From: Joerg Roedel <joerg.roedel-5C7GfCeVMHo@public.gmane.org>
Subject: OMAP and MSM IOMMU driver misbehavior
Date: Mon, 23 Jan 2012 15:03:55 +0100
Message-ID: <20120123140355.GA19255@amd.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Sender: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
Errors-To: iommu-bounces-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org
To: Ohad Ben-Cohen <ohad-Ix1uc/W3ht7QT0dZR+AlfA@public.gmane.org>, Stepan Moskovchenko <stepanm-sgV2jX0FEOL9JmXXK+q4OQ@public.gmane.org>, David Brown <davidb-sgV2jX0FEOL9JmXXK+q4OQ@public.gmane.org>
Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org

Hi,

while reviewing another IOMMU driver again I came across a problem in
the IOMMU drivers for OMAP and MSM platforms. In both drivers the
'domain_destroy with devices attached' case isn't handled correctly.

OMAP driver seems not to track the devices attached to a domain at all.
So when a domain is destroyed it can happen that the hardware still
references old (and already freed) page-table pointers.

MSM tracks devices in a domain, but does not automatically remove the
devices from a domain that is about to be destroyed.

Please tell me when I mis-read the code, otherwise please fix this in
your drivers so that we can get consistent behavior for IOMMU-API
users :-)

Thanks,

	Joerg

-- 
AMD Operating System Research Center

Advanced Micro Devices GmbH Einsteinring 24 85609 Dornach
General Managers: Alberto Bozzo
Registration: Dornach, Landkr. Muenchen; Registerger. Muenchen, HRB Nr. 43632