iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout
authorZhen Lei <thunder.leizhen@huawei.com>
Sun, 19 Aug 2018 07:51:10 +0000 (15:51 +0800)
committerWill Deacon <will.deacon@arm.com>
Mon, 1 Oct 2018 12:01:30 +0000 (13:01 +0100)
commit0f02477d16980938a84aba8688a4e3a303306116
treeb56b2730a54ece3940ce9a735a62c9730d63c7bf
parent85c7a0f1ef624ef58173ef52ea77780257bdfe04
iommu/arm-smmu-v3: Fix unexpected CMD_SYNC timeout

The condition break condition of:

(int)(VAL - sync_idx) >= 0

in the __arm_smmu_sync_poll_msi() polling loop requires that sync_idx
must be increased monotonically according to the sequence of the CMDs in
the cmdq.

However, since the msidata is populated using atomic_inc_return_relaxed()
before taking the command-queue spinlock, then the following scenario
can occur:

CPU0 CPU1
msidata=0
msidata=1
insert cmd1
insert cmd0
smmu execute cmd1
smmu execute cmd0
poll timeout, because msidata=1 is overridden by
cmd0, that means VAL=0, sync_idx=1.

This is not a functional problem, since the caller will eventually either
timeout or exit due to another CMD_SYNC, however it's clearly not what
the code is supposed to be doing. Fix it, by incrementing the sequence
count with the command-queue lock held, allowing us to drop the atomic
operations altogether.

Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
[will: dropped the specialised cmd building routine for now]
Signed-off-by: Will Deacon <will.deacon@arm.com>
drivers/iommu/arm-smmu-v3.c