• Chris Wright's avatar
    intel-iommu: Dont cache iova above 32bit · 1c9fc3d1
    Chris Wright authored
    Mike Travis and Mike Habeck reported an issue where iova allocation
    would return a range that was larger than a device's dma mask.
    
    https://lkml.org/lkml/2011/3/29/423
    
    The dmar initialization code will reserve all PCI MMIO regions and copy
    those reservations into a domain specific iova tree.  It is possible for
    one of those regions to be above the dma mask of a device.  It is typical
    to allocate iovas with a 32bit mask (despite device's dma mask possibly
    being larger) and cache the result until it exhausts the lower 32bit
    address space.  Freeing the iova range that is >= the last iova in the
    lower 32bit range when there is still an iova above the 32bit range will
    corrupt the cached iova by pointing it to a region that is above 32bit.
    If that region is also larger than the device's dma mask, a subsequent
    allocation will return an unusable iova and cause dma failure.
    
    Simply don't cache an iova that is above the 32bit caching boundary.
    Reported-by: default avatarMike Travis <travis@sgi.com>
    Reported-by: default avatarMike Habeck <habeck@sgi.com>
    Cc: stable@kernel.org
    Acked-by: default avatarMike Travis <travis@sgi.com>
    Tested-by: default avatarMike Habeck <habeck@sgi.com>
    Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
    Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
    1c9fc3d1
iova.c 11.5 KB