1 /*
2 * Copyright (c) 2013-2015, Mellanox Technologies. All rights reserved.
3 *
4 * This software is available to you under a choice of one of two
5 * licenses. You may choose to be licensed under the terms of the GNU
6 * General Public License (GPL) Version 2, available from the file
7 * COPYING in the main directory of this source tree, or the
8 * OpenIB.org BSD license below:
9 *
10 * Redistribution and use in source and binary forms, with or
11 * without modification, are permitted provided that the following
12 * conditions are met:
13 *
14 * - Redistributions of source code must retain the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer.
17 *
18 * - Redistributions in binary form must reproduce the above
19 * copyright notice, this list of conditions and the following
20 * disclaimer in the documentation and/or other materials
21 * provided with the distribution.
22 *
23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
24 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
25 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
26 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
27 * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
29 * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
30 * SOFTWARE.
31 */
32
33 #include <rdma/ib_umem_odp.h>
34 #include <linux/kernel.h>
35 #include <linux/dma-buf.h>
36 #include <linux/dma-resv.h>
37
38 #include "mlx5_ib.h"
39 #include "cmd.h"
40 #include "umr.h"
41 #include "qp.h"
42
43 #include <linux/mlx5/eq.h>
44
45 /* Contains the details of a pagefault. */
46 struct mlx5_pagefault {
47 u32 bytes_committed;
48 u64 token;
49 u8 event_subtype;
50 u8 type;
51 union {
52 /* Initiator or send message responder pagefault details. */
53 struct {
54 /* Received packet size, only valid for responders. */
55 u32 packet_size;
56 /*
57 * Number of resource holding WQE, depends on type.
58 */
59 u32 wq_num;
60 /*
61 * WQE index. Refers to either the send queue or
62 * receive queue, according to event_subtype.
63 */
64 u16 wqe_index;
65 } wqe;
66 /* RDMA responder pagefault details */
67 struct {
68 u32 r_key;
69 /*
70 * Received packet size, minimal size page fault
71 * resolution required for forward progress.
72 */
73 u32 packet_size;
74 u32 rdma_op_len;
75 u64 rdma_va;
76 } rdma;
77 struct {
78 u64 va;
79 u32 mkey;
80 u32 fault_byte_count;
81 u32 prefetch_before_byte_count;
82 u32 prefetch_after_byte_count;
83 u8 flags;
84 } memory;
85 };
86
87 struct mlx5_ib_pf_eq *eq;
88 struct work_struct work;
89 };
90
91 #define MAX_PREFETCH_LEN (4*1024*1024U)
92
93 /* Timeout in ms to wait for an active mmu notifier to complete when handling
94 * a pagefault. */
95 #define MMU_NOTIFIER_TIMEOUT 1000
96
97 #define MLX5_IMR_MTT_BITS (30 - PAGE_SHIFT)
98 #define MLX5_IMR_MTT_SHIFT (MLX5_IMR_MTT_BITS + PAGE_SHIFT)
99 #define MLX5_IMR_MTT_ENTRIES BIT_ULL(MLX5_IMR_MTT_BITS)
100 #define MLX5_IMR_MTT_SIZE BIT_ULL(MLX5_IMR_MTT_SHIFT)
101 #define MLX5_IMR_MTT_MASK (~(MLX5_IMR_MTT_SIZE - 1))
102
103 #define MLX5_KSM_PAGE_SHIFT MLX5_IMR_MTT_SHIFT
104
105 static u64 mlx5_imr_ksm_entries;
106
populate_klm(struct mlx5_klm * pklm,size_t idx,size_t nentries,struct mlx5_ib_mr * imr,int flags)107 static void populate_klm(struct mlx5_klm *pklm, size_t idx, size_t nentries,
108 struct mlx5_ib_mr *imr, int flags)
109 {
110 struct mlx5_core_dev *dev = mr_to_mdev(imr)->mdev;
111 struct mlx5_klm *end = pklm + nentries;
112 int step = MLX5_CAP_ODP(dev, mem_page_fault) ? MLX5_IMR_MTT_SIZE : 0;
113 __be32 key = MLX5_CAP_ODP(dev, mem_page_fault) ?
114 cpu_to_be32(imr->null_mmkey.key) :
115 mr_to_mdev(imr)->mkeys.null_mkey;
116 u64 va =
117 MLX5_CAP_ODP(dev, mem_page_fault) ? idx * MLX5_IMR_MTT_SIZE : 0;
118
119 if (flags & MLX5_IB_UPD_XLT_ZAP) {
120 for (; pklm != end; pklm++, idx++, va += step) {
121 pklm->bcount = cpu_to_be32(MLX5_IMR_MTT_SIZE);
122 pklm->key = key;
123 pklm->va = cpu_to_be64(va);
124 }
125 return;
126 }
127
128 /*
129 * The locking here is pretty subtle. Ideally the implicit_children
130 * xarray would be protected by the umem_mutex, however that is not
131 * possible. Instead this uses a weaker update-then-lock pattern:
132 *
133 * xa_store()
134 * mutex_lock(umem_mutex)
135 * mlx5r_umr_update_xlt()
136 * mutex_unlock(umem_mutex)
137 * destroy lkey
138 *
139 * ie any change the xarray must be followed by the locked update_xlt
140 * before destroying.
141 *
142 * The umem_mutex provides the acquire/release semantic needed to make
143 * the xa_store() visible to a racing thread.
144 */
145 lockdep_assert_held(&to_ib_umem_odp(imr->umem)->umem_mutex);
146
147 for (; pklm != end; pklm++, idx++, va += step) {
148 struct mlx5_ib_mr *mtt = xa_load(&imr->implicit_children, idx);
149
150 pklm->bcount = cpu_to_be32(MLX5_IMR_MTT_SIZE);
151 if (mtt) {
152 pklm->key = cpu_to_be32(mtt->ibmr.lkey);
153 pklm->va = cpu_to_be64(idx * MLX5_IMR_MTT_SIZE);
154 } else {
155 pklm->key = key;
156 pklm->va = cpu_to_be64(va);
157 }
158 }
159 }
160
umem_dma_to_mtt(dma_addr_t umem_dma)161 static u64 umem_dma_to_mtt(dma_addr_t umem_dma)
162 {
163 u64 mtt_entry = umem_dma & ODP_DMA_ADDR_MASK;
164
165 if (umem_dma & ODP_READ_ALLOWED_BIT)
166 mtt_entry |= MLX5_IB_MTT_READ;
167 if (umem_dma & ODP_WRITE_ALLOWED_BIT)
168 mtt_entry |= MLX5_IB_MTT_WRITE;
169
170 return mtt_entry;
171 }
172
populate_mtt(__be64 * pas,size_t idx,size_t nentries,struct mlx5_ib_mr * mr,int flags)173 static void populate_mtt(__be64 *pas, size_t idx, size_t nentries,
174 struct mlx5_ib_mr *mr, int flags)
175 {
176 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
177 dma_addr_t pa;
178 size_t i;
179
180 if (flags & MLX5_IB_UPD_XLT_ZAP)
181 return;
182
183 for (i = 0; i < nentries; i++) {
184 pa = odp->dma_list[idx + i];
185 pas[i] = cpu_to_be64(umem_dma_to_mtt(pa));
186 }
187 }
188
mlx5_odp_populate_xlt(void * xlt,size_t idx,size_t nentries,struct mlx5_ib_mr * mr,int flags)189 void mlx5_odp_populate_xlt(void *xlt, size_t idx, size_t nentries,
190 struct mlx5_ib_mr *mr, int flags)
191 {
192 if (flags & MLX5_IB_UPD_XLT_INDIRECT) {
193 populate_klm(xlt, idx, nentries, mr, flags);
194 } else {
195 populate_mtt(xlt, idx, nentries, mr, flags);
196 }
197 }
198
199 /*
200 * This must be called after the mr has been removed from implicit_children.
201 * NOTE: The MR does not necessarily have to be
202 * empty here, parallel page faults could have raced with the free process and
203 * added pages to it.
204 */
free_implicit_child_mr_work(struct work_struct * work)205 static void free_implicit_child_mr_work(struct work_struct *work)
206 {
207 struct mlx5_ib_mr *mr =
208 container_of(work, struct mlx5_ib_mr, odp_destroy.work);
209 struct mlx5_ib_mr *imr = mr->parent;
210 struct ib_umem_odp *odp_imr = to_ib_umem_odp(imr->umem);
211 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
212
213 mlx5r_deref_wait_odp_mkey(&mr->mmkey);
214
215 mutex_lock(&odp_imr->umem_mutex);
216 mlx5r_umr_update_xlt(mr->parent,
217 ib_umem_start(odp) >> MLX5_IMR_MTT_SHIFT, 1, 0,
218 MLX5_IB_UPD_XLT_INDIRECT | MLX5_IB_UPD_XLT_ATOMIC);
219 mutex_unlock(&odp_imr->umem_mutex);
220 mlx5_ib_dereg_mr(&mr->ibmr, NULL);
221
222 mlx5r_deref_odp_mkey(&imr->mmkey);
223 }
224
destroy_unused_implicit_child_mr(struct mlx5_ib_mr * mr)225 static void destroy_unused_implicit_child_mr(struct mlx5_ib_mr *mr)
226 {
227 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
228 unsigned long idx = ib_umem_start(odp) >> MLX5_IMR_MTT_SHIFT;
229 struct mlx5_ib_mr *imr = mr->parent;
230
231 /*
232 * If userspace is racing freeing the parent implicit ODP MR then we can
233 * loose the race with parent destruction. In this case
234 * mlx5_ib_free_odp_mr() will free everything in the implicit_children
235 * xarray so NOP is fine. This child MR cannot be destroyed here because
236 * we are under its umem_mutex.
237 */
238 if (!refcount_inc_not_zero(&imr->mmkey.usecount))
239 return;
240
241 xa_lock(&imr->implicit_children);
242 if (__xa_cmpxchg(&imr->implicit_children, idx, mr, NULL, GFP_KERNEL) !=
243 mr) {
244 xa_unlock(&imr->implicit_children);
245 mlx5r_deref_odp_mkey(&imr->mmkey);
246 return;
247 }
248
249 if (MLX5_CAP_ODP(mr_to_mdev(mr)->mdev, mem_page_fault))
250 __xa_erase(&mr_to_mdev(mr)->odp_mkeys,
251 mlx5_base_mkey(mr->mmkey.key));
252 xa_unlock(&imr->implicit_children);
253
254 /* Freeing a MR is a sleeping operation, so bounce to a work queue */
255 INIT_WORK(&mr->odp_destroy.work, free_implicit_child_mr_work);
256 queue_work(system_unbound_wq, &mr->odp_destroy.work);
257 }
258
mlx5_ib_invalidate_range(struct mmu_interval_notifier * mni,const struct mmu_notifier_range * range,unsigned long cur_seq)259 static bool mlx5_ib_invalidate_range(struct mmu_interval_notifier *mni,
260 const struct mmu_notifier_range *range,
261 unsigned long cur_seq)
262 {
263 struct ib_umem_odp *umem_odp =
264 container_of(mni, struct ib_umem_odp, notifier);
265 struct mlx5_ib_mr *mr;
266 const u64 umr_block_mask = MLX5_UMR_MTT_NUM_ENTRIES_ALIGNMENT - 1;
267 u64 idx = 0, blk_start_idx = 0;
268 u64 invalidations = 0;
269 unsigned long start;
270 unsigned long end;
271 int in_block = 0;
272 u64 addr;
273
274 if (!mmu_notifier_range_blockable(range))
275 return false;
276
277 mutex_lock(&umem_odp->umem_mutex);
278 mmu_interval_set_seq(mni, cur_seq);
279 /*
280 * If npages is zero then umem_odp->private may not be setup yet. This
281 * does not complete until after the first page is mapped for DMA.
282 */
283 if (!umem_odp->npages)
284 goto out;
285 mr = umem_odp->private;
286 if (!mr)
287 goto out;
288
289 start = max_t(u64, ib_umem_start(umem_odp), range->start);
290 end = min_t(u64, ib_umem_end(umem_odp), range->end);
291
292 /*
293 * Iteration one - zap the HW's MTTs. The notifiers_count ensures that
294 * while we are doing the invalidation, no page fault will attempt to
295 * overwrite the same MTTs. Concurent invalidations might race us,
296 * but they will write 0s as well, so no difference in the end result.
297 */
298 for (addr = start; addr < end; addr += BIT(umem_odp->page_shift)) {
299 idx = (addr - ib_umem_start(umem_odp)) >> umem_odp->page_shift;
300 /*
301 * Strive to write the MTTs in chunks, but avoid overwriting
302 * non-existing MTTs. The huristic here can be improved to
303 * estimate the cost of another UMR vs. the cost of bigger
304 * UMR.
305 */
306 if (umem_odp->dma_list[idx] &
307 (ODP_READ_ALLOWED_BIT | ODP_WRITE_ALLOWED_BIT)) {
308 if (!in_block) {
309 blk_start_idx = idx;
310 in_block = 1;
311 }
312
313 /* Count page invalidations */
314 invalidations += idx - blk_start_idx + 1;
315 } else {
316 u64 umr_offset = idx & umr_block_mask;
317
318 if (in_block && umr_offset == 0) {
319 mlx5r_umr_update_xlt(mr, blk_start_idx,
320 idx - blk_start_idx, 0,
321 MLX5_IB_UPD_XLT_ZAP |
322 MLX5_IB_UPD_XLT_ATOMIC);
323 in_block = 0;
324 }
325 }
326 }
327 if (in_block)
328 mlx5r_umr_update_xlt(mr, blk_start_idx,
329 idx - blk_start_idx + 1, 0,
330 MLX5_IB_UPD_XLT_ZAP |
331 MLX5_IB_UPD_XLT_ATOMIC);
332
333 mlx5_update_odp_stats_with_handled(mr, invalidations, invalidations);
334
335 /*
336 * We are now sure that the device will not access the
337 * memory. We can safely unmap it, and mark it as dirty if
338 * needed.
339 */
340
341 ib_umem_odp_unmap_dma_pages(umem_odp, start, end);
342
343 if (unlikely(!umem_odp->npages && mr->parent))
344 destroy_unused_implicit_child_mr(mr);
345 out:
346 mutex_unlock(&umem_odp->umem_mutex);
347 return true;
348 }
349
350 const struct mmu_interval_notifier_ops mlx5_mn_ops = {
351 .invalidate = mlx5_ib_invalidate_range,
352 };
353
internal_fill_odp_caps(struct mlx5_ib_dev * dev)354 static void internal_fill_odp_caps(struct mlx5_ib_dev *dev)
355 {
356 struct ib_odp_caps *caps = &dev->odp_caps;
357
358 memset(caps, 0, sizeof(*caps));
359
360 if (!MLX5_CAP_GEN(dev->mdev, pg) || !mlx5r_umr_can_load_pas(dev, 0))
361 return;
362
363 caps->general_caps = IB_ODP_SUPPORT;
364
365 if (MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset))
366 dev->odp_max_size = U64_MAX;
367 else
368 dev->odp_max_size = BIT_ULL(MLX5_MAX_UMR_SHIFT + PAGE_SHIFT);
369
370 if (MLX5_CAP_ODP_SCHEME(dev->mdev, ud_odp_caps.send))
371 caps->per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_SEND;
372
373 if (MLX5_CAP_ODP_SCHEME(dev->mdev, ud_odp_caps.srq_receive))
374 caps->per_transport_caps.ud_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
375
376 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.send))
377 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_SEND;
378
379 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.receive))
380 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_RECV;
381
382 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.write))
383 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_WRITE;
384
385 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.read))
386 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_READ;
387
388 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.atomic))
389 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_ATOMIC;
390
391 if (MLX5_CAP_ODP_SCHEME(dev->mdev, rc_odp_caps.srq_receive))
392 caps->per_transport_caps.rc_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
393
394 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.send))
395 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_SEND;
396
397 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.receive))
398 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_RECV;
399
400 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.write))
401 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_WRITE;
402
403 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.read))
404 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_READ;
405
406 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.atomic))
407 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_ATOMIC;
408
409 if (MLX5_CAP_ODP_SCHEME(dev->mdev, xrc_odp_caps.srq_receive))
410 caps->per_transport_caps.xrc_odp_caps |= IB_ODP_SUPPORT_SRQ_RECV;
411
412 if (MLX5_CAP_GEN(dev->mdev, fixed_buffer_size) &&
413 MLX5_CAP_GEN(dev->mdev, null_mkey) &&
414 MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset) &&
415 !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled))
416 caps->general_caps |= IB_ODP_SUPPORT_IMPLICIT;
417 }
418
mlx5_ib_page_fault_resume(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault,int error)419 static void mlx5_ib_page_fault_resume(struct mlx5_ib_dev *dev,
420 struct mlx5_pagefault *pfault,
421 int error)
422 {
423 int wq_num = pfault->event_subtype == MLX5_PFAULT_SUBTYPE_WQE ?
424 pfault->wqe.wq_num : pfault->token;
425 u32 in[MLX5_ST_SZ_DW(page_fault_resume_in)] = {};
426 void *info;
427 int err;
428
429 MLX5_SET(page_fault_resume_in, in, opcode, MLX5_CMD_OP_PAGE_FAULT_RESUME);
430
431 if (pfault->event_subtype == MLX5_PFAULT_SUBTYPE_MEMORY) {
432 info = MLX5_ADDR_OF(page_fault_resume_in, in,
433 page_fault_info.mem_page_fault_info);
434 MLX5_SET(mem_page_fault_info, info, fault_token_31_0,
435 pfault->token & 0xffffffff);
436 MLX5_SET(mem_page_fault_info, info, fault_token_47_32,
437 (pfault->token >> 32) & 0xffff);
438 MLX5_SET(mem_page_fault_info, info, error, !!error);
439 } else {
440 info = MLX5_ADDR_OF(page_fault_resume_in, in,
441 page_fault_info.trans_page_fault_info);
442 MLX5_SET(trans_page_fault_info, info, page_fault_type,
443 pfault->type);
444 MLX5_SET(trans_page_fault_info, info, fault_token,
445 pfault->token);
446 MLX5_SET(trans_page_fault_info, info, wq_number, wq_num);
447 MLX5_SET(trans_page_fault_info, info, error, !!error);
448 }
449
450 err = mlx5_cmd_exec_in(dev->mdev, page_fault_resume, in);
451 if (err)
452 mlx5_ib_err(dev, "Failed to resolve the page fault on WQ 0x%x err %d\n",
453 wq_num, err);
454 }
455
implicit_get_child_mr(struct mlx5_ib_mr * imr,unsigned long idx)456 static struct mlx5_ib_mr *implicit_get_child_mr(struct mlx5_ib_mr *imr,
457 unsigned long idx)
458 {
459 struct mlx5_ib_dev *dev = mr_to_mdev(imr);
460 struct ib_umem_odp *odp;
461 struct mlx5_ib_mr *mr;
462 struct mlx5_ib_mr *ret;
463 int err;
464
465 odp = ib_umem_odp_alloc_child(to_ib_umem_odp(imr->umem),
466 idx * MLX5_IMR_MTT_SIZE,
467 MLX5_IMR_MTT_SIZE, &mlx5_mn_ops);
468 if (IS_ERR(odp))
469 return ERR_CAST(odp);
470
471 mr = mlx5_mr_cache_alloc(dev, imr->access_flags,
472 MLX5_MKC_ACCESS_MODE_MTT,
473 MLX5_IMR_MTT_ENTRIES);
474 if (IS_ERR(mr)) {
475 ib_umem_odp_release(odp);
476 return mr;
477 }
478
479 mr->access_flags = imr->access_flags;
480 mr->ibmr.pd = imr->ibmr.pd;
481 mr->ibmr.device = &mr_to_mdev(imr)->ib_dev;
482 mr->umem = &odp->umem;
483 mr->ibmr.lkey = mr->mmkey.key;
484 mr->ibmr.rkey = mr->mmkey.key;
485 mr->ibmr.iova = idx * MLX5_IMR_MTT_SIZE;
486 mr->parent = imr;
487 odp->private = mr;
488
489 /*
490 * First refcount is owned by the xarray and second refconut
491 * is returned to the caller.
492 */
493 refcount_set(&mr->mmkey.usecount, 2);
494
495 err = mlx5r_umr_update_xlt(mr, 0,
496 MLX5_IMR_MTT_ENTRIES,
497 PAGE_SHIFT,
498 MLX5_IB_UPD_XLT_ZAP |
499 MLX5_IB_UPD_XLT_ENABLE);
500 if (err) {
501 ret = ERR_PTR(err);
502 goto out_mr;
503 }
504
505 xa_lock(&imr->implicit_children);
506 ret = __xa_cmpxchg(&imr->implicit_children, idx, NULL, mr,
507 GFP_KERNEL);
508 if (unlikely(ret)) {
509 if (xa_is_err(ret)) {
510 ret = ERR_PTR(xa_err(ret));
511 goto out_lock;
512 }
513 /*
514 * Another thread beat us to creating the child mr, use
515 * theirs.
516 */
517 refcount_inc(&ret->mmkey.usecount);
518 goto out_lock;
519 }
520
521 if (MLX5_CAP_ODP(dev->mdev, mem_page_fault)) {
522 ret = __xa_store(&dev->odp_mkeys, mlx5_base_mkey(mr->mmkey.key),
523 &mr->mmkey, GFP_KERNEL);
524 if (xa_is_err(ret)) {
525 ret = ERR_PTR(xa_err(ret));
526 __xa_erase(&imr->implicit_children, idx);
527 goto out_lock;
528 }
529 mr->mmkey.type = MLX5_MKEY_IMPLICIT_CHILD;
530 }
531 xa_unlock(&imr->implicit_children);
532 mlx5_ib_dbg(mr_to_mdev(imr), "key %x mr %p\n", mr->mmkey.key, mr);
533 return mr;
534
535 out_lock:
536 xa_unlock(&imr->implicit_children);
537 out_mr:
538 mlx5_ib_dereg_mr(&mr->ibmr, NULL);
539 return ret;
540 }
541
542 /*
543 * When using memory scheme ODP, implicit MRs can't use the reserved null mkey
544 * and each implicit MR needs to assign a private null mkey to get the page
545 * faults on.
546 * The null mkey is created with the properties to enable getting the page
547 * fault for every time it is accessed and having all relevant access flags.
548 */
alloc_implicit_mr_null_mkey(struct mlx5_ib_dev * dev,struct mlx5_ib_mr * imr,struct mlx5_ib_pd * pd)549 static int alloc_implicit_mr_null_mkey(struct mlx5_ib_dev *dev,
550 struct mlx5_ib_mr *imr,
551 struct mlx5_ib_pd *pd)
552 {
553 size_t inlen = MLX5_ST_SZ_BYTES(create_mkey_in) + 64;
554 void *mkc;
555 u32 *in;
556 int err;
557
558 in = kzalloc(inlen, GFP_KERNEL);
559 if (!in)
560 return -ENOMEM;
561
562 MLX5_SET(create_mkey_in, in, translations_octword_actual_size, 4);
563 MLX5_SET(create_mkey_in, in, pg_access, 1);
564
565 mkc = MLX5_ADDR_OF(create_mkey_in, in, memory_key_mkey_entry);
566 MLX5_SET(mkc, mkc, a, 1);
567 MLX5_SET(mkc, mkc, rw, 1);
568 MLX5_SET(mkc, mkc, rr, 1);
569 MLX5_SET(mkc, mkc, lw, 1);
570 MLX5_SET(mkc, mkc, lr, 1);
571 MLX5_SET(mkc, mkc, free, 0);
572 MLX5_SET(mkc, mkc, umr_en, 0);
573 MLX5_SET(mkc, mkc, access_mode_1_0, MLX5_MKC_ACCESS_MODE_MTT);
574
575 MLX5_SET(mkc, mkc, translations_octword_size, 4);
576 MLX5_SET(mkc, mkc, log_page_size, 61);
577 MLX5_SET(mkc, mkc, length64, 1);
578 MLX5_SET(mkc, mkc, pd, pd->pdn);
579 MLX5_SET64(mkc, mkc, start_addr, 0);
580 MLX5_SET(mkc, mkc, qpn, 0xffffff);
581
582 err = mlx5_core_create_mkey(dev->mdev, &imr->null_mmkey.key, in, inlen);
583 if (err)
584 goto free_in;
585
586 imr->null_mmkey.type = MLX5_MKEY_NULL;
587
588 free_in:
589 kfree(in);
590 return err;
591 }
592
mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd * pd,int access_flags)593 struct mlx5_ib_mr *mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd *pd,
594 int access_flags)
595 {
596 struct mlx5_ib_dev *dev = to_mdev(pd->ibpd.device);
597 struct ib_umem_odp *umem_odp;
598 struct mlx5_ib_mr *imr;
599 int err;
600
601 if (!mlx5r_umr_can_load_pas(dev, MLX5_IMR_MTT_ENTRIES * PAGE_SIZE))
602 return ERR_PTR(-EOPNOTSUPP);
603
604 umem_odp = ib_umem_odp_alloc_implicit(&dev->ib_dev, access_flags);
605 if (IS_ERR(umem_odp))
606 return ERR_CAST(umem_odp);
607
608 imr = mlx5_mr_cache_alloc(dev, access_flags, MLX5_MKC_ACCESS_MODE_KSM,
609 mlx5_imr_ksm_entries);
610 if (IS_ERR(imr)) {
611 ib_umem_odp_release(umem_odp);
612 return imr;
613 }
614
615 imr->access_flags = access_flags;
616 imr->ibmr.pd = &pd->ibpd;
617 imr->ibmr.iova = 0;
618 imr->umem = &umem_odp->umem;
619 imr->ibmr.lkey = imr->mmkey.key;
620 imr->ibmr.rkey = imr->mmkey.key;
621 imr->ibmr.device = &dev->ib_dev;
622 imr->is_odp_implicit = true;
623 xa_init(&imr->implicit_children);
624
625 if (MLX5_CAP_ODP(dev->mdev, mem_page_fault)) {
626 err = alloc_implicit_mr_null_mkey(dev, imr, pd);
627 if (err)
628 goto out_mr;
629
630 err = mlx5r_store_odp_mkey(dev, &imr->null_mmkey);
631 if (err)
632 goto out_mr;
633 }
634
635 err = mlx5r_umr_update_xlt(imr, 0,
636 mlx5_imr_ksm_entries,
637 MLX5_KSM_PAGE_SHIFT,
638 MLX5_IB_UPD_XLT_INDIRECT |
639 MLX5_IB_UPD_XLT_ZAP |
640 MLX5_IB_UPD_XLT_ENABLE);
641 if (err)
642 goto out_mr;
643
644 err = mlx5r_store_odp_mkey(dev, &imr->mmkey);
645 if (err)
646 goto out_mr;
647
648 mlx5_ib_dbg(dev, "key %x mr %p\n", imr->mmkey.key, imr);
649 return imr;
650 out_mr:
651 mlx5_ib_err(dev, "Failed to register MKEY %d\n", err);
652 mlx5_ib_dereg_mr(&imr->ibmr, NULL);
653 return ERR_PTR(err);
654 }
655
mlx5_ib_free_odp_mr(struct mlx5_ib_mr * mr)656 void mlx5_ib_free_odp_mr(struct mlx5_ib_mr *mr)
657 {
658 struct mlx5_ib_mr *mtt;
659 unsigned long idx;
660
661 /*
662 * If this is an implicit MR it is already invalidated so we can just
663 * delete the children mkeys.
664 */
665 xa_for_each(&mr->implicit_children, idx, mtt) {
666 xa_erase(&mr->implicit_children, idx);
667 mlx5_ib_dereg_mr(&mtt->ibmr, NULL);
668 }
669
670 if (mr->null_mmkey.key) {
671 xa_erase(&mr_to_mdev(mr)->odp_mkeys,
672 mlx5_base_mkey(mr->null_mmkey.key));
673
674 mlx5_core_destroy_mkey(mr_to_mdev(mr)->mdev,
675 mr->null_mmkey.key);
676 }
677 }
678
679 #define MLX5_PF_FLAGS_DOWNGRADE BIT(1)
680 #define MLX5_PF_FLAGS_SNAPSHOT BIT(2)
681 #define MLX5_PF_FLAGS_ENABLE BIT(3)
pagefault_real_mr(struct mlx5_ib_mr * mr,struct ib_umem_odp * odp,u64 user_va,size_t bcnt,u32 * bytes_mapped,u32 flags)682 static int pagefault_real_mr(struct mlx5_ib_mr *mr, struct ib_umem_odp *odp,
683 u64 user_va, size_t bcnt, u32 *bytes_mapped,
684 u32 flags)
685 {
686 int page_shift, ret, np;
687 bool downgrade = flags & MLX5_PF_FLAGS_DOWNGRADE;
688 u64 access_mask;
689 u64 start_idx;
690 bool fault = !(flags & MLX5_PF_FLAGS_SNAPSHOT);
691 u32 xlt_flags = MLX5_IB_UPD_XLT_ATOMIC;
692
693 if (flags & MLX5_PF_FLAGS_ENABLE)
694 xlt_flags |= MLX5_IB_UPD_XLT_ENABLE;
695
696 page_shift = odp->page_shift;
697 start_idx = (user_va - ib_umem_start(odp)) >> page_shift;
698 access_mask = ODP_READ_ALLOWED_BIT;
699
700 if (odp->umem.writable && !downgrade)
701 access_mask |= ODP_WRITE_ALLOWED_BIT;
702
703 np = ib_umem_odp_map_dma_and_lock(odp, user_va, bcnt, access_mask, fault);
704 if (np < 0)
705 return np;
706
707 /*
708 * No need to check whether the MTTs really belong to this MR, since
709 * ib_umem_odp_map_dma_and_lock already checks this.
710 */
711 ret = mlx5r_umr_update_xlt(mr, start_idx, np, page_shift, xlt_flags);
712 mutex_unlock(&odp->umem_mutex);
713
714 if (ret < 0) {
715 if (ret != -EAGAIN)
716 mlx5_ib_err(mr_to_mdev(mr),
717 "Failed to update mkey page tables\n");
718 goto out;
719 }
720
721 if (bytes_mapped) {
722 u32 new_mappings = (np << page_shift) -
723 (user_va - round_down(user_va, 1 << page_shift));
724
725 *bytes_mapped += min_t(u32, new_mappings, bcnt);
726 }
727
728 return np << (page_shift - PAGE_SHIFT);
729
730 out:
731 return ret;
732 }
733
pagefault_implicit_mr(struct mlx5_ib_mr * imr,struct ib_umem_odp * odp_imr,u64 user_va,size_t bcnt,u32 * bytes_mapped,u32 flags)734 static int pagefault_implicit_mr(struct mlx5_ib_mr *imr,
735 struct ib_umem_odp *odp_imr, u64 user_va,
736 size_t bcnt, u32 *bytes_mapped, u32 flags)
737 {
738 unsigned long end_idx = (user_va + bcnt - 1) >> MLX5_IMR_MTT_SHIFT;
739 unsigned long upd_start_idx = end_idx + 1;
740 unsigned long upd_len = 0;
741 unsigned long npages = 0;
742 int err;
743 int ret;
744
745 if (unlikely(user_va >= mlx5_imr_ksm_entries * MLX5_IMR_MTT_SIZE ||
746 mlx5_imr_ksm_entries * MLX5_IMR_MTT_SIZE - user_va < bcnt))
747 return -EFAULT;
748
749 /* Fault each child mr that intersects with our interval. */
750 while (bcnt) {
751 unsigned long idx = user_va >> MLX5_IMR_MTT_SHIFT;
752 struct ib_umem_odp *umem_odp;
753 struct mlx5_ib_mr *mtt;
754 u64 len;
755
756 xa_lock(&imr->implicit_children);
757 mtt = xa_load(&imr->implicit_children, idx);
758 if (unlikely(!mtt)) {
759 xa_unlock(&imr->implicit_children);
760 mtt = implicit_get_child_mr(imr, idx);
761 if (IS_ERR(mtt)) {
762 ret = PTR_ERR(mtt);
763 goto out;
764 }
765 upd_start_idx = min(upd_start_idx, idx);
766 upd_len = idx - upd_start_idx + 1;
767 } else {
768 refcount_inc(&mtt->mmkey.usecount);
769 xa_unlock(&imr->implicit_children);
770 }
771
772 umem_odp = to_ib_umem_odp(mtt->umem);
773 len = min_t(u64, user_va + bcnt, ib_umem_end(umem_odp)) -
774 user_va;
775
776 ret = pagefault_real_mr(mtt, umem_odp, user_va, len,
777 bytes_mapped, flags);
778
779 mlx5r_deref_odp_mkey(&mtt->mmkey);
780
781 if (ret < 0)
782 goto out;
783 user_va += len;
784 bcnt -= len;
785 npages += ret;
786 }
787
788 ret = npages;
789
790 /*
791 * Any time the implicit_children are changed we must perform an
792 * update of the xlt before exiting to ensure the HW and the
793 * implicit_children remains synchronized.
794 */
795 out:
796 if (likely(!upd_len))
797 return ret;
798
799 /*
800 * Notice this is not strictly ordered right, the KSM is updated after
801 * the implicit_children is updated, so a parallel page fault could
802 * see a MR that is not yet visible in the KSM. This is similar to a
803 * parallel page fault seeing a MR that is being concurrently removed
804 * from the KSM. Both of these improbable situations are resolved
805 * safely by resuming the HW and then taking another page fault. The
806 * next pagefault handler will see the new information.
807 */
808 mutex_lock(&odp_imr->umem_mutex);
809 err = mlx5r_umr_update_xlt(imr, upd_start_idx, upd_len, 0,
810 MLX5_IB_UPD_XLT_INDIRECT |
811 MLX5_IB_UPD_XLT_ATOMIC);
812 mutex_unlock(&odp_imr->umem_mutex);
813 if (err) {
814 mlx5_ib_err(mr_to_mdev(imr), "Failed to update PAS\n");
815 return err;
816 }
817 return ret;
818 }
819
pagefault_dmabuf_mr(struct mlx5_ib_mr * mr,size_t bcnt,u32 * bytes_mapped,u32 flags)820 static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt,
821 u32 *bytes_mapped, u32 flags)
822 {
823 struct ib_umem_dmabuf *umem_dmabuf = to_ib_umem_dmabuf(mr->umem);
824 u32 xlt_flags = 0;
825 int err;
826 unsigned long page_size;
827
828 if (flags & MLX5_PF_FLAGS_ENABLE)
829 xlt_flags |= MLX5_IB_UPD_XLT_ENABLE;
830
831 dma_resv_lock(umem_dmabuf->attach->dmabuf->resv, NULL);
832 err = ib_umem_dmabuf_map_pages(umem_dmabuf);
833 if (err) {
834 dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv);
835 return err;
836 }
837
838 page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf);
839 if (!page_size) {
840 ib_umem_dmabuf_unmap_pages(umem_dmabuf);
841 err = -EINVAL;
842 } else {
843 if (mr->data_direct)
844 err = mlx5r_umr_update_data_direct_ksm_pas(mr, xlt_flags);
845 else
846 err = mlx5r_umr_update_mr_pas(mr, xlt_flags);
847 }
848 dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv);
849
850 if (err)
851 return err;
852
853 if (bytes_mapped)
854 *bytes_mapped += bcnt;
855
856 return ib_umem_num_pages(mr->umem);
857 }
858
859 /*
860 * Returns:
861 * -EFAULT: The io_virt->bcnt is not within the MR, it covers pages that are
862 * not accessible, or the MR is no longer valid.
863 * -EAGAIN/-ENOMEM: The operation should be retried
864 *
865 * -EINVAL/others: General internal malfunction
866 * >0: Number of pages mapped
867 */
pagefault_mr(struct mlx5_ib_mr * mr,u64 io_virt,size_t bcnt,u32 * bytes_mapped,u32 flags,bool permissive_fault)868 static int pagefault_mr(struct mlx5_ib_mr *mr, u64 io_virt, size_t bcnt,
869 u32 *bytes_mapped, u32 flags, bool permissive_fault)
870 {
871 struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem);
872
873 if (unlikely(io_virt < mr->ibmr.iova) && !permissive_fault)
874 return -EFAULT;
875
876 if (mr->umem->is_dmabuf)
877 return pagefault_dmabuf_mr(mr, bcnt, bytes_mapped, flags);
878
879 if (!odp->is_implicit_odp) {
880 u64 offset = io_virt < mr->ibmr.iova ? 0 : io_virt - mr->ibmr.iova;
881 u64 user_va;
882
883 if (check_add_overflow(offset, (u64)odp->umem.address,
884 &user_va))
885 return -EFAULT;
886
887 if (permissive_fault) {
888 if (user_va < ib_umem_start(odp))
889 user_va = ib_umem_start(odp);
890 if ((user_va + bcnt) > ib_umem_end(odp))
891 bcnt = ib_umem_end(odp) - user_va;
892 } else if (unlikely(user_va >= ib_umem_end(odp) ||
893 ib_umem_end(odp) - user_va < bcnt))
894 return -EFAULT;
895 return pagefault_real_mr(mr, odp, user_va, bcnt, bytes_mapped,
896 flags);
897 }
898 return pagefault_implicit_mr(mr, odp, io_virt, bcnt, bytes_mapped,
899 flags);
900 }
901
mlx5_ib_init_odp_mr(struct mlx5_ib_mr * mr)902 int mlx5_ib_init_odp_mr(struct mlx5_ib_mr *mr)
903 {
904 int ret;
905
906 ret = pagefault_real_mr(mr, to_ib_umem_odp(mr->umem), mr->umem->address,
907 mr->umem->length, NULL,
908 MLX5_PF_FLAGS_SNAPSHOT | MLX5_PF_FLAGS_ENABLE);
909 return ret >= 0 ? 0 : ret;
910 }
911
mlx5_ib_init_dmabuf_mr(struct mlx5_ib_mr * mr)912 int mlx5_ib_init_dmabuf_mr(struct mlx5_ib_mr *mr)
913 {
914 int ret;
915
916 ret = pagefault_dmabuf_mr(mr, mr->umem->length, NULL,
917 MLX5_PF_FLAGS_ENABLE);
918
919 return ret >= 0 ? 0 : ret;
920 }
921
922 struct pf_frame {
923 struct pf_frame *next;
924 u32 key;
925 u64 io_virt;
926 size_t bcnt;
927 int depth;
928 };
929
mkey_is_eq(struct mlx5_ib_mkey * mmkey,u32 key)930 static bool mkey_is_eq(struct mlx5_ib_mkey *mmkey, u32 key)
931 {
932 if (!mmkey)
933 return false;
934 if (mmkey->type == MLX5_MKEY_MW ||
935 mmkey->type == MLX5_MKEY_INDIRECT_DEVX)
936 return mlx5_base_mkey(mmkey->key) == mlx5_base_mkey(key);
937 return mmkey->key == key;
938 }
939
find_odp_mkey(struct mlx5_ib_dev * dev,u32 key)940 static struct mlx5_ib_mkey *find_odp_mkey(struct mlx5_ib_dev *dev, u32 key)
941 {
942 struct mlx5_ib_mkey *mmkey;
943
944 xa_lock(&dev->odp_mkeys);
945 mmkey = xa_load(&dev->odp_mkeys, mlx5_base_mkey(key));
946 if (!mmkey) {
947 mmkey = ERR_PTR(-ENOENT);
948 goto out;
949 }
950 if (!mkey_is_eq(mmkey, key)) {
951 mmkey = ERR_PTR(-EFAULT);
952 goto out;
953 }
954 refcount_inc(&mmkey->usecount);
955 out:
956 xa_unlock(&dev->odp_mkeys);
957
958 return mmkey;
959 }
960
961 /*
962 * Handle a single data segment in a page-fault WQE or RDMA region.
963 *
964 * Returns zero on success. The caller may continue to the next data segment.
965 * Can return the following error codes:
966 * -EAGAIN to designate a temporary error. The caller will abort handling the
967 * page fault and resolve it.
968 * -EFAULT when there's an error mapping the requested pages. The caller will
969 * abort the page fault handling.
970 */
pagefault_single_data_segment(struct mlx5_ib_dev * dev,struct ib_pd * pd,u32 key,u64 io_virt,size_t bcnt,u32 * bytes_committed,u32 * bytes_mapped)971 static int pagefault_single_data_segment(struct mlx5_ib_dev *dev,
972 struct ib_pd *pd, u32 key,
973 u64 io_virt, size_t bcnt,
974 u32 *bytes_committed,
975 u32 *bytes_mapped)
976 {
977 int ret, i, outlen, cur_outlen = 0, depth = 0, pages_in_range;
978 struct pf_frame *head = NULL, *frame;
979 struct mlx5_ib_mkey *mmkey;
980 struct mlx5_ib_mr *mr;
981 struct mlx5_klm *pklm;
982 u32 *out = NULL;
983 size_t offset;
984
985 io_virt += *bytes_committed;
986 bcnt -= *bytes_committed;
987 next_mr:
988 mmkey = find_odp_mkey(dev, key);
989 if (IS_ERR(mmkey)) {
990 ret = PTR_ERR(mmkey);
991 if (ret == -ENOENT) {
992 mlx5_ib_dbg(
993 dev,
994 "skipping non ODP MR (lkey=0x%06x) in page fault handler.\n",
995 key);
996 if (bytes_mapped)
997 *bytes_mapped += bcnt;
998 /*
999 * The user could specify a SGL with multiple lkeys and
1000 * only some of them are ODP. Treat the non-ODP ones as
1001 * fully faulted.
1002 */
1003 ret = 0;
1004 }
1005 goto end;
1006 }
1007
1008 switch (mmkey->type) {
1009 case MLX5_MKEY_MR:
1010 mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1011
1012 pages_in_range = (ALIGN(io_virt + bcnt, PAGE_SIZE) -
1013 (io_virt & PAGE_MASK)) >>
1014 PAGE_SHIFT;
1015 ret = pagefault_mr(mr, io_virt, bcnt, bytes_mapped, 0, false);
1016 if (ret < 0)
1017 goto end;
1018
1019 mlx5_update_odp_stats_with_handled(mr, faults, ret);
1020
1021 if (ret < pages_in_range) {
1022 ret = -EFAULT;
1023 goto end;
1024 }
1025
1026 ret = 0;
1027 break;
1028
1029 case MLX5_MKEY_MW:
1030 case MLX5_MKEY_INDIRECT_DEVX:
1031 if (depth >= MLX5_CAP_GEN(dev->mdev, max_indirection)) {
1032 mlx5_ib_dbg(dev, "indirection level exceeded\n");
1033 ret = -EFAULT;
1034 goto end;
1035 }
1036
1037 outlen = MLX5_ST_SZ_BYTES(query_mkey_out) +
1038 sizeof(*pklm) * (mmkey->ndescs - 2);
1039
1040 if (outlen > cur_outlen) {
1041 kfree(out);
1042 out = kzalloc(outlen, GFP_KERNEL);
1043 if (!out) {
1044 ret = -ENOMEM;
1045 goto end;
1046 }
1047 cur_outlen = outlen;
1048 }
1049
1050 pklm = (struct mlx5_klm *)MLX5_ADDR_OF(query_mkey_out, out,
1051 bsf0_klm0_pas_mtt0_1);
1052
1053 ret = mlx5_core_query_mkey(dev->mdev, mmkey->key, out, outlen);
1054 if (ret)
1055 goto end;
1056
1057 offset = io_virt - MLX5_GET64(query_mkey_out, out,
1058 memory_key_mkey_entry.start_addr);
1059
1060 for (i = 0; bcnt && i < mmkey->ndescs; i++, pklm++) {
1061 if (offset >= be32_to_cpu(pklm->bcount)) {
1062 offset -= be32_to_cpu(pklm->bcount);
1063 continue;
1064 }
1065
1066 frame = kzalloc(sizeof(*frame), GFP_KERNEL);
1067 if (!frame) {
1068 ret = -ENOMEM;
1069 goto end;
1070 }
1071
1072 frame->key = be32_to_cpu(pklm->key);
1073 frame->io_virt = be64_to_cpu(pklm->va) + offset;
1074 frame->bcnt = min_t(size_t, bcnt,
1075 be32_to_cpu(pklm->bcount) - offset);
1076 frame->depth = depth + 1;
1077 frame->next = head;
1078 head = frame;
1079
1080 bcnt -= frame->bcnt;
1081 offset = 0;
1082 }
1083 break;
1084
1085 default:
1086 mlx5_ib_dbg(dev, "wrong mkey type %d\n", mmkey->type);
1087 ret = -EFAULT;
1088 goto end;
1089 }
1090
1091 if (head) {
1092 frame = head;
1093 head = frame->next;
1094
1095 key = frame->key;
1096 io_virt = frame->io_virt;
1097 bcnt = frame->bcnt;
1098 depth = frame->depth;
1099 kfree(frame);
1100
1101 mlx5r_deref_odp_mkey(mmkey);
1102 goto next_mr;
1103 }
1104
1105 end:
1106 if (!IS_ERR(mmkey))
1107 mlx5r_deref_odp_mkey(mmkey);
1108 while (head) {
1109 frame = head;
1110 head = frame->next;
1111 kfree(frame);
1112 }
1113 kfree(out);
1114
1115 *bytes_committed = 0;
1116 return ret;
1117 }
1118
1119 /*
1120 * Parse a series of data segments for page fault handling.
1121 *
1122 * @dev: Pointer to mlx5 IB device
1123 * @pfault: contains page fault information.
1124 * @wqe: points at the first data segment in the WQE.
1125 * @wqe_end: points after the end of the WQE.
1126 * @bytes_mapped: receives the number of bytes that the function was able to
1127 * map. This allows the caller to decide intelligently whether
1128 * enough memory was mapped to resolve the page fault
1129 * successfully (e.g. enough for the next MTU, or the entire
1130 * WQE).
1131 * @total_wqe_bytes: receives the total data size of this WQE in bytes (minus
1132 * the committed bytes).
1133 * @receive_queue: receive WQE end of sg list
1134 *
1135 * Returns zero for success or a negative error code.
1136 */
pagefault_data_segments(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault,void * wqe,void * wqe_end,u32 * bytes_mapped,u32 * total_wqe_bytes,bool receive_queue)1137 static int pagefault_data_segments(struct mlx5_ib_dev *dev,
1138 struct mlx5_pagefault *pfault,
1139 void *wqe,
1140 void *wqe_end, u32 *bytes_mapped,
1141 u32 *total_wqe_bytes, bool receive_queue)
1142 {
1143 int ret = 0;
1144 u64 io_virt;
1145 __be32 key;
1146 u32 byte_count;
1147 size_t bcnt;
1148 int inline_segment;
1149
1150 if (bytes_mapped)
1151 *bytes_mapped = 0;
1152 if (total_wqe_bytes)
1153 *total_wqe_bytes = 0;
1154
1155 while (wqe < wqe_end) {
1156 struct mlx5_wqe_data_seg *dseg = wqe;
1157
1158 io_virt = be64_to_cpu(dseg->addr);
1159 key = dseg->lkey;
1160 byte_count = be32_to_cpu(dseg->byte_count);
1161 inline_segment = !!(byte_count & MLX5_INLINE_SEG);
1162 bcnt = byte_count & ~MLX5_INLINE_SEG;
1163
1164 if (inline_segment) {
1165 bcnt = bcnt & MLX5_WQE_INLINE_SEG_BYTE_COUNT_MASK;
1166 wqe += ALIGN(sizeof(struct mlx5_wqe_inline_seg) + bcnt,
1167 16);
1168 } else {
1169 wqe += sizeof(*dseg);
1170 }
1171
1172 /* receive WQE end of sg list. */
1173 if (receive_queue && bcnt == 0 &&
1174 key == dev->mkeys.terminate_scatter_list_mkey &&
1175 io_virt == 0)
1176 break;
1177
1178 if (!inline_segment && total_wqe_bytes) {
1179 *total_wqe_bytes += bcnt - min_t(size_t, bcnt,
1180 pfault->bytes_committed);
1181 }
1182
1183 /* A zero length data segment designates a length of 2GB. */
1184 if (bcnt == 0)
1185 bcnt = 1U << 31;
1186
1187 if (inline_segment || bcnt <= pfault->bytes_committed) {
1188 pfault->bytes_committed -=
1189 min_t(size_t, bcnt,
1190 pfault->bytes_committed);
1191 continue;
1192 }
1193
1194 ret = pagefault_single_data_segment(dev, NULL, be32_to_cpu(key),
1195 io_virt, bcnt,
1196 &pfault->bytes_committed,
1197 bytes_mapped);
1198 if (ret < 0)
1199 break;
1200 }
1201
1202 return ret;
1203 }
1204
1205 /*
1206 * Parse initiator WQE. Advances the wqe pointer to point at the
1207 * scatter-gather list, and set wqe_end to the end of the WQE.
1208 */
mlx5_ib_mr_initiator_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault,struct mlx5_ib_qp * qp,void ** wqe,void ** wqe_end,int wqe_length)1209 static int mlx5_ib_mr_initiator_pfault_handler(
1210 struct mlx5_ib_dev *dev, struct mlx5_pagefault *pfault,
1211 struct mlx5_ib_qp *qp, void **wqe, void **wqe_end, int wqe_length)
1212 {
1213 struct mlx5_wqe_ctrl_seg *ctrl = *wqe;
1214 u16 wqe_index = pfault->wqe.wqe_index;
1215 struct mlx5_base_av *av;
1216 unsigned ds, opcode;
1217 u32 qpn = qp->trans_qp.base.mqp.qpn;
1218
1219 ds = be32_to_cpu(ctrl->qpn_ds) & MLX5_WQE_CTRL_DS_MASK;
1220 if (ds * MLX5_WQE_DS_UNITS > wqe_length) {
1221 mlx5_ib_err(dev, "Unable to read the complete WQE. ds = 0x%x, ret = 0x%x\n",
1222 ds, wqe_length);
1223 return -EFAULT;
1224 }
1225
1226 if (ds == 0) {
1227 mlx5_ib_err(dev, "Got WQE with zero DS. wqe_index=%x, qpn=%x\n",
1228 wqe_index, qpn);
1229 return -EFAULT;
1230 }
1231
1232 *wqe_end = *wqe + ds * MLX5_WQE_DS_UNITS;
1233 *wqe += sizeof(*ctrl);
1234
1235 opcode = be32_to_cpu(ctrl->opmod_idx_opcode) &
1236 MLX5_WQE_CTRL_OPCODE_MASK;
1237
1238 if (qp->type == IB_QPT_XRC_INI)
1239 *wqe += sizeof(struct mlx5_wqe_xrc_seg);
1240
1241 if (qp->type == IB_QPT_UD || qp->type == MLX5_IB_QPT_DCI) {
1242 av = *wqe;
1243 if (av->dqp_dct & cpu_to_be32(MLX5_EXTENDED_UD_AV))
1244 *wqe += sizeof(struct mlx5_av);
1245 else
1246 *wqe += sizeof(struct mlx5_base_av);
1247 }
1248
1249 switch (opcode) {
1250 case MLX5_OPCODE_RDMA_WRITE:
1251 case MLX5_OPCODE_RDMA_WRITE_IMM:
1252 case MLX5_OPCODE_RDMA_READ:
1253 *wqe += sizeof(struct mlx5_wqe_raddr_seg);
1254 break;
1255 case MLX5_OPCODE_ATOMIC_CS:
1256 case MLX5_OPCODE_ATOMIC_FA:
1257 *wqe += sizeof(struct mlx5_wqe_raddr_seg);
1258 *wqe += sizeof(struct mlx5_wqe_atomic_seg);
1259 break;
1260 }
1261
1262 return 0;
1263 }
1264
1265 /*
1266 * Parse responder WQE and set wqe_end to the end of the WQE.
1267 */
mlx5_ib_mr_responder_pfault_handler_srq(struct mlx5_ib_dev * dev,struct mlx5_ib_srq * srq,void ** wqe,void ** wqe_end,int wqe_length)1268 static int mlx5_ib_mr_responder_pfault_handler_srq(struct mlx5_ib_dev *dev,
1269 struct mlx5_ib_srq *srq,
1270 void **wqe, void **wqe_end,
1271 int wqe_length)
1272 {
1273 int wqe_size = 1 << srq->msrq.wqe_shift;
1274
1275 if (wqe_size > wqe_length) {
1276 mlx5_ib_err(dev, "Couldn't read all of the receive WQE's content\n");
1277 return -EFAULT;
1278 }
1279
1280 *wqe_end = *wqe + wqe_size;
1281 *wqe += sizeof(struct mlx5_wqe_srq_next_seg);
1282
1283 return 0;
1284 }
1285
mlx5_ib_mr_responder_pfault_handler_rq(struct mlx5_ib_dev * dev,struct mlx5_ib_qp * qp,void * wqe,void ** wqe_end,int wqe_length)1286 static int mlx5_ib_mr_responder_pfault_handler_rq(struct mlx5_ib_dev *dev,
1287 struct mlx5_ib_qp *qp,
1288 void *wqe, void **wqe_end,
1289 int wqe_length)
1290 {
1291 struct mlx5_ib_wq *wq = &qp->rq;
1292 int wqe_size = 1 << wq->wqe_shift;
1293
1294 if (qp->flags_en & MLX5_QP_FLAG_SIGNATURE) {
1295 mlx5_ib_err(dev, "ODP fault with WQE signatures is not supported\n");
1296 return -EFAULT;
1297 }
1298
1299 if (wqe_size > wqe_length) {
1300 mlx5_ib_err(dev, "Couldn't read all of the receive WQE's content\n");
1301 return -EFAULT;
1302 }
1303
1304 *wqe_end = wqe + wqe_size;
1305
1306 return 0;
1307 }
1308
odp_get_rsc(struct mlx5_ib_dev * dev,u32 wq_num,int pf_type)1309 static inline struct mlx5_core_rsc_common *odp_get_rsc(struct mlx5_ib_dev *dev,
1310 u32 wq_num, int pf_type)
1311 {
1312 struct mlx5_core_rsc_common *common = NULL;
1313 struct mlx5_core_srq *srq;
1314
1315 switch (pf_type) {
1316 case MLX5_WQE_PF_TYPE_RMP:
1317 srq = mlx5_cmd_get_srq(dev, wq_num);
1318 if (srq)
1319 common = &srq->common;
1320 break;
1321 case MLX5_WQE_PF_TYPE_REQ_SEND_OR_WRITE:
1322 case MLX5_WQE_PF_TYPE_RESP:
1323 case MLX5_WQE_PF_TYPE_REQ_READ_OR_ATOMIC:
1324 common = mlx5_core_res_hold(dev, wq_num, MLX5_RES_QP);
1325 break;
1326 default:
1327 break;
1328 }
1329
1330 return common;
1331 }
1332
res_to_qp(struct mlx5_core_rsc_common * res)1333 static inline struct mlx5_ib_qp *res_to_qp(struct mlx5_core_rsc_common *res)
1334 {
1335 struct mlx5_core_qp *mqp = (struct mlx5_core_qp *)res;
1336
1337 return to_mibqp(mqp);
1338 }
1339
res_to_srq(struct mlx5_core_rsc_common * res)1340 static inline struct mlx5_ib_srq *res_to_srq(struct mlx5_core_rsc_common *res)
1341 {
1342 struct mlx5_core_srq *msrq =
1343 container_of(res, struct mlx5_core_srq, common);
1344
1345 return to_mibsrq(msrq);
1346 }
1347
mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1348 static void mlx5_ib_mr_wqe_pfault_handler(struct mlx5_ib_dev *dev,
1349 struct mlx5_pagefault *pfault)
1350 {
1351 bool sq = pfault->type & MLX5_PFAULT_REQUESTOR;
1352 u16 wqe_index = pfault->wqe.wqe_index;
1353 void *wqe, *wqe_start = NULL, *wqe_end = NULL;
1354 u32 bytes_mapped, total_wqe_bytes;
1355 struct mlx5_core_rsc_common *res;
1356 int resume_with_error = 1;
1357 struct mlx5_ib_qp *qp;
1358 size_t bytes_copied;
1359 int ret = 0;
1360
1361 res = odp_get_rsc(dev, pfault->wqe.wq_num, pfault->type);
1362 if (!res) {
1363 mlx5_ib_dbg(dev, "wqe page fault for missing resource %d\n", pfault->wqe.wq_num);
1364 return;
1365 }
1366
1367 if (res->res != MLX5_RES_QP && res->res != MLX5_RES_SRQ &&
1368 res->res != MLX5_RES_XSRQ) {
1369 mlx5_ib_err(dev, "wqe page fault for unsupported type %d\n",
1370 pfault->type);
1371 goto resolve_page_fault;
1372 }
1373
1374 wqe_start = (void *)__get_free_page(GFP_KERNEL);
1375 if (!wqe_start) {
1376 mlx5_ib_err(dev, "Error allocating memory for IO page fault handling.\n");
1377 goto resolve_page_fault;
1378 }
1379
1380 wqe = wqe_start;
1381 qp = (res->res == MLX5_RES_QP) ? res_to_qp(res) : NULL;
1382 if (qp && sq) {
1383 ret = mlx5_ib_read_wqe_sq(qp, wqe_index, wqe, PAGE_SIZE,
1384 &bytes_copied);
1385 if (ret)
1386 goto read_user;
1387 ret = mlx5_ib_mr_initiator_pfault_handler(
1388 dev, pfault, qp, &wqe, &wqe_end, bytes_copied);
1389 } else if (qp && !sq) {
1390 ret = mlx5_ib_read_wqe_rq(qp, wqe_index, wqe, PAGE_SIZE,
1391 &bytes_copied);
1392 if (ret)
1393 goto read_user;
1394 ret = mlx5_ib_mr_responder_pfault_handler_rq(
1395 dev, qp, wqe, &wqe_end, bytes_copied);
1396 } else if (!qp) {
1397 struct mlx5_ib_srq *srq = res_to_srq(res);
1398
1399 ret = mlx5_ib_read_wqe_srq(srq, wqe_index, wqe, PAGE_SIZE,
1400 &bytes_copied);
1401 if (ret)
1402 goto read_user;
1403 ret = mlx5_ib_mr_responder_pfault_handler_srq(
1404 dev, srq, &wqe, &wqe_end, bytes_copied);
1405 }
1406
1407 if (ret < 0 || wqe >= wqe_end)
1408 goto resolve_page_fault;
1409
1410 ret = pagefault_data_segments(dev, pfault, wqe, wqe_end, &bytes_mapped,
1411 &total_wqe_bytes, !sq);
1412 if (ret == -EAGAIN)
1413 goto out;
1414
1415 if (ret < 0 || total_wqe_bytes > bytes_mapped)
1416 goto resolve_page_fault;
1417
1418 out:
1419 ret = 0;
1420 resume_with_error = 0;
1421
1422 read_user:
1423 if (ret)
1424 mlx5_ib_err(
1425 dev,
1426 "Failed reading a WQE following page fault, error %d, wqe_index %x, qpn %llx\n",
1427 ret, wqe_index, pfault->token);
1428
1429 resolve_page_fault:
1430 mlx5_ib_page_fault_resume(dev, pfault, resume_with_error);
1431 mlx5_ib_dbg(dev, "PAGE FAULT completed. QP 0x%x resume_with_error=%d, type: 0x%x\n",
1432 pfault->wqe.wq_num, resume_with_error,
1433 pfault->type);
1434 mlx5_core_res_put(res);
1435 free_page((unsigned long)wqe_start);
1436 }
1437
mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1438 static void mlx5_ib_mr_rdma_pfault_handler(struct mlx5_ib_dev *dev,
1439 struct mlx5_pagefault *pfault)
1440 {
1441 u64 address;
1442 u32 length;
1443 u32 prefetch_len = pfault->bytes_committed;
1444 int prefetch_activated = 0;
1445 u32 rkey = pfault->rdma.r_key;
1446 int ret;
1447
1448 /* The RDMA responder handler handles the page fault in two parts.
1449 * First it brings the necessary pages for the current packet
1450 * (and uses the pfault context), and then (after resuming the QP)
1451 * prefetches more pages. The second operation cannot use the pfault
1452 * context and therefore uses the dummy_pfault context allocated on
1453 * the stack */
1454 pfault->rdma.rdma_va += pfault->bytes_committed;
1455 pfault->rdma.rdma_op_len -= min(pfault->bytes_committed,
1456 pfault->rdma.rdma_op_len);
1457 pfault->bytes_committed = 0;
1458
1459 address = pfault->rdma.rdma_va;
1460 length = pfault->rdma.rdma_op_len;
1461
1462 /* For some operations, the hardware cannot tell the exact message
1463 * length, and in those cases it reports zero. Use prefetch
1464 * logic. */
1465 if (length == 0) {
1466 prefetch_activated = 1;
1467 length = pfault->rdma.packet_size;
1468 prefetch_len = min(MAX_PREFETCH_LEN, prefetch_len);
1469 }
1470
1471 ret = pagefault_single_data_segment(dev, NULL, rkey, address, length,
1472 &pfault->bytes_committed, NULL);
1473 if (ret == -EAGAIN) {
1474 /* We're racing with an invalidation, don't prefetch */
1475 prefetch_activated = 0;
1476 } else if (ret < 0) {
1477 mlx5_ib_page_fault_resume(dev, pfault, 1);
1478 if (ret != -ENOENT)
1479 mlx5_ib_dbg(dev, "PAGE FAULT error %d. QP 0x%llx, type: 0x%x\n",
1480 ret, pfault->token, pfault->type);
1481 return;
1482 }
1483
1484 mlx5_ib_page_fault_resume(dev, pfault, 0);
1485 mlx5_ib_dbg(dev, "PAGE FAULT completed. QP 0x%llx, type: 0x%x, prefetch_activated: %d\n",
1486 pfault->token, pfault->type,
1487 prefetch_activated);
1488
1489 /* At this point, there might be a new pagefault already arriving in
1490 * the eq, switch to the dummy pagefault for the rest of the
1491 * processing. We're still OK with the objects being alive as the
1492 * work-queue is being fenced. */
1493
1494 if (prefetch_activated) {
1495 u32 bytes_committed = 0;
1496
1497 ret = pagefault_single_data_segment(dev, NULL, rkey, address,
1498 prefetch_len,
1499 &bytes_committed, NULL);
1500 if (ret < 0 && ret != -EAGAIN) {
1501 mlx5_ib_dbg(dev, "Prefetch failed. ret: %d, QP 0x%llx, address: 0x%.16llx, length = 0x%.16x\n",
1502 ret, pfault->token, address, prefetch_len);
1503 }
1504 }
1505 }
1506
1507 #define MLX5_MEMORY_PAGE_FAULT_FLAGS_LAST BIT(7)
mlx5_ib_mr_memory_pfault_handler(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1508 static void mlx5_ib_mr_memory_pfault_handler(struct mlx5_ib_dev *dev,
1509 struct mlx5_pagefault *pfault)
1510 {
1511 u64 prefetch_va =
1512 pfault->memory.va - pfault->memory.prefetch_before_byte_count;
1513 size_t prefetch_size = pfault->memory.prefetch_before_byte_count +
1514 pfault->memory.fault_byte_count +
1515 pfault->memory.prefetch_after_byte_count;
1516 struct mlx5_ib_mkey *mmkey;
1517 struct mlx5_ib_mr *mr, *child_mr;
1518 int ret = 0;
1519
1520 mmkey = find_odp_mkey(dev, pfault->memory.mkey);
1521 if (IS_ERR(mmkey))
1522 goto err;
1523
1524 switch (mmkey->type) {
1525 case MLX5_MKEY_IMPLICIT_CHILD:
1526 child_mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1527 mr = child_mr->parent;
1528 break;
1529 case MLX5_MKEY_NULL:
1530 mr = container_of(mmkey, struct mlx5_ib_mr, null_mmkey);
1531 break;
1532 default:
1533 mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1534 break;
1535 }
1536
1537 /* If prefetch fails, handle only demanded page fault */
1538 ret = pagefault_mr(mr, prefetch_va, prefetch_size, NULL, 0, true);
1539 if (ret < 0) {
1540 ret = pagefault_mr(mr, pfault->memory.va,
1541 pfault->memory.fault_byte_count, NULL, 0,
1542 true);
1543 if (ret < 0)
1544 goto err;
1545 }
1546
1547 mlx5_update_odp_stats_with_handled(mr, faults, ret);
1548 mlx5r_deref_odp_mkey(mmkey);
1549
1550 if (pfault->memory.flags & MLX5_MEMORY_PAGE_FAULT_FLAGS_LAST)
1551 mlx5_ib_page_fault_resume(dev, pfault, 0);
1552
1553 mlx5_ib_dbg(
1554 dev,
1555 "PAGE FAULT completed %s. token 0x%llx, mkey: 0x%x, va: 0x%llx, byte_count: 0x%x\n",
1556 pfault->memory.flags & MLX5_MEMORY_PAGE_FAULT_FLAGS_LAST ?
1557 "" :
1558 "without resume cmd",
1559 pfault->token, pfault->memory.mkey, pfault->memory.va,
1560 pfault->memory.fault_byte_count);
1561
1562 return;
1563
1564 err:
1565 if (!IS_ERR(mmkey))
1566 mlx5r_deref_odp_mkey(mmkey);
1567 mlx5_ib_page_fault_resume(dev, pfault, 1);
1568 mlx5_ib_dbg(
1569 dev,
1570 "PAGE FAULT error. token 0x%llx, mkey: 0x%x, va: 0x%llx, byte_count: 0x%x, err: %d\n",
1571 pfault->token, pfault->memory.mkey, pfault->memory.va,
1572 pfault->memory.fault_byte_count, ret);
1573 }
1574
mlx5_ib_pfault(struct mlx5_ib_dev * dev,struct mlx5_pagefault * pfault)1575 static void mlx5_ib_pfault(struct mlx5_ib_dev *dev, struct mlx5_pagefault *pfault)
1576 {
1577 u8 event_subtype = pfault->event_subtype;
1578
1579 switch (event_subtype) {
1580 case MLX5_PFAULT_SUBTYPE_WQE:
1581 mlx5_ib_mr_wqe_pfault_handler(dev, pfault);
1582 break;
1583 case MLX5_PFAULT_SUBTYPE_RDMA:
1584 mlx5_ib_mr_rdma_pfault_handler(dev, pfault);
1585 break;
1586 case MLX5_PFAULT_SUBTYPE_MEMORY:
1587 mlx5_ib_mr_memory_pfault_handler(dev, pfault);
1588 break;
1589 default:
1590 mlx5_ib_err(dev, "Invalid page fault event subtype: 0x%x\n",
1591 event_subtype);
1592 mlx5_ib_page_fault_resume(dev, pfault, 1);
1593 }
1594 }
1595
mlx5_ib_eqe_pf_action(struct work_struct * work)1596 static void mlx5_ib_eqe_pf_action(struct work_struct *work)
1597 {
1598 struct mlx5_pagefault *pfault = container_of(work,
1599 struct mlx5_pagefault,
1600 work);
1601 struct mlx5_ib_pf_eq *eq = pfault->eq;
1602
1603 mlx5_ib_pfault(eq->dev, pfault);
1604 mempool_free(pfault, eq->pool);
1605 }
1606
1607 #define MEMORY_SCHEME_PAGE_FAULT_GRANULARITY 4096
mlx5_ib_eq_pf_process(struct mlx5_ib_pf_eq * eq)1608 static void mlx5_ib_eq_pf_process(struct mlx5_ib_pf_eq *eq)
1609 {
1610 struct mlx5_eqe_page_fault *pf_eqe;
1611 struct mlx5_pagefault *pfault;
1612 struct mlx5_eqe *eqe;
1613 int cc = 0;
1614
1615 while ((eqe = mlx5_eq_get_eqe(eq->core, cc))) {
1616 pfault = mempool_alloc(eq->pool, GFP_ATOMIC);
1617 if (!pfault) {
1618 schedule_work(&eq->work);
1619 break;
1620 }
1621
1622 pf_eqe = &eqe->data.page_fault;
1623 pfault->event_subtype = eqe->sub_type;
1624
1625 switch (eqe->sub_type) {
1626 case MLX5_PFAULT_SUBTYPE_RDMA:
1627 /* RDMA based event */
1628 pfault->bytes_committed =
1629 be32_to_cpu(pf_eqe->rdma.bytes_committed);
1630 pfault->type =
1631 be32_to_cpu(pf_eqe->rdma.pftype_token) >> 24;
1632 pfault->token =
1633 be32_to_cpu(pf_eqe->rdma.pftype_token) &
1634 MLX5_24BIT_MASK;
1635 pfault->rdma.r_key =
1636 be32_to_cpu(pf_eqe->rdma.r_key);
1637 pfault->rdma.packet_size =
1638 be16_to_cpu(pf_eqe->rdma.packet_length);
1639 pfault->rdma.rdma_op_len =
1640 be32_to_cpu(pf_eqe->rdma.rdma_op_len);
1641 pfault->rdma.rdma_va =
1642 be64_to_cpu(pf_eqe->rdma.rdma_va);
1643 mlx5_ib_dbg(
1644 eq->dev,
1645 "PAGE_FAULT: subtype: 0x%02x, bytes_committed: 0x%06x, type:0x%x, token: 0x%06llx, r_key: 0x%08x\n",
1646 eqe->sub_type, pfault->bytes_committed,
1647 pfault->type, pfault->token,
1648 pfault->rdma.r_key);
1649 mlx5_ib_dbg(eq->dev,
1650 "PAGE_FAULT: rdma_op_len: 0x%08x, rdma_va: 0x%016llx\n",
1651 pfault->rdma.rdma_op_len,
1652 pfault->rdma.rdma_va);
1653 break;
1654
1655 case MLX5_PFAULT_SUBTYPE_WQE:
1656 /* WQE based event */
1657 pfault->bytes_committed =
1658 be32_to_cpu(pf_eqe->wqe.bytes_committed);
1659 pfault->type =
1660 (be32_to_cpu(pf_eqe->wqe.pftype_wq) >> 24) & 0x7;
1661 pfault->token =
1662 be32_to_cpu(pf_eqe->wqe.token);
1663 pfault->wqe.wq_num =
1664 be32_to_cpu(pf_eqe->wqe.pftype_wq) &
1665 MLX5_24BIT_MASK;
1666 pfault->wqe.wqe_index =
1667 be16_to_cpu(pf_eqe->wqe.wqe_index);
1668 pfault->wqe.packet_size =
1669 be16_to_cpu(pf_eqe->wqe.packet_length);
1670 mlx5_ib_dbg(
1671 eq->dev,
1672 "PAGE_FAULT: subtype: 0x%02x, bytes_committed: 0x%06x, type:0x%x, token: 0x%06llx, wq_num: 0x%06x, wqe_index: 0x%04x\n",
1673 eqe->sub_type, pfault->bytes_committed,
1674 pfault->type, pfault->token, pfault->wqe.wq_num,
1675 pfault->wqe.wqe_index);
1676 break;
1677
1678 case MLX5_PFAULT_SUBTYPE_MEMORY:
1679 /* Memory based event */
1680 pfault->bytes_committed = 0;
1681 pfault->token =
1682 be32_to_cpu(pf_eqe->memory.token31_0) |
1683 ((u64)be16_to_cpu(pf_eqe->memory.token47_32)
1684 << 32);
1685 pfault->memory.va = be64_to_cpu(pf_eqe->memory.va);
1686 pfault->memory.mkey = be32_to_cpu(pf_eqe->memory.mkey);
1687 pfault->memory.fault_byte_count = (be32_to_cpu(
1688 pf_eqe->memory.demand_fault_pages) >> 12) *
1689 MEMORY_SCHEME_PAGE_FAULT_GRANULARITY;
1690 pfault->memory.prefetch_before_byte_count =
1691 be16_to_cpu(
1692 pf_eqe->memory.pre_demand_fault_pages) *
1693 MEMORY_SCHEME_PAGE_FAULT_GRANULARITY;
1694 pfault->memory.prefetch_after_byte_count =
1695 be16_to_cpu(
1696 pf_eqe->memory.post_demand_fault_pages) *
1697 MEMORY_SCHEME_PAGE_FAULT_GRANULARITY;
1698 pfault->memory.flags = pf_eqe->memory.flags;
1699 mlx5_ib_dbg(
1700 eq->dev,
1701 "PAGE_FAULT: subtype: 0x%02x, token: 0x%06llx, mkey: 0x%06x, fault_byte_count: 0x%06x, va: 0x%016llx, flags: 0x%02x\n",
1702 eqe->sub_type, pfault->token,
1703 pfault->memory.mkey,
1704 pfault->memory.fault_byte_count,
1705 pfault->memory.va, pfault->memory.flags);
1706 mlx5_ib_dbg(
1707 eq->dev,
1708 "PAGE_FAULT: prefetch size: before: 0x%06x, after 0x%06x\n",
1709 pfault->memory.prefetch_before_byte_count,
1710 pfault->memory.prefetch_after_byte_count);
1711 break;
1712
1713 default:
1714 mlx5_ib_warn(eq->dev,
1715 "Unsupported page fault event sub-type: 0x%02hhx\n",
1716 eqe->sub_type);
1717 /* Unsupported page faults should still be
1718 * resolved by the page fault handler
1719 */
1720 }
1721
1722 pfault->eq = eq;
1723 INIT_WORK(&pfault->work, mlx5_ib_eqe_pf_action);
1724 queue_work(eq->wq, &pfault->work);
1725
1726 cc = mlx5_eq_update_cc(eq->core, ++cc);
1727 }
1728
1729 mlx5_eq_update_ci(eq->core, cc, 1);
1730 }
1731
mlx5_ib_eq_pf_int(struct notifier_block * nb,unsigned long type,void * data)1732 static int mlx5_ib_eq_pf_int(struct notifier_block *nb, unsigned long type,
1733 void *data)
1734 {
1735 struct mlx5_ib_pf_eq *eq =
1736 container_of(nb, struct mlx5_ib_pf_eq, irq_nb);
1737 unsigned long flags;
1738
1739 if (spin_trylock_irqsave(&eq->lock, flags)) {
1740 mlx5_ib_eq_pf_process(eq);
1741 spin_unlock_irqrestore(&eq->lock, flags);
1742 } else {
1743 schedule_work(&eq->work);
1744 }
1745
1746 return IRQ_HANDLED;
1747 }
1748
1749 /* mempool_refill() was proposed but unfortunately wasn't accepted
1750 * http://lkml.iu.edu/hypermail/linux/kernel/1512.1/05073.html
1751 * Cheap workaround.
1752 */
mempool_refill(mempool_t * pool)1753 static void mempool_refill(mempool_t *pool)
1754 {
1755 while (pool->curr_nr < pool->min_nr)
1756 mempool_free(mempool_alloc(pool, GFP_KERNEL), pool);
1757 }
1758
mlx5_ib_eq_pf_action(struct work_struct * work)1759 static void mlx5_ib_eq_pf_action(struct work_struct *work)
1760 {
1761 struct mlx5_ib_pf_eq *eq =
1762 container_of(work, struct mlx5_ib_pf_eq, work);
1763
1764 mempool_refill(eq->pool);
1765
1766 spin_lock_irq(&eq->lock);
1767 mlx5_ib_eq_pf_process(eq);
1768 spin_unlock_irq(&eq->lock);
1769 }
1770
1771 enum {
1772 MLX5_IB_NUM_PF_EQE = 0x1000,
1773 MLX5_IB_NUM_PF_DRAIN = 64,
1774 };
1775
mlx5r_odp_create_eq(struct mlx5_ib_dev * dev,struct mlx5_ib_pf_eq * eq)1776 int mlx5r_odp_create_eq(struct mlx5_ib_dev *dev, struct mlx5_ib_pf_eq *eq)
1777 {
1778 struct mlx5_eq_param param = {};
1779 int err = 0;
1780
1781 mutex_lock(&dev->odp_eq_mutex);
1782 if (eq->core)
1783 goto unlock;
1784 INIT_WORK(&eq->work, mlx5_ib_eq_pf_action);
1785 spin_lock_init(&eq->lock);
1786 eq->dev = dev;
1787
1788 eq->pool = mempool_create_kmalloc_pool(MLX5_IB_NUM_PF_DRAIN,
1789 sizeof(struct mlx5_pagefault));
1790 if (!eq->pool) {
1791 err = -ENOMEM;
1792 goto unlock;
1793 }
1794
1795 eq->wq = alloc_workqueue("mlx5_ib_page_fault",
1796 WQ_HIGHPRI | WQ_UNBOUND | WQ_MEM_RECLAIM,
1797 MLX5_NUM_CMD_EQE);
1798 if (!eq->wq) {
1799 err = -ENOMEM;
1800 goto err_mempool;
1801 }
1802
1803 eq->irq_nb.notifier_call = mlx5_ib_eq_pf_int;
1804 param = (struct mlx5_eq_param) {
1805 .nent = MLX5_IB_NUM_PF_EQE,
1806 };
1807 param.mask[0] = 1ull << MLX5_EVENT_TYPE_PAGE_FAULT;
1808 eq->core = mlx5_eq_create_generic(dev->mdev, ¶m);
1809 if (IS_ERR(eq->core)) {
1810 err = PTR_ERR(eq->core);
1811 goto err_wq;
1812 }
1813 err = mlx5_eq_enable(dev->mdev, eq->core, &eq->irq_nb);
1814 if (err) {
1815 mlx5_ib_err(dev, "failed to enable odp EQ %d\n", err);
1816 goto err_eq;
1817 }
1818
1819 mutex_unlock(&dev->odp_eq_mutex);
1820 return 0;
1821 err_eq:
1822 mlx5_eq_destroy_generic(dev->mdev, eq->core);
1823 err_wq:
1824 eq->core = NULL;
1825 destroy_workqueue(eq->wq);
1826 err_mempool:
1827 mempool_destroy(eq->pool);
1828 unlock:
1829 mutex_unlock(&dev->odp_eq_mutex);
1830 return err;
1831 }
1832
1833 static int
mlx5_ib_odp_destroy_eq(struct mlx5_ib_dev * dev,struct mlx5_ib_pf_eq * eq)1834 mlx5_ib_odp_destroy_eq(struct mlx5_ib_dev *dev, struct mlx5_ib_pf_eq *eq)
1835 {
1836 int err;
1837
1838 if (!eq->core)
1839 return 0;
1840 mlx5_eq_disable(dev->mdev, eq->core, &eq->irq_nb);
1841 err = mlx5_eq_destroy_generic(dev->mdev, eq->core);
1842 cancel_work_sync(&eq->work);
1843 destroy_workqueue(eq->wq);
1844 mempool_destroy(eq->pool);
1845
1846 return err;
1847 }
1848
mlx5_odp_init_mkey_cache(struct mlx5_ib_dev * dev)1849 int mlx5_odp_init_mkey_cache(struct mlx5_ib_dev *dev)
1850 {
1851 struct mlx5r_cache_rb_key rb_key = {
1852 .access_mode = MLX5_MKC_ACCESS_MODE_KSM,
1853 .ndescs = mlx5_imr_ksm_entries,
1854 };
1855 struct mlx5_cache_ent *ent;
1856
1857 if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT_IMPLICIT))
1858 return 0;
1859
1860 ent = mlx5r_cache_create_ent_locked(dev, rb_key, true);
1861 if (IS_ERR(ent))
1862 return PTR_ERR(ent);
1863
1864 return 0;
1865 }
1866
1867 static const struct ib_device_ops mlx5_ib_dev_odp_ops = {
1868 .advise_mr = mlx5_ib_advise_mr,
1869 };
1870
mlx5_ib_odp_init_one(struct mlx5_ib_dev * dev)1871 int mlx5_ib_odp_init_one(struct mlx5_ib_dev *dev)
1872 {
1873 internal_fill_odp_caps(dev);
1874
1875 if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT))
1876 return 0;
1877
1878 ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_odp_ops);
1879
1880 mutex_init(&dev->odp_eq_mutex);
1881 return 0;
1882 }
1883
mlx5_ib_odp_cleanup_one(struct mlx5_ib_dev * dev)1884 void mlx5_ib_odp_cleanup_one(struct mlx5_ib_dev *dev)
1885 {
1886 if (!(dev->odp_caps.general_caps & IB_ODP_SUPPORT))
1887 return;
1888
1889 mlx5_ib_odp_destroy_eq(dev, &dev->odp_pf_eq);
1890 }
1891
mlx5_ib_odp_init(void)1892 int mlx5_ib_odp_init(void)
1893 {
1894 mlx5_imr_ksm_entries = BIT_ULL(get_order(TASK_SIZE) -
1895 MLX5_IMR_MTT_BITS);
1896
1897 return 0;
1898 }
1899
1900 struct prefetch_mr_work {
1901 struct work_struct work;
1902 u32 pf_flags;
1903 u32 num_sge;
1904 struct {
1905 u64 io_virt;
1906 struct mlx5_ib_mr *mr;
1907 size_t length;
1908 } frags[];
1909 };
1910
destroy_prefetch_work(struct prefetch_mr_work * work)1911 static void destroy_prefetch_work(struct prefetch_mr_work *work)
1912 {
1913 u32 i;
1914
1915 for (i = 0; i < work->num_sge; ++i)
1916 mlx5r_deref_odp_mkey(&work->frags[i].mr->mmkey);
1917
1918 kvfree(work);
1919 }
1920
1921 static struct mlx5_ib_mr *
get_prefetchable_mr(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 lkey)1922 get_prefetchable_mr(struct ib_pd *pd, enum ib_uverbs_advise_mr_advice advice,
1923 u32 lkey)
1924 {
1925 struct mlx5_ib_dev *dev = to_mdev(pd->device);
1926 struct mlx5_ib_mr *mr = NULL;
1927 struct mlx5_ib_mkey *mmkey;
1928
1929 xa_lock(&dev->odp_mkeys);
1930 mmkey = xa_load(&dev->odp_mkeys, mlx5_base_mkey(lkey));
1931 if (!mmkey || mmkey->key != lkey) {
1932 mr = ERR_PTR(-ENOENT);
1933 goto end;
1934 }
1935 if (mmkey->type != MLX5_MKEY_MR) {
1936 mr = ERR_PTR(-EINVAL);
1937 goto end;
1938 }
1939
1940 mr = container_of(mmkey, struct mlx5_ib_mr, mmkey);
1941
1942 if (mr->ibmr.pd != pd) {
1943 mr = ERR_PTR(-EPERM);
1944 goto end;
1945 }
1946
1947 /* prefetch with write-access must be supported by the MR */
1948 if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_WRITE &&
1949 !mr->umem->writable) {
1950 mr = ERR_PTR(-EPERM);
1951 goto end;
1952 }
1953
1954 refcount_inc(&mmkey->usecount);
1955 end:
1956 xa_unlock(&dev->odp_mkeys);
1957 return mr;
1958 }
1959
mlx5_ib_prefetch_mr_work(struct work_struct * w)1960 static void mlx5_ib_prefetch_mr_work(struct work_struct *w)
1961 {
1962 struct prefetch_mr_work *work =
1963 container_of(w, struct prefetch_mr_work, work);
1964 u32 bytes_mapped = 0;
1965 int ret;
1966 u32 i;
1967
1968 /* We rely on IB/core that work is executed if we have num_sge != 0 only. */
1969 WARN_ON(!work->num_sge);
1970 for (i = 0; i < work->num_sge; ++i) {
1971 ret = pagefault_mr(work->frags[i].mr, work->frags[i].io_virt,
1972 work->frags[i].length, &bytes_mapped,
1973 work->pf_flags, false);
1974 if (ret <= 0)
1975 continue;
1976 mlx5_update_odp_stats(work->frags[i].mr, prefetch, ret);
1977 }
1978
1979 destroy_prefetch_work(work);
1980 }
1981
init_prefetch_work(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 pf_flags,struct prefetch_mr_work * work,struct ib_sge * sg_list,u32 num_sge)1982 static int init_prefetch_work(struct ib_pd *pd,
1983 enum ib_uverbs_advise_mr_advice advice,
1984 u32 pf_flags, struct prefetch_mr_work *work,
1985 struct ib_sge *sg_list, u32 num_sge)
1986 {
1987 u32 i;
1988
1989 INIT_WORK(&work->work, mlx5_ib_prefetch_mr_work);
1990 work->pf_flags = pf_flags;
1991
1992 for (i = 0; i < num_sge; ++i) {
1993 struct mlx5_ib_mr *mr;
1994
1995 mr = get_prefetchable_mr(pd, advice, sg_list[i].lkey);
1996 if (IS_ERR(mr)) {
1997 work->num_sge = i;
1998 return PTR_ERR(mr);
1999 }
2000 work->frags[i].io_virt = sg_list[i].addr;
2001 work->frags[i].length = sg_list[i].length;
2002 work->frags[i].mr = mr;
2003 }
2004 work->num_sge = num_sge;
2005 return 0;
2006 }
2007
mlx5_ib_prefetch_sg_list(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 pf_flags,struct ib_sge * sg_list,u32 num_sge)2008 static int mlx5_ib_prefetch_sg_list(struct ib_pd *pd,
2009 enum ib_uverbs_advise_mr_advice advice,
2010 u32 pf_flags, struct ib_sge *sg_list,
2011 u32 num_sge)
2012 {
2013 u32 bytes_mapped = 0;
2014 int ret = 0;
2015 u32 i;
2016
2017 for (i = 0; i < num_sge; ++i) {
2018 struct mlx5_ib_mr *mr;
2019
2020 mr = get_prefetchable_mr(pd, advice, sg_list[i].lkey);
2021 if (IS_ERR(mr))
2022 return PTR_ERR(mr);
2023 ret = pagefault_mr(mr, sg_list[i].addr, sg_list[i].length,
2024 &bytes_mapped, pf_flags, false);
2025 if (ret < 0) {
2026 mlx5r_deref_odp_mkey(&mr->mmkey);
2027 return ret;
2028 }
2029 mlx5_update_odp_stats(mr, prefetch, ret);
2030 mlx5r_deref_odp_mkey(&mr->mmkey);
2031 }
2032
2033 return 0;
2034 }
2035
mlx5_ib_advise_mr_prefetch(struct ib_pd * pd,enum ib_uverbs_advise_mr_advice advice,u32 flags,struct ib_sge * sg_list,u32 num_sge)2036 int mlx5_ib_advise_mr_prefetch(struct ib_pd *pd,
2037 enum ib_uverbs_advise_mr_advice advice,
2038 u32 flags, struct ib_sge *sg_list, u32 num_sge)
2039 {
2040 u32 pf_flags = 0;
2041 struct prefetch_mr_work *work;
2042 int rc;
2043
2044 if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH)
2045 pf_flags |= MLX5_PF_FLAGS_DOWNGRADE;
2046
2047 if (advice == IB_UVERBS_ADVISE_MR_ADVICE_PREFETCH_NO_FAULT)
2048 pf_flags |= MLX5_PF_FLAGS_SNAPSHOT;
2049
2050 if (flags & IB_UVERBS_ADVISE_MR_FLAG_FLUSH)
2051 return mlx5_ib_prefetch_sg_list(pd, advice, pf_flags, sg_list,
2052 num_sge);
2053
2054 work = kvzalloc(struct_size(work, frags, num_sge), GFP_KERNEL);
2055 if (!work)
2056 return -ENOMEM;
2057
2058 rc = init_prefetch_work(pd, advice, pf_flags, work, sg_list, num_sge);
2059 if (rc) {
2060 destroy_prefetch_work(work);
2061 return rc;
2062 }
2063 queue_work(system_unbound_wq, &work->work);
2064 return 0;
2065 }
2066