1 /*
2 * Copyright (c) 2013-2015, Mellanox Technologies. All rights reserved.
3 *
4 * This software is available to you under a choice of one of two
5 * licenses. You may choose to be licensed under the terms of the GNU
6 * General Public License (GPL) Version 2, available from the file
7 * COPYING in the main directory of this source tree, or the
8 * OpenIB.org BSD license below:
9 *
10 * Redistribution and use in source and binary forms, with or
11 * without modification, are permitted provided that the following
12 * conditions are met:
13 *
14 * - Redistributions of source code must retain the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer.
17 *
18 * - Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following
20 * disclaimer in the documentation and/or other materials
21 * provided with the distribution.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30 * SOFTWARE.
31 */
32
33 #include <rdma/ib_umem_odp.h>
34 #include <linux/kernel.h>
35 #include <linux/dma-buf.h>
36 #include <linux/dma-resv.h>
37
38 #include "mlx5_ib.h"
39 #include "cmd.h"
40 #include "umr.h"
41 #include "qp.h"
42
43 #include <linux/mlx5/eq.h>
44
45 /* Contains the details of a pagefault. */
46 struct mlx5_pagefault {
47 u32 bytes_committed;
48 u64 token;
49 u8 event_subtype;
50 u8 type;
51 union {
52 /* Initiator or send message responder pagefault details. */
53 struct {
54 /* Received packet size, only valid for responders. */
55 u32 packet_size;
56 /*
57 * Number of resource holding WQE, depends on type.
58 */
59 u32 wq_num;
60 /*
61 * WQE index. Refers to either the send queue or
62 * receive queue, according to event_subtype.
63 */
64 u16 wqe_index;
65 } wqe;
66 /* RDMA responder pagefault details */
67 struct {
68 u32 r_key;
69 /*
70 * Received packet size, minimal size page fault
71 * resolution required for forward progress.
72 */
73 u32 packet_size;
74 u32 rdma_op_len;
75 u64 rdma_va;
76 } rdma;
77 struct {
78 u64 va;
79 u32 mkey;
80 u32 fault_byte_count;
81 u32 prefetch_before_byte_count;
82 u32 prefetch_after_byte_count;
83 u8 flags;
84 } memory;
85 };
86
87 struct mlx5_ib_pf_eq *eq;
88 struct work_struct work;
89 };
90
91 #define MAX_PREFETCH_LEN (4*1024*1024U)
92
93 /* Timeout in ms to wait for an active mmu notifier to complete when handling
94 * a pagefault. */
95 #define MMU_NOTIFIER_TIMEOUT 1000
96
97 #define MLX5_IMR_MTT_BITS (30 - PAGE_SHIFT)
98 #define MLX5_IMR_MTT_SHIFT (MLX5_IMR_MTT_BITS + PAGE_SHIFT)
99 #define MLX5_IMR_MTT_ENTRIES BIT_ULL(MLX5_IMR_MTT_BITS)
100 #define MLX5_IMR_MTT_SIZE BIT_ULL(MLX5_IMR_MTT_SHIFT)
101 #define MLX5_IMR_MTT_MASK (~(MLX5_IMR_MTT_SIZE - 1))
102
103 #define MLX5_KSM_PAGE_SHIFT MLX5_IMR_MTT_SHIFT
104
105 static u64 mlx5_imr_ksm_entries;
106
populate_klm(struct mlx5_klm * pklm,size_t idx,size_t nentries,struct mlx5_ib_mr * imr,int flags)107 static void populate_klm(struct mlx5_klm *pklm, size_t idx, size_t nentries,
108 struct mlx5_ib_mr *imr, int flags)
109 {
110 struct mlx5_core_dev *dev = mr_to_mdev(imr)->mdev;
111 struct mlx5_klm *end = pklm + nentries;
112 int step = MLX5_CAP_ODP(dev, mem_page_fault) ? MLX5_IMR_MTT_SIZE : 0;
113 __be32 key = MLX5_CAP_ODP(dev, mem_page_fault) ?
114 cpu_to_be32(imr->null_mmkey.key) :
115 mr_to_mdev(imr)->mkeys.null_mkey;
116 u64 va =
117 MLX5_CAP_ODP(dev, mem_page_fault) ? idx * MLX5_IMR_MTT_SIZE : 0;
118
119 if (flags & MLX5_IB_UPD_XLT_ZAP) {
120 for (; pklm != end; pklm++, idx++, va += step) {
121 pklm->bcount = cpu_to_be32(MLX5_IMR_MTT_SIZE);
122 pklm->key = key;
123 pklm->va = cpu_to_be64(va);
124 }
125 return;
126 }
127
128 /*
129 * The locking here is pretty subtle. Ideally the implicit_children
130 * xarray would be protected by the umem_mutex, however that is not
131 * possible. Instead this uses a weaker update-then-lock pattern:
132 *
133 * xa_store()
134 * mutex_lock(umem_mutex)
135 * mlx5r_umr_update_xlt()
136 * mutex_unlock(umem_mutex)
137 * destroy lkey
138 *
139 * ie any change the xarray must be followed by the locked update_xlt
140 * before destroying.
141 *
142 * The umem_mutex provides the acquire/release semantic needed to make
143 * the xa_store() visible to a racing thread.
144 */
145 lockdep_assert_held(&to_ib_umem_odp(imr->umem)->umem_mutex);
146
147 for (; pklm != end; pklm++, idx++, va += step) {
148 struct mlx5_ib_mr *mtt = xa_load(&imr->implicit_children, idx);
149
150 pklm->bcount = cpu_to_be32(MLX5_IMR_MTT_SIZE);
151 if (mtt) {
152 pklm->key = cpu_to_be32(mtt->ibmr.lkey);
153 pklm->va = cpu_to_be64(idx * MLX5_IMR_MTT_SIZE);
154 } else {
155 pklm->key = key;
156 pklm->va = cpu_to_be64(va);
157 }
158 }
159 }
160
umem_dma_to_mtt(dma_addr_t umem_dma)161 static u64 umem_dma_to_mtt(dma_addr_t umem_dma)
162 {
163 u64 mtt_entry = umem_dma & ODP_DMA_ADDR_MASK;
164
165 if (umem_dma & ODP_READ_ALLOWED_BIT)
166 mtt_entry |= MLX5_IB_MTT_READ;
167 if (umem_dma & ODP_WRITE_ALLOWED_BIT)
168 mtt_entry |= MLX5_IB_MTT_WRITE;
169
170 return mtt_entry;
171 }
172
populate_mtt(__be64 * pas,size_t idx,size_t nentries,struct mlx5_ib_mr * mr,int flags)173 static void populate_mtt(__be64 *pas, size_t idx, size_t nentries,
174 struct mlx5_ib_mr *mr, int flags)
175 {
176 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
177 dma_addr_t pa;
178 size_t i;
179
180 if (flags & MLX5_IB_UPD_XLT_ZAP)
181 return;
182
183 for (i = 0; i < nentries; i++) {
184 pa = odp->dma_list[idx + i];
185 pas[i] = cpu_to_be64(umem_dma_to_mtt(pa));
186 }
187 }
188
mlx5_odp_populate_xlt(void * xlt,size_t idx,size_t nentries,struct mlx5_ib_mr * mr,int flags)189 void mlx5_odp_populate_xlt(void *xlt, size_t idx, size_t nentries,
190 struct mlx5_ib_mr *mr, int flags)
191 {
192 if (flags & MLX5_IB_UPD_XLT_INDIRECT) {
193 populate_klm(xlt, idx, nentries, mr, flags);
194 } else {
195 populate_mtt(xlt, idx, nentries, mr, flags);
196 }
197 }
198
199 /*
200 * This must be called after the mr has been removed from implicit_children.
201 * NOTE: The MR does not necessarily have to be
202 * empty here, parallel page faults could have raced with the free process and
203 * added pages to it.
204 */
free_implicit_child_mr_work(struct work_struct * work)205 static void free_implicit_child_mr_work(struct work_struct *work)
206 {
207 struct mlx5_ib_mr *mr =
208 container_of(work, struct mlx5_ib_mr, odp_destroy.work);
209 struct mlx5_ib_mr *imr = mr->parent;
210 struct ib_umem_odp *odp_imr = to_ib_umem_odp(imr->umem);
211 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
212
213 mlx5r_deref_wait_odp_mkey(&mr->mmkey);
214
215 mutex_lock(&odp_imr->umem_mutex);
216 mlx5r_umr_update_xlt(mr->parent,
217 ib_umem_start(odp) >> MLX5_IMR_MTT_SHIFT, 1, 0,
218 MLX5_IB_UPD_XLT_INDIRECT | MLX5_IB_UPD_XLT_ATOMIC);
219 mutex_unlock(&odp_imr->umem_mutex);
220 mlx5_ib_dereg_mr(&mr->ibmr, NULL);
221
222 mlx5r_deref_odp_mkey(&imr->mmkey);
223 }
224
destroy_unused_implicit_child_mr(struct mlx5_ib_mr * mr)225 static void destroy_unused_implicit_child_mr(struct mlx5_ib_mr *mr)
226 {
227 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
228 unsigned long idx = ib_umem_start(odp) >> MLX5_IMR_MTT_SHIFT;
229 struct mlx5_ib_mr *imr = mr->parent;
230
231 /*
232 * If userspace is racing freeing the parent implicit ODP MR then we can
233 * loose the race with parent destruction. In this case
234 * mlx5_ib_free_odp_mr() will free everything in the implicit_children
235 * xarray so NOP is fine. This child MR cannot be destroyed here because
236 * we are under its umem_mutex.
237 */
238 if (!refcount_inc_not_zero(&imr->mmkey.usecount))
239 return;
240
241 xa_lock(&imr->implicit_children);
242 if (__xa_cmpxchg(&imr->implicit_children, idx, mr, NULL, GFP_KERNEL) !=
243 mr) {
244 xa_unlock(&imr->implicit_children);
245 mlx5r_deref_odp_mkey(&imr->mmkey);
246 return;
247 }
248
249 if (MLX5_CAP_ODP(mr_to_mdev(mr)->mdev, mem_page_fault))
250 __xa_erase(&mr_to_mdev(mr)->odp_mkeys,
251 mlx5_base_mkey(mr->mmkey.key));
252 xa_unlock(&imr->implicit_children);
253
254 /* Freeing a MR is a sleeping operation, so bounce to a work queue */
255 INIT_WORK(&mr->odp_destroy.work, free_implicit_child_mr_work);
256 queue_work(system_unbound_wq, &mr->odp_destroy.work);
257 }
258
mlx5_ib_invalidate_range(struct mmu_interval_notifier * mni,const struct mmu_notifier_range * range,unsigned long cur_seq)259 static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,
260 const struct mmu_notifier_range *range,
261 unsigned long cur_seq)
262 {
263 struct ib_umem_odp *umem_odp =
264 container_of(mni, struct ib_umem_odp, notifier);
265 struct mlx5_ib_mr *mr;
266 const u64 umr_block_mask = MLX5_UMR_MTT_NUM_ENTRIES_ALIGNMENT - 1;
267 u64 idx = 0, blk_start_idx = 0;
268 u64 invalidations = 0;
269 unsigned long start;
270 unsigned long end;
271 int in_block = 0;
272 u64 addr;
273
274 if (!mmu_notifier_range_blockable(range))
275 return false;
276
277 mutex_lock(&umem_odp->umem_mutex);
278 mmu_interval_set_seq(mni, cur_seq);
279 /*
280 * If npages is zero then umem_odp->private may not be setup yet. This
281 * does not complete until after the first page is mapped for DMA.
282 */
283 if (!umem_odp->npages)
284 goto out;
285 mr = umem_odp->private;
286 if (!mr)
287 goto out;
288
289 start = max_t(u64, ib_umem_start(umem_odp), range->start);
290 end = min_t(u64, ib_umem_end(umem_odp), range->end);
291
292 /*
293 * Iteration one - zap the HW's MTTs. The notifiers_count ensures that
294 * while we are doing the invalidation, no page fault will attempt to
295 * overwrite the same MTTs. Concurent invalidations might race us,
296 * but they will write 0s as well, so no difference in the end result.
297 */
298 for (addr = start; addr < end; addr += BIT(umem_odp->page_shift)) {
299 idx = (addr - ib_umem_start(umem_odp)) >> umem_odp->page_shift;
300 /*
301 * Strive to write the MTTs in chunks, but avoid overwriting
302 * non-existing MTTs. The huristic here can be improved to
303 * estimate the cost of another UMR vs. the cost of bigger
304 * UMR.
305 */
306 if (umem_odp->dma_list[idx] &
307 (ODP_READ_ALLOWED_BIT | ODP_WRITE_ALLOWED_BIT)) {
308 if (!in_block) {
309 blk_start_idx = idx;
310 in_block = 1;
311 }
312 } else {
313 u64 umr_offset = idx & umr_block_mask;
314
315 if (in_block && umr_offset == 0) {
316 mlx5r_umr_update_xlt(mr, blk_start_idx,
317 idx - blk_start_idx, 0,
318 MLX5_IB_UPD_XLT_ZAP |
319 MLX5_IB_UPD_XLT_ATOMIC);
320 in_block = 0;
321 /* Count page invalidations */
322 invalidations += idx - blk_start_idx + 1;
323 }
324 }
325 }
326 if (in_block) {
327 mlx5r_umr_update_xlt(mr, blk_start_idx,
328 idx - blk_start_idx + 1, 0,
329 MLX5_IB_UPD_XLT_ZAP |
330 MLX5_IB_UPD_XLT_ATOMIC);
331 /* Count page invalidations */
332 invalidations += idx - blk_start_idx + 1;
333 }
334
335 mlx5_update_odp_stats_with_handled(mr, invalidations, invalidations);
336
337 /*
338 * We are now sure that the device will not access the
339 * memory. We can safely unmap it, and mark it as dirty if
340 * needed.
341 */
342
343 ib_umem_odp_unmap_dma_pages(umem_odp, start, end);
344
345 if (unlikely(!umem_odp->npages && mr->parent))
346 destroy_unused_implicit_child_mr(mr);
347 out:
348 mutex_unlock(&umem_odp->umem_mutex);
349 return true;
350 }
351
352 const struct mmu_interval_notifier_ops mlx5_mn_ops = {
353 .invalidate = mlx5_ib_invalidate_range,
354 };
355
internal_fill_odp_caps(struct mlx5_ib_dev * dev)356 static void internal_fill_odp_caps(struct mlx5_ib_dev *dev)
357 {
358 struct ib_odp_caps *caps = &dev->odp_caps;
359
360 memset(caps, 0, sizeof(*caps));
361
362 if (!MLX5_CAP_GEN(dev->mdev, pg) || !mlx5r_umr_can_load_pas(dev, 0))
363 return;
364
365 caps->general_caps = IB_ODP_SUPPORT;
366
367 if (MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset))
368 dev->odp_max_size = U64_MAX;
369 else
370 dev->odp_max_size = BIT_ULL(MLX5_MAX_UMR_SHIFT + PAGE_SHIFT);
371
372 if (MLX5_CAP_ODP_SCHEME(dev->mdev, ud_odp_caps.send))
373 caps->per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_SEND;
374
375 if (MLX5_CAP_ODP_SCHEME(dev->mdev, ud_odp_caps.srq_receive))
376 caps->per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
377
378 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.send))
379 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_SEND;
380
381 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.receive))
382 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_RECV;
383
384 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.write))
385 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_WRITE;
386
387 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.read))
388 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_READ;
389
390 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.atomic))
391 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_ATOMIC;
392
393 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.srq_receive))
394 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
395
396 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.send))
397 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_SEND;
398
399 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.receive))
400 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_RECV;
401
402 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.write))
403 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_WRITE;
404
405 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.read))
406 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_READ;
407
408 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.atomic))
409 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_ATOMIC;
410
411 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.srq_receive))
412 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
413
414 if (MLX5_CAP_GEN(dev->mdev, fixed_buffer_size) &&
415 MLX5_CAP_GEN(dev->mdev, null_mkey) &&
416 MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset) &&
417 !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled))
418 caps->general_caps |= IB_ODP_SUPPORT_IMPLICIT;
419 }
420
mlx5_ib_page_fault_resume(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault,int error)421 static void mlx5_ib_page_fault_resume(struct mlx5_ib_dev *dev,
422 struct mlx5_pagefault *pfault,
423 int error)
424 {
425 int wq_num = pfault->event_subtype == MLX5_PFAULT_SUBTYPE_WQE ?
426 pfault->wqe.wq_num : pfault->token;
427 u32 in[MLX5_ST_SZ_DW(page_fault_resume_in)] = {};
428 void *info;
429 int err;
430
431 MLX5_SET(page_fault_resume_in, in, opcode, MLX5_CMD_OP_PAGE_FAULT_RESUME);
432
433 if (pfault->event_subtype == MLX5_PFAULT_SUBTYPE_MEMORY) {
434 info = MLX5_ADDR_OF(page_fault_resume_in, in,
435 page_fault_info.mem_page_fault_info);
436 MLX5_SET(mem_page_fault_info, info, fault_token_31_0,
437 pfault->token & 0xffffffff);
438 MLX5_SET(mem_page_fault_info, info, fault_token_47_32,
439 (pfault->token >> 32) & 0xffff);
440 MLX5_SET(mem_page_fault_info, info, error, !!error);
441 } else {
442 info = MLX5_ADDR_OF(page_fault_resume_in, in,
443 page_fault_info.trans_page_fault_info);
444 MLX5_SET(trans_page_fault_info, info, page_fault_type,
445 pfault->type);
446 MLX5_SET(trans_page_fault_info, info, fault_token,
447 pfault->token);
448 MLX5_SET(trans_page_fault_info, info, wq_number, wq_num);
449 MLX5_SET(trans_page_fault_info, info, error, !!error);
450 }
451
452 err = mlx5_cmd_exec_in(dev->mdev, page_fault_resume, in);
453 if (err)
454 mlx5_ib_err(dev, "Failed to resolve the page fault on WQ 0x%x err %d\n",
455 wq_num, err);
456 }
457
implicit_get_child_mr(struct mlx5_ib_mr * imr,unsigned long idx)458 static struct mlx5_ib_mr *implicit_get_child_mr(struct mlx5_ib_mr *imr,
459 unsigned long idx)
460 {
461 struct mlx5_ib_dev *dev = mr_to_mdev(imr);
462 struct ib_umem_odp *odp;
463 struct mlx5_ib_mr *mr;
464 struct mlx5_ib_mr *ret;
465 int err;
466
467 odp = ib_umem_odp_alloc_child(to_ib_umem_odp(imr->umem),
468 idx * MLX5_IMR_MTT_SIZE,
469 MLX5_IMR_MTT_SIZE, &mlx5_mn_ops);
470 if (IS_ERR(odp))
471 return ERR_CAST(odp);
472
473 mr = mlx5_mr_cache_alloc(dev, imr->access_flags,
474 MLX5_MKC_ACCESS_MODE_MTT,
475 MLX5_IMR_MTT_ENTRIES);
476 if (IS_ERR(mr)) {
477 ib_umem_odp_release(odp);
478 return mr;
479 }
480
481 mr->access_flags = imr->access_flags;
482 mr->ibmr.pd = imr->ibmr.pd;
483 mr->ibmr.device = &mr_to_mdev(imr)->ib_dev;
484 mr->umem = &odp->umem;
485 mr->ibmr.lkey = mr->mmkey.key;
486 mr->ibmr.rkey = mr->mmkey.key;
487 mr->ibmr.iova = idx * MLX5_IMR_MTT_SIZE;
488 mr->parent = imr;
489 odp->private = mr;
490
491 /*
492 * First refcount is owned by the xarray and second refconut
493 * is returned to the caller.
494 */
495 refcount_set(&mr->mmkey.usecount, 2);
496
497 err = mlx5r_umr_update_xlt(mr, 0,
498 MLX5_IMR_MTT_ENTRIES,
499 PAGE_SHIFT,
500 MLX5_IB_UPD_XLT_ZAP |
501 MLX5_IB_UPD_XLT_ENABLE);
502 if (err) {
503 ret = ERR_PTR(err);
504 goto out_mr;
505 }
506
507 xa_lock(&imr->implicit_children);
508 ret = __xa_cmpxchg(&imr->implicit_children, idx, NULL, mr,
509 GFP_KERNEL);
510 if (unlikely(ret)) {
511 if (xa_is_err(ret)) {
512 ret = ERR_PTR(xa_err(ret));
513 goto out_lock;
514 }
515 /*
516 * Another thread beat us to creating the child mr, use
517 * theirs.
518 */
519 refcount_inc(&ret->mmkey.usecount);
520 goto out_lock;
521 }
522
523 if (MLX5_CAP_ODP(dev->mdev, mem_page_fault)) {
524 ret = __xa_store(&dev->odp_mkeys, mlx5_base_mkey(mr->mmkey.key),
525 &mr->mmkey, GFP_KERNEL);
526 if (xa_is_err(ret)) {
527 ret = ERR_PTR(xa_err(ret));
528 __xa_erase(&imr->implicit_children, idx);
529 goto out_lock;
530 }
531 mr->mmkey.type = MLX5_MKEY_IMPLICIT_CHILD;
532 }
533 xa_unlock(&imr->implicit_children);
534 mlx5_ib_dbg(mr_to_mdev(imr), "key %x mr %p\n", mr->mmkey.key, mr);
535 return mr;
536
537 out_lock:
538 xa_unlock(&imr->implicit_children);
539 out_mr:
540 mlx5_ib_dereg_mr(&mr->ibmr, NULL);
541 return ret;
542 }
543
544 /*
545 * When using memory scheme ODP, implicit MRs can't use the reserved null mkey
546 * and each implicit MR needs to assign a private null mkey to get the page
547 * faults on.
548 * The null mkey is created with the properties to enable getting the page
549 * fault for every time it is accessed and having all relevant access flags.
550 */
alloc_implicit_mr_null_mkey(struct mlx5_ib_dev * dev,struct mlx5_ib_mr * imr,struct mlx5_ib_pd * pd)551 static int alloc_implicit_mr_null_mkey(struct mlx5_ib_dev *dev,
552 struct mlx5_ib_mr *imr,
553 struct mlx5_ib_pd *pd)
554 {
555 size_t inlen = MLX5_ST_SZ_BYTES(create_mkey_in) + 64;
556 void *mkc;
557 u32 *in;
558 int err;
559
560 in = kzalloc(inlen, GFP_KERNEL);
561 if (!in)
562 return -ENOMEM;
563
564 MLX5_SET(create_mkey_in, in, translations_octword_actual_size, 4);
565 MLX5_SET(create_mkey_in, in, pg_access, 1);
566
567 mkc = MLX5_ADDR_OF(create_mkey_in, in, memory_key_mkey_entry);
568 MLX5_SET(mkc, mkc, a, 1);
569 MLX5_SET(mkc, mkc, rw, 1);
570 MLX5_SET(mkc, mkc, rr, 1);
571 MLX5_SET(mkc, mkc, lw, 1);
572 MLX5_SET(mkc, mkc, lr, 1);
573 MLX5_SET(mkc, mkc, free, 0);
574 MLX5_SET(mkc, mkc, umr_en, 0);
575 MLX5_SET(mkc, mkc, access_mode_1_0, MLX5_MKC_ACCESS_MODE_MTT);
576
577 MLX5_SET(mkc, mkc, translations_octword_size, 4);
578 MLX5_SET(mkc, mkc, log_page_size, 61);
579 MLX5_SET(mkc, mkc, length64, 1);
580 MLX5_SET(mkc, mkc, pd, pd->pdn);
581 MLX5_SET64(mkc, mkc, start_addr, 0);
582 MLX5_SET(mkc, mkc, qpn, 0xffffff);
583
584 err = mlx5_core_create_mkey(dev->mdev, &imr->null_mmkey.key, in, inlen);
585 if (err)
586 goto free_in;
587
588 imr->null_mmkey.type = MLX5_MKEY_NULL;
589
590 free_in:
591 kfree(in);
592 return err;
593 }
594
mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd * pd,int access_flags)595 struct mlx5_ib_mr *mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd *pd,
596 int access_flags)
597 {
598 struct mlx5_ib_dev *dev = to_mdev(pd->ibpd.device);
599 struct ib_umem_odp *umem_odp;
600 struct mlx5_ib_mr *imr;
601 int err;
602
603 if (!mlx5r_umr_can_load_pas(dev, MLX5_IMR_MTT_ENTRIES * PAGE_SIZE))
604 return ERR_PTR(-EOPNOTSUPP);
605
606 umem_odp = ib_umem_odp_alloc_implicit(&dev->ib_dev, access_flags);
607 if (IS_ERR(umem_odp))
608 return ERR_CAST(umem_odp);
609
610 imr = mlx5_mr_cache_alloc(dev, access_flags, MLX5_MKC_ACCESS_MODE_KSM,
611 mlx5_imr_ksm_entries);
612 if (IS_ERR(imr)) {
613 ib_umem_odp_release(umem_odp);
614 return imr;
615 }
616
617 imr->access_flags = access_flags;
618 imr->ibmr.pd = &pd->ibpd;
619 imr->ibmr.iova = 0;
620 imr->umem = &umem_odp->umem;
621 imr->ibmr.lkey = imr->mmkey.key;
622 imr->ibmr.rkey = imr->mmkey.key;
623 imr->ibmr.device = &dev->ib_dev;
624 imr->is_odp_implicit = true;
625 xa_init(&imr->implicit_children);
626
627 if (MLX5_CAP_ODP(dev->mdev, mem_page_fault)) {
628 err = alloc_implicit_mr_null_mkey(dev, imr, pd);
629 if (err)
630 goto out_mr;
631
632 err = mlx5r_store_odp_mkey(dev, &imr->null_mmkey);
633 if (err)
634 goto out_mr;
635 }
636
637 err = mlx5r_umr_update_xlt(imr, 0,
638 mlx5_imr_ksm_entries,
639 MLX5_KSM_PAGE_SHIFT,
640 MLX5_IB_UPD_XLT_INDIRECT |
641 MLX5_IB_UPD_XLT_ZAP |
642 MLX5_IB_UPD_XLT_ENABLE);
643 if (err)
644 goto out_mr;
645
646 err = mlx5r_store_odp_mkey(dev, &imr->mmkey);
647 if (err)
648 goto out_mr;
649
650 mlx5_ib_dbg(dev, "key %x mr %p\n", imr->mmkey.key, imr);
651 return imr;
652 out_mr:
653 mlx5_ib_err(dev, "Failed to register MKEY %d\n", err);
654 mlx5_ib_dereg_mr(&imr->ibmr, NULL);
655 return ERR_PTR(err);
656 }
657
mlx5_ib_free_odp_mr(struct mlx5_ib_mr * mr)658 void mlx5_ib_free_odp_mr(struct mlx5_ib_mr *mr)
659 {
660 struct mlx5_ib_mr *mtt;
661 unsigned long idx;
662
663 /*
664 * If this is an implicit MR it is already invalidated so we can just
665 * delete the children mkeys.
666 */
667 xa_for_each(&mr->implicit_children, idx, mtt) {
668 xa_erase(&mr->implicit_children, idx);
669 mlx5_ib_dereg_mr(&mtt->ibmr, NULL);
670 }
671
672 if (mr->null_mmkey.key) {
673 xa_erase(&mr_to_mdev(mr)->odp_mkeys,
674 mlx5_base_mkey(mr->null_mmkey.key));
675
676 mlx5_core_destroy_mkey(mr_to_mdev(mr)->mdev,
677 mr->null_mmkey.key);
678 }
679 }
680
681 #define MLX5_PF_FLAGS_DOWNGRADE BIT(1)
682 #define MLX5_PF_FLAGS_SNAPSHOT BIT(2)
683 #define MLX5_PF_FLAGS_ENABLE BIT(3)
pagefault_real_mr(struct mlx5_ib_mr * mr,struct ib_umem_odp * odp,u64 user_va,size_t bcnt,u32 * bytes_mapped,u32 flags)684 static int pagefault_real_mr(struct mlx5_ib_mr *mr, struct ib_umem_odp *odp,
685 u64 user_va, size_t bcnt, u32 *bytes_mapped,
686 u32 flags)
687 {
688 int page_shift, ret, np;
689 bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE;
690 u64 access_mask;
691 u64 start_idx;
692 bool fault = !(flags & MLX5_PF_FLAGS_SNAPSHOT);
693 u32 xlt_flags = MLX5_IB_UPD_XLT_ATOMIC;
694
695 if (flags & MLX5_PF_FLAGS_ENABLE)
696 xlt_flags |= MLX5_IB_UPD_XLT_ENABLE;
697
698 page_shift = odp->page_shift;
699 start_idx = (user_va - ib_umem_start(odp)) >> page_shift;
700 access_mask = ODP_READ_ALLOWED_BIT;
701
702 if (odp->umem.writable && !downgrade)
703 access_mask |= ODP_WRITE_ALLOWED_BIT;
704
705 np = ib_umem_odp_map_dma_and_lock(odp, user_va, bcnt, access_mask, fault);
706 if (np < 0)
707 return np;
708
709 /*
710 * No need to check whether the MTTs really belong to this MR, since
711 * ib_umem_odp_map_dma_and_lock already checks this.
712 */
713 ret = mlx5r_umr_update_xlt(mr, start_idx, np, page_shift, xlt_flags);
714 mutex_unlock(&odp->umem_mutex);
715
716 if (ret < 0) {
717 if (ret != -EAGAIN)
718 mlx5_ib_err(mr_to_mdev(mr),
719 "Failed to update mkey page tables\n");
720 goto out;
721 }
722
723 if (bytes_mapped) {
724 u32 new_mappings = (np << page_shift) -
725 (user_va - round_down(user_va, 1 << page_shift));
726
727 *bytes_mapped += min_t(u32, new_mappings, bcnt);
728 }
729
730 return np << (page_shift - PAGE_SHIFT);
731
732 out:
733 return ret;
734 }
735
pagefault_implicit_mr(struct mlx5_ib_mr * imr,struct ib_umem_odp * odp_imr,u64 user_va,size_t bcnt,u32 * bytes_mapped,u32 flags)736 static int pagefault_implicit_mr(struct mlx5_ib_mr *imr,
737 struct ib_umem_odp *odp_imr, u64 user_va,
738 size_t bcnt, u32 *bytes_mapped, u32 flags)
739 {
740 unsigned long end_idx = (user_va + bcnt - 1) >> MLX5_IMR_MTT_SHIFT;
741 unsigned long upd_start_idx = end_idx + 1;
742 unsigned long upd_len = 0;
743 unsigned long npages = 0;
744 int err;
745 int ret;
746
747 if (unlikely(user_va >= mlx5_imr_ksm_entries * MLX5_IMR_MTT_SIZE ||
748 mlx5_imr_ksm_entries * MLX5_IMR_MTT_SIZE - user_va < bcnt))
749 return -EFAULT;
750
751 /* Fault each child mr that intersects with our interval. */
752 while (bcnt) {
753 unsigned long idx = user_va >> MLX5_IMR_MTT_SHIFT;
754 struct ib_umem_odp *umem_odp;
755 struct mlx5_ib_mr *mtt;
756 u64 len;
757
758 xa_lock(&imr->implicit_children);
759 mtt = xa_load(&imr->implicit_children, idx);
760 if (unlikely(!mtt)) {
761 xa_unlock(&imr->implicit_children);
762 mtt = implicit_get_child_mr(imr, idx);
763 if (IS_ERR(mtt)) {
764 ret = PTR_ERR(mtt);
765 goto out;
766 }
767 upd_start_idx = min(upd_start_idx, idx);
768 upd_len = idx - upd_start_idx + 1;
769 } else {
770 refcount_inc(&mtt->mmkey.usecount);
771 xa_unlock(&imr->implicit_children);
772 }
773
774 umem_odp = to_ib_umem_odp(mtt->umem);
775 len = min_t(u64, user_va + bcnt, ib_umem_end(umem_odp)) -
776 user_va;
777
778 ret = pagefault_real_mr(mtt, umem_odp, user_va, len,
779 bytes_mapped, flags);
780
781 mlx5r_deref_odp_mkey(&mtt->mmkey);
782
783 if (ret < 0)
784 goto out;
785 user_va += len;
786 bcnt -= len;
787 npages += ret;
788 }
789
790 ret = npages;
791
792 /*
793 * Any time the implicit_children are changed we must perform an
794 * update of the xlt before exiting to ensure the HW and the
795 * implicit_children remains synchronized.
796 */
797 out:
798 if (likely(!upd_len))
799 return ret;
800
801 /*
802 * Notice this is not strictly ordered right, the KSM is updated after
803 * the implicit_children is updated, so a parallel page fault could
804 * see a MR that is not yet visible in the KSM. This is similar to a
805 * parallel page fault seeing a MR that is being concurrently removed
806 * from the KSM. Both of these improbable situations are resolved
807 * safely by resuming the HW and then taking another page fault. The
808 * next pagefault handler will see the new information.
809 */
810 mutex_lock(&odp_imr->umem_mutex);
811 err = mlx5r_umr_update_xlt(imr, upd_start_idx, upd_len, 0,
812 MLX5_IB_UPD_XLT_INDIRECT |
813 MLX5_IB_UPD_XLT_ATOMIC);
814 mutex_unlock(&odp_imr->umem_mutex);
815 if (err) {
816 mlx5_ib_err(mr_to_mdev(imr), "Failed to update PAS\n");
817 return err;
818 }
819 return ret;
820 }
821
pagefault_dmabuf_mr(struct mlx5_ib_mr * mr,size_t bcnt,u32 * bytes_mapped,u32 flags)822 static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt,
823 u32 *bytes_mapped, u32 flags)
824 {
825 struct ib_umem_dmabuf *umem_dmabuf = to_ib_umem_dmabuf(mr->umem);
826 u32 xlt_flags = 0;
827 int err;
828 unsigned long page_size;
829
830 if (flags & MLX5_PF_FLAGS_ENABLE)
831 xlt_flags |= MLX5_IB_UPD_XLT_ENABLE;
832
833 dma_resv_lock(umem_dmabuf->attach->dmabuf->resv, NULL);
834 err = ib_umem_dmabuf_map_pages(umem_dmabuf);
835 if (err) {
836 dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv);
837 return err;
838 }
839
840 page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf);
841 if (!page_size) {
842 ib_umem_dmabuf_unmap_pages(umem_dmabuf);
843 err = -EINVAL;
844 } else {
845 if (mr->data_direct)
846 err = mlx5r_umr_update_data_direct_ksm_pas(mr, xlt_flags);
847 else
848 err = mlx5r_umr_update_mr_pas(mr, xlt_flags);
849 }
850 dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv);
851
852 if (err)
853 return err;
854
855 if (bytes_mapped)
856 *bytes_mapped += bcnt;
857
858 return ib_umem_num_pages(mr->umem);
859 }
860
861 /*
862 * Returns:
863 * -EFAULT: The io_virt->bcnt is not within the MR, it covers pages that are
864 * not accessible, or the MR is no longer valid.
865 * -EAGAIN/-ENOMEM: The operation should be retried
866 *
867 * -EINVAL/others: General internal malfunction
868 * >0: Number of pages mapped
869 */
pagefault_mr(struct mlx5_ib_mr * mr,u64 io_virt,size_t bcnt,u32 * bytes_mapped,u32 flags,bool permissive_fault)870 static int pagefault_mr(struct mlx5_ib_mr *mr, u64 io_virt, size_t bcnt,
871 u32 *bytes_mapped, u32 flags, bool permissive_fault)
872 {
873 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
874
875 if (unlikely(io_virt < mr->ibmr.iova) && !permissive_fault)
876 return -EFAULT;
877
878 if (mr->umem->is_dmabuf)
879 return pagefault_dmabuf_mr(mr, bcnt, bytes_mapped, flags);
880
881 if (!odp->is_implicit_odp) {
882 u64 offset = io_virt < mr->ibmr.iova ? 0 : io_virt - mr->ibmr.iova;
883 u64 user_va;
884
885 if (check_add_overflow(offset, (u64)odp->umem.address,
886 &user_va))
887 return -EFAULT;
888
889 if (permissive_fault) {
890 if (user_va < ib_umem_start(odp))
891 user_va = ib_umem_start(odp);
892 if ((user_va + bcnt) > ib_umem_end(odp))
893 bcnt = ib_umem_end(odp) - user_va;
894 } else if (unlikely(user_va >= ib_umem_end(odp) ||
895 ib_umem_end(odp) - user_va < bcnt))
896 return -EFAULT;
897 return pagefault_real_mr(mr, odp, user_va, bcnt, bytes_mapped,
898 flags);
899 }
900 return pagefault_implicit_mr(mr, odp, io_virt, bcnt, bytes_mapped,
901 flags);
902 }
903
mlx5_ib_init_odp_mr(struct mlx5_ib_mr * mr)904 int mlx5_ib_init_odp_mr(struct mlx5_ib_mr *mr)
905 {
906 int ret;
907
908 ret = pagefault_real_mr(mr, to_ib_umem_odp(mr->umem), mr->umem->address,
909 mr->umem->length, NULL,
910 MLX5_PF_FLAGS_SNAPSHOT | MLX5_PF_FLAGS_ENABLE);
911 return ret >= 0 ? 0 : ret;
912 }
913
mlx5_ib_init_dmabuf_mr(struct mlx5_ib_mr * mr)914 int mlx5_ib_init_dmabuf_mr(struct mlx5_ib_mr *mr)
915 {
916 int ret;
917
918 ret = pagefault_dmabuf_mr(mr, mr->umem->length, NULL,
919 MLX5_PF_FLAGS_ENABLE);
920
921 return ret >= 0 ? 0 : ret;
922 }
923
924 struct pf_frame {
925 struct pf_frame *next;
926 u32 key;
927 u64 io_virt;
928 size_t bcnt;
929 int depth;
930 };
931
mkey_is_eq(struct mlx5_ib_mkey * mmkey,u32 key)932 static bool mkey_is_eq(struct mlx5_ib_mkey *mmkey, u32 key)
933 {
934 if (!mmkey)
935 return false;
936 if (mmkey->type == MLX5_MKEY_MW ||
937 mmkey->type == MLX5_MKEY_INDIRECT_DEVX)
938 return mlx5_base_mkey(mmkey->key) == mlx5_base_mkey(key);
939 return mmkey->key == key;
940 }
941
find_odp_mkey(struct mlx5_ib_dev * dev,u32 key)942 static struct mlx5_ib_mkey *find_odp_mkey(struct mlx5_ib_dev *dev, u32 key)
943 {
944 struct mlx5_ib_mkey *mmkey;
945
946 xa_lock(&dev->odp_mkeys);
947 mmkey = xa_load(&dev->odp_mkeys, mlx5_base_mkey(key));
948 if (!mmkey) {
949 mmkey = ERR_PTR(-ENOENT);
950 goto out;
951 }
952 if (!mkey_is_eq(mmkey, key)) {
953 mmkey = ERR_PTR(-EFAULT);
954 goto out;
955 }
956 refcount_inc(&mmkey->usecount);
957 out:
958 xa_unlock(&dev->odp_mkeys);
959
960 return mmkey;
961 }
962
963 /*
964 * Handle a single data segment in a page-fault WQE or RDMA region.
965 *
966 * Returns zero on success. The caller may continue to the next data segment.
967 * Can return the following error codes:
968 * -EAGAIN to designate a temporary error. The caller will abort handling the
969 * page fault and resolve it.
970 * -EFAULT when there's an error mapping the requested pages. The caller will
971 * abort the page fault handling.
972 */
pagefault_single_data_segment(struct mlx5_ib_dev * dev,struct ib_pd * pd,u32 key,u64 io_virt,size_t bcnt,u32 * bytes_committed,u32 * bytes_mapped)973 static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,
974 struct ib_pd *pd, u32 key,
975 u64 io_virt, size_t bcnt,
976 u32 *bytes_committed,
977 u32 *bytes_mapped)
978 {
979 int ret, i, outlen, cur_outlen = 0, depth = 0, pages_in_range;
980 struct pf_frame *head = NULL, *frame;
981 struct mlx5_ib_mkey *mmkey;
982 struct mlx5_ib_mr *mr;
983 struct mlx5_klm *pklm;
984 u32 *out = NULL;
985 size_t offset;
986
987 io_virt += *bytes_committed;
988 bcnt -= *bytes_committed;
989 next_mr:
990 mmkey = find_odp_mkey(dev, key);
991 if (IS_ERR(mmkey)) {
992 ret = PTR_ERR(mmkey);
993 if (ret == -ENOENT) {
994 mlx5_ib_dbg(
995 dev,
996 "skipping non ODP MR (lkey=0x%06x) in page fault handler.\n",
997 key);
998 if (bytes_mapped)
999 *bytes_mapped += bcnt;
1000 /*
1001 * The user could specify a SGL with multiple lkeys and
1002 * only some of them are ODP. Treat the non-ODP ones as
1003 * fully faulted.
1004 */
1005 ret = 0;
1006 }
1007 goto end;
1008 }
1009
1010 switch (mmkey->type) {
1011 case MLX5_MKEY_MR:
1012 mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1013
1014 pages_in_range = (ALIGN(io_virt + bcnt, PAGE_SIZE) -
1015 (io_virt & PAGE_MASK)) >>
1016 PAGE_SHIFT;
1017 ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false);
1018 if (ret < 0)
1019 goto end;
1020
1021 mlx5_update_odp_stats_with_handled(mr, faults, ret);
1022
1023 if (ret < pages_in_range) {
1024 ret = -EFAULT;
1025 goto end;
1026 }
1027
1028 ret = 0;
1029 break;
1030
1031 case MLX5_MKEY_MW:
1032 case MLX5_MKEY_INDIRECT_DEVX:
1033 if (depth >= MLX5_CAP_GEN(dev->mdev, max_indirection)) {
1034 mlx5_ib_dbg(dev, "indirection level exceeded\n");
1035 ret = -EFAULT;
1036 goto end;
1037 }
1038
1039 outlen = MLX5_ST_SZ_BYTES(query_mkey_out) +
1040 sizeof(*pklm) * (mmkey->ndescs - 2);
1041
1042 if (outlen > cur_outlen) {
1043 kfree(out);
1044 out = kzalloc(outlen, GFP_KERNEL);
1045 if (!out) {
1046 ret = -ENOMEM;
1047 goto end;
1048 }
1049 cur_outlen = outlen;
1050 }
1051
1052 pklm = (struct mlx5_klm *)MLX5_ADDR_OF(query_mkey_out, out,
1053 bsf0_klm0_pas_mtt0_1);
1054
1055 ret = mlx5_core_query_mkey(dev->mdev, mmkey->key, out, outlen);
1056 if (ret)
1057 goto end;
1058
1059 offset = io_virt - MLX5_GET64(query_mkey_out, out,
1060 memory_key_mkey_entry.start_addr);
1061
1062 for (i = 0; bcnt && i < mmkey->ndescs; i++, pklm++) {
1063 if (offset >= be32_to_cpu(pklm->bcount)) {
1064 offset -= be32_to_cpu(pklm->bcount);
1065 continue;
1066 }
1067
1068 frame = kzalloc(sizeof(*frame), GFP_KERNEL);
1069 if (!frame) {
1070 ret = -ENOMEM;
1071 goto end;
1072 }
1073
1074 frame->key = be32_to_cpu(pklm->key);
1075 frame->io_virt = be64_to_cpu(pklm->va) + offset;
1076 frame->bcnt = min_t(size_t, bcnt,
1077 be32_to_cpu(pklm->bcount) - offset);
1078 frame->depth = depth + 1;
1079 frame->next = head;
1080 head = frame;
1081
1082 bcnt -= frame->bcnt;
1083 offset = 0;
1084 }
1085 break;
1086
1087 default:
1088 mlx5_ib_dbg(dev, "wrong mkey type %d\n", mmkey->type);
1089 ret = -EFAULT;
1090 goto end;
1091 }
1092
1093 if (head) {
1094 frame = head;
1095 head = frame->next;
1096
1097 key = frame->key;
1098 io_virt = frame->io_virt;
1099 bcnt = frame->bcnt;
1100 depth = frame->depth;
1101 kfree(frame);
1102
1103 mlx5r_deref_odp_mkey(mmkey);
1104 goto next_mr;
1105 }
1106
1107 end:
1108 if (!IS_ERR(mmkey))
1109 mlx5r_deref_odp_mkey(mmkey);
1110 while (head) {
1111 frame = head;
1112 head = frame->next;
1113 kfree(frame);
1114 }
1115 kfree(out);
1116
1117 *bytes_committed = 0;
1118 return ret;
1119 }
1120
1121 /*
1122 * Parse a series of data segments for page fault handling.
1123 *
1124 * @dev: Pointer to mlx5 IB device
1125 * @pfault: contains page fault information.
1126 * @wqe: points at the first data segment in the WQE.
1127 * @wqe_end: points after the end of the WQE.
1128 * @bytes_mapped: receives the number of bytes that the function was able to
1129 * map. This allows the caller to decide intelligently whether
1130 * enough memory was mapped to resolve the page fault
1131 * successfully (e.g. enough for the next MTU, or the entire
1132 * WQE).
1133 * @total_wqe_bytes: receives the total data size of this WQE in bytes (minus
1134 * the committed bytes).
1135 * @receive_queue: receive WQE end of sg list
1136 *
1137 * Returns zero for success or a negative error code.
1138 */
pagefault_data_segments(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault,void * wqe,void * wqe_end,u32 * bytes_mapped,u32 * total_wqe_bytes,bool receive_queue)1139 static int pagefault_data_segments(struct mlx5_ib_dev *dev,
1140 struct mlx5_pagefault *pfault,
1141 void *wqe,
1142 void *wqe_end, u32 *bytes_mapped,
1143 u32 *total_wqe_bytes, bool receive_queue)
1144 {
1145 int ret = 0;
1146 u64 io_virt;
1147 __be32 key;
1148 u32 byte_count;
1149 size_t bcnt;
1150 int inline_segment;
1151
1152 if (bytes_mapped)
1153 *bytes_mapped = 0;
1154 if (total_wqe_bytes)
1155 *total_wqe_bytes = 0;
1156
1157 while (wqe < wqe_end) {
1158 struct mlx5_wqe_data_seg *dseg = wqe;
1159
1160 io_virt = be64_to_cpu(dseg->addr);
1161 key = dseg->lkey;
1162 byte_count = be32_to_cpu(dseg->byte_count);
1163 inline_segment = !!(byte_count & MLX5_INLINE_SEG);
1164 bcnt = byte_count & ~MLX5_INLINE_SEG;
1165
1166 if (inline_segment) {
1167 bcnt = bcnt & MLX5_WQE_INLINE_SEG_BYTE_COUNT_MASK;
1168 wqe += ALIGN(sizeof(struct mlx5_wqe_inline_seg) + bcnt,
1169 16);
1170 } else {
1171 wqe += sizeof(*dseg);
1172 }
1173
1174 /* receive WQE end of sg list. */
1175 if (receive_queue && bcnt == 0 &&
1176 key == dev->mkeys.terminate_scatter_list_mkey &&
1177 io_virt == 0)
1178 break;
1179
1180 if (!inline_segment && total_wqe_bytes) {
1181 *total_wqe_bytes += bcnt - min_t(size_t, bcnt,
1182 pfault->bytes_committed);
1183 }
1184
1185 /* A zero length data segment designates a length of 2GB. */
1186 if (bcnt == 0)
1187 bcnt = 1U << 31;
1188
1189 if (inline_segment || bcnt <= pfault->bytes_committed) {
1190 pfault->bytes_committed -=
1191 min_t(size_t, bcnt,
1192 pfault->bytes_committed);
1193 continue;
1194 }
1195
1196 ret = pagefault_single_data_segment(dev, NULL, be32_to_cpu(key),
1197 io_virt, bcnt,
1198 &pfault->bytes_committed,
1199 bytes_mapped);
1200 if (ret < 0)
1201 break;
1202 }
1203
1204 return ret;
1205 }
1206
1207 /*
1208 * Parse initiator WQE. Advances the wqe pointer to point at the
1209 * scatter-gather list, and set wqe_end to the end of the WQE.
1210 */
mlx5_ib_mr_initiator_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault,struct mlx5_ib_qp * qp,void ** wqe,void ** wqe_end,int wqe_length)1211 static int mlx5_ib_mr_initiator_pfault_handler(
1212 struct mlx5_ib_dev *dev, struct mlx5_pagefault *pfault,
1213 struct mlx5_ib_qp *qp, void **wqe, void **wqe_end, int wqe_length)
1214 {
1215 struct mlx5_wqe_ctrl_seg *ctrl = *wqe;
1216 u16 wqe_index = pfault->wqe.wqe_index;
1217 struct mlx5_base_av *av;
1218 unsigned ds, opcode;
1219 u32 qpn = qp->trans_qp.base.mqp.qpn;
1220
1221 ds = be32_to_cpu(ctrl->qpn_ds) & MLX5_WQE_CTRL_DS_MASK;
1222 if (ds * MLX5_WQE_DS_UNITS > wqe_length) {
1223 mlx5_ib_err(dev, "Unable to read the complete WQE. ds = 0x%x, ret = 0x%x\n",
1224 ds, wqe_length);
1225 return -EFAULT;
1226 }
1227
1228 if (ds == 0) {
1229 mlx5_ib_err(dev, "Got WQE with zero DS. wqe_index=%x, qpn=%x\n",
1230 wqe_index, qpn);
1231 return -EFAULT;
1232 }
1233
1234 *wqe_end = *wqe + ds * MLX5_WQE_DS_UNITS;
1235 *wqe += sizeof(*ctrl);
1236
1237 opcode = be32_to_cpu(ctrl->opmod_idx_opcode) &
1238 MLX5_WQE_CTRL_OPCODE_MASK;
1239
1240 if (qp->type == IB_QPT_XRC_INI)
1241 *wqe += sizeof(struct mlx5_wqe_xrc_seg);
1242
1243 if (qp->type == IB_QPT_UD || qp->type == MLX5_IB_QPT_DCI) {
1244 av = *wqe;
1245 if (av->dqp_dct & cpu_to_be32(MLX5_EXTENDED_UD_AV))
1246 *wqe += sizeof(struct mlx5_av);
1247 else
1248 *wqe += sizeof(struct mlx5_base_av);
1249 }
1250
1251 switch (opcode) {
1252 case MLX5_OPCODE_RDMA_WRITE:
1253 case MLX5_OPCODE_RDMA_WRITE_IMM:
1254 case MLX5_OPCODE_RDMA_READ:
1255 *wqe += sizeof(struct mlx5_wqe_raddr_seg);
1256 break;
1257 case MLX5_OPCODE_ATOMIC_CS:
1258 case MLX5_OPCODE_ATOMIC_FA:
1259 *wqe += sizeof(struct mlx5_wqe_raddr_seg);
1260 *wqe += sizeof(struct mlx5_wqe_atomic_seg);
1261 break;
1262 }
1263
1264 return 0;
1265 }
1266
1267 /*
1268 * Parse responder WQE and set wqe_end to the end of the WQE.
1269 */
mlx5_ib_mr_responder_pfault_handler_srq(struct mlx5_ib_dev * dev,struct mlx5_ib_srq * srq,void ** wqe,void ** wqe_end,int wqe_length)1270 static int mlx5_ib_mr_responder_pfault_handler_srq(struct mlx5_ib_dev *dev,
1271 struct mlx5_ib_srq *srq,
1272 void **wqe, void **wqe_end,
1273 int wqe_length)
1274 {
1275 int wqe_size = 1 << srq->msrq.wqe_shift;
1276
1277 if (wqe_size > wqe_length) {
1278 mlx5_ib_err(dev, "Couldn't read all of the receive WQE's content\n");
1279 return -EFAULT;
1280 }
1281
1282 *wqe_end = *wqe + wqe_size;
1283 *wqe += sizeof(struct mlx5_wqe_srq_next_seg);
1284
1285 return 0;
1286 }
1287
mlx5_ib_mr_responder_pfault_handler_rq(struct mlx5_ib_dev * dev,struct mlx5_ib_qp * qp,void * wqe,void ** wqe_end,int wqe_length)1288 static int mlx5_ib_mr_responder_pfault_handler_rq(struct mlx5_ib_dev *dev,
1289 struct mlx5_ib_qp *qp,
1290 void *wqe, void **wqe_end,
1291 int wqe_length)
1292 {
1293 struct mlx5_ib_wq *wq = &qp->rq;
1294 int wqe_size = 1 << wq->wqe_shift;
1295
1296 if (qp->flags_en & MLX5_QP_FLAG_SIGNATURE) {
1297 mlx5_ib_err(dev, "ODP fault with WQE signatures is not supported\n");
1298 return -EFAULT;
1299 }
1300
1301 if (wqe_size > wqe_length) {
1302 mlx5_ib_err(dev, "Couldn't read all of the receive WQE's content\n");
1303 return -EFAULT;
1304 }
1305
1306 *wqe_end = wqe + wqe_size;
1307
1308 return 0;
1309 }
1310
odp_get_rsc(struct mlx5_ib_dev * dev,u32 wq_num,int pf_type)1311 static inline struct mlx5_core_rsc_common *odp_get_rsc(struct mlx5_ib_dev *dev,
1312 u32 wq_num, int pf_type)
1313 {
1314 struct mlx5_core_rsc_common *common = NULL;
1315 struct mlx5_core_srq *srq;
1316
1317 switch (pf_type) {
1318 case MLX5_WQE_PF_TYPE_RMP:
1319 srq = mlx5_cmd_get_srq(dev, wq_num);
1320 if (srq)
1321 common = &srq->common;
1322 break;
1323 case MLX5_WQE_PF_TYPE_REQ_SEND_OR_WRITE:
1324 case MLX5_WQE_PF_TYPE_RESP:
1325 case MLX5_WQE_PF_TYPE_REQ_READ_OR_ATOMIC:
1326 common = mlx5_core_res_hold(dev, wq_num, MLX5_RES_QP);
1327 break;
1328 default:
1329 break;
1330 }
1331
1332 return common;
1333 }
1334
res_to_qp(struct mlx5_core_rsc_common * res)1335 static inline struct mlx5_ib_qp *res_to_qp(struct mlx5_core_rsc_common *res)
1336 {
1337 struct mlx5_core_qp *mqp = (struct mlx5_core_qp *)res;
1338
1339 return to_mibqp(mqp);
1340 }
1341
res_to_srq(struct mlx5_core_rsc_common * res)1342 static inline struct mlx5_ib_srq *res_to_srq(struct mlx5_core_rsc_common *res)
1343 {
1344 struct mlx5_core_srq *msrq =
1345 container_of(res, struct mlx5_core_srq, common);
1346
1347 return to_mibsrq(msrq);
1348 }
1349
mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1350 static void mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev *dev,
1351 struct mlx5_pagefault *pfault)
1352 {
1353 bool sq = pfault->type & MLX5_PFAULT_REQUESTOR;
1354 u16 wqe_index = pfault->wqe.wqe_index;
1355 void *wqe, *wqe_start = NULL, *wqe_end = NULL;
1356 u32 bytes_mapped, total_wqe_bytes;
1357 struct mlx5_core_rsc_common *res;
1358 int resume_with_error = 1;
1359 struct mlx5_ib_qp *qp;
1360 size_t bytes_copied;
1361 int ret = 0;
1362
1363 res = odp_get_rsc(dev, pfault->wqe.wq_num, pfault->type);
1364 if (!res) {
1365 mlx5_ib_dbg(dev, "wqe page fault for missing resource %d\n", pfault->wqe.wq_num);
1366 return;
1367 }
1368
1369 if (res->res != MLX5_RES_QP && res->res != MLX5_RES_SRQ &&
1370 res->res != MLX5_RES_XSRQ) {
1371 mlx5_ib_err(dev, "wqe page fault for unsupported type %d\n",
1372 pfault->type);
1373 goto resolve_page_fault;
1374 }
1375
1376 wqe_start = (void *)__get_free_page(GFP_KERNEL);
1377 if (!wqe_start) {
1378 mlx5_ib_err(dev, "Error allocating memory for IO page fault handling.\n");
1379 goto resolve_page_fault;
1380 }
1381
1382 wqe = wqe_start;
1383 qp = (res->res == MLX5_RES_QP) ? res_to_qp(res) : NULL;
1384 if (qp && sq) {
1385 ret = mlx5_ib_read_wqe_sq(qp, wqe_index, wqe, PAGE_SIZE,
1386 &bytes_copied);
1387 if (ret)
1388 goto read_user;
1389 ret = mlx5_ib_mr_initiator_pfault_handler(
1390 dev, pfault, qp, &wqe, &wqe_end, bytes_copied);
1391 } else if (qp && !sq) {
1392 ret = mlx5_ib_read_wqe_rq(qp, wqe_index, wqe, PAGE_SIZE,
1393 &bytes_copied);
1394 if (ret)
1395 goto read_user;
1396 ret = mlx5_ib_mr_responder_pfault_handler_rq(
1397 dev, qp, wqe, &wqe_end, bytes_copied);
1398 } else if (!qp) {
1399 struct mlx5_ib_srq *srq = res_to_srq(res);
1400
1401 ret = mlx5_ib_read_wqe_srq(srq, wqe_index, wqe, PAGE_SIZE,
1402 &bytes_copied);
1403 if (ret)
1404 goto read_user;
1405 ret = mlx5_ib_mr_responder_pfault_handler_srq(
1406 dev, srq, &wqe, &wqe_end, bytes_copied);
1407 }
1408
1409 if (ret < 0 || wqe >= wqe_end)
1410 goto resolve_page_fault;
1411
1412 ret = pagefault_data_segments(dev, pfault, wqe, wqe_end, &bytes_mapped,
1413 &total_wqe_bytes, !sq);
1414 if (ret == -EAGAIN)
1415 goto out;
1416
1417 if (ret < 0 || total_wqe_bytes > bytes_mapped)
1418 goto resolve_page_fault;
1419
1420 out:
1421 ret = 0;
1422 resume_with_error = 0;
1423
1424 read_user:
1425 if (ret)
1426 mlx5_ib_err(
1427 dev,
1428 "Failed reading a WQE following page fault, error %d, wqe_index %x, qpn %llx\n",
1429 ret, wqe_index, pfault->token);
1430
1431 resolve_page_fault:
1432 mlx5_ib_page_fault_resume(dev, pfault, resume_with_error);
1433 mlx5_ib_dbg(dev, "PAGE FAULT completed. QP 0x%x resume_with_error=%d, type: 0x%x\n",
1434 pfault->wqe.wq_num, resume_with_error,
1435 pfault->type);
1436 mlx5_core_res_put(res);
1437 free_page((unsigned long)wqe_start);
1438 }
1439
mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1440 static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev,
1441 struct mlx5_pagefault *pfault)
1442 {
1443 u64 address;
1444 u32 length;
1445 u32 prefetch_len = pfault->bytes_committed;
1446 int prefetch_activated = 0;
1447 u32 rkey = pfault->rdma.r_key;
1448 int ret;
1449
1450 /* The RDMA responder handler handles the page fault in two parts.
1451 * First it brings the necessary pages for the current packet
1452 * (and uses the pfault context), and then (after resuming the QP)
1453 * prefetches more pages. The second operation cannot use the pfault
1454 * context and therefore uses the dummy_pfault context allocated on
1455 * the stack */
1456 pfault->rdma.rdma_va += pfault->bytes_committed;
1457 pfault->rdma.rdma_op_len -= min(pfault->bytes_committed,
1458 pfault->rdma.rdma_op_len);
1459 pfault->bytes_committed = 0;
1460
1461 address = pfault->rdma.rdma_va;
1462 length = pfault->rdma.rdma_op_len;
1463
1464 /* For some operations, the hardware cannot tell the exact message
1465 * length, and in those cases it reports zero. Use prefetch
1466 * logic. */
1467 if (length == 0) {
1468 prefetch_activated = 1;
1469 length = pfault->rdma.packet_size;
1470 prefetch_len = min(MAX_PREFETCH_LEN, prefetch_len);
1471 }
1472
1473 ret = pagefault_single_data_segment(dev, NULL, rkey, address, length,
1474 &pfault->bytes_committed, NULL);
1475 if (ret == -EAGAIN) {
1476 /* We're racing with an invalidation, don't prefetch */
1477 prefetch_activated = 0;
1478 } else if (ret < 0) {
1479 mlx5_ib_page_fault_resume(dev, pfault, 1);
1480 if (ret != -ENOENT)
1481 mlx5_ib_dbg(dev, "PAGE FAULT error %d. QP 0x%llx, type: 0x%x\n",
1482 ret, pfault->token, pfault->type);
1483 return;
1484 }
1485
1486 mlx5_ib_page_fault_resume(dev, pfault, 0);
1487 mlx5_ib_dbg(dev, "PAGE FAULT completed. QP 0x%llx, type: 0x%x, prefetch_activated: %d\n",
1488 pfault->token, pfault->type,
1489 prefetch_activated);
1490
1491 /* At this point, there might be a new pagefault already arriving in
1492 * the eq, switch to the dummy pagefault for the rest of the
1493 * processing. We're still OK with the objects being alive as the
1494 * work-queue is being fenced. */
1495
1496 if (prefetch_activated) {
1497 u32 bytes_committed = 0;
1498
1499 ret = pagefault_single_data_segment(dev, NULL, rkey, address,
1500 prefetch_len,
1501 &bytes_committed, NULL);
1502 if (ret < 0 && ret != -EAGAIN) {
1503 mlx5_ib_dbg(dev, "Prefetch failed. ret: %d, QP 0x%llx, address: 0x%.16llx, length = 0x%.16x\n",
1504 ret, pfault->token, address, prefetch_len);
1505 }
1506 }
1507 }
1508
1509 #define MLX5_MEMORY_PAGE_FAULT_FLAGS_LAST BIT(7)
mlx5_ib_mr_memory_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1510 static void mlx5_ib_mr_memory_pfault_handler(struct mlx5_ib_dev *dev,
1511 struct mlx5_pagefault *pfault)
1512 {
1513 u64 prefetch_va =
1514 pfault->memory.va - pfault->memory.prefetch_before_byte_count;
1515 size_t prefetch_size = pfault->memory.prefetch_before_byte_count +
1516 pfault->memory.fault_byte_count +
1517 pfault->memory.prefetch_after_byte_count;
1518 struct mlx5_ib_mkey *mmkey;
1519 struct mlx5_ib_mr *mr, *child_mr;
1520 int ret = 0;
1521
1522 mmkey = find_odp_mkey(dev, pfault->memory.mkey);
1523 if (IS_ERR(mmkey))
1524 goto err;
1525
1526 switch (mmkey->type) {
1527 case MLX5_MKEY_IMPLICIT_CHILD:
1528 child_mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1529 mr = child_mr->parent;
1530 break;
1531 case MLX5_MKEY_NULL:
1532 mr = container_of(mmkey, struct mlx5_ib_mr, null_mmkey);
1533 break;
1534 default:
1535 mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1536 break;
1537 }
1538
1539 /* If prefetch fails, handle only demanded page fault */
1540 ret = pagefault_mr(mr, prefetch_va, prefetch_size, NULL, 0, true);
1541 if (ret < 0) {
1542 ret = pagefault_mr(mr, pfault->memory.va,
1543 pfault->memory.fault_byte_count, NULL, 0,
1544 true);
1545 if (ret < 0)
1546 goto err;
1547 }
1548
1549 mlx5_update_odp_stats_with_handled(mr, faults, ret);
1550 mlx5r_deref_odp_mkey(mmkey);
1551
1552 if (pfault->memory.flags & MLX5_MEMORY_PAGE_FAULT_FLAGS_LAST)
1553 mlx5_ib_page_fault_resume(dev, pfault, 0);
1554
1555 mlx5_ib_dbg(
1556 dev,
1557 "PAGE FAULT completed %s. token 0x%llx, mkey: 0x%x, va: 0x%llx, byte_count: 0x%x\n",
1558 pfault->memory.flags & MLX5_MEMORY_PAGE_FAULT_FLAGS_LAST ?
1559 "" :
1560 "without resume cmd",
1561 pfault->token, pfault->memory.mkey, pfault->memory.va,
1562 pfault->memory.fault_byte_count);
1563
1564 return;
1565
1566 err:
1567 if (!IS_ERR(mmkey))
1568 mlx5r_deref_odp_mkey(mmkey);
1569 mlx5_ib_page_fault_resume(dev, pfault, 1);
1570 mlx5_ib_dbg(
1571 dev,
1572 "PAGE FAULT error. token 0x%llx, mkey: 0x%x, va: 0x%llx, byte_count: 0x%x, err: %d\n",
1573 pfault->token, pfault->memory.mkey, pfault->memory.va,
1574 pfault->memory.fault_byte_count, ret);
1575 }
1576
mlx5_ib_pfault(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1577 static void mlx5_ib_pfault(struct mlx5_ib_dev *dev, struct mlx5_pagefault *pfault)
1578 {
1579 u8 event_subtype = pfault->event_subtype;
1580
1581 switch (event_subtype) {
1582 case MLX5_PFAULT_SUBTYPE_WQE:
1583 mlx5_ib_mr_wqe_pfault_handler(dev, pfault);
1584 break;
1585 case MLX5_PFAULT_SUBTYPE_RDMA:
1586 mlx5_ib_mr_rdma_pfault_handler(dev, pfault);
1587 break;
1588 case MLX5_PFAULT_SUBTYPE_MEMORY:
1589 mlx5_ib_mr_memory_pfault_handler(dev, pfault);
1590 break;
1591 default:
1592 mlx5_ib_err(dev, "Invalid page fault event subtype: 0x%x\n",
1593 event_subtype);
1594 mlx5_ib_page_fault_resume(dev, pfault, 1);
1595 }
1596 }
1597
mlx5_ib_eqe_pf_action(struct work_struct * work)1598 static void mlx5_ib_eqe_pf_action(struct work_struct *work)
1599 {
1600 struct mlx5_pagefault *pfault = container_of(work,
1601 struct mlx5_pagefault,
1602 work);
1603 struct mlx5_ib_pf_eq *eq = pfault->eq;
1604
1605 mlx5_ib_pfault(eq->dev, pfault);
1606 mempool_free(pfault, eq->pool);
1607 }
1608
1609 #define MEMORY_SCHEME_PAGE_FAULT_GRANULARITY 4096
mlx5_ib_eq_pf_process(struct mlx5_ib_pf_eq * eq)1610 static void mlx5_ib_eq_pf_process(struct mlx5_ib_pf_eq *eq)
1611 {
1612 struct mlx5_eqe_page_fault *pf_eqe;
1613 struct mlx5_pagefault *pfault;
1614 struct mlx5_eqe *eqe;
1615 int cc = 0;
1616
1617 while ((eqe = mlx5_eq_get_eqe(eq->core, cc))) {
1618 pfault = mempool_alloc(eq->pool, GFP_ATOMIC);
1619 if (!pfault) {
1620 schedule_work(&eq->work);
1621 break;
1622 }
1623
1624 pf_eqe = &eqe->data.page_fault;
1625 pfault->event_subtype = eqe->sub_type;
1626
1627 switch (eqe->sub_type) {
1628 case MLX5_PFAULT_SUBTYPE_RDMA:
1629 /* RDMA based event */
1630 pfault->bytes_committed =
1631 be32_to_cpu(pf_eqe->rdma.bytes_committed);
1632 pfault->type =
1633 be32_to_cpu(pf_eqe->rdma.pftype_token) >> 24;
1634 pfault->token =
1635 be32_to_cpu(pf_eqe->rdma.pftype_token) &
1636 MLX5_24BIT_MASK;
1637 pfault->rdma.r_key =
1638 be32_to_cpu(pf_eqe->rdma.r_key);
1639 pfault->rdma.packet_size =
1640 be16_to_cpu(pf_eqe->rdma.packet_length);
1641 pfault->rdma.rdma_op_len =
1642 be32_to_cpu(pf_eqe->rdma.rdma_op_len);
1643 pfault->rdma.rdma_va =
1644 be64_to_cpu(pf_eqe->rdma.rdma_va);
1645 mlx5_ib_dbg(
1646 eq->dev,
1647 "PAGE_FAULT: subtype: 0x%02x, bytes_committed: 0x%06x, type:0x%x, token: 0x%06llx, r_key: 0x%08x\n",
1648 eqe->sub_type, pfault->bytes_committed,
1649 pfault->type, pfault->token,
1650 pfault->rdma.r_key);
1651 mlx5_ib_dbg(eq->dev,
1652 "PAGE_FAULT: rdma_op_len: 0x%08x, rdma_va: 0x%016llx\n",
1653 pfault->rdma.rdma_op_len,
1654 pfault->rdma.rdma_va);
1655 break;
1656
1657 case MLX5_PFAULT_SUBTYPE_WQE:
1658 /* WQE based event */
1659 pfault->bytes_committed =
1660 be32_to_cpu(pf_eqe->wqe.bytes_committed);
1661 pfault->type =
1662 (be32_to_cpu(pf_eqe->wqe.pftype_wq) >> 24) & 0x7;
1663 pfault->token =
1664 be32_to_cpu(pf_eqe->wqe.token);
1665 pfault->wqe.wq_num =
1666 be32_to_cpu(pf_eqe->wqe.pftype_wq) &
1667 MLX5_24BIT_MASK;
1668 pfault->wqe.wqe_index =
1669 be16_to_cpu(pf_eqe->wqe.wqe_index);
1670 pfault->wqe.packet_size =
1671 be16_to_cpu(pf_eqe->wqe.packet_length);
1672 mlx5_ib_dbg(
1673 eq->dev,
1674 "PAGE_FAULT: subtype: 0x%02x, bytes_committed: 0x%06x, type:0x%x, token: 0x%06llx, wq_num: 0x%06x, wqe_index: 0x%04x\n",
1675 eqe->sub_type, pfault->bytes_committed,
1676 pfault->type, pfault->token, pfault->wqe.wq_num,
1677 pfault->wqe.wqe_index);
1678 break;
1679
1680 case MLX5_PFAULT_SUBTYPE_MEMORY:
1681 /* Memory based event */
1682 pfault->bytes_committed = 0;
1683 pfault->token =
1684 be32_to_cpu(pf_eqe->memory.token31_0) |
1685 ((u64)be16_to_cpu(pf_eqe->memory.token47_32)
1686 << 32);
1687 pfault->memory.va = be64_to_cpu(pf_eqe->memory.va);
1688 pfault->memory.mkey = be32_to_cpu(pf_eqe->memory.mkey);
1689 pfault->memory.fault_byte_count = (be32_to_cpu(
1690 pf_eqe->memory.demand_fault_pages) >> 12) *
1691 MEMORY_SCHEME_PAGE_FAULT_GRANULARITY;
1692 pfault->memory.prefetch_before_byte_count =
1693 be16_to_cpu(
1694 pf_eqe->memory.pre_demand_fault_pages) *
1695 MEMORY_SCHEME_PAGE_FAULT_GRANULARITY;
1696 pfault->memory.prefetch_after_byte_count =
1697 be16_to_cpu(
1698 pf_eqe->memory.post_demand_fault_pages) *
1699 MEMORY_SCHEME_PAGE_FAULT_GRANULARITY;
1700 pfault->memory.flags = pf_eqe->memory.flags;
1701 mlx5_ib_dbg(
1702 eq->dev,
1703 "PAGE_FAULT: subtype: 0x%02x, token: 0x%06llx, mkey: 0x%06x, fault_byte_count: 0x%06x, va: 0x%016llx, flags: 0x%02x\n",
1704 eqe->sub_type, pfault->token,
1705 pfault->memory.mkey,
1706 pfault->memory.fault_byte_count,
1707 pfault->memory.va, pfault->memory.flags);
1708 mlx5_ib_dbg(
1709 eq->dev,
1710 "PAGE_FAULT: prefetch size: before: 0x%06x, after 0x%06x\n",
1711 pfault->memory.prefetch_before_byte_count,
1712 pfault->memory.prefetch_after_byte_count);
1713 break;
1714
1715 default:
1716 mlx5_ib_warn(eq->dev,
1717 "Unsupported page fault event sub-type: 0x%02hhx\n",
1718 eqe->sub_type);
1719 /* Unsupported page faults should still be
1720 * resolved by the page fault handler
1721 */
1722 }
1723
1724 pfault->eq = eq;
1725 INIT_WORK(&pfault->work, mlx5_ib_eqe_pf_action);
1726 queue_work(eq->wq, &pfault->work);
1727
1728 cc = mlx5_eq_update_cc(eq->core, ++cc);
1729 }
1730
1731 mlx5_eq_update_ci(eq->core, cc, 1);
1732 }
1733
mlx5_ib_eq_pf_int(struct notifier_block * nb,unsigned long type,void * data)1734 static int mlx5_ib_eq_pf_int(struct notifier_block *nb, unsigned long type,
1735 void *data)
1736 {
1737 struct mlx5_ib_pf_eq *eq =
1738 container_of(nb, struct mlx5_ib_pf_eq, irq_nb);
1739 unsigned long flags;
1740
1741 if (spin_trylock_irqsave(&eq->lock, flags)) {
1742 mlx5_ib_eq_pf_process(eq);
1743 spin_unlock_irqrestore(&eq->lock, flags);
1744 } else {
1745 schedule_work(&eq->work);
1746 }
1747
1748 return IRQ_HANDLED;
1749 }
1750
1751 /* mempool_refill() was proposed but unfortunately wasn't accepted
1752 * http://lkml.iu.edu/hypermail/linux/kernel/1512.1/05073.html
1753 * Cheap workaround.
1754 */
mempool_refill(mempool_t * pool)1755 static void mempool_refill(mempool_t *pool)
1756 {
1757 while (pool->curr_nr < pool->min_nr)
1758 mempool_free(mempool_alloc(pool, GFP_KERNEL), pool);
1759 }
1760
mlx5_ib_eq_pf_action(struct work_struct * work)1761 static void mlx5_ib_eq_pf_action(struct work_struct *work)
1762 {
1763 struct mlx5_ib_pf_eq *eq =
1764 container_of(work, struct mlx5_ib_pf_eq, work);
1765
1766 mempool_refill(eq->pool);
1767
1768 spin_lock_irq(&eq->lock);
1769 mlx5_ib_eq_pf_process(eq);
1770 spin_unlock_irq(&eq->lock);
1771 }
1772
1773 enum {
1774 MLX5_IB_NUM_PF_EQE = 0x1000,
1775 MLX5_IB_NUM_PF_DRAIN = 64,
1776 };
1777
mlx5r_odp_create_eq(struct mlx5_ib_dev * dev,struct mlx5_ib_pf_eq * eq)1778 int mlx5r_odp_create_eq(struct mlx5_ib_dev *dev, struct mlx5_ib_pf_eq *eq)
1779 {
1780 struct mlx5_eq_param param = {};
1781 int err = 0;
1782
1783 mutex_lock(&dev->odp_eq_mutex);
1784 if (eq->core)
1785 goto unlock;
1786 INIT_WORK(&eq->work, mlx5_ib_eq_pf_action);
1787 spin_lock_init(&eq->lock);
1788 eq->dev = dev;
1789
1790 eq->pool = mempool_create_kmalloc_pool(MLX5_IB_NUM_PF_DRAIN,
1791 sizeof(struct mlx5_pagefault));
1792 if (!eq->pool) {
1793 err = -ENOMEM;
1794 goto unlock;
1795 }
1796
1797 eq->wq = alloc_workqueue("mlx5_ib_page_fault",
1798 WQ_HIGHPRI | WQ_UNBOUND | WQ_MEM_RECLAIM,
1799 MLX5_NUM_CMD_EQE);
1800 if (!eq->wq) {
1801 err = -ENOMEM;
1802 goto err_mempool;
1803 }
1804
1805 eq->irq_nb.notifier_call = mlx5_ib_eq_pf_int;
1806 param = (struct mlx5_eq_param) {
1807 .nent = MLX5_IB_NUM_PF_EQE,
1808 };
1809 param.mask[0] = 1ull << MLX5_EVENT_TYPE_PAGE_FAULT;
1810 eq->core = mlx5_eq_create_generic(dev->mdev, ¶m);
1811 if (IS_ERR(eq->core)) {
1812 err = PTR_ERR(eq->core);
1813 goto err_wq;
1814 }
1815 err = mlx5_eq_enable(dev->mdev, eq->core, &eq->irq_nb);
1816 if (err) {
1817 mlx5_ib_err(dev, "failed to enable odp EQ %d\n", err);
1818 goto err_eq;
1819 }
1820
1821 mutex_unlock(&dev->odp_eq_mutex);
1822 return 0;
1823 err_eq:
1824 mlx5_eq_destroy_generic(dev->mdev, eq->core);
1825 err_wq:
1826 eq->core = NULL;
1827 destroy_workqueue(eq->wq);
1828 err_mempool:
1829 mempool_destroy(eq->pool);
1830 unlock:
1831 mutex_unlock(&dev->odp_eq_mutex);
1832 return err;
1833 }
1834
1835 static int
mlx5_ib_odp_destroy_eq(struct mlx5_ib_dev * dev,struct mlx5_ib_pf_eq * eq)1836 mlx5_ib_odp_destroy_eq(struct mlx5_ib_dev *dev, struct mlx5_ib_pf_eq *eq)
1837 {
1838 int err;
1839
1840 if (!eq->core)
1841 return 0;
1842 mlx5_eq_disable(dev->mdev, eq->core, &eq->irq_nb);
1843 err = mlx5_eq_destroy_generic(dev->mdev, eq->core);
1844 cancel_work_sync(&eq->work);
1845 destroy_workqueue(eq->wq);
1846 mempool_destroy(eq->pool);
1847
1848 return err;
1849 }
1850
mlx5_odp_init_mkey_cache(struct mlx5_ib_dev * dev)1851 int mlx5_odp_init_mkey_cache(struct mlx5_ib_dev *dev)
1852 {
1853 struct mlx5r_cache_rb_key rb_key = {
1854 .access_mode = MLX5_MKC_ACCESS_MODE_KSM,
1855 .ndescs = mlx5_imr_ksm_entries,
1856 };
1857 struct mlx5_cache_ent *ent;
1858
1859 if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT_IMPLICIT))
1860 return 0;
1861
1862 ent = mlx5r_cache_create_ent_locked(dev, rb_key, true);
1863 if (IS_ERR(ent))
1864 return PTR_ERR(ent);
1865
1866 return 0;
1867 }
1868
1869 static const struct ib_device_ops mlx5_ib_dev_odp_ops = {
1870 .advise_mr = mlx5_ib_advise_mr,
1871 };
1872
mlx5_ib_odp_init_one(struct mlx5_ib_dev * dev)1873 int mlx5_ib_odp_init_one(struct mlx5_ib_dev *dev)
1874 {
1875 internal_fill_odp_caps(dev);
1876
1877 if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT))
1878 return 0;
1879
1880 ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_odp_ops);
1881
1882 mutex_init(&dev->odp_eq_mutex);
1883 return 0;
1884 }
1885
mlx5_ib_odp_cleanup_one(struct mlx5_ib_dev * dev)1886 void mlx5_ib_odp_cleanup_one(struct mlx5_ib_dev *dev)
1887 {
1888 if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT))
1889 return;
1890
1891 mlx5_ib_odp_destroy_eq(dev, &dev->odp_pf_eq);
1892 }
1893
mlx5_ib_odp_init(void)1894 int mlx5_ib_odp_init(void)
1895 {
1896 mlx5_imr_ksm_entries = BIT_ULL(get_order(TASK_SIZE) -
1897 MLX5_IMR_MTT_BITS);
1898
1899 return 0;
1900 }
1901
1902 struct prefetch_mr_work {
1903 struct work_struct work;
1904 u32 pf_flags;
1905 u32 num_sge;
1906 struct {
1907 u64 io_virt;
1908 struct mlx5_ib_mr *mr;
1909 size_t length;
1910 } frags[];
1911 };
1912
destroy_prefetch_work(struct prefetch_mr_work * work)1913 static void destroy_prefetch_work(struct prefetch_mr_work *work)
1914 {
1915 u32 i;
1916
1917 for (i = 0; i < work->num_sge; ++i)
1918 mlx5r_deref_odp_mkey(&work->frags[i].mr->mmkey);
1919
1920 kvfree(work);
1921 }
1922
1923 static struct mlx5_ib_mr *
get_prefetchable_mr(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 lkey)1924 get_prefetchable_mr(struct ib_pd *pd, enum ib_uverbs_advise_mr_advice advice,
1925 u32 lkey)
1926 {
1927 struct mlx5_ib_dev *dev = to_mdev(pd->device);
1928 struct mlx5_ib_mr *mr = NULL;
1929 struct mlx5_ib_mkey *mmkey;
1930
1931 xa_lock(&dev->odp_mkeys);
1932 mmkey = xa_load(&dev->odp_mkeys, mlx5_base_mkey(lkey));
1933 if (!mmkey || mmkey->key != lkey) {
1934 mr = ERR_PTR(-ENOENT);
1935 goto end;
1936 }
1937 if (mmkey->type != MLX5_MKEY_MR) {
1938 mr = ERR_PTR(-EINVAL);
1939 goto end;
1940 }
1941
1942 mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1943
1944 if (mr->ibmr.pd != pd) {
1945 mr = ERR_PTR(-EPERM);
1946 goto end;
1947 }
1948
1949 /* prefetch with write-access must be supported by the MR */
1950 if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_WRITE &&
1951 !mr->umem->writable) {
1952 mr = ERR_PTR(-EPERM);
1953 goto end;
1954 }
1955
1956 refcount_inc(&mmkey->usecount);
1957 end:
1958 xa_unlock(&dev->odp_mkeys);
1959 return mr;
1960 }
1961
mlx5_ib_prefetch_mr_work(struct work_struct * w)1962 static void mlx5_ib_prefetch_mr_work(struct work_struct *w)
1963 {
1964 struct prefetch_mr_work *work =
1965 container_of(w, struct prefetch_mr_work, work);
1966 u32 bytes_mapped = 0;
1967 int ret;
1968 u32 i;
1969
1970 /* We rely on IB/core that work is executed if we have num_sge != 0 only. */
1971 WARN_ON(!work->num_sge);
1972 for (i = 0; i < work->num_sge; ++i) {
1973 ret = pagefault_mr(work->frags[i].mr, work->frags[i].io_virt,
1974 work->frags[i].length, &bytes_mapped,
1975 work->pf_flags, false);
1976 if (ret <= 0)
1977 continue;
1978 mlx5_update_odp_stats(work->frags[i].mr, prefetch, ret);
1979 }
1980
1981 destroy_prefetch_work(work);
1982 }
1983
init_prefetch_work(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 pf_flags,struct prefetch_mr_work * work,struct ib_sge * sg_list,u32 num_sge)1984 static int init_prefetch_work(struct ib_pd *pd,
1985 enum ib_uverbs_advise_mr_advice advice,
1986 u32 pf_flags, struct prefetch_mr_work *work,
1987 struct ib_sge *sg_list, u32 num_sge)
1988 {
1989 u32 i;
1990
1991 INIT_WORK(&work->work, mlx5_ib_prefetch_mr_work);
1992 work->pf_flags = pf_flags;
1993
1994 for (i = 0; i < num_sge; ++i) {
1995 struct mlx5_ib_mr *mr;
1996
1997 mr = get_prefetchable_mr(pd, advice, sg_list[i].lkey);
1998 if (IS_ERR(mr)) {
1999 work->num_sge = i;
2000 return PTR_ERR(mr);
2001 }
2002 work->frags[i].io_virt = sg_list[i].addr;
2003 work->frags[i].length = sg_list[i].length;
2004 work->frags[i].mr = mr;
2005 }
2006 work->num_sge = num_sge;
2007 return 0;
2008 }
2009
mlx5_ib_prefetch_sg_list(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 pf_flags,struct ib_sge * sg_list,u32 num_sge)2010 static int mlx5_ib_prefetch_sg_list(struct ib_pd *pd,
2011 enum ib_uverbs_advise_mr_advice advice,
2012 u32 pf_flags, struct ib_sge *sg_list,
2013 u32 num_sge)
2014 {
2015 u32 bytes_mapped = 0;
2016 int ret = 0;
2017 u32 i;
2018
2019 for (i = 0; i < num_sge; ++i) {
2020 struct mlx5_ib_mr *mr;
2021
2022 mr = get_prefetchable_mr(pd, advice, sg_list[i].lkey);
2023 if (IS_ERR(mr))
2024 return PTR_ERR(mr);
2025 ret = pagefault_mr(mr, sg_list[i].addr, sg_list[i].length,
2026 &bytes_mapped, pf_flags, false);
2027 if (ret < 0) {
2028 mlx5r_deref_odp_mkey(&mr->mmkey);
2029 return ret;
2030 }
2031 mlx5_update_odp_stats(mr, prefetch, ret);
2032 mlx5r_deref_odp_mkey(&mr->mmkey);
2033 }
2034
2035 return 0;
2036 }
2037
mlx5_ib_advise_mr_prefetch(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 flags,struct ib_sge * sg_list,u32 num_sge)2038 int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
2039 enum ib_uverbs_advise_mr_advice advice,
2040 u32 flags, struct ib_sge *sg_list, u32 num_sge)
2041 {
2042 u32 pf_flags = 0;
2043 struct prefetch_mr_work *work;
2044 int rc;
2045
2046 if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH)
2047 pf_flags |= MLX5_PF_FLAGS_DOWNGRADE;
2048
2049 if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_NO_FAULT)
2050 pf_flags |= MLX5_PF_FLAGS_SNAPSHOT;
2051
2052 if (flags & IB_UVERBS_ADVISE_MR_FLAG_FLUSH)
2053 return mlx5_ib_prefetch_sg_list(pd, advice, pf_flags, sg_list,
2054 num_sge);
2055
2056 work = kvzalloc(struct_size(work, frags, num_sge), GFP_KERNEL);
2057 if (!work)
2058 return -ENOMEM;
2059
2060 rc = init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge);
2061 if (rc) {
2062 destroy_prefetch_work(work);
2063 return rc;
2064 }
2065 queue_work(system_unbound_wq, &work->work);
2066 return 0;
2067 }
2068