SMMU fault on address 0x00000000ffd6c000

Hello,
We have an application that is handling multiple RTSP sessions (generally short sessions around 2-5 seconds), after few hours we see the following messages on dmesg and our process gets an abort signal:

[1385672.353297] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=187 in L2
[1385672.363941] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1385672.370738] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1385672.376576] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1386401.554308] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=184 in L2
[1386401.564955] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1386401.571761] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1386401.577611] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1386852.457024] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=185 in L2
[1386852.467682] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1386852.474478] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1386852.480322] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1386988.212115] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=197 in L2
[1386988.222801] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1386988.229600] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1386988.235438] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1387019.699531] mc-err: Too many MC errors; throttling prints
[1387467.888423] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=198 in L2
[1387467.899080] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1387467.905884] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1387467.911733] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1388264.763027] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=182 in L2
[1388264.773684] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1388264.780484] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1388264.786328] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1388504.724797] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=184 in L2
[1388504.735449] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1388504.742239] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1388504.748084] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1388834.081509] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=188 in L2
[1388834.092167] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1388834.098958] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1388834.104797] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389004.206275] mc-err: Too many MC errors; throttling prints
[1389203.507709] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=182 in L2
[1389203.518348] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389203.525175] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389203.531026] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389421.401744] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=186 in L2
[1389421.412401] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389421.419204] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389421.425048] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389574.525641] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=186 in L2
[1389574.536320] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389574.543124] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389574.548961] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389808.338054] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=182 in L2
[1389808.348691] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389808.355499] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389808.361334] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1390337.956943] mc-err: Too many MC errors; throttling prints
[1390509.675127] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=181 in L2
[1390509.685771] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1390509.692564] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1390509.698407] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1390624.815941] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=189 in L2
[1390624.826583] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1390624.833374] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1390624.839210] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1390772.263643] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=187 in L2
[1390772.274317] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1390772.281118] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1390772.286984] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391198.547114] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=185 in L2
[1391198.558427] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391198.565490] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391198.572119] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391526.987419] mc-err: Too many MC errors; throttling prints
[1391549.383973] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=191 in L2
[1391549.394614] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391549.401820] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391549.407722] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391676.904313] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=177 in L2
[1391676.915223] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391676.922076] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391676.928081] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391979.682048] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=185 in L2
[1391979.692925] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391979.699780] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391979.706058] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1392035.185746] audit: type=1701 audit(1748454027.359:43): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=371487 comm=“agent” exe=“/opt/crs/agent/agent” sig=6

Looking at the DTS we noticed that the address 0x00000000ffd6c000 lands in a iommu mapped domain that could conflict:

iommu@12000000 {
compatible = “arm,mmu-500”;
#iommu-cells = <0x01>;
#global-interrupts = <0x02>;
status = “okay”;
interrupts = <0x00 0xaa 0x04 0x00 0xab 0x04>;
phandle = <0x11>;
reg = <0x00 0x12000000 0x00 0x1000000>;
linux,phandle = <0x11>;
suspend-save-reg = <0xc390868>;

	domains {

		xusb_host_domain {
			address-space = <0xb6>;
			sid-list = <0x1b>;
		};

		host1x2_domain {
			address-space = <0xb5>;
			sid-list = <0x3a>;
		};

		sdmmc4a_domain {
			address-space = <0xb6>;
			sid-list = <0x17>;
		};

		host1x_client_domain {
			address-space = <0xb5>;
			sid-list = <0x03 0x04 0x06 0x07 0x08 0x05 0x0a 0x0b 0x09 0x02 0x2b 0x0c 0x0d 0x0e 0x0f>;
		};

		sdmmc1a_domain {
			address-space = <0xb6>;
			sid-list = <0x1a>;
		};

		host1x1_domain {
			address-space = <0xb5>;
			sid-list = <0x39>;
		};

		ufshci_domain {
			address-space = <0xb6>;
			sid-list = <0x15>;
		};

		host1x7_domain {
			address-space = <0xb5>;
			sid-list = <0x3f>;
		};

		bpmp_domain {
			address-space = <0xb6>;
			sid-list = <0x32>;
		};

		sata2_domain {
			address-space = <0xb6>;
			sid-list = <0x1d>;
		};

		host1x0_domain {
			address-space = <0xb5>;
			sid-list = <0x38>;
		};

		host1x6_domain {
			address-space = <0xb5>;
			sid-list = <0x3e>;
		};

		sdmmc2a_domain {
			address-space = <0xb6>;
			sid-list = <0x19>;
		};

		gpu_domain {
			address-space = <0xb3>;
			sid-list = <0x10>;
		};

		ape_domain {
			address-space = <0xb7>;
			sid-list = <0x1e 0x14>;
		};

		gpcdma_domain {
			address-space = <0xb6>;
			sid-list = <0x20>;
		};

		rtcpu_domain {
			address-space = <0xb9>;
			sid-list = <0x2a 0x2d>;
		};

		host1x5_domain {
			address-space = <0xb5>;
			sid-list = <0x3d>;
		};

		hda_domain {
			address-space = <0xb6>;
			sid-list = <0x12>;
		};

		host1x4_domain {
			address-space = <0xb5>;
			sid-list = <0x3c>;
		};

		xusb_dev_domain {
			address-space = <0xb6>;
			sid-list = <0x1c>;
		};

		sdmmc3a_domain {
			address-space = <0xb6>;
			sid-list = <0x18>;
		};

		aon_domain {
			address-space = <0xb6>;
			sid-list = <0x16>;
		};

		host1x_domain {
			address-space = <0xb4>;
			sid-list = <0x01>;
		};

		smmu_test_domain {
			address-space = <0xb6>;
			sid-list = <0x33>;
		};

		afi_domain {
			address-space = <0xb8>;
			sid-list = <0x11>;
		};

		host1x3_domain {
			address-space = <0xb5>;
			sid-list = <0x3b>;
		};

		sce_domain {
			address-space = <0xb6>;
			sid-list = <0x1f>;
		};
	};

	address-space-prop {

		camera {
			iova-size = <0x00 0x20000000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0xa0000000>;
			phandle = <0xb9>;
			linux,phandle = <0xb9>;
		};

		gpu {
			iova-size = <0x3ff 0xffefffff>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x00>;
			iova-start = <0x00 0x100000>;
			phandle = <0xb3>;
			linux,phandle = <0xb3>;
		};

		pcie_as {
			iova-size = <0x00 0xffffffff>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x80000000>;
			phandle = <0xb8>;
			linux,phandle = <0xb8>;
		};

		host1x_client {
			iova-size = <0x1f 0xfffff000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x1000>;
			phandle = <0xb5>;
			linux,phandle = <0xb5>;
		};

		ape {
			iova-size = <0x00 0x20000000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x40000000>;
			phandle = <0xb7>;
			linux,phandle = <0xb7>;
		};

		host1x {
			iova-size = <0x00 0xfffff000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x1000>;
			phandle = <0xb4>;
			linux,phandle = <0xb4>;
		};

		common {
			iova-size = <0x00 0x7ff00000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x80000000>;
			phandle = <0xb6>;
			linux,phandle = <0xb6>;
		};
	};
};

Note that “pcie_as” and “common” sections have the same iova-start address (0x80000000) and pcie_as size is 0xffffffff.
Is this a problem that could be related to the errors messages we see?

Thanks,
Davide

1 Like