iommufd: Rename some shortterm-related identifiers

Rename the shortterm-related identifiers to wait-related.

The usage of shortterm_users refcount is now beyond its name.  It is
also used for references which live longer than an ioctl execution.
E.g. vdev holds idev's shortterm_users refcount on vdev allocation,
releases it during idev's pre_destroy(). Rename the refcount as
wait_cnt, since it is always used to sync the referencing & the
destruction of the object by waiting for it to go to zero.

List all changed identifiers:

  iommufd_object::shortterm_users -> iommufd_object::wait_cnt
  REMOVE_WAIT_SHORTTERM -> REMOVE_WAIT
  iommufd_object_dec_wait_shortterm() -> iommufd_object_dec_wait()
  zerod_shortterm -> zerod_wait_cnt

No functional change intended.

Link: https://patch.msgid.link/r/20250716070349.1807226-9-yilun.xu@linux.intel.com
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c
index ee6ff4caf3982fee05ba8a018eec7e474c695097..65fbd098f9e98f2c83dab07f2fe501f2feeb4e27 100644 (file)
--- a/drivers/iommu/iommufd/device.c
+++ b/drivers/iommu/iommufd/device.c
@@ -152,8 +152,8 @@ static void iommufd_device_remove_vdev(struct iommufd_device *idev)
        /*
         * An ongoing vdev destroy ioctl has removed the vdev from the object
         * xarray, but has not finished iommufd_vdevice_destroy() yet as it
-        * needs the same mutex. We exit the locking then wait on short term
-        * users for the vdev destruction.
+        * needs the same mutex. We exit the locking then wait on wait_cnt
+        * reference for the vdev destruction.
         */
        if (IS_ERR(vdev))
                goto out_unlock;
@@ -184,7 +184,7 @@ void iommufd_device_pre_destroy(struct iommufd_object *obj)
        struct iommufd_device *idev =
                container_of(obj, struct iommufd_device, obj);
 
-       /* Release the short term users on this */
+       /* Release the wait_cnt reference on this */
        iommufd_device_remove_vdev(idev);
 }
 

diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h
index 5d6ea5395cfea6a661d01470ef6259fa2e956077..0da2a81eedfa8bbe7e3236cb1b8526bf6a2fc6dc 100644 (file)
--- a/drivers/iommu/iommufd/iommufd_private.h
+++ b/drivers/iommu/iommufd/iommufd_private.h
@@ -169,7 +169,7 @@ static inline bool iommufd_lock_obj(struct iommufd_object *obj)
 {
        if (!refcount_inc_not_zero(&obj->users))
                return false;
-       if (!refcount_inc_not_zero(&obj->shortterm_users)) {
+       if (!refcount_inc_not_zero(&obj->wait_cnt)) {
                /*
                 * If the caller doesn't already have a ref on obj this must be
                 * called under the xa_lock. Otherwise the caller is holding a
@@ -187,11 +187,11 @@ static inline void iommufd_put_object(struct iommufd_ctx *ictx,
                                      struct iommufd_object *obj)
 {
        /*
-        * Users first, then shortterm so that REMOVE_WAIT_SHORTTERM never sees
-        * a spurious !0 users with a 0 shortterm_users.
+        * Users first, then wait_cnt so that REMOVE_WAIT never sees a spurious
+        * !0 users with a 0 wait_cnt.
         */
        refcount_dec(&obj->users);
-       if (refcount_dec_and_test(&obj->shortterm_users))
+       if (refcount_dec_and_test(&obj->wait_cnt))
                wake_up_interruptible_all(&ictx->destroy_wait);
 }
 
@@ -202,7 +202,7 @@ void iommufd_object_finalize(struct iommufd_ctx *ictx,
                             struct iommufd_object *obj);
 
 enum {
-       REMOVE_WAIT_SHORTTERM   = BIT(0),
+       REMOVE_WAIT             = BIT(0),
        REMOVE_OBJ_TOMBSTONE    = BIT(1),
 };
 int iommufd_object_remove(struct iommufd_ctx *ictx,
@@ -211,15 +211,15 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
 
 /*
  * The caller holds a users refcount and wants to destroy the object. At this
- * point the caller has no shortterm_users reference and at least the xarray
- * will be holding one.
+ * point the caller has no wait_cnt reference and at least the xarray will be
+ * holding one.
  */
 static inline void iommufd_object_destroy_user(struct iommufd_ctx *ictx,
                                               struct iommufd_object *obj)
 {
        int ret;
 
-       ret = iommufd_object_remove(ictx, obj, obj->id, REMOVE_WAIT_SHORTTERM);
+       ret = iommufd_object_remove(ictx, obj, obj->id, REMOVE_WAIT);
 
        /*
         * If there is a bug and we couldn't destroy the object then we did put
@@ -239,7 +239,7 @@ static inline void iommufd_object_tombstone_user(struct iommufd_ctx *ictx,
        int ret;
 
        ret = iommufd_object_remove(ictx, obj, obj->id,
-                                   REMOVE_WAIT_SHORTTERM | REMOVE_OBJ_TOMBSTONE);
+                                   REMOVE_WAIT | REMOVE_OBJ_TOMBSTONE);
 
        /*
         * If there is a bug and we couldn't destroy the object then we did put

diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
index 99c1aab3d396dddebdd1cf04323b0c10a662f668..15af7ced0501d6f85a2daa7f963ced2b783e198b 100644 (file)
--- a/drivers/iommu/iommufd/main.c
+++ b/drivers/iommu/iommufd/main.c
@@ -42,7 +42,7 @@ struct iommufd_object *_iommufd_object_alloc(struct iommufd_ctx *ictx,
                return ERR_PTR(-ENOMEM);
        obj->type = type;
        /* Starts out bias'd by 1 until it is removed from the xarray */
-       refcount_set(&obj->shortterm_users, 1);
+       refcount_set(&obj->wait_cnt, 1);
        refcount_set(&obj->users, 1);
 
        /*
@@ -155,22 +155,22 @@ struct iommufd_object *iommufd_get_object(struct iommufd_ctx *ictx, u32 id,
        return obj;
 }
 
-static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
-                                            struct iommufd_object *to_destroy)
+static int iommufd_object_dec_wait(struct iommufd_ctx *ictx,
+                                  struct iommufd_object *to_destroy)
 {
-       if (refcount_dec_and_test(&to_destroy->shortterm_users))
+       if (refcount_dec_and_test(&to_destroy->wait_cnt))
                return 0;
 
        if (iommufd_object_ops[to_destroy->type].pre_destroy)
                iommufd_object_ops[to_destroy->type].pre_destroy(to_destroy);
 
        if (wait_event_timeout(ictx->destroy_wait,
-                              refcount_read(&to_destroy->shortterm_users) == 0,
+                              refcount_read(&to_destroy->wait_cnt) == 0,
                               msecs_to_jiffies(60000)))
                return 0;
 
        pr_crit("Time out waiting for iommufd object to become free\n");
-       refcount_inc(&to_destroy->shortterm_users);
+       refcount_inc(&to_destroy->wait_cnt);
        return -EBUSY;
 }
 
@@ -184,17 +184,18 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
 {
        struct iommufd_object *obj;
        XA_STATE(xas, &ictx->objects, id);
-       bool zerod_shortterm = false;
+       bool zerod_wait_cnt = false;
        int ret;
 
        /*
-        * The purpose of the shortterm_users is to ensure deterministic
-        * destruction of objects used by external drivers and destroyed by this
-        * function. Any temporary increment of the refcount must increment
-        * shortterm_users, such as during ioctl execution.
+        * The purpose of the wait_cnt is to ensure deterministic destruction
+        * of objects used by external drivers and destroyed by this function.
+        * Incrementing this wait_cnt should either be short lived, such as
+        * during ioctl execution, or be revoked and blocked during
+        * pre_destroy(), such as vdev holding the idev's refcount.
         */
-       if (flags & REMOVE_WAIT_SHORTTERM) {
-               ret = iommufd_object_dec_wait_shortterm(ictx, to_destroy);
+       if (flags & REMOVE_WAIT) {
+               ret = iommufd_object_dec_wait(ictx, to_destroy);
                if (ret) {
                        /*
                         * We have a bug. Put back the callers reference and
@@ -203,7 +204,7 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
                        refcount_dec(&to_destroy->users);
                        return ret;
                }
-               zerod_shortterm = true;
+               zerod_wait_cnt = true;
        }
 
        xa_lock(&ictx->objects);
@@ -235,11 +236,11 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
        xa_unlock(&ictx->objects);
 
        /*
-        * Since users is zero any positive users_shortterm must be racing
+        * Since users is zero any positive wait_cnt must be racing
         * iommufd_put_object(), or we have a bug.
         */
-       if (!zerod_shortterm) {
-               ret = iommufd_object_dec_wait_shortterm(ictx, obj);
+       if (!zerod_wait_cnt) {
+               ret = iommufd_object_dec_wait(ictx, obj);
                if (WARN_ON(ret))
                        return ret;
        }
@@ -249,9 +250,9 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
        return 0;
 
 err_xa:
-       if (zerod_shortterm) {
+       if (zerod_wait_cnt) {
                /* Restore the xarray owned reference */
-               refcount_set(&obj->shortterm_users, 1);
+               refcount_set(&obj->wait_cnt, 1);
        }
        xa_unlock(&ictx->objects);
 

diff --git a/drivers/iommu/iommufd/viommu.c b/drivers/iommu/iommufd/viommu.c
index 6cf0bd5d8f0887093f838505dec163786d74fb26..2ca5809b238bbe7e1c81fb420b49a21b211f9a33 100644 (file)
--- a/drivers/iommu/iommufd/viommu.c
+++ b/drivers/iommu/iommufd/viommu.c
@@ -205,8 +205,8 @@ int iommufd_vdevice_alloc_ioctl(struct iommufd_ucmd *ucmd)
        vdev->viommu = viommu;
        refcount_inc(&viommu->obj.users);
        /*
-        * A short term users reference is held on the idev so long as we have
-        * the pointer. iommufd_device_pre_destroy() will revoke it before the
+        * A wait_cnt reference is held on the idev so long as we have the
+        * pointer. iommufd_device_pre_destroy() will revoke it before the
         * idev real destruction.
         */
        vdev->idev = idev;

diff --git a/include/linux/iommufd.h b/include/linux/iommufd.h
index 810e4d8ac91240a7039c34be1ad986032e7bf0a2..6e7efe83bc5d83e8d4f5cede9a680860bc5fed9b 100644 (file)
--- a/include/linux/iommufd.h
+++ b/include/linux/iommufd.h
@@ -46,7 +46,13 @@ enum iommufd_object_type {
 
 /* Base struct for all objects with a userspace ID handle. */
 struct iommufd_object {
-       refcount_t shortterm_users;
+       /*
+        * Destroy will sleep and wait for wait_cnt to go to zero. This allows
+        * concurrent users of the ID to reliably avoid causing a spurious
+        * destroy failure. Incrementing this count should either be short
+        * lived or be revoked and blocked during pre_destroy().
+        */
+       refcount_t wait_cnt;
        refcount_t users;
        enum iommufd_object_type type;
        unsigned int id;