[PATCH v2 0/3] Fix GPU and display on ARM32 platforms using the MSM IOMMU

[Dmitry Baryshkov]

On apq8064 (tested on the IFC6410 board) neither the GPU nor the display
controller comes up in mainline: with CONFIG_ARM_DMA_USE_IOMMU enabled
both devices either fail to probe with -EBUSY or take the kernel down
during the ensuing unwind. Three independent problems stack up on that
path, one in each of three subsystems, and only fixing all of them makes
the board usable.

First, the MSM IOMMU driver does not handle a device that is attached to
several IOMMU instances, which is exactly how apq8064 describes both the
GPU (&gfx3d and &gfx3d1) and the display controller (&mdp_port0 and
&mdp_port1). It keyed the per-device bookkeeping off two mismatched
things, a per-IOMMU list and a per-device pointer, so only one of the
instances ever got programmed with the stream IDs. That had been merely
wrong for years, but it turned into a NULL dereference once the IOMMU
core started deferring probe per instance, so today the board does not
even reach a shell with the display enabled.

Second, on ARM32 the arch code gives every IOMMU-backed device a
dma_iommu_mapping of its own and attaches it. drm/msm manages its address
spaces itself and cannot take over a device whose group already has that
foreign domain attached. The other ARM32 DRM drivers that are in the same
position (tegra, rockchip, exynos) drop the arch mapping first; drm/msm
has to do the same.

Third, arm_iommu_detach_device() undoes things in the opposite order from
the one arm_iommu_attach_device() set them up in. An IOMMU driver that
allocates its page tables during attach therefore frees them with the
IOMMU DMA ops installed rather than the direct ops that mapped them,
which ends in a NULL pointer dereference. This is trivially reachable as
soon as any of the probe failures above unwinds, and it is what turns the
GPU probe failure into a crash rather than an error message.

The three patches are independent and are expected to be picked up by
three different maintainers.

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov at oss.qualcomm.com>
---
Changes in v2:
- dropped dev_warn -> dev_dbg chunk (Konrad)
- rewrote second patch to use correct device inside msm_iommu unmapping
  (Robin)
- Link to v1: https://patch.msgid.link/20260730-fix-qcom-smmu-v1-0-b12fa067804e@oss.qualcomm.com

To: Rob Clark <robin.clark at oss.qualcomm.com>
To: "Joerg Roedel (AMD)" <joro at 8bytes.org>
To: Will Deacon <will at kernel.org>
To: Robin Murphy <robin.murphy at arm.com>
To: Joerg Roedel <jroedel at suse.de>
To: Sricharan Ramabadhran <quic_srichara at quicinc.com>
To: Dmitry Baryshkov <lumag at kernel.org>
To: Abhinav Kumar <abhinav.kumar at linux.dev>
To: Jessica Zhang <jesszhan0024 at gmail.com>
To: Sean Paul <sean at poorly.run>
To: Marijn Suijten <marijn.suijten at somainline.org>
To: David Airlie <airlied at gmail.com>
To: Simona Vetter <simona at ffwll.ch>
To: Heiko Stuebner <heiko at sntech.de>
Cc: iommu at lists.linux.dev
Cc: linux-arm-msm at vger.kernel.org
Cc: linux-kernel at vger.kernel.org
Cc: dri-devel at lists.freedesktop.org
Cc: freedreno at lists.freedesktop.org
Cc: linux-arm-kernel at lists.infradead.org
Cc: linux-rockchip at lists.infradead.org

---
Dmitry Baryshkov (3):
      iommu/msm: track a context master per device and IOMMU
      iommu/msm: use the IOMMU device for page table allocation
      drm/msm: detach the ARM DMA mapping before attaching our own domain

 drivers/gpu/drm/msm/msm_iommu.c | 22 +++++++++++++
 drivers/iommu/msm_iommu.c       | 68 +++++++++++++++++++++++++++++++----------
 2 files changed, 74 insertions(+), 16 deletions(-)
---
base-commit: 78bc8af4affb9a732504eb22eeac7d1e50883853
change-id: 20260723-fix-qcom-smmu-b5798c65d689
prerequisite-change-id: 20260723-msm-fix-crash-8c13220d9465:v1
prerequisite-patch-id: 3556d41e924ad64e8e9c06cc5bd1972c66957f42

Best regards,
--  
With best wishes
Dmitry