Received-SPF: pass (google.com: domain of linux-kernel+bounces-211181-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <0192198a-8150-465d-ba74-fd7ab7af1b72@amd.com>
Date: Wed, 12 Jun 2024 13:56:40 +0530
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 1/1] iommu/amd: Fix "execute NX-protected page" when
 running CPU hotplug
To: Adrian Huang <adrianhuang0701@gmail.com>, Joerg Roedel <joro@8bytes.org>,
 Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>,
 Will Deacon <will@kernel.org>
Cc: Dimitri Sivanich <sivanich@hpe.com>, iommu@lists.linux.dev,
 linux-kernel@vger.kernel.org, Adrian Huang <ahuang12@lenovo.com>
References: <20240611155444.860-1-ahuang12@lenovo.com>
Content-Language: en-US
From: Vasant Hegde <vasant.hegde@amd.com>
In-Reply-To: <20240611155444.860-1-ahuang12@lenovo.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?S24zYTBoTGovTTdkUEpEck5zZ25HWEtpUUc4WGdic1dZNU5KVEZwSzVKNW5s?=
 =?utf-8?B?blR4b1hVMDIzaVU1NDRCWm5pU3B0bGFYZmRrR3VqZEJwb2o3aUJpZDUxOFRL?=
 =?utf-8?B?SGlBLzF4b2h3NXpiTWxhWGk4bk9IMkdZZFR6NDhYUGxHa0c4M0RjdFg2SHZE?=
 =?utf-8?B?bHF4MGdYOE5jbm5aclUvaUVGcmFCamZ2NEtvakEwbFk0Um1xT282a1ZtK1pw?=
 =?utf-8?B?Y3BBeUc1NTNac0E5RnJ0SldLR294eVZUY2RlZ0E1QVZ0R2ovYlRvaUdaakY4?=
 =?utf-8?B?QThINGd4OFRKVWdLODBMVitheUtaNjFVYThYaHcrZ01wWUdjRU9UcWxVOFpl?=
 =?utf-8?B?MHNpUjJmS1ZQSisvS2pHRUpBSExpdGprc2dQSXFXYlo4TFhYUGZsUm1QMTBN?=
 =?utf-8?B?RHoyOFMzT0xVb3BCVTdiWFJnQ3ZoOEhCZUM5OEZtVm5RZVdPMXJ0ZDFPcW1N?=
 =?utf-8?B?aGhET0twdis2ZzNuU0k4OXVFdVFta0hseFpNWDhKZ0hsalJDeWJLRHBrVEM4?=
 =?utf-8?B?cFhnY0hjWDRiYVJVeXNnU2h0aC9MalJMckppVzZRUzIzbk5oQ1FJMXFyQys3?=
 =?utf-8?B?RXFlUVEyOXhzbFNTai9WZGlNSk1FVGdOTEo2VGgzL1dOcUlCU0V1dUY4RFVY?=
 =?utf-8?B?NXArbFNPL2lZa3Z0MW5YMkplQWtDY0lxbXVBdWRJNlRYbnNBVE03YnU0dk9r?=
 =?utf-8?B?VTFrU3N5NzJBT01WUy82KzhPZWRiV0FPZnBOaXdqMUlta0ZNV0NacVFLVVZj?=
 =?utf-8?B?TnA5d3FZeXROWWxmUlNZNEVRRHRWWUh5YjE4OTduTDdjbkVneXpVYk9iTnFK?=
 =?utf-8?B?SnhzN21CS0VyaDJiaHRORVBKQ1ZqUFAwOWRBRXo2UkM4bkV3YXJBNUZpa3hw?=
 =?utf-8?B?bGR3NEdscHpobDFtT2dUN2xFckpDUzl4RjhFSVErTXNTNlVoRUZYQ21jOWZ2?=
 =?utf-8?B?cnNjUmV4RWV3R3JTR29YUm5XeU04ZndTcWh5UG9uWTNTWnZNMlBPSldzVU9v?=
 =?utf-8?B?SFFNNnZDeDhrbjNOaFV0T0VuY2JsK2hZNDY3a0E3ZzZPck84UVl1d2g4NHBq?=
 =?utf-8?B?Q3VEbFRzTlh4SXJzWWxrbHB2Y0E1STJjbjdzOUl2L3c0V0RkeFZGZXZqZEQ1?=
 =?utf-8?B?cFFFNitNcVBjbnlIZUoyTkNhQUNJOGZocFU0dnNQdC95a2UrUDM3dHhGSFVr?=
 =?utf-8?B?TlRpSDZTb3EwdzlFMkxuRzZLR0FMVkFWRE4rN2F5UWM3Y1RIRENxQStiZ3hq?=
 =?utf-8?B?SExyYkJJQkFWZ0VxTXk1MDUzQUorNW9vTlluTkVSQ0tDd0tjNUZlbUU3citO?=
 =?utf-8?B?R0pyL0lSREdDQjNpYkZObXhpNTFtVXdqMGVUTVRJVnJRZjRyNW5XRDRYYWNu?=
 =?utf-8?B?WnlNaUM3aUlubzZSZ3lKallZU2dlSkNvQWxqcnpWQTZ5RFpKV3V3WjYxNE15?=
 =?utf-8?B?NHczVjM5K2RUbmVKTXcrUmlGUHdnSEl3RzVnRUxLNUd5c2xIQmdlSEhXSXV3?=
 =?utf-8?B?UE1UeHVlbmZCSmZ1anliRVVtWDJLbjgyRkdZWEc0UWV2TjVRR0VmVmN1cWxS?=
 =?utf-8?B?TkluMTJWOURMRHJDMVptaFE0TlY5SWduT3RVQ0Ridm5mRUpIOHNjam50YkRw?=
 =?utf-8?B?dFdCZ1g5UDI3bDZzR0dDRU1xVUZCbCs2bCtGSm15WHVKNEJkdHZVTzF5bnV2?=
 =?utf-8?B?YmxtaGV5dzlQQnVLUGJNTTNSS1JEOUhnVGxOT1Q2RVJ2TVcwR2VSTkYvTFVK?=
 =?utf-8?B?RkUzZEU0Rk1kVWZ3U2loVHFhRitNZkFJQ0ovU2dodHdiaVU5cWlmaWdMbU5p?=
 =?utf-8?B?bVRLQlJKcjJaT0l3ZE52WUVNeFVXYllhd1VDUmJrb0NHVDdKNUUzK3RRZDJ5?=
 =?utf-8?B?bS9aNy9WN3N1WC9nOUNVUk1BRlVlOXBPWkZLWGcrWjQxV3B6ZmNLTXdoT1BD?=
 =?utf-8?B?RWxKd1d4S3dnT0Z2cG0zTnNCUEhRd29ZSjFGTGUydm5MU21kU0NueDlHM0JW?=
 =?utf-8?B?TDFDMitrNU8wcUdpSWtpekFHTFRoc1JaRU1BNTNvYkkrSk1CVm4rTmZYQnBG?=
 =?utf-8?B?M2RHUmhlY0F4VDBaL3pDWXBTMkcwZlhDQjdNMi9IZSt6WTAyUmFXeCtLZ3JY?=
 =?utf-8?Q?cDY2kcE68bXnIwIxLYAjqJxqr?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6e96c4bd-1528-40a4-a497-08dc8ab966d6
X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB6048.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jun 2024 08:26:48.2129
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3wFuypnCzVNj5S7iZDfiRfLw3wWNQtOg8ObAExSBTHGUM2WhHVIrkSph78iInQc3sKUOlL3v7ILxGgudSm7hYQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB8499

Hi Adrian,

On 6/11/2024 9:24 PM, Adrian Huang wrote:
> From: Adrian Huang <ahuang12@lenovo.com>
> 
> When running the following command (cpu hotplug test case of LTP),
> the "execute NX-protected page" exception is triggered.


Thanks for the detailed report and fix. This issue has been discussed and we
already have similar patch [1] from Dimitri.


[1] https://lore.kernel.org/linux-iommu/ZljHE%2FR4KLzGU6vx@hpe.com/

-Vasant


> 
>   # /opt/ltp/testcases/bin/cpuhotplug02.sh -c 1 -l 1
> 
> Here is the call trace:
> 
>   process 14301 (cpuhotplug_do_s) no longer affine to cpu1
>   smpboot: CPU 1 is now offline
>   smpboot: Booting Node 0 Processor 1 APIC 0x2
>   LVT offset 0 assigned for vector 0x400
>   kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
>   BUG: unable to handle page fault for address: ffffffffbb559170
>   #PF: supervisor instruction fetch in kernel mode
>   #PF: error_code(0x0011) - permissions violation
>   PGD 1ae25067 P4D 1ae25067 PUD 1ae26063 PMD 134abd063 PTE 80000000
>   Oops: Oops: 0011 [#1] PREEMPT SMP NOPTI
>   CPU: 1 PID: 24 Comm: cpuhp/1 Kdump: loaded Not tainted 6.10.0-rc3
>   Hardware name: Lenovo ThinkSystem SR665 MB/7D2WRCZ000, BIOS D8E121K-2.20 08/12/2021
>   RIP: 0010:amd_iommu_enable_faulting+0x0/0x10
>   Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
>    cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <cc> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc
>   RSP: 0018:ffffb4e243fafe48 EFLAGS: 00010202
>   RAX: 00000000000003c0 RBX: ffff90f4baea0820 RCX: 0000000000000000
>   RDX: 00000000000000ec RSI: 00000000000000c0 RDI: 0000000000000001
>   RBP: 0000000000000001 R08: ffff90f4baea0848 R09: ffff90f184a90d00
>   R10: ffff90f184a90ce0 R11: ffff90f1834ebaf8 R12: 00000000000000c0
>   R13: ffffffffbb559170 R14: ffffffffbaa4bd00 R15: ffff90f4baea0848
>   FS:  0000000000000000(0000) GS:ffff90f4bae80000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: ffffffffbb559170 CR3: 000000001ae20000 CR4: 0000000000350ef0
>   Call Trace:
>    <TASK>
>    ? __die+0x20/0x70
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? page_fault_oops+0x75/0x170
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? exc_page_fault+0xaa/0x140
>    ? asm_exc_page_fault+0x22/0x30
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    ? __pfx_amd_iommu_enable_faulting+0x10/0x10
>    cpuhp_invoke_callback+0x2cc/0x470
>    ? __pfx_blk_mq_hctx_notify_online+0x10/0x10
>    ? __pfx_smpboot_thread_fn+0x10/0x10
>    cpuhp_thread_fun+0x8b/0x140
>    smpboot_thread_fn+0xd9/0x1d0
>    kthread+0xcf/0x100
>    ? __pfx_kthread+0x10/0x10
>    ret_from_fork+0x30/0x50
>    ? __pfx_kthread+0x10/0x10
>    ret_from_fork_asm+0x1a/0x30
>    </TASK>
> 
> The address '0xffffffffbb559170' is the function address of
> 'amd_iommu_enable_faulting()'. However, this function is declared with
> '__init' keyword and will be freed in free_initmem().
> 
> Fix the issue by removing '__init' keyword since this function is still
> needed for the up-and-running kernel.
> 
> Fixes: d74169ceb0d2 ("iommu/vt-d: Allocate DMAR fault interrupts locally")
> Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
> ---
>  drivers/iommu/amd/init.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
> index 27e293727095..161248067776 100644
> --- a/drivers/iommu/amd/init.c
> +++ b/drivers/iommu/amd/init.c
> @@ -3362,7 +3362,7 @@ int amd_iommu_reenable(int mode)
>  	return 0;
>  }
>  
> -int __init amd_iommu_enable_faulting(unsigned int cpu)
> +int amd_iommu_enable_faulting(unsigned int cpu)
>  {
>  	/* We enable MSI later when PCI is initialized */
>  	return 0;