From: Sriharsha Basavapatna Date: Tue, 19 May 2026 15:00:39 +0000 (+0530) Subject: RDMA/bnxt_re: Enhance dpi lifecycle logic in doorbell uapis X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=54c01d98f480a5622780cb4d5e893e25dda70e57;p=thirdparty%2Fkernel%2Flinux.git RDMA/bnxt_re: Enhance dpi lifecycle logic in doorbell uapis If the DPI is freed when the dbr object is freed, but if the process has not unmapped the page yet, then the DPI slot could get reallocated to another process while the original process still has it mapped. To prevent this, save the DPI info in the mmap entry during dbr allocation and free the DPI slot from bnxt_re_mmap_free(), which enures that there are no references to it. This change is needed to support doorbell allocation to QPs in the next patch. Link: https://patch.msgid.link/r/20260519150041.7251-8-sriharsha.basavapatna@broadcom.com Signed-off-by: Sriharsha Basavapatna Reviewed-by: Selvin Xavier Signed-off-by: Jason Gunthorpe --- diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index e0c98b3ec2982..c706ba19e7194 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -4943,6 +4943,10 @@ void bnxt_re_mmap_free(struct rdma_user_mmap_entry *rdma_entry) bnxt_entry = container_of(rdma_entry, struct bnxt_re_user_mmap_entry, rdma_entry); + if (bnxt_entry->dpi_valid) + bnxt_qplib_free_uc_dpi(&bnxt_entry->uctx->rdev->qplib_res, + &bnxt_entry->dpi); + kfree(bnxt_entry); } diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h index 13dac48ed453e..6a5bcc3fb289b 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h @@ -161,6 +161,8 @@ struct bnxt_re_user_mmap_entry { struct bnxt_re_ucontext *uctx; u64 mem_offset; u8 mmap_flag; + bool dpi_valid; + struct bnxt_qplib_dpi dpi; }; struct bnxt_re_dbr_obj { diff --git a/drivers/infiniband/hw/bnxt_re/uapi.c b/drivers/infiniband/hw/bnxt_re/uapi.c index b8fc8bfba2ad4..1d44d6225da07 100644 --- a/drivers/infiniband/hw/bnxt_re/uapi.c +++ b/drivers/infiniband/hw/bnxt_re/uapi.c @@ -368,6 +368,13 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD_DBR_ALLOC)(struct uverbs_attr_bundle *a goto free_dpi; } + /* Save DPI info to the mmap entry so that bnxt_re_mmap_free() + * can free the DPI slot only after the last reference to the + * mmap entry is released. + */ + obj->entry->dpi = *dpi; + obj->entry->dpi_valid = true; + obj->rdev = rdev; kref_init(&obj->usecnt); uobj->object = obj; @@ -396,10 +403,12 @@ void bnxt_re_dbr_kref_release(struct kref *ref) { struct bnxt_re_dbr_obj *obj = container_of(ref, struct bnxt_re_dbr_obj, usecnt); - struct bnxt_re_dev *rdev = obj->rdev; + /* Drop the driver's reference to the mmap entry (_remove()). + * The DPI slot gets freed from bnxt_re_mmap_free() only + * when there's no VMA mapping reference to it. + */ rdma_user_mmap_entry_remove(&obj->entry->rdma_entry); - bnxt_qplib_free_uc_dpi(&rdev->qplib_res, &obj->dpi); kfree(obj); }