Linux kernel (drivers/iommu/intel): VT-d advertised IOMMU dirty-page tracking on units whose page walk is not coherent

Impact

VT-d advertised IOMMU dirty-page tracking on units whose page walk is not coherent with the CPU. Per the Intel spec, the IOMMU then takes a non-recoverable fault the moment it tries to atomically set an A/D bit, so a tenant enabling dirty tracking on its own passthrough domain wedges the IOMMU unit that serves other devices on that node. The kernel CNA scored this scope-changed, which matches: the damage lands outside the requesting domain. Separately, dirty bits that never land quietly break live-migration correctness for any workload relying on them.

Who can reach it

A tenant (or the migration control plane acting on a tenant's request) allocates an iommufd hardware page table with dirty tracking enabled - IOMMU_HWPT_ALLOC with the dirty-tracking flag - for a device behind a VT-d unit that reports scalable-mode A/D support without snooped page-walk coherency. Reachable from /dev/iommu with no host root. Conditional on Intel VT-d, scalable mode, and hardware that reports ecap_slads without ecap_smpwc.

What to do

No fixed release is listed in this record; apply the linked stable commits or run a current stable/LTS kernel. Interim: do not enable IOMMU dirty tracking (and therefore IOMMU-assisted live migration of passthrough devices) on hosts whose VT-d units lack snooped page-walk coherency; gate the dirty-tracking flag in your VMM/control plane rather than letting tenants request it.

References