* [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
@ 2026-07-15 13:27 Clément MATHIEU--DRIF
2026-07-24 2:42 ` Duan, Zhenzhong
2026-07-24 6:08 ` Philippe Mathieu-Daudé
0 siblings, 2 replies; 5+ messages in thread
From: Clément MATHIEU--DRIF @ 2026-07-15 13:27 UTC (permalink / raw)
To: qemu-devel@nongnu.org
Cc: pbonzini@redhat.com, mst@redhat.com, zhenzhong.duan@intel.com,
kevin.tian@intel.com, yi.l.liu@intel.com,
Clément MATHIEU--DRIF
Prevent a buggy driver to execute malformed invalidation operations.
Add the same assert as in vtd_iotlb_page_invalidate.
Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
---
hw/i386/intel_iommu.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index bf4f0f2f6b..c591d1db3f 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
{
VTDIOTLBPageInvInfo info;
+ assert(am <= VTD_MAMV);
+
info.domain_id = domain_id;
info.pasid = pasid;
info.addr = addr;
@@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
+ if (am > VTD_MAMV) {
+ error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
+ ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)",
+ __func__, inv_desc->val[1], inv_desc->val[0],
+ am, (unsigned)VTD_MAMV);
+ return false;
+ }
addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
VTD_INV_DESC_PIOTLB_IH(inv_desc));
--
2.54.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* RE: [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
2026-07-15 13:27 [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation Clément MATHIEU--DRIF
@ 2026-07-24 2:42 ` Duan, Zhenzhong
2026-07-24 6:08 ` Philippe Mathieu-Daudé
1 sibling, 0 replies; 5+ messages in thread
From: Duan, Zhenzhong @ 2026-07-24 2:42 UTC (permalink / raw)
To: Clément MATHIEU--DRIF, qemu-devel@nongnu.org
Cc: pbonzini@redhat.com, mst@redhat.com, Tian, Kevin, Liu, Yi L
Hi Clement,
>-----Original Message-----
>From: Clément MATHIEU--DRIF <clement.mathieu--drif@bull.com>
>Subject: [PATCH] intel_iommu: Check address mask before using it in pasid-based
>iotlb invalidation
>
>Prevent a buggy driver to execute malformed invalidation operations.
>
>Add the same assert as in vtd_iotlb_page_invalidate.
>
>Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
>Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
>Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Thanks
Zhenzhong
>---
> hw/i386/intel_iommu.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
>diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
>index bf4f0f2f6b..c591d1db3f 100644
>--- a/hw/i386/intel_iommu.c
>+++ b/hw/i386/intel_iommu.c
>@@ -3021,6 +3021,8 @@ static void
>vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
> {
> VTDIOTLBPageInvInfo info;
>
>+ assert(am <= VTD_MAMV);
>+
> info.domain_id = domain_id;
> info.pasid = pasid;
> info.addr = addr;
>@@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState
>*s,
>
> case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
> am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
>+ if (am > VTD_MAMV) {
>+ error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
>+ ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)",
>+ __func__, inv_desc->val[1], inv_desc->val[0],
>+ am, (unsigned)VTD_MAMV);
>+ return false;
>+ }
> addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
> vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
> VTD_INV_DESC_PIOTLB_IH(inv_desc));
>--
>2.54.0
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
2026-07-15 13:27 [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation Clément MATHIEU--DRIF
2026-07-24 2:42 ` Duan, Zhenzhong
@ 2026-07-24 6:08 ` Philippe Mathieu-Daudé
2026-07-24 8:31 ` Michael S. Tsirkin
1 sibling, 1 reply; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-24 6:08 UTC (permalink / raw)
To: Clément MATHIEU--DRIF, qemu-devel@nongnu.org
Cc: pbonzini@redhat.com, mst@redhat.com, zhenzhong.duan@intel.com,
kevin.tian@intel.com, yi.l.liu@intel.com
On 15/7/26 15:27, Clément MATHIEU--DRIF wrote:
> Prevent a buggy driver to execute malformed invalidation operations.
>
> Add the same assert as in vtd_iotlb_page_invalidate.
>
> Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
> Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
> ---
> hw/i386/intel_iommu.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
> index bf4f0f2f6b..c591d1db3f 100644
> --- a/hw/i386/intel_iommu.c
> +++ b/hw/i386/intel_iommu.c
> @@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
> {
> VTDIOTLBPageInvInfo info;
>
> + assert(am <= VTD_MAMV);
> +
> info.domain_id = domain_id;
> info.pasid = pasid;
> info.addr = addr;
> @@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
>
> case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
> am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
> + if (am > VTD_MAMV) {
> + error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
> + ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)",
> + __func__, inv_desc->val[1], inv_desc->val[0],
> + am, (unsigned)VTD_MAMV);
Better use the PRIu64 format instead of this surprising cast, anyway:
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
> + return false;
> + }
> addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
> vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
> VTD_INV_DESC_PIOTLB_IH(inv_desc));
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
2026-07-24 6:08 ` Philippe Mathieu-Daudé
@ 2026-07-24 8:31 ` Michael S. Tsirkin
2026-07-24 8:46 ` Philippe Mathieu-Daudé
0 siblings, 1 reply; 5+ messages in thread
From: Michael S. Tsirkin @ 2026-07-24 8:31 UTC (permalink / raw)
To: Philippe Mathieu-Daudé
Cc: Clément MATHIEU--DRIF, qemu-devel@nongnu.org,
pbonzini@redhat.com, zhenzhong.duan@intel.com,
kevin.tian@intel.com, yi.l.liu@intel.com
On Fri, Jul 24, 2026 at 08:08:50AM +0200, Philippe Mathieu-Daudé wrote:
> On 15/7/26 15:27, Clément MATHIEU--DRIF wrote:
> > Prevent a buggy driver to execute malformed invalidation operations.
> >
> > Add the same assert as in vtd_iotlb_page_invalidate.
> >
> > Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
> > Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
> > Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
> > ---
> > hw/i386/intel_iommu.c | 9 +++++++++
> > 1 file changed, 9 insertions(+)
> >
> > diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
> > index bf4f0f2f6b..c591d1db3f 100644
> > --- a/hw/i386/intel_iommu.c
> > +++ b/hw/i386/intel_iommu.c
> > @@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
> > {
> > VTDIOTLBPageInvInfo info;
> > + assert(am <= VTD_MAMV);
> > +
> > info.domain_id = domain_id;
> > info.pasid = pasid;
> > info.addr = addr;
> > @@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
> > case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
> > am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
> > + if (am > VTD_MAMV) {
> > + error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
> > + ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)",
> > + __func__, inv_desc->val[1], inv_desc->val[0],
> > + am, (unsigned)VTD_MAMV);
>
> Better use the PRIu64 format instead of this surprising cast,
I think you mean %llu - PRIu64 is for uint64_t
> anyway:
> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>
> > + return false;
> > + }
> > addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
> > vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
> > VTD_INV_DESC_PIOTLB_IH(inv_desc));
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation
2026-07-24 8:31 ` Michael S. Tsirkin
@ 2026-07-24 8:46 ` Philippe Mathieu-Daudé
0 siblings, 0 replies; 5+ messages in thread
From: Philippe Mathieu-Daudé @ 2026-07-24 8:46 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: Clément MATHIEU--DRIF, qemu-devel@nongnu.org,
pbonzini@redhat.com, zhenzhong.duan@intel.com,
kevin.tian@intel.com, yi.l.liu@intel.com
On 24/7/26 10:31, Michael S. Tsirkin wrote:
> On Fri, Jul 24, 2026 at 08:08:50AM +0200, Philippe Mathieu-Daudé wrote:
>> On 15/7/26 15:27, Clément MATHIEU--DRIF wrote:
>>> Prevent a buggy driver to execute malformed invalidation operations.
>>>
>>> Add the same assert as in vtd_iotlb_page_invalidate.
>>>
>>> Link: https://gitlab.com/qemu-project/qemu/-/work_items/3619
>>> Fixes: 6ebe6cf2a066 ("intel_iommu: Process PASID-based iotlb invalidation")
>>> Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
>>> ---
>>> hw/i386/intel_iommu.c | 9 +++++++++
>>> 1 file changed, 9 insertions(+)
>>>
>>> diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
>>> index bf4f0f2f6b..c591d1db3f 100644
>>> --- a/hw/i386/intel_iommu.c
>>> +++ b/hw/i386/intel_iommu.c
>>> @@ -3021,6 +3021,8 @@ static void vtd_piotlb_page_invalidate(IntelIOMMUState *s, uint16_t domain_id,
>>> {
>>> VTDIOTLBPageInvInfo info;
>>> + assert(am <= VTD_MAMV);
>>> +
>>> info.domain_id = domain_id;
>>> info.pasid = pasid;
>>> info.addr = addr;
>>> @@ -3060,6 +3062,13 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
>>> case VTD_INV_DESC_PIOTLB_PSI_IN_PASID:
>>> am = VTD_INV_DESC_PIOTLB_AM(inv_desc->val[1]);
>>> + if (am > VTD_MAMV) {
>>> + error_report_once("%s: invalid piotlb inv desc: hi=0x%"PRIx64
>>> + ", lo=0x%"PRIx64" (am=%u > VTD_MAMV=%u)",
>>> + __func__, inv_desc->val[1], inv_desc->val[0],
>>> + am, (unsigned)VTD_MAMV);
>>
>> Better use the PRIu64 format instead of this surprising cast,
>
> I think you mean %llu - PRIu64 is for uint64_t
Yes <:)
>
>> anyway:
>> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
>>
>>> + return false;
>>> + }
>>> addr = (hwaddr) VTD_INV_DESC_PIOTLB_ADDR(inv_desc->val[1]);
>>> vtd_piotlb_page_invalidate(s, domain_id, pasid, addr, am,
>>> VTD_INV_DESC_PIOTLB_IH(inv_desc));
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-07-24 8:47 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-15 13:27 [PATCH] intel_iommu: Check address mask before using it in pasid-based iotlb invalidation Clément MATHIEU--DRIF
2026-07-24 2:42 ` Duan, Zhenzhong
2026-07-24 6:08 ` Philippe Mathieu-Daudé
2026-07-24 8:31 ` Michael S. Tsirkin
2026-07-24 8:46 ` Philippe Mathieu-Daudé
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.