From: Zhenhua Huang <quic_zhenhuah@quicinc.com>
To: <will@kernel.org>, <robin.murphy@arm.com>, <joro@8bytes.org>,
<jgg@ziepe.ca>, <baolu.lu@linux.intel.com>
Cc: <iommu@lists.linux.dev>, <linux-arm-kernel@lists.infradead.org>,
<quic_tingweiz@quicinc.com>
Subject: [ARM IOMMU] IOMMU framework concurrency issue
Date: Tue, 17 Oct 2023 19:10:23 +0800 [thread overview]
Message-ID: <e2e20e1c-6450-4ac5-9804-b0000acdf7de@quicinc.com> (raw)
Dear experts,
Saw a few crashes in our projects because of concurrency between (1) and
(2).
bus notifier or bus_iommu_probe:
__iommu_probe_device
acquire iommu_probe_device_lock only
iommu_init_device()
//touch dev->iommu (1)
dev_iommu_get()
->probe_device()
Client device probing path:
of_dma_configure
of_iommu_configure
//touch dev->iommu (2)
...
We already have 01657bc14a39 ("iommu: Avoid races around device probe")
and the big comment in __iommu_probe_device() refers to adopt
device_lock() further. Notice your big effort to utilize it, and IMO it
can address above issue(which protects dev->iommu):
https://lore.kernel.org/all/0-v2-d2762acaf50a+16d-iommu_group_locking2_jgg@nvidia.com/T/#md11b80c9e5c90ab97904f1bddecc21d97c296c0d
But from your discussion it was pointed out "which already violates
*other* IOMMU API assumptions", because of some drivers directly called
of_dma_configure() w/o acquiring device_lock().
Could you please provide your points of view how to address this further?
One example of crash logs, checking dump found dev->iommu already freed:
[ 0.898000][ T77] Unable to handle kernel paging request at virtual
address 70c7e81d817765bc
…
[ 0.898219][ T77] pc : iommu_fwspec_init+0x30/0xc4
[ 0.898223][ T77] lr : of_iommu_xlate+0x58/0xe0
…
[ 0.898252][ T77] Call trace:
[ 0.898253][ T77] iommu_fwspec_init+0x30/0xc4
[ 0.898255][ T77] of_iommu_xlate+0x58/0xe0
[ 0.898257][ T77] of_iommu_configure+0x16c/0x224
[ 0.898260][ T77] of_dma_configure_id+0x1cc/0x244
[ 0.898265][ T77] platform_dma_configure+0x34/0x80
[ 0.898267][ T77] really_probe+0x110/0x384
[ 0.898271][ T77] __driver_probe_device+0xb4/0xe4
[ 0.898274][ T77] driver_probe_device+0x44/0x210
[ 0.898277][ T77] __device_attach_driver+0x144/0x170
[ 0.898280][ T77] bus_for_each_drv+0x9c/0xec
[ 0.898282][ T77] __device_attach_async_helper+0x78/0xd0
[ 0.898285][ T77] async_run_entry_fn+0x44/0x118
[ 0.898287][ T77] process_one_work+0x1e4/0x43c
[ 0.898290][ T77] worker_thread+0x25c/0x430
[ 0.898293][ T77] kthread+0x104/0x1d4
[ 0.898295][ T77] ret_from_fork+0x10/0x20
Thanks,
Zhenhua
next reply other threads:[~2023-10-17 11:10 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-17 11:10 Zhenhua Huang [this message]
2023-10-17 16:33 ` [ARM IOMMU] IOMMU framework concurrency issue Jason Gunthorpe
2023-10-18 14:27 ` Zhenhua Huang
2023-10-18 15:34 ` Robin Murphy
2023-10-18 16:19 ` Jason Gunthorpe
2023-10-19 8:21 ` Zhenhua Huang
2023-10-19 15:15 ` Jason Gunthorpe
2023-10-20 8:39 ` Zhenhua Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e2e20e1c-6450-4ac5-9804-b0000acdf7de@quicinc.com \
--to=quic_zhenhuah@quicinc.com \
--cc=baolu.lu@linux.intel.com \
--cc=iommu@lists.linux.dev \
--cc=jgg@ziepe.ca \
--cc=joro@8bytes.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=quic_tingweiz@quicinc.com \
--cc=robin.murphy@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox