2 * Copyright (c) 2016, Mellanox Technologies inc. All rights reserved.
4 * This software is available to you under a choice of one of two
5 * licenses. You may choose to be licensed under the terms of the GNU
6 * General Public License (GPL) Version 2, available from the file
7 * COPYING in the main directory of this source tree, or the
8 * OpenIB.org BSD license below:
10 * Redistribution and use in source and binary forms, with or
11 * without modification, are permitted provided that the following
14 * - Redistributions of source code must retain the above
15 * copyright notice, this list of conditions and the following
18 * - Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following
20 * disclaimer in the documentation and/or other materials
21 * provided with the distribution.
23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33 #include <linux/file.h>
34 #include <linux/anon_inodes.h>
35 #include <linux/sched/mm.h>
36 #include <rdma/ib_verbs.h>
37 #include <rdma/uverbs_types.h>
38 #include <linux/rcupdate.h>
39 #include <rdma/uverbs_ioctl.h>
40 #include <rdma/rdma_user_ioctl.h>
42 #include "core_priv.h"
43 #include "rdma_core.h"
45 void uverbs_uobject_get(struct ib_uobject *uobject)
47 kref_get(&uobject->ref);
50 static void uverbs_uobject_free(struct kref *ref)
52 struct ib_uobject *uobj =
53 container_of(ref, struct ib_uobject, ref);
55 if (uobj->uapi_object->type_class->needs_kfree_rcu)
61 void uverbs_uobject_put(struct ib_uobject *uobject)
63 kref_put(&uobject->ref, uverbs_uobject_free);
66 static int uverbs_try_lock_object(struct ib_uobject *uobj,
67 enum rdma_lookup_mode mode)
70 * When a shared access is required, we use a positive counter. Each
71 * shared access request checks that the value != -1 and increment it.
72 * Exclusive access is required for operations like write or destroy.
73 * In exclusive access mode, we check that the counter is zero (nobody
74 * claimed this object) and we set it to -1. Releasing a shared access
75 * lock is done simply by decreasing the counter. As for exclusive
76 * access locks, since only a single one of them is is allowed
77 * concurrently, setting the counter to zero is enough for releasing
81 case UVERBS_LOOKUP_READ:
82 return atomic_fetch_add_unless(&uobj->usecnt, 1, -1) == -1 ?
84 case UVERBS_LOOKUP_WRITE:
85 /* lock is exclusive */
86 return atomic_cmpxchg(&uobj->usecnt, 0, -1) == 0 ? 0 : -EBUSY;
87 case UVERBS_LOOKUP_DESTROY:
93 static void assert_uverbs_usecnt(struct ib_uobject *uobj,
94 enum rdma_lookup_mode mode)
98 case UVERBS_LOOKUP_READ:
99 WARN_ON(atomic_read(&uobj->usecnt) <= 0);
101 case UVERBS_LOOKUP_WRITE:
102 WARN_ON(atomic_read(&uobj->usecnt) != -1);
104 case UVERBS_LOOKUP_DESTROY:
111 * This must be called with the hw_destroy_rwsem locked for read or write,
112 * also the uobject itself must be locked for write.
114 * Upon return the HW object is guaranteed to be destroyed.
116 * For RDMA_REMOVE_ABORT, the hw_destroy_rwsem is not required to be held,
117 * however the type's allocat_commit function cannot have been called and the
118 * uobject cannot be on the uobjects_lists
120 * For RDMA_REMOVE_DESTROY the caller shold be holding a kref (eg via
121 * rdma_lookup_get_uobject) and the object is left in a state where the caller
122 * needs to call rdma_lookup_put_uobject.
124 * For all other destroy modes this function internally unlocks the uobject
125 * and consumes the kref on the uobj.
127 static int uverbs_destroy_uobject(struct ib_uobject *uobj,
128 enum rdma_remove_reason reason)
130 struct ib_uverbs_file *ufile = uobj->ufile;
134 lockdep_assert_held(&ufile->hw_destroy_rwsem);
135 assert_uverbs_usecnt(uobj, UVERBS_LOOKUP_WRITE);
138 ret = uobj->uapi_object->type_class->destroy_hw(uobj, reason);
140 if (ib_is_destroy_retryable(ret, reason, uobj))
143 /* Nothing to be done, dangle the memory and move on */
145 "ib_uverbs: failed to remove uobject id %d, driver err=%d",
152 if (reason == RDMA_REMOVE_ABORT) {
153 WARN_ON(!list_empty(&uobj->list));
154 WARN_ON(!uobj->context);
155 uobj->uapi_object->type_class->alloc_abort(uobj);
158 uobj->context = NULL;
161 * For DESTROY the usecnt is not changed, the caller is expected to
162 * manage it via uobj_put_destroy(). Only DESTROY can remove the IDR
165 if (reason != RDMA_REMOVE_DESTROY)
166 atomic_set(&uobj->usecnt, 0);
168 uobj->uapi_object->type_class->remove_handle(uobj);
170 if (!list_empty(&uobj->list)) {
171 spin_lock_irqsave(&ufile->uobjects_lock, flags);
172 list_del_init(&uobj->list);
173 spin_unlock_irqrestore(&ufile->uobjects_lock, flags);
176 * Pairs with the get in rdma_alloc_commit_uobject(), could
179 uverbs_uobject_put(uobj);
183 * When aborting the stack kref remains owned by the core code, and is
184 * not transferred into the type. Pairs with the get in alloc_uobj
186 if (reason == RDMA_REMOVE_ABORT)
187 uverbs_uobject_put(uobj);
193 * This calls uverbs_destroy_uobject() using the RDMA_REMOVE_DESTROY
194 * sequence. It should only be used from command callbacks. On success the
195 * caller must pair this with uobj_put_destroy(). This
196 * version requires the caller to have already obtained an
197 * LOOKUP_DESTROY uobject kref.
199 int uobj_destroy(struct ib_uobject *uobj)
201 struct ib_uverbs_file *ufile = uobj->ufile;
204 down_read(&ufile->hw_destroy_rwsem);
207 * Once the uobject is destroyed by RDMA_REMOVE_DESTROY then it is left
208 * write locked as the callers put it back with UVERBS_LOOKUP_DESTROY.
209 * This is because any other concurrent thread can still see the object
210 * in the xarray due to RCU. Leaving it locked ensures nothing else will
213 ret = uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE);
217 ret = uverbs_destroy_uobject(uobj, RDMA_REMOVE_DESTROY);
219 atomic_set(&uobj->usecnt, 0);
224 up_read(&ufile->hw_destroy_rwsem);
229 * uobj_get_destroy destroys the HW object and returns a handle to the uobj
230 * with a NULL object pointer. The caller must pair this with
231 * uobj_put_destroy().
233 struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj,
234 u32 id, struct ib_uverbs_file *ufile)
236 struct ib_uobject *uobj;
239 uobj = rdma_lookup_get_uobject(obj, ufile, id, UVERBS_LOOKUP_DESTROY);
243 ret = uobj_destroy(uobj);
245 rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_DESTROY);
253 * Does both uobj_get_destroy() and uobj_put_destroy(). Returns success_res
254 * on success (negative errno on failure). For use by callers that do not need
257 int __uobj_perform_destroy(const struct uverbs_api_object *obj, u32 id,
258 struct ib_uverbs_file *ufile, int success_res)
260 struct ib_uobject *uobj;
262 uobj = __uobj_get_destroy(obj, id, ufile);
264 return PTR_ERR(uobj);
266 uobj_put_destroy(uobj);
270 /* alloc_uobj must be undone by uverbs_destroy_uobject() */
271 static struct ib_uobject *alloc_uobj(struct ib_uverbs_file *ufile,
272 const struct uverbs_api_object *obj)
274 struct ib_uobject *uobj;
275 struct ib_ucontext *ucontext;
277 ucontext = ib_uverbs_get_ucontext(ufile);
278 if (IS_ERR(ucontext))
279 return ERR_CAST(ucontext);
281 uobj = kzalloc(obj->type_attrs->obj_size, GFP_KERNEL);
283 return ERR_PTR(-ENOMEM);
285 * user_handle should be filled by the handler,
286 * The object is added to the list in the commit stage.
289 uobj->context = ucontext;
290 INIT_LIST_HEAD(&uobj->list);
291 uobj->uapi_object = obj;
293 * Allocated objects start out as write locked to deny any other
294 * syscalls from accessing them until they are committed. See
295 * rdma_alloc_commit_uobject
297 atomic_set(&uobj->usecnt, -1);
298 kref_init(&uobj->ref);
303 static int idr_add_uobj(struct ib_uobject *uobj)
307 idr_preload(GFP_KERNEL);
308 spin_lock(&uobj->ufile->idr_lock);
311 * We start with allocating an idr pointing to NULL. This represents an
312 * object which isn't initialized yet. We'll replace it later on with
313 * the real object once we commit.
315 ret = idr_alloc(&uobj->ufile->idr, NULL, 0,
316 min_t(unsigned long, U32_MAX - 1, INT_MAX), GFP_NOWAIT);
320 spin_unlock(&uobj->ufile->idr_lock);
323 return ret < 0 ? ret : 0;
326 /* Returns the ib_uobject or an error. The caller should check for IS_ERR. */
327 static struct ib_uobject *
328 lookup_get_idr_uobject(const struct uverbs_api_object *obj,
329 struct ib_uverbs_file *ufile, s64 id,
330 enum rdma_lookup_mode mode)
332 struct ib_uobject *uobj;
333 unsigned long idrno = id;
335 if (id < 0 || id > ULONG_MAX)
336 return ERR_PTR(-EINVAL);
339 /* object won't be released as we're protected in rcu */
340 uobj = idr_find(&ufile->idr, idrno);
342 uobj = ERR_PTR(-ENOENT);
347 * The idr_find is guaranteed to return a pointer to something that
348 * isn't freed yet, or NULL, as the free after idr_remove goes through
349 * kfree_rcu(). However the object may still have been released and
350 * kfree() could be called at any time.
352 if (!kref_get_unless_zero(&uobj->ref))
353 uobj = ERR_PTR(-ENOENT);
360 static struct ib_uobject *
361 lookup_get_fd_uobject(const struct uverbs_api_object *obj,
362 struct ib_uverbs_file *ufile, s64 id,
363 enum rdma_lookup_mode mode)
365 const struct uverbs_obj_fd_type *fd_type;
367 struct ib_uobject *uobject;
371 return ERR_PTR(-EINVAL);
373 if (mode != UVERBS_LOOKUP_READ)
374 return ERR_PTR(-EOPNOTSUPP);
376 if (!obj->type_attrs)
377 return ERR_PTR(-EIO);
379 container_of(obj->type_attrs, struct uverbs_obj_fd_type, type);
383 return ERR_PTR(-EBADF);
385 uobject = f->private_data;
387 * fget(id) ensures we are not currently running uverbs_close_fd,
388 * and the caller is expected to ensure that uverbs_close_fd is never
389 * done while a call top lookup is possible.
391 if (f->f_op != fd_type->fops || uobject->ufile != ufile) {
393 return ERR_PTR(-EBADF);
396 uverbs_uobject_get(uobject);
400 struct ib_uobject *rdma_lookup_get_uobject(const struct uverbs_api_object *obj,
401 struct ib_uverbs_file *ufile, s64 id,
402 enum rdma_lookup_mode mode)
404 struct ib_uobject *uobj;
408 return ERR_PTR(-EINVAL);
410 uobj = obj->type_class->lookup_get(obj, ufile, id, mode);
414 if (uobj->uapi_object != obj) {
420 * If we have been disassociated block every command except for
421 * DESTROY based commands.
423 if (mode != UVERBS_LOOKUP_DESTROY &&
424 !srcu_dereference(ufile->device->ib_dev,
425 &ufile->device->disassociate_srcu)) {
430 ret = uverbs_try_lock_object(uobj, mode);
436 obj->type_class->lookup_put(uobj, mode);
437 uverbs_uobject_put(uobj);
441 static struct ib_uobject *
442 alloc_begin_idr_uobject(const struct uverbs_api_object *obj,
443 struct ib_uverbs_file *ufile)
446 struct ib_uobject *uobj;
448 uobj = alloc_uobj(ufile, obj);
452 ret = idr_add_uobj(uobj);
456 ret = ib_rdmacg_try_charge(&uobj->cg_obj, uobj->context->device,
457 RDMACG_RESOURCE_HCA_OBJECT);
464 spin_lock(&ufile->idr_lock);
465 idr_remove(&ufile->idr, uobj->id);
466 spin_unlock(&ufile->idr_lock);
468 uverbs_uobject_put(uobj);
472 static struct ib_uobject *
473 alloc_begin_fd_uobject(const struct uverbs_api_object *obj,
474 struct ib_uverbs_file *ufile)
477 struct ib_uobject *uobj;
479 new_fd = get_unused_fd_flags(O_CLOEXEC);
481 return ERR_PTR(new_fd);
483 uobj = alloc_uobj(ufile, obj);
485 put_unused_fd(new_fd);
495 struct ib_uobject *rdma_alloc_begin_uobject(const struct uverbs_api_object *obj,
496 struct ib_uverbs_file *ufile)
498 struct ib_uobject *ret;
501 return ERR_PTR(-EINVAL);
504 * The hw_destroy_rwsem is held across the entire object creation and
505 * released during rdma_alloc_commit_uobject or
506 * rdma_alloc_abort_uobject
508 if (!down_read_trylock(&ufile->hw_destroy_rwsem))
509 return ERR_PTR(-EIO);
511 ret = obj->type_class->alloc_begin(obj, ufile);
513 up_read(&ufile->hw_destroy_rwsem);
519 static void alloc_abort_idr_uobject(struct ib_uobject *uobj)
521 ib_rdmacg_uncharge(&uobj->cg_obj, uobj->context->device,
522 RDMACG_RESOURCE_HCA_OBJECT);
524 spin_lock(&uobj->ufile->idr_lock);
525 idr_remove(&uobj->ufile->idr, uobj->id);
526 spin_unlock(&uobj->ufile->idr_lock);
529 static int __must_check destroy_hw_idr_uobject(struct ib_uobject *uobj,
530 enum rdma_remove_reason why)
532 const struct uverbs_obj_idr_type *idr_type =
533 container_of(uobj->uapi_object->type_attrs,
534 struct uverbs_obj_idr_type, type);
535 int ret = idr_type->destroy_object(uobj, why);
538 * We can only fail gracefully if the user requested to destroy the
539 * object or when a retry may be called upon an error.
540 * In the rest of the cases, just remove whatever you can.
542 if (ib_is_destroy_retryable(ret, why, uobj))
545 if (why == RDMA_REMOVE_ABORT)
548 ib_rdmacg_uncharge(&uobj->cg_obj, uobj->context->device,
549 RDMACG_RESOURCE_HCA_OBJECT);
554 static void remove_handle_idr_uobject(struct ib_uobject *uobj)
556 spin_lock(&uobj->ufile->idr_lock);
557 idr_remove(&uobj->ufile->idr, uobj->id);
558 spin_unlock(&uobj->ufile->idr_lock);
559 /* Matches the kref in alloc_commit_idr_uobject */
560 uverbs_uobject_put(uobj);
563 static void alloc_abort_fd_uobject(struct ib_uobject *uobj)
565 put_unused_fd(uobj->id);
568 static int __must_check destroy_hw_fd_uobject(struct ib_uobject *uobj,
569 enum rdma_remove_reason why)
571 const struct uverbs_obj_fd_type *fd_type = container_of(
572 uobj->uapi_object->type_attrs, struct uverbs_obj_fd_type, type);
573 int ret = fd_type->context_closed(uobj, why);
575 if (ib_is_destroy_retryable(ret, why, uobj))
581 static void remove_handle_fd_uobject(struct ib_uobject *uobj)
585 static int alloc_commit_idr_uobject(struct ib_uobject *uobj)
587 struct ib_uverbs_file *ufile = uobj->ufile;
589 spin_lock(&ufile->idr_lock);
591 * We already allocated this IDR with a NULL object, so
592 * this shouldn't fail.
594 * NOTE: Once we set the IDR we loose ownership of our kref on uobj.
595 * It will be put by remove_commit_idr_uobject()
597 WARN_ON(idr_replace(&ufile->idr, uobj, uobj->id));
598 spin_unlock(&ufile->idr_lock);
603 static int alloc_commit_fd_uobject(struct ib_uobject *uobj)
605 const struct uverbs_obj_fd_type *fd_type = container_of(
606 uobj->uapi_object->type_attrs, struct uverbs_obj_fd_type, type);
611 * The kref for uobj is moved into filp->private data and put in
612 * uverbs_close_fd(). Once alloc_commit() succeeds uverbs_close_fd()
613 * must be guaranteed to be called from the provided fops release
616 filp = anon_inode_getfile(fd_type->name,
621 return PTR_ERR(filp);
625 /* Matching put will be done in uverbs_close_fd() */
626 kref_get(&uobj->ufile->ref);
628 /* This shouldn't be used anymore. Use the file object instead */
632 * NOTE: Once we install the file we loose ownership of our kref on
633 * uobj. It will be put by uverbs_close_fd()
635 fd_install(fd, filp);
641 * In all cases rdma_alloc_commit_uobject() consumes the kref to uobj and the
642 * caller can no longer assume uobj is valid. If this function fails it
643 * destroys the uboject, including the attached HW object.
645 int __must_check rdma_alloc_commit_uobject(struct ib_uobject *uobj)
647 struct ib_uverbs_file *ufile = uobj->ufile;
650 /* alloc_commit consumes the uobj kref */
651 ret = uobj->uapi_object->type_class->alloc_commit(uobj);
653 uverbs_destroy_uobject(uobj, RDMA_REMOVE_ABORT);
654 up_read(&ufile->hw_destroy_rwsem);
658 /* kref is held so long as the uobj is on the uobj list. */
659 uverbs_uobject_get(uobj);
660 spin_lock_irq(&ufile->uobjects_lock);
661 list_add(&uobj->list, &ufile->uobjects);
662 spin_unlock_irq(&ufile->uobjects_lock);
664 /* matches atomic_set(-1) in alloc_uobj */
665 atomic_set(&uobj->usecnt, 0);
667 /* Matches the down_read in rdma_alloc_begin_uobject */
668 up_read(&ufile->hw_destroy_rwsem);
674 * This consumes the kref for uobj. It is up to the caller to unwind the HW
675 * object and anything else connected to uobj before calling this.
677 void rdma_alloc_abort_uobject(struct ib_uobject *uobj)
679 struct ib_uverbs_file *ufile = uobj->ufile;
682 uverbs_destroy_uobject(uobj, RDMA_REMOVE_ABORT);
684 /* Matches the down_read in rdma_alloc_begin_uobject */
685 up_read(&ufile->hw_destroy_rwsem);
688 static void lookup_put_idr_uobject(struct ib_uobject *uobj,
689 enum rdma_lookup_mode mode)
693 static void lookup_put_fd_uobject(struct ib_uobject *uobj,
694 enum rdma_lookup_mode mode)
696 struct file *filp = uobj->object;
698 WARN_ON(mode != UVERBS_LOOKUP_READ);
699 /* This indirectly calls uverbs_close_fd and free the object */
703 void rdma_lookup_put_uobject(struct ib_uobject *uobj,
704 enum rdma_lookup_mode mode)
706 assert_uverbs_usecnt(uobj, mode);
708 * In order to unlock an object, either decrease its usecnt for
709 * read access or zero it in case of exclusive access. See
710 * uverbs_try_lock_object for locking schema information.
713 case UVERBS_LOOKUP_READ:
714 atomic_dec(&uobj->usecnt);
716 case UVERBS_LOOKUP_WRITE:
717 atomic_set(&uobj->usecnt, 0);
719 case UVERBS_LOOKUP_DESTROY:
723 uobj->uapi_object->type_class->lookup_put(uobj, mode);
724 /* Pairs with the kref obtained by type->lookup_get */
725 uverbs_uobject_put(uobj);
728 void setup_ufile_idr_uobject(struct ib_uverbs_file *ufile)
730 spin_lock_init(&ufile->idr_lock);
731 idr_init(&ufile->idr);
734 void release_ufile_idr_uobject(struct ib_uverbs_file *ufile)
736 struct ib_uobject *entry;
740 * At this point uverbs_cleanup_ufile() is guaranteed to have run, and
741 * there are no HW objects left, however the IDR is still populated
742 * with anything that has not been cleaned up by userspace. Since the
743 * kref on ufile is 0, nothing is allowed to call lookup_get.
745 * This is an optimized equivalent to remove_handle_idr_uobject
747 idr_for_each_entry(&ufile->idr, entry, id) {
748 WARN_ON(entry->object);
749 uverbs_uobject_put(entry);
752 idr_destroy(&ufile->idr);
755 const struct uverbs_obj_type_class uverbs_idr_class = {
756 .alloc_begin = alloc_begin_idr_uobject,
757 .lookup_get = lookup_get_idr_uobject,
758 .alloc_commit = alloc_commit_idr_uobject,
759 .alloc_abort = alloc_abort_idr_uobject,
760 .lookup_put = lookup_put_idr_uobject,
761 .destroy_hw = destroy_hw_idr_uobject,
762 .remove_handle = remove_handle_idr_uobject,
764 * When we destroy an object, we first just lock it for WRITE and
765 * actually DESTROY it in the finalize stage. So, the problematic
766 * scenario is when we just started the finalize stage of the
767 * destruction (nothing was executed yet). Now, the other thread
768 * fetched the object for READ access, but it didn't lock it yet.
769 * The DESTROY thread continues and starts destroying the object.
770 * When the other thread continue - without the RCU, it would
771 * access freed memory. However, the rcu_read_lock delays the free
772 * until the rcu_read_lock of the READ operation quits. Since the
773 * exclusive lock of the object is still taken by the DESTROY flow, the
774 * READ operation will get -EBUSY and it'll just bail out.
776 .needs_kfree_rcu = true,
778 EXPORT_SYMBOL(uverbs_idr_class);
780 void uverbs_close_fd(struct file *f)
782 struct ib_uobject *uobj = f->private_data;
783 struct ib_uverbs_file *ufile = uobj->ufile;
785 if (down_read_trylock(&ufile->hw_destroy_rwsem)) {
787 * lookup_get_fd_uobject holds the kref on the struct file any
788 * time a FD uobj is locked, which prevents this release
789 * method from being invoked. Meaning we can always get the
790 * write lock here, or we have a kernel bug.
792 WARN_ON(uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE));
793 uverbs_destroy_uobject(uobj, RDMA_REMOVE_CLOSE);
794 up_read(&ufile->hw_destroy_rwsem);
797 /* Matches the get in alloc_begin_fd_uobject */
798 kref_put(&ufile->ref, ib_uverbs_release_file);
800 /* Pairs with filp->private_data in alloc_begin_fd_uobject */
801 uverbs_uobject_put(uobj);
804 static void ufile_disassociate_ucontext(struct ib_ucontext *ibcontext)
806 struct ib_device *ib_dev = ibcontext->device;
807 struct task_struct *owning_process = NULL;
808 struct mm_struct *owning_mm = NULL;
810 owning_process = get_pid_task(ibcontext->tgid, PIDTYPE_PID);
814 owning_mm = get_task_mm(owning_process);
816 pr_info("no mm, disassociate ucontext is pending task termination\n");
818 put_task_struct(owning_process);
819 usleep_range(1000, 2000);
820 owning_process = get_pid_task(ibcontext->tgid,
822 if (!owning_process ||
823 owning_process->state == TASK_DEAD) {
824 pr_info("disassociate ucontext done, task was terminated\n");
825 /* in case task was dead need to release the
829 put_task_struct(owning_process);
835 down_write(&owning_mm->mmap_sem);
836 ib_dev->disassociate_ucontext(ibcontext);
837 up_write(&owning_mm->mmap_sem);
839 put_task_struct(owning_process);
843 * Drop the ucontext off the ufile and completely disconnect it from the
846 static void ufile_destroy_ucontext(struct ib_uverbs_file *ufile,
847 enum rdma_remove_reason reason)
849 struct ib_ucontext *ucontext = ufile->ucontext;
852 if (reason == RDMA_REMOVE_DRIVER_REMOVE)
853 ufile_disassociate_ucontext(ucontext);
855 put_pid(ucontext->tgid);
856 ib_rdmacg_uncharge(&ucontext->cg_obj, ucontext->device,
857 RDMACG_RESOURCE_HCA_HANDLE);
860 * FIXME: Drivers are not permitted to fail dealloc_ucontext, remove
863 ret = ucontext->device->dealloc_ucontext(ucontext);
866 ufile->ucontext = NULL;
869 static int __uverbs_cleanup_ufile(struct ib_uverbs_file *ufile,
870 enum rdma_remove_reason reason)
872 struct ib_uobject *obj, *next_obj;
876 * This shouldn't run while executing other commands on this
877 * context. Thus, the only thing we should take care of is
878 * releasing a FD while traversing this list. The FD could be
879 * closed and released from the _release fop of this FD.
880 * In order to mitigate this, we add a lock.
881 * We take and release the lock per traversal in order to let
882 * other threads (which might still use the FDs) chance to run.
884 list_for_each_entry_safe(obj, next_obj, &ufile->uobjects, list) {
886 * if we hit this WARN_ON, that means we are
887 * racing with a lookup_get.
889 WARN_ON(uverbs_try_lock_object(obj, UVERBS_LOOKUP_WRITE));
890 if (!uverbs_destroy_uobject(obj, reason))
893 atomic_set(&obj->usecnt, 0);
899 * Destroy the uncontext and every uobject associated with it. If called with
900 * reason != RDMA_REMOVE_CLOSE this will not return until the destruction has
901 * been completed and ufile->ucontext is NULL.
903 * This is internally locked and can be called in parallel from multiple
906 void uverbs_destroy_ufile_hw(struct ib_uverbs_file *ufile,
907 enum rdma_remove_reason reason)
909 if (reason == RDMA_REMOVE_CLOSE) {
911 * During destruction we might trigger something that
912 * synchronously calls release on any file descriptor. For
913 * this reason all paths that come from file_operations
914 * release must use try_lock. They can progress knowing that
915 * there is an ongoing uverbs_destroy_ufile_hw that will clean
916 * up the driver resources.
918 if (!mutex_trylock(&ufile->ucontext_lock))
922 mutex_lock(&ufile->ucontext_lock);
925 down_write(&ufile->hw_destroy_rwsem);
928 * If a ucontext was never created then we can't have any uobjects to
929 * cleanup, nothing to do.
931 if (!ufile->ucontext)
934 ufile->ucontext->closing = true;
935 ufile->ucontext->cleanup_retryable = true;
936 while (!list_empty(&ufile->uobjects))
937 if (__uverbs_cleanup_ufile(ufile, reason)) {
939 * No entry was cleaned-up successfully during this
945 ufile->ucontext->cleanup_retryable = false;
946 if (!list_empty(&ufile->uobjects))
947 __uverbs_cleanup_ufile(ufile, reason);
949 ufile_destroy_ucontext(ufile, reason);
952 up_write(&ufile->hw_destroy_rwsem);
953 mutex_unlock(&ufile->ucontext_lock);
956 const struct uverbs_obj_type_class uverbs_fd_class = {
957 .alloc_begin = alloc_begin_fd_uobject,
958 .lookup_get = lookup_get_fd_uobject,
959 .alloc_commit = alloc_commit_fd_uobject,
960 .alloc_abort = alloc_abort_fd_uobject,
961 .lookup_put = lookup_put_fd_uobject,
962 .destroy_hw = destroy_hw_fd_uobject,
963 .remove_handle = remove_handle_fd_uobject,
964 .needs_kfree_rcu = false,
966 EXPORT_SYMBOL(uverbs_fd_class);
969 uverbs_get_uobject_from_file(u16 object_id,
970 struct ib_uverbs_file *ufile,
971 enum uverbs_obj_access access, s64 id)
973 const struct uverbs_api_object *obj =
974 uapi_get_object(ufile->device->uapi, object_id);
977 case UVERBS_ACCESS_READ:
978 return rdma_lookup_get_uobject(obj, ufile, id,
980 case UVERBS_ACCESS_DESTROY:
981 /* Actual destruction is done inside uverbs_handle_method */
982 return rdma_lookup_get_uobject(obj, ufile, id,
983 UVERBS_LOOKUP_DESTROY);
984 case UVERBS_ACCESS_WRITE:
985 return rdma_lookup_get_uobject(obj, ufile, id,
986 UVERBS_LOOKUP_WRITE);
987 case UVERBS_ACCESS_NEW:
988 return rdma_alloc_begin_uobject(obj, ufile);
991 return ERR_PTR(-EOPNOTSUPP);
995 int uverbs_finalize_object(struct ib_uobject *uobj,
996 enum uverbs_obj_access access,
1002 * refcounts should be handled at the object level and not at the
1003 * uobject level. Refcounts of the objects themselves are done in
1008 case UVERBS_ACCESS_READ:
1009 rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_READ);
1011 case UVERBS_ACCESS_WRITE:
1012 rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE);
1014 case UVERBS_ACCESS_DESTROY:
1016 rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_DESTROY);
1018 case UVERBS_ACCESS_NEW:
1020 ret = rdma_alloc_commit_uobject(uobj);
1022 rdma_alloc_abort_uobject(uobj);