Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Fri, 16 Feb 2018 09:34:04 +0530
From:   Linu Cherian <linu.cherian@cavium.com>
To:     Alex Williamson <alex.williamson@redhat.com>
Cc:     Linu Cherian <linuc.decode@gmail.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, Sunil.Goutham@cavium.com
Subject: Re: Handling active DMA during a VFIO application crash
Message-ID: <20180216040404.GA12253@virtx40>
References: <20180215110406.GA15219@virtx40>
 <20180215092109.51dc7a1a@w520.home>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20180215092109.51dc7a1a@w520.home>
User-Agent: Mutt/1.5.21 (2010-09-15)
Received-SPF: None (protection.outlook.com: cavium.com does not designate
 permitted sender hosts)
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2018 04:04:22.4987 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: eb05fded-7bb3-492a-4230-08d574f25d78
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 711e4ccf-2e9b-4bcf-a551-4094005b6194
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR07MB3435
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Alex,

On Thu Feb 15, 2018 at 09:21:09AM -0700, Alex Williamson wrote:
> On Thu, 15 Feb 2018 16:34:06 +0530
> Linu Cherian <linuc.decode@gmail.com> wrote:
> 
> > Hi,
> > 
> > Was exploring the implications of an application crash while DMA 
> > is active from a vfio PCI device; the DMA being configured and 
> > started by the application using vfio APIs.               
> > 
> > The expectation is that, DMA is stopped/reset before we tear down the IOMMU mappings 
> > and finally free the mmapped pages(on which DMA is happening).                                            
> > 
> > From the below stack trace(with dump_stack in vfio_pci_release),             
> > [  201.564273] [<ffffff8008798b50>] vfio_pci_release+0x80/0x458
> > [  201.564276] [<ffffff8008792b74>] vfio_device_fops_release+0x2c/0x50
> > [  201.564279] [<ffffff8008269ef4>] __fput+0x9c/0x218
> > [  201.564283] [<ffffff800826a0e8>] ____fput+0x20/0x30
> > [  201.564286] [<ffffff80080e7fe0>] task_work_run+0xa0/0xc8
> > [  201.564289] [<ffffff80080cbc7c>] do_exit+0x2bc/0x9c8
> > [  201.564293] [<ffffff80080cd0ec>] do_group_exit+0x3c/0xa8
> > [  201.564296] [<ffffff80080d94c4>] get_signal+0x3e4/0x538
> > [  201.564299] [<ffffff80080892f0>] do_signal+0x70/0x660
> > [  201.564302] [<ffffff8008089ce8>] do_notify_resume+0xe0/0x120
> >                                                                                                
> > 
> > PCI device is disabled/reset from vfio_pci_release invoked as part of 
> > device fd release. The fd releases are in turn invoked from exit_files
> > and exit_task_work.
> > 
> > But exit_mm, gets called before exit_files/exit_task_work in do_exit.
> >                                                                                                
> > Assuming all pages allocated/mmaped to a process gets freed in exit_mm,                                                                                               
> > is there is a possibility that user pages configured for DMA can get freed 
> > to kernel before the vfio device is stopped/reset ? 
> 
> Pages mapped through the IOMMU are still pinned, so they have an
> elevated reference count and I believe therefore cannot "get freed to
> kernel".  Nothing should therefore be able to allocate those pages
> until the container is released, which happens even after the device is
> released.  Thanks,
> 
> Alex


Thanks for the clarification. I will dig through the code on this.

-- 
Linu cherian