[PATCH 0/2] [PULL REQUEST] iommu/vt-d: Fixes for v7.0-rc

[PATCH 0/2] [PULL REQUEST] iommu/vt-d: Fixes for v7.0-rc

[Lu Baolu]

Hi Joerg,

The following fixes have been queued for v7.0-rc. They aim to fix the
following issues.

- Abort all pending requests on dev_tlb_inv timeout to avoid hardlockup
- Limit IOPF handling to PRI-capable device to avoid SVA attach failure

These patches have been reviewed and tested and are ready for merge.
Please consider them for v7.0-rc.

Best regards,
baolu

Guanghui Feng (1):
  iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry

Lu Baolu (1):
  iommu/vt-d: Only handle IOPF for SVA when PRI is supported

 drivers/iommu/intel/dmar.c |  3 +--
 drivers/iommu/intel/svm.c  | 12 ++++++++----
 2 files changed, 9 insertions(+), 6 deletions(-)

-- 
2.43.0

[PATCH 1/2] iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry

[Lu Baolu]

From: Guanghui Feng <guanghuifeng@linux.alibaba.com>

During the qi_check_fault process after an IOMMU ITE event, requests at
odd-numbered positions in the queue are set to QI_ABORT, only satisfying
single-request submissions. However, qi_submit_sync now supports multiple
simultaneous submissions, and can't guarantee that the wait_desc will be
at an odd-numbered position. Therefore, if an item times out, IOMMU can't
re-initiate the request, resulting in an infinite polling wait.

This modifies the process by setting the status of all requests already
fetched by IOMMU and recorded as QI_IN_USE status (including wait_desc
requests) to QI_ABORT, thus enabling multiple requests to be resubmitted.

Fixes: 8a1d82462540 ("iommu/vt-d: Multiple descriptors per qi_submit_sync()")
Cc: stable@vger.kernel.org
Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Tested-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Link: https://lore.kernel.org/r/20260306101516.3885775-1-guanghuifeng@linux.alibaba.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
---
 drivers/iommu/intel/dmar.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
index d68c06025cac..69222dbd2af0 100644
--- a/drivers/iommu/intel/dmar.c
+++ b/drivers/iommu/intel/dmar.c
@@ -1314,7 +1314,6 @@ static int qi_check_fault(struct intel_iommu *iommu, int index, int wait_index)
 	if (fault & DMA_FSTS_ITE) {
 		head = readl(iommu->reg + DMAR_IQH_REG);
 		head = ((head >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
-		head |= 1;
 		tail = readl(iommu->reg + DMAR_IQT_REG);
 		tail = ((tail >> shift) - 1 + QI_LENGTH) % QI_LENGTH;
 
@@ -1331,7 +1330,7 @@ static int qi_check_fault(struct intel_iommu *iommu, int index, int wait_index)
 		do {
 			if (qi->desc_status[head] == QI_IN_USE)
 				qi->desc_status[head] = QI_ABORT;
-			head = (head - 2 + QI_LENGTH) % QI_LENGTH;
+			head = (head - 1 + QI_LENGTH) % QI_LENGTH;
 		} while (head != tail);
 
 		/*
-- 
2.43.0

[PATCH 2/2] iommu/vt-d: Only handle IOPF for SVA when PRI is supported

[Lu Baolu]

In intel_svm_set_dev_pasid(), the driver unconditionally manages the IOPF
handling during a domain transition. However, commit a86fb7717320
("iommu/vt-d: Allow SVA with device-specific IOPF") introduced support for
SVA on devices that handle page faults internally without utilizing the
PCI PRI. On such devices, the IOMMU-side IOPF infrastructure is not
required. Calling iopf_for_domain_replace() on these devices is incorrect
and can lead to unexpected failures during PASID attachment or unwinding.

Add a check for info->pri_supported to ensure that the IOPF queue logic
is only invoked for devices that actually rely on the IOMMU's PRI-based
fault handling.

Fixes: 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path")
Cc: stable@vger.kernel.org
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20260310075520.295104-1-baolu.lu@linux.intel.com
---
 drivers/iommu/intel/svm.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c
index fea10acd4f02..57cd1db7207a 100644
--- a/drivers/iommu/intel/svm.c
+++ b/drivers/iommu/intel/svm.c
@@ -164,9 +164,12 @@ static int intel_svm_set_dev_pasid(struct iommu_domain *domain,
 	if (IS_ERR(dev_pasid))
 		return PTR_ERR(dev_pasid);
 
-	ret = iopf_for_domain_replace(domain, old, dev);
-	if (ret)
-		goto out_remove_dev_pasid;
+	/* SVA with non-IOMMU/PRI IOPF handling is allowed. */
+	if (info->pri_supported) {
+		ret = iopf_for_domain_replace(domain, old, dev);
+		if (ret)
+			goto out_remove_dev_pasid;
+	}
 
 	/* Setup the pasid table: */
 	sflags = cpu_feature_enabled(X86_FEATURE_LA57) ? PASID_FLAG_FL5LP : 0;
@@ -181,7 +184,8 @@ static int intel_svm_set_dev_pasid(struct iommu_domain *domain,
 
 	return 0;
 out_unwind_iopf:
-	iopf_for_domain_replace(old, domain, dev);
+	if (info->pri_supported)
+		iopf_for_domain_replace(old, domain, dev);
 out_remove_dev_pasid:
 	domain_remove_dev_pasid(domain, dev, pasid);
 	return ret;
-- 
2.43.0

Re: [PATCH 0/2] [PULL REQUEST] iommu/vt-d: Fixes for v7.0-rc

[Joerg Roedel]

On Mon, Mar 16, 2026 at 03:16:38PM +0800, Lu Baolu wrote:
> Hi Joerg,
> 
> The following fixes have been queued for v7.0-rc. They aim to fix the
> following issues.
> 
> - Abort all pending requests on dev_tlb_inv timeout to avoid hardlockup
> - Limit IOPF handling to PRI-capable device to avoid SVA attach failure
> 
> These patches have been reviewed and tested and are ready for merge.
> Please consider them for v7.0-rc.
> 
> Best regards,
> baolu
> 
> Guanghui Feng (1):
>   iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry
> 
> Lu Baolu (1):
>   iommu/vt-d: Only handle IOPF for SVA when PRI is supported
> 
>  drivers/iommu/intel/dmar.c |  3 +--
>  drivers/iommu/intel/svm.c  | 12 ++++++++----
>  2 files changed, 9 insertions(+), 6 deletions(-)

Applied for -rc, thanks Baolu.