From mboxrd@z Thu Jan  1 00:00:00 1970
From: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Subject: Re: [Qemu-devel] [PATCH 1/2] KVM: page track: add a new notifier
 type: track_flush_slot
Date: Thu, 20 Oct 2016 09:48:40 +0800
Message-ID: <d098b5c1-935f-0977-b0c9-93ed6bcbe882@linux.intel.com>
References: <c9d63f52-9b6f-5752-2111-773b33adc426@redhat.com>
 <1259cdba-c137-c3da-abe2-ecf51aec6738@linux.intel.com>
 <e992eb4e-0806-8f6e-851d-36eaf389a897@redhat.com>
 <ea9dffe6-7afa-4862-e46f-6f780a309e46@linux.intel.com>
 <523e1446-75f1-fe3a-d818-f7d238d57751@redhat.com>
 <5800B579.9000705@intel.com> <20161014084158.623087aa@t450s.home>
 <20161014084601.2a50ba87@t450s.home> <20161014163545.GA6121@nvidia.com>
 <20161014105124.42b438a6@t450s.home> <20161014221901.GA8865@nvidia.com>
 <20161017100229.1474ae33@t450s.home> <580617BD.8000300@intel.com>
 <20161018085918.61ec0e93@t450s.home> <5806DB2D.6090306@intel.com>
 <2f04a53d-261c-7fb5-6825-117da6a1307d@intel.com>
 <f66b030e-490e-8480-ff19-71116f42040a@redhat.com>
 <06340187-61d8-ed7a-e40d-264ca3eb4b37@linux.intel.com>
 <6067bf7d-42ba-0ffd-5131-da74f60296d4@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Cc: "Tian, Kevin" <kevin.tian@intel.com>, Neo Jia <cjia@nvidia.com>,
        kvm@vger.kernel.org, qemu-devel <qemu-devel@nongnu.org>,
        Xiaoguang Chen <xiaoguang.chen@intel.com>,
        Kirti Wankhede <kwankhede@nvidia.com>
To: Paolo Bonzini <pbonzini@redhat.com>,
        Xiao Guangrong <guangrong.xiao@intel.com>,
        Jike Song <jike.song@intel.com>,
        Alex Williamson <alex.williamson@redhat.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mga07.intel.com ([134.134.136.100]:9685 "EHLO mga07.intel.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1756790AbcJTBzd (ORCPT <rfc822;kvm@vger.kernel.org>);
        Wed, 19 Oct 2016 21:55:33 -0400
In-Reply-To: <6067bf7d-42ba-0ffd-5131-da74f60296d4@redhat.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>



On 10/19/2016 10:14 PM, Paolo Bonzini wrote:
>
>
> On 19/10/2016 15:39, Xiao Guangrong wrote:
>>
>>
>> On 10/19/2016 07:56 PM, Paolo Bonzini wrote:
>>>
>>>
>>> On 19/10/2016 07:45, Xiao Guangrong wrote:
>>>>
>>>>
>>>> On 10/19/2016 10:32 AM, Jike Song wrote:
>>>> +EXPORT_SYMBOL_GPL(vfio_group_set_usrdata);
>>>>>>> +
>>>>>>> +void *vfio_group_get_usrdata(struct vfio_group *group)
>>>>>>> +{
>>>>>>> +    return group->usrdata;
>>>>>>> +}
>>>>>>> +EXPORT_SYMBOL_GPL(vfio_group_get_usrdata);
>>>>>>> +
>>>>>>> +void *vfio_group_get_usrdata_by_device(struct device *dev)
>>>>>>> +{
>>>>>>> +    struct vfio_group *vfio_group;
>>>>>>> +
>>>>>>> +    vfio_group = __vfio_group_get_from_iommu(dev->iommu_group);
>>>>>>
>>>>>> We actually need to use iommu_group_get() here.  Kirti adds a
>>>>>> vfio_group_get_from_dev() in v9 03/12 that does this properly.
>>>>>>
>>>>>>> +    if (!vfio_group)
>>>>>>> +        return NULL;
>>>>>>> +
>>>>>>> +    return vfio_group_get_usrdata(vfio_group);
>>>>
>>>> I am worrying if the kvm instance got from group->usrdata is safe
>>>> enough? What happens if you get the instance after kvm released
>>>> kvm-vfio device?
>>>
>>> It shouldn't happen if you use kvm_get_kvm and kvm_put_kvm properly.  It
>>> is almost okay in the patch, just:
>>
>> How about if KVM releases kvm-vfio device between vfio_group_get_usrdata()
>> and get_kvm()?
>
> That cannot happen as long as there is a struct file* for the device
> (see kvm_ioctl_create_device and kvm_device_release).  Since you're
> sending a ioctl to it, it's fine.

I understood that KVM side is safe, however, vfio side is independent with
kvm and the user of usrdata can fetch kvm struct at any time, consider
this scenario:

CPU 0                         CPU 1
KVM:                         VFIO/userdata user
   kvm_ioctl_create_device
      get_kvm()
                             vfio_group_get_usrdata(vfio_group)
   kvm_device_release
     put_kvm()
                             !!! kvm refcount has gone
                             use KVM struct

Then, the user of userdata have fetched kvm struct but the refcount has already gone.

What i missed?