docs/devel/vfio-iommufd.rst | 9 ++++++ hw/i386/intel_iommu_accel.h | 5 ++++ include/hw/core/iommu.h | 5 ++++ include/hw/pci/pci.h | 31 ++++++++++++++++++++ include/hw/vfio/vfio-container.h | 1 + include/hw/vfio/vfio-device.h | 3 ++ hw/i386/intel_iommu.c | 2 ++ hw/i386/intel_iommu_accel.c | 21 ++++++++++++++ hw/pci/pci.c | 12 ++++++++ hw/vfio/device.c | 14 +++++++++ hw/vfio/iommufd.c | 9 +++++- hw/vfio/listener.c | 50 +++++++++++++++++++++++++------- hw/vfio/trace-events | 1 + 13 files changed, 151 insertions(+), 12 deletions(-)
Hi, Based on Cédric's suggestions[1], The nesting series v8 is split to "base nesting series" + "ERRATA_772415_SPR17 quirk series", this is the ERRATA_772415_SPR17 quirk series. On a system influenced by ERRATA_772415, IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 is repored by IOMMU_DEVICE_GET_HW_INFO. Due to this errata, even the readonly range mapped on second stage page table could still be written. Reference from 4th Gen Intel Xeon Processor Scalable Family Specification Update, Errata Details, SPR17. Link https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/eagle-stream/sapphire-rapids-specification-update/ Backup link https://cdrdv2.intel.com/v1/dl/getContent/772415 Also copied the SPR17 details from above link: "Problem: When remapping hardware is configured by system software in scalable mode as Nested (PGTT=011b) and with PWSNP field Set in the PASID-table-entry, it may Set Accessed bit and Dirty bit (and Extended Access bit if enabled) in first-stage page-table entries even when second-stage mappings indicate that corresponding first-stage page-table is Read-Only. Implication: Due to this erratum, pages mapped as Read-only in second-stage page-tables may be modified by remapping hardware Access/Dirty bit updates. Workaround: None identified. System software enabling nested translations for a VM should ensure that there are no read-only pages in the corresponding second-stage mappings." QEMU code can be found at [2], it's based after below two series: [PATCH v10 00/19] intel_iommu: Enable first stage translation for passthrough device [PATCH v6 0/9] vfio: relax the vIOMMU check Thanks Zhenzhong Changelog: v10: - All headers under include/hw/ have been moved to include/hw/core/, do the same for iommu.h (Cédric) v9: This is a new split from nesting series, see the link[3] for history changelog. [1] https://lore.kernel.org/qemu-devel/bbc8412b-25c3-4c95-9fde-a1c9c29b54ce@redhat.com/ [2] https://github.com/yiliu1765/qemu/tree/zhenzhong/iommufd_nesting_ERRATA_772415.v10 [3] https://lore.kernel.org/qemu-devel/20251117093729.1121324-1-zhenzhong.duan@intel.com/ Zhenzhong Duan (4): hw/pci: Introduce pci_device_get_host_iommu_quirks() intel_iommu_accel: Implement get_host_iommu_quirks() callback vfio/listener: Bypass readonly region for dirty tracking Workaround for ERRATA_772415_SPR17 docs/devel/vfio-iommufd.rst | 9 ++++++ hw/i386/intel_iommu_accel.h | 5 ++++ include/hw/core/iommu.h | 5 ++++ include/hw/pci/pci.h | 31 ++++++++++++++++++++ include/hw/vfio/vfio-container.h | 1 + include/hw/vfio/vfio-device.h | 3 ++ hw/i386/intel_iommu.c | 2 ++ hw/i386/intel_iommu_accel.c | 21 ++++++++++++++ hw/pci/pci.c | 12 ++++++++ hw/vfio/device.c | 14 +++++++++ hw/vfio/iommufd.c | 9 +++++- hw/vfio/listener.c | 50 +++++++++++++++++++++++++------- hw/vfio/trace-events | 1 + 13 files changed, 151 insertions(+), 12 deletions(-) -- 2.47.1
On 1/6/26 07:28, Zhenzhong Duan wrote: > Hi, > > Based on Cédric's suggestions[1], The nesting series v8 is split to > "base nesting series" + "ERRATA_772415_SPR17 quirk series", this is the > ERRATA_772415_SPR17 quirk series. > > On a system influenced by ERRATA_772415, IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 > is repored by IOMMU_DEVICE_GET_HW_INFO. Due to this errata, even the readonly > range mapped on second stage page table could still be written. > > Reference from 4th Gen Intel Xeon Processor Scalable Family Specification > Update, Errata Details, SPR17. > Link https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/eagle-stream/sapphire-rapids-specification-update/ > Backup link https://cdrdv2.intel.com/v1/dl/getContent/772415 > > Also copied the SPR17 details from above link: > "Problem: When remapping hardware is configured by system software in > scalable mode as Nested (PGTT=011b) and with PWSNP field Set in the > PASID-table-entry, it may Set Accessed bit and Dirty bit (and Extended > Access bit if enabled) in first-stage page-table entries even when > second-stage mappings indicate that corresponding first-stage page-table > is Read-Only. > > Implication: Due to this erratum, pages mapped as Read-only in second-stage > page-tables may be modified by remapping hardware Access/Dirty bit updates. > > Workaround: None identified. System software enabling nested translations > for a VM should ensure that there are no read-only pages in the > corresponding second-stage mappings." > > QEMU code can be found at [2], it's based after below two series: > > [PATCH v10 00/19] intel_iommu: Enable first stage translation for passthrough device > [PATCH v6 0/9] vfio: relax the vIOMMU check > > Thanks > Zhenzhong > > Changelog: > v10: > - All headers under include/hw/ have been moved to include/hw/core/, do > the same for iommu.h (Cédric) > > v9: > This is a new split from nesting series, see the link[3] for history changelog. > > [1] https://lore.kernel.org/qemu-devel/bbc8412b-25c3-4c95-9fde-a1c9c29b54ce@redhat.com/ > [2] https://github.com/yiliu1765/qemu/tree/zhenzhong/iommufd_nesting_ERRATA_772415.v10 > [3] https://lore.kernel.org/qemu-devel/20251117093729.1121324-1-zhenzhong.duan@intel.com/ > > > Zhenzhong Duan (4): > hw/pci: Introduce pci_device_get_host_iommu_quirks() > intel_iommu_accel: Implement get_host_iommu_quirks() callback > vfio/listener: Bypass readonly region for dirty tracking > Workaround for ERRATA_772415_SPR17 > > docs/devel/vfio-iommufd.rst | 9 ++++++ > hw/i386/intel_iommu_accel.h | 5 ++++ > include/hw/core/iommu.h | 5 ++++ > include/hw/pci/pci.h | 31 ++++++++++++++++++++ > include/hw/vfio/vfio-container.h | 1 + > include/hw/vfio/vfio-device.h | 3 ++ > hw/i386/intel_iommu.c | 2 ++ > hw/i386/intel_iommu_accel.c | 21 ++++++++++++++ > hw/pci/pci.c | 12 ++++++++ > hw/vfio/device.c | 14 +++++++++ > hw/vfio/iommufd.c | 9 +++++- > hw/vfio/listener.c | 50 +++++++++++++++++++++++++------- > hw/vfio/trace-events | 1 + > 13 files changed, 151 insertions(+), 12 deletions(-) > Applied to vfio-next. Thanks, C.
On 1/6/26 07:28, Zhenzhong Duan wrote: > Hi, > > Based on Cédric's suggestions[1], The nesting series v8 is split to > "base nesting series" + "ERRATA_772415_SPR17 quirk series", this is the > ERRATA_772415_SPR17 quirk series. > > On a system influenced by ERRATA_772415, IOMMU_HW_INFO_VTD_ERRATA_772415_SPR17 > is repored by IOMMU_DEVICE_GET_HW_INFO. Due to this errata, even the readonly > range mapped on second stage page table could still be written. > > Reference from 4th Gen Intel Xeon Processor Scalable Family Specification > Update, Errata Details, SPR17. > Link https://edc.intel.com/content/www/us/en/design/products-and-solutions/processors-and-chipsets/eagle-stream/sapphire-rapids-specification-update/ > Backup link https://cdrdv2.intel.com/v1/dl/getContent/772415 > > Also copied the SPR17 details from above link: > "Problem: When remapping hardware is configured by system software in > scalable mode as Nested (PGTT=011b) and with PWSNP field Set in the > PASID-table-entry, it may Set Accessed bit and Dirty bit (and Extended > Access bit if enabled) in first-stage page-table entries even when > second-stage mappings indicate that corresponding first-stage page-table > is Read-Only. > > Implication: Due to this erratum, pages mapped as Read-only in second-stage > page-tables may be modified by remapping hardware Access/Dirty bit updates. > > Workaround: None identified. System software enabling nested translations > for a VM should ensure that there are no read-only pages in the > corresponding second-stage mappings." > > QEMU code can be found at [2], it's based after below two series: > > [PATCH v10 00/19] intel_iommu: Enable first stage translation for passthrough device > [PATCH v6 0/9] vfio: relax the vIOMMU check > > Thanks > Zhenzhong > > Changelog: > v10: > - All headers under include/hw/ have been moved to include/hw/core/, do > the same for iommu.h (Cédric) > > v9: > This is a new split from nesting series, see the link[3] for history changelog. > > [1] https://lore.kernel.org/qemu-devel/bbc8412b-25c3-4c95-9fde-a1c9c29b54ce@redhat.com/ > [2] https://github.com/yiliu1765/qemu/tree/zhenzhong/iommufd_nesting_ERRATA_772415.v10 > [3] https://lore.kernel.org/qemu-devel/20251117093729.1121324-1-zhenzhong.duan@intel.com/ > > > Zhenzhong Duan (4): > hw/pci: Introduce pci_device_get_host_iommu_quirks() > intel_iommu_accel: Implement get_host_iommu_quirks() callback > vfio/listener: Bypass readonly region for dirty tracking > Workaround for ERRATA_772415_SPR17 > > docs/devel/vfio-iommufd.rst | 9 ++++++ > hw/i386/intel_iommu_accel.h | 5 ++++ > include/hw/core/iommu.h | 5 ++++ > include/hw/pci/pci.h | 31 ++++++++++++++++++++ > include/hw/vfio/vfio-container.h | 1 + > include/hw/vfio/vfio-device.h | 3 ++ > hw/i386/intel_iommu.c | 2 ++ > hw/i386/intel_iommu_accel.c | 21 ++++++++++++++ > hw/pci/pci.c | 12 ++++++++ > hw/vfio/device.c | 14 +++++++++ > hw/vfio/iommufd.c | 9 +++++- > hw/vfio/listener.c | 50 +++++++++++++++++++++++++------- > hw/vfio/trace-events | 1 + > 13 files changed, 151 insertions(+), 12 deletions(-) Reviewed-by: Cédric Le Goater <clg@redhat.com> Thanks, C.
© 2016 - 2026 Red Hat, Inc.