2 * Copyright (c) 2016, Mellanox Technologies inc. All rights reserved.
4 * This software is available to you under a choice of one of two
5 * licenses. You may choose to be licensed under the terms of the GNU
6 * General Public License (GPL) Version 2, available from the file
7 * COPYING in the main directory of this source tree, or the
8 * OpenIB.org BSD license below:
10 * Redistribution and use in source and binary forms, with or
11 * without modification, are permitted provided that the following
14 * - Redistributions of source code must retain the above
15 * copyright notice, this list of conditions and the following
18 * - Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following
20 * disclaimer in the documentation and/or other materials
21 * provided with the distribution.
23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33 #include <linux/file.h>
34 #include <linux/anon_inodes.h>
35 #include <linux/sched/mm.h>
36 #include <rdma/ib_verbs.h>
37 #include <rdma/uverbs_types.h>
38 #include <linux/rcupdate.h>
39 #include <rdma/uverbs_ioctl.h>
40 #include <rdma/rdma_user_ioctl.h>
42 #include "core_priv.h"
43 #include "rdma_core.h"
45 void uverbs_uobject_get(struct ib_uobject
*uobject
)
47 kref_get(&uobject
->ref
);
50 static void uverbs_uobject_free(struct kref
*ref
)
52 struct ib_uobject
*uobj
=
53 container_of(ref
, struct ib_uobject
, ref
);
55 if (uobj
->uapi_object
->type_class
->needs_kfree_rcu
)
61 void uverbs_uobject_put(struct ib_uobject
*uobject
)
63 kref_put(&uobject
->ref
, uverbs_uobject_free
);
66 static int uverbs_try_lock_object(struct ib_uobject
*uobj
,
67 enum rdma_lookup_mode mode
)
70 * When a shared access is required, we use a positive counter. Each
71 * shared access request checks that the value != -1 and increment it.
72 * Exclusive access is required for operations like write or destroy.
73 * In exclusive access mode, we check that the counter is zero (nobody
74 * claimed this object) and we set it to -1. Releasing a shared access
75 * lock is done simply by decreasing the counter. As for exclusive
76 * access locks, since only a single one of them is is allowed
77 * concurrently, setting the counter to zero is enough for releasing
81 case UVERBS_LOOKUP_READ
:
82 return atomic_fetch_add_unless(&uobj
->usecnt
, 1, -1) == -1 ?
84 case UVERBS_LOOKUP_WRITE
:
85 /* lock is exclusive */
86 return atomic_cmpxchg(&uobj
->usecnt
, 0, -1) == 0 ? 0 : -EBUSY
;
87 case UVERBS_LOOKUP_DESTROY
:
93 static void assert_uverbs_usecnt(struct ib_uobject
*uobj
,
94 enum rdma_lookup_mode mode
)
98 case UVERBS_LOOKUP_READ
:
99 WARN_ON(atomic_read(&uobj
->usecnt
) <= 0);
101 case UVERBS_LOOKUP_WRITE
:
102 WARN_ON(atomic_read(&uobj
->usecnt
) != -1);
104 case UVERBS_LOOKUP_DESTROY
:
111 * This must be called with the hw_destroy_rwsem locked for read or write,
112 * also the uobject itself must be locked for write.
114 * Upon return the HW object is guaranteed to be destroyed.
116 * For RDMA_REMOVE_ABORT, the hw_destroy_rwsem is not required to be held,
117 * however the type's allocat_commit function cannot have been called and the
118 * uobject cannot be on the uobjects_lists
120 * For RDMA_REMOVE_DESTROY the caller shold be holding a kref (eg via
121 * rdma_lookup_get_uobject) and the object is left in a state where the caller
122 * needs to call rdma_lookup_put_uobject.
124 * For all other destroy modes this function internally unlocks the uobject
125 * and consumes the kref on the uobj.
127 static int uverbs_destroy_uobject(struct ib_uobject
*uobj
,
128 enum rdma_remove_reason reason
,
129 struct uverbs_attr_bundle
*attrs
)
131 struct ib_uverbs_file
*ufile
= attrs
->ufile
;
135 lockdep_assert_held(&ufile
->hw_destroy_rwsem
);
136 assert_uverbs_usecnt(uobj
, UVERBS_LOOKUP_WRITE
);
139 ret
= uobj
->uapi_object
->type_class
->destroy_hw(uobj
, reason
,
142 if (ib_is_destroy_retryable(ret
, reason
, uobj
))
145 /* Nothing to be done, dangle the memory and move on */
147 "ib_uverbs: failed to remove uobject id %d, driver err=%d",
154 if (reason
== RDMA_REMOVE_ABORT
) {
155 WARN_ON(!list_empty(&uobj
->list
));
156 WARN_ON(!uobj
->context
);
157 uobj
->uapi_object
->type_class
->alloc_abort(uobj
);
160 uobj
->context
= NULL
;
163 * For DESTROY the usecnt is held write locked, the caller is expected
164 * to put it unlock and put the object when done with it. Only DESTROY
165 * can remove the IDR handle.
167 if (reason
!= RDMA_REMOVE_DESTROY
)
168 atomic_set(&uobj
->usecnt
, 0);
170 uobj
->uapi_object
->type_class
->remove_handle(uobj
);
172 if (!list_empty(&uobj
->list
)) {
173 spin_lock_irqsave(&ufile
->uobjects_lock
, flags
);
174 list_del_init(&uobj
->list
);
175 spin_unlock_irqrestore(&ufile
->uobjects_lock
, flags
);
178 * Pairs with the get in rdma_alloc_commit_uobject(), could
181 uverbs_uobject_put(uobj
);
185 * When aborting the stack kref remains owned by the core code, and is
186 * not transferred into the type. Pairs with the get in alloc_uobj
188 if (reason
== RDMA_REMOVE_ABORT
)
189 uverbs_uobject_put(uobj
);
195 * This calls uverbs_destroy_uobject() using the RDMA_REMOVE_DESTROY
196 * sequence. It should only be used from command callbacks. On success the
197 * caller must pair this with rdma_lookup_put_uobject(LOOKUP_WRITE). This
198 * version requires the caller to have already obtained an
199 * LOOKUP_DESTROY uobject kref.
201 int uobj_destroy(struct ib_uobject
*uobj
, struct uverbs_attr_bundle
*attrs
)
203 struct ib_uverbs_file
*ufile
= attrs
->ufile
;
206 down_read(&ufile
->hw_destroy_rwsem
);
208 ret
= uverbs_try_lock_object(uobj
, UVERBS_LOOKUP_WRITE
);
212 ret
= uverbs_destroy_uobject(uobj
, RDMA_REMOVE_DESTROY
, attrs
);
214 atomic_set(&uobj
->usecnt
, 0);
219 up_read(&ufile
->hw_destroy_rwsem
);
224 * uobj_get_destroy destroys the HW object and returns a handle to the uobj
225 * with a NULL object pointer. The caller must pair this with
226 * uverbs_put_destroy.
228 struct ib_uobject
*__uobj_get_destroy(const struct uverbs_api_object
*obj
,
229 u32 id
, struct uverbs_attr_bundle
*attrs
)
231 struct ib_uobject
*uobj
;
234 uobj
= rdma_lookup_get_uobject(obj
, attrs
->ufile
, id
,
235 UVERBS_LOOKUP_DESTROY
, attrs
);
239 ret
= uobj_destroy(uobj
, attrs
);
241 rdma_lookup_put_uobject(uobj
, UVERBS_LOOKUP_DESTROY
);
249 * Does both uobj_get_destroy() and uobj_put_destroy(). Returns 0 on success
250 * (negative errno on failure). For use by callers that do not need the uobj.
252 int __uobj_perform_destroy(const struct uverbs_api_object
*obj
, u32 id
,
253 struct uverbs_attr_bundle
*attrs
)
255 struct ib_uobject
*uobj
;
257 uobj
= __uobj_get_destroy(obj
, id
, attrs
);
259 return PTR_ERR(uobj
);
261 rdma_lookup_put_uobject(uobj
, UVERBS_LOOKUP_WRITE
);
265 /* alloc_uobj must be undone by uverbs_destroy_uobject() */
266 static struct ib_uobject
*alloc_uobj(struct ib_uverbs_file
*ufile
,
267 const struct uverbs_api_object
*obj
)
269 struct ib_uobject
*uobj
;
270 struct ib_ucontext
*ucontext
;
272 ucontext
= ib_uverbs_get_ucontext_file(ufile
);
273 if (IS_ERR(ucontext
))
274 return ERR_CAST(ucontext
);
276 uobj
= kzalloc(obj
->type_attrs
->obj_size
, GFP_KERNEL
);
278 return ERR_PTR(-ENOMEM
);
280 * user_handle should be filled by the handler,
281 * The object is added to the list in the commit stage.
284 uobj
->context
= ucontext
;
285 INIT_LIST_HEAD(&uobj
->list
);
286 uobj
->uapi_object
= obj
;
288 * Allocated objects start out as write locked to deny any other
289 * syscalls from accessing them until they are committed. See
290 * rdma_alloc_commit_uobject
292 atomic_set(&uobj
->usecnt
, -1);
293 kref_init(&uobj
->ref
);
298 static int idr_add_uobj(struct ib_uobject
*uobj
)
302 idr_preload(GFP_KERNEL
);
303 spin_lock(&uobj
->ufile
->idr_lock
);
306 * We start with allocating an idr pointing to NULL. This represents an
307 * object which isn't initialized yet. We'll replace it later on with
308 * the real object once we commit.
310 ret
= idr_alloc(&uobj
->ufile
->idr
, NULL
, 0,
311 min_t(unsigned long, U32_MAX
- 1, INT_MAX
), GFP_NOWAIT
);
315 spin_unlock(&uobj
->ufile
->idr_lock
);
318 return ret
< 0 ? ret
: 0;
321 /* Returns the ib_uobject or an error. The caller should check for IS_ERR. */
322 static struct ib_uobject
*
323 lookup_get_idr_uobject(const struct uverbs_api_object
*obj
,
324 struct ib_uverbs_file
*ufile
, s64 id
,
325 enum rdma_lookup_mode mode
)
327 struct ib_uobject
*uobj
;
328 unsigned long idrno
= id
;
330 if (id
< 0 || id
> ULONG_MAX
)
331 return ERR_PTR(-EINVAL
);
334 /* object won't be released as we're protected in rcu */
335 uobj
= idr_find(&ufile
->idr
, idrno
);
337 uobj
= ERR_PTR(-ENOENT
);
342 * The idr_find is guaranteed to return a pointer to something that
343 * isn't freed yet, or NULL, as the free after idr_remove goes through
344 * kfree_rcu(). However the object may still have been released and
345 * kfree() could be called at any time.
347 if (!kref_get_unless_zero(&uobj
->ref
))
348 uobj
= ERR_PTR(-ENOENT
);
355 static struct ib_uobject
*
356 lookup_get_fd_uobject(const struct uverbs_api_object
*obj
,
357 struct ib_uverbs_file
*ufile
, s64 id
,
358 enum rdma_lookup_mode mode
)
360 const struct uverbs_obj_fd_type
*fd_type
;
362 struct ib_uobject
*uobject
;
366 return ERR_PTR(-EINVAL
);
368 if (mode
!= UVERBS_LOOKUP_READ
)
369 return ERR_PTR(-EOPNOTSUPP
);
371 if (!obj
->type_attrs
)
372 return ERR_PTR(-EIO
);
374 container_of(obj
->type_attrs
, struct uverbs_obj_fd_type
, type
);
378 return ERR_PTR(-EBADF
);
380 uobject
= f
->private_data
;
382 * fget(id) ensures we are not currently running uverbs_close_fd,
383 * and the caller is expected to ensure that uverbs_close_fd is never
384 * done while a call top lookup is possible.
386 if (f
->f_op
!= fd_type
->fops
) {
388 return ERR_PTR(-EBADF
);
391 uverbs_uobject_get(uobject
);
395 struct ib_uobject
*rdma_lookup_get_uobject(const struct uverbs_api_object
*obj
,
396 struct ib_uverbs_file
*ufile
, s64 id
,
397 enum rdma_lookup_mode mode
,
398 struct uverbs_attr_bundle
*attrs
)
400 struct ib_uobject
*uobj
;
403 if (IS_ERR(obj
) && PTR_ERR(obj
) == -ENOMSG
) {
404 /* must be UVERBS_IDR_ANY_OBJECT, see uapi_get_object() */
405 uobj
= lookup_get_idr_uobject(NULL
, ufile
, id
, mode
);
410 return ERR_PTR(-EINVAL
);
412 uobj
= obj
->type_class
->lookup_get(obj
, ufile
, id
, mode
);
416 if (uobj
->uapi_object
!= obj
) {
423 * If we have been disassociated block every command except for
424 * DESTROY based commands.
426 if (mode
!= UVERBS_LOOKUP_DESTROY
&&
427 !srcu_dereference(ufile
->device
->ib_dev
,
428 &ufile
->device
->disassociate_srcu
)) {
433 ret
= uverbs_try_lock_object(uobj
, mode
);
437 attrs
->context
= uobj
->context
;
441 uobj
->uapi_object
->type_class
->lookup_put(uobj
, mode
);
442 uverbs_uobject_put(uobj
);
446 static struct ib_uobject
*
447 alloc_begin_idr_uobject(const struct uverbs_api_object
*obj
,
448 struct ib_uverbs_file
*ufile
)
451 struct ib_uobject
*uobj
;
453 uobj
= alloc_uobj(ufile
, obj
);
457 ret
= idr_add_uobj(uobj
);
461 ret
= ib_rdmacg_try_charge(&uobj
->cg_obj
, uobj
->context
->device
,
462 RDMACG_RESOURCE_HCA_OBJECT
);
469 spin_lock(&ufile
->idr_lock
);
470 idr_remove(&ufile
->idr
, uobj
->id
);
471 spin_unlock(&ufile
->idr_lock
);
473 uverbs_uobject_put(uobj
);
477 static struct ib_uobject
*
478 alloc_begin_fd_uobject(const struct uverbs_api_object
*obj
,
479 struct ib_uverbs_file
*ufile
)
482 struct ib_uobject
*uobj
;
484 new_fd
= get_unused_fd_flags(O_CLOEXEC
);
486 return ERR_PTR(new_fd
);
488 uobj
= alloc_uobj(ufile
, obj
);
490 put_unused_fd(new_fd
);
500 struct ib_uobject
*rdma_alloc_begin_uobject(const struct uverbs_api_object
*obj
,
501 struct ib_uverbs_file
*ufile
,
502 struct uverbs_attr_bundle
*attrs
)
504 struct ib_uobject
*ret
;
507 return ERR_PTR(-EINVAL
);
510 * The hw_destroy_rwsem is held across the entire object creation and
511 * released during rdma_alloc_commit_uobject or
512 * rdma_alloc_abort_uobject
514 if (!down_read_trylock(&ufile
->hw_destroy_rwsem
))
515 return ERR_PTR(-EIO
);
517 ret
= obj
->type_class
->alloc_begin(obj
, ufile
);
519 up_read(&ufile
->hw_destroy_rwsem
);
523 attrs
->context
= ret
->context
;
527 static void alloc_abort_idr_uobject(struct ib_uobject
*uobj
)
529 ib_rdmacg_uncharge(&uobj
->cg_obj
, uobj
->context
->device
,
530 RDMACG_RESOURCE_HCA_OBJECT
);
532 spin_lock(&uobj
->ufile
->idr_lock
);
533 idr_remove(&uobj
->ufile
->idr
, uobj
->id
);
534 spin_unlock(&uobj
->ufile
->idr_lock
);
537 static int __must_check
destroy_hw_idr_uobject(struct ib_uobject
*uobj
,
538 enum rdma_remove_reason why
,
539 struct uverbs_attr_bundle
*attrs
)
541 const struct uverbs_obj_idr_type
*idr_type
=
542 container_of(uobj
->uapi_object
->type_attrs
,
543 struct uverbs_obj_idr_type
, type
);
544 int ret
= idr_type
->destroy_object(uobj
, why
, attrs
);
547 * We can only fail gracefully if the user requested to destroy the
548 * object or when a retry may be called upon an error.
549 * In the rest of the cases, just remove whatever you can.
551 if (ib_is_destroy_retryable(ret
, why
, uobj
))
554 if (why
== RDMA_REMOVE_ABORT
)
557 ib_rdmacg_uncharge(&uobj
->cg_obj
, uobj
->context
->device
,
558 RDMACG_RESOURCE_HCA_OBJECT
);
563 static void remove_handle_idr_uobject(struct ib_uobject
*uobj
)
565 spin_lock(&uobj
->ufile
->idr_lock
);
566 idr_remove(&uobj
->ufile
->idr
, uobj
->id
);
567 spin_unlock(&uobj
->ufile
->idr_lock
);
568 /* Matches the kref in alloc_commit_idr_uobject */
569 uverbs_uobject_put(uobj
);
572 static void alloc_abort_fd_uobject(struct ib_uobject
*uobj
)
574 put_unused_fd(uobj
->id
);
577 static int __must_check
destroy_hw_fd_uobject(struct ib_uobject
*uobj
,
578 enum rdma_remove_reason why
,
579 struct uverbs_attr_bundle
*attrs
)
581 const struct uverbs_obj_fd_type
*fd_type
= container_of(
582 uobj
->uapi_object
->type_attrs
, struct uverbs_obj_fd_type
, type
);
583 int ret
= fd_type
->context_closed(uobj
, why
);
585 if (ib_is_destroy_retryable(ret
, why
, uobj
))
591 static void remove_handle_fd_uobject(struct ib_uobject
*uobj
)
595 static int alloc_commit_idr_uobject(struct ib_uobject
*uobj
)
597 struct ib_uverbs_file
*ufile
= uobj
->ufile
;
599 spin_lock(&ufile
->idr_lock
);
601 * We already allocated this IDR with a NULL object, so
602 * this shouldn't fail.
604 * NOTE: Once we set the IDR we loose ownership of our kref on uobj.
605 * It will be put by remove_commit_idr_uobject()
607 WARN_ON(idr_replace(&ufile
->idr
, uobj
, uobj
->id
));
608 spin_unlock(&ufile
->idr_lock
);
613 static int alloc_commit_fd_uobject(struct ib_uobject
*uobj
)
615 const struct uverbs_obj_fd_type
*fd_type
= container_of(
616 uobj
->uapi_object
->type_attrs
, struct uverbs_obj_fd_type
, type
);
621 * The kref for uobj is moved into filp->private data and put in
622 * uverbs_close_fd(). Once alloc_commit() succeeds uverbs_close_fd()
623 * must be guaranteed to be called from the provided fops release
626 filp
= anon_inode_getfile(fd_type
->name
,
631 return PTR_ERR(filp
);
635 /* Matching put will be done in uverbs_close_fd() */
636 kref_get(&uobj
->ufile
->ref
);
638 /* This shouldn't be used anymore. Use the file object instead */
642 * NOTE: Once we install the file we loose ownership of our kref on
643 * uobj. It will be put by uverbs_close_fd()
645 fd_install(fd
, filp
);
651 * In all cases rdma_alloc_commit_uobject() consumes the kref to uobj and the
652 * caller can no longer assume uobj is valid. If this function fails it
653 * destroys the uboject, including the attached HW object.
655 int __must_check
rdma_alloc_commit_uobject(struct ib_uobject
*uobj
,
656 struct uverbs_attr_bundle
*attrs
)
658 struct ib_uverbs_file
*ufile
= attrs
->ufile
;
661 /* alloc_commit consumes the uobj kref */
662 ret
= uobj
->uapi_object
->type_class
->alloc_commit(uobj
);
664 uverbs_destroy_uobject(uobj
, RDMA_REMOVE_ABORT
, attrs
);
665 up_read(&ufile
->hw_destroy_rwsem
);
669 /* kref is held so long as the uobj is on the uobj list. */
670 uverbs_uobject_get(uobj
);
671 spin_lock_irq(&ufile
->uobjects_lock
);
672 list_add(&uobj
->list
, &ufile
->uobjects
);
673 spin_unlock_irq(&ufile
->uobjects_lock
);
675 /* matches atomic_set(-1) in alloc_uobj */
676 atomic_set(&uobj
->usecnt
, 0);
678 /* Matches the down_read in rdma_alloc_begin_uobject */
679 up_read(&ufile
->hw_destroy_rwsem
);
685 * This consumes the kref for uobj. It is up to the caller to unwind the HW
686 * object and anything else connected to uobj before calling this.
688 void rdma_alloc_abort_uobject(struct ib_uobject
*uobj
,
689 struct uverbs_attr_bundle
*attrs
)
691 struct ib_uverbs_file
*ufile
= uobj
->ufile
;
694 uverbs_destroy_uobject(uobj
, RDMA_REMOVE_ABORT
, attrs
);
696 /* Matches the down_read in rdma_alloc_begin_uobject */
697 up_read(&ufile
->hw_destroy_rwsem
);
700 static void lookup_put_idr_uobject(struct ib_uobject
*uobj
,
701 enum rdma_lookup_mode mode
)
705 static void lookup_put_fd_uobject(struct ib_uobject
*uobj
,
706 enum rdma_lookup_mode mode
)
708 struct file
*filp
= uobj
->object
;
710 WARN_ON(mode
!= UVERBS_LOOKUP_READ
);
711 /* This indirectly calls uverbs_close_fd and free the object */
715 void rdma_lookup_put_uobject(struct ib_uobject
*uobj
,
716 enum rdma_lookup_mode mode
)
718 assert_uverbs_usecnt(uobj
, mode
);
719 uobj
->uapi_object
->type_class
->lookup_put(uobj
, mode
);
721 * In order to unlock an object, either decrease its usecnt for
722 * read access or zero it in case of exclusive access. See
723 * uverbs_try_lock_object for locking schema information.
726 case UVERBS_LOOKUP_READ
:
727 atomic_dec(&uobj
->usecnt
);
729 case UVERBS_LOOKUP_WRITE
:
730 atomic_set(&uobj
->usecnt
, 0);
732 case UVERBS_LOOKUP_DESTROY
:
736 /* Pairs with the kref obtained by type->lookup_get */
737 uverbs_uobject_put(uobj
);
740 void setup_ufile_idr_uobject(struct ib_uverbs_file
*ufile
)
742 spin_lock_init(&ufile
->idr_lock
);
743 idr_init(&ufile
->idr
);
746 void release_ufile_idr_uobject(struct ib_uverbs_file
*ufile
)
748 struct ib_uobject
*entry
;
752 * At this point uverbs_cleanup_ufile() is guaranteed to have run, and
753 * there are no HW objects left, however the IDR is still populated
754 * with anything that has not been cleaned up by userspace. Since the
755 * kref on ufile is 0, nothing is allowed to call lookup_get.
757 * This is an optimized equivalent to remove_handle_idr_uobject
759 idr_for_each_entry(&ufile
->idr
, entry
, id
) {
760 WARN_ON(entry
->object
);
761 uverbs_uobject_put(entry
);
764 idr_destroy(&ufile
->idr
);
767 const struct uverbs_obj_type_class uverbs_idr_class
= {
768 .alloc_begin
= alloc_begin_idr_uobject
,
769 .lookup_get
= lookup_get_idr_uobject
,
770 .alloc_commit
= alloc_commit_idr_uobject
,
771 .alloc_abort
= alloc_abort_idr_uobject
,
772 .lookup_put
= lookup_put_idr_uobject
,
773 .destroy_hw
= destroy_hw_idr_uobject
,
774 .remove_handle
= remove_handle_idr_uobject
,
776 * When we destroy an object, we first just lock it for WRITE and
777 * actually DESTROY it in the finalize stage. So, the problematic
778 * scenario is when we just started the finalize stage of the
779 * destruction (nothing was executed yet). Now, the other thread
780 * fetched the object for READ access, but it didn't lock it yet.
781 * The DESTROY thread continues and starts destroying the object.
782 * When the other thread continue - without the RCU, it would
783 * access freed memory. However, the rcu_read_lock delays the free
784 * until the rcu_read_lock of the READ operation quits. Since the
785 * exclusive lock of the object is still taken by the DESTROY flow, the
786 * READ operation will get -EBUSY and it'll just bail out.
788 .needs_kfree_rcu
= true,
790 EXPORT_SYMBOL(uverbs_idr_class
);
792 void uverbs_close_fd(struct file
*f
)
794 struct ib_uobject
*uobj
= f
->private_data
;
795 struct ib_uverbs_file
*ufile
= uobj
->ufile
;
796 struct uverbs_attr_bundle attrs
= {
797 .context
= uobj
->context
,
801 if (down_read_trylock(&ufile
->hw_destroy_rwsem
)) {
803 * lookup_get_fd_uobject holds the kref on the struct file any
804 * time a FD uobj is locked, which prevents this release
805 * method from being invoked. Meaning we can always get the
806 * write lock here, or we have a kernel bug.
808 WARN_ON(uverbs_try_lock_object(uobj
, UVERBS_LOOKUP_WRITE
));
809 uverbs_destroy_uobject(uobj
, RDMA_REMOVE_CLOSE
, &attrs
);
810 up_read(&ufile
->hw_destroy_rwsem
);
813 /* Matches the get in alloc_begin_fd_uobject */
814 kref_put(&ufile
->ref
, ib_uverbs_release_file
);
816 /* Pairs with filp->private_data in alloc_begin_fd_uobject */
817 uverbs_uobject_put(uobj
);
819 EXPORT_SYMBOL(uverbs_close_fd
);
822 * Drop the ucontext off the ufile and completely disconnect it from the
825 static void ufile_destroy_ucontext(struct ib_uverbs_file
*ufile
,
826 enum rdma_remove_reason reason
)
828 struct ib_ucontext
*ucontext
= ufile
->ucontext
;
829 struct ib_device
*ib_dev
= ucontext
->device
;
832 * If we are closing the FD then the user mmap VMAs must have
833 * already been destroyed as they hold on to the filep, otherwise
834 * they need to be zap'd.
836 if (reason
== RDMA_REMOVE_DRIVER_REMOVE
) {
837 uverbs_user_mmap_disassociate(ufile
);
838 if (ib_dev
->ops
.disassociate_ucontext
)
839 ib_dev
->ops
.disassociate_ucontext(ucontext
);
842 ib_rdmacg_uncharge(&ucontext
->cg_obj
, ib_dev
,
843 RDMACG_RESOURCE_HCA_HANDLE
);
845 rdma_restrack_del(&ucontext
->res
);
847 ib_dev
->ops
.dealloc_ucontext(ucontext
);
850 ufile
->ucontext
= NULL
;
853 static int __uverbs_cleanup_ufile(struct ib_uverbs_file
*ufile
,
854 enum rdma_remove_reason reason
)
856 struct ib_uobject
*obj
, *next_obj
;
858 struct uverbs_attr_bundle attrs
= { .ufile
= ufile
};
861 * This shouldn't run while executing other commands on this
862 * context. Thus, the only thing we should take care of is
863 * releasing a FD while traversing this list. The FD could be
864 * closed and released from the _release fop of this FD.
865 * In order to mitigate this, we add a lock.
866 * We take and release the lock per traversal in order to let
867 * other threads (which might still use the FDs) chance to run.
869 list_for_each_entry_safe(obj
, next_obj
, &ufile
->uobjects
, list
) {
870 attrs
.context
= obj
->context
;
872 * if we hit this WARN_ON, that means we are
873 * racing with a lookup_get.
875 WARN_ON(uverbs_try_lock_object(obj
, UVERBS_LOOKUP_WRITE
));
876 if (!uverbs_destroy_uobject(obj
, reason
, &attrs
))
879 atomic_set(&obj
->usecnt
, 0);
885 * Destroy the uncontext and every uobject associated with it. If called with
886 * reason != RDMA_REMOVE_CLOSE this will not return until the destruction has
887 * been completed and ufile->ucontext is NULL.
889 * This is internally locked and can be called in parallel from multiple
892 void uverbs_destroy_ufile_hw(struct ib_uverbs_file
*ufile
,
893 enum rdma_remove_reason reason
)
895 if (reason
== RDMA_REMOVE_CLOSE
) {
897 * During destruction we might trigger something that
898 * synchronously calls release on any file descriptor. For
899 * this reason all paths that come from file_operations
900 * release must use try_lock. They can progress knowing that
901 * there is an ongoing uverbs_destroy_ufile_hw that will clean
902 * up the driver resources.
904 if (!mutex_trylock(&ufile
->ucontext_lock
))
908 mutex_lock(&ufile
->ucontext_lock
);
911 down_write(&ufile
->hw_destroy_rwsem
);
914 * If a ucontext was never created then we can't have any uobjects to
915 * cleanup, nothing to do.
917 if (!ufile
->ucontext
)
920 ufile
->ucontext
->closing
= true;
921 ufile
->ucontext
->cleanup_retryable
= true;
922 while (!list_empty(&ufile
->uobjects
))
923 if (__uverbs_cleanup_ufile(ufile
, reason
)) {
925 * No entry was cleaned-up successfully during this
931 ufile
->ucontext
->cleanup_retryable
= false;
932 if (!list_empty(&ufile
->uobjects
))
933 __uverbs_cleanup_ufile(ufile
, reason
);
935 ufile_destroy_ucontext(ufile
, reason
);
938 up_write(&ufile
->hw_destroy_rwsem
);
939 mutex_unlock(&ufile
->ucontext_lock
);
942 const struct uverbs_obj_type_class uverbs_fd_class
= {
943 .alloc_begin
= alloc_begin_fd_uobject
,
944 .lookup_get
= lookup_get_fd_uobject
,
945 .alloc_commit
= alloc_commit_fd_uobject
,
946 .alloc_abort
= alloc_abort_fd_uobject
,
947 .lookup_put
= lookup_put_fd_uobject
,
948 .destroy_hw
= destroy_hw_fd_uobject
,
949 .remove_handle
= remove_handle_fd_uobject
,
950 .needs_kfree_rcu
= false,
952 EXPORT_SYMBOL(uverbs_fd_class
);
955 uverbs_get_uobject_from_file(u16 object_id
, enum uverbs_obj_access access
,
956 s64 id
, struct uverbs_attr_bundle
*attrs
)
958 const struct uverbs_api_object
*obj
=
959 uapi_get_object(attrs
->ufile
->device
->uapi
, object_id
);
962 case UVERBS_ACCESS_READ
:
963 return rdma_lookup_get_uobject(obj
, attrs
->ufile
, id
,
964 UVERBS_LOOKUP_READ
, attrs
);
965 case UVERBS_ACCESS_DESTROY
:
966 /* Actual destruction is done inside uverbs_handle_method */
967 return rdma_lookup_get_uobject(obj
, attrs
->ufile
, id
,
968 UVERBS_LOOKUP_DESTROY
, attrs
);
969 case UVERBS_ACCESS_WRITE
:
970 return rdma_lookup_get_uobject(obj
, attrs
->ufile
, id
,
971 UVERBS_LOOKUP_WRITE
, attrs
);
972 case UVERBS_ACCESS_NEW
:
973 return rdma_alloc_begin_uobject(obj
, attrs
->ufile
, attrs
);
976 return ERR_PTR(-EOPNOTSUPP
);
980 int uverbs_finalize_object(struct ib_uobject
*uobj
,
981 enum uverbs_obj_access access
, bool commit
,
982 struct uverbs_attr_bundle
*attrs
)
987 * refcounts should be handled at the object level and not at the
988 * uobject level. Refcounts of the objects themselves are done in
993 case UVERBS_ACCESS_READ
:
994 rdma_lookup_put_uobject(uobj
, UVERBS_LOOKUP_READ
);
996 case UVERBS_ACCESS_WRITE
:
997 rdma_lookup_put_uobject(uobj
, UVERBS_LOOKUP_WRITE
);
999 case UVERBS_ACCESS_DESTROY
:
1001 rdma_lookup_put_uobject(uobj
, UVERBS_LOOKUP_DESTROY
);
1003 case UVERBS_ACCESS_NEW
:
1005 ret
= rdma_alloc_commit_uobject(uobj
, attrs
);
1007 rdma_alloc_abort_uobject(uobj
, attrs
);