linux-kernel - Re: [PATCH] iommu/rockchip: disable fetch dte time limit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <cea54dcb-6236-4363-8b46-e2213a190894@pengutronix.de>
Date: Fri, 28 Nov 2025 08:26:55 +0100
From: Sven Püschel <s.pueschel@...gutronix.de>
To: Shawn Lin <shawn.lin@...k-chips.com>, Joerg Roedel <joro@...tes.org>,
 Will Deacon <will@...nel.org>, Robin Murphy <robin.murphy@....com>,
 Heiko Stuebner <heiko@...ech.de>
Cc: iommu@...ts.linux.dev, linux-arm-kernel@...ts.infradead.org,
 linux-rockchip@...ts.infradead.org, linux-kernel@...r.kernel.org,
 Simon Xue <xxm@...k-chips.com>, kernel@...gutronix.de
Subject: Re: [PATCH] iommu/rockchip: disable fetch dte time limit


On 11/27/25 5:32 AM, Shawn Lin wrote:
> 在 2025/11/26 星期三 19:45, Sven Püschel 写道:
>> From: Simon Xue <xxm@...k-chips.com>
>>
>> Disable the Bit 31 of the AUTO_GATING iommu register, as it causes
>> hangups with the RGA3 (Raster Graphics Acceleration 3) peripheral.
>> The RGA3 register description of the TRM already states that the bit
>> must be set to 1. The vendor kernel sets the bit unconditionally to
>> 1 to fix VOP (Video Output Processor) screen black issues. This patch
>> squashes the 2 vendor kernel commits with the following commit messages:
>>
>> Master fetch data and cpu update page table may work in parallel, may
>> have the following procedure:
>>
>>     master                  cpu
>>     fetch dte               update page tabl
>>             |                       |
>>     (make dte invalid)  <-  zap iotlb entry
>>             |                       |
>>     fetch dte again
>>     (make dte invalid)  <-  zap iotlb entry
>>             |                       |
>>     fetch dte again
>>     (make dte invalid)  <-  zap iotlb entry
>>             |                       |
>>     fetch dte again
>>     (make iommu block)  <-  zap iotlb entry
>>
>> New iommu version has the above bug, if fetch dte consecutively four
>> times, then it will be blocked. Fortunately, we can set bit 31 of
>> register MMU_AUTO_GATING to 1 to make it work as old version which does
>> not have this issue.
>>
>> This issue only appears on RV1126 so far, so make a workaround dedicated
>> to "rockchip,rv1126" machine type.
>>
>> iommu/rockchip: fix vop blocked and screen black on RK356X and RK3588
>>
>> RK3568 and RK3588 has the same issue as RV1126/RV1109 that caused by
>> dte fetch time limit, So we can set BIT(31) of register 0x24 default
>> to 1 as a workaround.
>>
>> Signed-off-by: Simon Xue <xxm@...k-chips.com>
>> Signed-off-by: Sven Püschel <s.pueschel@...gutronix.de>
>> ---
>> During testing of a newly developed driver for the RGA3 peripheral [1]
>> (Raster Graphic Acceleration 3) of the RK3588 some sporadic hangs
>> have been observed. The upstream rockchip-iommu driver is used to handle
>> the RGA3 IOMMU register space.
>>
>> After a closer look at the TRM for the RK3588, the RGA3 iommu register
>> description of the RGA3_MMU_AUTO_GATING register (offset 0x24) mentions
>
> It's 0xF24 per RGA3 chapter.

yeah, sorry. I was already thinking relative to the rga3 iommu address 
space in my head, but didn't really mention that the chapter says 0xF24 
with the iommu related registers starting at 0xF00.

Sincerely
     Sven

>
>> a mmu_bug_fixed_disable bit, which must be set to 1 but defaults to 0.
>>
>> Looking at the commits in the vendor kernel, the bit is unconditionally
>> set to 1 and mentions that it fixes a blocked VOP (Video Output
>> Processor) [3]. Therefore squash the relevant vendor commits
>> [2] and [3] into a single patch, combine the commit messages and keep
>> the Signed-off-by line from the original author.
>>
>> [1] 
>> https://lore.kernel.org/all/20251007-spu-rga3-v1-0-36ad85570402@pengutronix.de/
>> [2] 
>> https://github.com/rockchip-linux/kernel/commit/7f8158fb41b5cc8e738aaeebc3637c50ebd74cae
>> [3] 
>> https://github.com/rockchip-linux/kernel/commit/6a355e5f9a2069a2309e240791bc3aad63b7324e
>> ---
>>   drivers/iommu/rockchip-iommu.c | 8 ++++++++
>>   1 file changed, 8 insertions(+)
>>
>> diff --git a/drivers/iommu/rockchip-iommu.c 
>> b/drivers/iommu/rockchip-iommu.c
>> index 0861dd469bd86..2d0dabb0d101a 100644
>> --- a/drivers/iommu/rockchip-iommu.c
>> +++ b/drivers/iommu/rockchip-iommu.c
>> @@ -76,6 +76,8 @@
>>   #define SPAGE_ORDER 12
>>   #define SPAGE_SIZE (1 << SPAGE_ORDER)
>>   +#define DISABLE_FETCH_DTE_TIME_LIMIT BIT(31)
>> +
>>    /*
>>     * Support mapping any size that fits in one page table:
>>     *   4 KiB to 4 MiB
>> @@ -930,6 +932,7 @@ static int rk_iommu_enable(struct rk_iommu *iommu)
>>       struct iommu_domain *domain = iommu->domain;
>>       struct rk_iommu_domain *rk_domain = to_rk_domain(domain);
>>       int ret, i;
>> +    u32 auto_gate;
>>         ret = clk_bulk_enable(iommu->num_clocks, iommu->clocks);
>>       if (ret)
>> @@ -948,6 +951,11 @@ static int rk_iommu_enable(struct rk_iommu *iommu)
>> rk_ops->mk_dtentries(rk_domain->dt_dma));
>>           rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE);
>>           rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, 
>> RK_MMU_IRQ_MASK);
>> +
>> +        /* Workaround for iommu blocked, BIT(31) default to 1 */
>> +        auto_gate = rk_iommu_read(iommu->bases[i], RK_MMU_AUTO_GATING);
>> +        auto_gate |= DISABLE_FETCH_DTE_TIME_LIMIT;
>> +        rk_iommu_write(iommu->bases[i], RK_MMU_AUTO_GATING, auto_gate);
>>       }
>>         ret = rk_iommu_enable_paging(iommu);
>>
>> ---
>> base-commit: 30f09200cc4aefbd8385b01e41bde2e4565a6f0e
>> change-id: 20251126-spu-iommudtefix-cd0c5244c74a
>>
>> Best regards,
>
>