kernel/linux.git/include/linux/iommu-debug-pagealloc.h, branch v7.0-rc7Linux kernel stable tree (mirror)https://git.radix-linux.su/kernel/linux.git/atom?h=v7.0-rc72026-01-10T09:52:27+00:00iommu: debug-pagealloc: Check mapped/unmapped kernel memory2026-01-10T09:52:27+00:00Mostafa Salehsmostafa@google.com2026-01-09T17:18:05+00:00urn:sha1:a8258ffed2efdf533bdc756141eeb7bc5301ad4f
Now, as the page_ext holds count of IOMMU mappings, we can use it to
assert that any page allocated/freed is indeed not in the IOMMU.
The sanitizer doesn’t protect against mapping/unmapping during this
period. However, that’s less harmful as the page is not used by the
kernel.
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
iommu: Add calls for IOMMU_DEBUG_PAGEALLOC2026-01-10T09:52:26+00:00Mostafa Salehsmostafa@google.com2026-01-09T17:18:03+00:00urn:sha1:ccc21213f013834b484cdcc738e282f963fcfc97
Add calls for the new iommu debug config IOMMU_DEBUG_PAGEALLOC:
- iommu_debug_init: Enable the debug mode if configured by the user.
- iommu_debug_map: Track iommu pages mapped, using physical address.
- iommu_debug_unmap_begin: Track start of iommu unmap operation, with
IOVA and size.
- iommu_debug_unmap_end: Track the end of unmap operation, passing the
actual unmapped size versus the tracked one at unmap_begin.
We have to do the unmap_begin/end as once pages are unmapped we lose
the information of the physical address.
This is racy, but the API is racy by construction as it uses refcounts
and doesn't attempt to lock/synchronize with the IOMMU API as that will
be costly, meaning that possibility of false negative exists.
Reviewed-by: Samiullah Khawaja <skhawaja@google.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
iommu: Add page_ext for IOMMU_DEBUG_PAGEALLOC2026-01-10T09:52:25+00:00Mostafa Salehsmostafa@google.com2026-01-09T17:18:02+00:00urn:sha1:466ae6978a5b8c6022bd4537fbfd00e94bb07219
Add a new config IOMMU_DEBUG_PAGEALLOC, which registers new data to
page_ext.
This config will be used by the IOMMU API to track pages mapped in
the IOMMU to catch drivers trying to free kernel memory that they
still map in their domains, causing all types of memory corruption.
This behaviour is disabled by default and can be enabled using
kernel cmdline iommu.debug_pagealloc.
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>