39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
|
# Commit 6b4d71d028f445cba7426a144751fddc8bfdd67b
|
||
|
|
# Date 2014-05-28 09:50:33 +0200
|
||
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
||
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
||
|
|
AMD IOMMU: don't free page table prematurely
|
||
|
|
|
||
|
|
iommu_merge_pages() still wants to look at the next level page table,
|
||
|
|
the TLB flush necessary before freeing too happens in that function,
|
||
|
|
and if it fails no free should happen at all. Hence the freeing must
|
||
|
|
be done after that function returned successfully, not before it's
|
||
|
|
being called.
|
||
|
|
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
||
|
|
Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
|
||
|
|
Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
|
||
|
|
|
||
|
|
--- a/xen/drivers/passthrough/amd/iommu_map.c
|
||
|
|
+++ b/xen/drivers/passthrough/amd/iommu_map.c
|
||
|
|
@@ -691,8 +691,6 @@ int amd_iommu_map_page(struct domain *d,
|
||
|
|
if ( !iommu_update_pde_count(d, pt_mfn[merge_level],
|
||
|
|
gfn, mfn, merge_level) )
|
||
|
|
break;
|
||
|
|
- /* Deallocate lower level page table */
|
||
|
|
- free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1]));
|
||
|
|
|
||
|
|
if ( iommu_merge_pages(d, pt_mfn[merge_level], gfn,
|
||
|
|
flags, merge_level) )
|
||
|
|
@@ -703,6 +701,9 @@ int amd_iommu_map_page(struct domain *d,
|
||
|
|
domain_crash(d);
|
||
|
|
return -EFAULT;
|
||
|
|
}
|
||
|
|
+
|
||
|
|
+ /* Deallocate lower level page table */
|
||
|
|
+ free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1]));
|
||
|
|
}
|
||
|
|
|
||
|
|
out:
|