[PATCH v1 0/2] iommu/riscv: Keep page table pages when IOTLB invalidation fails

[Yuho Choi]

riscv_iommu_iotlb_sync() frees the page table pages on gather->freelist
without knowing whether the invalidation that should have removed the
cached references to them was queued and completed. Patch 1 makes the
command helpers report a failure and leaks the freelist in that case.
Patch 2 fixes riscv_iommu_queue_wait() reporting success when the
command queue stopped on an error before the IOFENCE.C ran, so that
patch 1 also catches that case.

Neither failure is expected on working hardware, but when one happens,
freeing the pages lets the IOMMU walk memory that has a new owner.

The pages that the dma-iommu flush queue frees after flush_iotlb_all()
and the data pages released by iommu_unmap() callers are not covered,
as the IOMMU core does not let those callbacks report a failure.

The issues were found with a static analysis tool from ongoing, not yet
published research, and confirmed by code inspection. Compile-tested
only (ARCH=riscv defconfig with RISCV_IOMMU=y, W=1, each patch).

Yuho Choi (2):
  iommu/riscv: Keep page table pages when IOTLB invalidation fails
  iommu/riscv: Do not report a stalled command queue as completed

 drivers/iommu/riscv/iommu.c | 74 ++++++++++++++++++++++++++-----------
 1 file changed, 53 insertions(+), 21 deletions(-)


base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.43.0