When writing the address of a freshly allocated zero-initialized PASID
table to a PASID directory entry, do that after the CPU cache flush for
this PASID table, not before it, to avoid the time window when this
PASID table may be already used by non-coherent IOMMU hardware while
its contents in RAM is still some random old data, not zero-initialized.

Signed-off-by: Dmytro Maluka <dmaluka@chromium.org>
---
 drivers/iommu/intel/pasid.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
index 3e2255057079..77b9b147ab50 100644
--- a/drivers/iommu/intel/pasid.c
+++ b/drivers/iommu/intel/pasid.c
@@ -153,6 +153,9 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid)
 		if (!entries)
 			return NULL;
 
+		if (!ecap_coherent(info->iommu->ecap))
+			clflush_cache_range(entries, VTD_PAGE_SIZE);
+
 		/*
 		 * The pasid directory table entry won't be freed after
 		 * allocation. No worry about the race with free and
@@ -165,10 +168,8 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid)
 			iommu_free_pages(entries);
 			goto retry;
 		}
-		if (!ecap_coherent(info->iommu->ecap)) {
-			clflush_cache_range(entries, VTD_PAGE_SIZE);
+		if (!ecap_coherent(info->iommu->ecap))
 			clflush_cache_range(&dir[dir_index].val, sizeof(*dir));
-		}
 	}
 
 	return &entries[index];
-- 
2.47.2

On 12/21/25 08:17, Dmytro Maluka wrote:
> When writing the address of a freshly allocated zero-initialized PASID
> table to a PASID directory entry, do that after the CPU cache flush for
> this PASID table, not before it, to avoid the time window when this
> PASID table may be already used by non-coherent IOMMU hardware while
> its contents in RAM is still some random old data, not zero-initialized.
> 

Fixes: 194b3348bdbb ("iommu/vt-d: Fix PASID directory pointer coherency")

> Signed-off-by: Dmytro Maluka <dmaluka@chromium.org>
> ---
>   drivers/iommu/intel/pasid.c | 7 ++++---
>   1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
> index 3e2255057079..77b9b147ab50 100644
> --- a/drivers/iommu/intel/pasid.c
> +++ b/drivers/iommu/intel/pasid.c
> @@ -153,6 +153,9 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid)
>   		if (!entries)
>   			return NULL;
>   
> +		if (!ecap_coherent(info->iommu->ecap))
> +			clflush_cache_range(entries, VTD_PAGE_SIZE);
> +
>   		/*
>   		 * The pasid directory table entry won't be freed after
>   		 * allocation. No worry about the race with free and
> @@ -165,10 +168,8 @@ static struct pasid_entry *intel_pasid_get_entry(struct device *dev, u32 pasid)
>   			iommu_free_pages(entries);
>   			goto retry;
>   		}
> -		if (!ecap_coherent(info->iommu->ecap)) {
> -			clflush_cache_range(entries, VTD_PAGE_SIZE);
> +		if (!ecap_coherent(info->iommu->ecap))
>   			clflush_cache_range(&dir[dir_index].val, sizeof(*dir));
> -		}
>   	}
>   
>   	return &entries[index];

Thanks,
baolu