From 26cd3b3f19a019cf0bc17915af179de6193fe56c Mon Sep 17 00:00:00 2001 From: Chengchang Tang Date: Thu, 18 Apr 2024 13:49:33 +0800 Subject: [PATCH] libhns: Fix owner bit when SQ wraps around in new IO mainline inclusion from mainline-master commit 0067aad0a3a9a46d6c150e089b30bc9246dfe663 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZME CVE: NA Reference: https://github.com/linux-rdma/rdma-core/pull/1450/commits/0067aad0a3a9a46d6c150e089b30bc9246dfe663 ---------------------------------------------------------------------- Commit c292b7809f38 ("libhns: Fix the owner bit error of sq in new io") fixed a bug that the SQ head was updated before the owner bit was filled in WQE, but only when using ibv_wr_set_sge(). Actually this bug still exists in other ibv_wr_set_*(). For example, in the flow below, the driver will fill the owner bit in ibv_wr_rdma_write(), but mistakenly overwrite it again in ibv_wr_set_sge_list() or ibv_wr_set_inline_data_list(). ```c ibv_wr_start(); ibv_wr_rdma_write(); if (inline) ibv_wr_set_inline_data_list(); else ibv_wr_set_sge_list(); ibv_wr_complete(); ``` When the SQ wraps around, the overwritten value will be incorrect. Remove all the incorrect owner bit filling in ibv_wr_set_*(). Fixes: 36446a56eea5 ("libhns: Extended QP supports the new post send mechanism") Fixes: c292b7809f38 ("libhns: Fix the owner bit error of sq in new io") Signed-off-by: Chengchang Tang Signed-off-by: Junxian Huang Signed-off-by: Juan Zhou --- providers/hns/hns_roce_u_hw_v2.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c index a0dce1c..9016978 100644 --- a/providers/hns/hns_roce_u_hw_v2.c +++ b/providers/hns/hns_roce_u_hw_v2.c @@ -2353,8 +2353,6 @@ static void wr_set_sge_list_rc(struct ibv_qp_ex *ibv_qp, size_t num_sge, wqe->msg_len = htole32(qp->sge_info.total_len); hr_reg_write(wqe, RCWQE_SGE_NUM, qp->sge_info.valid_num); - - enable_wqe(qp, wqe, qp->sq.head); } static void wr_send_rc(struct ibv_qp_ex *ibv_qp) @@ -2546,7 +2544,6 @@ static void wr_set_inline_data_rc(struct ibv_qp_ex *ibv_qp, void *addr, qp->sge_info.total_len = length; set_inline_data_list_rc(qp, wqe, 1, &buff); - enable_wqe(qp, wqe, qp->sq.head); } static void wr_set_inline_data_list_rc(struct ibv_qp_ex *ibv_qp, size_t num_buf, @@ -2564,7 +2561,6 @@ static void wr_set_inline_data_list_rc(struct ibv_qp_ex *ibv_qp, size_t num_buf, qp->sge_info.total_len += buf_list[i].length; set_inline_data_list_rc(qp, wqe, num_buf, buf_list); - enable_wqe(qp, wqe, qp->sq.head); } static struct hns_roce_ud_sq_wqe * @@ -2701,7 +2697,6 @@ static void wr_set_sge_list_ud(struct ibv_qp_ex *ibv_qp, size_t num_sge, hr_reg_write(wqe, UDWQE_SGE_NUM, cnt); qp->sge_info.start_idx += cnt; - enable_wqe(qp, wqe, qp->sq.head); } static void set_inline_data_list_ud(struct hns_roce_qp *qp, @@ -2767,7 +2762,6 @@ static void wr_set_inline_data_ud(struct ibv_qp_ex *ibv_qp, void *addr, qp->sge_info.total_len = length; set_inline_data_list_ud(qp, wqe, 1, &buff); - enable_wqe(qp, wqe, qp->sq.head); } static void wr_set_inline_data_list_ud(struct ibv_qp_ex *ibv_qp, size_t num_buf, @@ -2785,7 +2779,6 @@ static void wr_set_inline_data_list_ud(struct ibv_qp_ex *ibv_qp, size_t num_buf, qp->sge_info.total_len += buf_list[i].length; set_inline_data_list_ud(qp, wqe, num_buf, buf_list); - enable_wqe(qp, wqe, qp->sq.head); } static void wr_start(struct ibv_qp_ex *ibv_qp) -- 2.33.0