1. Patchew
  2. QEMU
  3. View series

[PATCH v2] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation

Clément MATHIEU--DRIF posted 1 patch 1 day, 5 hours ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260724111424.376680-1-clement.mathieu--drif@bull.com
Maintainers: "Michael S. Tsirkin" <mst@redhat.com>, Jason Wang <jasowangio@gmail.com>, Yi Liu <yi.l.liu@intel.com>, "Clément Mathieu--Drif" <clement.mathieu--drif@bull.com>, Paolo Bonzini <pbonzini@redhat.com>, Richard Henderson <richard.henderson@linaro.org>
hw/i386/intel_iommu.c | 9 +++++++++
1 file changed, 9 insertions(+)
[PATCH v2] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
Posted by Clément MATHIEU--DRIF 1 day, 5 hours ago 
Prevent a buggy driver to execute malformed invalidation operations.

Add the same assert as in vtd_iotlb_page_invalidate.

Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 hw/i386/intel_iommu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index bf4f0f2f6b..8245452d89 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
 {
     VTDIOTLBPageInvInfo info;
 
+    assert(am <= VTD_MAMV);
+
     info.domain_id = domain_id;
     info.pasid = pasid;
     info.addr = addr;
@@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
 
     case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
         am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
+        if (am > VTD_MAMV) {
+            error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
+                              ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%llu)",
+                              __func__, inv_desc->val[1], inv_desc->val[0],
+                              am, VTD_MAMV);
+            return false;
+        }
         addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
         vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
                                    VTD_INV_DESC_PIOTLB_IH(inv_desc));
-- 
2.54.0
Re: [PATCH v2] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
Posted by Michael S. Tsirkin 1 day, 5 hours ago 
On Fri, Jul 24, 2026 at 11:15:32AM +0000, Clément MATHIEU--DRIF wrote:
> Prevent a buggy driver to execute malformed invalidation operations.
> 
> Add the same assert as in vtd_iotlb_page_invalidate.
> 
> Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
> Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
> Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> ---

changelog in the future pls.

>  hw/i386/intel_iommu.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
> index bf4f0f2f6b..8245452d89 100644
> --- a/hw/i386/intel_iommu.c
> +++ b/hw/i386/intel_iommu.c
> @@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
>  {
>      VTDIOTLBPageInvInfo info;
>  
> +    assert(am <= VTD_MAMV);
> +
>      info.domain_id = domain_id;
>      info.pasid = pasid;
>      info.addr = addr;
> @@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
>  
>      case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
>          am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
> +        if (am > VTD_MAMV) {
> +            error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
> +                              ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%llu)",
> +                              __func__, inv_desc->val[1], inv_desc->val[0],
> +                              am, VTD_MAMV);
> +            return false;
> +        }
>          addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
>          vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
>                                     VTD_INV_DESC_PIOTLB_IH(inv_desc));
> -- 
> 2.54.0
Re: [PATCH v2] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
Posted by Clément MATHIEU--DRIF 1 day, 4 hours ago 
On Fri, 2026-07-24 at 07:41 -0400, Michael S. Tsirkin wrote:
> Caution: External email. Do not open attachments or click links, unless this email comes from a known sender and you know the content is safe.
>
>
> On Fri, Jul 24, 2026 at 11:15:32AM +0000, Clément MATHIEU--DRIF wrote:
>
> > Prevent a buggy driver to execute malformed invalidation operations.
> >
> > Add the same assert as in vtd_iotlb_page_invalidate.
> >
> > Link: [https://gitlab.com/qemu-project/qemu/-/work_items/3619](https://gitlab.com/qemu-project/qemu/-/work_items/3619)
> > Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
> > Signed-off-by: Clement Mathieu--Drif <[clement.mathieu--drif@bull.com](mailto:clement.mathieu--drif@bull.com)>
> > Reviewed-by: Philippe Mathieu-Daudé <[philmd@oss.qualcomm.com](mailto:philmd@oss.qualcomm.com)>
> > Reviewed-by: Zhenzhong Duan <[zhenzhong.duan@intel.com](mailto:zhenzhong.duan@intel.com)>
> > ---
>
>
> changelog in the future pls.

Yep, my bad, thanks Michael

>
>
> >  hw/i386/intel_iommu.c | 9 +++++++++
> >  1 file changed, 9 insertions(+)
> >
> > diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
> > index bf4f0f2f6b..8245452d89 100644
> > --- a/hw/i386/intel_iommu.c
> > +++ b/hw/i386/intel_iommu.c
> > @@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
> >  {
> >      VTDIOTLBPageInvInfo info;
> >
> > +    assert(am <= VTD_MAMV);
> > +
> >      info.domain_id = domain_id;
> >      info.pasid = pasid;
> >      info.addr = addr;
> > @@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
> >
> >      case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
> >          am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
> > +        if (am > VTD_MAMV) {
> > +            error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
> > +                              ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%llu)",
> > +                              __func__, inv_desc->val[1], inv_desc->val[0],
> > +                              am, VTD_MAMV);
> > +            return false;
> > +        }
> >          addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
> >          vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
> >                                     VTD_INV_DESC_PIOTLB_IH(inv_desc));
> > --
> > 2.54.0
>
>

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.