On Mon, Oct 14, 2024 at 03:58:55PM +0800, Zhangfei Gao wrote:
+struct iommufd_object *iommufd_object_alloc_elm(struct iommufd_ctx *ictx,
size_t size,enum iommufd_object_type type)+{
struct iommufd_object *obj;int rc;obj = kzalloc(size, GFP_KERNEL_ACCOUNT);if (!obj)return ERR_PTR(-ENOMEM);obj->type = type;/* Starts out bias'd by 1 until it is removed from the xarray */refcount_set(&obj->shortterm_users, 1);refcount_set(&obj->users, 1);here set refcont 1
iommufd_device_bind -> iommufd_object_alloc(ictx, idev, IOMMUFD_OBJ_DEVICE): refcont -> 1 refcount_inc(&idev->obj.users); refcount -> 2 will cause iommufd_device_unbind fail.
May remove refcount_inc(&idev->obj.users) in iommufd_device_bind
Hmm, why would it fail? Or is it failing on your system?
Not sure, still in check, it may only be on my platform.
it hit iommufd_object_remove: if (WARN_ON(obj != to_destroy))
iommufd_device_bind refcount=2 iommufd_device_attach refcount=3 //still not sure which operation inc the count? iommufd_device_detach refcount=4
Have a question, when should iommufd_vdevice_destroy be called, before or after iommufd_device_unbind.
Before.
Now iommufd_vdevice_destroy (ref--) is after unbind, hits the if (!refcount_dec_if_one(&obj->users)) check.
Hmm, where do we have an iommufd_vdevice_destroy after unbind?
iommufd_device_bind iommufd_device_attach iommufd_vdevice_alloc_ioctl
iommufd_device_detach iommufd_device_unbind // refcount check fail iommufd_vdevice_destroy ref--
Things should be symmetric. As you suspected, vdevice should be destroyed before iommufd_device_detach.
A vdev is an object on top of a vIOMMU obj and an idev obj, so it takes a refcount from each of them. That's why idev couldn't unbind.
Thanks Nicolin