* bug in intel_iommu_unmap()
@ 2013-09-01 20:26 Shankar, Hari
[not found] ` <CE48F11D.4142A%hshankar-HgOvQuBEEgTQT0dZR+AlfA@public.gmane.org>
0 siblings, 1 reply; 2+ messages in thread
From: Shankar, Hari @ 2013-09-01 20:26 UTC (permalink / raw)
To: dwmw2-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org
Cc: Singh, Varinder, Sundaram, Rajesh, Kimmel, Jeff,
iommu-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org,
Spiller, John
[-- Attachment #1.1: Type: text/plain, Size: 591 bytes --]
Hi David,
NetApp is using Linux VFIO code for user space drivers. We recently ran into a memory corruption bug which was root caused to lack of IOMMU TLB flush in intel_iommu_unmap() routine.
While reviewing the code we also figured that the unmap routine always returns size only for one page rather than the total unmapped size. Since VFIO unmaps one page at a time, the problem isn't exposed
Alex Williamson suggested that you're the maintainer of the code so sending to you for review.
Diff for the changes is attached and is generated on Linux kernel version 3.6.11
Hari.
[-- Attachment #1.2: Type: text/html, Size: 1043 bytes --]
[-- Attachment #2: intel_iommu_unmap_patch.txt --]
[-- Type: text/plain, Size: 1695 bytes --]
--- drivers/iommu/intel-iommu.c.orig 2013-09-01 10:10:14.723958000 -0700
+++ drivers/iommu/intel-iommu.c 2013-09-01 10:17:22.428412000 -0700
@@ -4060,14 +4060,34 @@ static size_t intel_iommu_unmap(struct i
{
struct dmar_domain *dmar_domain = domain->priv;
int order;
+ struct intel_iommu *iommu;
+ unsigned long start_pfn, last_pfn;
+ unsigned int npages;
+ int iommu_id, num, ndomains;
- order = dma_pte_clear_range(dmar_domain, iova >> VTD_PAGE_SHIFT,
- (iova + size - 1) >> VTD_PAGE_SHIFT);
+ start_pfn = iova >> VTD_PAGE_SHIFT;
+ last_pfn = (iova + size - 1) >> VTD_PAGE_SHIFT;
+ order = dma_pte_clear_range(dmar_domain, start_pfn, last_pfn);
- if (dmar_domain->max_addr == iova + size)
- dmar_domain->max_addr = iova;
+ last_pfn |= (1UL << order) - 1;
+ npages = last_pfn - start_pfn + 1;
+
+ for_each_set_bit(iommu_id, dmar_domain->iommu_bmp, g_num_of_iommus) {
+ iommu = g_iommus[iommu_id];
- return PAGE_SIZE << order;
+ /*
+ * find bit position of dmar_domain
+ */
+ ndomains = cap_ndoms(iommu->cap);
+ for_each_set_bit(num, iommu->domain_ids, ndomains)
+ if (iommu->domains[num] == dmar_domain)
+ iommu_flush_iotlb_psi(iommu, num, start_pfn, npages, 0);
+ }
+
+ if (dmar_domain->max_addr <= iova + (npages << VTD_PAGE_SHIFT))
+ dmar_domain->max_addr = iova;
+
+ return npages << VTD_PAGE_SHIFT;
}
static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
[-- Attachment #3: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-09-02 1:54 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-01 20:26 bug in intel_iommu_unmap() Shankar, Hari
[not found] ` <CE48F11D.4142A%hshankar-HgOvQuBEEgTQT0dZR+AlfA@public.gmane.org>
2013-09-02 1:54 ` Shankar, Hari
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.