Re: [PATCH v3 03/13] iommu/arm-smmu-v3: Drain in-flight fault events on domain detach

[Nicolin Chen <nicolinc@nvidia.com>]

On Fri, Sep 04, 2026 at 11:09:06AM -0300, Jason Gunthorpe wrote:
> On Thu, Sep 03, 2026 at 12:18:33PM -0700, Jonathan Cameron wrote:
> > > Also run the drain for every stall-capable master, even when the departing
> > > attachment did not enable IOPF: such a stall event has to be aborted while
> > > it still resolves to the old attach handle, 
> 
> That isn't the model for fault handling. The fault is delivered
> unpredictably into either old or new domain. It doesn't matter which
> one.
> 
> Domains have to conclude their fault proceessing before they are
> destroyed, and attach to the a non-fault domain has to conclude faults
> before completing the attach.
> 
> But there is no requirement to deliver faults to any particular thing.

Edited:

Also run the drain for every stall-capable master, even when the departing
attachment did not enable IOPF. An attachment has to conclude its in-flight
faults before the attach completes, as the incoming domain might not handle
a fault at all.

> > > could pick it up right after the handle swap, mistakenly resuming it as if
> > > it were a valid page fault against a new domain.
> > 
> > Useful perhaps to call out if this has been seen in real systems or
> > not. I agree with the analysis but would rather hope drivers are
> > well behaved in ensuring all traffic is done, adn this is hardeninging
> > / handling of naught hardware activity (all good if so!)
> 
> There is a firm API contract on the iommu drivers, they cannot
> propogate faults at unexpected times because the consumers cannot deal
> with it.
> 
> We don't reason about well behaved drivers at this level because vfio
> cannot be trusted to be well behaved. So any nonsense vfio can trigger
> has to be handled without crashing the kernel.

Added:

This is an API contract, not hardening against odd hardware: a detach may
arrive at any moment from a userspace driver behind VFIO, which cannot be
trusted to quiesce its device first.

Thanks
Nicolin