Re: [PATCH v3] PCI: Fix crash during pci_dev hot-unplug on pseries KVM guest

Hi Michael,

On 2024/08/17 08:59 AM, Michael Ellerman wrote:

Amit Machhiwal [off-list ref] writes:

quoted

On 2024/08/15 01:20 PM, Michael Ellerman wrote:

quoted

Bjorn Helgaas [off-list ref] writes:

quoted

On Sat, Aug 03, 2024 at 12:03:25AM +0530, Amit Machhiwal wrote:

quoted

With CONFIG_PCI_DYNAMIC_OF_NODES [1], a hot-plug and hot-unplug sequence
of a PCI device attached to a PCI-bridge causes following kernel Oops on
a pseries KVM guest:

What is unique about pseries here?  There's nothing specific to
pseries in the patch, so I would expect this to be a generic problem
on any arch.

quoted

 RTAS: event: 2, Type: Hotplug Event (229), Severity: 1
 Kernel attempted to read user page (10ec00000048) - exploit attempt? (uid: 0)
 BUG: Unable to handle kernel data access on read at 0x10ec00000048

Weird address.  I would expect NULL or something.  Where did this
non-NULL pointer come from?

It originally comes from np->data, which is supposed to be an
of_changeset.

The powerpc code also uses np->data for the struct pci_dn pointer, see
pci_add_device_node_info().

I wonder if that's why it's non-NULL?

I'm also looking into the code to figure out where's that value coming from. I
will update as soon as I get there.

Thanks.
 

quoted

quoted

Amit, do we have exact steps to reproduce this? I poked around a bit but
couldn't get it to trigger.

Sure, below are the steps:

1. Set CONFIG_PCI_DYNAMIC_OF_NODES=y in the kernel config and compile (Fedora
   has it disabled in it's distro config, Ubuntu has it enabled but will have it
   disabled in the next update)

2. If you are using Fedora cloud images, make sure you've these packages
   installed:
    $ rpm -qa | grep -e 'ppc64-diag\|powerpc-utils'
    powerpc-utils-core-1.3.11-6.fc40.ppc64le
    powerpc-utils-1.3.11-6.fc40.ppc64le
    ppc64-diag-rtas-2.7.9-6.fc40.ppc64le
    ppc64-diag-2.7.9-6.fc40.ppc64le

3. Hotplug a pci device as follows:
    virsh attach-interface <domain_name> bridge --source virbr0

I don't use virsh :)

No worries. Fortunately, we do have a way to do it with qemu monitor.

Any idea how to do it with just qemu monitor commands?

1. Boot the guest with the below included in the qemu cmdline:

    -netdev bridge,id=<net_name>,br=virbr0,helper=/usr/libexec/qemu-bridge-helper

2. Once the guest boots, run the below command on qemu monitor to hot-plug a pci
   device:

    device_add rtl8139,netdev=<net_name>,mac=52:54:00:88:31:28,id=<net_id>

    dmesg
    =====
    [  116.968210] pci 0000:00:01.0: [10ec:8139] type 00 class 0x020000 conventional PCI endpoint
    [  116.969260] pci 0000:00:01.0: BAR 0 [io  0x10000-0x100ff]
    [  116.969904] pci 0000:00:01.0: BAR 1 [mem 0x00000000-0x000000ff]
    [  116.970745] pci 0000:00:01.0: ROM [mem 0x00000000-0x0003ffff pref]
    [  116.971456] pci 0000:00:01.0: No hypervisor support for SR-IOV on this device, IOV BARs disabled.
    [  116.972583] pci 0000:00:01.0: Adding to iommu group 0
    [  116.978466] pci 0000:00:01.0: ROM [mem 0x200080080000-0x2000800bffff pref]: assigned
    [  116.979347] pci 0000:00:01.0: BAR 0 [io  0x10400-0x104ff]: assigned
    [  116.980063] pci 0000:00:01.0: BAR 1 [mem 0x200080001000-0x2000800010ff]: assigned
    [  117.017187] 8139cp: 8139cp: 10/100 PCI Ethernet driver v1.3 (Mar 22, 2004)
    [  117.018577] 8139cp 0000:00:01.0: enabling device (0000 -> 0003)
    [  117.025414] 8139cp 0000:00:01.0 eth1: RTL-8139C+ at 0x00000000fbf09e59, 52:54:00:88:31:28, IRQ 26
    [  117.051028] 8139too: 8139too Fast Ethernet driver 0.9.28
    [  117.076577] 8139cp 0000:00:01.0 eth1: link up, 100Mbps, full-duplex, lpa 0x05E1

3. Try hot-unplug of the device to recreate the kernel Oops.

    device_del <net_id>

Thanks,
Amit

cheers