init_memory_definitions() walks every top-level subtable including the IVHD blocks (type 0x10/0x11/0x40) in the IVRS ACPI table. It interprets each one as a 'struct ivmd_header', solely on m->flags, without first checking that the subtable's type actually is one of the IVMD types (ACPI_IVMD_TYPE, ACPI_IVMD_TYPE_ALL, ACPI_IVMD_TYPE_RANGE). if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE)) init_unity_map_range(m, table); IVMD_FLAG_UNITY_MAP (0x01) occupies the same bit position as the IVHD flags field's HtTunEn bit. Unlike real hardware, QEMU's AMD IOMMU emulation sets HtTunEn unconditionally (flags=0xD1 for type 0x10, 0x11 for type 0x11), so every QEMU-emitted IVHD block is misidentified as a unity-map/exclusion-range IVMD entry, which subsequently results in the creation of a bogus pci segment. Eg: AMD-Vi: PCI segment : 0x4000, last bdf : 0x0000 Fix by checking the subtable's type before treating it as IVMD. Fixes: be2a022c0dd0 ("x86, AMD IOMMU: add functions to parse IOMMU memory mapping requirements for devices") Cc: stable@vger.kernel.org Signed-off-by: Akshay Jindal --- Testing: ======== - Reproduced via amd_iommu_dump=1 on a QEMU multi-IOMMU (pxb-pcie) topology; confirmed "PCI segment : 0x4000, last bdf : 0x0000" no longer appears after the fix. - Verified IVHD device-entry parsing (DEV_SELECT/RANGE/SPECIAL) is unaffected by diffing amd_iommu_dump=1 output before/after. - Booted real hardware (IVHD flags=0xB0, HtTunEn clear) to confirm no regression; this bug was not observable there to begin with. drivers/iommu/amd/init.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 8ec8a6fccaaf..00e1d0be749f 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -2716,6 +2716,15 @@ static int __init init_unity_map_range(struct ivmd_header *m, return 0; } +static bool ivrs_block_type_ivmd(u8 type) +{ + if (type == ACPI_IVMD_TYPE || + type == ACPI_IVMD_TYPE_ALL || + type == ACPI_IVMD_TYPE_RANGE) + return true; + return false; +} + /* iterates over all memory definitions we find in the ACPI table */ static int __init init_memory_definitions(struct acpi_table_header *table) { @@ -2727,10 +2736,11 @@ static int __init init_memory_definitions(struct acpi_table_header *table) while (p < end) { m = (struct ivmd_header *)p; + p += m->length; + if (!ivrs_block_type_ivmd(m->type)) + continue; if (m->flags & (IVMD_FLAG_UNITY_MAP | IVMD_FLAG_EXCL_RANGE)) init_unity_map_range(m, table); - - p += m->length; } return 0; -- 2.43.0