| From 2ec2c1bfa79ba489e3637eefec15a176710df917 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 18 Sep 2025 13:01:59 +0800 |
| Subject: iommu/vt-d: debugfs: Fix legacy mode page table dump logic |
| |
| From: Vineeth Pillai (Google) <vineeth@bitbyteword.org> |
| |
| [ Upstream commit fbe6070c73badca726e4ff7877320e6c62339917 ] |
| |
| In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR |
| maybe uninitialized or zero in that case and may cause oops like: |
| |
| Oops: general protection fault, probably for non-canonical address |
| 0xf00087d3f000f000: 0000 [#1] SMP NOPTI |
| CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) |
| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 |
| RIP: 0010:pgtable_walk_level+0x98/0x150 |
| RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 |
| RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e |
| RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 |
| RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 |
| R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 |
| R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 |
| FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 |
| PKRU: 55555554 |
| Call Trace: |
| <TASK> |
| pgtable_walk_level+0x88/0x150 |
| domain_translation_struct_show.isra.0+0x2d9/0x300 |
| dev_domain_translation_struct_show+0x20/0x40 |
| seq_read_iter+0x12d/0x490 |
| ... |
| |
| Avoid walking the page table if TT is not 00b or 01b. |
| |
| Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") |
| Signed-off-by: Vineeth Pillai (Google) <vineeth@bitbyteword.org> |
| Reviewed-by: Kevin Tian <kevin.tian@intel.com> |
| Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org |
| Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com> |
| Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- |
| 1 file changed, 15 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c |
| index affbf4a1558de..5aa7f46a420b5 100644 |
| --- a/drivers/iommu/intel/debugfs.c |
| +++ b/drivers/iommu/intel/debugfs.c |
| @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, |
| } |
| pgd &= VTD_PAGE_MASK; |
| } else { /* legacy mode */ |
| - pgd = context->lo & VTD_PAGE_MASK; |
| - agaw = context->hi & 7; |
| + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; |
| + |
| + /* |
| + * According to Translation Type(TT), |
| + * get the page table pointer(SSPTPTR). |
| + */ |
| + switch (tt) { |
| + case CONTEXT_TT_MULTI_LEVEL: |
| + case CONTEXT_TT_DEV_IOTLB: |
| + pgd = context->lo & VTD_PAGE_MASK; |
| + agaw = context->hi & 7; |
| + break; |
| + default: |
| + goto iommu_unlock; |
| + } |
| } |
| |
| seq_printf(m, "Device %04x:%02x:%02x.%x ", |
| -- |
| 2.51.0 |
| |
