From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linu Cherian Subject: Re: Handling active DMA during a VFIO application crash Date: Fri, 16 Feb 2018 09:34:04 +0530 Message-ID: <20180216040404.GA12253@virtx40> References: <20180215110406.GA15219@virtx40> <20180215092109.51dc7a1a@w520.home> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Linu Cherian , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, Sunil.Goutham@cavium.com To: Alex Williamson Return-path: Content-Disposition: inline In-Reply-To: <20180215092109.51dc7a1a@w520.home> Sender: linux-kernel-owner@vger.kernel.org List-Id: kvm.vger.kernel.org Hi Alex, On Thu Feb 15, 2018 at 09:21:09AM -0700, Alex Williamson wrote: > On Thu, 15 Feb 2018 16:34:06 +0530 > Linu Cherian wrote: > > > Hi, > > > > Was exploring the implications of an application crash while DMA > > is active from a vfio PCI device; the DMA being configured and > > started by the application using vfio APIs. > > > > The expectation is that, DMA is stopped/reset before we tear down the IOMMU mappings > > and finally free the mmapped pages(on which DMA is happening). > > > > From the below stack trace(with dump_stack in vfio_pci_release), > > [ 201.564273] [] vfio_pci_release+0x80/0x458 > > [ 201.564276] [] vfio_device_fops_release+0x2c/0x50 > > [ 201.564279] [] __fput+0x9c/0x218 > > [ 201.564283] [] ____fput+0x20/0x30 > > [ 201.564286] [] task_work_run+0xa0/0xc8 > > [ 201.564289] [] do_exit+0x2bc/0x9c8 > > [ 201.564293] [] do_group_exit+0x3c/0xa8 > > [ 201.564296] [] get_signal+0x3e4/0x538 > > [ 201.564299] [] do_signal+0x70/0x660 > > [ 201.564302] [] do_notify_resume+0xe0/0x120 > > > > > > PCI device is disabled/reset from vfio_pci_release invoked as part of > > device fd release. The fd releases are in turn invoked from exit_files > > and exit_task_work. > > > > But exit_mm, gets called before exit_files/exit_task_work in do_exit. > > > > Assuming all pages allocated/mmaped to a process gets freed in exit_mm, > > is there is a possibility that user pages configured for DMA can get freed > > to kernel before the vfio device is stopped/reset ? > > Pages mapped through the IOMMU are still pinned, so they have an > elevated reference count and I believe therefore cannot "get freed to > kernel". Nothing should therefore be able to allocate those pages > until the container is released, which happens even after the device is > released. Thanks, > > Alex Thanks for the clarification. I will dig through the code on this. -- Linu cherian