[PATCH v1 1/2] iommu/riscv: Keep page table pages when IOTLB invalidation fails

[Jason Gunthorpe]

On Tue, Oct 20, 2026 at 01:34:23AM -0400, Yuho Choi wrote:
> riscv_iommu_iotlb_sync() frees the page table pages on gather->freelist
> right after riscv_iommu_iotlb_inval(), which does not report whether the
> invalidation commands could be queued or whether IOFENCE.C completed.
> If either fails, the pages go back to the page allocator while the IOMMU
> may still hold cached entries pointing to them, and whatever their next
> owner writes there can then be walked as page table entries.

Invalidation is not allowed to fail. Drivers always have to free the
pages.

The system is irrecoverably broken if the iommu driver blows up so
much it cannot invalidate.

Jason