From: Lu Baolu <baolu.lu@linux.intel.com>
To: "Longpeng(Mike)" <longpeng2@huawei.com>,
iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org
Cc: Kevin Tian <kevin.tian@intel.com>,
David Woodhouse <dwmw2@infradead.org>,
stable@vger.kernel.org,
Alex Williamson <alex.williamson@redhat.com>,
Gonglei <arei.gonglei@huawei.com>
Subject: Re: [PATCH] iommu/vt-d: Force to flush iotlb before creating superpage
Date: Fri, 2 Apr 2021 11:06:10 +0800 [thread overview]
Message-ID: <af470760-04c1-0929-7304-0879ca7af542@linux.intel.com> (raw)
In-Reply-To: <20210401071834.1639-1-longpeng2@huawei.com>
Hi Longpeng,
On 4/1/21 3:18 PM, Longpeng(Mike) wrote:
> The translation caches may preserve obsolete data when the
> mapping size is changed, suppose the following sequence which
> can reveal the problem with high probability.
>
> 1.mmap(4GB,MAP_HUGETLB)
> 2.
> while (1) {
> (a) DMA MAP 0,0xa0000
> (b) DMA UNMAP 0,0xa0000
> (c) DMA MAP 0,0xc0000000
> * DMA read IOVA 0 may failure here (Not present)
> * if the problem occurs.
> (d) DMA UNMAP 0,0xc0000000
> }
>
> The page table(only focus on IOVA 0) after (a) is:
> PML4: 0x19db5c1003 entry:0xffff899bdcd2f000
> PDPE: 0x1a1cacb003 entry:0xffff89b35b5c1000
> PDE: 0x1a30a72003 entry:0xffff89b39cacb000
> PTE: 0x21d200803 entry:0xffff89b3b0a72000
>
> The page table after (b) is:
> PML4: 0x19db5c1003 entry:0xffff899bdcd2f000
> PDPE: 0x1a1cacb003 entry:0xffff89b35b5c1000
> PDE: 0x1a30a72003 entry:0xffff89b39cacb000
> PTE: 0x0 entry:0xffff89b3b0a72000
>
> The page table after (c) is:
> PML4: 0x19db5c1003 entry:0xffff899bdcd2f000
> PDPE: 0x1a1cacb003 entry:0xffff89b35b5c1000
> PDE: 0x21d200883 entry:0xffff89b39cacb000 (*)
>
> Because the PDE entry after (b) is present, it won't be
> flushed even if the iommu driver flush cache when unmap,
> so the obsolete data may be preserved in cache, which
> would cause the wrong translation at end.
>
> However, we can see the PDE entry is finally switch to
> 2M-superpage mapping, but it does not transform
> to 0x21d200883 directly:
>
> 1. PDE: 0x1a30a72003
> 2. __domain_mapping
> dma_pte_free_pagetable
> Set the PDE entry to ZERO
> Set the PDE entry to 0x21d200883
>
> So we must flush the cache after the entry switch to ZERO
> to avoid the obsolete info be preserved.
>
> Cc: David Woodhouse <dwmw2@infradead.org>
> Cc: Lu Baolu <baolu.lu@linux.intel.com>
> Cc: Nadav Amit <nadav.amit@gmail.com>
> Cc: Alex Williamson <alex.williamson@redhat.com>
> Cc: Kevin Tian <kevin.tian@intel.com>
> Cc: Gonglei (Arei) <arei.gonglei@huawei.com>
>
> Fixes: 6491d4d02893 ("intel-iommu: Free old page tables before creating superpage")
> Cc: <stable@vger.kernel.org> # v3.0+
> Link: https://lore.kernel.org/linux-iommu/670baaf8-4ff8-4e84-4be3-030b95ab5a5e@huawei.com/
> Suggested-by: Lu Baolu <baolu.lu@linux.intel.com>
> Signed-off-by: Longpeng(Mike) <longpeng2@huawei.com>
> ---
> drivers/iommu/intel/iommu.c | 15 +++++++++++++--
> 1 file changed, 13 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
> index ee09323..cbcb434 100644
> --- a/drivers/iommu/intel/iommu.c
> +++ b/drivers/iommu/intel/iommu.c
> @@ -2342,9 +2342,20 @@ static inline int hardware_largepage_caps(struct dmar_domain *domain,
> * removed to make room for superpage(s).
> * We're adding new large pages, so make sure
> * we don't remove their parent tables.
> + *
> + * We also need to flush the iotlb before creating
> + * superpage to ensure it does not perserves any
> + * obsolete info.
> */
> - dma_pte_free_pagetable(domain, iov_pfn, end_pfn,
> - largepage_lvl + 1);
> + if (dma_pte_present(pte)) {
> + int i;
> +
> + dma_pte_free_pagetable(domain, iov_pfn, end_pfn,
> + largepage_lvl + 1);
> + for_each_domain_iommu(i, domain)
> + iommu_flush_iotlb_psi(g_iommus[i], domain,
> + iov_pfn, nr_pages, 0, 0);
Thanks for patch!
How about making the flushed page size accurate? For example,
@@ -2365,8 +2365,8 @@ __domain_mapping(struct dmar_domain *domain,
unsigned long iov_pfn,
dma_pte_free_pagetable(domain,
iov_pfn, end_pfn,
largepage_lvl + 1);
for_each_domain_iommu(i, domain)
-
iommu_flush_iotlb_psi(g_iommus[i], domain,
-
iov_pfn, nr_pages, 0, 0);
+
iommu_flush_iotlb_psi(g_iommus[i], domain, iov_pfn,
+
ALIGN_DOWN(nr_pages, lvl_pages), 0, 0);
> + }
> } else {
> pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
> }
>
Best regards,
baolu
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
next prev parent reply other threads:[~2021-04-02 3:15 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-01 7:18 [PATCH] iommu/vt-d: Force to flush iotlb before creating superpage Longpeng(Mike)
2021-04-02 3:06 ` Lu Baolu [this message]
2021-04-02 3:41 ` Longpeng (Mike, Cloud Infrastructure Service Product Dept.)
2021-04-02 4:47 ` Lu Baolu
2021-04-02 4:44 ` Lu Baolu
2021-04-07 6:35 ` Longpeng (Mike, Cloud Infrastructure Service Product Dept.)
2021-04-08 4:32 ` Lu Baolu
2021-04-08 7:37 ` Longpeng (Mike, Cloud Infrastructure Service Product Dept.)
2021-04-09 5:31 ` Lu Baolu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=af470760-04c1-0929-7304-0879ca7af542@linux.intel.com \
--to=baolu.lu@linux.intel.com \
--cc=alex.williamson@redhat.com \
--cc=arei.gonglei@huawei.com \
--cc=dwmw2@infradead.org \
--cc=iommu@lists.linux-foundation.org \
--cc=kevin.tian@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=longpeng2@huawei.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).