70 lines
2.6 KiB
Diff
70 lines
2.6 KiB
Diff
From ce5295813c0f1c94964cbd126f37a3202c360b92 Mon Sep 17 00:00:00 2001
|
|
From: eperezma <eperezma@redhat.com>
|
|
Date: Mon, 11 Jan 2021 14:36:15 -0500
|
|
Subject: memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: eperezma <eperezma@redhat.com>
|
|
Message-id: <20210111143615.303645-6-eperezma@redhat.com>
|
|
Patchwork-id: 100573
|
|
O-Subject: [RHEL-AV-8.4.0 qemu-kvm PATCH 5/5] memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type
|
|
Bugzilla: 1845758
|
|
RH-Acked-by: Xiao Wang <jasowang@redhat.com>
|
|
RH-Acked-by: David Hildenbrand <david@redhat.com>
|
|
RH-Acked-by: Peter Xu <peterx@redhat.com>
|
|
|
|
Device IOTLB invalidations can unmap arbitrary ranges, eiter outside of
|
|
the memory region or even [0, ~0ULL] for all the space. The assertion
|
|
could be hit by a guest, and rhel7 guest effectively hit it.
|
|
|
|
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
|
|
Reviewed-by: Peter Xu <peterx@redhat.com>
|
|
Reviewed-by: Juan Quintela <quintela@redhat.com>
|
|
Acked-by: Jason Wang <jasowang@redhat.com>
|
|
Message-Id: <20201116165506.31315-6-eperezma@redhat.com>
|
|
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
|
|
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
|
(cherry picked from commit 1804857f19f612f6907832e35599cdb51d4ec764)
|
|
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
|
|
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
|
|
---
|
|
softmmu/memory.c | 11 +++++++++--
|
|
1 file changed, 9 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/softmmu/memory.c b/softmmu/memory.c
|
|
index 6ca87e8d73..22bacbbc78 100644
|
|
--- a/softmmu/memory.c
|
|
+++ b/softmmu/memory.c
|
|
@@ -1947,6 +1947,7 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
|
|
{
|
|
IOMMUTLBEntry *entry = &event->entry;
|
|
hwaddr entry_end = entry->iova + entry->addr_mask;
|
|
+ IOMMUTLBEntry tmp = *entry;
|
|
|
|
if (event->type == IOMMU_NOTIFIER_UNMAP) {
|
|
assert(entry->perm == IOMMU_NONE);
|
|
@@ -1960,10 +1961,16 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
|
|
return;
|
|
}
|
|
|
|
- assert(entry->iova >= notifier->start && entry_end <= notifier->end);
|
|
+ if (notifier->notifier_flags & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
|
|
+ /* Crop (iova, addr_mask) to range */
|
|
+ tmp.iova = MAX(tmp.iova, notifier->start);
|
|
+ tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova;
|
|
+ } else {
|
|
+ assert(entry->iova >= notifier->start && entry_end <= notifier->end);
|
|
+ }
|
|
|
|
if (event->type & notifier->notifier_flags) {
|
|
- notifier->notify(notifier, entry);
|
|
+ notifier->notify(notifier, &tmp);
|
|
}
|
|
}
|
|
|
|
--
|
|
2.18.4
|
|
|