[PATCH v1 2/2] iommu/riscv: Do not report a stalled command queue as completed

[Yuho Choi]

Since commit b2e5684558ed ("iommu/riscv: Stop polling when CQCSR reports
an error"), riscv_iommu_queue_wait() stops polling when CQCSR has cqmf,
cmd_to or cmd_ill set, but then returns 0 as if the waited-for command
had been executed. The hardware stops processing the queue at the
faulting command, so an IOFENCE.C queued behind it has not completed,
yet riscv_iommu_iotlb_sync() goes on to free the page table pages.

Return -EIO when the queue stopped before reaching the waited-for entry,
and keep the "command execution timeout" message for real timeouts; the
interrupt handler already reports the CQCSR error bits.

Fixes: b2e5684558ed ("iommu/riscv: Stop polling when CQCSR reports an error")
Assisted-by: LLM
Signed-off-by: Yuho Choi <oss.patchbox at gmail.com>
---
This was found with a static analysis tool from ongoing, not yet
published research, and confirmed by code inspection. It has not been
reproduced on hardware or in an emulator.

 drivers/iommu/riscv/iommu.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/riscv/iommu.c b/drivers/iommu/riscv/iommu.c
index 816d50c0f508..2a95cb8c9e4c 100644
--- a/drivers/iommu/riscv/iommu.c
+++ b/drivers/iommu/riscv/iommu.c
@@ -371,15 +371,24 @@ static int riscv_iommu_queue_wait(struct riscv_iommu_queue *queue,
 	unsigned int cons = atomic_read(&queue->head);
 	unsigned int flags = RISCV_IOMMU_CQCSR_CQMF | RISCV_IOMMU_CQCSR_CMD_TO |
 			     RISCV_IOMMU_CQCSR_CMD_ILL;
+	int ret;
 
 	/* Already processed by the consumer */
 	if ((int)(cons - index) > 0)
 		return 0;
 
 	/* Monitor consumer index */
-	return readx_poll_timeout(riscv_iommu_queue_cons, queue, cons,
+	ret = readx_poll_timeout(riscv_iommu_queue_cons, queue, cons,
 				 (riscv_iommu_readl(queue->iommu, queue->qcr) & flags) ||
 				 (int)(cons - index) > 0, 0, timeout_us);
+	if (ret)
+		return ret;
+
+	/* The queue stopped on an error before it reached the item. */
+	if ((int)(cons - index) <= 0)
+		return -EIO;
+
+	return 0;
 }
 
 static int riscv_iommu_queue_wait_for_space(struct riscv_iommu_queue *queue,
@@ -531,7 +540,7 @@ static int riscv_iommu_cmd_sync(struct riscv_iommu_device *iommu,
 		return 0;
 
 	ret = riscv_iommu_queue_wait(&iommu->cmdq, prod, timeout_us);
-	if (ret)
+	if (ret == -ETIMEDOUT)
 		dev_err_once(iommu->dev,
 			     "Hardware error: command execution timeout\n");
 
-- 
2.43.0