* [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-05-30 12:07 ` yf.wang--- via iommu
0 siblings, 0 replies; 17+ messages in thread
From: yf.wang @ 2022-05-30 12:07 UTC (permalink / raw)
To: Joerg Roedel, Will Deacon, Matthias Brugger,
open list:IOMMU DRIVERS, open list,
moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support
Cc: wsd_upstream, Libo Kang, Miles Chen, Yong Wu, Yunfei Wang, Ning Li
From: Yunfei Wang <yf.wang@mediatek.com>
When many devices share the same iova domain, iommu_dma_init_domain()
may be called at the same time. The checking of iovad->start_pfn will
all get false in iommu_dma_init_domain() and both enter init_iova_domain()
to do iovad initialization.
Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Exception backtrace:
rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
init_iova_domain() + 180
iommu_setup_dma_ops() + 260
arch_setup_dma_ops() + 132
of_dma_configure_id() + 468
platform_dma_configure() + 32
really_probe() + 1168
driver_probe_device() + 268
__device_attach_driver() + 524
__device_attach() + 524
bus_probe_device() + 64
deferred_probe_work_func() + 260
process_one_work() + 580
worker_thread() + 1076
kthread() + 332
ret_from_fork() + 16
Signed-off-by: Ning Li <ning.li@mediatek.com>
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
---
drivers/iommu/dma-iommu.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 09f6e1c0f9c0..b38c5041eeab 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
/* Domain for flush queue callback; NULL if flush queue not in use */
struct iommu_domain *fq_domain;
+ struct mutex mutex;
};
static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
if (!domain->iova_cookie)
return -ENOMEM;
+ mutex_init(&domain->iova_cookie->mutex);
return 0;
}
@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
}
/* start_pfn is always nonzero for an already-initialised domain */
+ mutex_lock(&cookie->mutex);
if (iovad->start_pfn) {
if (1UL << order != iovad->granule ||
base_pfn != iovad->start_pfn) {
pr_warn("Incompatible range for DMA domain\n");
- return -EFAULT;
+ ret = -EFAULT;
+ goto done_unlock;
}
- return 0;
+ ret = 0;
+ goto done_unlock;
}
init_iova_domain(iovad, 1UL << order, base_pfn);
ret = iova_domain_init_rcaches(iovad);
if (ret)
- return ret;
+ goto done_unlock;
/* If the FQ fails we can simply fall back to strict mode */
if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
domain->type = IOMMU_DOMAIN_DMA;
- return iova_reserve_iommu_regions(dev, domain);
+ ret = iova_reserve_iommu_regions(dev, domain);
+
+done_unlock:
+ mutex_unlock(&cookie->mutex);
+ return ret;
}
/**
--
2.18.0
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-05-30 12:07 ` yf.wang--- via iommu
0 siblings, 0 replies; 17+ messages in thread
From: yf.wang--- via iommu @ 2022-05-30 12:07 UTC (permalink / raw)
To: Joerg Roedel, Will Deacon, Matthias Brugger,
open list:IOMMU DRIVERS, open list,
moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support
Cc: wsd_upstream, Yunfei Wang, Libo Kang, Miles Chen, Ning Li
From: Yunfei Wang <yf.wang@mediatek.com>
When many devices share the same iova domain, iommu_dma_init_domain()
may be called at the same time. The checking of iovad->start_pfn will
all get false in iommu_dma_init_domain() and both enter init_iova_domain()
to do iovad initialization.
Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Exception backtrace:
rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
init_iova_domain() + 180
iommu_setup_dma_ops() + 260
arch_setup_dma_ops() + 132
of_dma_configure_id() + 468
platform_dma_configure() + 32
really_probe() + 1168
driver_probe_device() + 268
__device_attach_driver() + 524
__device_attach() + 524
bus_probe_device() + 64
deferred_probe_work_func() + 260
process_one_work() + 580
worker_thread() + 1076
kthread() + 332
ret_from_fork() + 16
Signed-off-by: Ning Li <ning.li@mediatek.com>
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
---
drivers/iommu/dma-iommu.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 09f6e1c0f9c0..b38c5041eeab 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
/* Domain for flush queue callback; NULL if flush queue not in use */
struct iommu_domain *fq_domain;
+ struct mutex mutex;
};
static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
if (!domain->iova_cookie)
return -ENOMEM;
+ mutex_init(&domain->iova_cookie->mutex);
return 0;
}
@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
}
/* start_pfn is always nonzero for an already-initialised domain */
+ mutex_lock(&cookie->mutex);
if (iovad->start_pfn) {
if (1UL << order != iovad->granule ||
base_pfn != iovad->start_pfn) {
pr_warn("Incompatible range for DMA domain\n");
- return -EFAULT;
+ ret = -EFAULT;
+ goto done_unlock;
}
- return 0;
+ ret = 0;
+ goto done_unlock;
}
init_iova_domain(iovad, 1UL << order, base_pfn);
ret = iova_domain_init_rcaches(iovad);
if (ret)
- return ret;
+ goto done_unlock;
/* If the FQ fails we can simply fall back to strict mode */
if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
domain->type = IOMMU_DOMAIN_DMA;
- return iova_reserve_iommu_regions(dev, domain);
+ ret = iova_reserve_iommu_regions(dev, domain);
+
+done_unlock:
+ mutex_unlock(&cookie->mutex);
+ return ret;
}
/**
--
2.18.0
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-05-30 12:07 ` yf.wang--- via iommu
0 siblings, 0 replies; 17+ messages in thread
From: yf.wang @ 2022-05-30 12:07 UTC (permalink / raw)
To: Joerg Roedel, Will Deacon, Matthias Brugger,
open list:IOMMU DRIVERS, open list,
moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support
Cc: wsd_upstream, Libo Kang, Miles Chen, Yong Wu, Yunfei Wang, Ning Li
From: Yunfei Wang <yf.wang@mediatek.com>
When many devices share the same iova domain, iommu_dma_init_domain()
may be called at the same time. The checking of iovad->start_pfn will
all get false in iommu_dma_init_domain() and both enter init_iova_domain()
to do iovad initialization.
Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Exception backtrace:
rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
init_iova_domain() + 180
iommu_setup_dma_ops() + 260
arch_setup_dma_ops() + 132
of_dma_configure_id() + 468
platform_dma_configure() + 32
really_probe() + 1168
driver_probe_device() + 268
__device_attach_driver() + 524
__device_attach() + 524
bus_probe_device() + 64
deferred_probe_work_func() + 260
process_one_work() + 580
worker_thread() + 1076
kthread() + 332
ret_from_fork() + 16
Signed-off-by: Ning Li <ning.li@mediatek.com>
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
---
drivers/iommu/dma-iommu.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 09f6e1c0f9c0..b38c5041eeab 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
/* Domain for flush queue callback; NULL if flush queue not in use */
struct iommu_domain *fq_domain;
+ struct mutex mutex;
};
static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
if (!domain->iova_cookie)
return -ENOMEM;
+ mutex_init(&domain->iova_cookie->mutex);
return 0;
}
@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
}
/* start_pfn is always nonzero for an already-initialised domain */
+ mutex_lock(&cookie->mutex);
if (iovad->start_pfn) {
if (1UL << order != iovad->granule ||
base_pfn != iovad->start_pfn) {
pr_warn("Incompatible range for DMA domain\n");
- return -EFAULT;
+ ret = -EFAULT;
+ goto done_unlock;
}
- return 0;
+ ret = 0;
+ goto done_unlock;
}
init_iova_domain(iovad, 1UL << order, base_pfn);
ret = iova_domain_init_rcaches(iovad);
if (ret)
- return ret;
+ goto done_unlock;
/* If the FQ fails we can simply fall back to strict mode */
if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
domain->type = IOMMU_DOMAIN_DMA;
- return iova_reserve_iommu_regions(dev, domain);
+ ret = iova_reserve_iommu_regions(dev, domain);
+
+done_unlock:
+ mutex_unlock(&cookie->mutex);
+ return ret;
}
/**
--
2.18.0
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-05-30 12:07 ` yf.wang--- via iommu
0 siblings, 0 replies; 17+ messages in thread
From: yf.wang @ 2022-05-30 12:07 UTC (permalink / raw)
To: Joerg Roedel, Will Deacon, Matthias Brugger,
open list:IOMMU DRIVERS, open list,
moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support
Cc: wsd_upstream, Libo Kang, Miles Chen, Yong Wu, Yunfei Wang, Ning Li
From: Yunfei Wang <yf.wang@mediatek.com>
When many devices share the same iova domain, iommu_dma_init_domain()
may be called at the same time. The checking of iovad->start_pfn will
all get false in iommu_dma_init_domain() and both enter init_iova_domain()
to do iovad initialization.
Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Exception backtrace:
rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
init_iova_domain() + 180
iommu_setup_dma_ops() + 260
arch_setup_dma_ops() + 132
of_dma_configure_id() + 468
platform_dma_configure() + 32
really_probe() + 1168
driver_probe_device() + 268
__device_attach_driver() + 524
__device_attach() + 524
bus_probe_device() + 64
deferred_probe_work_func() + 260
process_one_work() + 580
worker_thread() + 1076
kthread() + 332
ret_from_fork() + 16
Signed-off-by: Ning Li <ning.li@mediatek.com>
Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
---
drivers/iommu/dma-iommu.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 09f6e1c0f9c0..b38c5041eeab 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
/* Domain for flush queue callback; NULL if flush queue not in use */
struct iommu_domain *fq_domain;
+ struct mutex mutex;
};
static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
if (!domain->iova_cookie)
return -ENOMEM;
+ mutex_init(&domain->iova_cookie->mutex);
return 0;
}
@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
}
/* start_pfn is always nonzero for an already-initialised domain */
+ mutex_lock(&cookie->mutex);
if (iovad->start_pfn) {
if (1UL << order != iovad->granule ||
base_pfn != iovad->start_pfn) {
pr_warn("Incompatible range for DMA domain\n");
- return -EFAULT;
+ ret = -EFAULT;
+ goto done_unlock;
}
- return 0;
+ ret = 0;
+ goto done_unlock;
}
init_iova_domain(iovad, 1UL << order, base_pfn);
ret = iova_domain_init_rcaches(iovad);
if (ret)
- return ret;
+ goto done_unlock;
/* If the FQ fails we can simply fall back to strict mode */
if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
domain->type = IOMMU_DOMAIN_DMA;
- return iova_reserve_iommu_regions(dev, domain);
+ ret = iova_reserve_iommu_regions(dev, domain);
+
+done_unlock:
+ mutex_unlock(&cookie->mutex);
+ return ret;
}
/**
--
2.18.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
2022-05-30 12:07 ` yf.wang--- via iommu
(?)
(?)
@ 2022-06-09 17:04 ` Miles Chen via iommu
-1 siblings, 0 replies; 17+ messages in thread
From: Miles Chen @ 2022-06-09 17:04 UTC (permalink / raw)
To: yf.wang
Cc: Libo.Kang, Yong.Wu, iommu, joro, linux-arm-kernel, linux-kernel,
linux-mediatek, matthias.bgg, miles.chen, ning.li, will,
wsd_upstream
Hi YF,
>When many devices share the same iova domain, iommu_dma_init_domain()
>may be called at the same time. The checking of iovad->start_pfn will
>all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>to do iovad initialization.
After reading this patch.
It means that we use iovad->start_pfn as a key to tell if an iovad is already initialized,
but we do not protect iovad->start_pfn from concurrent access.
So what's happening is like:
cpu0 cpu1
of_dma_configure_id() of_dma_configure_id()
arch_setup_dma_ops() arch_setup_dma_ops()
iommu_setup_dma_ops() iommu_setup_dma_ops()
init_iova_domain() init_iova_domain()
if (iovad->start_pfn) { if (iovad->start_pfn) {
} }
init_iova_domain() init_iova_domain()
init_iova_domain() is called at the same time.
>Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Reviewed-by: Miles Chen <miles.chen@mediatek.com>
>Exception backtrace:
>rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>init_iova_domain() + 180
>iommu_setup_dma_ops() + 260
>arch_setup_dma_ops() + 132
>of_dma_configure_id() + 468
>platform_dma_configure() + 32
>really_probe() + 1168
>driver_probe_device() + 268
>__device_attach_driver() + 524
>__device_attach() + 524
>bus_probe_device() + 64
>deferred_probe_work_func() + 260
>process_one_work() + 580
>worker_thread() + 1076
>kthread() + 332
>ret_from_fork() + 16
>
>Signed-off-by: Ning Li <ning.li@mediatek.com>
>Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
>diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>index 09f6e1c0f9c0..b38c5041eeab 100644
>--- a/drivers/iommu/dma-iommu.c
>+++ b/drivers/iommu/dma-iommu.c
>@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
>+ struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
>+ mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
>@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
>+ mutex_lock(&cookie->mutex);
>
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
>- return -EFAULT;
>+ ret = -EFAULT;
>+ goto done_unlock;
> }
>
>- return 0;
>+ ret = 0;
>+ goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
>- return ret;
>+ goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
>- return iova_reserve_iommu_regions(dev, domain);
>+ ret = iova_reserve_iommu_regions(dev, domain);
>+
>+done_unlock:
>+ mutex_unlock(&cookie->mutex);
>+ return ret;
> }
>
> /**
>--
>2.18.0
>
>
>_______________________________________________
>Linux-mediatek mailing list
>Linux-mediatek@lists.infradead.org
>http://lists.infradead.org/mailman/listinfo/linux-mediatek
>
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-09 17:04 ` Miles Chen via iommu
0 siblings, 0 replies; 17+ messages in thread
From: Miles Chen via iommu @ 2022-06-09 17:04 UTC (permalink / raw)
To: yf.wang
Cc: miles.chen, wsd_upstream, linux-kernel, Libo.Kang, iommu,
linux-mediatek, ning.li, matthias.bgg, will, linux-arm-kernel
Hi YF,
>When many devices share the same iova domain, iommu_dma_init_domain()
>may be called at the same time. The checking of iovad->start_pfn will
>all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>to do iovad initialization.
After reading this patch.
It means that we use iovad->start_pfn as a key to tell if an iovad is already initialized,
but we do not protect iovad->start_pfn from concurrent access.
So what's happening is like:
cpu0 cpu1
of_dma_configure_id() of_dma_configure_id()
arch_setup_dma_ops() arch_setup_dma_ops()
iommu_setup_dma_ops() iommu_setup_dma_ops()
init_iova_domain() init_iova_domain()
if (iovad->start_pfn) { if (iovad->start_pfn) {
} }
init_iova_domain() init_iova_domain()
init_iova_domain() is called at the same time.
>Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Reviewed-by: Miles Chen <miles.chen@mediatek.com>
>Exception backtrace:
>rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>init_iova_domain() + 180
>iommu_setup_dma_ops() + 260
>arch_setup_dma_ops() + 132
>of_dma_configure_id() + 468
>platform_dma_configure() + 32
>really_probe() + 1168
>driver_probe_device() + 268
>__device_attach_driver() + 524
>__device_attach() + 524
>bus_probe_device() + 64
>deferred_probe_work_func() + 260
>process_one_work() + 580
>worker_thread() + 1076
>kthread() + 332
>ret_from_fork() + 16
>
>Signed-off-by: Ning Li <ning.li@mediatek.com>
>Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
>diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>index 09f6e1c0f9c0..b38c5041eeab 100644
>--- a/drivers/iommu/dma-iommu.c
>+++ b/drivers/iommu/dma-iommu.c
>@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
>+ struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
>+ mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
>@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
>+ mutex_lock(&cookie->mutex);
>
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
>- return -EFAULT;
>+ ret = -EFAULT;
>+ goto done_unlock;
> }
>
>- return 0;
>+ ret = 0;
>+ goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
>- return ret;
>+ goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
>- return iova_reserve_iommu_regions(dev, domain);
>+ ret = iova_reserve_iommu_regions(dev, domain);
>+
>+done_unlock:
>+ mutex_unlock(&cookie->mutex);
>+ return ret;
> }
>
> /**
>--
>2.18.0
>
>
>_______________________________________________
>Linux-mediatek mailing list
>Linux-mediatek@lists.infradead.org
>http://lists.infradead.org/mailman/listinfo/linux-mediatek
>
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-09 17:04 ` Miles Chen via iommu
0 siblings, 0 replies; 17+ messages in thread
From: Miles Chen @ 2022-06-09 17:04 UTC (permalink / raw)
To: yf.wang
Cc: Libo.Kang, Yong.Wu, iommu, joro, linux-arm-kernel, linux-kernel,
linux-mediatek, matthias.bgg, miles.chen, ning.li, will,
wsd_upstream
Hi YF,
>When many devices share the same iova domain, iommu_dma_init_domain()
>may be called at the same time. The checking of iovad->start_pfn will
>all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>to do iovad initialization.
After reading this patch.
It means that we use iovad->start_pfn as a key to tell if an iovad is already initialized,
but we do not protect iovad->start_pfn from concurrent access.
So what's happening is like:
cpu0 cpu1
of_dma_configure_id() of_dma_configure_id()
arch_setup_dma_ops() arch_setup_dma_ops()
iommu_setup_dma_ops() iommu_setup_dma_ops()
init_iova_domain() init_iova_domain()
if (iovad->start_pfn) { if (iovad->start_pfn) {
} }
init_iova_domain() init_iova_domain()
init_iova_domain() is called at the same time.
>Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Reviewed-by: Miles Chen <miles.chen@mediatek.com>
>Exception backtrace:
>rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>init_iova_domain() + 180
>iommu_setup_dma_ops() + 260
>arch_setup_dma_ops() + 132
>of_dma_configure_id() + 468
>platform_dma_configure() + 32
>really_probe() + 1168
>driver_probe_device() + 268
>__device_attach_driver() + 524
>__device_attach() + 524
>bus_probe_device() + 64
>deferred_probe_work_func() + 260
>process_one_work() + 580
>worker_thread() + 1076
>kthread() + 332
>ret_from_fork() + 16
>
>Signed-off-by: Ning Li <ning.li@mediatek.com>
>Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
>diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>index 09f6e1c0f9c0..b38c5041eeab 100644
>--- a/drivers/iommu/dma-iommu.c
>+++ b/drivers/iommu/dma-iommu.c
>@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
>+ struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
>+ mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
>@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
>+ mutex_lock(&cookie->mutex);
>
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
>- return -EFAULT;
>+ ret = -EFAULT;
>+ goto done_unlock;
> }
>
>- return 0;
>+ ret = 0;
>+ goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
>- return ret;
>+ goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
>- return iova_reserve_iommu_regions(dev, domain);
>+ ret = iova_reserve_iommu_regions(dev, domain);
>+
>+done_unlock:
>+ mutex_unlock(&cookie->mutex);
>+ return ret;
> }
>
> /**
>--
>2.18.0
>
>
>_______________________________________________
>Linux-mediatek mailing list
>Linux-mediatek@lists.infradead.org
>http://lists.infradead.org/mailman/listinfo/linux-mediatek
>
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-09 17:04 ` Miles Chen via iommu
0 siblings, 0 replies; 17+ messages in thread
From: Miles Chen @ 2022-06-09 17:04 UTC (permalink / raw)
To: yf.wang
Cc: Libo.Kang, Yong.Wu, iommu, joro, linux-arm-kernel, linux-kernel,
linux-mediatek, matthias.bgg, miles.chen, ning.li, will,
wsd_upstream
Hi YF,
>When many devices share the same iova domain, iommu_dma_init_domain()
>may be called at the same time. The checking of iovad->start_pfn will
>all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>to do iovad initialization.
After reading this patch.
It means that we use iovad->start_pfn as a key to tell if an iovad is already initialized,
but we do not protect iovad->start_pfn from concurrent access.
So what's happening is like:
cpu0 cpu1
of_dma_configure_id() of_dma_configure_id()
arch_setup_dma_ops() arch_setup_dma_ops()
iommu_setup_dma_ops() iommu_setup_dma_ops()
init_iova_domain() init_iova_domain()
if (iovad->start_pfn) { if (iovad->start_pfn) {
} }
init_iova_domain() init_iova_domain()
init_iova_domain() is called at the same time.
>Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
Reviewed-by: Miles Chen <miles.chen@mediatek.com>
>Exception backtrace:
>rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>init_iova_domain() + 180
>iommu_setup_dma_ops() + 260
>arch_setup_dma_ops() + 132
>of_dma_configure_id() + 468
>platform_dma_configure() + 32
>really_probe() + 1168
>driver_probe_device() + 268
>__device_attach_driver() + 524
>__device_attach() + 524
>bus_probe_device() + 64
>deferred_probe_work_func() + 260
>process_one_work() + 580
>worker_thread() + 1076
>kthread() + 332
>ret_from_fork() + 16
>
>Signed-off-by: Ning Li <ning.li@mediatek.com>
>Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
>diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>index 09f6e1c0f9c0..b38c5041eeab 100644
>--- a/drivers/iommu/dma-iommu.c
>+++ b/drivers/iommu/dma-iommu.c
>@@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
>+ struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>@@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
>+ mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
>@@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
>+ mutex_lock(&cookie->mutex);
>
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
>- return -EFAULT;
>+ ret = -EFAULT;
>+ goto done_unlock;
> }
>
>- return 0;
>+ ret = 0;
>+ goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
>- return ret;
>+ goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
>- return iova_reserve_iommu_regions(dev, domain);
>+ ret = iova_reserve_iommu_regions(dev, domain);
>+
>+done_unlock:
>+ mutex_unlock(&cookie->mutex);
>+ return ret;
> }
>
> /**
>--
>2.18.0
>
>
>_______________________________________________
>Linux-mediatek mailing list
>Linux-mediatek@lists.infradead.org
>http://lists.infradead.org/mailman/listinfo/linux-mediatek
>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
2022-05-30 12:07 ` yf.wang--- via iommu
(?)
@ 2022-06-22 12:46 ` Joerg Roedel
-1 siblings, 0 replies; 17+ messages in thread
From: Joerg Roedel @ 2022-06-22 12:46 UTC (permalink / raw)
To: yf.wang
Cc: Will Deacon, Matthias Brugger, open list:IOMMU DRIVERS,
open list, moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support, wsd_upstream, Libo Kang,
Miles Chen, Yong Wu, Ning Li
Please re-send with
Robin Murphy <robin.murphy@arm.com>
in Cc.
On Mon, May 30, 2022 at 08:07:45PM +0800, yf.wang@mediatek.com wrote:
> From: Yunfei Wang <yf.wang@mediatek.com>
>
> When many devices share the same iova domain, iommu_dma_init_domain()
> may be called at the same time. The checking of iovad->start_pfn will
> all get false in iommu_dma_init_domain() and both enter init_iova_domain()
> to do iovad initialization.
>
> Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
>
> Exception backtrace:
> rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
> init_iova_domain() + 180
> iommu_setup_dma_ops() + 260
> arch_setup_dma_ops() + 132
> of_dma_configure_id() + 468
> platform_dma_configure() + 32
> really_probe() + 1168
> driver_probe_device() + 268
> __device_attach_driver() + 524
> __device_attach() + 524
> bus_probe_device() + 64
> deferred_probe_work_func() + 260
> process_one_work() + 580
> worker_thread() + 1076
> kthread() + 332
> ret_from_fork() + 16
>
> Signed-off-by: Ning Li <ning.li@mediatek.com>
> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
> ---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 09f6e1c0f9c0..b38c5041eeab 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
> + struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
> @@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
> + mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
> @@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
> + mutex_lock(&cookie->mutex);
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
> - return -EFAULT;
> + ret = -EFAULT;
> + goto done_unlock;
> }
>
> - return 0;
> + ret = 0;
> + goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
> - return ret;
> + goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
> - return iova_reserve_iommu_regions(dev, domain);
> + ret = iova_reserve_iommu_regions(dev, domain);
> +
> +done_unlock:
> + mutex_unlock(&cookie->mutex);
> + return ret;
> }
>
> /**
> --
> 2.18.0
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-22 12:46 ` Joerg Roedel
0 siblings, 0 replies; 17+ messages in thread
From: Joerg Roedel @ 2022-06-22 12:46 UTC (permalink / raw)
To: yf.wang
Cc: Miles Chen, wsd_upstream, open list, Libo Kang,
open list:IOMMU DRIVERS, moderated list:ARM/Mediatek SoC support,
Ning Li, Matthias Brugger, Will Deacon,
moderated list:ARM/Mediatek SoC support
Please re-send with
Robin Murphy <robin.murphy@arm.com>
in Cc.
On Mon, May 30, 2022 at 08:07:45PM +0800, yf.wang@mediatek.com wrote:
> From: Yunfei Wang <yf.wang@mediatek.com>
>
> When many devices share the same iova domain, iommu_dma_init_domain()
> may be called at the same time. The checking of iovad->start_pfn will
> all get false in iommu_dma_init_domain() and both enter init_iova_domain()
> to do iovad initialization.
>
> Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
>
> Exception backtrace:
> rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
> init_iova_domain() + 180
> iommu_setup_dma_ops() + 260
> arch_setup_dma_ops() + 132
> of_dma_configure_id() + 468
> platform_dma_configure() + 32
> really_probe() + 1168
> driver_probe_device() + 268
> __device_attach_driver() + 524
> __device_attach() + 524
> bus_probe_device() + 64
> deferred_probe_work_func() + 260
> process_one_work() + 580
> worker_thread() + 1076
> kthread() + 332
> ret_from_fork() + 16
>
> Signed-off-by: Ning Li <ning.li@mediatek.com>
> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
> ---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 09f6e1c0f9c0..b38c5041eeab 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
> + struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
> @@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
> + mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
> @@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
> + mutex_lock(&cookie->mutex);
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
> - return -EFAULT;
> + ret = -EFAULT;
> + goto done_unlock;
> }
>
> - return 0;
> + ret = 0;
> + goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
> - return ret;
> + goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
> - return iova_reserve_iommu_regions(dev, domain);
> + ret = iova_reserve_iommu_regions(dev, domain);
> +
> +done_unlock:
> + mutex_unlock(&cookie->mutex);
> + return ret;
> }
>
> /**
> --
> 2.18.0
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-22 12:46 ` Joerg Roedel
0 siblings, 0 replies; 17+ messages in thread
From: Joerg Roedel @ 2022-06-22 12:46 UTC (permalink / raw)
To: yf.wang
Cc: Will Deacon, Matthias Brugger, open list:IOMMU DRIVERS,
open list, moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support, wsd_upstream, Libo Kang,
Miles Chen, Yong Wu, Ning Li
Please re-send with
Robin Murphy <robin.murphy@arm.com>
in Cc.
On Mon, May 30, 2022 at 08:07:45PM +0800, yf.wang@mediatek.com wrote:
> From: Yunfei Wang <yf.wang@mediatek.com>
>
> When many devices share the same iova domain, iommu_dma_init_domain()
> may be called at the same time. The checking of iovad->start_pfn will
> all get false in iommu_dma_init_domain() and both enter init_iova_domain()
> to do iovad initialization.
>
> Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
>
> Exception backtrace:
> rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
> init_iova_domain() + 180
> iommu_setup_dma_ops() + 260
> arch_setup_dma_ops() + 132
> of_dma_configure_id() + 468
> platform_dma_configure() + 32
> really_probe() + 1168
> driver_probe_device() + 268
> __device_attach_driver() + 524
> __device_attach() + 524
> bus_probe_device() + 64
> deferred_probe_work_func() + 260
> process_one_work() + 580
> worker_thread() + 1076
> kthread() + 332
> ret_from_fork() + 16
>
> Signed-off-by: Ning Li <ning.li@mediatek.com>
> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
> ---
> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
> 1 file changed, 13 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 09f6e1c0f9c0..b38c5041eeab 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>
> /* Domain for flush queue callback; NULL if flush queue not in use */
> struct iommu_domain *fq_domain;
> + struct mutex mutex;
> };
>
> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
> @@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
> if (!domain->iova_cookie)
> return -ENOMEM;
>
> + mutex_init(&domain->iova_cookie->mutex);
> return 0;
> }
>
> @@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
> }
>
> /* start_pfn is always nonzero for an already-initialised domain */
> + mutex_lock(&cookie->mutex);
> if (iovad->start_pfn) {
> if (1UL << order != iovad->granule ||
> base_pfn != iovad->start_pfn) {
> pr_warn("Incompatible range for DMA domain\n");
> - return -EFAULT;
> + ret = -EFAULT;
> + goto done_unlock;
> }
>
> - return 0;
> + ret = 0;
> + goto done_unlock;
> }
>
> init_iova_domain(iovad, 1UL << order, base_pfn);
> ret = iova_domain_init_rcaches(iovad);
> if (ret)
> - return ret;
> + goto done_unlock;
>
> /* If the FQ fails we can simply fall back to strict mode */
> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
> domain->type = IOMMU_DOMAIN_DMA;
>
> - return iova_reserve_iommu_regions(dev, domain);
> + ret = iova_reserve_iommu_regions(dev, domain);
> +
> +done_unlock:
> + mutex_unlock(&cookie->mutex);
> + return ret;
> }
>
> /**
> --
> 2.18.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
2022-06-22 12:46 ` Joerg Roedel
(?)
@ 2022-06-22 13:27 ` Robin Murphy
-1 siblings, 0 replies; 17+ messages in thread
From: Robin Murphy @ 2022-06-22 13:27 UTC (permalink / raw)
To: Joerg Roedel, yf.wang
Cc: wsd_upstream, open list:IOMMU DRIVERS, Libo Kang, open list,
Miles Chen, moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support, Matthias Brugger,
Will Deacon, Ning Li
On 2022-06-22 13:46, Joerg Roedel wrote:
> Please re-send with
>
> Robin Murphy <robin.murphy@arm.com>
>
> in Cc.
Apologies, I did spot this before, I've just been tied up with other
things and dropping everything non-critical on the floor, so didn't get
round to replying before it slipped my mind again.
In summary, I hate it, but mostly because the whole situation of calling
iommu_probe_device off the back of driver probe is fundamentally broken.
I'm still a few steps away from fixing that properly, at which point I
can just as well rip all these little bodges out again. If it really
does need mitigating in the meantime (i.e. this is real-world async
probe, not just some contrived testcase), then I can't easily think of
any cleaner hack, so,
Acked-by: Robin Murphy <robin.murphy@arm.com>
(somewhat reluctantly)
Cheers,
Robin.
> On Mon, May 30, 2022 at 08:07:45PM +0800, yf.wang@mediatek.com wrote:
>> From: Yunfei Wang <yf.wang@mediatek.com>
>>
>> When many devices share the same iova domain, iommu_dma_init_domain()
>> may be called at the same time. The checking of iovad->start_pfn will
>> all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>> to do iovad initialization.
>>
>> Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
>>
>> Exception backtrace:
>> rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>> init_iova_domain() + 180
>> iommu_setup_dma_ops() + 260
>> arch_setup_dma_ops() + 132
>> of_dma_configure_id() + 468
>> platform_dma_configure() + 32
>> really_probe() + 1168
>> driver_probe_device() + 268
>> __device_attach_driver() + 524
>> __device_attach() + 524
>> bus_probe_device() + 64
>> deferred_probe_work_func() + 260
>> process_one_work() + 580
>> worker_thread() + 1076
>> kthread() + 332
>> ret_from_fork() + 16
>>
>> Signed-off-by: Ning Li <ning.li@mediatek.com>
>> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>> ---
>> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
>> 1 file changed, 13 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>> index 09f6e1c0f9c0..b38c5041eeab 100644
>> --- a/drivers/iommu/dma-iommu.c
>> +++ b/drivers/iommu/dma-iommu.c
>> @@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>>
>> /* Domain for flush queue callback; NULL if flush queue not in use */
>> struct iommu_domain *fq_domain;
>> + struct mutex mutex;
>> };
>>
>> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>> @@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
>> if (!domain->iova_cookie)
>> return -ENOMEM;
>>
>> + mutex_init(&domain->iova_cookie->mutex);
>> return 0;
>> }
>>
>> @@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
>> }
>>
>> /* start_pfn is always nonzero for an already-initialised domain */
>> + mutex_lock(&cookie->mutex);
>> if (iovad->start_pfn) {
>> if (1UL << order != iovad->granule ||
>> base_pfn != iovad->start_pfn) {
>> pr_warn("Incompatible range for DMA domain\n");
>> - return -EFAULT;
>> + ret = -EFAULT;
>> + goto done_unlock;
>> }
>>
>> - return 0;
>> + ret = 0;
>> + goto done_unlock;
>> }
>>
>> init_iova_domain(iovad, 1UL << order, base_pfn);
>> ret = iova_domain_init_rcaches(iovad);
>> if (ret)
>> - return ret;
>> + goto done_unlock;
>>
>> /* If the FQ fails we can simply fall back to strict mode */
>> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
>> domain->type = IOMMU_DOMAIN_DMA;
>>
>> - return iova_reserve_iommu_regions(dev, domain);
>> + ret = iova_reserve_iommu_regions(dev, domain);
>> +
>> +done_unlock:
>> + mutex_unlock(&cookie->mutex);
>> + return ret;
>> }
>>
>> /**
>> --
>> 2.18.0
> _______________________________________________
> iommu mailing list
> iommu@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/iommu
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-22 13:27 ` Robin Murphy
0 siblings, 0 replies; 17+ messages in thread
From: Robin Murphy @ 2022-06-22 13:27 UTC (permalink / raw)
To: Joerg Roedel, yf.wang
Cc: Miles Chen, wsd_upstream, open list, Libo Kang,
open list:IOMMU DRIVERS, moderated list:ARM/Mediatek SoC support,
Ning Li, Matthias Brugger, Will Deacon,
moderated list:ARM/Mediatek SoC support
On 2022-06-22 13:46, Joerg Roedel wrote:
> Please re-send with
>
> Robin Murphy <robin.murphy@arm.com>
>
> in Cc.
Apologies, I did spot this before, I've just been tied up with other
things and dropping everything non-critical on the floor, so didn't get
round to replying before it slipped my mind again.
In summary, I hate it, but mostly because the whole situation of calling
iommu_probe_device off the back of driver probe is fundamentally broken.
I'm still a few steps away from fixing that properly, at which point I
can just as well rip all these little bodges out again. If it really
does need mitigating in the meantime (i.e. this is real-world async
probe, not just some contrived testcase), then I can't easily think of
any cleaner hack, so,
Acked-by: Robin Murphy <robin.murphy@arm.com>
(somewhat reluctantly)
Cheers,
Robin.
> On Mon, May 30, 2022 at 08:07:45PM +0800, yf.wang@mediatek.com wrote:
>> From: Yunfei Wang <yf.wang@mediatek.com>
>>
>> When many devices share the same iova domain, iommu_dma_init_domain()
>> may be called at the same time. The checking of iovad->start_pfn will
>> all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>> to do iovad initialization.
>>
>> Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
>>
>> Exception backtrace:
>> rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>> init_iova_domain() + 180
>> iommu_setup_dma_ops() + 260
>> arch_setup_dma_ops() + 132
>> of_dma_configure_id() + 468
>> platform_dma_configure() + 32
>> really_probe() + 1168
>> driver_probe_device() + 268
>> __device_attach_driver() + 524
>> __device_attach() + 524
>> bus_probe_device() + 64
>> deferred_probe_work_func() + 260
>> process_one_work() + 580
>> worker_thread() + 1076
>> kthread() + 332
>> ret_from_fork() + 16
>>
>> Signed-off-by: Ning Li <ning.li@mediatek.com>
>> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>> ---
>> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
>> 1 file changed, 13 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>> index 09f6e1c0f9c0..b38c5041eeab 100644
>> --- a/drivers/iommu/dma-iommu.c
>> +++ b/drivers/iommu/dma-iommu.c
>> @@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>>
>> /* Domain for flush queue callback; NULL if flush queue not in use */
>> struct iommu_domain *fq_domain;
>> + struct mutex mutex;
>> };
>>
>> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>> @@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
>> if (!domain->iova_cookie)
>> return -ENOMEM;
>>
>> + mutex_init(&domain->iova_cookie->mutex);
>> return 0;
>> }
>>
>> @@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
>> }
>>
>> /* start_pfn is always nonzero for an already-initialised domain */
>> + mutex_lock(&cookie->mutex);
>> if (iovad->start_pfn) {
>> if (1UL << order != iovad->granule ||
>> base_pfn != iovad->start_pfn) {
>> pr_warn("Incompatible range for DMA domain\n");
>> - return -EFAULT;
>> + ret = -EFAULT;
>> + goto done_unlock;
>> }
>>
>> - return 0;
>> + ret = 0;
>> + goto done_unlock;
>> }
>>
>> init_iova_domain(iovad, 1UL << order, base_pfn);
>> ret = iova_domain_init_rcaches(iovad);
>> if (ret)
>> - return ret;
>> + goto done_unlock;
>>
>> /* If the FQ fails we can simply fall back to strict mode */
>> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
>> domain->type = IOMMU_DOMAIN_DMA;
>>
>> - return iova_reserve_iommu_regions(dev, domain);
>> + ret = iova_reserve_iommu_regions(dev, domain);
>> +
>> +done_unlock:
>> + mutex_unlock(&cookie->mutex);
>> + return ret;
>> }
>>
>> /**
>> --
>> 2.18.0
> _______________________________________________
> iommu mailing list
> iommu@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/iommu
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-22 13:27 ` Robin Murphy
0 siblings, 0 replies; 17+ messages in thread
From: Robin Murphy @ 2022-06-22 13:27 UTC (permalink / raw)
To: Joerg Roedel, yf.wang
Cc: Miles Chen, wsd_upstream, open list, Libo Kang,
open list:IOMMU DRIVERS, moderated list:ARM/Mediatek SoC support,
Ning Li, Matthias Brugger, Will Deacon,
moderated list:ARM/Mediatek SoC support
On 2022-06-22 13:46, Joerg Roedel wrote:
> Please re-send with
>
> Robin Murphy <robin.murphy@arm.com>
>
> in Cc.
Apologies, I did spot this before, I've just been tied up with other
things and dropping everything non-critical on the floor, so didn't get
round to replying before it slipped my mind again.
In summary, I hate it, but mostly because the whole situation of calling
iommu_probe_device off the back of driver probe is fundamentally broken.
I'm still a few steps away from fixing that properly, at which point I
can just as well rip all these little bodges out again. If it really
does need mitigating in the meantime (i.e. this is real-world async
probe, not just some contrived testcase), then I can't easily think of
any cleaner hack, so,
Acked-by: Robin Murphy <robin.murphy@arm.com>
(somewhat reluctantly)
Cheers,
Robin.
> On Mon, May 30, 2022 at 08:07:45PM +0800, yf.wang@mediatek.com wrote:
>> From: Yunfei Wang <yf.wang@mediatek.com>
>>
>> When many devices share the same iova domain, iommu_dma_init_domain()
>> may be called at the same time. The checking of iovad->start_pfn will
>> all get false in iommu_dma_init_domain() and both enter init_iova_domain()
>> to do iovad initialization.
>>
>> Fix this by protecting init_iova_domain() with iommu_dma_cookie->mutex.
>>
>> Exception backtrace:
>> rb_insert_color(param1=0xFFFFFF80CD2BDB40, param3=1) + 64
>> init_iova_domain() + 180
>> iommu_setup_dma_ops() + 260
>> arch_setup_dma_ops() + 132
>> of_dma_configure_id() + 468
>> platform_dma_configure() + 32
>> really_probe() + 1168
>> driver_probe_device() + 268
>> __device_attach_driver() + 524
>> __device_attach() + 524
>> bus_probe_device() + 64
>> deferred_probe_work_func() + 260
>> process_one_work() + 580
>> worker_thread() + 1076
>> kthread() + 332
>> ret_from_fork() + 16
>>
>> Signed-off-by: Ning Li <ning.li@mediatek.com>
>> Signed-off-by: Yunfei Wang <yf.wang@mediatek.com>
>> ---
>> drivers/iommu/dma-iommu.c | 17 +++++++++++++----
>> 1 file changed, 13 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
>> index 09f6e1c0f9c0..b38c5041eeab 100644
>> --- a/drivers/iommu/dma-iommu.c
>> +++ b/drivers/iommu/dma-iommu.c
>> @@ -63,6 +63,7 @@ struct iommu_dma_cookie {
>>
>> /* Domain for flush queue callback; NULL if flush queue not in use */
>> struct iommu_domain *fq_domain;
>> + struct mutex mutex;
>> };
>>
>> static DEFINE_STATIC_KEY_FALSE(iommu_deferred_attach_enabled);
>> @@ -309,6 +310,7 @@ int iommu_get_dma_cookie(struct iommu_domain *domain)
>> if (!domain->iova_cookie)
>> return -ENOMEM;
>>
>> + mutex_init(&domain->iova_cookie->mutex);
>> return 0;
>> }
>>
>> @@ -549,26 +551,33 @@ static int iommu_dma_init_domain(struct iommu_domain *domain, dma_addr_t base,
>> }
>>
>> /* start_pfn is always nonzero for an already-initialised domain */
>> + mutex_lock(&cookie->mutex);
>> if (iovad->start_pfn) {
>> if (1UL << order != iovad->granule ||
>> base_pfn != iovad->start_pfn) {
>> pr_warn("Incompatible range for DMA domain\n");
>> - return -EFAULT;
>> + ret = -EFAULT;
>> + goto done_unlock;
>> }
>>
>> - return 0;
>> + ret = 0;
>> + goto done_unlock;
>> }
>>
>> init_iova_domain(iovad, 1UL << order, base_pfn);
>> ret = iova_domain_init_rcaches(iovad);
>> if (ret)
>> - return ret;
>> + goto done_unlock;
>>
>> /* If the FQ fails we can simply fall back to strict mode */
>> if (domain->type == IOMMU_DOMAIN_DMA_FQ && iommu_dma_init_fq(domain))
>> domain->type = IOMMU_DOMAIN_DMA;
>>
>> - return iova_reserve_iommu_regions(dev, domain);
>> + ret = iova_reserve_iommu_regions(dev, domain);
>> +
>> +done_unlock:
>> + mutex_unlock(&cookie->mutex);
>> + return ret;
>> }
>>
>> /**
>> --
>> 2.18.0
> _______________________________________________
> iommu mailing list
> iommu@lists.linux-foundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/iommu
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
2022-06-22 13:27 ` Robin Murphy
(?)
@ 2022-06-22 13:42 ` Joerg Roedel
-1 siblings, 0 replies; 17+ messages in thread
From: Joerg Roedel @ 2022-06-22 13:42 UTC (permalink / raw)
To: Robin Murphy
Cc: yf.wang, Miles Chen, wsd_upstream, open list, Libo Kang,
open list:IOMMU DRIVERS, moderated list:ARM/Mediatek SoC support,
Ning Li, Matthias Brugger, Will Deacon,
moderated list:ARM/Mediatek SoC support
On Wed, Jun 22, 2022 at 02:27:57PM +0100, Robin Murphy wrote:
> Apologies, I did spot this before, I've just been tied up with other things
> and dropping everything non-critical on the floor, so didn't get round to
> replying before it slipped my mind again.
>
> In summary, I hate it, but mostly because the whole situation of calling
> iommu_probe_device off the back of driver probe is fundamentally broken. I'm
> still a few steps away from fixing that properly, at which point I can just
> as well rip all these little bodges out again. If it really does need
> mitigating in the meantime (i.e. this is real-world async probe, not just
> some contrived testcase), then I can't easily think of any cleaner hack, so,
>
> Acked-by: Robin Murphy <robin.murphy@arm.com>
Alright, applied this now.
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-22 13:42 ` Joerg Roedel
0 siblings, 0 replies; 17+ messages in thread
From: Joerg Roedel @ 2022-06-22 13:42 UTC (permalink / raw)
To: Robin Murphy
Cc: wsd_upstream, open list, open list:IOMMU DRIVERS, Libo Kang,
yf.wang, Miles Chen, moderated list:ARM/Mediatek SoC support,
moderated list:ARM/Mediatek SoC support, Matthias Brugger,
Will Deacon, Ning Li
On Wed, Jun 22, 2022 at 02:27:57PM +0100, Robin Murphy wrote:
> Apologies, I did spot this before, I've just been tied up with other things
> and dropping everything non-critical on the floor, so didn't get round to
> replying before it slipped my mind again.
>
> In summary, I hate it, but mostly because the whole situation of calling
> iommu_probe_device off the back of driver probe is fundamentally broken. I'm
> still a few steps away from fixing that properly, at which point I can just
> as well rip all these little bodges out again. If it really does need
> mitigating in the meantime (i.e. this is real-world async probe, not just
> some contrived testcase), then I can't easily think of any cleaner hack, so,
>
> Acked-by: Robin Murphy <robin.murphy@arm.com>
Alright, applied this now.
_______________________________________________
iommu mailing list
iommu@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/iommu
^ permalink raw reply [flat|nested] 17+ messages in thread
* Re: [PATCH] iommu/dma: Fix race condition during iova_domain initialization
@ 2022-06-22 13:42 ` Joerg Roedel
0 siblings, 0 replies; 17+ messages in thread
From: Joerg Roedel @ 2022-06-22 13:42 UTC (permalink / raw)
To: Robin Murphy
Cc: yf.wang, Miles Chen, wsd_upstream, open list, Libo Kang,
open list:IOMMU DRIVERS, moderated list:ARM/Mediatek SoC support,
Ning Li, Matthias Brugger, Will Deacon,
moderated list:ARM/Mediatek SoC support
On Wed, Jun 22, 2022 at 02:27:57PM +0100, Robin Murphy wrote:
> Apologies, I did spot this before, I've just been tied up with other things
> and dropping everything non-critical on the floor, so didn't get round to
> replying before it slipped my mind again.
>
> In summary, I hate it, but mostly because the whole situation of calling
> iommu_probe_device off the back of driver probe is fundamentally broken. I'm
> still a few steps away from fixing that properly, at which point I can just
> as well rip all these little bodges out again. If it really does need
> mitigating in the meantime (i.e. this is real-world async probe, not just
> some contrived testcase), then I can't easily think of any cleaner hack, so,
>
> Acked-by: Robin Murphy <robin.murphy@arm.com>
Alright, applied this now.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2022-06-22 13:43 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-30 12:07 [PATCH] iommu/dma: Fix race condition during iova_domain initialization yf.wang
2022-05-30 12:07 ` yf.wang
2022-05-30 12:07 ` yf.wang
2022-05-30 12:07 ` yf.wang--- via iommu
2022-06-09 17:04 ` Miles Chen
2022-06-09 17:04 ` Miles Chen
2022-06-09 17:04 ` Miles Chen
2022-06-09 17:04 ` Miles Chen via iommu
2022-06-22 12:46 ` Joerg Roedel
2022-06-22 12:46 ` Joerg Roedel
2022-06-22 12:46 ` Joerg Roedel
2022-06-22 13:27 ` Robin Murphy
2022-06-22 13:27 ` Robin Murphy
2022-06-22 13:27 ` Robin Murphy
2022-06-22 13:42 ` Joerg Roedel
2022-06-22 13:42 ` Joerg Roedel
2022-06-22 13:42 ` Joerg Roedel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.