[PATCH v4 04/15] iommu/arm-smmu-v3: Drain in-flight fault events on domain detach

[Jonathan Cameron]

> When a device leaves a domain, fault events for the old domain may remain
> in the SMMU event queue or the IOPF workqueue. If the IOMMU core frees that
> domain before those events are handled, the work may use freed memory.
> 
> Start with the hardware queue by using arm_smmu_wait_for_queue_drained() to
> count entries consumed by the threaded IRQ handler, and poll the EVTQ when
> an IOPF-enabled attachment ends. This prevents a pending IRQ from queuing
> old-domain work after the drain. Its until_empty mode can drain the CMDQ as
> well during suspend and runtime PM.
> 
> queue_poll() cannot be used because it is an atomic busy-wait that expects
> hardware to consume entries. The EVTQ and PRIQ are drained by threaded IRQ
> handlers, so a busy-wait could starve a handler sharing the same CPU on a
> non-preemptible kernel. The new helper sleeps, and might_sleep() catches an
> atomic-context caller even when the queue is already empty.
> 
> Note that a drained event is dequeued, but not necessarily handled, since
> queue_remove_raw() moves the MMIO CONS before the threaded IRQ handler gets
> to push the event onto the IOPF workqueue. A subsequent change will invoke
> synchronize_irq() and iopf_queue_flush_dev() to close that gap, and it will
> act on the errno of a timed-out drain too.
> 
> Fixes: cfea71aea921 ("iommu/arm-smmu-v3: Put iopf enablement in the domain attach path")
> Cc: stable at vger.kernel.org # v6.16
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Nicolin Chen <nicolinc at nvidia.com>

Nice - I always like patches with diagrams ;)

Reviewed-by: Jonathan Cameron <jonathan.cameron at oss.qualcomm.com>

-- 
Jonathan Cameron <jonathan.cameron at oss.qualcomm.com>