From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Gibson Subject: Re: [PATCH] vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null Date: Tue, 31 Jan 2017 14:35:50 +1100 Message-ID: <20170131033550.GM14879@umbus.fritz.box> References: <148527662612.23856.14258969006565989096.stgit@bahia> <20170124110759.51dc07cc@t450s.home> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="EOHJn1TVIJfeVXv2" Cc: Greg Kurz , kvm@vger.kernel.org, Alexey Kardashevskiy , linux-kernel@vger.kernel.org, Vaibhav Jain To: Alex Williamson Return-path: Content-Disposition: inline In-Reply-To: <20170124110759.51dc07cc@t450s.home> Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org --EOHJn1TVIJfeVXv2 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Tue, Jan 24, 2017 at 11:07:59AM -0700, Alex Williamson wrote: > On Tue, 24 Jan 2017 17:50:26 +0100 > Greg Kurz wrote: >=20 > > The recently added mediated VFIO driver doesn't know about powerpc iomm= u. > > It thus doesn't register a struct iommu_table_group in the iommu group > > upon device creation. The iommu_data pointer hence remains null. > >=20 > > This causes a kernel oops when userspace tries to set the iommu type of= a > > container associated with a mediated device to VFIO_SPAPR_TCE_v2_IOMMU. > >=20 > > [ 82.585440] mtty mtty: MDEV: Registered > > [ 87.655522] iommu: Adding device 83b8f4f2-509f-382f-3c1e-e6bfe0fa100= 1 to group 10 > > [ 87.655527] vfio_mdev 83b8f4f2-509f-382f-3c1e-e6bfe0fa1001: MDEV: gr= oup_id =3D 10 > > [ 116.297184] Unable to handle kernel paging request for data at addre= ss 0x00000030 > > [ 116.297389] Faulting instruction address: 0xd000000007870524 > > [ 116.297465] Oops: Kernel access of bad area, sig: 11 [#1] > > [ 116.297611] SMP NR_CPUS=3D2048 > > [ 116.297611] NUMA > > [ 116.297627] PowerNV > > ... > > [ 116.297954] CPU: 33 PID: 7067 Comm: qemu-system-ppc Not tainted 4.10= =2E0-rc5-mdev-test #8 > > [ 116.297993] task: c000000e7718b680 task.stack: c000000e77214000 > > [ 116.298025] NIP: d000000007870524 LR: d000000007870518 CTR: 00000000= 00000000 > > [ 116.298064] REGS: c000000e77217990 TRAP: 0300 Not tainted (4.10.0= -rc5-mdev-test) > > [ 116.298103] MSR: 9000000000009033 > > [ 116.298107] CR: 84004444 XER: 00000000 > > [ 116.298154] CFAR: c00000000000888c DAR: 0000000000000030 DSISR: 4000= 0000 SOFTE: 1 > > GPR00: d000000007870518 c000000e77217c10 d00000000787b0e= d c000000eed2103c0 > > GPR04: 0000000000000000 0000000000000000 c000000eed2103e= 0 0000000f24320000 > > GPR08: 0000000000000104 0000000000000001 000000000000000= 0 d0000000078729b0 > > GPR12: c00000000025b7e0 c00000000fe08400 000000000000000= 1 000001002d31d100 > > GPR16: 000001002c22c850 00003ffff315c750 000000004314568= 0 0000000043141bc0 > > GPR20: ffffffffffffffed fffffffffffff000 0000000020003b6= 5 d000000007706018 > > GPR24: c000000f16cf0d98 d000000007706000 c000000003f4298= 0 c000000003f42980 > > GPR28: c000000f1575ac00 c000000003f429c8 000000000000000= 0 c000000eed2103c0 > > [ 116.298504] NIP [d000000007870524] tce_iommu_attach_group+0x10c/0x36= 0 [vfio_iommu_spapr_tce] > > [ 116.298555] LR [d000000007870518] tce_iommu_attach_group+0x100/0x360= [vfio_iommu_spapr_tce] > > [ 116.298601] Call Trace: > > [ 116.298610] [c000000e77217c10] [d000000007870518] tce_iommu_attach_g= roup+0x100/0x360 [vfio_iommu_spapr_tce] (unreliable) > > [ 116.298671] [c000000e77217cb0] [d0000000077033a0] vfio_fops_unl_ioct= l+0x278/0x3e0 [vfio] > > [ 116.298713] [c000000e77217d40] [c0000000002a3ebc] do_vfs_ioctl+0xcc/= 0x8b0 > > [ 116.298745] [c000000e77217de0] [c0000000002a4700] SyS_ioctl+0x60/0xc0 > > [ 116.298782] [c000000e77217e30] [c00000000000b220] system_call+0x38/0= xfc > > [ 116.298812] Instruction dump: > > [ 116.298828] 7d3f4b78 409effc8 3d220000 e9298020 3c800140 38a00018 60= 8480c0 e8690028 > > [ 116.298869] 4800249d e8410018 7c7f1b79 41820230 2fa90000 = 419e0114 e9090020 > > [ 116.298914] ---[ end trace 1e10b0ced08b9120 ]--- > >=20 > > This patch fixes the oops. > >=20 > > Reported-by: Vaibhav Jain > > Signed-off-by: Greg Kurz > > --- > > drivers/vfio/vfio_iommu_spapr_tce.c | 4 ++++ > > 1 file changed, 4 insertions(+) > >=20 > > diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_io= mmu_spapr_tce.c > > index c8823578a1b2..128d10282d16 100644 > > --- a/drivers/vfio/vfio_iommu_spapr_tce.c > > +++ b/drivers/vfio/vfio_iommu_spapr_tce.c > > @@ -1270,6 +1270,10 @@ static int tce_iommu_attach_group(void *iommu_da= ta, > > /* pr_debug("tce_vfio: Attaching group #%u to iommu %p\n", > > iommu_group_id(iommu_group), iommu_group); */ > > table_group =3D iommu_group_get_iommudata(iommu_group); > > + if (!table_group) { > > + ret =3D -ENODEV; > > + goto unlock_exit; > > + } > > =20 > > if (tce_groups_attached(container) && (!table_group->ops || > > !table_group->ops->take_ownership || > >=20 >=20 > Seems sane to me. >=20 > David/Alexey, please review. Thanks, Seems reasonable. --=20 David Gibson | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_ | _way_ _around_! http://www.ozlabs.org/~dgibson --EOHJn1TVIJfeVXv2 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJYkAYWAAoJEGw4ysog2bOSj+UQAM95qrD/ISIbCZEM+YQVgufY F4QvoSktcYdIxUI0OI8qJVVMnyPN4o18i9tXB+RDNOsUcYMQe+cxjtkR+YXduSok ZUKSoLcxwQQ2tHFRPJ/YTyFkb6u13eLLmKgarblGp0rMfEk0h9q/EvZzpztphrQk jltaR4ISU+fdwr7IhEVEqGUFZ8fa3JW6WZD3wUX6TLwD5KmHCtNMQwpxUB2id3s6 XVgWHfP+BCRjw0lw/NI/b9lJVCNYcfJiUsJQIUQTJfU25qJc5W8COuw9jYPRvk8d xOwm5mgvMfCdcy1zI86mTIzdChZm+u0xl2VgZUuPDnRJS1DNxI6JBzjyJLaMAzjR 1m3sok9hrgH9oqH4PCn0hZXNov1lP2hxUosNNE0agVG9cVwKljBkMIl0CJoSDT6e iv2wF7gHX54rhIxT83CYe5cskMKw2Sojw+/FWungPLXE1kufebj5E03pyPW5avQc +vRIgl2U9wjJWAuQkiagyuCPk4xRvNBYf4pWNyBSHT9oRSAInhPe+1r5FqCxhC4/ Yaw4caDYH+8buUuEppEVbkWwsSQVyg50jBMIoqlP5MzG/YGYu86r9cHTR6J2I7k8 l3oK5kizKNP2LONffGEzoa5msX5I0Vxwx7E3+BY+W9c1uTOcH28T9ORZWuNx2aUO aI5kjgnslvllAixS3fSU =uM9v -----END PGP SIGNATURE----- --EOHJn1TVIJfeVXv2--