linux-kernel - Re: [PATCH 1/2] iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <98a2a099-0b90-4837-a20c-742c883e8eea@linux.intel.com>
Date: Thu, 11 Dec 2025 10:10:52 +0800
From: Baolu Lu <baolu.lu@...ux.intel.com>
To: Jinhui Guo <guojinhui.liam@...edance.com>, dwmw2@...radead.org,
 joro@...tes.org, will@...nel.org
Cc: haifeng.zhao@...ux.intel.com, iommu@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/2] iommu/vt-d: Skip dev-iotlb flush for inaccessible
 PCIe device without scalable mode

On 12/11/25 01:14, Jinhui Guo wrote:
> PCIe endpoints with ATS enabled and passed through to userspace
> (e.g., QEMU, DPDK) can hard-lock the host when their link drops,
> either by surprise removal or by a link fault.
> 
> Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
> request when device is disconnected") adds pci_dev_is_disconnected()
> to devtlb_invalidation_with_pasid() so ATS invalidation is skipped
> only when the device is being safely removed, but it applies only
> when Intel IOMMU scalable mode is enabled.
> 
> With scalable mode disabled or unsupported, a system hard-lock
> occurs when a PCIe endpoint's link drops because the Intel IOMMU
> waits indefinitely for an ATS invalidation that cannot complete.
> 
> Call Trace:
>   qi_submit_sync
>   qi_flush_dev_iotlb
>   __context_flush_dev_iotlb.part.0
>   domain_context_clear_one_cb
>   pci_for_each_dma_alias
>   device_block_translation
>   blocking_domain_attach_dev
>   iommu_deinit_device
>   __iommu_group_remove_device
>   iommu_release_device
>   iommu_bus_notifier
>   blocking_notifier_call_chain
>   bus_notify
>   device_del
>   pci_remove_bus_device
>   pci_stop_and_remove_bus_device
>   pciehp_unconfigure_device
>   pciehp_disable_slot
>   pciehp_handle_presence_or_link_change
>   pciehp_ist
> 
> Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
> adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
> which calls qi_flush_dev_iotlb() and can also hard-lock the system
> when a PCIe endpoint's link drops.
> 
> Call Trace:
>   qi_submit_sync
>   qi_flush_dev_iotlb
>   __context_flush_dev_iotlb.part.0
>   intel_context_flush_no_pasid
>   device_pasid_table_teardown
>   pci_pasid_table_teardown
>   pci_for_each_dma_alias
>   intel_pasid_teardown_sm_context
>   intel_iommu_release_device
>   iommu_deinit_device
>   __iommu_group_remove_device
>   iommu_release_device
>   iommu_bus_notifier
>   blocking_notifier_call_chain
>   bus_notify
>   device_del
>   pci_remove_bus_device
>   pci_stop_and_remove_bus_device
>   pciehp_unconfigure_device
>   pciehp_disable_slot
>   pciehp_handle_presence_or_link_change
>   pciehp_ist
> 
> Sometimes the endpoint loses connection without a link-down event
> (e.g., due to a link fault); killing the process (virsh destroy)
> then hard-locks the host.
> 
> Call Trace:
>   qi_submit_sync
>   qi_flush_dev_iotlb
>   __context_flush_dev_iotlb.part.0
>   domain_context_clear_one_cb
>   pci_for_each_dma_alias
>   device_block_translation
>   blocking_domain_attach_dev
>   __iommu_attach_device
>   __iommu_device_set_domain
>   __iommu_group_set_domain_internal
>   iommu_detach_group
>   vfio_iommu_type1_detach_group
>   vfio_group_detach_container
>   vfio_group_fops_release
>   __fput
> 
> pci_dev_is_disconnected() only covers safe-removal paths;
> pci_device_is_present() tests accessibility by reading
> vendor/device IDs and internally calls pci_dev_is_disconnected().
> On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs.
> 
> Since __context_flush_dev_iotlb() is only called on
> {attach,release}_dev paths (not hot), add pci_device_is_present()
> there to skip inaccessible devices and avoid the hard-lock.
> 
> Fixes: 37764b952e1b ("iommu/vt-d: Global devTLB flush when present context entry changed")
> Fixes: 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")

Cc: stable@...r.kernel.org

> Signed-off-by: Jinhui Guo <guojinhui.liam@...edance.com>
> ---
>   drivers/iommu/intel/pasid.c | 11 +++++++++++
>   1 file changed, 11 insertions(+)
> 
> diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
> index 3e2255057079..b1e8eb6a6504 100644
> --- a/drivers/iommu/intel/pasid.c
> +++ b/drivers/iommu/intel/pasid.c
> @@ -1099,9 +1099,20 @@ int intel_pasid_setup_sm_context(struct device *dev)
>    */
>   static void __context_flush_dev_iotlb(struct device_domain_info *info)
>   {
> +	struct pci_dev *pdev;
> +
>   	if (!info->ats_enabled)
>   		return;
>   
> +	/*
> +	 * Skip dev-IOTLB flush for inaccessible PCIe devices to prevent the
> +	 * Intel IOMMU from waiting indefinitely for an ATS invalidation that
> +	 * cannot complete.
> +	 */
> +	pdev = dev_is_pci(info->dev) ? to_pci_dev(info->dev) : NULL;
> +	if (pdev && !pci_device_is_present(pdev))
> +		return;

Could simply be

	if (dev_is_pci(info->dev) &&
	    !pci_device_is_present(to_pci_dev(info->dev)))
		return;

?

> +
>   	qi_flush_dev_iotlb(info->iommu, PCI_DEVID(info->bus, info->devfn),
>   			   info->pfsid, info->ats_qdep, 0, MAX_AGAW_PFN_WIDTH);
>   

Thanks,
baolu