IOMMUTLBEntry.iova is returned incorrectly in one PT path (though mostly we cannot really trigger this path, even if we do, we are mostly disgarding this value, so it didn't break anything). Fix it by converting the VTD_PAGE_MASK into normal definition (normally it should be pfn mask, not offset mask), then switch the other user of it.
Fixes: b93130 ("intel_iommu: cleanup vtd_{do_}iommu_translate()") Signed-off-by: Peter Xu <pet...@redhat.com> --- hw/i386/intel_iommu.c | 2 +- hw/i386/intel_iommu_internal.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c index a9b59bd..a5c83dd 100644 --- a/hw/i386/intel_iommu.c +++ b/hw/i386/intel_iommu.c @@ -1141,7 +1141,7 @@ static bool vtd_do_iommu_translate(VTDAddressSpace *vtd_as, PCIBus *bus, if (vtd_ce_get_type(&ce) == VTD_CONTEXT_TT_PASS_THROUGH) { entry->iova = addr & VTD_PAGE_MASK; entry->translated_addr = entry->iova; - entry->addr_mask = VTD_PAGE_MASK; + entry->addr_mask = ~VTD_PAGE_MASK; entry->perm = IOMMU_RW; trace_vtd_translate_pt(source_id, entry->iova); diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h index f50ecd8..d1d6290 100644 --- a/hw/i386/intel_iommu_internal.h +++ b/hw/i386/intel_iommu_internal.h @@ -384,7 +384,7 @@ typedef struct VTDIOTLBPageInvInfo VTDIOTLBPageInvInfo; /* Pagesize of VTD paging structures, including root and context tables */ #define VTD_PAGE_SHIFT 12 #define VTD_PAGE_SIZE (1ULL << VTD_PAGE_SHIFT) -#define VTD_PAGE_MASK (VTD_PAGE_SIZE - 1) +#define VTD_PAGE_MASK ~(VTD_PAGE_SIZE - 1) #define VTD_PAGE_SHIFT_4K 12 #define VTD_PAGE_MASK_4K (~((1ULL << VTD_PAGE_SHIFT_4K) - 1)) -- 2.7.4