SMMU fault on address 0x00000000ffd6c000

Hello,
We have an application that is handling multiple RTSP sessions (generally short sessions around 2-5 seconds), after few hours we see the following messages on dmesg and our process gets an abort signal:

[1385672.353297] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=187 in L2
[1385672.363941] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1385672.370738] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1385672.376576] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1386401.554308] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=184 in L2
[1386401.564955] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1386401.571761] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1386401.577611] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1386852.457024] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=185 in L2
[1386852.467682] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1386852.474478] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1386852.480322] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1386988.212115] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=197 in L2
[1386988.222801] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1386988.229600] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1386988.235438] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1387019.699531] mc-err: Too many MC errors; throttling prints
[1387467.888423] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=198 in L2
[1387467.899080] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1387467.905884] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1387467.911733] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1388264.763027] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=182 in L2
[1388264.773684] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1388264.780484] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1388264.786328] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1388504.724797] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=184 in L2
[1388504.735449] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1388504.742239] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1388504.748084] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1388834.081509] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=188 in L2
[1388834.092167] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1388834.098958] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1388834.104797] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389004.206275] mc-err: Too many MC errors; throttling prints
[1389203.507709] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=182 in L2
[1389203.518348] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389203.525175] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389203.531026] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389421.401744] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=186 in L2
[1389421.412401] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389421.419204] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389421.425048] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389574.525641] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=186 in L2
[1389574.536320] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389574.543124] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389574.548961] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1389808.338054] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=182 in L2
[1389808.348691] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1389808.355499] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1389808.361334] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1390337.956943] mc-err: Too many MC errors; throttling prints
[1390509.675127] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=181 in L2
[1390509.685771] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1390509.692564] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1390509.698407] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1390624.815941] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=189 in L2
[1390624.826583] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1390624.833374] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1390624.839210] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1390772.263643] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=187 in L2
[1390772.274317] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1390772.281118] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1390772.286984] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391198.547114] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=185 in L2
[1391198.558427] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391198.565490] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391198.572119] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391526.987419] mc-err: Too many MC errors; throttling prints
[1391549.383973] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=191 in L2
[1391549.394614] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391549.401820] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391549.407722] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391676.904313] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=177 in L2
[1391676.915223] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391676.922076] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391676.928081] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1391979.682048] smmu_dump_pagetable(): fault_address=0x00000000ffd6c000 pa=0x0000000000000000 bytes=1000 #pte=185 in L2
[1391979.692925] mc-err: (0) csr_afir: EMEM decode error on PDE or PTE entry
[1391979.699780] mc-err: status = 0x6000000e; addr = 0xffd6c000
[1391979.706058] mc-err: secure: no, access-type: read, SMMU fault: nr-nw-s
[1392035.185746] audit: type=1701 audit(1748454027.359:43): auid=4294967295 uid=1000 gid=1000 ses=4294967295 pid=371487 comm=“agent” exe=“/opt/crs/agent/agent” sig=6

Looking at the DTS we noticed that the address 0x00000000ffd6c000 lands in a iommu mapped domain that could conflict:

iommu@12000000 {
compatible = “arm,mmu-500”;
#iommu-cells = <0x01>;
#global-interrupts = <0x02>;
status = “okay”;
interrupts = <0x00 0xaa 0x04 0x00 0xab 0x04>;
phandle = <0x11>;
reg = <0x00 0x12000000 0x00 0x1000000>;
linux,phandle = <0x11>;
suspend-save-reg = <0xc390868>;

	domains {

		xusb_host_domain {
			address-space = <0xb6>;
			sid-list = <0x1b>;
		};

		host1x2_domain {
			address-space = <0xb5>;
			sid-list = <0x3a>;
		};

		sdmmc4a_domain {
			address-space = <0xb6>;
			sid-list = <0x17>;
		};

		host1x_client_domain {
			address-space = <0xb5>;
			sid-list = <0x03 0x04 0x06 0x07 0x08 0x05 0x0a 0x0b 0x09 0x02 0x2b 0x0c 0x0d 0x0e 0x0f>;
		};

		sdmmc1a_domain {
			address-space = <0xb6>;
			sid-list = <0x1a>;
		};

		host1x1_domain {
			address-space = <0xb5>;
			sid-list = <0x39>;
		};

		ufshci_domain {
			address-space = <0xb6>;
			sid-list = <0x15>;
		};

		host1x7_domain {
			address-space = <0xb5>;
			sid-list = <0x3f>;
		};

		bpmp_domain {
			address-space = <0xb6>;
			sid-list = <0x32>;
		};

		sata2_domain {
			address-space = <0xb6>;
			sid-list = <0x1d>;
		};

		host1x0_domain {
			address-space = <0xb5>;
			sid-list = <0x38>;
		};

		host1x6_domain {
			address-space = <0xb5>;
			sid-list = <0x3e>;
		};

		sdmmc2a_domain {
			address-space = <0xb6>;
			sid-list = <0x19>;
		};

		gpu_domain {
			address-space = <0xb3>;
			sid-list = <0x10>;
		};

		ape_domain {
			address-space = <0xb7>;
			sid-list = <0x1e 0x14>;
		};

		gpcdma_domain {
			address-space = <0xb6>;
			sid-list = <0x20>;
		};

		rtcpu_domain {
			address-space = <0xb9>;
			sid-list = <0x2a 0x2d>;
		};

		host1x5_domain {
			address-space = <0xb5>;
			sid-list = <0x3d>;
		};

		hda_domain {
			address-space = <0xb6>;
			sid-list = <0x12>;
		};

		host1x4_domain {
			address-space = <0xb5>;
			sid-list = <0x3c>;
		};

		xusb_dev_domain {
			address-space = <0xb6>;
			sid-list = <0x1c>;
		};

		sdmmc3a_domain {
			address-space = <0xb6>;
			sid-list = <0x18>;
		};

		aon_domain {
			address-space = <0xb6>;
			sid-list = <0x16>;
		};

		host1x_domain {
			address-space = <0xb4>;
			sid-list = <0x01>;
		};

		smmu_test_domain {
			address-space = <0xb6>;
			sid-list = <0x33>;
		};

		afi_domain {
			address-space = <0xb8>;
			sid-list = <0x11>;
		};

		host1x3_domain {
			address-space = <0xb5>;
			sid-list = <0x3b>;
		};

		sce_domain {
			address-space = <0xb6>;
			sid-list = <0x1f>;
		};
	};

	address-space-prop {

		camera {
			iova-size = <0x00 0x20000000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0xa0000000>;
			phandle = <0xb9>;
			linux,phandle = <0xb9>;
		};

		gpu {
			iova-size = <0x3ff 0xffefffff>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x00>;
			iova-start = <0x00 0x100000>;
			phandle = <0xb3>;
			linux,phandle = <0xb3>;
		};

		pcie_as {
			iova-size = <0x00 0xffffffff>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x80000000>;
			phandle = <0xb8>;
			linux,phandle = <0xb8>;
		};

		host1x_client {
			iova-size = <0x1f 0xfffff000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x1000>;
			phandle = <0xb5>;
			linux,phandle = <0xb5>;
		};

		ape {
			iova-size = <0x00 0x20000000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x40000000>;
			phandle = <0xb7>;
			linux,phandle = <0xb7>;
		};

		host1x {
			iova-size = <0x00 0xfffff000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x1000>;
			phandle = <0xb4>;
			linux,phandle = <0xb4>;
		};

		common {
			iova-size = <0x00 0x7ff00000>;
			num-pf-page = <0x00>;
			alignment = <0xfffff>;
			gap-page = <0x01>;
			iova-start = <0x00 0x80000000>;
			phandle = <0xb6>;
			linux,phandle = <0xb6>;
		};
	};
};

Note that “pcie_as” and “common” sections have the same iova-start address (0x80000000) and pcie_as size is 0xffffffff.
Is this a problem that could be related to the errors messages we see?

Thanks,
Davide

Hi,
Do you use Jetpack 4.6.6? If you use previous version, would suggest upgrade to latest version and try

JetPack 4.6.4 + patches for Micron.
tegra186-soc-base.dtsi iommu section in 4.6.6 looks the same.