linux-lts/repos/core-x86_64/0003-iommu-intel-do-deep-dma-unmapping-to-avoid-kernel-fl.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Ajay Garg <ajaygargnsit@gmail.com>
   3 Date: Tue, 12 Oct 2021 19:26:53 +0530
   4 Subject: [PATCH] iommu: intel: do deep dma-unmapping, to avoid
   5  kernel-flooding.
   6
   7 Origins at :
   8 https://lists.linuxfoundation.org/pipermail/iommu/2021-October/thread.html
   9
  10 === Changes from v1 => v2 ===
  11
  12 a)
  13 Improved patch-description.
  14
  15 b)
  16 A more root-level fix, as suggested by
  17
  18         1.
  19         Alex Williamson <alex.williamson@redhat.com>
  20
  21         2.
  22         Lu Baolu <baolu.lu@linux.intel.com>
  23
  24 === Issue ===
  25
  26 Kernel-flooding is seen, when an x86_64 L1 guest (Ubuntu-21) is booted in qemu/kvm
  27 on a x86_64 host (Ubuntu-21), with a host-pci-device attached.
  28
  29 Following kind of logs, along with the stacktraces, cause the flood :
  30
  31 ......
  32  DMAR: ERROR: DMA PTE for vPFN 0x428ec already set (to 3f6ec003 not 3f6ec003)
  33  DMAR: ERROR: DMA PTE for vPFN 0x428ed already set (to 3f6ed003 not 3f6ed003)
  34  DMAR: ERROR: DMA PTE for vPFN 0x428ee already set (to 3f6ee003 not 3f6ee003)
  35  DMAR: ERROR: DMA PTE for vPFN 0x428ef already set (to 3f6ef003 not 3f6ef003)
  36  DMAR: ERROR: DMA PTE for vPFN 0x428f0 already set (to 3f6f0003 not 3f6f0003)
  37 ......
  38
  39 === Current Behaviour, leading to the issue ===
  40
  41 Currently, when we do a dma-unmapping, we unmap/unlink the mappings, but
  42 the pte-entries are not cleared.
  43
  44 Thus, following sequencing would flood the kernel-logs :
  45
  46 i)
  47 A dma-unmapping makes the real/leaf-level pte-slot invalid, but the
  48 pte-content itself is not cleared.
  49
  50 ii)
  51 Now, during some later dma-mapping procedure, as the pte-slot is about
  52 to hold a new pte-value, the intel-iommu checks if a prior
  53 pte-entry exists in the pte-slot. If it exists, it logs a kernel-error,
  54 along with a corresponding stacktrace.
  55
  56 iii)
  57 Step ii) runs in abundance, and the kernel-logs run insane.
  58
  59 === Fix ===
  60
  61 We ensure that as part of a dma-unmapping, each (unmapped) pte-slot
  62 is also cleared of its value/content (at the leaf-level, where the
  63 real mapping from a iova => pfn mapping is stored).
  64
  65 This completes a "deep" dma-unmapping.
  66
  67 Signed-off-by: Ajay Garg <ajaygargnsit@gmail.com>
  68 Link: https://lore.kernel.org/linux-iommu/20211012135653.3852-1-ajaygargnsit@gmail.com/
  69 ---
  70  drivers/iommu/intel/iommu.c | 2 ++
  71  1 file changed, 2 insertions(+)
  72
  73 diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
  74 index a1ffb3d6d901..c41788ea1a03 100644
  75 --- a/drivers/iommu/intel/iommu.c
  76 +++ b/drivers/iommu/intel/iommu.c
  77 @@ -5113,6 +5113,8 @@ static size_t intel_iommu_unmap(struct iommu_domain *domain,
  78         gather->freelist = domain_unmap(dmar_domain, start_pfn,
  79                                         last_pfn, gather->freelist);
  80
  81 +       dma_pte_clear_range(dmar_domain, start_pfn, last_pfn);
  82 +
  83         if (dmar_domain->max_addr == iova + size)
  84                 dmar_domain->max_addr = iova;
  85