From: Julien Grall <julien@xen.org>
To: xen-devel@lists.xenproject.org
Cc: hongyxia@amazon.co.uk, iwj@xenproject.org,
Julien Grall <jgrall@amazon.com>, Jan Beulich <jbeulich@suse.com>,
Andrew Cooper <andrew.cooper3@citrix.com>,
Kevin Tian <kevin.tian@intel.com>, Paul Durrant <paul@xen.org>
Subject: [for-4.15][PATCH v3 2/3] xen/x86: iommu: Ignore IOMMU mapping requests when a domain is dying
Date: Wed, 17 Feb 2021 14:24:57 +0000 [thread overview]
Message-ID: <20210217142458.3769-3-julien@xen.org> (raw)
In-Reply-To: <20210217142458.3769-1-julien@xen.org>
From: Julien Grall <jgrall@amazon.com>
The new x86 IOMMU page-tables allocator will release the pages when
relinquishing the domain resources. However, this is not sufficient
when the domain is dying because nothing prevents page-table to be
allocated.
Currently page-table allocations can only happen from iommu_map(). As
the domain is dying, there is no good reason to continue to modify the
IOMMU page-tables.
In order to observe d->is_dying correctly, we need to rely on per-arch
locking, so the check to ignore IOMMU mapping is added on the per-driver
map_page() callback.
Signed-off-by: Julien Grall <jgrall@amazon.com>
---
Changes in v3:
- Patch added. This is a replacement of "xen/iommu: iommu_map: Don't
crash the domain if it is dying"
---
xen/drivers/passthrough/amd/iommu_map.c | 13 +++++++++++++
xen/drivers/passthrough/vtd/iommu.c | 13 +++++++++++++
xen/drivers/passthrough/x86/iommu.c | 3 +++
3 files changed, 29 insertions(+)
diff --git a/xen/drivers/passthrough/amd/iommu_map.c b/xen/drivers/passthrough/amd/iommu_map.c
index d3a8b1aec766..ed78a083ba12 100644
--- a/xen/drivers/passthrough/amd/iommu_map.c
+++ b/xen/drivers/passthrough/amd/iommu_map.c
@@ -285,6 +285,19 @@ int amd_iommu_map_page(struct domain *d, dfn_t dfn, mfn_t mfn,
spin_lock(&hd->arch.mapping_lock);
+ /*
+ * IOMMU mapping request can be safely ignored when the domain is dying.
+ *
+ * hd->arch.mapping_lock guarantees that d->is_dying will be observed
+ * before any page tables are freed (see iommu_free_pgtables() and
+ * iommu_clear_root_pgtable()).
+ */
+ if ( d->is_dying )
+ {
+ spin_unlock(&hd->arch.mapping_lock);
+ return 0;
+ }
+
rc = amd_iommu_alloc_root(d);
if ( rc )
{
diff --git a/xen/drivers/passthrough/vtd/iommu.c b/xen/drivers/passthrough/vtd/iommu.c
index e1871f6c2bc1..239a63f74f64 100644
--- a/xen/drivers/passthrough/vtd/iommu.c
+++ b/xen/drivers/passthrough/vtd/iommu.c
@@ -1771,6 +1771,19 @@ static int __must_check intel_iommu_map_page(struct domain *d, dfn_t dfn,
spin_lock(&hd->arch.mapping_lock);
+ /*
+ * IOMMU mapping request can be safely ignored when the domain is dying.
+ *
+ * hd->arch.mapping_lock guarantees that d->is_dying will be observed
+ * before any page tables are freed (see iommu_free_pgtables() and
+ * iommu_clear_root_pgtable()).
+ */
+ if ( d->is_dying )
+ {
+ spin_unlock(&hd->arch.mapping_lock);
+ return 0;
+ }
+
pg_maddr = addr_to_dma_page_maddr(d, dfn_to_daddr(dfn), 1);
if ( !pg_maddr )
{
diff --git a/xen/drivers/passthrough/x86/iommu.c b/xen/drivers/passthrough/x86/iommu.c
index f54fc8093f18..faa0078db595 100644
--- a/xen/drivers/passthrough/x86/iommu.c
+++ b/xen/drivers/passthrough/x86/iommu.c
@@ -273,6 +273,9 @@ int iommu_free_pgtables(struct domain *d)
/*
* Pages will be moved to the free list below. So we want to
* clear the root page-table to avoid any potential use after-free.
+ *
+ * After this call, no more IOMMU mapping can happen.
+ *
*/
hd->platform_ops->clear_root_pgtable(d);
--
2.17.1
next prev parent reply other threads:[~2021-02-17 14:25 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-17 14:24 [for-4.15][PATCH v3 0/3] xen/iommu: Collection of bug fixes for IOMMU teadorwn Julien Grall
2021-02-17 14:24 ` [for-4.15][PATCH v3 1/3] xen/iommu: x86: Clear the root page-table before freeing the page-tables Julien Grall
2021-02-17 14:54 ` Jan Beulich
2021-02-17 15:00 ` Julien Grall
2021-02-17 15:17 ` Jan Beulich
2021-02-17 16:48 ` Julien Grall
2021-02-17 14:24 ` Julien Grall [this message]
2021-02-17 15:01 ` [for-4.15][PATCH v3 2/3] xen/x86: iommu: Ignore IOMMU mapping requests when a domain is dying Jan Beulich
2021-02-17 16:07 ` Julien Grall
2021-02-18 13:05 ` Jan Beulich
2021-02-18 13:25 ` Julien Grall
2021-02-19 8:49 ` Jan Beulich
2021-02-19 9:24 ` Julien Grall
2021-02-18 14:00 ` Paul Durrant
2021-02-19 8:56 ` Jan Beulich
2021-02-17 14:24 ` [for-4.15][PATCH v3 3/3] xen/iommu: x86: Harden the IOMMU page-table allocator Julien Grall
2021-02-17 15:13 ` Jan Beulich
2021-02-17 16:29 ` Julien Grall
2021-02-18 13:10 ` Jan Beulich
2021-02-18 13:19 ` Julien Grall
2021-02-18 17:04 ` Jan Beulich
2021-02-18 17:41 ` Julien Grall
2021-02-19 8:46 ` Jan Beulich
2021-02-19 8:57 ` Julien Grall
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210217142458.3769-3-julien@xen.org \
--to=julien@xen.org \
--cc=andrew.cooper3@citrix.com \
--cc=hongyxia@amazon.co.uk \
--cc=iwj@xenproject.org \
--cc=jbeulich@suse.com \
--cc=jgrall@amazon.com \
--cc=kevin.tian@intel.com \
--cc=paul@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).