Messages in this thread | | | From | Eric Lowe <> | Subject | RE: Process VM Addr to Kernel VM Addr at Interrupt Time. | Date | Thu, 29 Apr 1999 10:37:43 -0400 |
| |
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2448.0"> <TITLE>RE: Process VM Addr to Kernel VM Addr at Interrupt Time.</TITLE> </HEAD> <BODY>
<P><FONT SIZE=2>> > process, etc.</FONT> <BR><FONT SIZE=2>> > Without a mechanism to allow the driver to be notified the </FONT> <BR><FONT SIZE=2>> process has died</FONT> <BR><FONT SIZE=2>> > to stop the DMA disk buffers could be destroyed, processes </FONT> <BR><FONT SIZE=2>> overwritten, etc.</FONT> <BR><FONT SIZE=2>> > This is a BAD THING.</FONT> <BR><FONT SIZE=2>> </FONT> <BR><FONT SIZE=2>> When a kernel mapping is created for a given user-page. </FONT> <BR><FONT SIZE=2>> Doesn't the reference</FONT> <BR><FONT SIZE=2>> count for the page be "2", one for the user and one for </FONT> <BR><FONT SIZE=2>> the kernel. Doesn't </FONT> <BR><FONT SIZE=2>> the page structure maintain a reference count ?</FONT> <BR><FONT SIZE=2>> Also when a kernel mapping is created, shouldn't the page </FONT> <BR><FONT SIZE=2>> accquire a property</FONT> <BR><FONT SIZE=2>> of staying around, even if the user mapping goes off ? </FONT> <BR><FONT SIZE=2>> Because when the user</FONT> <BR><FONT SIZE=2>> process goes off the page * should * not go back to the </FONT> <BR><FONT SIZE=2>> free pool, but stay </FONT> <BR><FONT SIZE=2>> around as the "ref cnt" is now "1". Also it should always </FONT> <BR><FONT SIZE=2>> stay in memory, because</FONT> <BR><FONT SIZE=2>> the page is still locked. If a process was the only user </FONT> <BR><FONT SIZE=2>> for the page when</FONT> <BR><FONT SIZE=2>> the memory cleanup occurs as part of exit(), the page </FONT> <BR><FONT SIZE=2>> will go back to the free pool</FONT> <BR><FONT SIZE=2>> and lose its property of being locked. </FONT> </P>
<P><FONT SIZE=2>Yes. Someone please correct me if I'm wrong -- but since I'm using the PG_locked bit, when the reference count falls to 1 the kernel knows that it has the other reference, and frees the memory anyway. I have tested repeated allocations, locks, and killed the process with the buffer locked -- and the memory usage of the system doesn't go up, which seems to verify this is the case. Of course, I could get around this by setting PG_reserved, but that would make the memory unusable until reboot -- which would be evil. This is precisely the wrong kind of hack that makes Linus' hair stand up on end, as it should. :-)</FONT></P>
<P><FONT SIZE=2>> But i do accept one likely problem in such DMA's. In case </FONT> <BR><FONT SIZE=2>> the driver is waiting</FONT> <BR><FONT SIZE=2>> for the DMA to happen/complete and an un-advertised </FONT> <BR><FONT SIZE=2>> exit() happens:</FONT> </P>
<P><FONT SIZE=2>That's why a callback mechanism is necessary; or, alternatively, a way to access a process's page tables from a kernel thread that will still live after the process dies (but that also requires that the memory not be freed until after it's unlocked...)</FONT></P>
<P><FONT SIZE=2>> This will more likely cause kernel memory VM and the </FONT> <BR><FONT SIZE=2>> pages behind them to be eaten </FONT> <BR><FONT SIZE=2>> up, as there is no one to free them if the process goes </FONT> <BR><FONT SIZE=2>> off un-advertised. This </FONT> <BR><FONT SIZE=2>> is assuming that the process had called exit() in the </FONT> <BR><FONT SIZE=2>> interruptible blocking call </FONT> <BR><FONT SIZE=2>> itself on receipt of say a SIGSEGV ( for a multi-threaded </FONT> <BR><FONT SIZE=2>> case ), or some other</FONT> <BR><FONT SIZE=2>> fatal exit criteria.</FONT> <BR><FONT SIZE=2>> </FONT> <BR><FONT SIZE=2>> I have another question:</FONT> <BR><FONT SIZE=2>> Doesn't the above happen for the case for allocation of </FONT> <BR><FONT SIZE=2>> kernel buffers and mmap</FONT> <BR><FONT SIZE=2>> to the user ? I mean who will free the kernel buffers in </FONT> <BR><FONT SIZE=2>> this case ?</FONT> </P>
<P><FONT SIZE=2>The kernel. The real problem is this-- I need to be able to set a timer to go off regardless of whether or not the process that locked the pages is still around. I can't do that from the process context, since it is removed from the timer queue when the process goes away. A possible solution would be to do the work from a kernel thread that sleeps and wakes up when a timer goes off every so often and checks for buffers that have been locked but have a reference count of '1'. This adds overhead though, so I would think it would be more efficient to give this job to the swapper since it's already around...</FONT></P>
<P><FONT SIZE=2>--</FONT> <BR><FONT SIZE=2>Eric Lowe</FONT> <BR><FONT SIZE=2>elowe@systran.com</FONT> <BR><FONT SIZE=2>Software Engineer Co-op, Systran Corporation</FONT> <BR><FONT SIZE=2>937-252-5601 x330</FONT> </P> <BR> <BR>
</BODY> </HTML> | |