Re: [PATCH v2 0/3] iommu/vt-d: Ensure atomicity in context and PASID entry updates

[Vineeth Pillai (Google)]

Hi Baolu,

> This is a follow-up from recent discussions in the iommu community
> mailing list [1] [2] regarding potential race conditions in table
> entry updates.
>
> The Intel VT-d hardware fetches translation table entries (context
> entries and PASID entries) in 128-bit (16-byte) chunks. Currently, the
> Linux driver often updates these entries using multiple 64-bit writes.
> This creates a race condition where the IOMMU hardware may fetch a
> "torn" entry — a mixture of old and new data — during a CPU update. This
> can lead to unpredictable hardware behavior, spurious faults, or system
> instability.
> 
> This addresses these atomicity issues by following the translation table
> entry ownership handshake protocal recommended by the VT-d specification.
> 
> [1] https://lore.kernel.org/linux-iommu/20251227175728.4358-1-dmaluka@xxxxxxxxxxxx/
> [2] https://lore.kernel.org/linux-iommu/20260107201800.2486137-1-skhawaja@xxxxxxxxxx/
> 
> Change log:
> 
> v2:
>  - Considering that these fixes should be backported deep into old
>    versions, and the previous solution relies heavily on the x86_64
>    cmpxchg16b instruction, which is not friendly to backport as it might
>    cause regressions on early hardware or configurations, we use the
>    simple dma_wmb() approach in this version.
>  - Jason proposed the entry-sync framework
>    (https://lore.kernel.org/linux-iommu/20260113150542.GF812923@xxxxxxxxxx/)
>    which consolidates the details of how to update a translation table
>    entry in common code shared by the individual drivers, so that the
>    IOMMU driver could be designed without considering the hitless or
>    non-hitless replace.
>  - To make life easier, I decided to split all the work into multiple
>    series. The first, as it is, covers fixing the real problems in a
>    backport-friendly way, and the next series covers entry-sync for
>    PASID table entry updates.
> 
> v1: https://lore.kernel.org/linux-iommu/20260113030052.977366-1-baolu.lu@xxxxxxxxxxxxxxx/
> 
> Lu Baolu (3):
>   iommu/vt-d: Clear Present bit before tearing down PASID entry
>   iommu/vt-d: Clear Present bit before tearing down context entry
>   iommu/vt-d: Fix race condition during PASID entry replacement

This last patch(addressing CVE-2026-45945) did not seem to make it to
6.18 stable, while the first 2 patches went in with v6.18.14.

Could you please send a patch for 6.18?

Thanks,
Vineeth