Re: [PATCH] iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

[Jason Gunthorpe <jgg@ziepe.ca>]

On Mon, Jun 01, 2026 at 01:35:08PM +0800, Baolu Lu wrote:
> On 5/28/26 10:55, Michael Bommarito wrote:
> > device_pasid_table_teardown() zeroes the 128-bit scalable-mode context
> > entry with context_clear_entry() while the Present bit is still set. This
> > creates a window where the hardware can fetch a torn entry, with some
> > fields already zeroed while Present is still set, leading to unpredictable
> > behavior or spurious faults. The context-cache invalidation is issued only
> > after the entry has been zeroed, and intel_pasid_free_table() then frees
> > the PASID directory pages, so the IOMMU can keep walking a stale Present=1
> > entry that points at freed memory.
> > 
> > While x86 provides strong write ordering, the compiler may reorder the two
> > 64-bit writes to the entry, and the hardware fetch is not guaranteed to be
> > atomic with respect to multiple CPU writes.
> > 
> > Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down
> > context entry") fixed this exact pattern in domain_context_clear_one() and
> > the copied-context path, but device_pasid_table_teardown() was not
> > converted.
> > 
> > Align it with the "Guidance to Software for Invalidations" in the VT-d
> > spec, Section 6.5.3.3, using the same ownership handshake as the sibling
> > fix: clear only the Present bit, flush it to the IOMMU, perform the
> > context-cache invalidation, and only then zero the rest of the entry.
> > 
> > Fixes: 81e921fd32161 ("iommu/vt-d: Fix NULL domain on device release")
> > Signed-off-by: Michael Bommarito<michael.bommarito@gmail.com>
> > Assisted-by:Claude:claude-opus-4-7
> > ---
> > Found by static analysis while auditing the callers of context_clear_entry()
> > for the same teardown ordering that c1e4f1dccbe9d addressed. This site is
> > reachable only in scalable mode, so it does not manifest on the legacy-mode
> > hardware available to me; I could not trigger a runtime fault and the change
> > is verified by code inspection only, on the same basis as the sibling fix.
> > Compile-tested on x86_64 with CONFIG_INTEL_IOMMU; no new warnings.
> > 
> >   drivers/iommu/intel/pasid.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> Queued for linux-next. Thank you!

What happened to your work to move over to the ARM updator that
doesn't have any of these bugs? :)

Jason