FAILED: patch "[PATCH] iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions" failed to apply to 5.15-stable tree

FAILED: patch "[PATCH] iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions" failed to apply to 5.15-stable tree

[Sasha Levin]

The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x e62df37e0eff4d670e78bbd415be2c1675883c15
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '20261109202457-failed-5.15-e62df37e0eff@kernel.org' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'

Thanks,
Sasha

------------------ original commit in Linus's tree ------------------

From e62df37e0eff4d670e78bbd415be2c1675883c15 Mon Sep 17 00:00:00 2001
From: Akshay Jindal <Akshay.Jindal@amd.com>
Date: Thu, 5 Nov 2026 16:32:17 +0000
Subject: [PATCH] iommu/amd: Skip non-IVMD entries when parsing IVRS memory
 definitions

init_memory_definitions() walks every top-level subtable including the
IVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets
each one as a 'struct ivmd_header', solely on m->flags, without first
checking that the subtable's type actually is one of the IVMD types
(ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).

    if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
            init_unity_map_range(m, table);

IVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD
flags field's HtTunEn bit. Unlike real hardware, QEMU's AMD IOMMU
emulation sets HtTunEn unconditionally (flags=0xD1 for type 0x10,
0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified
as a unity-map/exclusion-range IVMD entry, which subsequently results
in the creation of a bogus pci segment. Eg:

    AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000

Fix by checking the subtable's type before treating it as IVMD.

Fixes: be2a022c0dd0 ("x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices")
Cc: stable@vger.kernel.org
Signed-off-by: Akshay Jindal <Akshay.Jindal@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
---
 drivers/iommu/amd/init.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 78c7079dec9d6..3dd4ff145e552 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -2776,6 +2776,15 @@ static int __init init_unity_map_range(struct ivmd_header *m,
 	return 0;
 }
 
+static bool ivrs_block_type_ivmd(u8 type)
+{
+	if (type == ACPI_IVMD_TYPE ||
+	    type == ACPI_IVMD_TYPE_ALL ||
+	    type == ACPI_IVMD_TYPE_RANGE)
+		return true;
+	return false;
+}
+
 /* iterates over all memory definitions we find in the ACPI table */
 static int __init init_memory_definitions(struct acpi_table_header *table)
 {
@@ -2787,10 +2796,11 @@ static int __init init_memory_definitions(struct acpi_table_header *table)
 
 	while (p < end) {
 		m = (struct ivmd_header *)p;
+		p += m->length;
+		if (!ivrs_block_type_ivmd(m->type))
+			continue;
 		if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
 			init_unity_map_range(m, table);
-
-		p += m->length;
 	}
 
 	return 0;
-- 
2.53.0

Re: FAILED: patch "[PATCH] iommu/amd: Skip non-IVMD entries when parsing IVRS memory definitions" failed to apply to 5.15-stable tree

[Jindal, Akshay]

Will send the patch.

Thanks,
Akshay

On 10-11-2026 06:54, Sasha Levin wrote:
> Caution: This message originated from an External Source. Use proper caution when opening attachments, clicking links, or responding.
> 
> 
> The patch below does not apply to the 5.15-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.
> 
> To reproduce the conflict and resubmit, you may use the following commands:
> 
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
> git checkout FETCH_HEAD
> git cherry-pick -x e62df37e0eff4d670e78bbd415be2c1675883c15
> # <resolve conflicts, build, test, etc.>
> git commit -s
> git send-email --to '<stable@vger.kernel.org>' --in-reply-to '20261109202457-failed-5.15-e62df37e0eff@kernel.org' --subject-prefix 'PATCH 5.15.y' 'HEAD^..'
> 
> Thanks,
> Sasha
> 
> ------------------ original commit in Linus's tree ------------------
> 
> From e62df37e0eff4d670e78bbd415be2c1675883c15 Mon Sep 17 00:00:00 2001
> From: Akshay Jindal <Akshay.Jindal@amd.com>
> Date: Thu, 5 Nov 2026 16:32:17 +0000
> Subject: [PATCH] iommu/amd: Skip non-IVMD entries when parsing IVRS memory
>  definitions
> 
> init_memory_definitions() walks every top-level subtable including the
> IVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets
> each one as a 'struct ivmd_header', solely on m->flags, without first
> checking that the subtable's type actually is one of the IVMD types
> (ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE).
> 
>     if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
>             init_unity_map_range(m, table);
> 
> IVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD
> flags field's HtTunEn bit. Unlike real hardware, QEMU's AMD IOMMU
> emulation sets HtTunEn unconditionally (flags=0xD1 for type 0x10,
> 0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified
> as a unity-map/exclusion-range IVMD entry, which subsequently results
> in the creation of a bogus pci segment. Eg:
> 
>     AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000
> 
> Fix by checking the subtable's type before treating it as IVMD.
> 
> Fixes: be2a022c0dd0 ("x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices")
> Cc: stable@vger.kernel.org
> Signed-off-by: Akshay Jindal <Akshay.Jindal@amd.com>
> Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
> ---
>  drivers/iommu/amd/init.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index 78c7079dec9d6..3dd4ff145e552 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -2776,6 +2776,15 @@ static int __init init_unity_map_range(struct ivmd_header *m,
>         return 0;
>  }
> 
> +static bool ivrs_block_type_ivmd(u8 type)
> +{
> +       if (type == ACPI_IVMD_TYPE ||
> +           type == ACPI_IVMD_TYPE_ALL ||
> +           type == ACPI_IVMD_TYPE_RANGE)
> +               return true;
> +       return false;
> +}
> +
>  /* iterates over all memory definitions we find in the ACPI table */
>  static int __init init_memory_definitions(struct acpi_table_header *table)
>  {
> @@ -2787,10 +2796,11 @@ static int __init init_memory_definitions(struct acpi_table_header *table)
> 
>         while (p < end) {
>                 m = (struct ivmd_header *)p;
> +               p += m->length;
> +               if (!ivrs_block_type_ivmd(m->type))
> +                       continue;
>                 if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE))
>                         init_unity_map_range(m, table);
> -
> -               p += m->length;
>         }
> 
>         return 0;
> --
> 2.53.0
> 
> 
> 
>