iommufd: Rename some shortterm-related identifiers

Rename the shortterm-related identifiers to wait-related.

The usage of shortterm_users refcount is now beyond its name.  It is
also used for references which live longer than an ioctl execution.
E.g. vdev holds idev's shortterm_users refcount on vdev allocation,
releases it during idev's pre_destroy(). Rename the refcount as
wait_cnt, since it is always used to sync the referencing & the
destruction of the object by waiting for it to go to zero.

List all changed identifiers:

  iommufd_object::shortterm_users -> iommufd_object::wait_cnt
  REMOVE_WAIT_SHORTTERM -> REMOVE_WAIT
  iommufd_object_dec_wait_shortterm() -> iommufd_object_dec_wait()
  zerod_shortterm -> zerod_wait_cnt

No functional change intended.

Link: https://patch.msgid.link/r/20250716070349.1807226-9-yilun.xu@linux.intel.com
Suggested-by: Kevin Tian <kevin.tian@intel.com>
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
pull/1311/head
Xu Yilun 2025-07-16 15:03:49 +08:00 committed by Jason Gunthorpe
parent 39a369c341
commit ab6bc44159
5 changed files with 41 additions and 34 deletions

View File

@ -152,8 +152,8 @@ static void iommufd_device_remove_vdev(struct iommufd_device *idev)
/*
* An ongoing vdev destroy ioctl has removed the vdev from the object
* xarray, but has not finished iommufd_vdevice_destroy() yet as it
* needs the same mutex. We exit the locking then wait on short term
* users for the vdev destruction.
* needs the same mutex. We exit the locking then wait on wait_cnt
* reference for the vdev destruction.
*/
if (IS_ERR(vdev))
goto out_unlock;
@ -184,7 +184,7 @@ void iommufd_device_pre_destroy(struct iommufd_object *obj)
struct iommufd_device *idev =
container_of(obj, struct iommufd_device, obj);
/* Release the short term users on this */
/* Release the wait_cnt reference on this */
iommufd_device_remove_vdev(idev);
}

View File

@ -169,7 +169,7 @@ static inline bool iommufd_lock_obj(struct iommufd_object *obj)
{
if (!refcount_inc_not_zero(&obj->users))
return false;
if (!refcount_inc_not_zero(&obj->shortterm_users)) {
if (!refcount_inc_not_zero(&obj->wait_cnt)) {
/*
* If the caller doesn't already have a ref on obj this must be
* called under the xa_lock. Otherwise the caller is holding a
@ -187,11 +187,11 @@ static inline void iommufd_put_object(struct iommufd_ctx *ictx,
struct iommufd_object *obj)
{
/*
* Users first, then shortterm so that REMOVE_WAIT_SHORTTERM never sees
* a spurious !0 users with a 0 shortterm_users.
* Users first, then wait_cnt so that REMOVE_WAIT never sees a spurious
* !0 users with a 0 wait_cnt.
*/
refcount_dec(&obj->users);
if (refcount_dec_and_test(&obj->shortterm_users))
if (refcount_dec_and_test(&obj->wait_cnt))
wake_up_interruptible_all(&ictx->destroy_wait);
}
@ -202,7 +202,7 @@ void iommufd_object_finalize(struct iommufd_ctx *ictx,
struct iommufd_object *obj);
enum {
REMOVE_WAIT_SHORTTERM = BIT(0),
REMOVE_WAIT = BIT(0),
REMOVE_OBJ_TOMBSTONE = BIT(1),
};
int iommufd_object_remove(struct iommufd_ctx *ictx,
@ -211,15 +211,15 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
/*
* The caller holds a users refcount and wants to destroy the object. At this
* point the caller has no shortterm_users reference and at least the xarray
* will be holding one.
* point the caller has no wait_cnt reference and at least the xarray will be
* holding one.
*/
static inline void iommufd_object_destroy_user(struct iommufd_ctx *ictx,
struct iommufd_object *obj)
{
int ret;
ret = iommufd_object_remove(ictx, obj, obj->id, REMOVE_WAIT_SHORTTERM);
ret = iommufd_object_remove(ictx, obj, obj->id, REMOVE_WAIT);
/*
* If there is a bug and we couldn't destroy the object then we did put
@ -239,7 +239,7 @@ static inline void iommufd_object_tombstone_user(struct iommufd_ctx *ictx,
int ret;
ret = iommufd_object_remove(ictx, obj, obj->id,
REMOVE_WAIT_SHORTTERM | REMOVE_OBJ_TOMBSTONE);
REMOVE_WAIT | REMOVE_OBJ_TOMBSTONE);
/*
* If there is a bug and we couldn't destroy the object then we did put

View File

@ -42,7 +42,7 @@ struct iommufd_object *_iommufd_object_alloc(struct iommufd_ctx *ictx,
return ERR_PTR(-ENOMEM);
obj->type = type;
/* Starts out bias'd by 1 until it is removed from the xarray */
refcount_set(&obj->shortterm_users, 1);
refcount_set(&obj->wait_cnt, 1);
refcount_set(&obj->users, 1);
/*
@ -155,22 +155,22 @@ struct iommufd_object *iommufd_get_object(struct iommufd_ctx *ictx, u32 id,
return obj;
}
static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
struct iommufd_object *to_destroy)
static int iommufd_object_dec_wait(struct iommufd_ctx *ictx,
struct iommufd_object *to_destroy)
{
if (refcount_dec_and_test(&to_destroy->shortterm_users))
if (refcount_dec_and_test(&to_destroy->wait_cnt))
return 0;
if (iommufd_object_ops[to_destroy->type].pre_destroy)
iommufd_object_ops[to_destroy->type].pre_destroy(to_destroy);
if (wait_event_timeout(ictx->destroy_wait,
refcount_read(&to_destroy->shortterm_users) == 0,
refcount_read(&to_destroy->wait_cnt) == 0,
msecs_to_jiffies(60000)))
return 0;
pr_crit("Time out waiting for iommufd object to become free\n");
refcount_inc(&to_destroy->shortterm_users);
refcount_inc(&to_destroy->wait_cnt);
return -EBUSY;
}
@ -184,17 +184,18 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
{
struct iommufd_object *obj;
XA_STATE(xas, &ictx->objects, id);
bool zerod_shortterm = false;
bool zerod_wait_cnt = false;
int ret;
/*
* The purpose of the shortterm_users is to ensure deterministic
* destruction of objects used by external drivers and destroyed by this
* function. Any temporary increment of the refcount must increment
* shortterm_users, such as during ioctl execution.
* The purpose of the wait_cnt is to ensure deterministic destruction
* of objects used by external drivers and destroyed by this function.
* Incrementing this wait_cnt should either be short lived, such as
* during ioctl execution, or be revoked and blocked during
* pre_destroy(), such as vdev holding the idev's refcount.
*/
if (flags & REMOVE_WAIT_SHORTTERM) {
ret = iommufd_object_dec_wait_shortterm(ictx, to_destroy);
if (flags & REMOVE_WAIT) {
ret = iommufd_object_dec_wait(ictx, to_destroy);
if (ret) {
/*
* We have a bug. Put back the callers reference and
@ -203,7 +204,7 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
refcount_dec(&to_destroy->users);
return ret;
}
zerod_shortterm = true;
zerod_wait_cnt = true;
}
xa_lock(&ictx->objects);
@ -235,11 +236,11 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
xa_unlock(&ictx->objects);
/*
* Since users is zero any positive users_shortterm must be racing
* Since users is zero any positive wait_cnt must be racing
* iommufd_put_object(), or we have a bug.
*/
if (!zerod_shortterm) {
ret = iommufd_object_dec_wait_shortterm(ictx, obj);
if (!zerod_wait_cnt) {
ret = iommufd_object_dec_wait(ictx, obj);
if (WARN_ON(ret))
return ret;
}
@ -249,9 +250,9 @@ int iommufd_object_remove(struct iommufd_ctx *ictx,
return 0;
err_xa:
if (zerod_shortterm) {
if (zerod_wait_cnt) {
/* Restore the xarray owned reference */
refcount_set(&obj->shortterm_users, 1);
refcount_set(&obj->wait_cnt, 1);
}
xa_unlock(&ictx->objects);

View File

@ -205,8 +205,8 @@ int iommufd_vdevice_alloc_ioctl(struct iommufd_ucmd *ucmd)
vdev->viommu = viommu;
refcount_inc(&viommu->obj.users);
/*
* A short term users reference is held on the idev so long as we have
* the pointer. iommufd_device_pre_destroy() will revoke it before the
* A wait_cnt reference is held on the idev so long as we have the
* pointer. iommufd_device_pre_destroy() will revoke it before the
* idev real destruction.
*/
vdev->idev = idev;

View File

@ -46,7 +46,13 @@ enum iommufd_object_type {
/* Base struct for all objects with a userspace ID handle. */
struct iommufd_object {
refcount_t shortterm_users;
/*
* Destroy will sleep and wait for wait_cnt to go to zero. This allows
* concurrent users of the ID to reliably avoid causing a spurious
* destroy failure. Incrementing this count should either be short
* lived or be revoked and blocked during pre_destroy().
*/
refcount_t wait_cnt;
refcount_t users;
enum iommufd_object_type type;
unsigned int id;