IB/mlx5: Fix the locking of SRQ objects in ODP events

QP and SRQ objects are stored in different containers so the action to get
and lock a common resource during ODP event needs to address that.

While here get rid of 'refcount' and 'free' fields in mlx5_core_srq struct
and use the fields with same semantics in common structure.

Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling")
Signed-off-by: Moni Shoua <monis@mellanox.com>
Reviewed-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index c283c32f30fed83766c75e2b98450e08eacea029..18704e503508300710008bf1be3d4cf4c79d3aac 100644 (file)
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -187,8 +187,8 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe,
                        wqe_ctr = be16_to_cpu(cqe->wqe_counter);
                        wc->wr_id = srq->wrid[wqe_ctr];
                        mlx5_ib_free_srq_wqe(srq, wqe_ctr);
-                       if (msrq && atomic_dec_and_test(&msrq->refcount))
-                               complete(&msrq->free);
+                       if (msrq)
+                               mlx5_core_res_put(&msrq->common);
                }
        } else {
                wq        = &qp->rq;

diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c
index 3e0d5885c026d182eb2100597b5dedd6809dbd1a..2cbe4320513b0019c1e237b3be678ba6b963bd31 100644 (file)
--- a/drivers/infiniband/hw/mlx5/odp.c
+++ b/drivers/infiniband/hw/mlx5/odp.c
@@ -1115,22 +1115,25 @@ static int mlx5_ib_mr_responder_pfault_handler(
 static inline struct mlx5_core_rsc_common *odp_get_rsc(struct mlx5_ib_dev *dev,
                                                       u32 wq_num, int pf_type)
 {
-       enum mlx5_res_type res_type;
+       struct mlx5_core_rsc_common *common = NULL;
+       struct mlx5_core_srq *srq;
 
        switch (pf_type) {
        case MLX5_WQE_PF_TYPE_RMP:
-               res_type = MLX5_RES_SRQ;
+               srq = mlx5_cmd_get_srq(dev, wq_num);
+               if (srq)
+                       common = &srq->common;
                break;
        case MLX5_WQE_PF_TYPE_REQ_SEND_OR_WRITE:
        case MLX5_WQE_PF_TYPE_RESP:
        case MLX5_WQE_PF_TYPE_REQ_READ_OR_ATOMIC:
-               res_type = MLX5_RES_QP;
+               common = mlx5_core_res_hold(dev->mdev, wq_num, MLX5_RES_QP);
                break;
        default:
-               return NULL;
+               break;
        }
 
-       return mlx5_core_res_hold(dev->mdev, wq_num, res_type);
+       return common;
 }
 
 static inline struct mlx5_ib_qp *res_to_qp(struct mlx5_core_rsc_common *res)

diff --git a/drivers/infiniband/hw/mlx5/srq.h b/drivers/infiniband/hw/mlx5/srq.h
index 75eb5839ae95e886bb871408ff8379f88335e19c..c330af35ff1051716344809eece8708b95f69c94 100644 (file)
--- a/drivers/infiniband/hw/mlx5/srq.h
+++ b/drivers/infiniband/hw/mlx5/srq.h
@@ -46,8 +46,6 @@ struct mlx5_core_srq {
        int wqe_shift;
        void (*event)(struct mlx5_core_srq *srq, enum mlx5_event e);
 
-       atomic_t refcount;
-       struct completion free;
        u16 uid;
 };
 

diff --git a/drivers/infiniband/hw/mlx5/srq_cmd.c b/drivers/infiniband/hw/mlx5/srq_cmd.c
index 7aaaffbd4afa099f36b229af88beb73836fce68e..63ac38bb3498548b8188c37b4f8d4b52c999c2f4 100644 (file)
--- a/drivers/infiniband/hw/mlx5/srq_cmd.c
+++ b/drivers/infiniband/hw/mlx5/srq_cmd.c
@@ -87,7 +87,7 @@ struct mlx5_core_srq *mlx5_cmd_get_srq(struct mlx5_ib_dev *dev, u32 srqn)
 
        srq = radix_tree_lookup(&table->tree, srqn);
        if (srq)
-               atomic_inc(&srq->refcount);
+               atomic_inc(&srq->common.refcount);
 
        spin_unlock(&table->lock);
 
@@ -594,8 +594,8 @@ int mlx5_cmd_create_srq(struct mlx5_ib_dev *dev, struct mlx5_core_srq *srq,
        if (err)
                return err;
 
-       atomic_set(&srq->refcount, 1);
-       init_completion(&srq->free);
+       atomic_set(&srq->common.refcount, 1);
+       init_completion(&srq->common.free);
 
        spin_lock_irq(&table->lock);
        err = radix_tree_insert(&table->tree, srq->srqn, srq);
@@ -627,9 +627,8 @@ int mlx5_cmd_destroy_srq(struct mlx5_ib_dev *dev, struct mlx5_core_srq *srq)
        if (err)
                return err;
 
-       if (atomic_dec_and_test(&srq->refcount))
-               complete(&srq->free);
-       wait_for_completion(&srq->free);
+       mlx5_core_res_put(&srq->common);
+       wait_for_completion(&srq->common.free);
 
        return 0;
 }
@@ -685,7 +684,7 @@ static int srq_event_notifier(struct notifier_block *nb,
 
        srq = radix_tree_lookup(&table->tree, srqn);
        if (srq)
-               atomic_inc(&srq->refcount);
+               atomic_inc(&srq->common.refcount);
 
        spin_unlock(&table->lock);
 
@@ -694,8 +693,7 @@ static int srq_event_notifier(struct notifier_block *nb,
 
        srq->event(srq, eqe->type);
 
-       if (atomic_dec_and_test(&srq->refcount))
-               complete(&srq->free);
+       mlx5_core_res_put(&srq->common);
 
        return NOTIFY_OK;
 }