the rabbit hole of trying to get all of the pieces in the bootloader merged before posting the kernel patches, and that's been taking a long time. Let me chime in here in the hope that it will be helpful to others.

The problem that I ran into was pretty much the same thing that Rob encountered. We have some platforms that will initialize display over HDMI in an early bootloader to show a splash screen. During boot we would usually take over display hardware by just resetting it and then programming it from scratch. Ultimately we want to do seamless handover so that the kernel can take over the splash and replace it by the console when that's ready. But I'm getting ahead of myself.

One of the things I've been trying to do is replace direct IOMMU API usage in the Tegra DRM driver by using DMA API only, which we need in order to fix some corner cases we ran into (I've now forgotten most of the details and I realize that my commit messages aren't all that helpful...).

Anyway, when I started using the DMA API I was running into a massive amount of IOMMU faults starting at early boot. It took me a while to realize that this was because now the IOMMU was enabled before the driver had a chance to set up the IOMMU domain. I think the only way that we were getting around that was because we used to have a custom IOMMU driver on older Tegra device and don't expose DMA API compatible IOMMU domains. With newer Tegras using the ARM SMMU we don't really have that option anymore.

So the root cause of this is that the bootloader initialized the display controller to scan out from a physical address (the bootloader does not set up the SMMU) and when the kernel attaches the display controller to the SMMU during early boot, the display controller ends up trying to fetch those physical addresses through the SMMU where no mapping for those addresses exists, hence causing these faults.

The solution that I came up with is to use the reserved-memory bindings along with memory-region references in the display controller nodes. I have a patch for the Tegra SMMU driver that implements support for parsing this data (the IOMMU framework has infrastructure to do this, so I take it that this has come up before) and setting up 1:1 mappings right before the SMMU is enabled for a device. This works rather well in my testing. I've been using hard-coded values because the bootloader does not properly put the reserved memory regions into the DT. I've been trying to add that as a side-project, but it turned into a bit of a can of worms.

These are all standard bindings, so I think we could implement something similar in the ARM SMMU driver. In fact, I was going to do that once I had sorted this all out for Tegra SMMU, but I'd be happy if anyone can beat me to it.

I've attached the patch for Tegra SMMU here. I think pretty much the same thing could be implement for any other drivers since this is based on standard bindings. Perhaps there could even be helpers. Actually it looks like one such helpers already exists:

iommu_dma_get_resv_regions()

I think the generic code looking up the standard memory-region property could be added to that to expose this functionality more broadly.

One thing to note is that I have this workaround in the Tegra SMMU driver to bind the IOMMU domain to a specific instance during this early direct mappings business. But I think that may no longer be necessary since there seems to have been some work in this area lately. Specifically I'm looking at 7423e01741dd6a5f1255f589145313f0fb1c8cbe, which may help. I can investigate, but let me post the patch first to keep the discussion going.

Here's a short extract of how I'm using this in device tree:

--- >8 ---

arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts +18 -0
index 5a57396b5948..82c4e0c88740 100644
@@ -8,6 +8,16 @@
        model = "NVIDIA Jetson TX1 Developer Kit";
        compatible = "nvidia,p2371-2180", "nvidia,tegra210";
 
+       reserved-memory {
+               #address-cells = <2>;
+               #size-cells = <2>;
+               ranges;
+
+               framebuffer: framebuffer@92c9f000 {
+                       reg = <0 0x92c9f000 0 0x00800000>;
+               };
+       };
+
        pcie@1003000 {
                status = "okay";
 
@@ -35,6 +45,14 @@
        };
 
        host1x@50000000 {
+               dc@54200000 {
+                       memory-region = <&framebuffer>;
+               };
+
+               dc@54240000 {
+                       memory-region = <&framebuffer>;
+               };
+
                dsi@54300000 {
                        status = "okay";
 

--- >8 ---

Note that these entries should all be generated at runtime by the bootloader once it has allocated the framebuffer. That's the can of worms I've been talking about.

Attached is the SMMU driver patch.

Hope that helps,
Thierry

From 1c7c4fcc5364e48fc5390ac17dd7e4ca347a6eb4 Mon Sep 17 00:00:00 2001
From: Thierry Reding <[email protected]>
Date: Fri, 15 Feb 2019 15:16:44 +0100
Subject: [PATCH] iommu/tegra-smmu: Add support for reserved regions

The Tegra DRM driver currently uses the IOMMU API explicitly. This means that it has fine-grained control over when exactly the translation through the IOMMU is enabled. This currently happens after the driver probes, so the driver is in a DMA quiesced state when the IOMMU translation is enabled.

During the transition of the Tegra DRM driver to use the DMA API instead of the IOMMU API explicitly, it was observed that on certain platforms the display controllers were still actively fetching from memory. When a DMA IOMMU domain is created as part of the DMA/IOMMU API setup during boot, the IOMMU translation for the display controllers can be enabled a significant amount of time before the driver has had a chance to reset the hardware into a sane state. This causes the SMMU to detect faults on the addresses that the display controller is trying to fetch.

To avoid this, and as a byproduct paving the way for seamless transition of display from the bootloader to the kernel, add support for reserved regions in the Tegra SMMU driver. This is implemented using the standard reserved memory device tree bindings, which let us describe regions of memory which the kernel is forbidden from using for regular allocations. The Tegra SMMU driver will parse the nodes associated with each device via the "memory-region" property and return reserved regions that the IOMMU core will then create direct mappings for prior to attaching the IOMMU domains to the devices. This ensures that a 1:1 mapping is in place when IOMMU translation starts and prevents the SMMU from detecting any faults.

---
 drivers/iommu/tegra-smmu.c | 115 +++++++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
drivers/iommu/tegra-smmu.c +115 -0

145 lines not on this page · raw message

Signature · 1 line
2.21.0

_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#19 lore raw
In reply to Rob Clark
Quoted 61 lines · Rob Clark
Quoted 17 lines · Robin Murphy
Quoted 15 lines · Rob Clark
Quoted 14 lines · Tomasz Figa
Quoted 11 lines · Rob Clark

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

Quoted 8 lines
Quoted 3 lines
Quoted 3 lines

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Right, it's not about "being clever", it's about not adding opt-in code to the hundreds and hundreds and hundreds of drivers which *might* ever find themselves used on a system where they would need the IOMMU's help for DMA.

Well, I mean, at one point we didn't do the automatic iommu hookup, we could have just stuck with that and added a helper so drivers could request the hookup. Things wouldn't have been any more broken than before, and when people bring up systems where iommu is required, they could have added the necessary dma_iommu_configure() call. But that is water under the bridge now.

Quoted 9 lines
Quoted 8 lines
Quoted 1 line

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Quoted 5 lines

Wouldn't help much. That particular issue is nothing to do with DMA ops really, it's about IOMMU initialisation. On something like SMMUv3 there is literally no way to turn the thing on without blocking unknown traffic - it *has* to have stream table entries programmed before it can even allow stuff to bypass.

fwiw, on these sdm850 laptops (and I think sdm845 boards like mtp and db845c) the SMMU (v2) is taken out of bypass by the bootloader. Bjorn has some patches for arm-smmu to read-back the state at boot.

(Although older devices were booting with display enabled but SMMU in bypass.)

Quoted 5 lines

The answer is either to either pay attention to the "Quiesce all DMA capable devices" part of the boot protocol (which has been there since pretty much forever), or to come up with some robust way of communicating "live" boot-time mappings to IOMMU drivers so that they can program themselves appropriately during probe.

Quoted 7 lines

Unfortunately display lit up by bootloader is basically ubiquitous. Every single android phone does it. All of the windows-arm laptops do it. Basically 99.9% of things that have a display do it. It's a tough problem to solve involving clks, gdsc, regulators, etc, in addition to the display driver.. and sadly now smmu. And devices where we can make changes to and update the firmware are rather rare. So there is really no option to ignore this problem.

I think this is going to require at least some degree of cooperation from the bootloader. See my other thread on that. Unfortunately I think this is an area where everyone has kind of been doing their own thing even if standard bindings for this have been around for quite a while (actually 5 years by now). I suspect that most bootloaders that run today are not that old, but as always downstream doesn't follow closely where upstream is guiding.

Quoted 5 lines

I guess if we had some early-quirks mechanism like x86 does, we could mash the display off early in boot. That would be an easy solution. Although I'd prefer a proper solution so that android phones aren't carrying around enormous stacks of hack patches to achieve a smooth flicker-free boot.

The proper solution, I think, is for bootloader and kernel to work together. Unfortunately that means we'll just have to bite the bullet and get things fixed across the stack. I think this is just the latest manifestation of the catch-up that upstream has been playing. Only now that we're starting to enable all of these features upstream are we running into interoperability issues.

If upstream had been further along we would've caught these issues way ahead of time and could've influenced the designs of bootloader much earlier. Now, unless we get all the vendors to go back and modify 5 year old code that's going to be difficult.

However, I think Robin has a point here: it's clearly documented in the boot protocol, so technically bootloaders are buggy and we can't always go and fix things so that buggy bootloaders continue to work. There's not a whole lot of incentive for anyone to fix the bootloaders if we keep doing that, ey?

Quoted 4 lines

I suppose arm-smmu could realize that the context bank is already taken out of bypass.. although I'm not entirely sure if we can assume that the CPU would be able to read back the pagetable setup by the bootloader. Maybe Vivek has an idea about that?

I've been thinking, though, and I'm not sure I see this issue on newer Tegras that use the ARM SMMU. I suppose this could be because the bootloader doesn't enable the SMMU, but then again, I should be getting these faults even so. Interestingly I don't see those on 64-bit ARM, so perhaps there's something special about that.

Let me reload a bit of context here so I can give you more than just speculation.

Thierry

author
#20 lore raw
Quoted 97 lines · Thierry Reding
Quoted 61 lines · Rob Clark
Quoted 17 lines · Robin Murphy
Quoted 15 lines · Rob Clark
Quoted 14 lines · Tomasz Figa
Quoted 11 lines · Rob Clark

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

Quoted 8 lines
Quoted 3 lines
Quoted 3 lines

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Right, it's not about "being clever", it's about not adding opt-in code to the hundreds and hundreds and hundreds of drivers which *might* ever find themselves used on a system where they would need the IOMMU's help for DMA.

Well, I mean, at one point we didn't do the automatic iommu hookup, we could have just stuck with that and added a helper so drivers could request the hookup. Things wouldn't have been any more broken than before, and when people bring up systems where iommu is required, they could have added the necessary dma_iommu_configure() call. But that is water under the bridge now.

Quoted 9 lines
Quoted 8 lines
Quoted 1 line

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Quoted 5 lines

Wouldn't help much. That particular issue is nothing to do with DMA ops really, it's about IOMMU initialisation. On something like SMMUv3 there is literally no way to turn the thing on without blocking unknown traffic - it *has* to have stream table entries programmed before it can even allow stuff to bypass.

fwiw, on these sdm850 laptops (and I think sdm845 boards like mtp and db845c) the SMMU (v2) is taken out of bypass by the bootloader. Bjorn has some patches for arm-smmu to read-back the state at boot.

(Although older devices were booting with display enabled but SMMU in bypass.)

Quoted 5 lines

The answer is either to either pay attention to the "Quiesce all DMA capable devices" part of the boot protocol (which has been there since pretty much forever), or to come up with some robust way of communicating "live" boot-time mappings to IOMMU drivers so that they can program themselves appropriately during probe.

Quoted 7 lines

Unfortunately display lit up by bootloader is basically ubiquitous. Every single android phone does it. All of the windows-arm laptops do it. Basically 99.9% of things that have a display do it. It's a tough problem to solve involving clks, gdsc, regulators, etc, in addition to the display driver.. and sadly now smmu. And devices where we can make changes to and update the firmware are rather rare. So there is really no option to ignore this problem.

I think this is going to require at least some degree of cooperation from the bootloader. See my other thread on that. Unfortunately I think this is an area where everyone has kind of been doing their own thing even if standard bindings for this have been around for quite a while (actually 5 years by now). I suspect that most bootloaders that run today are not that old, but as always downstream doesn't follow closely where upstream is guiding.

Quoted 5 lines

I guess if we had some early-quirks mechanism like x86 does, we could mash the display off early in boot. That would be an easy solution. Although I'd prefer a proper solution so that android phones aren't carrying around enormous stacks of hack patches to achieve a smooth flicker-free boot.

The proper solution, I think, is for bootloader and kernel to work together. Unfortunately that means we'll just have to bite the bullet and get things fixed across the stack. I think this is just the latest manifestation of the catch-up that upstream has been playing. Only now that we're starting to enable all of these features upstream are we running into interoperability issues.

If upstream had been further along we would've caught these issues way ahead of time and could've influenced the designs of bootloader much earlier. Now, unless we get all the vendors to go back and modify 5 year old code that's going to be difficult.

Quoted 6 lines

However, I think Robin has a point here: it's clearly documented in the boot protocol, so technically bootloaders are buggy and we can't always go and fix things so that buggy bootloaders continue to work. There's not a whole lot of incentive for anyone to fix the bootloaders if we keep doing that, ey?

A couple notes:

1) The odds of getting new bootloaders for 5yr old phones is basically none.. and they are typically signed so we couldn't just write our own even if we wanted to.

2) The windows arm laptops shipping actually have "real" UEFI+ACPI.. for now we've been using device-tree to get linux booting on them. But I think we are going to need to shift to ACPI eventually.. so a dt specific solution isn't super helpful.

But we do have EFI GOP to get the address of the boot framebuffer, and I believe there is a reserved memory region setup for it. Not sure how to connect that to the iommu subsys.

3) The automatic attach of DMA domain is also causing a different problem for us on the GPU side, preventing us from supporting per- context pagetables (since we end up with a disagreement about which context bank is used between arm-smmu and the firmware).

I'm kinda glad that x86 folks were more pragmatic about getting linux to work on actual hardware, not just restricting things to hw that looked the way they wanted it too.. at some point in arch/arm64 we are going to have to decide that reality is a thing. Ignoring that is only going to force users and distros to downstream kernels.

BR,
-R
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno

#21 lore raw
Quoted 111 lines · Rob Clark
Quoted 97 lines · Thierry Reding
Quoted 61 lines · Rob Clark
Quoted 17 lines · Robin Murphy
Quoted 15 lines · Rob Clark
Quoted 14 lines · Tomasz Figa
Quoted 11 lines · Rob Clark

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

Quoted 8 lines
Quoted 3 lines
Quoted 3 lines

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Right, it's not about "being clever", it's about not adding opt-in code to the hundreds and hundreds and hundreds of drivers which *might* ever find themselves used on a system where they would need the IOMMU's help for DMA.

Well, I mean, at one point we didn't do the automatic iommu hookup, we could have just stuck with that and added a helper so drivers could request the hookup. Things wouldn't have been any more broken than before, and when people bring up systems where iommu is required, they could have added the necessary dma_iommu_configure() call. But that is water under the bridge now.

Quoted 9 lines
Quoted 8 lines
Quoted 1 line

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()? I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Quoted 5 lines

Wouldn't help much. That particular issue is nothing to do with DMA ops really, it's about IOMMU initialisation. On something like SMMUv3 there is literally no way to turn the thing on without blocking unknown traffic - it *has* to have stream table entries programmed before it can even allow stuff to bypass.

fwiw, on these sdm850 laptops (and I think sdm845 boards like mtp and db845c) the SMMU (v2) is taken out of bypass by the bootloader. Bjorn has some patches for arm-smmu to read-back the state at boot.

(Although older devices were booting with display enabled but SMMU in bypass.)

Quoted 5 lines

The answer is either to either pay attention to the "Quiesce all DMA capable devices" part of the boot protocol (which has been there since pretty much forever), or to come up with some robust way of communicating "live" boot-time mappings to IOMMU drivers so that they can program themselves appropriately during probe.

Quoted 7 lines

Unfortunately display lit up by bootloader is basically ubiquitous. Every single android phone does it. All of the windows-arm laptops do it. Basically 99.9% of things that have a display do it. It's a tough problem to solve involving clks, gdsc, regulators, etc, in addition to the display driver.. and sadly now smmu. And devices where we can make changes to and update the firmware are rather rare. So there is really no option to ignore this problem.

I think this is going to require at least some degree of cooperation from the bootloader. See my other thread on that. Unfortunately I think this is an area where everyone has kind of been doing their own thing even if standard bindings for this have been around for quite a while (actually 5 years by now). I suspect that most bootloaders that run today are not that old, but as always downstream doesn't follow closely where upstream is guiding.

Quoted 5 lines

I guess if we had some early-quirks mechanism like x86 does, we could mash the display off early in boot. That would be an easy solution. Although I'd prefer a proper solution so that android phones aren't carrying around enormous stacks of hack patches to achieve a smooth flicker-free boot.

The proper solution, I think, is for bootloader and kernel to work together. Unfortunately that means we'll just have to bite the bullet and get things fixed across the stack. I think this is just the latest manifestation of the catch-up that upstream has been playing. Only now that we're starting to enable all of these features upstream are we running into interoperability issues.

If upstream had been further along we would've caught these issues way ahead of time and could've influenced the designs of bootloader much earlier. Now, unless we get all the vendors to go back and modify 5 year old code that's going to be difficult.

Quoted 6 lines

However, I think Robin has a point here: it's clearly documented in the boot protocol, so technically bootloaders are buggy and we can't always go and fix things so that buggy bootloaders continue to work. There's not a whole lot of incentive for anyone to fix the bootloaders if we keep doing that, ey?

A couple notes:

1) The odds of getting new bootloaders for 5yr old phones is basically none.. and they are typically signed so we couldn't just write our own even if we wanted to.

Quoted 8 lines

2) The windows arm laptops shipping actually have "real" UEFI+ACPI.. for now we've been using device-tree to get linux booting on them. But I think we are going to need to shift to ACPI eventually.. so a dt specific solution isn't super helpful.

But we do have EFI GOP to get the address of the boot framebuffer, and I believe there is a reserved memory region setup for it. Not sure how to connect that to the iommu subsys.

It shouldn't be a problem to hook something else up to the IOMMU subsystem. Hopefully it's something that people are going to standardize on.

Quoted 4 lines

3) The automatic attach of DMA domain is also causing a different problem for us on the GPU side, preventing us from supporting per- context pagetables (since we end up with a disagreement about which context bank is used between arm-smmu and the firmware).

I'm not sure I understand this issue. Is the context bank hard-coded in the firmware somehow? Or is it possible to rewrite which one is going to be used at runtime? Do you switch out the actual page tables rather than the IOMMU domains for context switching?

Quoted 5 lines

I'm kinda glad that x86 folks were more pragmatic about getting linux to work on actual hardware, not just restricting things to hw that looked the way they wanted it too.. at some point in arch/arm64 we are going to have to decide that reality is a thing. Ignoring that is only going to force users and distros to downstream kernels.

You're comparing apples to oranges here. On x86 at least there was some standardization when Linux started, whereas we still don't really have that on ARM after so many years of efforts to standardize. I think we are slowly getting there, but this particular instance shows that we're not there yet.

Don't get me wrong, I'm not trying to say that we should just ignore everything that's out there just because it may not be the way we want it to be. On the other hand if we just take everything as-is and try to implement workarounds and quirks every step of the way that's going to also take away a lot of the resources that are already pretty scarce as it is. I think it needs to be a reasonable compromise.

Also, there doesn't really seem to be a standardizing force in the Linux on ARM world, so who's going to do that if not the Linux community?

Thierry

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

#22 lore raw
Quoted 9 lines

It shouldn't be a problem to hook something else up to the IOMMU subsystem. Hopefully it's something that people are going to standardize on.

Quoted 4 lines

3) The automatic attach of DMA domain is also causing a different problem for us on the GPU side, preventing us from supporting per- context pagetables (since we end up with a disagreement about which context bank is used between arm-smmu and the firmware).

Quoted 4 lines

I'm not sure I understand this issue. Is the context bank hard-coded in the firmware somehow? Or is it possible to rewrite which one is going to be used at runtime? Do you switch out the actual page tables rather than the IOMMU domains for context switching?

We have a rather long history on this but the tl;dr is that the GPU microcode switches the pagetables by rewriting TTBR0 on the fly (since this is arm-smmu-v2 we have no better option) and yes, unfortunately it is hard coded to use context bank 0. [1] is the current patchset to support all this, including my own take on avoiding the dma-domain (all the cool kids have one).

Jordan

[1] https://patchwork.freedesktop.org/series/57441/

Signature · 6 lines
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum,
a Linux Foundation Collaborative Project
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno
#24 lore raw
In reply to Rob Clark
Quoted 140 lines · Rob Clark
Quoted 138 lines · Tomasz Figa
Quoted 135 lines · Rob Clark
Quoted 119 lines · Rob Clark
Quoted 104 lines · Rob Herring
Quoted 102 lines · Rob Clark

This solves a problem we see with drm/msm, caused by getting iommu_dma_ops while we attach our own domain and manage it directly at the iommu API level:

[0000000000000038] user address but active_mm is swapper

  Internal error: Oops: 96000005 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
  Hardware name: xxx (DT)
  Workqueue: events deferred_probe_work_func
  pstate: 80c00009 (Nzcv daif +PAN +UAO)
  pc : iommu_dma_map_sg+0x7c/0x2c8
  lr : iommu_dma_map_sg+0x40/0x2c8
  sp : ffffff80095eb4f0
  x29: ffffff80095eb4f0 x28: 0000000000000000
  x27: ffffffc0f9431578 x26: 0000000000000000
  x25: 00000000ffffffff x24: 0000000000000003
  x23: 0000000000000001 x22: ffffffc0fa9ac010
  x21: 0000000000000000 x20: ffffffc0fab40980
  x19: ffffffc0fab40980 x18: 0000000000000003
  x17: 00000000000001c4 x16: 0000000000000007
  x15: 000000000000000e x14: ffffffffffffffff
  x13: ffff000000000000 x12: 0000000000000028
  x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
  x9 : 0000000000000000 x8 : ffffffc0fab409a0
  x7 : 0000000000000000 x6 : 0000000000000002
  x5 : 0000000100000000 x4 : 0000000000000000
  x3 : 0000000000000001 x2 : 0000000000000002
  x1 : ffffffc0f9431578 x0 : 0000000000000000
  Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
  Call trace:
   iommu_dma_map_sg+0x7c/0x2c8
   __iommu_map_sg_attrs+0x70/0x84
   get_pages+0x170/0x1e8
   msm_gem_get_iova+0x8c/0x128
   _msm_gem_kernel_new+0x6c/0xc8
   msm_gem_kernel_new+0x4c/0x58
   dsi_tx_buf_alloc_6g+0x4c/0x8c
   msm_dsi_host_modeset_init+0xc8/0x108
   msm_dsi_modeset_init+0x54/0x18c
   _dpu_kms_drm_obj_init+0x430/0x474
   dpu_kms_hw_init+0x5f8/0x6b4
   msm_drm_bind+0x360/0x6c8
   try_to_bring_up_master.part.7+0x28/0x70
   component_master_add_with_match+0xe8/0x124
   msm_pdev_probe+0x294/0x2b4
   platform_drv_probe+0x58/0xa4
   really_probe+0x150/0x294
   driver_probe_device+0xac/0xe8
   __device_attach_driver+0xa4/0xb4
   bus_for_each_drv+0x98/0xc8
   __device_attach+0xac/0x12c
   device_initial_probe+0x24/0x30
   bus_probe_device+0x38/0x98
   deferred_probe_work_func+0x78/0xa4
   process_one_work+0x24c/0x3dc
   worker_thread+0x280/0x360
   kthread+0x134/0x13c
   ret_from_fork+0x10/0x18
  Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
  ---[ end trace f22dda57f3648e2c ]---
  Kernel panic - not syncing: Fatal exception
  SMP: stopping secondary CPUs
  Kernel Offset: disabled
  CPU features: 0x0,22802a18
  Memory Limit: none

The problem is that when drm/msm does it's own iommu_attach_device(), now the domain returned by iommu_get_domain_for_dev() is drm/msm's domain, and it doesn't have domain->iova_cookie.

We kind of avoided this problem prior to sdm845/dpu because the iommu was attached to the mdp node in dt, which is a child of the toplevel mdss node (which corresponds to the dev passed in dma_map_sg()). But with sdm845, now the iommu is attached at the mdss level so we hit the iommu_dma_ops in dma_map_sg().

But auto allocating/attaching a domain before the driver is probed was already a blocking problem for enabling per-context pagetables for the GPU. This problem is also now solved with this patch.

Fixes 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure

---
This is an alternative/replacement for [1]. What it lacks in elegance it makes up for in practicality ;-)

[1] https://patchwork.freedesktop.org/patch/264930/

 drivers/of/device.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
drivers/of/device.c +0 -0
index 5957cd4fa262..15ffee00fb22 100644
@@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
        return device_add(&ofdev->dev);
 }
 
Quoted 12 lines

drivers/of/device.c int of_device_add(struct platform_device *ofdev) · line 81

Quoted 7 lines
drivers/of/device.c +7 -0
+static const struct of_device_id iommu_blacklist[] = {
+       { .compatible = "qcom,mdp4" },
+       { .compatible = "qcom,mdss" },
+       { .compatible = "qcom,sdm845-mdss" },
+       { .compatible = "qcom,adreno" },
+       {}
+};

Not completely clear to whether this is still needed or not, but this really won't scale. Why can't the driver for these devices override whatever has been setup by default?

Quoted 3 lines

fwiw, at the moment it is not needed, but it will become needed again to implement per-context pagetables (although I suppose for this we only need to blacklist qcom,adreno and not also the display nodes).

So, another case I've come across, on the display side.. I'm working on handling the case where bootloader enables display (and takes iommu out of reset).. as soon as DMA domain gets attached we get iommu faults, because bootloader has already configured display for scanout. Unfortunately this all happens before actual driver is probed and has a chance to intervene.

It's rather unfortunate that we tried to be clever rather than just making drivers call some function to opt-in to the hookup of dma iommu ops :-(

Quoted 7 lines
Quoted 5 lines

I think it still works for the 90% of cases and if 10% needs some explicit work in the drivers, that's better than requiring 100% of the drivers to do things manually.

Adding Marek who had the same problem on Exynos.

I do wonder how many drivers need to iommu_map in their ->probe()?

Any driver that allocates some internal buffers using DMA API.

Also all V4L2 drivers would need it, because as soon as they call register_video_device() the userspace can open the video node and do buffer allocations, which in turn requires the DMA API to be all set.

Quoted 5 lines

I'm thinking moving the auto-hookup to after a successful probe(), with some function a driver could call if they need mapping in probe, might be a way to eventually get rid of the blacklist. But I've no idea how to find the subset of drivers that would be broken without a dma_setup_iommu_stuff() call in their probe.

Most of the drivers that call dma_alloc_() or dma_map_() from probe (or could have it called asynchronously before the probe returns).

But first of all, I remember Marek already submitted some patches long ago that extended struct driver with some flag that means that the driver doesn't want the IOMMU to be attached before probe. Why wouldn't that work? Sounds like a perfect opt-out solution.

Quoted 28 lines

BR,
-R

Quoted 24 lines

Best regards,
Tomasz

Quoted 21 lines

BR,
-R

Quoted 17 lines

The reason is that in the current state the core code creates the first domain before the driver has a chance to intervene and tell it not to. And this results that driver ends up using a different context bank on the iommu than what the firmware expects.

I guess the alternative is to put some property in DT.. but that doesn't really feel right. I guess there aren't really many (or any?) other drivers that have this specific problem, so I don't really expect it to be a scaling problem.

Yeah, it's a bit ugly, but I'll take a small ugly working hack, over elegant but non-working any day ;-)... but if someone has a better idea then I'm all ears.

BR,
-R

author
#25 lore raw
Quoted 5 lines · Tomasz Figa

But first of all, I remember Marek already submitted some patches long ago that extended struct driver with some flag that means that the driver doesn't want the IOMMU to be attached before probe. Why wouldn't that work? Sounds like a perfect opt-out solution.

Actually, yeah.. we should do that. That is the simplest solution.

BR,
-R

#26 lore raw

Hi Rob,

Quoted 6 lines · Rob Clark
Quoted 4 lines · Tomasz Figa

But first of all, I remember Marek already submitted some patches long ago that extended struct driver with some flag that means that the driver doesn't want the IOMMU to be attached before probe. Why wouldn't that work? Sounds like a perfect opt-out solution.

Actually, yeah.. we should do that. That is the simplest solution.

Tomasz has very good memory. It took me a while to find that old patches:

https://patchwork.kernel.org/patch/4677251/
https://patchwork.kernel.org/patch/4677941/
https://patchwork.kernel.org/patch/4677401/

It looks that my idea was a bit ahead of its time ;)

Best regards

Signature · 7 lines
Marek Szyprowski, PhD
Samsung R&D Institute Poland

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel
author
#27 lore raw
Quoted 11 lines · Marek Szyprowski

Hi Rob,

Quoted 6 lines · Rob Clark
Quoted 4 lines · Tomasz Figa

But first of all, I remember Marek already submitted some patches long ago that extended struct driver with some flag that means that the driver doesn't want the IOMMU to be attached before probe. Why wouldn't that work? Sounds like a perfect opt-out solution.

Actually, yeah.. we should do that. That is the simplest solution.

Quoted 8 lines

Tomasz has very good memory. It took me a while to find that old patches:

https://patchwork.kernel.org/patch/4677251/
https://patchwork.kernel.org/patch/4677941/
https://patchwork.kernel.org/patch/4677401/

It looks that my idea was a bit ahead of its time ;)

if I re-spin this, was their a reason not to just use bitfields, ie:

-    bool suppress_bind_attrs;    /* disables bind/unbind via sysfs */
+    bool suppress_bind_attrs : 1;    /* disables bind/unbind via sysfs */
+    bool has_own_iommu_manager : 1;  /* driver explictly manages IOMMU */

That seems like it would have been a bit less churn and a bit nicer looking (IMO at least)

BR,
-R
_______________________________________________
Freedreno mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/freedreno