[PATCH v2 00/11] iommu/tegra241-cmdqv: Fix error-interrupt races and VINTF lifecycle bugs

[Nicolin Chen]

On Tue, Jul 14, 2026 at 01:54:57PM -0700, Nicolin Chen wrote:
> False positives raised by Sashiko:
>   - a viommu outliving an SMMU unbind and touching freed memory on close: a
>     physical IOMMU is not a pluggable device, so iommufd holds no reference
>     on the one behind a viommu, and this teardown cannot arise.
>   - the ISR running after cmdqv is freed on probe failure: free_irq() runs
>     first from tegra241_cmdqv_remove(), the devm device_remove action,
>     which devres invokes before the cmdqv allocation is released.
>   - a guest never acking its VCMDQ error wedging the shared interrupt: the
>     interrupt is edge-signaled per event, and the host ISR only snapshots
>     the error map into the guest's bounded vEVENTQ, never depending on a
>     guest-side GERRORN ack.
>   - the ISR accessing a de-assigned LVCMDQ page after a VINTF hw_init()
>     failure: the page remains a mapped MMIO region backed by empty
>     registers, so reads are benign and writes are dropped.

Adding one more false positive:

Sashiko reported against this v2 a critical issue stating that
CMDQV is level-triggered and could cause trouble in kdump case.

But CMDQV is edge-triggered; one of the ISR patches noted very
clearly.

Nicolin