Message-ID: <20190603133918.GD30132@ulmo>
Date:   Mon, 3 Jun 2019 15:39:18 +0200
From:   Thierry Reding <thierry.reding@...il.com>
To:     Robin Murphy <robin.murphy@....com>
Cc:     Rob Clark <robdclark@...il.com>, Tomasz Figa <tfiga@...omium.org>,
        devicetree@...r.kernel.org, Frank Rowand <frowand.list@...il.com>,
        David Airlie <airlied@...ux.ie>,
        linux-arm-msm <linux-arm-msm@...r.kernel.org>,
        Will Deacon <will.deacon@....com>,
        Doug Anderson <dianders@...omium.org>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Linux IOMMU <iommu@...ts.linux-foundation.org>,
        Rob Herring <robh+dt@...nel.org>,
        Sean Paul <seanpaul@...omium.org>,
        Vivek Gautam <vivek.gautam@...eaurora.org>,
        freedreno <freedreno@...ts.freedesktop.org>,
        Christoph Hellwig <hch@....de>,
        Marek Szyprowski <m.szyprowski@...sung.com>
Subject: Re: [PATCH] of/device: add blacklist for iommu dma_ops

On Mon, Jun 03, 2019 at 12:14:27PM +0100, Robin Murphy wrote:
> On 03/06/2019 11:47, Rob Clark wrote:
> > On Sun, Jun 2, 2019 at 11:25 PM Tomasz Figa <tfiga@...omium.org> wrote:
> > > 
> > > On Mon, Jun 3, 2019 at 4:40 AM Rob Clark <robdclark@...il.com> wrote:
> > > > 
> > > > On Fri, May 10, 2019 at 7:35 AM Rob Clark <robdclark@...il.com> wrote:
> > > > > 
> > > > > On Tue, Dec 4, 2018 at 2:29 PM Rob Herring <robh+dt@...nel.org> wrote:
> > > > > > 
> > > > > > On Sat, Dec 1, 2018 at 10:54 AM Rob Clark <robdclark@...il.com> wrote:
> > > > > > > 
> > > > > > > This solves a problem we see with drm/msm, caused by getting
> > > > > > > iommu_dma_ops while we attach our own domain and manage it directly at
> > > > > > > the iommu API level:
> > > > > > > 
> > > > > > >    [0000000000000038] user address but active_mm is swapper
> > > > > > >    Internal error: Oops: 96000005 [#1] PREEMPT SMP
> > > > > > >    Modules linked in:
> > > > > > >    CPU: 7 PID: 70 Comm: kworker/7:1 Tainted: G        W         4.19.3 #90
> > > > > > >    Hardware name: xxx (DT)
> > > > > > >    Workqueue: events deferred_probe_work_func
> > > > > > >    pstate: 80c00009 (Nzcv daif +PAN +UAO)
> > > > > > >    pc : iommu_dma_map_sg+0x7c/0x2c8
> > > > > > >    lr : iommu_dma_map_sg+0x40/0x2c8
> > > > > > >    sp : ffffff80095eb4f0
> > > > > > >    x29: ffffff80095eb4f0 x28: 0000000000000000
> > > > > > >    x27: ffffffc0f9431578 x26: 0000000000000000
> > > > > > >    x25: 00000000ffffffff x24: 0000000000000003
> > > > > > >    x23: 0000000000000001 x22: ffffffc0fa9ac010
> > > > > > >    x21: 0000000000000000 x20: ffffffc0fab40980
> > > > > > >    x19: ffffffc0fab40980 x18: 0000000000000003
> > > > > > >    x17: 00000000000001c4 x16: 0000000000000007
> > > > > > >    x15: 000000000000000e x14: ffffffffffffffff
> > > > > > >    x13: ffff000000000000 x12: 0000000000000028
> > > > > > >    x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f
> > > > > > >    x9 : 0000000000000000 x8 : ffffffc0fab409a0
> > > > > > >    x7 : 0000000000000000 x6 : 0000000000000002
> > > > > > >    x5 : 0000000100000000 x4 : 0000000000000000
> > > > > > >    x3 : 0000000000000001 x2 : 0000000000000002
> > > > > > >    x1 : ffffffc0f9431578 x0 : 0000000000000000
> > > > > > >    Process kworker/7:1 (pid: 70, stack limit = 0x0000000017d08ffb)
> > > > > > >    Call trace:
> > > > > > >     iommu_dma_map_sg+0x7c/0x2c8
> > > > > > >     __iommu_map_sg_attrs+0x70/0x84
> > > > > > >     get_pages+0x170/0x1e8
> > > > > > >     msm_gem_get_iova+0x8c/0x128
> > > > > > >     _msm_gem_kernel_new+0x6c/0xc8
> > > > > > >     msm_gem_kernel_new+0x4c/0x58
> > > > > > >     dsi_tx_buf_alloc_6g+0x4c/0x8c
> > > > > > >     msm_dsi_host_modeset_init+0xc8/0x108
> > > > > > >     msm_dsi_modeset_init+0x54/0x18c
> > > > > > >     _dpu_kms_drm_obj_init+0x430/0x474
> > > > > > >     dpu_kms_hw_init+0x5f8/0x6b4
> > > > > > >     msm_drm_bind+0x360/0x6c8
> > > > > > >     try_to_bring_up_master.part.7+0x28/0x70
> > > > > > >     component_master_add_with_match+0xe8/0x124
> > > > > > >     msm_pdev_probe+0x294/0x2b4
> > > > > > >     platform_drv_probe+0x58/0xa4
> > > > > > >     really_probe+0x150/0x294
> > > > > > >     driver_probe_device+0xac/0xe8
> > > > > > >     __device_attach_driver+0xa4/0xb4
> > > > > > >     bus_for_each_drv+0x98/0xc8
> > > > > > >     __device_attach+0xac/0x12c
> > > > > > >     device_initial_probe+0x24/0x30
> > > > > > >     bus_probe_device+0x38/0x98
> > > > > > >     deferred_probe_work_func+0x78/0xa4
> > > > > > >     process_one_work+0x24c/0x3dc
> > > > > > >     worker_thread+0x280/0x360
> > > > > > >     kthread+0x134/0x13c
> > > > > > >     ret_from_fork+0x10/0x18
> > > > > > >    Code: d2800004 91000725 6b17039f 5400048a (f9401f40)
> > > > > > >    ---[ end trace f22dda57f3648e2c ]---
> > > > > > >    Kernel panic - not syncing: Fatal exception
> > > > > > >    SMP: stopping secondary CPUs
> > > > > > >    Kernel Offset: disabled
> > > > > > >    CPU features: 0x0,22802a18
> > > > > > >    Memory Limit: none
> > > > > > > 
> > > > > > > The problem is that when drm/msm does it's own iommu_attach_device(),
> > > > > > > now the domain returned by iommu_get_domain_for_dev() is drm/msm's
> > > > > > > domain, and it doesn't have domain->iova_cookie.
> > > > > > > 
> > > > > > > We kind of avoided this problem prior to sdm845/dpu because the iommu
> > > > > > > was attached to the mdp node in dt, which is a child of the toplevel
> > > > > > > mdss node (which corresponds to the dev passed in dma_map_sg()).  But
> > > > > > > with sdm845, now the iommu is attached at the mdss level so we hit the
> > > > > > > iommu_dma_ops in dma_map_sg().
> > > > > > > 
> > > > > > > But auto allocating/attaching a domain before the driver is probed was
> > > > > > > already a blocking problem for enabling per-context pagetables for the
> > > > > > > GPU.  This problem is also now solved with this patch.
> > > > > > > 
> > > > > > > Fixes: 97890ba9289c dma-mapping: detect and configure IOMMU in of_dma_configure
> > > > > > > Tested-by: Douglas Anderson <dianders@...omium.org>
> > > > > > > Signed-off-by: Rob Clark <robdclark@...il.com>
> > > > > > > ---
> > > > > > > This is an alternative/replacement for [1].  What it lacks in elegance
> > > > > > > it makes up for in practicality ;-)
> > > > > > > 
> > > > > > > [1] https://patchwork.freedesktop.org/patch/264930/
> > > > > > > 
> > > > > > >   drivers/of/device.c | 22 ++++++++++++++++++++++
> > > > > > >   1 file changed, 22 insertions(+)
> > > > > > > 
> > > > > > > diff --git a/drivers/of/device.c b/drivers/of/device.c
> > > > > > > index 5957cd4fa262..15ffee00fb22 100644
> > > > > > > --- a/drivers/of/device.c
> > > > > > > +++ b/drivers/of/device.c
> > > > > > > @@ -72,6 +72,14 @@ int of_device_add(struct platform_device *ofdev)
> > > > > > >          return device_add(&ofdev->dev);
> > > > > > >   }
> > > > > > > 
> > > > > > > +static const struct of_device_id iommu_blacklist[] = {
> > > > > > > +       { .compatible = "qcom,mdp4" },
> > > > > > > +       { .compatible = "qcom,mdss" },
> > > > > > > +       { .compatible = "qcom,sdm845-mdss" },
> > > > > > > +       { .compatible = "qcom,adreno" },
> > > > > > > +       {}
> > > > > > > +};
> > > > > > 
> > > > > > Not completely clear to whether this is still needed or not, but this
> > > > > > really won't scale. Why can't the driver for these devices override
> > > > > > whatever has been setup by default?
> > > > > > 
> > > > > 
> > > > > fwiw, at the moment it is not needed, but it will become needed again
> > > > > to implement per-context pagetables (although I suppose for this we
> > > > > only need to blacklist qcom,adreno and not also the display nodes).
> > > > 
> > > > So, another case I've come across, on the display side.. I'm working
> > > > on handling the case where bootloader enables display (and takes iommu
> > > > out of reset).. as soon as DMA domain gets attached we get iommu
> > > > faults, because bootloader has already configured display for scanout.
> > > > Unfortunately this all happens before actual driver is probed and has
> > > > a chance to intervene.
> > > > 
> > > > It's rather unfortunate that we tried to be clever rather than just
> > > > making drivers call some function to opt-in to the hookup of dma iommu
> > > > ops :-(
> > > 
> > > I think it still works for the 90% of cases and if 10% needs some
> > > explicit work in the drivers, that's better than requiring 100% of the
> > > drivers to do things manually.
> 
> Right, it's not about "being clever", it's about not adding opt-in code to
> the hundreds and hundreds and hundreds of drivers which *might* ever find
> themselves used on a system where they would need the IOMMU's help for DMA.
> 
> > > Adding Marek who had the same problem on Exynos.
> > 
> > I do wonder how many drivers need to iommu_map in their ->probe()?
> > I'm thinking moving the auto-hookup to after a successful probe(),
> > with some function a driver could call if they need mapping in probe,
> > might be a way to eventually get rid of the blacklist.  But I've no
> > idea how to find the subset of drivers that would be broken without a
> > dma_setup_iommu_stuff() call in their probe.
> 
> Wouldn't help much. That particular issue is nothing to do with DMA ops
> really, it's about IOMMU initialisation. On something like SMMUv3 there is
> literally no way to turn the thing on without blocking unknown traffic - it
> *has* to have stream table entries programmed before it can even allow stuff
> to bypass.
> 
> The answer is either to either pay attention to the "Quiesce all DMA capable
> devices" part of the boot protocol (which has been there since pretty much
> forever), or to come up with some robust way of communicating "live"
> boot-time mappings to IOMMU drivers so that they can program themselves
> appropriately during probe.

I ran into a similar issue not too long ago and I've been working on
what I think is a correct fix for this problem. Unfortunately I went
down the rabbit hole of trying to get all of the pieces in the
bootloader merged before posting the kernel patches, and that's been
taking a long time. Let me chime in here in the hope that it will be
helpful to others.

The problem that I ran into was pretty much the same thing that Rob
encountered. We have some platforms that will initialize display over
HDMI in an early bootloader to show a splash screen. During boot we
would usually take over display hardware by just resetting it and then
programming it from scratch. Ultimately we want to do seamless handover
so that the kernel can take over the splash and replace it by the
console when that's ready. But I'm getting ahead of myself.

One of the things I've been trying to do is replace direct IOMMU API
usage in the Tegra DRM driver by using DMA API only, which we need in
order to fix some corner cases we ran into (I've now forgotten most of
the details and I realize that my commit messages aren't all that
helpful...).

Anyway, when I started using the DMA API I was running into a massive
amount of IOMMU faults starting at early boot. It took me a while to
realize that this was because now the IOMMU was enabled before the
driver had a chance to set up the IOMMU domain. I think the only way
that we were getting around that was because we used to have a custom
IOMMU driver on older Tegra device and don't expose DMA API compatible
IOMMU domains. With newer Tegras using the ARM SMMU we don't really have
that option anymore.

So the root cause of this is that the bootloader initialized the display
controller to scan out from a physical address (the bootloader does not
set up the SMMU) and when the kernel attaches the display controller to
the SMMU during early boot, the display controller ends up trying to
fetch those physical addresses through the SMMU where no mapping for
those addresses exists, hence causing these faults.

The solution that I came up with is to use the reserved-memory bindings
along with memory-region references in the display controller nodes. I
have a patch for the Tegra SMMU driver that implements support for
parsing this data (the IOMMU framework has infrastructure to do this, so
I take it that this has come up before) and setting up 1:1 mappings
right before the SMMU is enabled for a device. This works rather well in
my testing. I've been using hard-coded values because the bootloader
does not properly put the reserved memory regions into the DT. I've been
trying to add that as a side-project, but it turned into a bit of a can
of worms.

These are all standard bindings, so I think we could implement something
similar in the ARM SMMU driver. In fact, I was going to do that once I
had sorted this all out for Tegra SMMU, but I'd be happy if anyone can
beat me to it.

I've attached the patch for Tegra SMMU here. I think pretty much the
same thing could be implement for any other drivers since this is based
on standard bindings. Perhaps there could even be helpers. Actually it
looks like one such helpers already exists:

	iommu_dma_get_resv_regions()

I think the generic code looking up the standard memory-region property
could be added to that to expose this functionality more broadly.

One thing to note is that I have this workaround in the Tegra SMMU
driver to bind the IOMMU domain to a specific instance during this early
direct mappings business. But I think that may no longer be necessary
since there seems to have been some work in this area lately.
Specifically I'm looking at 7423e01741dd6a5f1255f589145313f0fb1c8cbe,
which may help. I can investigate, but let me post the patch first to
keep the discussion going.

Here's a short extract of how I'm using this in device tree:

--- >8 ---
diff --git a/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts b/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts
index 5a57396b5948..82c4e0c88740 100644
--- a/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts
+++ b/arch/arm64/boot/dts/nvidia/tegra210-p2371-2180.dts
@@ -8,6 +8,16 @@
        model = "NVIDIA Jetson TX1 Developer Kit";
        compatible = "nvidia,p2371-2180", "nvidia,tegra210";

+       reserved-memory {
+               #address-cells = <2>;
+               #size-cells = <2>;
+               ranges;
+
+               framebuffer: framebuffer@...9f000 {
+                       reg = <0 0x92c9f000 0 0x00800000>;
+               };
+       };
+
        pcie@...3000 {
                status = "okay";

@@ -35,6 +45,14 @@
        };

        host1x@...00000 {
+               dc@...00000 {
+                       memory-region = <&framebuffer>;
+               };
+
+               dc@...40000 {
+                       memory-region = <&framebuffer>;
+               };
+
                dsi@...00000 {
                        status = "okay";

--- >8 ---

Note that these entries should all be generated at runtime by the
bootloader once it has allocated the framebuffer. That's the can of
worms I've been talking about.

Attached is the SMMU driver patch.

Hope that helps,
Thierry

View attachment "0001-iommu-tegra-smmu-Add-support-for-reserved-regions.patch" of type "text/plain" (7230 bytes)

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists