From ce5295813c0f1c94964cbd126f37a3202c360b92 Mon Sep 17 00:00:00 2001 From: eperezma Date: Mon, 11 Jan 2021 14:36:15 -0500 Subject: memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RH-Author: eperezma Message-id: <20210111143615.303645-6-eperezma@redhat.com> Patchwork-id: 100573 O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 5/5] memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type Bugzilla: 1845758 RH-Acked-by: Xiao Wang RH-Acked-by: David Hildenbrand RH-Acked-by: Peter Xu Device IOTLB invalidations can unmap arbitrary ranges, eiter outside of the memory region or even [0, ~0ULL] for all the space. The assertion could be hit by a guest, and rhel7 guest effectively hit it. Signed-off-by: Eugenio Pérez Reviewed-by: Peter Xu Reviewed-by: Juan Quintela Acked-by: Jason Wang Message-Id: <20201116165506.31315-6-eperezma@redhat.com> Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 1804857f19f612f6907832e35599cdb51d4ec764) Signed-off-by: Eugenio Pérez Signed-off-by: Danilo C. L. de Paula --- softmmu/memory.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/softmmu/memory.c b/softmmu/memory.c index 6ca87e8d73..22bacbbc78 100644 --- a/softmmu/memory.c +++ b/softmmu/memory.c @@ -1947,6 +1947,7 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier, { IOMMUTLBEntry *entry = &event->entry; hwaddr entry_end = entry->iova + entry->addr_mask; + IOMMUTLBEntry tmp = *entry; if (event->type == IOMMU_NOTIFIER_UNMAP) { assert(entry->perm == IOMMU_NONE); @@ -1960,10 +1961,16 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier, return; } - assert(entry->iova >= notifier->start && entry_end <= notifier->end); + if (notifier->notifier_flags & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) { + /* Crop (iova, addr_mask) to range */ + tmp.iova = MAX(tmp.iova, notifier->start); + tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova; + } else { + assert(entry->iova >= notifier->start && entry_end <= notifier->end); + } if (event->type & notifier->notifier_flags) { - notifier->notify(notifier, entry); + notifier->notify(notifier, &tmp); } } -- 2.18.4