From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9EBF285058 for ; Mon, 1 Jun 2026 05:36:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.12 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780292164; cv=none; b=kGfRdH2bmdxsjA0rgRDEWMG+ZbU1ihyMEzS4IryCtTRmPdh0qLkkXYuaeRRJ/xqNjcHcSgLLMPM/jZrNgS9/n0mygTSLYoFld/GX4/zq1hCImk2I9H4DymWNJmjq8P6tlEK5Q2yFtvyS9iySAQv5obprcsip0jziiOiXNtAaG2c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780292164; c=relaxed/simple; bh=og6jG5cg3kX4d88390kMEssuiV7CR/MNor/2WX50QK8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=E9YFFSatjxdqU0DK2lt6a/C1O6nS30zlMKdiUnC4SXlFoUDWUee4EkOXjYs2Lcp1ydRPHByGJRDolnURZHl8YUqDnni8YHG1CShsbZwn6W517gugQRtfGyu+6zJAR8giGfqoPAZMzhREEKK5hrX4jKcegMYkK6OwTwLeHZOgmYI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=WvpB0NlA; arc=none smtp.client-ip=198.175.65.12 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="WvpB0NlA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780292162; x=1811828162; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=og6jG5cg3kX4d88390kMEssuiV7CR/MNor/2WX50QK8=; b=WvpB0NlABWuzSiN6c9N7Q73jRkoDtN9FDB0bHAyjHWCX0qQF8ob0fn60 eSB2D25AOwITK98XB8/Yvagx3xs9nOD+achPt2T36COP/P1xmFb5R6ZAB 4oKMsG+hpYnDPdGSg71FBCpa75Kg363Vsq6gRriZJFJyQPqwxijQwv0V8 X0LM3gVwgE00ZTg+cEjnWVeeZrFSS3FG5RtQlMFSdzwWBE3LTWs23DDPH KruHeW2znSypahfss0EK3hkR8xisXodWG7DMZ+uolLwWrMaNJU7XYrVGW mgP/4Hdv/dVG8LeNmRiwhmQh2VkIk8s59SFz8wFcOEUKifER+UXslXlVR w==; X-CSE-ConnectionGUID: mzVCMPNEQDuboxr7deQAnQ== X-CSE-MsgGUID: vnv/n+K+TKm/fYpWMgK2+w== X-IronPort-AV: E=McAfee;i="6800,10657,11803"; a="92516449" X-IronPort-AV: E=Sophos;i="6.24,180,1774335600"; d="scan'208";a="92516449" Received: from orviesa005.jf.intel.com ([10.64.159.145]) by orvoesa104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 May 2026 22:36:01 -0700 X-CSE-ConnectionGUID: 5zX3G/IcS/GCHBaKFGBJYA== X-CSE-MsgGUID: k5y+/ucQQ0WAYdbzq1vmfA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,180,1774335600"; d="scan'208";a="248389777" Received: from allen-sbox.sh.intel.com (HELO [10.239.159.30]) ([10.239.159.30]) by orviesa005-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 May 2026 22:36:00 -0700 Message-ID: Date: Mon, 1 Jun 2026 13:35:08 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry To: Michael Bommarito , David Woodhouse , Joerg Roedel Cc: Will Deacon , Robin Murphy , iommu@lists.linux.dev, linux-kernel@vger.kernel.org References: <20260528025557.3209367-1-michael.bommarito@gmail.com> Content-Language: en-US From: Baolu Lu In-Reply-To: <20260528025557.3209367-1-michael.bommarito@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 5/28/26 10:55, Michael Bommarito wrote: > device_pasid_table_teardown() zeroes the 128-bit scalable-mode context > entry with context_clear_entry() while the Present bit is still set. This > creates a window where the hardware can fetch a torn entry, with some > fields already zeroed while Present is still set, leading to unpredictable > behavior or spurious faults. The context-cache invalidation is issued only > after the entry has been zeroed, and intel_pasid_free_table() then frees > the PASID directory pages, so the IOMMU can keep walking a stale Present=1 > entry that points at freed memory. > > While x86 provides strong write ordering, the compiler may reorder the two > 64-bit writes to the entry, and the hardware fetch is not guaranteed to be > atomic with respect to multiple CPU writes. > > Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down > context entry") fixed this exact pattern in domain_context_clear_one() and > the copied-context path, but device_pasid_table_teardown() was not > converted. > > Align it with the "Guidance to Software for Invalidations" in the VT-d > spec, Section 6.5.3.3, using the same ownership handshake as the sibling > fix: clear only the Present bit, flush it to the IOMMU, perform the > context-cache invalidation, and only then zero the rest of the entry. > > Fixes: 81e921fd32161 ("iommu/vt-d: Fix NULL domain on device release") > Signed-off-by: Michael Bommarito > Assisted-by:Claude:claude-opus-4-7 > --- > Found by static analysis while auditing the callers of context_clear_entry() > for the same teardown ordering that c1e4f1dccbe9d addressed. This site is > reachable only in scalable mode, so it does not manifest on the legacy-mode > hardware available to me; I could not trigger a runtime fault and the change > is verified by code inspection only, on the same basis as the sibling fix. > Compile-tested on x86_64 with CONFIG_INTEL_IOMMU; no new warnings. > > drivers/iommu/intel/pasid.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Queued for linux-next. Thank you!