Re: [PATCH v4 3/7] iommu/arm-smmu-v3: Introduce a per-domain arm_smmu_invs array

[Jason Gunthorpe <jgg@nvidia.com>]

On Mon, Oct 27, 2025 at 11:54:17AM -0700, Nicolin Chen wrote:
> +struct arm_smmu_invs *arm_smmu_invs_merge(struct arm_smmu_invs *invs,
> +					  struct arm_smmu_invs *to_merge)
> +{
> +	struct arm_smmu_invs *new_invs;
> +	struct arm_smmu_inv *new;
> +	size_t num_trashes = 0;
> +	size_t num_adds = 0;
> +	size_t i, j;
> +
> +	for (i = j = 0; i != invs->num_invs || j != to_merge->num_invs;) {
> +		int cmp = arm_smmu_invs_cmp(invs, i, to_merge, j);
> +
> +		/* Skip any unwanted trash entry */
> +		if (cmp < 0 && !refcount_read(&invs->inv[i].users)) {

Do we need cmp < 0 here and in all these other similar ifs? Can't we
just fully ignore trash entries no matter how they cmopare to the
other list?

If cmp ==0 and we do num_trash++ then the next iteration will see j
ass cmp > 1 so it will do num_adds++ and the two will cancel out.

> +			num_trashes++;
> +			i++;
> +			continue;
> +		}
> +
> +		if (cmp < 0) {
> +			/* not found in to_merge, leave alone */
> +			i++;
> +		} else if (cmp == 0) {
> +			/* same item */
> +			i++;
> +			j++;
> +		} else {
> +			/* unique to to_merge */
> +			num_adds++;
> +			j++;
> +		}
> +	}
> +
> +	new_invs = arm_smmu_invs_alloc(invs->num_invs - num_trashes + num_adds);
> +	if (IS_ERR(new_invs))
> +		return new_invs;
> +
> +	new = new_invs->inv;
> +	for (i = j = 0; i != invs->num_invs || j != to_merge->num_invs;) {
> +		int cmp = arm_smmu_invs_cmp(invs, i, to_merge, j);
> +
> +		if (cmp <= 0 && !refcount_read(&invs->inv[i].users)) {
> +			i++;
> +			continue;
> +		}
> +
> +		if (cmp < 0) {
> +			*new = invs->inv[i];
> +			i++;
> +		} else if (cmp == 0) {
> +			*new = invs->inv[i];
> +			refcount_inc(&new->users);
> +			i++;
> +			j++;
> +		} else {
> +			*new = to_merge->inv[j];
> +			refcount_set(&new->users, 1);
> +			j++;
> +		}
> +
> +		if (new != new_invs->inv)
> +			WARN_ON_ONCE(arm_smmu_inv_cmp(new - 1, new) == 1);

I'd add a little comment here:

   Check that the resulting list is sorted, this also checks that
   to_merge is sorted.


> static inline void arm_smmu_domain_free(struct arm_smmu_domain *smmu_domain)
> {
> +       kfree_rcu(rcu_dereference_protected(smmu_domain->invs, true), rcu);

It is working as is, but maybe a small comment

 No concurrency with invalidation is possible at this point

And you can just use kfree instead of kfree_rcu.

When the domain is destroyed the caller has to guarentee it isn't
calling map/unmap/etc anymore from any parallel threds or it will
UAF. So we know there can be, and will never be, no concurrent read
side cricitical regions on the RCU.

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason