[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] memory: do not do out of bound notification
From: |
Yan Zhao |
Subject: |
[Qemu-devel] [PATCH] memory: do not do out of bound notification |
Date: |
Wed, 19 Jun 2019 16:49:45 +0800 |
even if an entry overlaps with notifier's range, should not map/unmap
out of bound part in the entry.
This would cause problem in below case:
1. initially there are two notifiers with ranges
0-0xfedfffff, 0xfef00000-0xffffffffffffffff,
IOVAs from 0x3c000000 - 0x3c1fffff is in shadow page table.
2. in vfio, memory_region_register_iommu_notifier() is followed by
memory_region_iommu_replay(), which will first call address space unmap,
and walk and add back all entries in vtd shadow page table. e.g.
(1) for notifier 0-0xfedfffff,
IOVAs from 0 - 0xffffffff get unmapped,
and IOVAs from 0x3c000000 - 0x3c1fffff get mapped
(2) for notifier 0xfef00000-0xffffffffffffffff
IOVAs from 0 - 0x7fffffffff get unmapped,
but IOVAs from 0x3c000000 - 0x3c1fffff cannot get mapped back.
Signed-off-by: Yan Zhao <address@hidden>
---
memory.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/memory.c b/memory.c
index 07c8315..a6b9da6 100644
--- a/memory.c
+++ b/memory.c
@@ -1948,6 +1948,14 @@ void memory_region_notify_one(IOMMUNotifier *notifier,
return;
}
+ if (entry->iova < notifier->start) {
+ entry->iova = notifier->start;
+ }
+
+ if (entry->iova + entry->addr_mask > notifier->end) {
+ entry->addr_mask = notifier->end - entry->iova;
+ }
+
if (entry->perm & IOMMU_RW) {
printf("map %lx %lx\n", entry->iova, entry->iova + entry->addr_mask);
request_flags = IOMMU_NOTIFIER_MAP;
--
2.7.4