From: Jan Beulich Date: Wed, 28 May 2014 07:50:33 +0000 (+0200) Subject: AMD IOMMU: don't free page table prematurely X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~4949 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=6b4d71d028f445cba7426a144751fddc8bfdd67b;p=xen.git AMD IOMMU: don't free page table prematurely iommu_merge_pages() still wants to look at the next level page table, the TLB flush necessary before freeing too happens in that function, and if it fails no free should happen at all. Hence the freeing must be done after that function returned successfully, not before it's being called. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Reviewed-by: Suravee Suthikulpanit Tested-by: Suravee Suthikulpanit --- diff --git a/xen/drivers/passthrough/amd/iommu_map.c b/xen/drivers/passthrough/amd/iommu_map.c index ceb1c2864d..a8c60ec57b 100644 --- a/xen/drivers/passthrough/amd/iommu_map.c +++ b/xen/drivers/passthrough/amd/iommu_map.c @@ -691,8 +691,6 @@ int amd_iommu_map_page(struct domain *d, unsigned long gfn, unsigned long mfn, if ( !iommu_update_pde_count(d, pt_mfn[merge_level], gfn, mfn, merge_level) ) break; - /* Deallocate lower level page table */ - free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1])); if ( iommu_merge_pages(d, pt_mfn[merge_level], gfn, flags, merge_level) ) @@ -703,6 +701,9 @@ int amd_iommu_map_page(struct domain *d, unsigned long gfn, unsigned long mfn, domain_crash(d); return -EFAULT; } + + /* Deallocate lower level page table */ + free_amd_iommu_pgtable(mfn_to_page(pt_mfn[merge_level - 1])); } out: