Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Lu Baolu <baolu.lu@linux.intel.com>
To:     Jason Gunthorpe <jgg@ziepe.ca>, Kevin Tian <kevin.tian@intel.com>,
        Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>,
        Robin Murphy <robin.murphy@arm.com>,
        Jean-Philippe Brucker <jean-philippe@linaro.org>,
        Nicolin Chen <nicolinc@nvidia.com>,
        Yi Liu <yi.l.liu@intel.com>,
        Jacob Pan <jacob.jun.pan@linux.intel.com>
Cc:     iommu@lists.linux.dev, linux-kselftest@vger.kernel.org,
        virtualization@lists.linux-foundation.org,
        linux-kernel@vger.kernel.org, Lu Baolu <baolu.lu@linux.intel.com>
Subject: [RFC PATCHES 14/17] iommufd: Drain all pending faults when destroying hwpt
Date:   Tue, 30 May 2023 13:37:21 +0800
Message-Id: <20230530053724.232765-15-baolu.lu@linux.intel.com>
In-Reply-To: <20230530053724.232765-1-baolu.lu@linux.intel.com>
References: <20230530053724.232765-1-baolu.lu@linux.intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

When a HWPT is unexpectedly destroyed, drain all faults in the pending
lists. It is safe because the iommu domain has been released and there
will never be new io page faults anymore.

Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
---
 drivers/iommu/iommufd/hw_pagetable.c | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/iommufd/hw_pagetable.c b/drivers/iommu/iommufd/hw_pagetable.c
index 8c441fd72e1f..7f18e6bd76ec 100644
--- a/drivers/iommu/iommufd/hw_pagetable.c
+++ b/drivers/iommu/iommufd/hw_pagetable.c
@@ -574,11 +574,26 @@ static struct hw_pgtable_fault *hw_pagetable_fault_alloc(int eventfd)
 	return ERR_PTR(rc);
 }
 
+static void iommufd_fault_list_destroy(struct hw_pgtable_fault *fault,
+				       struct list_head *list)
+{
+	struct iommufd_fault *ifault;
+
+	mutex_lock(&fault->mutex);
+	while (!list_empty(list)) {
+		ifault = list_first_entry(list, struct iommufd_fault, item);
+		if (iommufd_fault_timer_teardown(ifault))
+			drain_iopf_fault(ifault);
+		list_del_init(&ifault->item);
+		iommufd_put_fault(ifault);
+	}
+	mutex_unlock(&fault->mutex);
+}
+
 static void hw_pagetable_fault_free(struct hw_pgtable_fault *fault)
 {
-	WARN_ON(!list_empty(&fault->deliver));
-	WARN_ON(!list_empty(&fault->response));
-
+	iommufd_fault_list_destroy(fault, &fault->deliver);
+	iommufd_fault_list_destroy(fault, &fault->response);
 	eventfd_ctx_put(fault->trigger);
 	kfree(fault);
 }
-- 
2.34.1