From 75ea7ddc250997986c781fedcdc862cb00ae4e8a Mon Sep 17 00:00:00 2001
Message-Id: <75ea7ddc250997986c781fedcdc862cb00ae4e8a.1336555833.git.minovotn@redhat.com>
From: Alex Williamson <alex.williamson@redhat.com>
Date: Thu, 3 May 2012 19:19:34 +0200
Subject: [PATCH] KVM: unmap pages from the iommu when slots are removed

RH-Author: Alex Williamson <alex.williamson@redhat.com>
Message-id: <20120503191401.5188.26997.stgit@bling.home>
Patchwork-id: 39566
O-Subject: [RHEL5.9/5.8.z kmod-kvm PATCH] KVM: unmap pages from the iommu when slots are removed
Bugzilla: 814153
RH-Acked-by: Don Dutile <ddutile@redhat.com>
RH-Acked-by: Amos Kong <akong@redhat.com>
RH-Acked-by: Paolo Bonzini <pbonzini@redhat.com>

Bugzilla: 814153 [5.9], 814151 [5.8.z]
Brew: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=4372204
Upstream: 32f6daad4651a748a58a3ab6da0611862175722f

We've been adding new mappings, but not destroying old mappings.
This can lead to a page leak as pages are pinned using
get_user_pages, but only unpinned with put_page if they still
exist in the memslots list on vm shutdown.  A memslot that is
destroyed while an iommu domain is enabled for the guest will
therefore result in an elevated page reference count that is
never cleared.

Additionally, without this fix, the iommu is only programmed
with the first translation for a gpa.  This can result in
peer-to-peer errors if a mapping is destroyed and replaced by a
new mapping at the same gpa as the iommu will still be pointing
to the original, pinned memory address.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
---

Backport note: commit 21a1416a1c945c5aeaeaf791b63c64926018eb77
"KVM: lock slots_lock around device assignment" is not necessary
for rhel5 since slot_lock is already taken around nearly all of
kvm_vm_ioctl_assign_device(), including calling kvm_iommu_map_guest

Tested assigning and removing multiple devices and using the
test program from bz811653.

 include/linux/kvm_host.h |    8 ++++++++
 virt/kvm/iommu.c         |   10 ++++++++--
 virt/kvm/kvm_main.c      |   18 ++++++++++++------
 3 files changed, 28 insertions(+), 8 deletions(-)

Signed-off-by: Michal Novotny <minovotn@redhat.com>
---
 include/linux/kvm_host.h |    8 ++++++++
 virt/kvm/iommu.c         |   10 ++++++++--
 virt/kvm/kvm_main.c      |   18 ++++++++++++------
 3 files changed, 28 insertions(+), 8 deletions(-)

diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 419345d..bb876ce 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -378,6 +378,8 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
 #ifdef CONFIG_IOMMU_API
 int kvm_iommu_map_pages(struct kvm *kvm, gfn_t base_gfn,
 			unsigned long npages);
+void kvm_iommu_unmap_pages(struct kvm *kvm, gfn_t base_gfn,
+			   unsigned long npages);
 int kvm_iommu_map_guest(struct kvm *kvm);
 int kvm_iommu_unmap_guest(struct kvm *kvm);
 int kvm_assign_device(struct kvm *kvm,
@@ -392,6 +394,12 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
 	return 0;
 }
 
+static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
+					 gfn_t base_gfn,
+					 unsigned long npages)
+{
+}
+
 static inline int kvm_iommu_map_guest(struct kvm *kvm)
 {
 	return -ENODEV;
diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
index 4c40375..17aed9b 100644
--- a/virt/kvm/iommu.c
+++ b/virt/kvm/iommu.c
@@ -186,13 +186,19 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
 	iommu_unmap_range(domain, gfn_to_gpa(base_gfn), PAGE_SIZE * npages);
 }
 
+void kvm_iommu_unmap_pages(struct kvm *kvm,
+			   gfn_t base_gfn, unsigned long npages)
+{
+	kvm_iommu_put_pages(kvm, base_gfn, npages);
+}
+
 static int kvm_iommu_unmap_memslots(struct kvm *kvm)
 {
 	int i;
 
 	for (i = 0; i < kvm->nmemslots; i++) {
-		kvm_iommu_put_pages(kvm, kvm->memslots[i].base_gfn,
-				    kvm->memslots[i].npages);
+		kvm_iommu_unmap_pages(kvm, kvm->memslots[i].base_gfn,
+				      kvm->memslots[i].npages);
 	}
 
 	return 0;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 5ac50a3..40b9328 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1153,7 +1153,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
 {
 	int r;
 	gfn_t base_gfn;
-	unsigned long npages;
+	unsigned long npages, old_npages;
 	int largepages;
 	unsigned long i;
 	struct kvm_memory_slot *memslot;
@@ -1260,8 +1260,11 @@ int __kvm_set_memory_region(struct kvm *kvm,
 	}
 #endif /* not defined CONFIG_S390 */
 
-	if (!npages)
+	if (!npages) {
 		kvm_arch_flush_shadow(kvm);
+		/* Save before clobbered by kvm_free_physmem_slot */
+		old_npages = old.npages;
+	}
 
 	spin_lock(&kvm->mmu_lock);
 	if (mem->slot >= kvm->nmemslots)
@@ -1285,10 +1288,13 @@ int __kvm_set_memory_region(struct kvm *kvm,
 		*memslot = old;
 	spin_unlock(&kvm->mmu_lock);
 #ifdef CONFIG_DMAR
-	/* map the pages in iommu page table */
-	r = kvm_iommu_map_pages(kvm, base_gfn, npages);
-	if (r)
-		goto out;
+	/* map/unmap the pages in iommu page table */
+	if (npages) {
+		r = kvm_iommu_map_pages(kvm, base_gfn, npages);
+		if (r)
+			goto out;
+	} else
+		kvm_iommu_unmap_pages(kvm, base_gfn, old_npages);
 #endif
 	return 0;
 
-- 
1.7.7.6