Skip to content
Permalink
Browse files Browse the repository at this point in the history
KVM: unmap pages from the iommu when slots are removed
commit 32f6daa upstream.

We've been adding new mappings, but not destroying old mappings.
This can lead to a page leak as pages are pinned using
get_user_pages, but only unpinned with put_page if they still
exist in the memslots list on vm shutdown.  A memslot that is
destroyed while an iommu domain is enabled for the guest will
therefore result in an elevated page reference count that is
never cleared.

Additionally, without this fix, the iommu is only programmed
with the first translation for a gpa.  This can result in
peer-to-peer errors if a mapping is destroyed and replaced by a
new mapping at the same gpa as the iommu will still be pointing
to the original, pinned memory address.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
awilliam authored and gregkh committed Apr 27, 2012
1 parent f16e3ad commit 09ca8e1
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 3 deletions.
6 changes: 6 additions & 0 deletions include/linux/kvm_host.h
Expand Up @@ -593,6 +593,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);

#ifdef CONFIG_IOMMU_API
int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
int kvm_iommu_map_guest(struct kvm *kvm);
int kvm_iommu_unmap_guest(struct kvm *kvm);
int kvm_assign_device(struct kvm *kvm,
Expand All @@ -606,6 +607,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
return 0;
}

static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
struct kvm_memory_slot *slot)
{
}

static inline int kvm_iommu_map_guest(struct kvm *kvm)
{
return -ENODEV;
Expand Down
7 changes: 6 additions & 1 deletion virt/kvm/iommu.c
Expand Up @@ -310,6 +310,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
}
}

void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
{
kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
}

static int kvm_iommu_unmap_memslots(struct kvm *kvm)
{
int idx;
Expand All @@ -320,7 +325,7 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
slots = kvm_memslots(kvm);

kvm_for_each_memslot(memslot, slots)
kvm_iommu_put_pages(kvm, memslot->base_gfn, memslot->npages);
kvm_iommu_unmap_pages(kvm, memslot);

srcu_read_unlock(&kvm->srcu, idx);

Expand Down
5 changes: 3 additions & 2 deletions virt/kvm/kvm_main.c
Expand Up @@ -873,12 +873,13 @@ int __kvm_set_memory_region(struct kvm *kvm,
if (r)
goto out_free;

/* map the pages in iommu page table */
/* map/unmap the pages in iommu page table */
if (npages) {
r = kvm_iommu_map_pages(kvm, &new);
if (r)
goto out_free;
}
} else
kvm_iommu_unmap_pages(kvm, &old);

r = -ENOMEM;
slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
Expand Down

0 comments on commit 09ca8e1

Please sign in to comment.