From: Joerg Roedel <joro-zLv9SwRftAIdnm+yROfE0A@public.gmane.org>
To: Alex Williamson
<alex.williamson-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Cc: iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Subject: Re: [PATCH] iommu/amd: Only unmap large pages from the first pte
Date: Sun, 23 Jun 2013 14:00:25 +0200 [thread overview]
Message-ID: <20130623120020.GB2557@8bytes.org> (raw)
In-Reply-To: <20130621203242.7475.19737.stgit-xdHQ/5r00wBBDLzU/O5InQ@public.gmane.org>
On Fri, Jun 21, 2013 at 02:33:19PM -0600, Alex Williamson wrote:
> If we use a large mapping, the expectation is that only unmaps from
> the first pte in the superpage are supported. Unmaps from offsets
> into the superpage should fail (ie. return zero sized unmap). In the
> current code, unmapping from an offset clears the size of the full
> mapping starting from an offset. For instance, if we map a 16k
> physically contiguous range at IOVA 0x0 with a large page, then
> attempt to unmap 4k at offset 12k, 4 ptes are cleared (12k - 28k) and
> the unmap returns 16k unmapped. This potentially incorrectly clears
> valid mappings and confuses drivers like VFIO that use the unmap size
> to release pinned pages.
>
> Fix by refusing to unmap from offsets into the page.
>
> Signed-off-by: Alex Williamson <alex.williamson-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> Cc: stable-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Applied, thanks for fixing this.
WARNING: multiple messages have this Message-ID (diff)
From: Joerg Roedel <joro@8bytes.org>
To: Alex Williamson <alex.williamson@redhat.com>
Cc: iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] iommu/amd: Only unmap large pages from the first pte
Date: Sun, 23 Jun 2013 14:00:25 +0200 [thread overview]
Message-ID: <20130623120020.GB2557@8bytes.org> (raw)
In-Reply-To: <20130621203242.7475.19737.stgit@bling.home>
On Fri, Jun 21, 2013 at 02:33:19PM -0600, Alex Williamson wrote:
> If we use a large mapping, the expectation is that only unmaps from
> the first pte in the superpage are supported. Unmaps from offsets
> into the superpage should fail (ie. return zero sized unmap). In the
> current code, unmapping from an offset clears the size of the full
> mapping starting from an offset. For instance, if we map a 16k
> physically contiguous range at IOVA 0x0 with a large page, then
> attempt to unmap 4k at offset 12k, 4 ptes are cleared (12k - 28k) and
> the unmap returns 16k unmapped. This potentially incorrectly clears
> valid mappings and confuses drivers like VFIO that use the unmap size
> to release pinned pages.
>
> Fix by refusing to unmap from offsets into the page.
>
> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
> Cc: stable@vger.kernel.org
Applied, thanks for fixing this.
next prev parent reply other threads:[~2013-06-23 12:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-21 20:33 [PATCH] iommu/amd: Only unmap large pages from the first pte Alex Williamson
2013-06-21 20:33 ` Alex Williamson
[not found] ` <20130621203242.7475.19737.stgit-xdHQ/5r00wBBDLzU/O5InQ@public.gmane.org>
2013-06-23 12:00 ` Joerg Roedel [this message]
2013-06-23 12:00 ` Joerg Roedel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130623120020.GB2557@8bytes.org \
--to=joro-zlv9swrftaidnm+yrofe0a@public.gmane.org \
--cc=alex.williamson-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org \
--cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.