[PATCH v3 00/12] media: verisilicon: Recover the Rockchip VPUs from faults and timeouts

[PATCH v3 00/12] media: verisilicon: Recover the Rockchip VPUs from faults and timeouts

[Arun Iyengar via B4 Relay]

On the RK3588, a VEPU121 encoder core that faults on an unmapped IOVA
never becomes idle again, and every later job times out. Patch 6
pulses the reset lines of the core on a timeout, and patch 7 then
reinitializes its IOMMU like rkvdec does. Patch 5 re-enables the
encoder interrupt after a reset. Patches 1 and 11 describe the optional
reset lines; patch 11 can go through the Rockchip tree.

Patch 4 stops asserting the resets on remove: the RK3588 AV1 resets
also cover its IOMMU, which then faults (SError) on runtime suspend.
It touches the same lines as Sergei Khomenkov's remove fix [1]; the
one applied second needs a trivial rebase.

Patches 8 to 10 and 12 describe the AV1 resets on its IOMMU too
(Philipp Zabel): vsi-iommu deasserts them on probe, and both drivers
acquire them only while using them. Patches 9 and 10 can go through
the iommu tree; patch 12 needs patch 8.

Patches 2 and 3 fix older bugs found by Sashiko: a NULL match in probe,
and a request left queued when the VPU can't resume. The ->run() error
paths are left to Sascha Hauer's series [2].

Tested on an Orange Pi 5 (RK3588S) on a v7.3 based kernel with other
out-of-tree Hantro patches (no 556ab0b2741d or 8e26d4c20ed2); v7.4-rc1
is build-tested only. AV1 unbind/rebind hit the SError before patch 4
and is clean with it. Provoked encoder timeouts and unmapped-IOVA
faults are reset and the next jobs encode.
All VPU cores still probe, H.264 fluster is unchanged, v4l2-compliance
-s passes on the JPEG encoder, and a job refused after a failed IOMMU
restore completes its request. Patch 3: code reading only.
With patches 8 to 10 and 12: AV1 unbind/rebind 20/20, AV1 fluster
unchanged (203/242), s2idle 3/3, encoder timeout recovery unchanged.

Developed with Claude (Anthropic), which wrote the code and the commit
messages. I reviewed every change.

[1] https://lore.kernel.org/r/20261106-hantro-remove-v1-1-d0a4678886d7@gmail.com
[2] https://lore.kernel.org/r/20260824-rk3588-jpegdec-v1-0-180a30a2852d@pengutronix.de

Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>

---
Changes in v3:
- New patch 2: check the match data in hantro_probe() (Sashiko, v1)
- New patch 3: complete the request when the VPU can't resume
- Patch 7 (was 5): complete the request of a job refused after a failed
  IOMMU restore (Sashiko); fail the probe if the empty domain can't be
  allocated
- Patches 4 to 7 (were 2 to 5): shorter commit messages and comments
- New patches 8 to 10, 12: the AV1 resets on its IOMMU, released
  reset controls (Philipp Zabel)
- Patch 11 was 6
- Patch 1: Acked-by from Krzysztof
- Link to v2: https://patch.msgid.link/20261112-hantro-robust-v2-0-18561fd48838@gmail.com

Changes in v2:
- Patch 2: never assert the resets on remove or on the probe error path
- New patch 3: re-enable the encoder interrupt after a VEPU1/VEPU2 reset
- Patch 5 (was 4): restore the IOMMU only from the Rockchip encoder
  reset, only with reset lines and a DMA domain; refuse later jobs if
  the attach fails
- Link to v1: https://patch.msgid.link/20261110-hantro-robust-v1-0-6b6269c05bfa@gmail.com

---
Arun Iyengar (12):
      dt-bindings: media: rockchip,rk3568-vepu: Add the reset lines
      media: verisilicon: Check the match data in hantro_probe()
      media: verisilicon: Complete the request when the VPU can't resume
      media: verisilicon: Don't hold the VPU in reset after remove
      media: verisilicon: Enable the Rockchip encoder interrupt again after a reset
      media: verisilicon: Reset the Rockchip encoder cores on timeout
      media: verisilicon: Reinitialize the IOMMU after resetting an encoder core
      media: verisilicon: Acquire the reset lines only while using them
      dt-bindings: iommu: verisilicon: Add the reset lines
      iommu/vsi: Deassert the reset lines on probe
      arm64: dts: rockchip: Add the reset lines of the RK3588 VEPU121 cores
      arm64: dts: rockchip: Add the reset lines of the RK3588 AV1 IOMMU

 .../bindings/iommu/verisilicon,iommu.yaml          |  10 ++
 .../bindings/media/rockchip,rk3568-vepu.yaml       |  10 ++
 arch/arm64/boot/dts/rockchip/rk3588-base.dtsi      |  10 ++
 drivers/iommu/vsi-iommu.c                          |  16 ++++
 drivers/media/platform/verisilicon/hantro.h        |   5 +
 drivers/media/platform/verisilicon/hantro_drv.c    | 102 +++++++++++++++++----
 drivers/media/platform/verisilicon/hantro_hw.h     |   1 +
 .../media/platform/verisilicon/rockchip_vpu_hw.c   |  44 +++++++++
 .../media/platform/verisilicon/stm32mp25_vpu_hw.c  |   4 +
 drivers/media/platform/verisilicon/sunxi_vpu_hw.c  |   4 +
 10 files changed, 188 insertions(+), 18 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261110-hantro-robust-6a6c84febb06

Best regards,
--  
Arun Iyengar <aiyengar1990@gmail.com>

[PATCH v3 01/12] dt-bindings: media: rockchip,rk3568-vepu: Add the reset lines

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

The VEPU121 encoder cores of the RK3588 each have their own AXI and AHB
reset lines in the CRU (SRST_A_JPEG_ENCODERx and SRST_H_JPEG_ENCODERx).
They are needed to recover a core that is stuck on the bus, which its
registers can't stop.

Describe them as optional, so that existing device trees stay valid.

Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 .../devicetree/bindings/media/rockchip,rk3568-vepu.yaml        | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Documentation/devicetree/bindings/media/rockchip,rk3568-vepu.yaml b/Documentation/devicetree/bindings/media/rockchip,rk3568-vepu.yaml
index d246f5d38427..e9fda4373f0f 100644
--- a/Documentation/devicetree/bindings/media/rockchip,rk3568-vepu.yaml
+++ b/Documentation/devicetree/bindings/media/rockchip,rk3568-vepu.yaml
@@ -32,6 +32,16 @@ properties:
       - const: aclk
       - const: hclk
 
+  resets:
+    items:
+      - description: AXI reset line
+      - description: AHB reset line
+
+  reset-names:
+    items:
+      - const: axi
+      - const: ahb
+
   power-domains:
     maxItems: 1
 

-- 
2.55.0

[PATCH v3 02/12] media: verisilicon: Check the match data in hantro_probe()

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

A device bound through driver_override may have no OF match, and
hantro_probe() then dereferences a NULL match. Use
device_get_match_data() and fail with -ENODEV without match data.

Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/hantro_drv.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 26e5d5547466..e86eb943d16a 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -17,6 +17,7 @@
 #include <linux/platform_device.h>
 #include <linux/pm.h>
 #include <linux/pm_runtime.h>
+#include <linux/property.h>
 #include <linux/slab.h>
 #include <linux/videodev2.h>
 #include <linux/workqueue.h>
@@ -1071,7 +1072,6 @@ static struct v4l2_m2m_dev *hantro_get_v4l2_m2m_dev(struct hantro_dev *vpu)
 
 static int hantro_probe(struct platform_device *pdev)
 {
-	const struct of_device_id *match;
 	struct hantro_dev *vpu;
 	int num_bases;
 	int i, ret;
@@ -1085,8 +1085,9 @@ static int hantro_probe(struct platform_device *pdev)
 	mutex_init(&vpu->vpu_mutex);
 	spin_lock_init(&vpu->irqlock);
 
-	match = of_match_node(of_hantro_match, pdev->dev.of_node);
-	vpu->variant = match->data;
+	vpu->variant = device_get_match_data(&pdev->dev);
+	if (!vpu->variant)
+		return -ENODEV;
 
 	ret = hantro_disable_multicore(vpu);
 	if (ret)
@@ -1098,8 +1099,7 @@ static int hantro_probe(struct platform_device *pdev)
 	 * nxp,imx8mq-vpu-g1 or nxp,imx8mq-vpu-g2 instead.
 	 */
 	if (of_device_is_compatible(pdev->dev.of_node, "nxp,imx8mq-vpu"))
-		dev_warn(&pdev->dev, "%s compatible is deprecated\n",
-			 match->compatible);
+		dev_warn(&pdev->dev, "nxp,imx8mq-vpu compatible is deprecated\n");
 
 	INIT_DELAYED_WORK(&vpu->watchdog_work, hantro_watchdog);
 

-- 
2.55.0

Re: [PATCH v3 02/12] media: verisilicon: Check the match data in hantro_probe()

[Nicolas Dufresne]

[-- Attachment #1: Type: text/plain, Size: 523 bytes --]

Le vendredi 13 novembre 2026 à 16:40 +0000, Arun Iyengar via B4 Relay a écrit :
> From: Arun Iyengar <aiyengar1990@gmail.com>
> 
> A device bound through driver_override may have no OF match, and
> hantro_probe() then dereferences a NULL match. Use
> device_get_match_data() and fail with -ENODEV without match data.
> 
> Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
> Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>

Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[PATCH v3 03/12] media: verisilicon: Complete the request when the VPU can't resume

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

If pm_runtime_resume_and_get() fails, device_run() returns the buffers
without completing the controls of the request, and the request stays
queued forever. Complete them on that path.

Fixes: 7d47b45dc590 ("media: rockchip/vpu: Support the Request API")
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/hantro_drv.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index e86eb943d16a..42822b2b376c 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -176,16 +176,20 @@ static void device_run(void *priv)
 	dst = hantro_get_dst_buf(ctx);
 
 	ret = pm_runtime_resume_and_get(vpu->dev);
-	if (ret < 0) {
-		hantro_job_finish_no_pm(ctx, VB2_BUF_STATE_ERROR);
-		return;
-	}
+	if (ret < 0)
+		goto err_cancel_job;
 
 	v4l2_m2m_buf_copy_metadata(src, dst);
 
 	ret = ctx->codec_ops->run(ctx);
 	if (ret)
 		hantro_job_finish(ctx, VB2_BUF_STATE_ERROR);
+
+	return;
+
+err_cancel_job:
+	v4l2_ctrl_request_complete(src->vb2_buf.req_obj.req, &ctx->ctrl_handler);
+	hantro_job_finish_no_pm(ctx, VB2_BUF_STATE_ERROR);
 }
 
 static const struct v4l2_m2m_ops vpu_m2m_ops = {

-- 
2.55.0

[PATCH v3 04/12] media: verisilicon: Don't hold the VPU in reset after remove

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

On the RK3588, the resets of the AV1 decoder include the AXI and APB
bus interface resets (SRST_A_AV1_BIU, SRST_P_AV1_BIU), which also cover
the Verisilicon IOMMU of the decoder. When the driver is unbound, the
driver core runtime resumes the device and, through the runtime PM
device link, its IOMMU. hantro_remove() then asserts the resets, and
when the IOMMU autosuspends 100 ms later, vsi_iommu_suspend() writes to
its registers while they are held in reset, which raises an SError and
panics the system:

  SError Interrupt on CPU4, code 0x00000000be000411 -- SError
  Workqueue: pm pm_runtime_work
  Call trace:
   clk_disable+0x30/0x90 (P)
   clk_bulk_disable+0x44/0x90
   vsi_iommu_suspend+0x4c/0xc8 [vsi_iommu]
   pm_generic_runtime_suspend+0x38/0x80
   genpd_runtime_suspend+0xc4/0x348
   ...
  Kernel panic - not syncing: Asynchronous SError Interrupt

Hit when reloading the module.

Commit 8e26d4c20ed2 ("media: hantro: disable runtime PM before hardware
teardown") moved the assert after the runtime PM teardown because
powering the domain off faulted on it. With the resets left asserted,
the domain is still powered on for the next bind, and off after a
failed probe, in that state.

A runtime suspended VPU has its resets deasserted and its clocks off.
Leave it in that state on remove and on the probe error path instead of
asserting the resets.

Fixes: ea71631b7129 ("media: hantro: add support for reset lines")
Cc: stable@vger.kernel.org
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/hantro_drv.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 42822b2b376c..daec9f1ea968 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1214,7 +1214,7 @@ static int hantro_probe(struct platform_device *pdev)
 	ret = clk_bulk_prepare(vpu->variant->num_clocks, vpu->clocks);
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to prepare clocks\n");
-		goto err_pm_disable_assert_reset;
+		goto err_pm_disable;
 	}
 
 	ret = v4l2_device_register(&pdev->dev, &vpu->v4l2_dev);
@@ -1268,11 +1268,6 @@ static int hantro_probe(struct platform_device *pdev)
 	v4l2_device_unregister(&vpu->v4l2_dev);
 err_clk_unprepare:
 	clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
-err_pm_disable_assert_reset:
-	pm_runtime_dont_use_autosuspend(vpu->dev);
-	pm_runtime_disable(vpu->dev);
-	reset_control_assert(vpu->resets);
-	return ret;
 err_pm_disable:
 	pm_runtime_dont_use_autosuspend(vpu->dev);
 	pm_runtime_disable(vpu->dev);
@@ -1294,7 +1289,6 @@ static void hantro_remove(struct platform_device *pdev)
 	clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
 	pm_runtime_dont_use_autosuspend(vpu->dev);
 	pm_runtime_disable(vpu->dev);
-	reset_control_assert(vpu->resets);
 }
 
 static int hantro_runtime_resume(struct device *dev)

-- 
2.55.0

[PATCH v3 05/12] media: verisilicon: Enable the Rockchip encoder interrupt again after a reset

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

The reset operations of the Rockchip VEPU1 and VEPU2 encoders disable
the encoder interrupt before stopping the encoder. Nothing enables it
again: the encoder run functions don't write the interrupt register,
only the interrupt handler does. Every later job on the encoder then
times out as well.

Clear the interrupt register at the end of the reset, as the interrupt
handler does after each frame.

Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/rockchip_vpu_hw.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
index 02673be9878e..ce3dbea70a8d 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
@@ -475,6 +475,8 @@ static void rockchip_vpu1_enc_reset(struct hantro_ctx *ctx)
 	vepu_write(vpu, H1_REG_INTERRUPT_DIS_BIT, H1_REG_INTERRUPT);
 	vepu_write(vpu, 0, H1_REG_ENC_CTRL);
 	vepu_write(vpu, 0, H1_REG_AXI_CTRL);
+	/* Only the interrupt handler writes this register: enable the interrupt again. */
+	vepu_write(vpu, 0, H1_REG_INTERRUPT);
 }
 
 static void rockchip_vpu2_dec_reset(struct hantro_ctx *ctx)
@@ -493,6 +495,8 @@ static void rockchip_vpu2_enc_reset(struct hantro_ctx *ctx)
 	vepu_write(vpu, VEPU_REG_INTERRUPT_DIS_BIT, VEPU_REG_INTERRUPT);
 	vepu_write(vpu, 0, VEPU_REG_ENCODE_START);
 	vepu_write(vpu, 0, VEPU_REG_AXI_CTRL);
+	/* Only the interrupt handler writes this register: enable the interrupt again. */
+	vepu_write(vpu, 0, VEPU_REG_INTERRUPT);
 }
 
 /*

-- 
2.55.0

[PATCH v3 06/12] media: verisilicon: Reset the Rockchip encoder cores on timeout

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

On a job timeout, the Rockchip VEPU1 and VEPU2 reset operations mask the
interrupt and clear the encode enable and AXI control registers. On
RK3588, when a VEPU121 core reads an IOVA that isn't mapped, the IOMMU
reports a page fault and the core never becomes idle again: its AXI
transactions stay outstanding, the IOMMU can't be stalled anymore
("Enable stall request timed out", then "Disable paging request timed
out" on runtime suspend), and every later job times out as well.

Pulse the optional reset lines in the encoder reset operations, after
stopping the core through its registers, as the Rockchip BSP MPP driver
does. The job that timed out still holds the clocks. Nothing changes
for device trees without the resets.

Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 .../media/platform/verisilicon/rockchip_vpu_hw.c   | 28 ++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
index ce3dbea70a8d..1467ae2bed1a 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/delay.h>
 
 #include "hantro.h"
 #include "hantro_jpeg.h"
@@ -468,6 +469,31 @@ static void rk3066_vpu_dec_reset(struct hantro_ctx *ctx)
 	vdpu_write(vpu, G1_REG_CONFIG_DEC_CLK_GATE_E, G1_REG_CONFIG);
 }
 
+/*
+ * A core stuck on the bus, e.g. after an IOMMU fault, can't be stopped
+ * through its registers and keeps the IOMMU from stalling. Pulse its reset
+ * lines, if any.
+ */
+static void rockchip_vpu_enc_hw_reset(struct hantro_dev *vpu)
+{
+	int ret;
+
+	if (!vpu->resets)
+		return;
+
+	ret = reset_control_assert(vpu->resets);
+	if (ret) {
+		dev_warn(vpu->dev, "Failed to assert resets: %d\n", ret);
+		return;
+	}
+
+	udelay(5);
+
+	ret = reset_control_deassert(vpu->resets);
+	if (ret)
+		dev_err(vpu->dev, "Failed to deassert resets: %d\n", ret);
+}
+
 static void rockchip_vpu1_enc_reset(struct hantro_ctx *ctx)
 {
 	struct hantro_dev *vpu = ctx->dev;
@@ -475,6 +501,7 @@ static void rockchip_vpu1_enc_reset(struct hantro_ctx *ctx)
 	vepu_write(vpu, H1_REG_INTERRUPT_DIS_BIT, H1_REG_INTERRUPT);
 	vepu_write(vpu, 0, H1_REG_ENC_CTRL);
 	vepu_write(vpu, 0, H1_REG_AXI_CTRL);
+	rockchip_vpu_enc_hw_reset(vpu);
 	/* Only the interrupt handler writes this register: enable the interrupt again. */
 	vepu_write(vpu, 0, H1_REG_INTERRUPT);
 }
@@ -495,6 +522,7 @@ static void rockchip_vpu2_enc_reset(struct hantro_ctx *ctx)
 	vepu_write(vpu, VEPU_REG_INTERRUPT_DIS_BIT, VEPU_REG_INTERRUPT);
 	vepu_write(vpu, 0, VEPU_REG_ENCODE_START);
 	vepu_write(vpu, 0, VEPU_REG_AXI_CTRL);
+	rockchip_vpu_enc_hw_reset(vpu);
 	/* Only the interrupt handler writes this register: enable the interrupt again. */
 	vepu_write(vpu, 0, VEPU_REG_INTERRUPT);
 }

-- 
2.55.0

[PATCH v3 07/12] media: verisilicon: Reinitialize the IOMMU after resetting an encoder core

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

A Rockchip encoder core that faulted on an unmapped IOVA leaves its
IOMMU with the fault pending, and the reset pulse of the previous patch
can reset the IOMMU behind its driver. The IOMMU is only reprogrammed
on runtime resume, which doesn't happen between back-to-back jobs.

Do like rkvdec: allocate an empty paging domain at probe and, after the
reset pulse, attach and detach it. The IOMMU driver reprograms the
IOMMU on each domain change, and the default domain keeps its mappings.

Only do this for a device with reset lines whose domain is a DMA
domain. If the attach fails, the IOMMU may be left without translation
(rockchip-iommu falls back to its identity domain), so refuse all
further jobs.

Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/hantro.h        |  5 ++
 drivers/media/platform/verisilicon/hantro_drv.c    | 62 ++++++++++++++++++++++
 drivers/media/platform/verisilicon/hantro_hw.h     |  1 +
 .../media/platform/verisilicon/rockchip_vpu_hw.c   |  6 ++-
 4 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/verisilicon/hantro.h b/drivers/media/platform/verisilicon/hantro.h
index 0353de154a1e..e3881ca21c56 100644
--- a/drivers/media/platform/verisilicon/hantro.h
+++ b/drivers/media/platform/verisilicon/hantro.h
@@ -193,6 +193,9 @@ hantro_vdev_to_func(struct video_device *vdev)
  *			shared with interrupt handlers.
  * @variant:		Hardware variant-specific parameters.
  * @watchdog_work:	Delayed work for hardware timeout handling.
+ * @empty_domain:	Empty IOMMU domain, used to reinitialize the IOMMU after
+ *			a reset of the core. NULL if not needed.
+ * @iommu_lost:		The IOMMU couldn't be reinitialized, no job can run.
  */
 struct hantro_dev {
 	struct v4l2_device v4l2_dev;
@@ -213,6 +216,8 @@ struct hantro_dev {
 	spinlock_t irqlock;
 	const struct hantro_variant *variant;
 	struct delayed_work watchdog_work;
+	struct iommu_domain *empty_domain;
+	bool iommu_lost;
 };
 
 /**
diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index daec9f1ea968..9bb4d1582622 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/iommu.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
@@ -113,6 +114,30 @@ void hantro_irq_done(struct hantro_dev *vpu,
 	}
 }
 
+/*
+ * Pulsing the reset lines of a core can reset its IOMMU behind the IOMMU
+ * driver. Attaching and detaching the empty domain makes the driver reprogram
+ * it; the default domain keeps its mappings. A failed attach may leave the
+ * IOMMU without translation, so no further job may run.
+ */
+void hantro_iommu_restore(struct hantro_dev *vpu)
+{
+	int ret;
+
+	if (!vpu->empty_domain)
+		return;
+
+	ret = iommu_attach_device(vpu->empty_domain, vpu->dev);
+	if (ret) {
+		dev_err(vpu->dev, "Failed to reinitialize the IOMMU (%d), refusing further jobs\n",
+			ret);
+		vpu->iommu_lost = true;
+		return;
+	}
+
+	iommu_detach_device(vpu->empty_domain, vpu->dev);
+}
+
 void hantro_watchdog(struct work_struct *work)
 {
 	struct hantro_dev *vpu;
@@ -175,6 +200,9 @@ static void device_run(void *priv)
 	src = hantro_get_src_buf(ctx);
 	dst = hantro_get_dst_buf(ctx);
 
+	if (unlikely(vpu->iommu_lost))
+		goto err_cancel_job;
+
 	ret = pm_runtime_resume_and_get(vpu->dev);
 	if (ret < 0)
 		goto err_cancel_job;
@@ -1074,6 +1102,36 @@ static struct v4l2_m2m_dev *hantro_get_v4l2_m2m_dev(struct hantro_dev *vpu)
 	return v4l2_m2m_init(&vpu_m2m_ops);
 }
 
+static void hantro_free_empty_domain(void *data)
+{
+	iommu_domain_free(data);
+}
+
+static int hantro_alloc_empty_domain(struct hantro_dev *vpu)
+{
+	struct iommu_domain *domain;
+
+	/*
+	 * Only needed if the core can be reset, and only possible with a DMA
+	 * domain to return to.
+	 */
+	if (!vpu->resets)
+		return 0;
+
+	domain = iommu_get_domain_for_dev(vpu->dev);
+	if (!domain || !iommu_is_dma_domain(domain))
+		return 0;
+
+	domain = iommu_paging_domain_alloc(vpu->dev);
+	if (IS_ERR(domain))
+		return PTR_ERR(domain);
+
+	vpu->empty_domain = domain;
+
+	return devm_add_action_or_reset(vpu->dev, hantro_free_empty_domain,
+					domain);
+}
+
 static int hantro_probe(struct platform_device *pdev)
 {
 	struct hantro_dev *vpu;
@@ -1134,6 +1192,10 @@ static int hantro_probe(struct platform_device *pdev)
 	if (IS_ERR(vpu->resets))
 		return PTR_ERR(vpu->resets);
 
+	ret = hantro_alloc_empty_domain(vpu);
+	if (ret)
+		return ret;
+
 	num_bases = vpu->variant->num_regs ?: 1;
 	vpu->reg_bases = devm_kcalloc(&pdev->dev, num_bases,
 				      sizeof(*vpu->reg_bases), GFP_KERNEL);
diff --git a/drivers/media/platform/verisilicon/hantro_hw.h b/drivers/media/platform/verisilicon/hantro_hw.h
index 13e573f1f19d..aa610dd5beef 100644
--- a/drivers/media/platform/verisilicon/hantro_hw.h
+++ b/drivers/media/platform/verisilicon/hantro_hw.h
@@ -427,6 +427,7 @@ extern const struct hantro_postproc_ops rockchip_vpu981_postproc_ops;
 extern const u32 hantro_vp8_dec_mc_filter[8][6];
 
 void hantro_watchdog(struct work_struct *work);
+void hantro_iommu_restore(struct hantro_dev *vpu);
 void hantro_irq_done(struct hantro_dev *vpu,
 		     enum vb2_buffer_state result);
 void hantro_start_prepare_run(struct hantro_ctx *ctx);
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
index 1467ae2bed1a..113b6977031d 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
@@ -490,8 +490,12 @@ static void rockchip_vpu_enc_hw_reset(struct hantro_dev *vpu)
 	udelay(5);
 
 	ret = reset_control_deassert(vpu->resets);
-	if (ret)
+	if (ret) {
 		dev_err(vpu->dev, "Failed to deassert resets: %d\n", ret);
+		return;
+	}
+
+	hantro_iommu_restore(vpu);
 }
 
 static void rockchip_vpu1_enc_reset(struct hantro_ctx *ctx)

-- 
2.55.0

[PATCH v3 08/12] media: verisilicon: Acquire the reset lines only while using them

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

The RK3588 AV1 IOMMU has no reset lines of its own: it shares the four
AV1 resets with the decoder. Get them as released exclusive controls and
acquire them only around their use, so that the IOMMU driver can
deassert them too.

Suggested-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/media/platform/verisilicon/hantro_drv.c       | 10 ++++++++--
 drivers/media/platform/verisilicon/rockchip_vpu_hw.c  | 12 ++++++++++--
 drivers/media/platform/verisilicon/stm32mp25_vpu_hw.c |  4 ++++
 drivers/media/platform/verisilicon/sunxi_vpu_hw.c     |  4 ++++
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
index 9bb4d1582622..823be057e167 100644
--- a/drivers/media/platform/verisilicon/hantro_drv.c
+++ b/drivers/media/platform/verisilicon/hantro_drv.c
@@ -1188,7 +1188,9 @@ static int hantro_probe(struct platform_device *pdev)
 			return PTR_ERR(vpu->clocks[0].clk);
 	}
 
-	vpu->resets = devm_reset_control_array_get_optional_exclusive(&pdev->dev);
+	/* Released: the IOMMU of a core can share its reset lines. */
+	vpu->resets = devm_reset_control_array_get(&pdev->dev,
+						   RESET_CONTROL_OPTIONAL_EXCLUSIVE_RELEASED);
 	if (IS_ERR(vpu->resets))
 		return PTR_ERR(vpu->resets);
 
@@ -1267,7 +1269,11 @@ static int hantro_probe(struct platform_device *pdev)
 	pm_runtime_use_autosuspend(vpu->dev);
 	pm_runtime_enable(vpu->dev);
 
-	ret = reset_control_deassert(vpu->resets);
+	ret = reset_control_acquire(vpu->resets);
+	if (!ret) {
+		ret = reset_control_deassert(vpu->resets);
+		reset_control_release(vpu->resets);
+	}
 	if (ret) {
 		dev_err(&pdev->dev, "Failed to deassert resets\n");
 		goto err_pm_disable;
diff --git a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
index 113b6977031d..f1188a6435b1 100644
--- a/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu_hw.c
@@ -481,10 +481,16 @@ static void rockchip_vpu_enc_hw_reset(struct hantro_dev *vpu)
 	if (!vpu->resets)
 		return;
 
+	ret = reset_control_acquire(vpu->resets);
+	if (ret) {
+		dev_warn(vpu->dev, "Failed to acquire resets: %d\n", ret);
+		return;
+	}
+
 	ret = reset_control_assert(vpu->resets);
 	if (ret) {
 		dev_warn(vpu->dev, "Failed to assert resets: %d\n", ret);
-		return;
+		goto release;
 	}
 
 	udelay(5);
@@ -492,10 +498,12 @@ static void rockchip_vpu_enc_hw_reset(struct hantro_dev *vpu)
 	ret = reset_control_deassert(vpu->resets);
 	if (ret) {
 		dev_err(vpu->dev, "Failed to deassert resets: %d\n", ret);
-		return;
+		goto release;
 	}
 
 	hantro_iommu_restore(vpu);
+release:
+	reset_control_release(vpu->resets);
 }
 
 static void rockchip_vpu1_enc_reset(struct hantro_ctx *ctx)
diff --git a/drivers/media/platform/verisilicon/stm32mp25_vpu_hw.c b/drivers/media/platform/verisilicon/stm32mp25_vpu_hw.c
index 833821120b20..a16c43bdeb24 100644
--- a/drivers/media/platform/verisilicon/stm32mp25_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/stm32mp25_vpu_hw.c
@@ -115,7 +115,11 @@ static void stm32mp25_venc_reset(struct hantro_ctx *ctx)
 {
 	struct hantro_dev *vpu = ctx->dev;
 
+	if (reset_control_acquire(vpu->resets))
+		return;
+
 	reset_control_reset(vpu->resets);
+	reset_control_release(vpu->resets);
 }
 
 /*
diff --git a/drivers/media/platform/verisilicon/sunxi_vpu_hw.c b/drivers/media/platform/verisilicon/sunxi_vpu_hw.c
index 02ce8b064a8f..f15ead62dc96 100644
--- a/drivers/media/platform/verisilicon/sunxi_vpu_hw.c
+++ b/drivers/media/platform/verisilicon/sunxi_vpu_hw.c
@@ -91,7 +91,11 @@ static void sunxi_vpu_reset(struct hantro_ctx *ctx)
 {
 	struct hantro_dev *vpu = ctx->dev;
 
+	if (reset_control_acquire(vpu->resets))
+		return;
+
 	reset_control_reset(vpu->resets);
+	reset_control_release(vpu->resets);
 }
 
 static const struct hantro_codec_ops sunxi_vpu_codec_ops[] = {

-- 
2.55.0

[PATCH v3 09/12] dt-bindings: iommu: verisilicon: Add the reset lines

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

The RK3588 AV1 IOMMU is part of the AV1 block and has no reset lines
of its own: the four AV1 resets also cover it. Its registers can't be
accessed while they are asserted. Describe them.

Suggested-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 Documentation/devicetree/bindings/iommu/verisilicon,iommu.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/Documentation/devicetree/bindings/iommu/verisilicon,iommu.yaml b/Documentation/devicetree/bindings/iommu/verisilicon,iommu.yaml
index d3ce9e603b61..70df03102015 100644
--- a/Documentation/devicetree/bindings/iommu/verisilicon,iommu.yaml
+++ b/Documentation/devicetree/bindings/iommu/verisilicon,iommu.yaml
@@ -41,6 +41,13 @@ properties:
   power-domains:
     maxItems: 1
 
+  resets:
+    items:
+      - description: AXI reset line
+      - description: AXI bus interface unit reset line
+      - description: APB reset line
+      - description: APB bus interface unit reset line
+
 required:
   - compatible
   - reg
@@ -55,6 +62,7 @@ examples:
   - |
     #include <dt-bindings/clock/rockchip,rk3588-cru.h>
     #include <dt-bindings/interrupt-controller/arm-gic.h>
+    #include <dt-bindings/reset/rockchip,rk3588-cru.h>
 
     bus {
       #address-cells = <2>;
@@ -67,5 +75,7 @@ examples:
         clocks = <&cru ACLK_AV1>, <&cru PCLK_AV1>;
         clock-names = "core", "iface";
         #iommu-cells = <0>;
+        resets = <&cru SRST_A_AV1>, <&cru SRST_A_AV1_BIU>,
+                 <&cru SRST_P_AV1>, <&cru SRST_P_AV1_BIU>;
       };
     };

-- 
2.55.0

[PATCH v3 10/12] iommu/vsi: Deassert the reset lines on probe

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

The RK3588 AV1 IOMMU shares its reset lines with the decoder, and its
registers can't be accessed while they are asserted. It writes them on
attach, before the decoder's probe deasserts the resets.

Deassert the resets on probe. They are released exclusive controls,
acquired only for that, so the decoder can still use them.

Suggested-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 drivers/iommu/vsi-iommu.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/iommu/vsi-iommu.c b/drivers/iommu/vsi-iommu.c
index 5dac20b143a5..a3ec2fe5ecd5 100644
--- a/drivers/iommu/vsi-iommu.c
+++ b/drivers/iommu/vsi-iommu.c
@@ -33,6 +33,7 @@
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 
@@ -669,6 +670,7 @@ MODULE_DEVICE_TABLE(of, vsi_iommu_dt_ids);
 static int vsi_iommu_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
+	struct reset_control *resets;
 	struct vsi_iommu *iommu;
 	int err;
 
@@ -688,6 +690,20 @@ static int vsi_iommu_probe(struct platform_device *pdev)
 	if  (iommu->num_clocks < 0)
 		return iommu->num_clocks;
 
+	/* Shared with the decoder. */
+	resets = devm_reset_control_array_get(dev, RESET_CONTROL_OPTIONAL_EXCLUSIVE_RELEASED);
+	if (IS_ERR(resets))
+		return PTR_ERR(resets);
+
+	err = reset_control_acquire(resets);
+	if (err)
+		return err;
+
+	err = reset_control_deassert(resets);
+	reset_control_release(resets);
+	if (err)
+		return err;
+
 	err = clk_bulk_prepare(iommu->num_clocks, iommu->clocks);
 	if (err)
 		return err;

-- 
2.55.0

[PATCH v3 11/12] arm64: dts: rockchip: Add the reset lines of the RK3588 VEPU121 cores

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

Describe the AXI and AHB reset lines of the four VEPU121 JPEG encoder
cores, so that the driver can reset a core that is stuck after a fault
of its IOMMU.

The IOMMU of each core sits in the same register block and is clocked
by the same clocks, so these resets likely cover its bus interface as
well. This relies on the driver not leaving the VPU in reset after
remove ("media: verisilicon: Don't hold the VPU in reset after remove").

Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
index aa69fd3793fd..227465d446a2 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
@@ -1325,6 +1325,8 @@ vepu121_0: video-codec@fdba0000 {
 		clock-names = "aclk", "hclk";
 		iommus = <&vepu121_0_mmu>;
 		power-domains = <&power RK3588_PD_VDPU>;
+		resets = <&cru SRST_A_JPEG_ENCODER0>, <&cru SRST_H_JPEG_ENCODER0>;
+		reset-names = "axi", "ahb";
 	};
 
 	vepu121_0_mmu: iommu@fdba0800 {
@@ -1345,6 +1347,8 @@ vepu121_1: video-codec@fdba4000 {
 		clock-names = "aclk", "hclk";
 		iommus = <&vepu121_1_mmu>;
 		power-domains = <&power RK3588_PD_VDPU>;
+		resets = <&cru SRST_A_JPEG_ENCODER1>, <&cru SRST_H_JPEG_ENCODER1>;
+		reset-names = "axi", "ahb";
 	};
 
 	vepu121_1_mmu: iommu@fdba4800 {
@@ -1365,6 +1369,8 @@ vepu121_2: video-codec@fdba8000 {
 		clock-names = "aclk", "hclk";
 		iommus = <&vepu121_2_mmu>;
 		power-domains = <&power RK3588_PD_VDPU>;
+		resets = <&cru SRST_A_JPEG_ENCODER2>, <&cru SRST_H_JPEG_ENCODER2>;
+		reset-names = "axi", "ahb";
 	};
 
 	vepu121_2_mmu: iommu@fdba8800 {
@@ -1385,6 +1391,8 @@ vepu121_3: video-codec@fdbac000 {
 		clock-names = "aclk", "hclk";
 		iommus = <&vepu121_3_mmu>;
 		power-domains = <&power RK3588_PD_VDPU>;
+		resets = <&cru SRST_A_JPEG_ENCODER3>, <&cru SRST_H_JPEG_ENCODER3>;
+		reset-names = "axi", "ahb";
 	};
 
 	vepu121_3_mmu: iommu@fdbac800 {

-- 
2.55.0

[PATCH v3 12/12] arm64: dts: rockchip: Add the reset lines of the RK3588 AV1 IOMMU

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

The AV1 IOMMU shares the four AV1 resets with the decoder. Describe
them, so that its driver deasserts them before using its registers.

This needs the decoder to get them as released controls ("media:
verisilicon: Acquire the reset lines only while using them").

Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
 arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
index 227465d446a2..96898fefe840 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
@@ -1491,6 +1491,8 @@ av1d_mmu: iommu@fdca0000 {
 		clock-names = "core", "iface";
 		#iommu-cells = <0>;
 		power-domains = <&power RK3588_PD_AV1>;
+		resets = <&cru SRST_A_AV1>, <&cru SRST_A_AV1_BIU>,
+			 <&cru SRST_P_AV1>, <&cru SRST_P_AV1_BIU>;
 	};
 
 	vicap: video-capture@fdce0000 {

-- 
2.55.0