Commit dc1b8aed9f for qemu.org

commit dc1b8aed9f4377dc26c9acfb2c1bf2057058cf1e
Author: Clément MATHIEU--DRIF <clement.mathieu--drif@bull.com>
Date:   Thu Sep 3 15:07:49 2026 +0000

    intel_iommu: Only set dirty bit when PTE exposes write permission

    Setting the dirty bit without the write bit in vIOMMU creates a spoofed
    shadow stack PTE that misleads the guest OS. This results in infinite
    PRI requests from the device, as no actual write permission is ever
    granted - the guest OS treats the PTE as a legitimate shadow stack entry
    and considers the permissions already correct.

    Fixes: 65c4f0999991 ("intel_iommu: Set accessed and dirty bits during stage-1 translation")
    Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@bull.com>
    Reviewed-by: Yi Liu <yi.l.liu@intel.com>
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260903150649.2281104-2-clement.mathieu--drif@bull.com>

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 7c442a86ca..eccb16346c 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -2039,7 +2039,7 @@ static int vtd_iova_to_fspte(IntelIOMMUState *s, VTDContextEntry *ce,
             return -VTD_FR_FS_PAGING_ENTRY_RSVD;
         }

-        if (vtd_is_last_pte(fspte, *fspte_level) && is_write) {
+        if (vtd_is_last_pte(fspte, *fspte_level) && *writes && is_write) {
             flag_ad |= VTD_FS_D;
         }