github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

RDMA/erdma: Hold CQ references when processing EQ events

Browse Source 
EQ handlers look up CQs from dev->cq_xa and invoke CQ completion or
error callbacks outside the xarray lock. erdma_destroy_cq() can erase the
CQ from the xarray and free its queue buffer and doorbell record while a
previously scheduled EQ handler is still using the CQ.

Add a CQ refcount and take a reference under the xarray lock with
refcount_inc_not_zero(). Remove the CQ from the xarray before dropping
the destroy-path reference, then wait for in-flight EQ users before
releasing CQ resources.

Fixes: 1550557717 ("RDMA/erdma: Add verbs implementation")
Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
Link: https://patch.msgid.link/20260730124357.12976-1-chengyou@linux.alibaba.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
This commit is contained in:
Cheng Xu 2026-07-30 20:43:53 +08:00 committed by Leon Romanovsky
parent 6aad80a1d4
commit 98df2aee14
3 changed files with 37 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/infiniband/hw/erdma/erdma_eq.c
View File

@ -52,7 +52,7 @@ void erdma_aeq_event_handler(struct erdma_dev *dev)
if (FIELD_GET(ERDMA_AEQE_HDR_TYPE_MASK,
le32_to_cpu(aeqe->hdr)) == ERDMA_AE_TYPE_CQ_ERR) {
cqn = le32_to_cpu(aeqe->event_data0);
cq = find_cq_by_cqn(dev, cqn);
cq = erdma_cq_get_by_cqn(dev, cqn);
if (!cq)
continue;
@ -62,6 +62,7 @@ void erdma_aeq_event_handler(struct erdma_dev *dev)
if (cq->ibcq.event_handler)
cq->ibcq.event_handler(&event,
cq->ibcq.cq_context);
erdma_cq_put(cq);
} else {
qpn = le32_to_cpu(aeqe->event_data0);
qp = find_qp_by_qpn(dev, qpn);
@ -157,7 +158,7 @@ void erdma_ceq_completion_handler(struct erdma_eq_cb *ceq_cb)
poll_cnt++;
cqn = FIELD_GET(ERDMA_CEQE_HDR_CQN_MASK, READ_ONCE(*ceqe));
cq = find_cq_by_cqn(dev, cqn);
cq = erdma_cq_get_by_cqn(dev, cqn);
if (!cq)
continue;
@ -166,6 +167,7 @@ void erdma_ceq_completion_handler(struct erdma_eq_cb *ceq_cb)
if (cq->ibcq.comp_handler)
cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
erdma_cq_put(cq);
}
notify_eq(&ceq_cb->eq);

12
drivers/infiniband/hw/erdma/erdma_verbs.c
View File

@ -1326,6 +1326,7 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
struct erdma_dev *dev = to_edev(ibcq->device);
struct erdma_ucontext *ctx = rdma_udata_to_drv_context(
udata, struct erdma_ucontext, ibucontext);
unsigned long flags;
int err;
struct erdma_cmdq_destroy_cq_req req;
@ -1340,6 +1341,13 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
"failed to destroy CQ %u: %d\n",
cq->cqn, err);
xa_lock_irqsave(&dev->cq_xa, flags);
__xa_erase(&dev->cq_xa, cq->cqn);
xa_unlock_irqrestore(&dev->cq_xa, flags);
erdma_cq_put(cq);
wait_for_completion(&cq->free);
if (rdma_is_kernel_res(&cq->ibcq.res)) {
dma_free_coherent(&dev->pdev->dev, cq->depth << CQE_SHIFT,
cq->kern_cq.qbuf, cq->kern_cq.qbuf_dma_addr);
@ -1350,8 +1358,6 @@ int erdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
put_mtt_entries(dev, &cq->user_cq.qbuf_mem);
}
xa_erase(&dev->cq_xa, cq->cqn);
return 0;
}
@ -1980,6 +1986,8 @@ int erdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
cq->ibcq.cqe = depth;
cq->depth = depth;
cq->assoc_eqn = attr->comp_vector + 1;
refcount_set(&cq->refcount, 1);
init_completion(&cq->free);
ret = xa_alloc_cyclic(&dev->cq_xa, &cq->cqn, cq,
XA_LIMIT(1, dev->attrs.max_cq - 1),

25
drivers/infiniband/hw/erdma/erdma_verbs.h
View File

@ -7,6 +7,9 @@
#ifndef __ERDMA_VERBS_H__
#define __ERDMA_VERBS_H__
#include <linux/completion.h>
#include <linux/refcount.h>
#include "erdma.h"
/* RDMA Capability. */
@ -341,6 +344,8 @@ struct erdma_cq {
u32 depth;
u32 assoc_eqn;
refcount_t refcount;
struct completion free;
union {
struct erdma_kcq_info kern_cq;
@ -355,9 +360,25 @@ static inline struct erdma_qp *find_qp_by_qpn(struct erdma_dev *dev, int id)
return (struct erdma_qp *)xa_load(&dev->qp_xa, id);
}
static inline struct erdma_cq *find_cq_by_cqn(struct erdma_dev *dev, int id)
static inline struct erdma_cq *erdma_cq_get_by_cqn(struct erdma_dev *dev,
int id)
{
return (struct erdma_cq *)xa_load(&dev->cq_xa, id);
struct erdma_cq *cq;
unsigned long flags;
xa_lock_irqsave(&dev->cq_xa, flags);
cq = xa_load(&dev->cq_xa, id);
if (cq && !refcount_inc_not_zero(&cq->refcount))
cq = NULL;
xa_unlock_irqrestore(&dev->cq_xa, flags);
return cq;
}
static inline void erdma_cq_put(struct erdma_cq *cq)
{
if (refcount_dec_and_test(&cq->refcount))
complete(&cq->free);
}
void erdma_qp_get(struct erdma_qp *qp);