Disable ATS via iommu during PCI resets

The iommu_deferred_attach() function invokes __iommu_attach_device(), but doesn't hold the group->mutex like other __iommu_attach_device() callers.

Though there is no pratical bug being triggered so far, it would be better to apply the same locking to this __iommu_attach_device(), since the IOMMU drivers nowaday are more aware of the group->mutex -- some of them use the iommu_group_mutex_assert() function that could be potentially in the path of an attach_dev callback function invoked by the __iommu_attach_device().

Worth mentioning that the iommu_deferred_attach() will soon need to check group->resetting_domain that must be locked also.

Thus, grab the mutex to guard __iommu_attach_device() like other callers.

Reviewed-by Jason Gunthorpe<[email protected]>

Reviewed-by Kevin Tian<[email protected]>

Signed-off-by Nicolin Chen<[email protected]>

---
  drivers/iommu/iommu.c | 13 ++++++++++---
  1 file changed, 10 insertions(+), 3 deletions(-)

This function can only be called on the default_domain. Trivally pass it in. In all three existing cases, the default domain was just attached to the device.

This avoids iommu_setup_dma_ops() calling iommu_get_domain_for_dev() the that will be used by external callers.

Suggested-by Jason Gunthorpe<[email protected]>

Signed-off-by Nicolin Chen<[email protected]>

---
  drivers/iommu/dma-iommu.h | 5 +++--
  drivers/iommu/dma-iommu.c | 4 +---
  drivers/iommu/iommu.c     | 6 +++---
  3 files changed, 7 insertions(+), 8 deletions(-)

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

This function can only be called on the default_domain. Trivally pass it in. In all three existing cases, the default domain was just attached to the device.

This avoids iommu_setup_dma_ops() calling iommu_get_domain_for_dev() the that will be used by external callers.

From: Tian, Kevin
Sent: Friday, November 14, 2025 5:17 PM

Quoted 3 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

Quoted 6 lines

This function can only be called on the default_domain. Trivally pass it in. In all three existing cases, the default domain was just attached to the device.

This avoids iommu_setup_dma_ops() calling iommu_get_domain_for_dev() the that will be used by external callers.

remove 'the' before 'that'

There is a need to stage a resetting PCI device to temporally the blocked domain and then attach back to its previously attached domain after reset.

This can be simply done by keeping the "previously attached domain" in the iommu_group->domain pointer while adding an iommu_group->resetting_domain, which gives troubles to IOMMU drivers using the iommu_get_domain_for_dev() for a device's physical domain in order to program IOMMU hardware.

And in such for-driver use cases, the iommu_group->mutex must be held, so it doesn't fit in external callers that don't hold the iommu_group->mutex.

Introduce a new iommu_driver_get_domain_for_dev() helper, exclusively for driver use cases that hold the iommu_group->mutex, to separate from those external use cases.

Add a lockdep_assert_not_held to the existing iommu_get_domain_for_dev() and highlight that in a kdoc.

Reviewed-by Kevin Tian <[email protected]>

Signed-off-by Nicolin Chen <[email protected]>

---
  include/linux/iommu.h                       |  1 +
  drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c |  5 ++--
  drivers/iommu/iommu.c                       | 28 +++++++++++++++++++++
  3 files changed, 32 insertions(+), 2 deletions(-)

include/linux/iommu.h +1 -0

index 801b2bd9e8d49..a42a2d1d7a0b7 100644
@@ -910,6 +910,7 @@ extern int iommu_attach_device(struct iommu_domain *domain,
  extern void iommu_detach_device(struct iommu_domain *domain,
  				struct device *dev);
  extern struct iommu_domain *iommu_get_domain_for_dev(struct device *dev);
+struct iommu_domain *iommu_driver_get_domain_for_dev(struct device *dev);
  extern struct iommu_domain *iommu_get_dma_domain(struct device *dev);
  extern int iommu_map(struct iommu_domain *domain, unsigned long iova,
  		     phys_addr_t paddr, size_t size, int prot, gfp_t gfp);

drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +3 -2

index a33fbd12a0dd9..412d1a9b31275 100644
@@ -3125,7 +3125,8 @@ int arm_smmu_set_pasid(struct arm_smmu_master *master,
  		       struct arm_smmu_domain *smmu_domain, ioasid_t pasid,
  		       struct arm_smmu_cd *cd, struct iommu_domain *old)
  {
-	struct iommu_domain *sid_domain = iommu_get_domain_for_dev(master->dev);
+	struct iommu_domain *sid_domain =
+		iommu_driver_get_domain_for_dev(master->dev);
  	struct arm_smmu_attach_state state = {
  		.master = master,
  		.ssid = pasid,

@@ -3191,7 +3192,7 @@ static int arm_smmu_blocking_set_dev_pasid(struct iommu_domain *new_domain,
  	 */
  	if (!arm_smmu_ssids_in_use(&master->cd_table)) {
  		struct iommu_domain *sid_domain =
-			iommu_get_domain_for_dev(master->dev);
+			iommu_driver_get_domain_for_dev(master->dev);
 
  		if (sid_domain->type == IOMMU_DOMAIN_IDENTITY ||
  		    sid_domain->type == IOMMU_DOMAIN_BLOCKED)

drivers/iommu/iommu.c +0 -0

index 1e322f87b1710..1f4d6ca0937bc 100644
@@ -2217,6 +2217,15 @@ void iommu_detach_device(struct iommu_domain *domain, struct device *dev)
  }

drivers/iommu/iommu.c +2 -0

+ */
  struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)
  {
  	/* Caller must be a probed driver on dev */

@@ -2225,10 +2234,29 @@ struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)
  	if (!group)
  		return NULL;
 
+	lockdep_assert_not_held(&group->mutex);

drivers/iommu/iommu.c +11 -0

+
  	return group->domain;
  }
  EXPORT_SYMBOL_GPL(iommu_get_domain_for_dev);
 
+/**
+ * iommu_driver_get_domain_for_dev() - Return the driver-level domain pointer
+ * @dev - Device to query
+ *
+ * This function can be called by an iommu driver that wants to get the physical
+ * domain within an iommu callback function where group->mutex is held.
+ */
+struct iommu_domain *iommu_driver_get_domain_for_dev(struct device *dev)
+{
+	struct iommu_group *group = dev->iommu_group;

Quoted 8 lines · Nicolin Chen

+/**
+ * iommu_get_domain_for_dev() - Return the DMA API domain pointer
+ * @dev - Device to query
+ *
+ * This function can be called within a driver bound to dev. The returned
+ * pointer is valid for the lifetime of the bound driver.
+ *
+ * It should not be called by drivers with driver_managed_dma = true.

"driver_managed_dma != true" means the driver will use the default domain allocated by the iommu core during iommu probe.

The iommu core
ensures that this domain stored at group->domain will not be changed during the driver's whole lifecycle. That's reasonable.

How about making some code to enforce this requirement? Something like below ...

Quoted 8 lines

+ */
struct iommu_domain *iommu_get_domain_for_dev(struct device *dev) {
/* Caller must be a probed driver on dev */

drivers/iommu/iommu.c +1 -0

@@ -2225,10 +2234,29 @@ struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)
  	if (!group)
  		return NULL;
+	lockdep_assert_not_held(&group->mutex);

...

	if (WARN_ON(!dev->driver || !group->owner_cnt || group->owner))
		return NULL;

Hi Baolu,

Quoted 10 lines · Baolu Lu

Quoted 8 lines · Nicolin Chen

+/**
+ * iommu_get_domain_for_dev() - Return the DMA API domain pointer
+ * @dev - Device to query
+ *
+ * This function can be called within a driver bound to dev. The returned
+ * pointer is valid for the lifetime of the bound driver.
+ *
+ * It should not be called by drivers with driver_managed_dma = true.

Quoted 2 lines

"driver_managed_dma != true" means the driver will use the default domain allocated by the iommu core during iommu probe.

Hmm, I am not very sure. Jason's remarks pointed out that There is an exception in host1x_client_iommu_detach():
https://lore.kernel.org/all/[email protected]/

Where the group->domain could be NULL, i.e. not attached to the default domain?

Quoted 17 lines

The iommu core
ensures that this domain stored at group->domain will not be changed during the driver's whole lifecycle. That's reasonable.

How about making some code to enforce this requirement? Something like below ...

Quoted 8 lines

+ */
struct iommu_domain *iommu_get_domain_for_dev(struct device *dev) {
/* Caller must be a probed driver on dev */

drivers/iommu/iommu.c +1 -0

@@ -2225,10 +2234,29 @@ struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)
  	if (!group)
  		return NULL;
+	lockdep_assert_not_held(&group->mutex);

...

Quoted 2 lines

	if (WARN_ON(!dev->driver || !group->owner_cnt || group->owner))
		return NULL;

With that, could host1x_client_iommu_detach() trigger WARN_ON?

Quoted 43 lines · Nicolin Chen

Hi Baolu,

Quoted 10 lines · Baolu Lu

Quoted 8 lines · Nicolin Chen

+/**
+ * iommu_get_domain_for_dev() - Return the DMA API domain pointer
+ * @dev - Device to query
+ *
+ * This function can be called within a driver bound to dev. The returned
+ * pointer is valid for the lifetime of the bound driver.
+ *
+ * It should not be called by drivers with driver_managed_dma = true.

Quoted 2 lines

"driver_managed_dma != true" means the driver will use the default domain allocated by the iommu core during iommu probe.

Hmm, I am not very sure. Jason's remarks pointed out that There is an exception in host1x_client_iommu_detach():
https://lore.kernel.org/all/[email protected]/

Where the group->domain could be NULL, i.e. not attached to the default domain?

Quoted 17 lines

The iommu core
ensures that this domain stored at group->domain will not be changed during the driver's whole lifecycle. That's reasonable.

How about making some code to enforce this requirement? Something like below ...

Quoted 8 lines

+ */
struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)

   {
   	/* Caller must be a probed driver on dev */

drivers/iommu/iommu.c +1 -0

@@ -2225,10 +2234,29 @@ struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)
   	if (!group)
   		return NULL;
+	lockdep_assert_not_held(&group->mutex);

...

Quoted 2 lines

	if (WARN_ON(!dev->driver || !group->owner_cnt || group->owner))
		return NULL;

Quoted 1 line

With that, could host1x_client_iommu_detach() trigger WARN_ON?

Hi Baolu,

For v6, I tend to keep this API as-is, trying not to give troubles to existing callers. Jason suggested a potential followup series:
https://lore.kernel.org/linux-iommu/[email protected]/
That would replace this function, so maybe we can think about that.

If you have a strong feeling about the WARN_ON, please let me know.

Thanks
Nicolin

Quoted 7 lines · Nicolin Chen

For v6, I tend to keep this API as-is, trying not to give troubles to existing callers. Jason suggested a potential followup series:
https://lore.kernel.org/linux-iommu/[email protected]/
That would replace this function, so maybe we can think about that.

If you have a strong feeling about the WARN_ON, please let me know.

No strong feeling. I am fine with it because the comments have already stated that "This function can be called within a driver bound to dev.".

Hi Baolu,

Quoted 10 lines · Baolu Lu

Quoted 8 lines · Nicolin Chen

+/**
+ * iommu_get_domain_for_dev() - Return the DMA API domain pointer
+ * @dev - Device to query
+ *
+ * This function can be called within a driver bound to dev. The returned
+ * pointer is valid for the lifetime of the bound driver.
+ *
+ * It should not be called by drivers with driver_managed_dma = true.

Quoted 2 lines

"driver_managed_dma != true" means the driver will use the default domain allocated by the iommu core during iommu probe.

Hmm, I am not very sure. Jason's remarks pointed out that There is an exception in host1x_client_iommu_detach():
https://lore.kernel.org/all/[email protected]/

Where the group->domain could be NULL, i.e. not attached to the default domain?

Quoted 10 lines

Quoted 8 lines

+ */
struct iommu_domain *iommu_get_domain_for_dev(struct device *dev) {
/* Caller must be a probed driver on dev */

drivers/iommu/iommu.c +1 -0

@@ -2225,10 +2234,29 @@ struct iommu_domain *iommu_get_domain_for_dev(struct device *dev)
  	if (!group)
  		return NULL;
+	lockdep_assert_not_held(&group->mutex);

...

Quoted 2 lines

	if (WARN_ON(!dev->driver || !group->owner_cnt || group->owner))
		return NULL;

With that, could host1x_client_iommu_detach() trigger WARN_ON?

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

There is a need to stage a resetting PCI device to temporally the blocked

drivers/iommu/iommu.c +23 -0

+/**
+ * iommu_dev_reset_prepare() - Block IOMMU to prepare for a device reset
+ * @dev: device that is going to enter a reset routine
+ *
+ * When certain device is entering a reset routine, it wants to block any IOMMU
+ * activity during the reset routine. This includes blocking any translation as
+ * well as cache invalidation (especially the device cache).
+ *
+ * This function attaches all RID/PASID of the device's to IOMMU_DOMAIN_BLOCKED
+ * allowing any blocked-domain-supporting IOMMU driver to pause translation and
+ * cahce invalidation, but leaves the software domain pointers intact so later
+ * the iommu_dev_reset_done() can restore everything.
+ *
+ * Return: 0 on success or negative error code if the preparation failed.
+ *
+ * Caller must use iommu_dev_reset_prepare() and iommu_dev_reset_done() together
+ * before/after the core-level reset routine, to unset the resetting_domain.
+ *
+ * These two functions are designed to be used by PCI reset functions that would
+ * not invoke any racy iommu_release_device(), since PCI sysfs node gets removed
+ * before it notifies with a BUS_NOTIFY_REMOVED_DEVICE. When using them in other
+ * case, callers must ensure there will be no racy iommu_release_device() call,
+ * which otherwise would UAF the dev->iommu_group pointer.

drivers/iommu/iommu.c +6 -0

+
+	guard(mutex)(&group->mutex);
+
+	/*
+	 * Once the resetting_domain is set, any concurrent attachment to this
+	 * iommu_group will be rejected, which would break the attach routines

drivers/iommu/iommu.c +79 -0

+
+	/* Re-entry is not allowed */
+	if (WARN_ON(group->resetting_domain))
+		return -EBUSY;
+
+	ret = __iommu_group_alloc_blocking_domain(group);
+	if (ret)
+		return ret;
+
+	/* Stage RID domain at blocking_domain while retaining group->domain */
+	if (group->domain != group->blocking_domain) {
+		ret = __iommu_attach_device(group->blocking_domain, dev,
+					    group->domain);
+		if (ret)
+			return ret;
+	}
+
+	/*
+	 * Stage PASID domains at blocking_domain while retaining pasid_array.
+	 *
+	 * The pasid_array is mostly fenced by group->mutex, except one reader
+	 * in iommu_attach_handle_get(), so it's safe to read without xa_lock.
+	 */
+	xa_for_each_start(&group->pasid_array, pasid, entry, 1)
+		iommu_remove_dev_pasid(dev, pasid,
+				       pasid_array_entry_to_domain(entry));
+
+	group->resetting_domain = group->blocking_domain;
+	return ret;
+}
+EXPORT_SYMBOL_GPL(iommu_dev_reset_prepare);
+
+/**
+ * iommu_dev_reset_done() - Restore IOMMU after a device reset is finished
+ * @dev: device that has finished a reset routine
+ *
+ * When certain device has finished a reset routine, it wants to restore its
+ * IOMMU activity, including new translation as well as cache invalidation, by
+ * re-attaching all RID/PASID of the device's back to the domains retained in
+ * the core-level structure.
+ *
+ * Caller must pair it with a successfully returned iommu_dev_reset_prepare().
+ *
+ * Note that, although unlikely, there is a risk that re-attaching domains might
+ * fail due to some unexpected happening like OOM.
+ */
+void iommu_dev_reset_done(struct device *dev)
+{
+	struct iommu_group *group = dev->iommu_group;
+	unsigned long pasid;
+	void *entry;
+
+	if (!dev_has_iommu(dev))
+		return;
+
+	guard(mutex)(&group->mutex);
+
+	/* iommu_dev_reset_prepare() was bypassed for the device */
+	if (!group->resetting_domain)
+		return;
+
+	/* iommu_dev_reset_prepare() was not successfully called */
+	if (WARN_ON(!group->blocking_domain))
+		return;
+
+	/* Re-attach RID domain back to group->domain */
+	if (group->domain != group->blocking_domain) {
+		WARN_ON(__iommu_attach_device(group->domain, dev,
+					      group->blocking_domain));
+	}
+
+	/*
+	 * Re-attach PASID domains back to the domains retained in pasid_array.
+	 *
+	 * The pasid_array is mostly fenced by group->mutex, except one reader
+	 * in iommu_attach_handle_get(), so it's safe to read without xa_lock.
+	 */
+	xa_for_each_start(&group->pasid_array, pasid, entry, 1)
+		WARN_ON(__iommu_set_group_pasid(

drivers/iommu/iommu.c int iommu_replace_group_handle(struct iommu_group *group, · line 3950

Quoted 9 lines · Nicolin Chen

drivers/iommu/iommu.c +9 -0

+int iommu_dev_reset_prepare(struct device *dev)
+{
+	struct iommu_group *group = dev->iommu_group;
+	unsigned long pasid;
+	void *entry;
+	int ret = 0;
+
+	if (!dev_has_iommu(dev))
+		return 0;

Nit: This interface is only for PCI layer, so why not just

	if (WARN_ON(!dev_is_pci(dev)))
		return -EINVAL;

?

Quoted 6 lines

drivers/iommu/iommu.c +6 -0

+
+	guard(mutex)(&group->mutex);
+
+	/*
+	 * Once the resetting_domain is set, any concurrent attachment to this
+	 * iommu_group will be rejected, which would break the attach routines

drivers/iommu/iommu.c int iommu_replace_group_handle(struct iommu_group *group, · line 3966

Quoted 10 lines

drivers/iommu/iommu.c +10 -0

+	 * of the sibling devices in the same iommu_group. So, skip this case.
+	 */
+	if (dev_is_pci(dev)) {
+		struct group_device *gdev;
+
+		for_each_group_device(group, gdev) {
+			if (gdev->dev != dev)
+				return 0;
+		}
+	}

With above dev_is_pci() check, here it can simply be,

	if (list_count_nodes(&group->devices) != 1)
		return 0;		

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

Note that there are two corner cases:
1. Devices in the same iommu_group
Since an attachment is always per iommu_group, disallowing one device to switch domains (or HWPTs in iommufd) would have to disallow others in the same iommu_group to switch domains as well. So, play safe by preventing a shared iommu_group from going through the iommu reset.

drivers/iommu/iommu.c +2 -0

@@ -2253,6 +2264,16 @@ struct iommu_domain
 *iommu_driver_get_domain_for_dev(struct device *dev)
 
 	lockdep_assert_held(&group->mutex);
 
+	/*
+	 * Driver handles the low-level __iommu_attach_device(), including

the

(quoted diff) +1 -0

+	 * one invoked by iommu_dev_reset_done(), in which case the driver

must

(quoted diff) +1 -0

+	 * get the resetting_domain over group->domain caching the one

prior to

(quoted diff) +1 -0

+	 * iommu_dev_reset_prepare(), so that it wouldn't end up with

attaching

+int iommu_dev_reset_prepare(struct device *dev)

(quoted diff) +2 -0

+	/*
+	 * Once the resetting_domain is set, any concurrent attachment to

this

(quoted diff) +1 -0

+	 * iommu_group will be rejected, which would break the attach

routines

Quoted 9 lines

From: Nicolin Chen <[email protected]>

drivers/iommu/iommu.c +3 -0

@@ -2195,6 +2200,12 @@ int iommu_deferred_attach(struct device *dev,
 struct iommu_domain *domain)
 
 	guard(mutex)(&dev->iommu_group->mutex);
 
+	/*
+	 * This is a concurrent attach while a group device is resetting. Reject
+	 * it until iommu_dev_reset_done() attaches the device to group-

drivers/iommu/iommu.c int iommu_deferred_attach(struct device *dev, struct iommu_domain *domain) · line 2208

Quoted 4 lines

Quoted 1 line

domain.

drivers/iommu/iommu.c +3 -0

+	 */
+	if (dev->iommu_group->resetting_domain)
+		return -EBUSY;

It might be worth noting that failing a deferred attach leads to failing the dma map operation. It's different from other explicit attaching paths, but there is nothing more we can do here.

Quoted 5 lines

drivers/iommu/iommu.c +0 -0

@@ -2253,6 +2264,16 @@ struct iommu_domain
 *iommu_driver_get_domain_for_dev(struct device *dev)
 
 	lockdep_assert_held(&group->mutex);
 

drivers/iommu/iommu.c struct iommu_domain *iommu_driver_get_domain_for_dev(struct device *dev) · line 2275

Quoted 13 lines

(quoted diff) +2 -0

+	/*
+	 * Driver handles the low-level __iommu_attach_device(), including

the

(quoted diff) +1 -0

+	 * one invoked by iommu_dev_reset_done(), in which case the driver

must

(quoted diff) +1 -0

+	 * get the resetting_domain over group->domain caching the one

prior to

(quoted diff) +1 -0

+	 * iommu_dev_reset_prepare(), so that it wouldn't end up with

attaching

drivers/iommu/iommu.c +4 -0

+	 * the device from group->domain (old) to group->domain (new).
+	 */
+	if (group->resetting_domain)
+		return group->resetting_domain;

It's a pretty long sentence. Let's break it.

Quoted 1 line

+int iommu_dev_reset_prepare(struct device *dev)

If this is intended to be used by pci for now, it's clearer to have a 'pci' word in the name. Later when there is a demand calling it from other buses, discussion will catch eyes to ensure no racy of UAF etc.

Quoted 5 lines

(quoted diff) +2 -0

+	/*
+	 * Once the resetting_domain is set, any concurrent attachment to

this

(quoted diff) +1 -0

+	 * iommu_group will be rejected, which would break the attach

routines

drivers/iommu/iommu.c int iommu_replace_group_handle(struct iommu_group *group, · line 3966

Quoted 10 lines

drivers/iommu/iommu.c +10 -0

+	 * of the sibling devices in the same iommu_group. So, skip this case.
+	 */
+	if (dev_is_pci(dev)) {
+		struct group_device *gdev;
+
+		for_each_group_device(group, gdev) {
+			if (gdev->dev != dev)
+				return 0;
+		}
+	}

btw what'd be a real impact to reject concurrent attachment for sibling devices? This series already documents the impact in uAPI for the device under attachment, and the userspace already knows the restriction of devices in the group which must be attached to a same hwpt.

Combining those knowledge I don't think there is a problem for userspace to be aware of that resetting a device in a multi-dev group affects concurrent attachment of sibling devices...

drivers/iommu/iommu.c int iommu_replace_group_handle(struct iommu_group *group, · line 4036

Quoted 5 lines

drivers/iommu/iommu.c +5 -0

+	/* Re-attach RID domain back to group->domain */
+	if (group->domain != group->blocking_domain) {
+		WARN_ON(__iommu_attach_device(group->domain, dev,
+					      group->blocking_domain));
+	}

Even if we disallow resetting on a multi-dev group, there is still a corner case not taken care here.

It's possible that there is only one device in the group at prepare, coming with a device hotplug added to the group in the middle, then doing reset_done.

In this case the newly-added device will inherit the blocking domain.

Then reset_done should loop all devices in the group and re-attach all of them to the cached domain.

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+ *
+ * This function attaches all RID/PASID of the device's to IOMMU_DOMAIN_BLOCKED
+ * allowing any blocked-domain-supporting IOMMU driver to pause translation and

Quoted 8 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+ *
+ * This function attaches all RID/PASID of the device's to IOMMU_DOMAIN_BLOCKED
+ * allowing any blocked-domain-supporting IOMMU driver to pause translation and

__iommu_group_alloc_blocking_domain() will allocate a paging domain if a driver doesn't support blocked_domain itself. So in the end this applies to all IOMMU drivers.

I saw several other places mention IOMMU_DOMAIN_BLOCKED in this series. Not very accurate.

PCIe permits a device to ignore ATS invalidation TLPs, while processing a reset. This creates a problem visible to the OS where an ATS invalidation command will time out. E.g. an SVA domain will have no coordination with a reset event and can racily issue ATS invalidations to a resetting device.

The OS should do something to mitigate this as we do not want production systems to be reporting critical ATS failures, especially in a hypervisor environment. Broadly, OS could arrange to ignore the timeouts, block page table mutations to prevent invalidations, or disable and block ATS.

The PCIe spec in sec 10.3.1 IMPLEMENTATION NOTE recommends to disable and block ATS before initiating a Function Level Reset. It also mentions that other reset methods could have the same vulnerability as well.

Provide a callback from the PCI subsystem that will enclose the reset and have the iommu core temporarily change all the attached domain to BLOCKED. After attaching a BLOCKED domain, IOMMU hardware would fence any incoming ATS queries. And IOMMU drivers should also synchronously stop issuing new ATS invalidations and wait for all ATS invalidations to complete. This can avoid any ATS invaliation timeouts.

However, if there is a domain attachment/replacement happening during an ongoing reset, ATS routines may be re-activated between the two function calls. So, introduce a new resetting_domain in the iommu_group structure to reject any concurrent attach_dev/set_dev_pasid call during a reset for a concern of compatibility failure. Since this changes the behavior of an attach operation, update the uAPI accordingly.

Note that there are two corner cases:
1. Devices in the same iommu_group
Since an attachment is always per iommu_group, disallowing one device to switch domains (or HWPTs in iommufd) would have to disallow others in the same iommu_group to switch domains as well. So, play safe by preventing a shared iommu_group from going through the iommu reset.
2. SRIOV devices that its PF is resetting while its VF isn't

In such case, the VF itself is already broken. So, there is no point in preventing PF from going through the iommu reset.

+ * iommu_dev_reset_prepare() - Block IOMMU to prepare for a device reset
+ * @dev: device that is going to enter a reset routine
+ *
+ * When certain device is entering a reset routine, it wants to block any IOMMU
+ * activity during the reset routine. This includes blocking any translation as
+ * well as cache invalidation (especially the device cache).
+ *
+ * This function attaches all RID/PASID of the device's to IOMMU_DOMAIN_BLOCKED
+ * allowing any blocked-domain-supporting IOMMU driver to pause translation and
+ * cahce invalidation, but leaves the software domain pointers intact so later

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

PCIe permits a device to ignore ATS invalidation TLPs, while processing a reset. This creates a problem visible to the OS where an ATS invalidation command will time out: e.g. an SVA domain will have no coordination with a reset event and can racily issue ATS invalidations to a resetting device.

The PCIe spec in sec 10.3.1 IMPLEMENTATION NOTE recommends to disable and
block ATS before initiating a Function Level Reset. It also mentions that other reset methods could have the same vulnerability as well.

Now iommu_dev_reset_prepare/done() helpers are introduced for this matter.
Use them in all the existing reset functions, which will attach the device

Quoted 13 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

PCIe permits a device to ignore ATS invalidation TLPs, while processing a reset. This creates a problem visible to the OS where an ATS invalidation command will time out: e.g. an SVA domain will have no coordination with a reset event and can racily issue ATS invalidations to a resetting device.

The PCIe spec in sec 10.3.1 IMPLEMENTATION NOTE recommends to disable and
block ATS before initiating a Function Level Reset. It also mentions that other reset methods could have the same vulnerability as well.

Quoted 3 lines

Now iommu_dev_reset_prepare/done() helpers are introduced for this matter.
Use them in all the existing reset functions, which will attach the device

looks pci_reset_bus_function() was missed?

drivers/pci/pci-acpi.c void pci_set_acpi_fwnode(struct pci_dev *dev) · line 974

Quoted 5 lines

drivers/pci/pci-acpi.c +1 -0

@@ -971,6 +971,7 @@ void pci_set_acpi_fwnode(struct pci_dev *dev)
 int pci_dev_acpi_reset(struct pci_dev *dev, bool probe)
 {
 	acpi_handle handle = ACPI_HANDLE(&dev->dev);
+	int ret = 0;

no need to initialize it. ditto for other reset functions.

drivers/pci/pci.c bool pci_reset_supported(struct pci_dev *dev) · line 109

Quoted 11 lines

(quoted diff) +2 -0

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software disables ATS

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

drivers/pci/pci.c +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

which one is desired?

drivers/pci/pci.c EXPORT_SYMBOL(pci_wait_for_pending_transaction); · line 4508

Quoted 4 lines

drivers/pci/pci.c +4 -0

+	/* Have to call it after waiting for pending DMA transaction */
+	ret = pci_reset_iommu_prepare(dev);
+	if (ret) {
+		pci_err(dev, "failed to stop IOMMU\n");

the error message could be more informative.

From: Nicolin Chen <[email protected]>
Sent: Saturday, November 15, 2025 2:01 AM

Quoted 5 lines · Kevin

Quoted 5 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software disables

ATS

Quoted 13 lines

drivers/pci/pci.c bool pci_reset_supported(struct pci_dev *dev) · line 109

Quoted 9 lines

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

drivers/pci/pci.c +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

Quoted 1 line

which one is desired?

The comments says "the iommu driver that enabled ATS". It doesn't conflict with what the PCI core checks here?

Quoted 7 lines

drivers/pci/pci.c EXPORT_SYMBOL(pci_wait_for_pending_transaction); · line 4508

Quoted 5 lines

drivers/pci/pci.c +4 -0

+	/* Have to call it after waiting for pending DMA transaction */
+	ret = pci_reset_iommu_prepare(dev);
+	if (ret) {
+		pci_err(dev, "failed to stop IOMMU\n");

the error message could be more informative.

OK. Perhaps print the ret value.

Quoted 23 lines

From: Nicolin Chen <[email protected]>
Sent: Saturday, November 15, 2025 2:01 AM

Quoted 5 lines · Kevin

Quoted 5 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software disables

ATS

Quoted 13 lines

drivers/pci/pci.c bool pci_reset_supported(struct pci_dev *dev) · line 109

Quoted 9 lines

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

drivers/pci/pci.c +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

Quoted 4 lines

Quoted 1 line

which one is desired?

The comments says "the iommu driver that enabled ATS". It doesn't conflict with what the PCI core checks here?

actually this is sent to all IOMMU drivers. there is no check on whether a specific driver has enabled ATS in this path.

Quoted 9 lines

Quoted 6 lines

drivers/pci/pci.c EXPORT_SYMBOL(pci_wait_for_pending_transaction); · line 4508

Quoted 4 lines

drivers/pci/pci.c +4 -0

+	/* Have to call it after waiting for pending DMA transaction */
+	ret = pci_reset_iommu_prepare(dev);
+	if (ret) {
+		pci_err(dev, "failed to stop IOMMU\n");

the error message could be more informative.

OK. Perhaps print the ret value.

and mention that it's for PCI reset.

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 18, 2025 3:27 AM

Quoted 9 lines · Kevin

Quoted 9 lines

From: Nicolin Chen <[email protected]>
Sent: Saturday, November 15, 2025 2:01 AM

Quoted 5 lines · Kevin

Quoted 5 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software

disables

Quoted 19 lines

Quoted 18 lines

ATS

Quoted 13 lines

drivers/pci/pci.c bool pci_reset_supported(struct pci_dev *dev) · line 109

Quoted 9 lines

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

drivers/pci/pci.c +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

Quoted 1 line

which one is desired?

The comments says "the iommu driver that enabled ATS". It doesn't conflict with what the PCI core checks here?

Quoted 2 lines

actually this is sent to all IOMMU drivers. there is no check on whether a specific driver has enabled ATS in this path.

But the comment doesn't say "check"..

How about "Notify the iommu driver that enables/disables ATS"?

The point is that pci_enable_ats() is called in iommu drivers.

Quoted 38 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 18, 2025 3:27 AM

Quoted 9 lines · Kevin

Quoted 9 lines

From: Nicolin Chen <[email protected]>
Sent: Saturday, November 15, 2025 2:01 AM

Quoted 5 lines · Kevin

Quoted 5 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software

disables

Quoted 14 lines

Quoted 14 lines

ATS

Quoted 13 lines

drivers/pci/pci.c bool pci_reset_supported(struct pci_dev *dev) · line 109

Quoted 9 lines

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

drivers/pci/pci.c +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

which one is desired?

The comments says "the iommu driver that enabled ATS". It doesn't conflict with what the PCI core checks here?

actually this is sent to all IOMMU drivers. there is no check on whether a specific driver has enabled ATS in this path.

But the comment doesn't say "check"..

Quoted 4 lines

How about "Notify the iommu driver that enables/disables ATS"?

The point is that pci_enable_ats() is called in iommu drivers.

but in current way even an iommu driver which doesn't call pci_enable_ats() will also be notified then I didn't see the point of adding an attribute to "the iommu driver".

Quoted 38 lines · Kevin

Quoted 38 lines

From: Nicolin Chen<[email protected]>
Sent: Tuesday, November 18, 2025 3:27 AM

Quoted 9 lines · Kevin

Quoted 9 lines

From: Nicolin Chen<[email protected]>
Sent: Saturday, November 15, 2025 2:01 AM

Quoted 5 lines · Kevin

Quoted 5 lines

From: Nicolin Chen<[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software

disables

Quoted 13 lines

Quoted 13 lines

ATS

Quoted 12 lines

Review

Quoted 9 lines

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

(quoted diff) +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

Quoted 5 lines

Quoted 3 lines

Quoted 1 line

which one is desired?

The comments says "the iommu driver that enabled ATS". It doesn't conflict with what the PCI core checks here?

actually this is sent to all IOMMU drivers. there is no check on whether a specific driver has enabled ATS in this path.

But the comment doesn't say "check"..

How about "Notify the iommu driver that enables/disables ATS"?

The point is that pci_enable_ats() is called in iommu drivers.

Quoted 3 lines

but in current way even an iommu driver which doesn't call pci_enable_ats() will also be notified then I didn't see the point of adding an attribute to "the iommu driver".

Hmm, that's a fair point.

Having looked closely, I see only AMD and ARM call that to enable ATs. How others (e.g. Intel) enable it?

The VT-d driver enables ATS in the iommu probe_finalize() path (for scalable mode).

iommu_enable_pci_ats() will eventually call pci_enable_ats() after some necessary checks.

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 18, 2025 9:42 AM

Quoted 38 lines · Kevin

Quoted 38 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 18, 2025 3:27 AM

Quoted 9 lines · Kevin

Quoted 9 lines

From: Nicolin Chen <[email protected]>
Sent: Saturday, November 15, 2025 2:01 AM

Quoted 5 lines · Kevin

Quoted 5 lines

From: Nicolin Chen <[email protected]>
Sent: Tuesday, November 11, 2025 1:13 PM

+/*
+ * Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software

disables

Quoted 14 lines

Quoted 14 lines

ATS

Quoted 13 lines

Review

Quoted 9 lines

before
+ * initiating a reset. Notify the iommu driver that enabled ATS.
+ */

(quoted diff) +6 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);
+	return 0;
+}

the comment says "driver that enabled ATS", but the code checks whether ATS is supported.

Quoted 7 lines

Quoted 4 lines

Quoted 1 line

which one is desired?

The comments says "the iommu driver that enabled ATS". It doesn't conflict with what the PCI core checks here?

actually this is sent to all IOMMU drivers. there is no check on whether a specific driver has enabled ATS in this path.

But the comment doesn't say "check"..

Quoted 8 lines

Quoted 4 lines

How about "Notify the iommu driver that enables/disables ATS"?

The point is that pci_enable_ats() is called in iommu drivers.

but in current way even an iommu driver which doesn't call pci_enable_ats() will also be notified then I didn't see the point of adding an attribute to "the iommu driver".

Hmm, that's a fair point.

Having looked closely, I see only AMD and ARM call that to enable ATs. How others (e.g. Intel) enable it?

And how do you think of the followings?

/*
* Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software disables ATS
before
* initiating a reset. Though not all IOMMU drivers calls pci_enable_ats(), it
* only gets invoked in IOMMU driver. And it is racy to check dev-

Quoted 1 line

ats_enabled

* here, as a concurrent IOMMU attachment can enable ATS right after this
line.
*
* Notify the IOMMU driver to stop IOMMU translations until the reset is
done,
* to ensure that the ATS function and its related invalidations are disabled. */

Quoted 8 lines

From: Nicolin Chen <[email protected]>
And how do you think of the followings?

/*
* Per PCIe r6.3, sec 10.3.1 IMPLEMENTATION NOTE, software disables ATS
before
* initiating a reset. Though not all IOMMU drivers calls pci_enable_ats(), it
* only gets invoked in IOMMU driver. And it is racy to check dev-

Quoted 9 lines

Quoted 1 line

ats_enabled

* here, as a concurrent IOMMU attachment can enable ATS right after this
line.
*
* Notify the IOMMU driver to stop IOMMU translations until the reset is
done,
* to ensure that the ATS function and its related invalidations are disabled. */

I'd remove the words between "Though not ..." and "after this line", which could be explained in iommu side following Bjorn's suggestion to not check pci_ats_supported() in pci core.

PCIe permits a device to ignore ATS invalidation TLPs, while processing a reset. This creates a problem visible to the OS where an ATS invalidation command will time out: e.g. an SVA domain will have no coordination with a reset event and can racily issue ATS invalidations to a resetting device.

The PCIe spec in sec 10.3.1 IMPLEMENTATION NOTE recommends to disable and block ATS before initiating a Function Level Reset. It also mentions that other reset methods could have the same vulnerability as well.

Now iommu_dev_reset_prepare/done() helpers are introduced for this matter.

Use them in all the existing reset functions, which will attach the device to an IOMMU_DOMAIN_BLOCKED during a reset, so as to allow IOMMU driver to:
- invoke pci_disable_ats() and pci_enable_ats(), if necessary
- wait for all ATS invalidations to complete
- stop issuing new ATS invalidations
- fence any incoming ATS queries

drivers/pci/pci.c bool pci_reset_supported(struct pci_dev *dev) · line 107

Quoted 4 lines · Nicolin Chen

drivers/pci/pci.c +4 -0

+int pci_reset_iommu_prepare(struct pci_dev *dev)
+{
+	if (pci_ats_supported(dev))
+		return iommu_dev_reset_prepare(&dev->dev);

Why bother checking pci_ats_supported() here? That could be done inside iommu_dev_reset_prepare(), since iommu.c already uses dev_is_pci() and pci_ats_supported() is already exported outside drivers/pci/.