Hi, On an Intel SoC with several 8250_mid PCIe UARTs built into the CPU, I can reliably trigger I/O page faults if I invoke TIOCVHANGUP on any of the UARTs and then re-open that UART. Invoking TIOCVHANGUP appears to clear the MSI address/data registers in the UART via tty_ioctl() -> tty_vhangup() -> __tty_hangup() -> uart_hangup() -> uart_shutdown() -> uart_port_shutdown() -> univ8250_release_irq() -> free_irq() -> irq_domain_deactivate_irq() -> __irq_domain_deactivate_irq() -> msi_domain_deactivate() -> __pci_write_msi_msg(): [root@icelake ~]# lspci -s 00:1a.0 -vv | grep -A1 MSI: Capabilities: [40] MSI: Enable+ Count=1/1 Maskable- 64bit- Address: fee00278 Data: 0000 [root@icelake ~]# cat hangup.c #include <stdio.h> #include <sys/ioctl.h> int main(int argc, char *argv[]) { ioctl(1, TIOCVHANGUP); return 0; } [root@icelake ~]# gcc -Wall -o hangup hangup.c [root@icelake ~]# ./hangup > /dev/ttyS4 [root@icelake ~]# lspci -s 00:1a.0 -vv | grep -A1 MSI: Capabilities: [40] MSI: Enable+ Count=1/1 Maskable- 64bit- Address: 00000000 Data: 0000 [root@icelake ~]# Opening the serial port device again while the UART is in this state then appears to cause the UART to generate an interrupt before the MSI vector has been set up again, causing a DMA write to I/O virtual address zero: [root@icelake console]# echo > /dev/ttyS4 [ 979.463307] DMAR: DRHD: handling fault status reg 3 [ 979.469409] DMAR: [DMA Write NO_PASID] Request device [00:1a.0] fault addr 0x0 [fault reason 0x05] PTE Write access is not set I'm guessing there's something under tty_open() -> uart_open() -> tty_port_open() -> uart_port_activate() -> uart_port_startup() -> serial8250_do_startup() that triggers a UART interrupt before the MSI vector has been set up again. I did a quick search but it didn't seem like this is a known issue. Thanks, Lennert