)]}' { "commit": "3e7abe2556b583e87dabda3e0e6178a67b20d06f", "tree": "524d965baf3aacc691aedd6535da901cc943cb7a", "parents": [ "65112dccf8a113737684366349d7f9ec373ddc47" ], "author": { "name": "Roland Dreier", "email": "roland@purestorage.com", "time": "Wed Jul 20 06:22:21 2011 -0700" }, "committer": { "name": "David Woodhouse", "email": "David.Woodhouse@intel.com", "time": "Mon Oct 10 22:02:24 2011 +0100" }, "message": "intel-iommu: Fix AB-BA lockdep report\n\nWhen unbinding a device so that I could pass it through to a KVM VM, I\ngot the lockdep report below. It looks like a legitimate lock\nordering problem:\n\n - domain_context_mapping_one() takes iommu-\u003elock and calls\n iommu_support_dev_iotlb(), which takes device_domain_lock (inside\n iommu-\u003elock).\n\n - domain_remove_one_dev_info() starts by taking device_domain_lock\n then takes iommu-\u003elock inside it (near the end of the function).\n\nSo this is the classic AB-BA deadlock. It looks like a safe fix is to\nsimply release device_domain_lock a bit earlier, since as far as I can\ntell, it doesn\u0027t protect any of the stuff accessed at the end of\ndomain_remove_one_dev_info() anyway.\n\nBTW, the use of device_domain_lock looks a bit unsafe to me... it\u0027s\nat least not obvious to me why we aren\u0027t vulnerable to the race below:\n\n iommu_support_dev_iotlb()\n domain_remove_dev_info()\n\n lock device_domain_lock\n find info\n unlock device_domain_lock\n\n lock device_domain_lock\n find same info\n unlock device_domain_lock\n\n free_devinfo_mem(info)\n\n do stuff with info after it\u0027s free\n\nHowever I don\u0027t understand the locking here well enough to know if\nthis is a real problem, let alone what the best fix is.\n\nAnyway here\u0027s the full lockdep output that prompted all of this:\n\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n [ INFO: possible circular locking dependency detected ]\n 2.6.39.1+ #1\n -------------------------------------------------------\n bash/13954 is trying to acquire lock:\n (\u0026(\u0026iommu-\u003elock)-\u003erlock){......}, at: [\u003cffffffff812f6421\u003e] domain_remove_one_dev_info+0x121/0x230\n\n but task is already holding lock:\n (device_domain_lock){-.-...}, at: [\u003cffffffff812f6508\u003e] domain_remove_one_dev_info+0x208/0x230\n\n which lock already depends on the new lock.\n\n the existing dependency chain (in reverse order) is:\n\n -\u003e #1 (device_domain_lock){-.-...}:\n [\u003cffffffff8109ca9d\u003e] lock_acquire+0x9d/0x130\n [\u003cffffffff81571475\u003e] _raw_spin_lock_irqsave+0x55/0xa0\n [\u003cffffffff812f8350\u003e] domain_context_mapping_one+0x600/0x750\n [\u003cffffffff812f84df\u003e] domain_context_mapping+0x3f/0x120\n [\u003cffffffff812f9175\u003e] iommu_prepare_identity_map+0x1c5/0x1e0\n [\u003cffffffff81ccf1ca\u003e] intel_iommu_init+0x88e/0xb5e\n [\u003cffffffff81cab204\u003e] pci_iommu_init+0x16/0x41\n [\u003cffffffff81002165\u003e] do_one_initcall+0x45/0x190\n [\u003cffffffff81ca3d3f\u003e] kernel_init+0xe3/0x168\n [\u003cffffffff8157ac24\u003e] kernel_thread_helper+0x4/0x10\n\n -\u003e #0 (\u0026(\u0026iommu-\u003elock)-\u003erlock){......}:\n [\u003cffffffff8109bf3e\u003e] __lock_acquire+0x195e/0x1e10\n [\u003cffffffff8109ca9d\u003e] lock_acquire+0x9d/0x130\n [\u003cffffffff81571475\u003e] _raw_spin_lock_irqsave+0x55/0xa0\n [\u003cffffffff812f6421\u003e] domain_remove_one_dev_info+0x121/0x230\n [\u003cffffffff812f8b42\u003e] device_notifier+0x72/0x90\n [\u003cffffffff8157555c\u003e] notifier_call_chain+0x8c/0xc0\n [\u003cffffffff81089768\u003e] __blocking_notifier_call_chain+0x78/0xb0\n [\u003cffffffff810897b6\u003e] blocking_notifier_call_chain+0x16/0x20\n [\u003cffffffff81373a5c\u003e] __device_release_driver+0xbc/0xe0\n [\u003cffffffff81373ccf\u003e] device_release_driver+0x2f/0x50\n [\u003cffffffff81372ee3\u003e] driver_unbind+0xa3/0xc0\n [\u003cffffffff813724ac\u003e] drv_attr_store+0x2c/0x30\n [\u003cffffffff811e4506\u003e] sysfs_write_file+0xe6/0x170\n [\u003cffffffff8117569e\u003e] vfs_write+0xce/0x190\n [\u003cffffffff811759e4\u003e] sys_write+0x54/0xa0\n [\u003cffffffff81579a82\u003e] system_call_fastpath+0x16/0x1b\n\n other info that might help us debug this:\n\n 6 locks held by bash/13954:\n #0: (\u0026buffer-\u003emutex){+.+.+.}, at: [\u003cffffffff811e4464\u003e] sysfs_write_file+0x44/0x170\n #1: (s_active#3){++++.+}, at: [\u003cffffffff811e44ed\u003e] sysfs_write_file+0xcd/0x170\n #2: (\u0026__lockdep_no_validate__){+.+.+.}, at: [\u003cffffffff81372edb\u003e] driver_unbind+0x9b/0xc0\n #3: (\u0026__lockdep_no_validate__){+.+.+.}, at: [\u003cffffffff81373cc7\u003e] device_release_driver+0x27/0x50\n #4: (\u0026(\u0026priv-\u003ebus_notifier)-\u003erwsem){.+.+.+}, at: [\u003cffffffff8108974f\u003e] __blocking_notifier_call_chain+0x5f/0xb0\n #5: (device_domain_lock){-.-...}, at: [\u003cffffffff812f6508\u003e] domain_remove_one_dev_info+0x208/0x230\n\n stack backtrace:\n Pid: 13954, comm: bash Not tainted 2.6.39.1+ #1\n Call Trace:\n [\u003cffffffff810993a7\u003e] print_circular_bug+0xf7/0x100\n [\u003cffffffff8109bf3e\u003e] __lock_acquire+0x195e/0x1e10\n [\u003cffffffff810972bd\u003e] ? trace_hardirqs_off+0xd/0x10\n [\u003cffffffff8109d57d\u003e] ? trace_hardirqs_on_caller+0x13d/0x180\n [\u003cffffffff8109ca9d\u003e] lock_acquire+0x9d/0x130\n [\u003cffffffff812f6421\u003e] ? domain_remove_one_dev_info+0x121/0x230\n [\u003cffffffff81571475\u003e] _raw_spin_lock_irqsave+0x55/0xa0\n [\u003cffffffff812f6421\u003e] ? domain_remove_one_dev_info+0x121/0x230\n [\u003cffffffff810972bd\u003e] ? trace_hardirqs_off+0xd/0x10\n [\u003cffffffff812f6421\u003e] domain_remove_one_dev_info+0x121/0x230\n [\u003cffffffff812f8b42\u003e] device_notifier+0x72/0x90\n [\u003cffffffff8157555c\u003e] notifier_call_chain+0x8c/0xc0\n [\u003cffffffff81089768\u003e] __blocking_notifier_call_chain+0x78/0xb0\n [\u003cffffffff810897b6\u003e] blocking_notifier_call_chain+0x16/0x20\n [\u003cffffffff81373a5c\u003e] __device_release_driver+0xbc/0xe0\n [\u003cffffffff81373ccf\u003e] device_release_driver+0x2f/0x50\n [\u003cffffffff81372ee3\u003e] driver_unbind+0xa3/0xc0\n [\u003cffffffff813724ac\u003e] drv_attr_store+0x2c/0x30\n [\u003cffffffff811e4506\u003e] sysfs_write_file+0xe6/0x170\n [\u003cffffffff8117569e\u003e] vfs_write+0xce/0x190\n [\u003cffffffff811759e4\u003e] sys_write+0x54/0xa0\n [\u003cffffffff81579a82\u003e] system_call_fastpath+0x16/0x1b\n\nSigned-off-by: Roland Dreier \u003croland@purestorage.com\u003e\nSigned-off-by: David Woodhouse \u003cDavid.Woodhouse@intel.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "c621c98c99da00886931b3aed1b8364c7de6b958", "old_mode": 33188, "old_path": "drivers/iommu/intel-iommu.c", "new_id": "d9514c46177f1c5f90892959d41fe4d0f9aedf99", "new_mode": 33188, "new_path": "drivers/iommu/intel-iommu.c" } ] }