On Mon, Oct 14, 2024 at 03:58:55PM +0800, Zhangfei Gao wrote: > > > > > +struct iommufd_object *iommufd_object_alloc_elm(struct iommufd_ctx *ictx, > > > > > + size_t size, > > > > > + enum iommufd_object_type type) > > > > > +{ > > > > > + struct iommufd_object *obj; > > > > > + int rc; > > > > > + > > > > > + obj = kzalloc(size, GFP_KERNEL_ACCOUNT); > > > > > + if (!obj) > > > > > + return ERR_PTR(-ENOMEM); > > > > > + obj->type = type; > > > > > + /* Starts out bias'd by 1 until it is removed from the xarray */ > > > > > + refcount_set(&obj->shortterm_users, 1); > > > > > + refcount_set(&obj->users, 1); > > > > > > > > here set refcont 1 > > > > > > > > iommufd_device_bind -> iommufd_object_alloc(ictx, idev, > > > > IOMMUFD_OBJ_DEVICE): refcont -> 1 > > > > refcount_inc(&idev->obj.users); refcount -> 2 > > > > will cause iommufd_device_unbind fail. > > > > > > > > May remove refcount_inc(&idev->obj.users) in iommufd_device_bind > > > > > > Hmm, why would it fail? Or is it failing on your system? > > > > Not sure, still in check, it may only be on my platform. > > > > it hit > > iommufd_object_remove: > > if (WARN_ON(obj != to_destroy)) > > > > iommufd_device_bind refcount=2 > > iommufd_device_attach refcount=3 > > //still not sure which operation inc the count? > > iommufd_device_detach refcount=4 > > > > Have a question, > when should iommufd_vdevice_destroy be called, before or after > iommufd_device_unbind. Before. > Now iommufd_vdevice_destroy (ref--) is after unbind, hits the if > (!refcount_dec_if_one(&obj->users)) check. Hmm, where do we have an iommufd_vdevice_destroy after unbind? > iommufd_device_bind > iommufd_device_attach > iommufd_vdevice_alloc_ioctl > > iommufd_device_detach > iommufd_device_unbind // refcount check fail > iommufd_vdevice_destroy ref-- Things should be symmetric. As you suspected, vdevice should be destroyed before iommufd_device_detach. A vdev is an object on top of a vIOMMU obj and an idev obj, so it takes a refcount from each of them. That's why idev couldn't unbind. Thanks Nicolin