On Wed, 20 Jul 2016 14:34:30 +1000 Alexey Kardashevskiy <aik@xxxxxxxxx> wrote: > static long tce_iommu_register_pages(struct tce_container *container, > @@ -128,10 +129,17 @@ static long tce_iommu_register_pages(struct > tce_container *container, ((vaddr + size) < vaddr)) > return -EINVAL; > > - ret = mm_iommu_get(vaddr, entries, &mem); > + if (!container->mm) { > + if (!current->mm) > + return -ESRCH; /* process exited */ This shouldn't happen if we're a userspace process. > + > + atomic_inc(¤t->mm->mm_count); > + container->mm = current->mm; > + } > + > + ret = mm_iommu_get(container->mm, vaddr, entries, &mem); Is it possible for processes (different mm) to be using the same container? > @@ -354,6 +362,8 @@ static void tce_iommu_release(void *iommu_data) > tce_iommu_free_table(tbl); > } > > + if (container->mm) > + mmdrop(container->mm); > tce_iommu_disable(container); > mutex_destroy(&container->lock); I'm wondering why keep the mm around at all. There is a bit of locked_vm accounting there (which maybe doesn't exactly do the right thing if we're talking about current task's rlimit if the mm does not belong to current anyway). The interesting cases are only the ones where a thread does something with container->mm when current->mm != container->mm (either a different process or a kernel thread). In what situations does that happen? Thanks, Nick -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html