system/qemu
system/qemu
1
0
Fork 0
mirror of https://gitlab.com/qemu-project/qemu synced 2024-11-05 20:35:44 +00:00
Code Issues Projects Releases Packages Wiki Activity

memory: Skip bad range assertion if notifier is DEVIOTLB_UNMAP type

Browse source 
Device IOTLB invalidations can unmap arbitrary ranges, eiter outside of
the memory region or even [0, ~0ULL] for all the space. The assertion
could be hit by a guest, and rhel7 guest effectively hit it.

Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Juan Quintela <quintela@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20201116165506.31315-6-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Eugenio Pérez 2020-11-16 17:55:06 +01:00 committed by Michael S. Tsirkin
parent f7701e2c79
commit 1804857f19
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
softmmu/memory.c
View file

@ -1947,6 +1947,7 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
{
IOMMUTLBEntry *entry = &event->entry;
hwaddr entry_end = entry->iova + entry->addr_mask;
IOMMUTLBEntry tmp = *entry;
if (event->type == IOMMU_NOTIFIER_UNMAP) {
assert(entry->perm == IOMMU_NONE);
@ -1960,10 +1961,16 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
return;
}
assert(entry->iova >= notifier->start && entry_end <= notifier->end);
if (notifier->notifier_flags & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
/* Crop (iova, addr_mask) to range */
tmp.iova = MAX(tmp.iova, notifier->start);
tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova;
} else {
assert(entry->iova >= notifier->start && entry_end <= notifier->end);
}
if (event->type & notifier->notifier_flags) {
notifier->notify(notifier, entry);
notifier->notify(notifier, &tmp);
}
}