[Xen-changelog] [xen stable-4.2] AMD IOMMU: don't free page table prematurely

[patchbot@xxxxxxx]

commit f9d3462a8fe6768e8230f1ee21251dee9f165fc7
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Jun 3 12:22:14 2014 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jun 3 12:22:14 2014 +0200

    AMD IOMMU: don't free page table prematurely
    
    iommu_merge_pages() still wants to look at the next level page table,
    the TLB flush necessary before freeing too happens in that function,
    and if it fails no free should happen at all. Hence the freeing must
    be done after that function returned successfully, not before it's
    being called.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
    Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
    master commit: 6b4d71d028f445cba7426a144751fddc8bfdd67b
    master date: 2014-05-28 09:50:33 +0200
---
 xen/drivers/passthrough/amd/iommu_map.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/xen/drivers/passthrough/amd/iommu_map.c 
b/xen/drivers/passthrough/amd/iommu_map.c
index 43bf5e5..f51db77 100644
--- a/xen/drivers/passthrough/amd/iommu_map.c
+++ b/xen/drivers/passthrough/amd/iommu_map.c
@@ -701,8 +701,6 @@ int amd_iommu_map_page(struct domain *d, unsigned long gfn, 
unsigned long mfn,
         if ( !iommu_update_pde_count(d, pt_mfn[merge_level],
                                      gfn, mfn, merge_level) )
             break;
-        /* Deallocate lower level page table */
-        free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1]));
 
         if ( iommu_merge_pages(d, pt_mfn[merge_level], gfn, 
                                flags, merge_level) )
@@ -713,6 +711,9 @@ int amd_iommu_map_page(struct domain *d, unsigned long gfn, 
unsigned long mfn,
             domain_crash(d);
             return -EFAULT;
         }
+
+        /* Deallocate lower level page table */
+        free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1]));
     }
 
 out:
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.2

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog