Re: [dpdk-dev] [dpdk-stable] [PATCH 2/2] app/testpmd: fix invalid port detaching

[Matan Azrad <matan@mellanox.com>]

Hi

From: Ferruh Yigit
> On 1/25/2020 6:56 PM, Matan Azrad wrote:
> > Hi Ferruh
> >
> > From: Ferruh Yigit
> >> On 1/23/2020 7:25 PM, Matan Azrad wrote:
> >>> Hi
> >>>
> >>> From: Ferruh Yigit
> >>>> On 1/23/2020 3:29 PM, Matan Azrad wrote:
> >>>>>
> >>>>> Hi
> >>>>>
> >>>>> From: Ferruh Yigit
> >>>>>> On 1/23/2020 2:05 PM, Matan Azrad wrote:
> >>>>>>> Hi
> >>>>>>>
> >>>>>>> From: Yigit, Ferruh
> >>>>>>>> On 11/12/2019 8:47 AM, Matan Azrad wrote:
> >>>>>>>>> The port was not validated before detaching.
> >>>>>>>>>
> >>>>>>>>> Ignore port detach operation when the port is not valid.
> >>>>>>>>>
> >>>>>>>>> Fixes: f8e5baa2662d ("app/testpmd: check not detaching device
> >>>>>>>>> twice")
> >>>>>>>>> Cc: thomas@monjalon.net
> >>>>>>>>> Cc: stable@dpdk.org
> >>>>>>>>>
> >>>>>>>>> Signed-off-by: Matan Azrad <matan@mellanox.com>
> >>>>>>>>> ---
> >>>>>>>>>  app/test-pmd/testpmd.c | 3 +++
> >>>>>>>>>  1 file changed, 3 insertions(+)
> >>>>>>>>>
> >>>>>>>>> diff --git a/app/test-pmd/testpmd.c b/app/test-pmd/testpmd.c
> >>>>>>>>> index 4444346..370eefe 100644
> >>>>>>>>> --- a/app/test-pmd/testpmd.c
> >>>>>>>>> +++ b/app/test-pmd/testpmd.c
> >>>>>>>>> @@ -2545,6 +2545,9 @@ struct extmem_param {
> >>>>>>>>>
> >>>>>>>>>  	printf("Removing a device...\n");
> >>>>>>>>>
> >>>>>>>>> +	if (port_id_is_invalid(port_id, ENABLED_WARN))
> >>>>>>>>> +		return;
> >>>>>>>>> +
> >>>>>>>>>  	dev = rte_eth_devices[port_id].device;
> >>>>>>>>>  	if (dev == NULL) {
> >>>>>>>>>  		printf("Device already removed\n");
> >>>>>>>>>
> >>>>>>>>
> >>>>>>>> The patch is already in 19.11 [1] but it is breaking the
> >>>>>>>> testpmd hotplug support.
> >>>>>>>> Before 'detach_port_device()' called, the port has been stopped
> >>>>>>>> and closed [2], which will make port fail from 'port_id_is_invalid()'
> >>>>>>>> check and the device removal path never fully called.
> >>>>>>>> The implication is, since device not detached, vfio request
> >>>>>>>> interrupt keeps triggered continuously and re-starts the detach
> >>>>>>>> path, but because of the half cleaned device it fails and app
> >>>>>>>> gets stuck with a
> >>>>>> continuous log [3].
> >>>>>>>>
> >>>>>>>> I wonder if the actual hotplug has been tested with this patch,
> >>>>>>>> the commit log is not clear about the motivation and
> >>>>>>>> implication of the patch, I am not clear why this check is
> >>>>>>>> added but I am sending a patch soon to remove it back.
> >>>>>>>
> >>>>>>> The motivation of this patch was to prevent double detach on
> >>>>>>> same port,
> >>>>>> so the user cannot call detach of invalid port.
> >>>>>>
> >>>>>> What is the definition of the 'invalid port', if you mean device
> >>>>>> already detached case, in the second call of the function "if
> >>>>>> (dev == NULL)" check should prevent it going forward.
> >>>>>
> >>>>> No, ethdev doesn't zero the device pointer when it release a port.
> >>>>
> >>>> As far as I can see it does, please see below.
> >>>
> >>> The code below is problematic because:
> >>>
> >>> 1. It is very bad that the application changing ethdev structure directly.
> >>
> >> Where the application is changing the ethdev structure?
> >
> > See it in the function we talk on:
> > rte_eth_devices[sibling].device = NULL;
> >
> > The application shouldn't do it - it should be done only by ethdev lib or by
> the PMDs.
> >
> > Are you agree here?
> 
> This is really no fun :(
> 
> It is not done by application, I already provided the call trace. This is done by
> the path of driver .remove().

Yes, probably, but also by testpmd application, I copied it from testpmd application.

Don't you see it?

> >
> >> Application calls the 'rte_dev_remove()' API, which does the job.
> >
> > Agree, This function is freeing(rte_free) the rte_device (actually
> > makes the rte_eth_devices[sibling].device pointer dangled) and releases
> its related resources what makes the device detached.
> 
> No it doesn't, I provided full call stack, and showed where the value set to
> NULL.

See again the testpmd function - it  does it too.

> >
> >>> 2. The below code run over valid port only, not on invalid
> >>> port(UNUSED
> >> state).
> >>>
> >>> So, the device pointer will still be valid if the port is invalid.
> >>>
> >>> All of this shows that this function try to detach only a valid port
> >>> (probably
> >> mainly because it is called by Testpmd detach command).
> >>>
> >>>>> So even if the port is in unused state already - means invalid,
> >>>>> the device
> >>>> pointer still may be valid and point to the last port that used the same
> id.
> >>>>
> >>>> If the port is closed, it is unused state, and ethdev layer
> >>>> resources freed but as you said device related structures are still
> >>>> there, device pointer is still valid and it is still in probed
> >>>> device list etc.. We need to able to detach the device even after it is
> unused state.
> >>>
> >>> Yes, but detach is for device, not for port.
> >>> The device pointer must be taken only when the port is in valid state.
> >>> Why?
> >>> Because if the port is in UNUSED state it is free to be allocated
> >>> again by
> >> ethdev layer for other device, then, the device pointer may point to
> >> other device.
> >>>
> >
> > Do you agree on the above statement I wrote?
> >
> >>>> "stop -> close -> detach" is a normal order, we shouldn't prevent
> >>>> it, but your check does prevent it.
> >>>
> >>> Yes, this is good order, but the pointer of the device should be
> >>> taken
> >> before close.
> >>> My patch prevent accessing invalid structure.
> >>
> >> The ethdev close() dev_ops, frees ethdev related resources, the
> >> rte_device is still valid in that struct.
> >
> > That’s exactly my concern.
> > I think you wrong here, the rte_device may be invalid in that struct,
> especially after close():
> >
> > When the port ID is closed and released, its ethdev structure moves to
> UNUSED state.
> > When an ethdev structure is in UNUSED state it may be attached again to
> another rte_device - see function rte_eth_dev_allocate.
> > Are you agree here?
> >
> > In this case, when a new device is attached after close() and before
> detach_port_device() we may remove wrong rte_device and cause a lot of
> problems.
> 
> The problem here is re-using the ethdev structure when it is closed but not
> freed completely, resulting overwriting some fields of it. This is another issue
> and can be fixed in the alloc path.

Sorry, don't agree with you here.
Port which is closed can be allocated again for other device - this is the basic for hot-plug mechanism in dpdk.
Reading the rte_device from port which was closed may remove other rte_device which is not related.

Agree that the PMD should clear the ethdev structure in remove, mlx5 doesn't do it and should be fixed, I don't know about other PMDS.
But this is not the issue I talk about.

Testpmd shouldn't read device pointer from port which was closed - this is race.
  
> >
> > Do you understand that?
> >
> > One more problematic case is a user mistake by the Testpmd command
> which may cause segfault in the good case and memory overriding in the
> worst case (my patch case):
> >
> > port stop all
> > port detach 0
> > port detach 0
> >
> > detach the same port twice will cause referencing of freed pointer of
> rte_device.
> >
> >
> > All of that is because Testpmd takes ethdev structure information from
> invalid ethdev structure.
> >
> > My patch prevents it.
> 
> For this case I am already getting "Device already removed" message from
> 'detach_port_device()' function.
> 
> Your patch is doing two things:
> - Hiding the fact that PMD .remove() is not setting the device pointer to null

The device pointer is zero also by testpmd - the hiding is here.

> - Breaking the hotplug functionality

To be precise - stay it broken.

> 
> >
> >
> >
> >> And yes your patch prevents accessing them and prevents hotplug
> >> remove the device.
> >>
> >
> > Yes, my patch is not good, solved issues and caused a new one.
> >
> > Agree that we need a new fix, my suggestion here is:
> >
> > 1. In the Testpmd internal management for hutplug (rmv_port_callback):
> > 	Call stop()
> > 	Take rte_device pointer( before port close).
> > 	Call close().
> > 	If no other valid port for the rte_device:
> > 		call detach() by the saved rte_device pointer.
> 
> Not sure about pushing more to the application, like checking if any other
> port using a device etc..

And for device pointer before close(), do you agree?

> As far as I understand your concern is when multiple ethdev are using same
> device, why not handle this in driver .remove() path, like detect if device still
> needs to be used and if so free only ethdev resources and return error, this
> error will prevent device resources to be freed:
> 
> pci_unplug()
>   ret = rte_pci_detach_dev(pdev);
>   if (ret == 0)
>     rte_pci_remove_device(pdev);
>     rte_devargs_remove(dev->devargs);
>     ...
> 
> This will cause the application receive an error but this is kind of true because
> all resources are not freed because they are shared.
> 
> When last ethdev detached, driver can send success causing all device
> resources to be freed.

Can be good for multi-port handling, but testpmd should handle this error and report it correctly.

> > 2. Replace the Testpmd command line for "port detach" with "detach [rte
> device name]":
> > 	Why?
> > 	Detach by port is problematic:
> > 	1. If the port is closed - Testpmd cannot get its rte_device from the
> related ethdev port structure.
> > 	2. If the port is not closed - It is not safe to detach it.
> > 	3. Attach is done by rte_device name, detach should be in same way.
> 
> Testpmd can first close() later detach().

Yes, close by port, detach by rte_device name (for example pci name).
That’s what I said.


> If it is closed already, agreed that new attached devices shouldn't be able to
> this struct until it is freed completely. But this is kind of edge case, because it
> required new device to be attached after old one closed but before it is
> detached.
> 
> >  Are you agree?

This is race, no edge.
What is "freed completely"?
IMO it is when the port is in UNUSED state (after close\release).

Hotplug can be triggered internally in parallel.

> >
> > I hope you understand now.
> >
> >>> And yes, Testpmd detach stays broken after my patch and after this
> >>> patch
> >> too.
> >>>
> >>>
> >>>>
<snip>
> >> To simplify things, can you please clarify what error are you getting
> >> with this patch, and can you please give some details how to
> >> reproduce it? So I can debug the issue you are having.
> >
> > Added details above, hope everything is clear when you read this line
> > 😊
> 
> Overall I believe this all fuss is about the PMD you are testing not cleaning the
> 'rte_eth_devices[port_id].device' pointer which should be handled in driver
> level but you are trying to fix this in testpmd causing it fail.

Sorry, but no, It is all about hotplug race.

Even if the PMD clear the device pointer, the testpmd still may release wrong rte_device.
<snip>