yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-memory-Skip-bad-range-assertion-if-notifier-is-DEVIO.patch

8fced6
From 8c5154729effda3f762bfb8224f9c61dab8b2986 Mon Sep 17 00:00:00 2001
8fced6
From: eperezma <eperezma@redhat.com>
8fced6
Date: Tue, 12 Jan 2021 14:36:38 -0500
8fced6
Subject: [PATCH 14/17] memory: Skip bad range assertion if notifier is
8fced6
 DEVIOTLB_UNMAP type
8fced6
MIME-Version: 1.0
8fced6
Content-Type: text/plain; charset=UTF-8
8fced6
Content-Transfer-Encoding: 8bit
8fced6
8fced6
RH-Author: eperezma <eperezma@redhat.com>
8fced6
Message-id: <20210112143638.374060-14-eperezma@redhat.com>
8fced6
Patchwork-id: 100606
8fced6
O-Subject: [RHEL-8.4.0 qemu-kvm PATCH v2 13/13] memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type
8fced6
Bugzilla: 1843852
8fced6
RH-Acked-by: Xiao Wang <jasowang@redhat.com>
8fced6
RH-Acked-by: Peter Xu <peterx@redhat.com>
8fced6
RH-Acked-by: Auger Eric <eric.auger@redhat.com>
8fced6
8fced6
Device IOTLB invalidations can unmap arbitrary ranges, eiter outside of
8fced6
the memory region or even [0, ~0ULL] for all the space. The assertion
8fced6
could be hit by a guest, and rhel7 guest effectively hit it.
8fced6
8fced6
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
8fced6
Reviewed-by: Peter Xu <peterx@redhat.com>
8fced6
Reviewed-by: Juan Quintela <quintela@redhat.com>
8fced6
Acked-by: Jason Wang <jasowang@redhat.com>
8fced6
Message-Id: <20201116165506.31315-6-eperezma@redhat.com>
8fced6
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
8fced6
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
8fced6
(cherry picked from commit 1804857f19f612f6907832e35599cdb51d4ec764)
8fced6
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
8fced6
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
8fced6
---
8fced6
 memory.c | 11 +++++++++--
8fced6
 1 file changed, 9 insertions(+), 2 deletions(-)
8fced6
8fced6
diff --git a/memory.c b/memory.c
8fced6
index 3bd99b8ac4a..5a4a80842d7 100644
8fced6
--- a/memory.c
8fced6
+++ b/memory.c
8fced6
@@ -1916,6 +1916,7 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
8fced6
 {
8fced6
     IOMMUTLBEntry *entry = &event->entry;
8fced6
     hwaddr entry_end = entry->iova + entry->addr_mask;
8fced6
+    IOMMUTLBEntry tmp = *entry;
8fced6
 
8fced6
     if (event->type == IOMMU_NOTIFIER_UNMAP) {
8fced6
         assert(entry->perm == IOMMU_NONE);
8fced6
@@ -1929,10 +1930,16 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
8fced6
         return;
8fced6
     }
8fced6
 
8fced6
-    assert(entry->iova >= notifier->start && entry_end <= notifier->end);
8fced6
+    if (notifier->notifier_flags & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
8fced6
+        /* Crop (iova, addr_mask) to range */
8fced6
+        tmp.iova = MAX(tmp.iova, notifier->start);
8fced6
+        tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova;
8fced6
+    } else {
8fced6
+        assert(entry->iova >= notifier->start && entry_end <= notifier->end);
8fced6
+    }
8fced6
 
8fced6
     if (event->type & notifier->notifier_flags) {
8fced6
-        notifier->notify(notifier, entry);
8fced6
+        notifier->notify(notifier, &tmp);
8fced6
     }
8fced6
 }
8fced6
 
8fced6
-- 
8fced6
2.27.0
8fced6