Re: [PATCH v5 07/18] iommu/arm-smmu-v3: Mark ATC invalidate timeouts via lockless bitmap

[sashiko-bot@kernel.org]

> An ATC invalidation timeout is a fatal error. While the SMMUv3 hardware is
> aware of the timeout via a GERROR interrupt, the driver thread issuing the
> commands lacks a direct mechanism to verify whether its specific batch was
> the cause or not, as polling the CMD_SYNC status doesn't natively return a
> failure code, making it very difficult to coordinate per-device recovery.
> 
> Introduce an atc_sync_timeouts bitmap in the cmdq structure to bridge this
> gap. When the ISR detects an ATC timeout, set the bit corresponding to the
> physical CMDQ index of the faulting CMD_SYNC command.
> 
> On the issuer side, after polling completes (or times out), test and clear
> its dedicated bit. If set, return -EIO to trigger device quarantine. This
> reader site tests with a plain test_bit() first and clear_bit() only when
> the bit is set, sparing the shared cache line an atomic RMW in the common
> no-timeout case. An smp_rmb() ahead of the issuer-side test orders it after
> the completion poll, which may observe the completion using a relaxed load
> that would otherwise allow this bitmap read to be hoisted over it.
> 
> When inserting a CMD_SYNC, clear any stale bit left in its slot by a prior
> wraparound, before the slot becomes visible to the SMMU, so that the GERROR
> ISR can only set the bit for the new CMD_SYNC.
> 
> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1783044582.git.nicolinc@nvidia.com?part=7