Commit 27c379f7f89a4d558c685b5d89b5ba2fe79ae701

Authored by Heiko Carstens
Committed by Ingo Molnar
1 parent df423dc7f2

generic-ipi: Fix deadlock in __smp_call_function_single

Just got my 6 way machine to a state where cpu 0 is in an
endless loop within __smp_call_function_single.
All other cpus are idle.

The call trace on cpu 0 looks like this:

 __smp_call_function_single
 scheduler_tick
 update_process_times
 tick_sched_timer
 __run_hrtimer
 hrtimer_interrupt
 clock_comparator_work
 do_extint
 ext_int_handler
 ----> timer irq
 cpu_idle

__smp_call_function_single() got called from nohz_balancer_kick()
(inlined) with the remote cpu being 1, wait being 0 and the per
cpu variable remote_sched_softirq_cb (call_single_data) of the
current cpu (0).

Then it loops forever when it tries to grab the lock of the
call_single_data, since it is already locked and enqueued on cpu 0.

My theory how this could have happened: for some reason the
scheduler decided to call __smp_call_function_single() on it's own
cpu, and sends an IPI to itself. The interrupt stays pending
since IRQs are disabled. If then the hypervisor schedules the
cpu away it might happen that upon rescheduling both the IPI and
the timer IRQ are pending. If then interrupts are enabled again
it depends which one gets scheduled first.
If the timer interrupt gets delivered first we end up with the
local deadlock as seen in the calltrace above.

Let's make __smp_call_function_single() check if the target cpu is
the current cpu and execute the function immediately just like
smp_call_function_single does. That should prevent at least the
scenario described here.

It might also be that the scheduler is not supposed to call
__smp_call_function_single with the remote cpu being the current
cpu, but that is a different issue.

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Jens Axboe <jaxboe@fusionio.com>
Cc: Venkatesh Pallipadi <venki@google.com>
Cc: Suresh Siddha <suresh.b.siddha@intel.com>
LKML-Reference: <20100910114729.GB2827@osiris.boeblingen.de.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Showing 1 changed file with 14 additions and 3 deletions Side-by-side Diff

... ... @@ -365,9 +365,10 @@
365 365 EXPORT_SYMBOL_GPL(smp_call_function_any);
366 366  
367 367 /**
368   - * __smp_call_function_single(): Run a function on another CPU
  368 + * __smp_call_function_single(): Run a function on a specific CPU
369 369 * @cpu: The CPU to run on.
370 370 * @data: Pre-allocated and setup data structure
  371 + * @wait: If true, wait until function has completed on specified CPU.
371 372 *
372 373 * Like smp_call_function_single(), but allow caller to pass in a
373 374 * pre-allocated data structure. Useful for embedding @data inside
374 375  
... ... @@ -376,8 +377,10 @@
376 377 void __smp_call_function_single(int cpu, struct call_single_data *data,
377 378 int wait)
378 379 {
379   - csd_lock(data);
  380 + unsigned int this_cpu;
  381 + unsigned long flags;
380 382  
  383 + this_cpu = get_cpu();
381 384 /*
382 385 * Can deadlock when called with interrupts disabled.
383 386 * We allow cpu's that are not yet online though, as no one else can
... ... @@ -387,7 +390,15 @@
387 390 WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
388 391 && !oops_in_progress);
389 392  
390   - generic_exec_single(cpu, data, wait);
  393 + if (cpu == this_cpu) {
  394 + local_irq_save(flags);
  395 + data->func(data->info);
  396 + local_irq_restore(flags);
  397 + } else {
  398 + csd_lock(data);
  399 + generic_exec_single(cpu, data, wait);
  400 + }
  401 + put_cpu();
391 402 }
392 403  
393 404 /**