Linux-ARM-Kernel Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Markuss Broks via B4 Relay <devnull+markuss.broks.gmail.com@kernel.org>
To: Marek Szyprowski <m.szyprowski@samsung.com>,
	 "Joerg Roedel (AMD)" <joro@8bytes.org>,
	Will Deacon <will@kernel.org>,
	 Robin Murphy <robin.murphy@arm.com>,
	Krzysztof Kozlowski <krzk@kernel.org>,
	 Peter Griffin <peter.griffin@linaro.org>,
	 Alim Akhtar <alim.akhtar@samsung.com>
Cc: iommu@lists.linux.dev, linux-arm-kernel@lists.infradead.org,
	 linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org,
	 Markuss Broks <markuss.broks@gmail.com>
Subject: [PATCH 0/4] IOMMU driver improvements for modern Exynos SysMMUs
Date: Thu, 20 Aug 2026 22:12:04 +0300	[thread overview]
Message-ID: <20260820-exynos-iommu-fixes-v1-0-6bbcd673bb15@gmail.com> (raw)

Newer SysMMU v7+ instances can lack BLOCK mode: CAPA1 bit 15 reports
that the CTRL_BLOCK function is not implemented, and MMU_STATUS never
reports a blocked state. The SysMMUs on Exynos 8835 are such
instances.

The driver currently assumes blocking always works, with two
consequences on such hardware:

The enable path writes CTRL_BLOCK first, which there acts as a plain 
enable and starts translation before the page table base is programmed.

Worse, both TLB invalidation paths gate the invalidation writes on
sysmmu_block() succeeding, which it never does - so every unmap silently
skips the invalidation. A stale TLB entry is a valid entry pointing
at a freed page, so nothing ever faults: the device reads back garbage
and its writebacks corrupt whatever the kernel has since reused those pages for.
 
This was tracked down on Exynos 8835 with the MFC, where the
first decoder session of a boot worked and later sessions produced
garbage along with random kernel memory corruption.
Patches 1-3 add detection of the capability bit and adapt the enable
sequence and the invalidation paths, matching the vendor driver's
handling of these parts. Patch 4 is an independent debugging
improvement: decode the v7 fault transaction info word (AxID/AxLEN),
which identifies the issuing port when a master containing several
DMA engines faults.

Tested on the Samsung Galaxy Tab S9 FE (Exynos 8835/Exynos 1380).

Signed-off-by: Markuss Broks <markuss.broks@gmail.com>
---
Markuss Broks (4):
      iommu/exynos: detect SysMMUs without BLOCK mode
      iommu/exynos: fix the enable sequence for no-block SysMMUs
      iommu/exynos: fix TLB invalidation for no-block SysMMUs
      iommu/exynos: decode the v7 fault transaction info

 drivers/iommu/exynos-iommu.c | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)
---
base-commit: 415606a7be939835db9b0d6b711887586646346d
change-id: 20260820-exynos-iommu-fixes-e0e4d8f0fc06

Best regards,
--  
Markuss Broks <markuss.broks@gmail.com>




             reply	other threads:[~2026-08-20 19:12 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-20 19:12 Markuss Broks via B4 Relay [this message]
2026-08-20 19:12 ` [PATCH 1/4] iommu/exynos: detect SysMMUs without BLOCK mode Markuss Broks via B4 Relay
2026-08-20 19:12 ` [PATCH 2/4] iommu/exynos: fix the enable sequence for no-block SysMMUs Markuss Broks via B4 Relay
2026-08-20 19:12 ` [PATCH 3/4] iommu/exynos: fix TLB invalidation " Markuss Broks via B4 Relay
2026-08-20 19:12 ` [PATCH 4/4] iommu/exynos: decode the v7 fault transaction info Markuss Broks via B4 Relay

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260820-exynos-iommu-fixes-v1-0-6bbcd673bb15@gmail.com \
    --to=devnull+markuss.broks.gmail.com@kernel.org \
    --cc=alim.akhtar@samsung.com \
    --cc=iommu@lists.linux.dev \
    --cc=joro@8bytes.org \
    --cc=krzk@kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-samsung-soc@vger.kernel.org \
    --cc=m.szyprowski@samsung.com \
    --cc=markuss.broks@gmail.com \
    --cc=peter.griffin@linaro.org \
    --cc=robin.murphy@arm.com \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox