mirror of https://gitee.com/openkylin/linux.git
825 lines
22 KiB
C
825 lines
22 KiB
C
/*
|
|
* Copyright (c) 2016, Mellanox Technologies inc. All rights reserved.
|
|
*
|
|
* This software is available to you under a choice of one of two
|
|
* licenses. You may choose to be licensed under the terms of the GNU
|
|
* General Public License (GPL) Version 2, available from the file
|
|
* COPYING in the main directory of this source tree, or the
|
|
* OpenIB.org BSD license below:
|
|
*
|
|
* Redistribution and use in source and binary forms, with or
|
|
* without modification, are permitted provided that the following
|
|
* conditions are met:
|
|
*
|
|
* - Redistributions of source code must retain the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer.
|
|
*
|
|
* - Redistributions in binary form must reproduce the above
|
|
* copyright notice, this list of conditions and the following
|
|
* disclaimer in the documentation and/or other materials
|
|
* provided with the distribution.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
|
|
* BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
|
|
* ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
|
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
* SOFTWARE.
|
|
*/
|
|
|
|
#include <linux/file.h>
|
|
#include <linux/anon_inodes.h>
|
|
#include <rdma/ib_verbs.h>
|
|
#include <rdma/uverbs_types.h>
|
|
#include <linux/rcupdate.h>
|
|
#include <rdma/uverbs_ioctl.h>
|
|
#include <rdma/rdma_user_ioctl.h>
|
|
#include "uverbs.h"
|
|
#include "core_priv.h"
|
|
#include "rdma_core.h"
|
|
|
|
int uverbs_ns_idx(u16 *id, unsigned int ns_count)
|
|
{
|
|
int ret = (*id & UVERBS_ID_NS_MASK) >> UVERBS_ID_NS_SHIFT;
|
|
|
|
if (ret >= ns_count)
|
|
return -EINVAL;
|
|
|
|
*id &= ~UVERBS_ID_NS_MASK;
|
|
return ret;
|
|
}
|
|
|
|
const struct uverbs_object_spec *uverbs_get_object(const struct ib_device *ibdev,
|
|
uint16_t object)
|
|
{
|
|
const struct uverbs_root_spec *object_hash = ibdev->specs_root;
|
|
const struct uverbs_object_spec_hash *objects;
|
|
int ret = uverbs_ns_idx(&object, object_hash->num_buckets);
|
|
|
|
if (ret < 0)
|
|
return NULL;
|
|
|
|
objects = object_hash->object_buckets[ret];
|
|
|
|
if (object >= objects->num_objects)
|
|
return NULL;
|
|
|
|
return objects->objects[object];
|
|
}
|
|
|
|
const struct uverbs_method_spec *uverbs_get_method(const struct uverbs_object_spec *object,
|
|
uint16_t method)
|
|
{
|
|
const struct uverbs_method_spec_hash *methods;
|
|
int ret = uverbs_ns_idx(&method, object->num_buckets);
|
|
|
|
if (ret < 0)
|
|
return NULL;
|
|
|
|
methods = object->method_buckets[ret];
|
|
if (method >= methods->num_methods)
|
|
return NULL;
|
|
|
|
return methods->methods[method];
|
|
}
|
|
|
|
void uverbs_uobject_get(struct ib_uobject *uobject)
|
|
{
|
|
kref_get(&uobject->ref);
|
|
}
|
|
|
|
static void uverbs_uobject_free(struct kref *ref)
|
|
{
|
|
struct ib_uobject *uobj =
|
|
container_of(ref, struct ib_uobject, ref);
|
|
|
|
if (uobj->type->type_class->needs_kfree_rcu)
|
|
kfree_rcu(uobj, rcu);
|
|
else
|
|
kfree(uobj);
|
|
}
|
|
|
|
void uverbs_uobject_put(struct ib_uobject *uobject)
|
|
{
|
|
kref_put(&uobject->ref, uverbs_uobject_free);
|
|
}
|
|
|
|
static int uverbs_try_lock_object(struct ib_uobject *uobj, bool exclusive)
|
|
{
|
|
/*
|
|
* When a shared access is required, we use a positive counter. Each
|
|
* shared access request checks that the value != -1 and increment it.
|
|
* Exclusive access is required for operations like write or destroy.
|
|
* In exclusive access mode, we check that the counter is zero (nobody
|
|
* claimed this object) and we set it to -1. Releasing a shared access
|
|
* lock is done simply by decreasing the counter. As for exclusive
|
|
* access locks, since only a single one of them is is allowed
|
|
* concurrently, setting the counter to zero is enough for releasing
|
|
* this lock.
|
|
*/
|
|
if (!exclusive)
|
|
return __atomic_add_unless(&uobj->usecnt, 1, -1) == -1 ?
|
|
-EBUSY : 0;
|
|
|
|
/* lock is either WRITE or DESTROY - should be exclusive */
|
|
return atomic_cmpxchg(&uobj->usecnt, 0, -1) == 0 ? 0 : -EBUSY;
|
|
}
|
|
|
|
static struct ib_uobject *alloc_uobj(struct ib_ucontext *context,
|
|
const struct uverbs_obj_type *type)
|
|
{
|
|
struct ib_uobject *uobj = kzalloc(type->obj_size, GFP_KERNEL);
|
|
|
|
if (!uobj)
|
|
return ERR_PTR(-ENOMEM);
|
|
/*
|
|
* user_handle should be filled by the handler,
|
|
* The object is added to the list in the commit stage.
|
|
*/
|
|
uobj->context = context;
|
|
uobj->type = type;
|
|
/*
|
|
* Allocated objects start out as write locked to deny any other
|
|
* syscalls from accessing them until they are committed. See
|
|
* rdma_alloc_commit_uobject
|
|
*/
|
|
atomic_set(&uobj->usecnt, -1);
|
|
kref_init(&uobj->ref);
|
|
|
|
return uobj;
|
|
}
|
|
|
|
static int idr_add_uobj(struct ib_uobject *uobj)
|
|
{
|
|
int ret;
|
|
|
|
idr_preload(GFP_KERNEL);
|
|
spin_lock(&uobj->context->ufile->idr_lock);
|
|
|
|
/*
|
|
* We start with allocating an idr pointing to NULL. This represents an
|
|
* object which isn't initialized yet. We'll replace it later on with
|
|
* the real object once we commit.
|
|
*/
|
|
ret = idr_alloc(&uobj->context->ufile->idr, NULL, 0,
|
|
min_t(unsigned long, U32_MAX - 1, INT_MAX), GFP_NOWAIT);
|
|
if (ret >= 0)
|
|
uobj->id = ret;
|
|
|
|
spin_unlock(&uobj->context->ufile->idr_lock);
|
|
idr_preload_end();
|
|
|
|
return ret < 0 ? ret : 0;
|
|
}
|
|
|
|
/*
|
|
* It only removes it from the uobjects list, uverbs_uobject_put() is still
|
|
* required.
|
|
*/
|
|
static void uverbs_idr_remove_uobj(struct ib_uobject *uobj)
|
|
{
|
|
spin_lock(&uobj->context->ufile->idr_lock);
|
|
idr_remove(&uobj->context->ufile->idr, uobj->id);
|
|
spin_unlock(&uobj->context->ufile->idr_lock);
|
|
}
|
|
|
|
/* Returns the ib_uobject or an error. The caller should check for IS_ERR. */
|
|
static struct ib_uobject *lookup_get_idr_uobject(const struct uverbs_obj_type *type,
|
|
struct ib_ucontext *ucontext,
|
|
int id, bool exclusive)
|
|
{
|
|
struct ib_uobject *uobj;
|
|
|
|
rcu_read_lock();
|
|
/* object won't be released as we're protected in rcu */
|
|
uobj = idr_find(&ucontext->ufile->idr, id);
|
|
if (!uobj) {
|
|
uobj = ERR_PTR(-ENOENT);
|
|
goto free;
|
|
}
|
|
|
|
/*
|
|
* The idr_find is guaranteed to return a pointer to something that
|
|
* isn't freed yet, or NULL, as the free after idr_remove goes through
|
|
* kfree_rcu(). However the object may still have been released and
|
|
* kfree() could be called at any time.
|
|
*/
|
|
if (!kref_get_unless_zero(&uobj->ref))
|
|
uobj = ERR_PTR(-ENOENT);
|
|
|
|
free:
|
|
rcu_read_unlock();
|
|
return uobj;
|
|
}
|
|
|
|
static struct ib_uobject *lookup_get_fd_uobject(const struct uverbs_obj_type *type,
|
|
struct ib_ucontext *ucontext,
|
|
int id, bool exclusive)
|
|
{
|
|
struct file *f;
|
|
struct ib_uobject *uobject;
|
|
const struct uverbs_obj_fd_type *fd_type =
|
|
container_of(type, struct uverbs_obj_fd_type, type);
|
|
|
|
if (exclusive)
|
|
return ERR_PTR(-EOPNOTSUPP);
|
|
|
|
f = fget(id);
|
|
if (!f)
|
|
return ERR_PTR(-EBADF);
|
|
|
|
uobject = f->private_data;
|
|
/*
|
|
* fget(id) ensures we are not currently running uverbs_close_fd,
|
|
* and the caller is expected to ensure that uverbs_close_fd is never
|
|
* done while a call top lookup is possible.
|
|
*/
|
|
if (f->f_op != fd_type->fops) {
|
|
fput(f);
|
|
return ERR_PTR(-EBADF);
|
|
}
|
|
|
|
uverbs_uobject_get(uobject);
|
|
return uobject;
|
|
}
|
|
|
|
struct ib_uobject *rdma_lookup_get_uobject(const struct uverbs_obj_type *type,
|
|
struct ib_ucontext *ucontext,
|
|
int id, bool exclusive)
|
|
{
|
|
struct ib_uobject *uobj;
|
|
int ret;
|
|
|
|
uobj = type->type_class->lookup_get(type, ucontext, id, exclusive);
|
|
if (IS_ERR(uobj))
|
|
return uobj;
|
|
|
|
if (uobj->type != type) {
|
|
ret = -EINVAL;
|
|
goto free;
|
|
}
|
|
|
|
ret = uverbs_try_lock_object(uobj, exclusive);
|
|
if (ret) {
|
|
WARN(ucontext->cleanup_reason,
|
|
"ib_uverbs: Trying to lookup_get while cleanup context\n");
|
|
goto free;
|
|
}
|
|
|
|
return uobj;
|
|
free:
|
|
uobj->type->type_class->lookup_put(uobj, exclusive);
|
|
uverbs_uobject_put(uobj);
|
|
return ERR_PTR(ret);
|
|
}
|
|
|
|
static struct ib_uobject *alloc_begin_idr_uobject(const struct uverbs_obj_type *type,
|
|
struct ib_ucontext *ucontext)
|
|
{
|
|
int ret;
|
|
struct ib_uobject *uobj;
|
|
|
|
uobj = alloc_uobj(ucontext, type);
|
|
if (IS_ERR(uobj))
|
|
return uobj;
|
|
|
|
ret = idr_add_uobj(uobj);
|
|
if (ret)
|
|
goto uobj_put;
|
|
|
|
ret = ib_rdmacg_try_charge(&uobj->cg_obj, ucontext->device,
|
|
RDMACG_RESOURCE_HCA_OBJECT);
|
|
if (ret)
|
|
goto idr_remove;
|
|
|
|
return uobj;
|
|
|
|
idr_remove:
|
|
uverbs_idr_remove_uobj(uobj);
|
|
uobj_put:
|
|
uverbs_uobject_put(uobj);
|
|
return ERR_PTR(ret);
|
|
}
|
|
|
|
static struct ib_uobject *alloc_begin_fd_uobject(const struct uverbs_obj_type *type,
|
|
struct ib_ucontext *ucontext)
|
|
{
|
|
const struct uverbs_obj_fd_type *fd_type =
|
|
container_of(type, struct uverbs_obj_fd_type, type);
|
|
int new_fd;
|
|
struct ib_uobject *uobj;
|
|
struct ib_uobject_file *uobj_file;
|
|
struct file *filp;
|
|
|
|
new_fd = get_unused_fd_flags(O_CLOEXEC);
|
|
if (new_fd < 0)
|
|
return ERR_PTR(new_fd);
|
|
|
|
uobj = alloc_uobj(ucontext, type);
|
|
if (IS_ERR(uobj)) {
|
|
put_unused_fd(new_fd);
|
|
return uobj;
|
|
}
|
|
|
|
uobj_file = container_of(uobj, struct ib_uobject_file, uobj);
|
|
filp = anon_inode_getfile(fd_type->name,
|
|
fd_type->fops,
|
|
uobj_file,
|
|
fd_type->flags);
|
|
if (IS_ERR(filp)) {
|
|
put_unused_fd(new_fd);
|
|
uverbs_uobject_put(uobj);
|
|
return (void *)filp;
|
|
}
|
|
|
|
uobj_file->uobj.id = new_fd;
|
|
uobj_file->uobj.object = filp;
|
|
uobj_file->ufile = ucontext->ufile;
|
|
INIT_LIST_HEAD(&uobj->list);
|
|
kref_get(&uobj_file->ufile->ref);
|
|
|
|
return uobj;
|
|
}
|
|
|
|
struct ib_uobject *rdma_alloc_begin_uobject(const struct uverbs_obj_type *type,
|
|
struct ib_ucontext *ucontext)
|
|
{
|
|
return type->type_class->alloc_begin(type, ucontext);
|
|
}
|
|
|
|
static void uverbs_uobject_add(struct ib_uobject *uobject)
|
|
{
|
|
mutex_lock(&uobject->context->uobjects_lock);
|
|
list_add(&uobject->list, &uobject->context->uobjects);
|
|
mutex_unlock(&uobject->context->uobjects_lock);
|
|
}
|
|
|
|
static int __must_check remove_commit_idr_uobject(struct ib_uobject *uobj,
|
|
enum rdma_remove_reason why)
|
|
{
|
|
const struct uverbs_obj_idr_type *idr_type =
|
|
container_of(uobj->type, struct uverbs_obj_idr_type,
|
|
type);
|
|
int ret = idr_type->destroy_object(uobj, why);
|
|
|
|
/*
|
|
* We can only fail gracefully if the user requested to destroy the
|
|
* object. In the rest of the cases, just remove whatever you can.
|
|
*/
|
|
if (why == RDMA_REMOVE_DESTROY && ret)
|
|
return ret;
|
|
|
|
ib_rdmacg_uncharge(&uobj->cg_obj, uobj->context->device,
|
|
RDMACG_RESOURCE_HCA_OBJECT);
|
|
uverbs_idr_remove_uobj(uobj);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void alloc_abort_fd_uobject(struct ib_uobject *uobj)
|
|
{
|
|
struct ib_uobject_file *uobj_file =
|
|
container_of(uobj, struct ib_uobject_file, uobj);
|
|
struct file *filp = uobj->object;
|
|
int id = uobj_file->uobj.id;
|
|
|
|
/* Unsuccessful NEW */
|
|
fput(filp);
|
|
put_unused_fd(id);
|
|
}
|
|
|
|
static int __must_check remove_commit_fd_uobject(struct ib_uobject *uobj,
|
|
enum rdma_remove_reason why)
|
|
{
|
|
const struct uverbs_obj_fd_type *fd_type =
|
|
container_of(uobj->type, struct uverbs_obj_fd_type, type);
|
|
struct ib_uobject_file *uobj_file =
|
|
container_of(uobj, struct ib_uobject_file, uobj);
|
|
int ret = fd_type->context_closed(uobj_file, why);
|
|
|
|
if (why == RDMA_REMOVE_DESTROY && ret)
|
|
return ret;
|
|
|
|
if (why == RDMA_REMOVE_DURING_CLEANUP) {
|
|
alloc_abort_fd_uobject(uobj);
|
|
return ret;
|
|
}
|
|
|
|
uobj_file->uobj.context = NULL;
|
|
return ret;
|
|
}
|
|
|
|
static void assert_uverbs_usecnt(struct ib_uobject *uobj, bool exclusive)
|
|
{
|
|
#ifdef CONFIG_LOCKDEP
|
|
if (exclusive)
|
|
WARN_ON(atomic_read(&uobj->usecnt) != -1);
|
|
else
|
|
WARN_ON(atomic_read(&uobj->usecnt) <= 0);
|
|
#endif
|
|
}
|
|
|
|
static int __must_check _rdma_remove_commit_uobject(struct ib_uobject *uobj,
|
|
enum rdma_remove_reason why)
|
|
{
|
|
int ret;
|
|
struct ib_ucontext *ucontext = uobj->context;
|
|
|
|
ret = uobj->type->type_class->remove_commit(uobj, why);
|
|
if (ret && why == RDMA_REMOVE_DESTROY) {
|
|
/* We couldn't remove the object, so just unlock the uobject */
|
|
atomic_set(&uobj->usecnt, 0);
|
|
uobj->type->type_class->lookup_put(uobj, true);
|
|
} else {
|
|
mutex_lock(&ucontext->uobjects_lock);
|
|
list_del(&uobj->list);
|
|
mutex_unlock(&ucontext->uobjects_lock);
|
|
/* put the ref we took when we created the object */
|
|
uverbs_uobject_put(uobj);
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
/* This is called only for user requested DESTROY reasons */
|
|
int __must_check rdma_remove_commit_uobject(struct ib_uobject *uobj)
|
|
{
|
|
int ret;
|
|
struct ib_ucontext *ucontext = uobj->context;
|
|
|
|
/* put the ref count we took at lookup_get */
|
|
uverbs_uobject_put(uobj);
|
|
/* Cleanup is running. Calling this should have been impossible */
|
|
if (!down_read_trylock(&ucontext->cleanup_rwsem)) {
|
|
WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
|
|
return 0;
|
|
}
|
|
assert_uverbs_usecnt(uobj, true);
|
|
ret = _rdma_remove_commit_uobject(uobj, RDMA_REMOVE_DESTROY);
|
|
|
|
up_read(&ucontext->cleanup_rwsem);
|
|
return ret;
|
|
}
|
|
|
|
static int null_obj_type_class_remove_commit(struct ib_uobject *uobj,
|
|
enum rdma_remove_reason why)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static const struct uverbs_obj_type null_obj_type = {
|
|
.type_class = &((const struct uverbs_obj_type_class){
|
|
.remove_commit = null_obj_type_class_remove_commit,
|
|
/* be cautious */
|
|
.needs_kfree_rcu = true}),
|
|
};
|
|
|
|
int rdma_explicit_destroy(struct ib_uobject *uobject)
|
|
{
|
|
int ret;
|
|
struct ib_ucontext *ucontext = uobject->context;
|
|
|
|
/* Cleanup is running. Calling this should have been impossible */
|
|
if (!down_read_trylock(&ucontext->cleanup_rwsem)) {
|
|
WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n");
|
|
return 0;
|
|
}
|
|
assert_uverbs_usecnt(uobject, true);
|
|
ret = uobject->type->type_class->remove_commit(uobject,
|
|
RDMA_REMOVE_DESTROY);
|
|
if (ret)
|
|
goto out;
|
|
|
|
uobject->type = &null_obj_type;
|
|
|
|
out:
|
|
up_read(&ucontext->cleanup_rwsem);
|
|
return ret;
|
|
}
|
|
|
|
static void alloc_commit_idr_uobject(struct ib_uobject *uobj)
|
|
{
|
|
uverbs_uobject_add(uobj);
|
|
spin_lock(&uobj->context->ufile->idr_lock);
|
|
/*
|
|
* We already allocated this IDR with a NULL object, so
|
|
* this shouldn't fail.
|
|
*/
|
|
WARN_ON(idr_replace(&uobj->context->ufile->idr,
|
|
uobj, uobj->id));
|
|
spin_unlock(&uobj->context->ufile->idr_lock);
|
|
}
|
|
|
|
static void alloc_commit_fd_uobject(struct ib_uobject *uobj)
|
|
{
|
|
struct ib_uobject_file *uobj_file =
|
|
container_of(uobj, struct ib_uobject_file, uobj);
|
|
|
|
uverbs_uobject_add(&uobj_file->uobj);
|
|
fd_install(uobj_file->uobj.id, uobj->object);
|
|
/* This shouldn't be used anymore. Use the file object instead */
|
|
uobj_file->uobj.id = 0;
|
|
/* Get another reference as we export this to the fops */
|
|
uverbs_uobject_get(&uobj_file->uobj);
|
|
}
|
|
|
|
int rdma_alloc_commit_uobject(struct ib_uobject *uobj)
|
|
{
|
|
/* Cleanup is running. Calling this should have been impossible */
|
|
if (!down_read_trylock(&uobj->context->cleanup_rwsem)) {
|
|
int ret;
|
|
|
|
WARN(true, "ib_uverbs: Cleanup is running while allocating an uobject\n");
|
|
ret = uobj->type->type_class->remove_commit(uobj,
|
|
RDMA_REMOVE_DURING_CLEANUP);
|
|
if (ret)
|
|
pr_warn("ib_uverbs: cleanup of idr object %d failed\n",
|
|
uobj->id);
|
|
return ret;
|
|
}
|
|
|
|
/* matches atomic_set(-1) in alloc_uobj */
|
|
assert_uverbs_usecnt(uobj, true);
|
|
atomic_set(&uobj->usecnt, 0);
|
|
|
|
uobj->type->type_class->alloc_commit(uobj);
|
|
up_read(&uobj->context->cleanup_rwsem);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void alloc_abort_idr_uobject(struct ib_uobject *uobj)
|
|
{
|
|
uverbs_idr_remove_uobj(uobj);
|
|
ib_rdmacg_uncharge(&uobj->cg_obj, uobj->context->device,
|
|
RDMACG_RESOURCE_HCA_OBJECT);
|
|
uverbs_uobject_put(uobj);
|
|
}
|
|
|
|
void rdma_alloc_abort_uobject(struct ib_uobject *uobj)
|
|
{
|
|
uobj->type->type_class->alloc_abort(uobj);
|
|
}
|
|
|
|
static void lookup_put_idr_uobject(struct ib_uobject *uobj, bool exclusive)
|
|
{
|
|
}
|
|
|
|
static void lookup_put_fd_uobject(struct ib_uobject *uobj, bool exclusive)
|
|
{
|
|
struct file *filp = uobj->object;
|
|
|
|
WARN_ON(exclusive);
|
|
/* This indirectly calls uverbs_close_fd and free the object */
|
|
fput(filp);
|
|
}
|
|
|
|
void rdma_lookup_put_uobject(struct ib_uobject *uobj, bool exclusive)
|
|
{
|
|
assert_uverbs_usecnt(uobj, exclusive);
|
|
uobj->type->type_class->lookup_put(uobj, exclusive);
|
|
/*
|
|
* In order to unlock an object, either decrease its usecnt for
|
|
* read access or zero it in case of exclusive access. See
|
|
* uverbs_try_lock_object for locking schema information.
|
|
*/
|
|
if (!exclusive)
|
|
atomic_dec(&uobj->usecnt);
|
|
else
|
|
atomic_set(&uobj->usecnt, 0);
|
|
|
|
uverbs_uobject_put(uobj);
|
|
}
|
|
|
|
const struct uverbs_obj_type_class uverbs_idr_class = {
|
|
.alloc_begin = alloc_begin_idr_uobject,
|
|
.lookup_get = lookup_get_idr_uobject,
|
|
.alloc_commit = alloc_commit_idr_uobject,
|
|
.alloc_abort = alloc_abort_idr_uobject,
|
|
.lookup_put = lookup_put_idr_uobject,
|
|
.remove_commit = remove_commit_idr_uobject,
|
|
/*
|
|
* When we destroy an object, we first just lock it for WRITE and
|
|
* actually DESTROY it in the finalize stage. So, the problematic
|
|
* scenario is when we just started the finalize stage of the
|
|
* destruction (nothing was executed yet). Now, the other thread
|
|
* fetched the object for READ access, but it didn't lock it yet.
|
|
* The DESTROY thread continues and starts destroying the object.
|
|
* When the other thread continue - without the RCU, it would
|
|
* access freed memory. However, the rcu_read_lock delays the free
|
|
* until the rcu_read_lock of the READ operation quits. Since the
|
|
* exclusive lock of the object is still taken by the DESTROY flow, the
|
|
* READ operation will get -EBUSY and it'll just bail out.
|
|
*/
|
|
.needs_kfree_rcu = true,
|
|
};
|
|
|
|
static void _uverbs_close_fd(struct ib_uobject_file *uobj_file)
|
|
{
|
|
struct ib_ucontext *ucontext;
|
|
struct ib_uverbs_file *ufile = uobj_file->ufile;
|
|
int ret;
|
|
|
|
mutex_lock(&uobj_file->ufile->cleanup_mutex);
|
|
|
|
/* uobject was either already cleaned up or is cleaned up right now anyway */
|
|
if (!uobj_file->uobj.context ||
|
|
!down_read_trylock(&uobj_file->uobj.context->cleanup_rwsem))
|
|
goto unlock;
|
|
|
|
ucontext = uobj_file->uobj.context;
|
|
ret = _rdma_remove_commit_uobject(&uobj_file->uobj, RDMA_REMOVE_CLOSE);
|
|
up_read(&ucontext->cleanup_rwsem);
|
|
if (ret)
|
|
pr_warn("uverbs: unable to clean up uobject file in uverbs_close_fd.\n");
|
|
unlock:
|
|
mutex_unlock(&ufile->cleanup_mutex);
|
|
}
|
|
|
|
void uverbs_close_fd(struct file *f)
|
|
{
|
|
struct ib_uobject_file *uobj_file = f->private_data;
|
|
struct kref *uverbs_file_ref = &uobj_file->ufile->ref;
|
|
|
|
_uverbs_close_fd(uobj_file);
|
|
uverbs_uobject_put(&uobj_file->uobj);
|
|
kref_put(uverbs_file_ref, ib_uverbs_release_file);
|
|
}
|
|
|
|
void uverbs_cleanup_ucontext(struct ib_ucontext *ucontext, bool device_removed)
|
|
{
|
|
enum rdma_remove_reason reason = device_removed ?
|
|
RDMA_REMOVE_DRIVER_REMOVE : RDMA_REMOVE_CLOSE;
|
|
unsigned int cur_order = 0;
|
|
|
|
ucontext->cleanup_reason = reason;
|
|
/*
|
|
* Waits for all remove_commit and alloc_commit to finish. Logically, We
|
|
* want to hold this forever as the context is going to be destroyed,
|
|
* but we'll release it since it causes a "held lock freed" BUG message.
|
|
*/
|
|
down_write(&ucontext->cleanup_rwsem);
|
|
|
|
while (!list_empty(&ucontext->uobjects)) {
|
|
struct ib_uobject *obj, *next_obj;
|
|
unsigned int next_order = UINT_MAX;
|
|
|
|
/*
|
|
* This shouldn't run while executing other commands on this
|
|
* context. Thus, the only thing we should take care of is
|
|
* releasing a FD while traversing this list. The FD could be
|
|
* closed and released from the _release fop of this FD.
|
|
* In order to mitigate this, we add a lock.
|
|
* We take and release the lock per order traversal in order
|
|
* to let other threads (which might still use the FDs) chance
|
|
* to run.
|
|
*/
|
|
mutex_lock(&ucontext->uobjects_lock);
|
|
list_for_each_entry_safe(obj, next_obj, &ucontext->uobjects,
|
|
list) {
|
|
if (obj->type->destroy_order == cur_order) {
|
|
int ret;
|
|
|
|
/*
|
|
* if we hit this WARN_ON, that means we are
|
|
* racing with a lookup_get.
|
|
*/
|
|
WARN_ON(uverbs_try_lock_object(obj, true));
|
|
ret = obj->type->type_class->remove_commit(obj,
|
|
reason);
|
|
list_del(&obj->list);
|
|
if (ret)
|
|
pr_warn("ib_uverbs: failed to remove uobject id %d order %u\n",
|
|
obj->id, cur_order);
|
|
/* put the ref we took when we created the object */
|
|
uverbs_uobject_put(obj);
|
|
} else {
|
|
next_order = min(next_order,
|
|
obj->type->destroy_order);
|
|
}
|
|
}
|
|
mutex_unlock(&ucontext->uobjects_lock);
|
|
cur_order = next_order;
|
|
}
|
|
up_write(&ucontext->cleanup_rwsem);
|
|
}
|
|
|
|
void uverbs_initialize_ucontext(struct ib_ucontext *ucontext)
|
|
{
|
|
ucontext->cleanup_reason = 0;
|
|
mutex_init(&ucontext->uobjects_lock);
|
|
INIT_LIST_HEAD(&ucontext->uobjects);
|
|
init_rwsem(&ucontext->cleanup_rwsem);
|
|
}
|
|
|
|
const struct uverbs_obj_type_class uverbs_fd_class = {
|
|
.alloc_begin = alloc_begin_fd_uobject,
|
|
.lookup_get = lookup_get_fd_uobject,
|
|
.alloc_commit = alloc_commit_fd_uobject,
|
|
.alloc_abort = alloc_abort_fd_uobject,
|
|
.lookup_put = lookup_put_fd_uobject,
|
|
.remove_commit = remove_commit_fd_uobject,
|
|
.needs_kfree_rcu = false,
|
|
};
|
|
|
|
struct ib_uobject *uverbs_get_uobject_from_context(const struct uverbs_obj_type *type_attrs,
|
|
struct ib_ucontext *ucontext,
|
|
enum uverbs_obj_access access,
|
|
int id)
|
|
{
|
|
switch (access) {
|
|
case UVERBS_ACCESS_READ:
|
|
return rdma_lookup_get_uobject(type_attrs, ucontext, id, false);
|
|
case UVERBS_ACCESS_DESTROY:
|
|
case UVERBS_ACCESS_WRITE:
|
|
return rdma_lookup_get_uobject(type_attrs, ucontext, id, true);
|
|
case UVERBS_ACCESS_NEW:
|
|
return rdma_alloc_begin_uobject(type_attrs, ucontext);
|
|
default:
|
|
WARN_ON(true);
|
|
return ERR_PTR(-EOPNOTSUPP);
|
|
}
|
|
}
|
|
|
|
int uverbs_finalize_object(struct ib_uobject *uobj,
|
|
enum uverbs_obj_access access,
|
|
bool commit)
|
|
{
|
|
int ret = 0;
|
|
|
|
/*
|
|
* refcounts should be handled at the object level and not at the
|
|
* uobject level. Refcounts of the objects themselves are done in
|
|
* handlers.
|
|
*/
|
|
|
|
switch (access) {
|
|
case UVERBS_ACCESS_READ:
|
|
rdma_lookup_put_uobject(uobj, false);
|
|
break;
|
|
case UVERBS_ACCESS_WRITE:
|
|
rdma_lookup_put_uobject(uobj, true);
|
|
break;
|
|
case UVERBS_ACCESS_DESTROY:
|
|
if (commit)
|
|
ret = rdma_remove_commit_uobject(uobj);
|
|
else
|
|
rdma_lookup_put_uobject(uobj, true);
|
|
break;
|
|
case UVERBS_ACCESS_NEW:
|
|
if (commit)
|
|
ret = rdma_alloc_commit_uobject(uobj);
|
|
else
|
|
rdma_alloc_abort_uobject(uobj);
|
|
break;
|
|
default:
|
|
WARN_ON(true);
|
|
ret = -EOPNOTSUPP;
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
int uverbs_finalize_objects(struct uverbs_attr_bundle *attrs_bundle,
|
|
struct uverbs_attr_spec_hash * const *spec_hash,
|
|
size_t num,
|
|
bool commit)
|
|
{
|
|
unsigned int i;
|
|
int ret = 0;
|
|
|
|
for (i = 0; i < num; i++) {
|
|
struct uverbs_attr_bundle_hash *curr_bundle =
|
|
&attrs_bundle->hash[i];
|
|
const struct uverbs_attr_spec_hash *curr_spec_bucket =
|
|
spec_hash[i];
|
|
unsigned int j;
|
|
|
|
for (j = 0; j < curr_bundle->num_attrs; j++) {
|
|
struct uverbs_attr *attr;
|
|
const struct uverbs_attr_spec *spec;
|
|
|
|
if (!uverbs_attr_is_valid_in_hash(curr_bundle, j))
|
|
continue;
|
|
|
|
attr = &curr_bundle->attrs[j];
|
|
spec = &curr_spec_bucket->attrs[j];
|
|
|
|
if (spec->type == UVERBS_ATTR_TYPE_IDR ||
|
|
spec->type == UVERBS_ATTR_TYPE_FD) {
|
|
int current_ret;
|
|
|
|
current_ret = uverbs_finalize_object(attr->obj_attr.uobject,
|
|
spec->obj.access,
|
|
commit);
|
|
if (!ret)
|
|
ret = current_ret;
|
|
}
|
|
}
|
|
}
|
|
return ret;
|
|
}
|