linux-kernel - Re: [PATCH] iommu/rockchip: disable fetch dte time limit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <075100c0-b4af-4077-bd3c-dd9407524671@rock-chips.com>
Date: Thu, 27 Nov 2025 12:32:44 +0800
From: Shawn Lin <shawn.lin@...k-chips.com>
To: Sven Püschel <s.pueschel@...gutronix.de>,
 Joerg Roedel <joro@...tes.org>, Will Deacon <will@...nel.org>,
 Robin Murphy <robin.murphy@....com>, Heiko Stuebner <heiko@...ech.de>
Cc: shawn.lin@...k-chips.com, iommu@...ts.linux.dev,
 linux-arm-kernel@...ts.infradead.org, linux-rockchip@...ts.infradead.org,
 linux-kernel@...r.kernel.org, Simon Xue <xxm@...k-chips.com>,
 kernel@...gutronix.de
Subject: Re: [PATCH] iommu/rockchip: disable fetch dte time limit

在 2025/11/26 星期三 19:45, Sven Püschel 写道:
> From: Simon Xue <xxm@...k-chips.com>
> 
> Disable the Bit 31 of the AUTO_GATING iommu register, as it causes
> hangups with the RGA3 (Raster Graphics Acceleration 3) peripheral.
> The RGA3 register description of the TRM already states that the bit
> must be set to 1. The vendor kernel sets the bit unconditionally to
> 1 to fix VOP (Video Output Processor) screen black issues. This patch
> squashes the 2 vendor kernel commits with the following commit messages:
> 
> Master fetch data and cpu update page table may work in parallel, may
> have the following procedure:
> 
> 	master                  cpu
> 	fetch dte               update page tabl
> 	        |                       |
> 	(make dte invalid)  <-  zap iotlb entry
> 	        |                       |
> 	fetch dte again
> 	(make dte invalid)  <-  zap iotlb entry
> 	        |                       |
> 	fetch dte again
> 	(make dte invalid)  <-  zap iotlb entry
> 	        |                       |
> 	fetch dte again
> 	(make iommu block)  <-  zap iotlb entry
> 
> New iommu version has the above bug, if fetch dte consecutively four
> times, then it will be blocked. Fortunately, we can set bit 31 of
> register MMU_AUTO_GATING to 1 to make it work as old version which does
> not have this issue.
> 
> This issue only appears on RV1126 so far, so make a workaround dedicated
> to "rockchip,rv1126" machine type.
> 
> iommu/rockchip: fix vop blocked and screen black on RK356X and RK3588
> 
> RK3568 and RK3588 has the same issue as RV1126/RV1109 that caused by
> dte fetch time limit, So we can set BIT(31) of register 0x24 default
> to 1 as a workaround.
> 
> Signed-off-by: Simon Xue <xxm@...k-chips.com>
> Signed-off-by: Sven Püschel <s.pueschel@...gutronix.de>
> ---
> During testing of a newly developed driver for the RGA3 peripheral [1]
> (Raster Graphic Acceleration 3) of the RK3588 some sporadic hangs
> have been observed. The upstream rockchip-iommu driver is used to handle
> the RGA3 IOMMU register space.
> 
> After a closer look at the TRM for the RK3588, the RGA3 iommu register
> description of the RGA3_MMU_AUTO_GATING register (offset 0x24) mentions

It's 0xF24 per RGA3 chapter.

> a mmu_bug_fixed_disable bit, which must be set to 1 but defaults to 0.
> 
> Looking at the commits in the vendor kernel, the bit is unconditionally
> set to 1 and mentions that it fixes a blocked VOP (Video Output
> Processor) [3]. Therefore squash the relevant vendor commits
> [2] and [3] into a single patch, combine the commit messages and keep
> the Signed-off-by line from the original author.
> 
> [1] https://lore.kernel.org/all/20251007-spu-rga3-v1-0-36ad85570402@pengutronix.de/
> [2] https://github.com/rockchip-linux/kernel/commit/7f8158fb41b5cc8e738aaeebc3637c50ebd74cae
> [3] https://github.com/rockchip-linux/kernel/commit/6a355e5f9a2069a2309e240791bc3aad63b7324e
> ---
>   drivers/iommu/rockchip-iommu.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
> index 0861dd469bd86..2d0dabb0d101a 100644
> --- a/drivers/iommu/rockchip-iommu.c
> +++ b/drivers/iommu/rockchip-iommu.c
> @@ -76,6 +76,8 @@
>   #define SPAGE_ORDER 12
>   #define SPAGE_SIZE (1 << SPAGE_ORDER)
>   
> +#define DISABLE_FETCH_DTE_TIME_LIMIT BIT(31)
> +
>    /*
>     * Support mapping any size that fits in one page table:
>     *   4 KiB to 4 MiB
> @@ -930,6 +932,7 @@ static int rk_iommu_enable(struct rk_iommu *iommu)
>   	struct iommu_domain *domain = iommu->domain;
>   	struct rk_iommu_domain *rk_domain = to_rk_domain(domain);
>   	int ret, i;
> +	u32 auto_gate;
>   
>   	ret = clk_bulk_enable(iommu->num_clocks, iommu->clocks);
>   	if (ret)
> @@ -948,6 +951,11 @@ static int rk_iommu_enable(struct rk_iommu *iommu)
>   			       rk_ops->mk_dtentries(rk_domain->dt_dma));
>   		rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
>   		rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK);
> +
> +		/* Workaround for iommu blocked, BIT(31) default to 1 */
> +		auto_gate = rk_iommu_read(iommu->bases[i], RK_MMU_AUTO_GATING);
> +		auto_gate |= DISABLE_FETCH_DTE_TIME_LIMIT;
> +		rk_iommu_write(iommu->bases[i], RK_MMU_AUTO_GATING, auto_gate);
>   	}
>   
>   	ret = rk_iommu_enable_paging(iommu);
> 
> ---
> base-commit: 30f09200cc4aefbd8385b01e41bde2e4565a6f0e
> change-id: 20251126-spu-iommudtefix-cd0c5244c74a
> 
> Best regards,