diff options
| author | Alex Williamson <alex.williamson@redhat.com> | 2019-02-21 21:07:03 -0700 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2019-02-21 21:07:03 -0700 |
| commit | 567d7d3e6be5e84741655729aebf78c7257ed043 (patch) | |
| tree | b90bac07aa32b7bc2f1c2391642ca0cfad952cb3 /hw/vfio/trace-events | |
| parent | fc3dbb90f2eb069801bfb4cfe9cbc83cf9c5f4a9 (diff) | |
| download | qemu-567d7d3e6be5e84741655729aebf78c7257ed043.zip qemu-567d7d3e6be5e84741655729aebf78c7257ed043.tar.gz qemu-567d7d3e6be5e84741655729aebf78c7257ed043.tar.bz2 | |
vfio/common: Work around kernel overflow bug in DMA unmap
A kernel bug was introduced in v4.15 via commit 71a7d3d78e3c which
adds a test for address space wrap-around in the vfio DMA unmap path.
Unfortunately due to overflow, the kernel detects an unmap of the last
page in the 64-bit address space as a wrap-around. In QEMU, a Q35
guest with VT-d emulation and guest IOMMU enabled will attempt to make
such an unmap request during VM system reset, triggering an error:
qemu-kvm: VFIO_UNMAP_DMA: -22
qemu-kvm: vfio_dma_unmap(0x561f059948f0, 0xfef00000, 0xffffffff01100000) = -22 (Invalid argument)
Here the IOVA start address (0xfef00000) and the size parameter
(0xffffffff01100000) add to exactly 2^64, triggering the bug. A
kernel fix is queued for the Linux v5.0 release to address this.
This patch implements a workaround to retry the unmap, excluding the
final page of the range when we detect an unmap failing which matches
the requirements for this issue. This is expected to be a safe and
complete workaround as the VT-d address space does not extend to the
full 64-bit space and therefore the last page should never be mapped.
This workaround can be removed once all kernels with this bug are
sufficiently deprecated.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291
Reported-by: Pei Zhang <pezhang@redhat.com>
Debugged-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Diffstat (limited to 'hw/vfio/trace-events')
| -rw-r--r-- | hw/vfio/trace-events | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events index f41ca96..ed2f333 100644 --- a/hw/vfio/trace-events +++ b/hw/vfio/trace-events @@ -110,6 +110,7 @@ vfio_region_mmaps_set_enabled(const char *name, bool enabled) "Region %s mmaps e vfio_region_sparse_mmap_header(const char *name, int index, int nr_areas) "Device %s region %d: %d sparse mmap entries" vfio_region_sparse_mmap_entry(int i, unsigned long start, unsigned long end) "sparse entry %d [0x%lx - 0x%lx]" vfio_get_dev_region(const char *name, int index, uint32_t type, uint32_t subtype) "%s index %d, %08x/%0x8" +vfio_dma_unmap_overflow_workaround(void) "" # hw/vfio/platform.c vfio_platform_base_device_init(char *name, int groupid) "%s belongs to group #%d" |