a428832eb0
xl-check-for-libvirt-managed-domain.patch - bnc#878841 - VUL-0: XSA-96: Xen: Vulnerabilities in HVM MSI injection 538dcada-x86-HVM-eliminate-vulnerabilities-from-hvm_inject_msi.patch - Upstream patches from Jan 537cd0b0-hvmloader-also-cover-PCI-MMIO-ranges-above-4G-with-UC-MTRR-ranges.patch 537cd0cc-hvmloader-PA-range-0xfc000000-0xffffffff-should-be-UC.patch 5383167d-ACPI-ERST-fix-table-mapping.patch 5383175e-VT-d-fix-mask-applied-to-DMIBAR-in-desktop-chipset-XSA-59-workaround.patch 53859549-AMD-IOMMU-don-t-free-page-table-prematurely.patch 5385956b-x86-don-t-use-VA-for-cache-flush-when-also-flushing-TLB.patch 53859956-timers-set-the-deadline-more-accurately.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=318
39 lines
1.5 KiB
Diff
39 lines
1.5 KiB
Diff
# Commit 6b4d71d028f445cba7426a144751fddc8bfdd67b
|
|
# Date 2014-05-28 09:50:33 +0200
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
AMD IOMMU: don't free page table prematurely
|
|
|
|
iommu_merge_pages() still wants to look at the next level page table,
|
|
the TLB flush necessary before freeing too happens in that function,
|
|
and if it fails no free should happen at all. Hence the freeing must
|
|
be done after that function returned successfully, not before it's
|
|
being called.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
|
Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
|
|
Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
|
|
|
|
--- a/xen/drivers/passthrough/amd/iommu_map.c
|
|
+++ b/xen/drivers/passthrough/amd/iommu_map.c
|
|
@@ -691,8 +691,6 @@ int amd_iommu_map_page(struct domain *d,
|
|
if ( !iommu_update_pde_count(d, pt_mfn[merge_level],
|
|
gfn, mfn, merge_level) )
|
|
break;
|
|
- /* Deallocate lower level page table */
|
|
- free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1]));
|
|
|
|
if ( iommu_merge_pages(d, pt_mfn[merge_level], gfn,
|
|
flags, merge_level) )
|
|
@@ -703,6 +701,9 @@ int amd_iommu_map_page(struct domain *d,
|
|
domain_crash(d);
|
|
return -EFAULT;
|
|
}
|
|
+
|
|
+ /* Deallocate lower level page table */
|
|
+ free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1]));
|
|
}
|
|
|
|
out:
|