On Fri, Jul 17, 2026 at 04:45:25PM +0200, Andrew Jones wrote:
> b18e3f0e2d0f fixed spa_fetch() faults whose TTYP used the leaf PTE
> permission instead of the original request permission. However, it kept
> that request-narrowed value in iotlb->perm after a successful walk, and
> riscv_iommu_translate() caches iotlb->perm for later accesses to the same
> IOVA.
>
> That means a write to an RW mapping can cache the entry as write-only.
> A later read then hits the cache and faults even though the mapping allows
> it, which showed up in NVMe testing as bogus completions and controller
> timeouts.
>
> Keep the requested permission in a separate req_perm and use it for all
> permission checks and fault-type decisions. Accumulate the leaf
> permissions separately and copy them to iotlb->perm only after the full
> walk succeeds, so cached entries describe the mapping rather than the
> current request. Since faults leave iotlb->perm as the original request,
> the S-stage and G-stage TTYP fixes remain intact.
>
> Fixes: b18e3f0e2d0f ("hw/riscv/riscv-iommu.c: fix fault type for spa_fetch()
> faults")
> Signed-off-by: Andrew Jones <[email protected]>
> ---
> hw/riscv/riscv-iommu.c | 50 ++++++++++++++++++++++++------------------
> 1 file changed, 29 insertions(+), 21 deletions(-)
>
Based-on: [email protected]
Thanks,
drew
