From: Jason Gunthorpe <jgg@ziepe.ca>
To: Zhenhua Huang <quic_zhenhuah@quicinc.com>
Cc: Robin Murphy <robin.murphy@arm.com>,
will@kernel.org, joro@8bytes.org, baolu.lu@linux.intel.com,
iommu@lists.linux.dev, linux-arm-kernel@lists.infradead.org,
quic_tingweiz@quicinc.com,
Pavan Kondeti <quic_pkondeti@quicinc.com>,
"Patrick Daly (QUIC)" <quic_pdaly@quicinc.com>
Subject: Re: [ARM IOMMU] IOMMU framework concurrency issue
Date: Thu, 19 Oct 2023 12:15:09 -0300 [thread overview]
Message-ID: <20231019151509.GD691768@ziepe.ca> (raw)
In-Reply-To: <0d6b490d-83df-76fb-f5ad-e9730fc57660@quicinc.com>
On Thu, Oct 19, 2023 at 04:21:47PM +0800, Zhenhua Huang wrote:
> In above time window (1), dev->iommu allocated but not freed, if it's just
> accessed by client device's probing(Thread 1).. crash happens.
>
> I also want to mention from our side, it's *not only seen for non-iommu*
> device.
I see. So there are only two locks we currently have that could
resolve that - the device_lock or the iommu_probe_device_lock
The device_lock path is what my prior series did, in your case you
already have the device_lock on of_dma_configure_id() so you just need
it on the bus path.
The iommu_probe_device_lock is what I guess Robin was thinking of with
the of_xlate rework.. I looked a little and it seems like quite a
thorny problem.. The ARM SMMU drivers seem to model the correct design
using the iommu_fwspec to pass data from of_xlate to probe, while a
whole bunch of other drivers decided to put the first half of their
probe functions into of_xlate!
To untangle this to use the iommu_probe_device_lock the of_xlate would
have to stop using the struct dev (ie so it cannot touch the
dev->iommu any more) and all the dev->iommu touches in the of/acpi
code reorganized into function arguments to iommu_probe which would
then store them into the dev->iommu under the lock. Ie stop using
dev->iommu as some temporary scratch pad to shuffle data around prior
to probing. Pass iommu_fwspec as an arg to iommu_probe and a new
ops->probe_fwspec. Stop calling dev_iommu_priv_set from of_xlate ops.
> Patch seems good to me and in theory can cover the case I have met. I tested
> below based on 6.6-rc1 for sanity with minor changes(clean up tags etc). If
> you're OK I want to propagate into our tree and to see if it fixes issue?
I don't think this patch can solve the races with of_xlate vs probe,
that is just wrongly locked.
I assume my series you linked to comprehensively fixes this?
FWIW I don't have the energy to try and fix all the wonky drivers
properly so I don't plan to revisit it.
Jason
next prev parent reply other threads:[~2023-10-19 15:15 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-17 11:10 [ARM IOMMU] IOMMU framework concurrency issue Zhenhua Huang
2023-10-17 16:33 ` Jason Gunthorpe
2023-10-18 14:27 ` Zhenhua Huang
2023-10-18 15:34 ` Robin Murphy
2023-10-18 16:19 ` Jason Gunthorpe
2023-10-19 8:21 ` Zhenhua Huang
2023-10-19 15:15 ` Jason Gunthorpe [this message]
2023-10-20 8:39 ` Zhenhua Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231019151509.GD691768@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=baolu.lu@linux.intel.com \
--cc=iommu@lists.linux.dev \
--cc=joro@8bytes.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=quic_pdaly@quicinc.com \
--cc=quic_pkondeti@quicinc.com \
--cc=quic_tingweiz@quicinc.com \
--cc=quic_zhenhuah@quicinc.com \
--cc=robin.murphy@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox