[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Zw08z9TOFL57z07O@Asurada-Nvidia>
Date: Mon, 14 Oct 2024 08:46:23 -0700
From: Nicolin Chen <nicolinc@...dia.com>
To: Zhangfei Gao <zhangfei.gao@...aro.org>
CC: <jgg@...dia.com>, <kevin.tian@...el.com>, <will@...nel.org>,
<joro@...tes.org>, <suravee.suthikulpanit@....com>, <robin.murphy@....com>,
<dwmw2@...radead.org>, <baolu.lu@...ux.intel.com>, <shuah@...nel.org>,
<linux-kernel@...r.kernel.org>, <iommu@...ts.linux.dev>,
<linux-arm-kernel@...ts.infradead.org>, <linux-kselftest@...r.kernel.org>,
<eric.auger@...hat.com>, <jean-philippe@...aro.org>, <mdf@...nel.org>,
<mshavit@...gle.com>, <shameerali.kolothum.thodi@...wei.com>,
<smostafa@...gle.com>, <yi.l.liu@...el.com>, <aik@....com>,
<patches@...ts.linux.dev>
Subject: Re: [PATCH v3 03/11] iommufd: Introduce IOMMUFD_OBJ_VIOMMU and its
related struct
On Mon, Oct 14, 2024 at 03:58:55PM +0800, Zhangfei Gao wrote:
> > > > > +struct iommufd_object *iommufd_object_alloc_elm(struct iommufd_ctx *ictx,
> > > > > + size_t size,
> > > > > + enum iommufd_object_type type)
> > > > > +{
> > > > > + struct iommufd_object *obj;
> > > > > + int rc;
> > > > > +
> > > > > + obj = kzalloc(size, GFP_KERNEL_ACCOUNT);
> > > > > + if (!obj)
> > > > > + return ERR_PTR(-ENOMEM);
> > > > > + obj->type = type;
> > > > > + /* Starts out bias'd by 1 until it is removed from the xarray */
> > > > > + refcount_set(&obj->shortterm_users, 1);
> > > > > + refcount_set(&obj->users, 1);
> > > >
> > > > here set refcont 1
> > > >
> > > > iommufd_device_bind -> iommufd_object_alloc(ictx, idev,
> > > > IOMMUFD_OBJ_DEVICE): refcont -> 1
> > > > refcount_inc(&idev->obj.users); refcount -> 2
> > > > will cause iommufd_device_unbind fail.
> > > >
> > > > May remove refcount_inc(&idev->obj.users) in iommufd_device_bind
> > >
> > > Hmm, why would it fail? Or is it failing on your system?
> >
> > Not sure, still in check, it may only be on my platform.
> >
> > it hit
> > iommufd_object_remove:
> > if (WARN_ON(obj != to_destroy))
> >
> > iommufd_device_bind refcount=2
> > iommufd_device_attach refcount=3
> > //still not sure which operation inc the count?
> > iommufd_device_detach refcount=4
> >
>
> Have a question,
> when should iommufd_vdevice_destroy be called, before or after
> iommufd_device_unbind.
Before.
> Now iommufd_vdevice_destroy (ref--) is after unbind, hits the if
> (!refcount_dec_if_one(&obj->users)) check.
Hmm, where do we have an iommufd_vdevice_destroy after unbind?
> iommufd_device_bind
> iommufd_device_attach
> iommufd_vdevice_alloc_ioctl
>
> iommufd_device_detach
> iommufd_device_unbind // refcount check fail
> iommufd_vdevice_destroy ref--
Things should be symmetric. As you suspected, vdevice should be
destroyed before iommufd_device_detach.
A vdev is an object on top of a vIOMMU obj and an idev obj, so
it takes a refcount from each of them. That's why idev couldn't
unbind.
Thanks
Nicolin
Powered by blists - more mailing lists