Commit fa6ecaa066 for qemu.org

commit fa6ecaa066fbec2b64aa6c56c4ac75e9930b2f52
Author: Clément MATHIEU--DRIF <clement.mathieu--drif@bull.com>
Date:   Thu Sep 3 15:07:50 2026 +0000

    intel_iommu: Always write all the flags passed to vtd_set_flag_in_pte

    This function was initially designed to write a single flag in a pte.
    The current implementation expects it to set several flags.

    Fixes: 65c4f0999991 ("intel_iommu: Set accessed and dirty bits during stage-1 translation")
    Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
    Reviewed-by: Yi Liu <yi.l.liu@intel.com>
    Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260903150649.2281104-3-clement.mathieu--drif@bull.com>

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index eccb16346c..91ab549dbf 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -1964,13 +1964,13 @@ static bool vtd_iova_fs_check_canonical(IntelIOMMUState *s, uint64_t iova,
     }
 }

-static MemTxResult vtd_set_flag_in_pte(dma_addr_t base_addr, uint32_t index,
-                                       uint64_t pte, uint64_t flag)
+static MemTxResult vtd_set_flags_in_pte(dma_addr_t base_addr, uint32_t index,
+                                       uint64_t pte, uint64_t flags)
 {
-    if (pte & flag) {
+    if ((pte & flags) == flags) {
         return MEMTX_OK;
     }
-    pte |= flag;
+    pte |= flags;
     pte = cpu_to_le64(pte);
     return dma_memory_write(&address_space_memory,
                             base_addr + index * sizeof(pte),
@@ -2043,7 +2043,7 @@ static int vtd_iova_to_fspte(IntelIOMMUState *s, VTDContextEntry *ce,
             flag_ad |= VTD_FS_D;
         }

-        if (vtd_set_flag_in_pte(addr, offset, fspte, flag_ad) != MEMTX_OK) {
+        if (vtd_set_flags_in_pte(addr, offset, fspte, flag_ad) != MEMTX_OK) {
             return -VTD_FR_FS_BIT_UPDATE_FAILED;
         }