From nobody Mon Jun 8 05:24:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 324FF280CE5 for ; Tue, 2 Jun 2026 23:36:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443410; cv=none; b=PF1ti1fJZyaDL/OxVTu2I3a1Ksl5fPAcxFoNzodZyCt1WWCK3YauTdvrk8J+A7NypNGPkZHNVpwytdrWPmuGeNXYkdU/hu/BHP4Y8F/KihxUR9aRUwr3jd59t+gJFBgWbGwKtp5NWQVQREjFHGxnprkTyIqySu7i+L/HT+/j7GQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443410; c=relaxed/simple; bh=xm53TpFRrN5dL4C2+v5j9/m5g0/qjhftnOUG7WU1TT0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bcc60yLX0gEsKwR7zLJOVJXQ8auTMCMOms53/k09e95Ts8GikywL+yTjtXhG/q6OwNhIalL9p6B7kPzQHabIy58rCSUOH/G/iY9DIJdPTwMZcOdkxE30mb78JUR/OY69FJSvW2ZADAPkEbkKPza/ymZpoVxBnCNYaBvc71BeJDI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=mFwb+Afq; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="mFwb+Afq" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780443409; x=1811979409; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=xm53TpFRrN5dL4C2+v5j9/m5g0/qjhftnOUG7WU1TT0=; b=mFwb+Afqz9h+MOtdYBqqFasHpQ5h20r6PHxR15ajbQioe9vOGsW3UCKg hPz4doHT8Xov603T4+tHJ3tqni3ZQVliQA+AzWdflyEQ67sxY6gd7TWEk sVZggt4bAFs2dhU/5n5iaa79HbGn/3VvlgNitvXS0KNyGVP4slYfEm1tn Usj1FJ0AI+3FKv0rfc7Yttglz6AXfsGSAuzmWJAJ2tPX2Wnk9DS+gbrQT gg2K3P8z65erZ/zZP/t1a1IkHNfFe2N/Rc57hUFsvEvT+NTgsHKWRGXp1 k6pOWjvnznk0/VSW8jmvzmAaz8V9aJRpQ2bU9RixCgDCALevu7iIy99U2 g==; X-CSE-ConnectionGUID: tO20nB6hTDeibqwaR59CTg== X-CSE-MsgGUID: bXGdMS67TImJeMaHnnjAww== X-IronPort-AV: E=McAfee;i="6800,10657,11805"; a="81369705" X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="81369705" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Jun 2026 16:36:48 -0700 X-CSE-ConnectionGUID: NPhMfOKaTNOWEh1G+BGanA== X-CSE-MsgGUID: 7fcn4anWTdWT48fdTfJVZA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="241068743" Received: from allen-box.sh.intel.com ([10.239.159.52]) by fmviesa007.fm.intel.com with ESMTP; 02 Jun 2026 16:36:47 -0700 From: Lu Baolu To: Joerg Roedel Cc: Pranjal Shrivastava , Guanghui Feng , =?UTF-8?q?Micha=C5=82=20Grzelak?= , Michael Bommarito , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 1/6] iommu/vt-d: Avoid WARNING in sva unbind path Date: Wed, 3 Jun 2026 07:34:20 +0800 Message-ID: <20260602233426.357499-2-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260602233426.357499-1-baolu.lu@linux.intel.com> References: <20260602233426.357499-1-baolu.lu@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supported") modified the SVA bind path to allow this configuration by skipping IOPF enablement when PRI is missing. However, it failed to update the unbind path. This creates an imbalance: the unbind path attempts to disable IOPF for a device that never had it enabled, triggering a WARNING in intel_iommu_disable_iopf(): WARNING: drivers/iommu/intel/iommu.c:3475 at intel_iommu_disable_iopf+0x4f= /0x90d Call Trace: blocking_domain_set_dev_pasid+0x50/0x70 iommu_detach_device_pasid+0x89/0xc0 iommu_sva_unbind_device+0x73/0x150 xe_vm_close_and_put+0x4d2/0x1200 [xe] Fix this by bypassing IOPF operations for SVA domains on non-PRI hardware in both the bind and unbind paths. Fixes: 39c20c4e83b9 ("iommu/vt-d: Only handle IOPF for SVA when PRI is supp= orted") Cc: stable@vger.kernel.org Reported-by: Nareshkumar Gollakoti Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20260519052917.3729796-1-baolu.lu@linux.int= el.com --- drivers/iommu/intel/iommu.h | 11 +++++++++++ drivers/iommu/intel/svm.c | 12 ++++-------- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index ef145560aa98..775f1c4ae346 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1254,18 +1254,29 @@ void intel_iommu_disable_iopf(struct device *dev); static inline int iopf_for_domain_set(struct iommu_domain *domain, struct device *dev) { + struct device_domain_info *info =3D dev_iommu_priv_get(dev); + if (!domain || !domain->iopf_handler) return 0; =20 + /* SVA with non-IOMMU/PRI IOPF handling is allowed. */ + if (domain->type =3D=3D IOMMU_DOMAIN_SVA && !info->pri_supported) + return 0; + return intel_iommu_enable_iopf(dev); } =20 static inline void iopf_for_domain_remove(struct iommu_domain *domain, struct device *dev) { + struct device_domain_info *info =3D dev_iommu_priv_get(dev); + if (!domain || !domain->iopf_handler) return; =20 + if (domain->type =3D=3D IOMMU_DOMAIN_SVA && !info->pri_supported) + return; + intel_iommu_disable_iopf(dev); } =20 diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c index 57cd1db7207a..fea10acd4f02 100644 --- a/drivers/iommu/intel/svm.c +++ b/drivers/iommu/intel/svm.c @@ -164,12 +164,9 @@ static int intel_svm_set_dev_pasid(struct iommu_domain= *domain, if (IS_ERR(dev_pasid)) return PTR_ERR(dev_pasid); =20 - /* SVA with non-IOMMU/PRI IOPF handling is allowed. */ - if (info->pri_supported) { - ret =3D iopf_for_domain_replace(domain, old, dev); - if (ret) - goto out_remove_dev_pasid; - } + ret =3D iopf_for_domain_replace(domain, old, dev); + if (ret) + goto out_remove_dev_pasid; =20 /* Setup the pasid table: */ sflags =3D cpu_feature_enabled(X86_FEATURE_LA57) ? PASID_FLAG_FL5LP : 0; @@ -184,8 +181,7 @@ static int intel_svm_set_dev_pasid(struct iommu_domain = *domain, =20 return 0; out_unwind_iopf: - if (info->pri_supported) - iopf_for_domain_replace(old, domain, dev); + iopf_for_domain_replace(old, domain, dev); out_remove_dev_pasid: domain_remove_dev_pasid(domain, dev, pasid); return ret; --=20 2.43.0 From nobody Mon Jun 8 05:24:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E43483537F9 for ; Tue, 2 Jun 2026 23:36:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443412; cv=none; b=OCb/8mJX2DV4SqrY1892ySPjyoV8w73gu/Zev4PnnxOaZwFsh0d36k3RvkBh1QHZlQ6DkZuguzP6OBwkkznziMqmlPTkeiE0hNb6RM9aHhCFL6euj7xSVUNHS91hANpYE5nOCQ1YlJcM6FhiTZZw3mtpUEZTcNYzT7jPbyE8rv8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443412; c=relaxed/simple; bh=ZNuUnQtm2QZ2JMwplBFeCc5TjvOkVGByw+irME/PHDE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nTp7Lapl/yWh/zzcP0y5Wm5VWHoU3E2s9Ql7Xz6lZs09av4ca+hzauN0oU+uKDRjqDNN+J3afd+lTDHAKvWW/vQWwLvH/XbBbx2XINuk9iUcJ/8z/FEzp/q0AfO9lLTDHW60y/KY2x6BlFXhCgYMvJViVg7mXuVtUa6iwg8U4gE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=ljcmCkqK; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="ljcmCkqK" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780443411; x=1811979411; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ZNuUnQtm2QZ2JMwplBFeCc5TjvOkVGByw+irME/PHDE=; b=ljcmCkqKOjFUU3OUwhDp0PrydMU9vjd8EkLjuX2STSdMscyCfQtIsSx/ WaWw7CBVQpi4T+Fogc3lrIRCZW0peHSX/d5YVF5zxDa+Tn0zOcLcB+Btb u0GuT3rSOzTQ1VPq5yqH4Yr/qqfksx5f8jhUlfNB8JHYq+n08Z4jeA90U Xx1yLoi154U8BRcD1kRv+ADZNcmoDjstQGmVD3+s/EM3rEMwnxFKhDQcp qeeSHynbKu4WjFfwshDBCOBA0N4pajELRnF+Rf7OggswawArHu1Sk71FH 5cAox8ICjEFKU44s4rN5GUBr7+f9iD8jTD90LCD4XMUVAsZy1CavDqzao A==; X-CSE-ConnectionGUID: gNuqvjajQByOMJAqrAIIFw== X-CSE-MsgGUID: JcqUOv/pSHKX7fOjSWELYg== X-IronPort-AV: E=McAfee;i="6800,10657,11805"; a="81369712" X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="81369712" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Jun 2026 16:36:50 -0700 X-CSE-ConnectionGUID: +PBzkT2ISS+Yz3CqQBEemg== X-CSE-MsgGUID: wbKjNTolQnmyPbE99TOSaA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="241068746" Received: from allen-box.sh.intel.com ([10.239.159.52]) by fmviesa007.fm.intel.com with ESMTP; 02 Jun 2026 16:36:49 -0700 From: Lu Baolu To: Joerg Roedel Cc: Pranjal Shrivastava , Guanghui Feng , =?UTF-8?q?Micha=C5=82=20Grzelak?= , Michael Bommarito , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 2/6] iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry Date: Wed, 3 Jun 2026 07:34:21 +0800 Message-ID: <20260602233426.357499-3-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260602233426.357499-1-baolu.lu@linux.intel.com> References: <20260602233426.357499-1-baolu.lu@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Michael Bommarito device_pasid_table_teardown() zeroes the 128-bit scalable-mode context entry with context_clear_entry() while the Present bit is still set. This creates a window where the hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behavior or spurious faults. The context-cache invalidation is issued only after the entry has been zeroed, and intel_pasid_free_table() then frees the PASID directory pages, so the IOMMU can keep walking a stale Present=3D1 entry that points at freed memory. While x86 provides strong write ordering, the compiler may reorder the two 64-bit writes to the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. Commit c1e4f1dccbe9d ("iommu/vt-d: Clear Present bit before tearing down context entry") fixed this exact pattern in domain_context_clear_one() and the copied-context path, but device_pasid_table_teardown() was not converted. Align it with the "Guidance to Software for Invalidations" in the VT-d spec, Section 6.5.3.3, using the same ownership handshake as the sibling fix: clear only the Present bit, flush it to the IOMMU, perform the context-cache invalidation, and only then zero the rest of the entry. Fixes: 81e921fd32161 ("iommu/vt-d: Fix NULL domain on device release") Signed-off-by: Michael Bommarito Assisted-by: Claude:claude-opus-4-7 Link: https://lore.kernel.org/r/20260528025557.3209367-1-michael.bommarito@= gmail.com Signed-off-by: Lu Baolu --- drivers/iommu/intel/pasid.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index 89541b74ab8c..40910dc7363b 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -748,10 +748,12 @@ static void device_pasid_table_teardown(struct device= *dev, u8 bus, u8 devfn) } =20 did =3D context_domain_id(context); - context_clear_entry(context); + context_clear_present(context); __iommu_flush_cache(iommu, context, sizeof(*context)); spin_unlock(&iommu->lock); intel_context_flush_no_pasid(info, context, did); + context_clear_entry(context); + __iommu_flush_cache(iommu, context, sizeof(*context)); } =20 static int pci_pasid_table_teardown(struct pci_dev *pdev, u16 alias, void = *data) --=20 2.43.0 From nobody Mon Jun 8 05:24:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 862523955F6 for ; Tue, 2 Jun 2026 23:36:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443416; cv=none; b=LUEfZ0C291zD6KvX6nmG2ZsNgJyblbLfxn3ie0D2k/t7M1WpFTQPORRGxBUmBr8YOIfwtrZu/mYfR3Xd8dHRpTrlaRdXTFMrPX7Jrq9JvrTTHlDalnXqmkd9Fw+YQX+Y5Jb30ExGAyFFq1nAU3Pq44aGd12zbuw0JlMmQhOGZfU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443416; c=relaxed/simple; bh=lk+QXBIHW2Uv+ZVyv3jxFQlkkLl5igDptN3oRqoYpls=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=YjUB8N/gL9QvBD76FvfNffWJkjML6U740I20R26k6fWDIZuVD47d61MY1V3MTOwH8bci3eebY4JSKcf61VM5jgvKs65a6z/kyhSfIz1JhprjxagsLcR7MpuFfBk6nxM35aKy+8qqxo+stM4BDZebDrC3qkKKPECRl6vx3PYve6c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=hUFT6DpX; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="hUFT6DpX" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780443412; x=1811979412; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=lk+QXBIHW2Uv+ZVyv3jxFQlkkLl5igDptN3oRqoYpls=; b=hUFT6DpX4BPz79mLTkvSOTKQLrkbz0q3v1+axo7IuC8UnF2+yakEdV/0 j4csjRnyf+ohTbRY6hTRt9wgxeweS6YpaCaed5ZEn+6LjSAQpLRc3kV7q JI1AVYbBwYjIw4E8H/xvvBga1ziNcFWEdElZgebXK6RicCc96fNwiH6JI kzHQ/mln07Um5J840A5z0CFRhH9h2n9qBtYNz95n8bSjHiSpaOI5JjqSj ePMPgqLiNAMvFljKYu5lSGbJigY9yiXW69h8KCvNcOGmPxFVfDj6wKsKj xmgvceqmCojiYkrAECOchNhS11J3N5d61xJUtPeGvkzxSopR8wnG9kNYB A==; X-CSE-ConnectionGUID: 9GZIYh4NThiNl/qBn8Uf9g== X-CSE-MsgGUID: r9vjOoEtT9ip+Cgv3j6Y2Q== X-IronPort-AV: E=McAfee;i="6800,10657,11805"; a="81369719" X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="81369719" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Jun 2026 16:36:52 -0700 X-CSE-ConnectionGUID: YrLYTcTbSgO943930VcgJQ== X-CSE-MsgGUID: jLMXqtcFR3aXwTJ773Y5cA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="241068749" Received: from allen-box.sh.intel.com ([10.239.159.52]) by fmviesa007.fm.intel.com with ESMTP; 02 Jun 2026 16:36:50 -0700 From: Lu Baolu To: Joerg Roedel Cc: Pranjal Shrivastava , Guanghui Feng , =?UTF-8?q?Micha=C5=82=20Grzelak?= , Michael Bommarito , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 3/6] iommu/vt-d: Remove typo from pasid_pte_config_nested() Date: Wed, 3 Jun 2026 07:34:22 +0800 Message-ID: <20260602233426.357499-4-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260602233426.357499-1-baolu.lu@linux.intel.com> References: <20260602233426.357499-1-baolu.lu@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Micha=C5=82 Grzelak Rename pasid_pte_config_nestd() into pasid_pte_config_nested(). Do it to match other function names ending with _nested(). Signed-off-by: Micha=C5=82 Grzelak Link: https://lore.kernel.org/r/20260509174503.831134-1-michal.grzelak@inte= l.com Signed-off-by: Lu Baolu --- drivers/iommu/intel/pasid.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index 40910dc7363b..81353fd46b37 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -618,11 +618,11 @@ void intel_pasid_setup_page_snoop_control(struct inte= l_iommu *iommu, intel_pasid_flush_present(iommu, dev, pasid, did, pte); } =20 -static void pasid_pte_config_nestd(struct intel_iommu *iommu, - struct pasid_entry *pte, - struct iommu_hwpt_vtd_s1 *s1_cfg, - struct dmar_domain *s2_domain, - u16 did) +static void pasid_pte_config_nested(struct intel_iommu *iommu, + struct pasid_entry *pte, + struct iommu_hwpt_vtd_s1 *s1_cfg, + struct dmar_domain *s2_domain, + u16 did) { struct pt_iommu_vtdss_hw_info pt_info; =20 @@ -720,7 +720,7 @@ int intel_pasid_setup_nested(struct intel_iommu *iommu,= struct device *dev, return -EBUSY; } =20 - pasid_pte_config_nestd(iommu, pte, s1_cfg, s2_domain, did); + pasid_pte_config_nested(iommu, pte, s1_cfg, s2_domain, did); spin_unlock(&iommu->lock); =20 pasid_flush_caches(iommu, pte, pasid, did); --=20 2.43.0 From nobody Mon Jun 8 05:24:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D709E379EC6 for ; Tue, 2 Jun 2026 23:36:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443416; cv=none; b=Po9hYkBiEuRY4wz3VYlY5VxZLfKAFWHZR5xjkOZNzbqZC75nTDV1+IaRJx9t7rk5RB9dByJhNWG1fA0uPmTxZGkIlGA/ofZLnfx0G2J0oicL0WwB9axMk42/Pet4c9KNXSfKLiH0845Shg58XA5yLrZZ48QPMpra3ggZFCo0yj4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443416; c=relaxed/simple; bh=bg9a90q7vThLPozRo1SItoJxz5cp3kq3hBfy/kU+5jg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ABPe/WGrLUDd7E5FPqLGNoHb3r87R0rv6udom9pQnSheqP4nlpbYHZZ3q/oZatPQ2v/JRjg2z3zlLA6XOBSm01jVRh6W3mlrxNT70l6J+EavCzfuseI5oqgh4JKkQfsjItJNDX6KKVNFy0T4dt58ihxon15+JtT6lb0/eB99G28= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=kj+1kCL/; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="kj+1kCL/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780443415; x=1811979415; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=bg9a90q7vThLPozRo1SItoJxz5cp3kq3hBfy/kU+5jg=; b=kj+1kCL/+QVkGom8l5cXGBc8lFw4o3qpCXFrtDQzfsv5trOGfG9JFh27 yOnKRk2UFmJN6zE2XgRtTPImWJ3/cMx1oE6awkWysK9jJSJG2i14BMSAi SoM3ua7oQrFaO8/HbHXfeij0xkYnKfdHeFlForwNQuH98NNh4ORbt40q8 3AcMixdajfN4MqfoopYBiDYyNoTuoDCSicEW84mvJ3ZZWHvxpVeoC+Oe4 9oWbnnptpVeJFu7ivMnhVBpd+i8FVPRGvBp8ZJpbU8KzDskBFxPXL2ahI 8IIE9KdodtlbTZY/xBLGLEZ87x8CZ+h46RYcXpbjdSsQwxCYWDLxc47wj w==; X-CSE-ConnectionGUID: orYh5011ROGi84dPbF6nYw== X-CSE-MsgGUID: OlRSKK1tTNKYneIPEcc/Gg== X-IronPort-AV: E=McAfee;i="6800,10657,11805"; a="81369738" X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="81369738" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Jun 2026 16:36:54 -0700 X-CSE-ConnectionGUID: We1cSPMXQIq1encQqA2Dbg== X-CSE-MsgGUID: TETKopAPToCiRiZISFkmmg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="241068752" Received: from allen-box.sh.intel.com ([10.239.159.52]) by fmviesa007.fm.intel.com with ESMTP; 02 Jun 2026 16:36:52 -0700 From: Lu Baolu To: Joerg Roedel Cc: Pranjal Shrivastava , Guanghui Feng , =?UTF-8?q?Micha=C5=82=20Grzelak?= , Michael Bommarito , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 4/6] iommu/vt-d: Improve IOMMU fault information Date: Wed, 3 Jun 2026 07:34:23 +0800 Message-ID: <20260602233426.357499-5-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260602233426.357499-1-baolu.lu@linux.intel.com> References: <20260602233426.357499-1-baolu.lu@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Guanghui Feng In some environments, multiple PCIe segments exist, and PCIe device information needs to be differentiated and identified based on the segment. When an IOMMU fault event occurs, the IOMMU and device segment information should be output in detail in dmar_fault_do_one. Signed-off-by: Guanghui Feng Link: https://lore.kernel.org/r/20260528022943.1697564-1-guanghuifeng@linux= .alibaba.com Signed-off-by: Lu Baolu --- drivers/iommu/intel/dmar.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index d33c119a935e..767ec092accd 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -1894,7 +1894,8 @@ static int dmar_fault_do_one(struct intel_iommu *iomm= u, int type, reason =3D dmar_get_fault_reason(fault_reason, &fault_type); =20 if (fault_type =3D=3D INTR_REMAP) { - pr_err("[INTR-REMAP] Request device [%02x:%02x.%d] fault index 0x%llx [f= ault reason 0x%02x] %s\n", + pr_err("[INTR-REMAP] Request device [%04x:%02x:%02x.%d] fault index 0x%l= lx [fault reason 0x%02x] %s\n", + iommu->segment, source_id >> 8, PCI_SLOT(source_id & 0xFF), PCI_FUNC(source_id & 0xFF), addr >> 48, fault_reason, reason); @@ -1903,14 +1904,16 @@ static int dmar_fault_do_one(struct intel_iommu *io= mmu, int type, } =20 if (pasid =3D=3D IOMMU_PASID_INVALID) - pr_err("[%s NO_PASID] Request device [%02x:%02x.%d] fault addr 0x%llx [f= ault reason 0x%02x] %s\n", + pr_err("[%s NO_PASID] Request device [%04x:%02x:%02x.%d] fault addr 0x%l= lx [fault reason 0x%02x] %s\n", type ? "DMA Read" : "DMA Write", + iommu->segment, source_id >> 8, PCI_SLOT(source_id & 0xFF), PCI_FUNC(source_id & 0xFF), addr, fault_reason, reason); else - pr_err("[%s PASID 0x%x] Request device [%02x:%02x.%d] fault addr 0x%llx = [fault reason 0x%02x] %s\n", + pr_err("[%s PASID 0x%x] Request device [%04x:%02x:%02x.%d] fault addr 0x= %llx [fault reason 0x%02x] %s\n", type ? "DMA Read" : "DMA Write", pasid, + iommu->segment, source_id >> 8, PCI_SLOT(source_id & 0xFF), PCI_FUNC(source_id & 0xFF), addr, fault_reason, reason); --=20 2.43.0 From nobody Mon Jun 8 05:24:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2809C361DD5 for ; Tue, 2 Jun 2026 23:36:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443417; cv=none; b=S9yL8XWOUn172xNEEtFWaCClfWM8arSjhmzfgMNDYr5fP4iPP+CWPHwlfu6u+TxC+9HEQPumN8YYq4ENxHbq+9tvLaSHkFoG1fZ84tHghmxseT9rSAX/Tw161XcmBfPdQUghSfAumfyIBY1HIKQ09fvmudkarLDe15ROQWS6ofo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443417; c=relaxed/simple; bh=D3dEDDoT3aHbpPxK4hEFaV8P3ei5CFxGflWpK+in12E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=SY4IdO5Kl0Ezdbu4x5nJcRB7/ZJspAf0WEgMidHlpzNU7tXJnePztwZdpWF0QdssTEob48abU/9DO+KIeZZq0LnVFwBhXo5Mk3+QbSUoifNru8EXCtfudKoUSjbJG+sPV5RXcJGVp7/SYXPng0736rwQXp9H4u3Ff4B+RFlEFTo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=D2PZkQ4L; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="D2PZkQ4L" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780443416; x=1811979416; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=D3dEDDoT3aHbpPxK4hEFaV8P3ei5CFxGflWpK+in12E=; b=D2PZkQ4LphsznuIIu24I6gUmYxuvGnZxPGMPrIfzPtzcUpgqnMIoNAvQ E1NyYj5aHlilLuShdRLtmMf9XpIKMav1ZJa7hFnMyn116Cunm1VKTHqfN ovHQ/Bu5sM4rzskglNZaLE5mjQ+294LHhgRLA9T2nHUMJNsUrr2CUF+dG 1KYbcpgUVybGH7UNuwO3EP+5g/WeeCtfcDyb6xwERTHzcBFU2wQyvPPMo DNrdPa45yRyItrN9hDiT7Udc+WWlDWmCXLMmYsIZHSCAElTqkCL77gGeK oN/Tw2L6kLsW+RFB/7HrvAYsN3sZDHxQV8nTmESbXRvG6b3GOcGVlskQi Q==; X-CSE-ConnectionGUID: Kod54gHDS/+FoiQd/yl7WQ== X-CSE-MsgGUID: OtyN3AZWSrKm7S8AK4UOQQ== X-IronPort-AV: E=McAfee;i="6800,10657,11805"; a="81369751" X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="81369751" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Jun 2026 16:36:56 -0700 X-CSE-ConnectionGUID: eKaYI7brR8CKdgpaLEDASA== X-CSE-MsgGUID: iiwI3scHSD+DxXDfdPpmsQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="241068755" Received: from allen-box.sh.intel.com ([10.239.159.52]) by fmviesa007.fm.intel.com with ESMTP; 02 Jun 2026 16:36:54 -0700 From: Lu Baolu To: Joerg Roedel Cc: Pranjal Shrivastava , Guanghui Feng , =?UTF-8?q?Micha=C5=82=20Grzelak?= , Michael Bommarito , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 5/6] iommu/vt-d: Fix RB-tree corruption in probe error path Date: Wed, 3 Jun 2026 07:34:24 +0800 Message-ID: <20260602233426.357499-6-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260602233426.357499-1-baolu.lu@linux.intel.com> References: <20260602233426.357499-1-baolu.lu@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Pranjal Shrivastava The info->node RB-tree member is zero-initialized via kzalloc. If a device does not support ATS, the device_rbtree_insert() call is skipped. If a subsequent probe step fails, the error path jumps to device_rbtree_remove(), which misinterprets the zeroed node as a tree root and corrupts the device RB-tree. Fix this by explicitly initializing the RB-node as empty using RB_CLEAR_NODE() during initialization and guarding the removal with RB_EMPTY_NODE(). Fixes: 4f1492efb495 ("iommu/vt-d: Revert ATS timing change to fix boot fail= ure") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel= .org/ Suggested-by: Baolu Lu Signed-off-by: Pranjal Shrivastava Link: https://lore.kernel.org/r/20260531170254.60493-2-praan@google.com Signed-off-by: Lu Baolu --- drivers/iommu/intel/iommu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 4d0e65bc131d..849d06dfe1ae 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -157,7 +157,10 @@ static void device_rbtree_remove(struct device_domain_= info *info) unsigned long flags; =20 spin_lock_irqsave(&iommu->device_rbtree_lock, flags); - rb_erase(&info->node, &iommu->device_rbtree); + if (!RB_EMPTY_NODE(&info->node)) { + rb_erase(&info->node, &iommu->device_rbtree); + RB_CLEAR_NODE(&info->node); + } spin_unlock_irqrestore(&iommu->device_rbtree_lock, flags); } =20 @@ -3254,6 +3257,7 @@ static struct iommu_device *intel_iommu_probe_device(= struct device *dev) =20 info->dev =3D dev; info->iommu =3D iommu; + RB_CLEAR_NODE(&info->node); if (dev_is_pci(dev)) { if (ecap_dev_iotlb_support(iommu->ecap) && pci_ats_supported(pdev) && --=20 2.43.0 From nobody Mon Jun 8 05:24:59 2026 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A98B3537F9 for ; Tue, 2 Jun 2026 23:36:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.15 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443421; cv=none; b=d5bzu6jQ4ungw9vHZgTGY9FlavSrb1PxJT4bTRQFve5J4GDiUxul26hfZ4zyypcAGJI3ty6AmN9nQmvNT0+Kg6kCFa/6IaFEZ5k52kfnLGdfSp5Dq6gg5cr2FH/ZMlbGlc5OIB8upzLhHfLIKsIsGmrOqwNuv4TovQxGfB0IQgc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780443421; c=relaxed/simple; bh=UJfzrNHwLtO9mjdbuOxo0aC264qVGR8jQJjJigoi/2k=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MJBFlrGYtDcW1MTd0eyBqvgt3CHXx3JgPBYuA+lzGbMGp9wJnaMp1pJQqBL8XN8EMUsEl2xgupmNrY/3jlpyFRNF5gERBFJB5KYxfS5NO+6TnA95pNpk/133M1PjMFnwvAl5ApndvZuigoqZ/kZi38zwb7ySLoaLWfTkjhzjk1U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=hAlP7Vez; arc=none smtp.client-ip=192.198.163.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="hAlP7Vez" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1780443420; x=1811979420; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=UJfzrNHwLtO9mjdbuOxo0aC264qVGR8jQJjJigoi/2k=; b=hAlP7VezpeVMRLsQccs+w3YyWCfA+UhaJRDbRep4TXL8JgR6PkeKWtua tvd+6myp5baP2WjZFZZSsVWCEUvD1GpEMFRp2r16i39oeZvcBuMPjGYTB BkAv2mIppxXQRT8t0vQW6e9blNtllOqcszq1VZ/hZEwip6Fx53sSvGNS8 HwZk2rZVrs0pYenIPjRHJT83CMc5DuwrNp64vkuJ2DpDyKftqxqc4Uw3S THY7DqEnt2wOL4lvb1yF2F9hBhiXkvos9MZ1Oza2NNjK2/nkh4dVrruZw nzUe6cAiL3dUBKmXdEVEDxij2Sbgj4Y1xDdDfXOnTc6KLLzl4xeKvnHSh Q==; X-CSE-ConnectionGUID: /kdjyWe2SW2/F1Onxw9z6Q== X-CSE-MsgGUID: 1xFOHREoQVCMi0Mwwd9w8g== X-IronPort-AV: E=McAfee;i="6800,10657,11805"; a="81369758" X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="81369758" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 02 Jun 2026 16:36:58 -0700 X-CSE-ConnectionGUID: OC28zMe3TcyA/LeAFdPDsg== X-CSE-MsgGUID: O47eRbn1TS6h0G0BpyLXAg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.24,184,1774335600"; d="scan'208";a="241068760" Received: from allen-box.sh.intel.com ([10.239.159.52]) by fmviesa007.fm.intel.com with ESMTP; 02 Jun 2026 16:36:56 -0700 From: Lu Baolu To: Joerg Roedel Cc: Pranjal Shrivastava , Guanghui Feng , =?UTF-8?q?Micha=C5=82=20Grzelak?= , Michael Bommarito , iommu@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH 6/6] iommu/vt-d: Fix Use-After-Free in probe error path Date: Wed, 3 Jun 2026 07:34:25 +0800 Message-ID: <20260602233426.357499-7-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260602233426.357499-1-baolu.lu@linux.intel.com> References: <20260602233426.357499-1-baolu.lu@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Pranjal Shrivastava When intel_iommu_probe_device() fails after the info structure has been linked to the device via dev_iommu_priv_set(), the error path calls kfree(info) but does not clear the pointer in the device structure. This results in a Use-After-Free regression if the pointer is accessed by a subsequent IOMMU core call or a re-probe. Fix this by ensuring dev_iommu_priv_set(dev, NULL) is called before freeing the info structure in the error path. Fixes: eda1a94caf6b ("iommu: Mark dev_iommu_priv_set() with a lockdep") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260525205628.CD4431F000E9@smtp.kernel= .org/ Signed-off-by: Pranjal Shrivastava Link: https://lore.kernel.org/r/20260531170254.60493-3-praan@google.com Signed-off-by: Lu Baolu --- drivers/iommu/intel/iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 849d06dfe1ae..ed6d3a0203f5 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -3320,6 +3320,7 @@ static struct iommu_device *intel_iommu_probe_device(= struct device *dev) clear_rbtree: device_rbtree_remove(info); free: + dev_iommu_priv_set(dev, NULL); kfree(info); =20 return ERR_PTR(ret); --=20 2.43.0