From: Yuho Choi <oss.patchbox@gmail.com>
To: Tomasz Jeznach <tomasz.jeznach@linux.dev>,
Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
Fangyu Yu <fangyu.yu@linux.alibaba.com>,
Zong Li <zong.li@sifive.com>, Lu Baolu <baolu.lu@linux.intel.com>,
Paul Walmsley <pjw@kernel.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Alexandre Ghiti <alex@ghiti.fr>,
iommu@lists.linux.dev, linux-riscv@lists.infradead.org,
linux-kernel@vger.kernel.org, Yuho Choi <oss.patchbox@gmail.com>
Subject: [PATCH v1 0/2] iommu/riscv: Keep page table pages when IOTLB invalidation fails
Date: Tue, 20 Oct 2026 01:34:22 -0400 [thread overview]
Message-ID: <20261020053435.1179054-4-oss.patchbox@gmail.com> (raw)
riscv_iommu_iotlb_sync() frees the page table pages on gather->freelist
without knowing whether the invalidation that should have removed the
cached references to them was queued and completed. Patch 1 makes the
command helpers report a failure and leaks the freelist in that case.
Patch 2 fixes riscv_iommu_queue_wait() reporting success when the
command queue stopped on an error before the IOFENCE.C ran, so that
patch 1 also catches that case.
Neither failure is expected on working hardware, but when one happens,
freeing the pages lets the IOMMU walk memory that has a new owner.
The pages that the dma-iommu flush queue frees after flush_iotlb_all()
and the data pages released by iommu_unmap() callers are not covered,
as the IOMMU core does not let those callbacks report a failure.
The issues were found with a static analysis tool from ongoing, not yet
published research, and confirmed by code inspection. Compile-tested
only (ARCH=riscv defconfig with RISCV_IOMMU=y, W=1, each patch).
Yuho Choi (2):
iommu/riscv: Keep page table pages when IOTLB invalidation fails
iommu/riscv: Do not report a stalled command queue as completed
drivers/iommu/riscv/iommu.c | 74 ++++++++++++++++++++++++++-----------
1 file changed, 53 insertions(+), 21 deletions(-)
base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
--
2.43.0
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
WARNING: multiple messages have this Message-ID (diff)
From: Yuho Choi <oss.patchbox@gmail.com>
To: Tomasz Jeznach <tomasz.jeznach@linux.dev>,
Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>,
Fangyu Yu <fangyu.yu@linux.alibaba.com>,
Zong Li <zong.li@sifive.com>, Lu Baolu <baolu.lu@linux.intel.com>,
Paul Walmsley <pjw@kernel.org>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Alexandre Ghiti <alex@ghiti.fr>,
iommu@lists.linux.dev, linux-riscv@lists.infradead.org,
linux-kernel@vger.kernel.org, Yuho Choi <oss.patchbox@gmail.com>
Subject: [PATCH v1 0/2] iommu/riscv: Keep page table pages when IOTLB invalidation fails
Date: Tue, 20 Oct 2026 01:34:22 -0400 [thread overview]
Message-ID: <20261020053435.1179054-4-oss.patchbox@gmail.com> (raw)
riscv_iommu_iotlb_sync() frees the page table pages on gather->freelist
without knowing whether the invalidation that should have removed the
cached references to them was queued and completed. Patch 1 makes the
command helpers report a failure and leaks the freelist in that case.
Patch 2 fixes riscv_iommu_queue_wait() reporting success when the
command queue stopped on an error before the IOFENCE.C ran, so that
patch 1 also catches that case.
Neither failure is expected on working hardware, but when one happens,
freeing the pages lets the IOMMU walk memory that has a new owner.
The pages that the dma-iommu flush queue frees after flush_iotlb_all()
and the data pages released by iommu_unmap() callers are not covered,
as the IOMMU core does not let those callbacks report a failure.
The issues were found with a static analysis tool from ongoing, not yet
published research, and confirmed by code inspection. Compile-tested
only (ARCH=riscv defconfig with RISCV_IOMMU=y, W=1, each patch).
Yuho Choi (2):
iommu/riscv: Keep page table pages when IOTLB invalidation fails
iommu/riscv: Do not report a stalled command queue as completed
drivers/iommu/riscv/iommu.c | 74 ++++++++++++++++++++++++++-----------
1 file changed, 53 insertions(+), 21 deletions(-)
base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
--
2.43.0
next reply other threads:[~2026-10-20 5:35 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-20 5:34 Yuho Choi [this message]
2026-10-20 5:34 ` [PATCH v1 0/2] iommu/riscv: Keep page table pages when IOTLB invalidation fails Yuho Choi
2026-10-20 5:34 ` [PATCH v1 1/2] " Yuho Choi
2026-10-20 5:34 ` Yuho Choi
2026-10-20 5:34 ` [PATCH v1 2/2] iommu/riscv: Do not report a stalled command queue as completed Yuho Choi
2026-10-20 5:34 ` Yuho Choi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261020053435.1179054-4-oss.patchbox@gmail.com \
--to=oss.patchbox@gmail.com \
--cc=alex@ghiti.fr \
--cc=aou@eecs.berkeley.edu \
--cc=baolu.lu@linux.intel.com \
--cc=fangyu.yu@linux.alibaba.com \
--cc=iommu@lists.linux.dev \
--cc=joro@8bytes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=palmer@dabbelt.com \
--cc=pjw@kernel.org \
--cc=robin.murphy@arm.com \
--cc=tomasz.jeznach@linux.dev \
--cc=will@kernel.org \
--cc=zong.li@sifive.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.