RDMA/bnxt_re: Change the sequence of updating the CQ toggle value

Currently the CQ toggle value in the shared page (read by the userlib) is
updated as part of the cqn_handler. There is a potential race of
application calling the CQ ARM doorbell immediately and using the old
toggle value.

Change the sequence of updating CQ toggle value to update in the
bnxt_qplib_service_nq function immediately after reading the toggle value
to be in sync with the HW updated value.

Fixes: e275919d9669 ("RDMA/bnxt_re: Share a page to expose per CQ info with userspace")
Link: https://patch.msgid.link/r/1728373302-19530-9-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Chandramohan Akula <chandramohan.akula@broadcom.com>
Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index 63ca600..6715c96 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1274,15 +1274,9 @@ static int bnxt_re_cqn_handler(struct bnxt_qplib_nq *nq,
 {
        struct bnxt_re_cq *cq = container_of(handle, struct bnxt_re_cq,
                                             qplib_cq);
-       u32 *cq_ptr;
 
-       if (cq->ib_cq.comp_handler) {
-               if (cq->uctx_cq_page) {
-                       cq_ptr = (u32 *)cq->uctx_cq_page;
-                       *cq_ptr = cq->qplib_cq.toggle;
-               }
+       if (cq->ib_cq.comp_handler)
                (*cq->ib_cq.comp_handler)(&cq->ib_cq, cq->ib_cq.cq_context);
-       }
 
        return 0;
 }

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 42e98e5..2ebcb2d 100644 (file)
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -327,6 +327,7 @@ static void bnxt_qplib_service_nq(struct tasklet_struct *t)
                case NQ_BASE_TYPE_CQ_NOTIFICATION:
                {
                        struct nq_cn *nqcne = (struct nq_cn *)nqe;
+                       struct bnxt_re_cq *cq_p;
 
                        q_handle = le32_to_cpu(nqcne->cq_handle_low);
                        q_handle |= (u64)le32_to_cpu(nqcne->cq_handle_high)
@@ -337,6 +338,10 @@ static void bnxt_qplib_service_nq(struct tasklet_struct *t)
                        cq->toggle = (le16_to_cpu(nqe->info10_type) &
                                        NQ_CN_TOGGLE_MASK) >> NQ_CN_TOGGLE_SFT;
                        cq->dbinfo.toggle = cq->toggle;
+                       cq_p = container_of(cq, struct bnxt_re_cq, qplib_cq);
+                       if (cq_p->uctx_cq_page)
+                               *((u32 *)cq_p->uctx_cq_page) = cq->toggle;
+
                        bnxt_qplib_armen_db(&cq->dbinfo,
                                            DBC_DBC_TYPE_CQ_ARMENA);
                        spin_lock_bh(&cq->compl_lock);