From 5cc1a047c4d71ced86b0f71f66adf12475a3c788 Mon Sep 17 00:00:00 2001 From: Wenpeng Liang Date: Tue, 11 May 2021 19:06:35 +0800 Subject: libhns: Bugfix for checking whether the SRQ is full when posting WR If the user post a list of WRs, the head in the for loop is not updated in time, and the judgment of if (head == tail) becomes invalid. Signed-off-by: Wenpeng Liang Signed-off-by: Weihang Li --- providers/hns/hns_roce_u_hw_v2.c | 17 +++++++++++++---- providers/hns/hns_roce_u_verbs.c | 2 +- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c index 82124082..0c15bdbe 100644 --- a/providers/hns/hns_roce_u_hw_v2.c +++ b/providers/hns/hns_roce_u_hw_v2.c @@ -1527,6 +1527,15 @@ static int hns_roce_u_v2_destroy_qp(struct ibv_qp *ibqp) return ret; } +static int hns_roce_v2_srqwq_overflow(struct hns_roce_srq *srq) +{ + struct hns_roce_idx_que *idx_que = &srq->idx_que; + unsigned int cur; + + cur = idx_que->head - idx_que->tail; + return cur >= srq->wqe_cnt - 1; +} + static int get_wqe_idx(struct hns_roce_srq *srq, int *wqe_idx) { struct hns_roce_idx_que *idx_que = &srq->idx_que; @@ -1577,14 +1586,14 @@ static int hns_roce_u_v2_post_srq_recv(struct ibv_srq *ib_srq, max_sge = srq->max_gs - srq->rsv_sge; for (nreq = 0; wr; ++nreq, wr = wr->next) { - if (wr->num_sge > max_sge) { - ret = -EINVAL; + if (hns_roce_v2_srqwq_overflow(srq)) { + ret = -ENOMEM; *bad_wr = wr; break; } - if (srq->idx_que.head == srq->idx_que.tail) { - ret = -ENOMEM; + if (wr->num_sge > max_sge) { + ret = -EINVAL; *bad_wr = wr; break; } diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index 3abf7b48..dace35fd 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -492,7 +492,7 @@ static int hns_roce_create_idx_que(struct hns_roce_srq *srq) idx_que->bitmap[i] = ~(0UL); idx_que->head = 0; - idx_que->tail = srq->wqe_cnt - 1; + idx_que->tail = 0; return 0; } -- 2.30.0