Re: [PATCH v1 2/2] iommu/arm-smmu-v3: Recover ATC invalidate timeouts

Robin Murphy
2026-03-06T15:24:26Z

On 2026-03-05 11:52 pm, Jason Gunthorpe wrote:
> On Thu, Mar 05, 2026 at 01:06:21PM -0800, Nicolin Chen wrote:
>> That sounds like the IOPF implementation. Maybe inventing another
>> IOMMU_FAULT_ATC_TIMEOUT to reuse the existing infrastructure would
>> make things cleaner.
>
> I think the routing is quite different, IOPF wants to route an event
> the domain creator, here you want to route an event to the IOMMU core
> then the PCIe RAS callbacks.
>
> IDK if there is much to be reused there, especially since IOPF
> requires a memory allocation and ideally we should not be allocating
> memory to resolve this critical error condition.

Yeah, sorry, for a moment there I somehow forgot that we can expect to
use ATS without PRI, so indeed tying this to IOPF wouldn't be
appropriate. And given the general difficulty of trying to infer what
went wrong and what to do from the CMDQ contents alone, I do like your
idea of trying to return a new kind of sync failure back to
arm_smmu_atc_inv_{master,domain}() so that we can take any defensive
action from there, with all the information to hand. We'd just have to
ensure that if a large set of ATCI commands needs to span multiple
batches, every batch must contain its own sync (since if some other
batch of unrelated commands could get interleaved in the middle and
issue a sync that then fails due to someone else's ATC timeout,
everything's likely to get confused and go wrong).

The fiddly thing then is that we might also have to be prepared to
"handle" CMD_SYNC timeout by manually checking for GERRORs, in case the
whole invalidation is in the context of an dma_unmap within some other
device's IRQ handler, which happens to be on the same CPU where the
GERROR IRQ is now pending, but can't be taken until we can complete the
inv and return out of the current IRQ :/

Thanks,
Robin.