From 26cd3b3f19a019cf0bc17915af179de6193fe56c Mon Sep 17 00:00:00 2001
From: Chengchang Tang <tangchengchang@huawei.com>
Date: Thu, 18 Apr 2024 13:49:33 +0800
Subject: [PATCH] libhns: Fix owner bit when SQ wraps around in new IO

mainline inclusion
from mainline-master
commit 0067aad0a3a9a46d6c150e089b30bc9246dfe663
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9NZME
CVE: NA

Reference: https://github.com/linux-rdma/rdma-core/pull/1450/commits/0067aad0a3a9a46d6c150e089b30bc9246dfe663

----------------------------------------------------------------------

Commit c292b7809f38 ("libhns: Fix the owner bit error of sq in new io")
fixed a bug that the SQ head was updated before the owner bit was filled
in WQE, but only when using ibv_wr_set_sge(). Actually this bug still
exists in other ibv_wr_set_*().

For example, in the flow below, the driver will fill the owner bit in
ibv_wr_rdma_write(), but mistakenly overwrite it again in
ibv_wr_set_sge_list() or ibv_wr_set_inline_data_list().

```c
ibv_wr_start();
ibv_wr_rdma_write();
if (inline)
    ibv_wr_set_inline_data_list();
else
    ibv_wr_set_sge_list();
ibv_wr_complete();
```

When the SQ wraps around, the overwritten value will be incorrect.
Remove all the incorrect owner bit filling in ibv_wr_set_*().

Fixes: 36446a56eea5 ("libhns: Extended QP supports the new post send mechanism")
Fixes: c292b7809f38 ("libhns: Fix the owner bit error of sq in new io")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Juan Zhou <zhoujuan51@h-partners.com>
---
 providers/hns/hns_roce_u_hw_v2.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c
index a0dce1c..9016978 100644
--- a/providers/hns/hns_roce_u_hw_v2.c
+++ b/providers/hns/hns_roce_u_hw_v2.c
@@ -2353,8 +2353,6 @@ static void wr_set_sge_list_rc(struct ibv_qp_ex *ibv_qp, size_t num_sge,
 
 	wqe->msg_len = htole32(qp->sge_info.total_len);
 	hr_reg_write(wqe, RCWQE_SGE_NUM, qp->sge_info.valid_num);
-
-	enable_wqe(qp, wqe, qp->sq.head);
 }
 
 static void wr_send_rc(struct ibv_qp_ex *ibv_qp)
@@ -2546,7 +2544,6 @@ static void wr_set_inline_data_rc(struct ibv_qp_ex *ibv_qp, void *addr,
 
 	qp->sge_info.total_len = length;
 	set_inline_data_list_rc(qp, wqe, 1, &buff);
-	enable_wqe(qp, wqe, qp->sq.head);
 }
 
 static void wr_set_inline_data_list_rc(struct ibv_qp_ex *ibv_qp, size_t num_buf,
@@ -2564,7 +2561,6 @@ static void wr_set_inline_data_list_rc(struct ibv_qp_ex *ibv_qp, size_t num_buf,
 		qp->sge_info.total_len += buf_list[i].length;
 
 	set_inline_data_list_rc(qp, wqe, num_buf, buf_list);
-	enable_wqe(qp, wqe, qp->sq.head);
 }
 
 static struct hns_roce_ud_sq_wqe *
@@ -2701,7 +2697,6 @@ static void wr_set_sge_list_ud(struct ibv_qp_ex *ibv_qp, size_t num_sge,
 	hr_reg_write(wqe, UDWQE_SGE_NUM, cnt);
 
 	qp->sge_info.start_idx += cnt;
-	enable_wqe(qp, wqe, qp->sq.head);
 }
 
 static void set_inline_data_list_ud(struct hns_roce_qp *qp,
@@ -2767,7 +2762,6 @@ static void wr_set_inline_data_ud(struct ibv_qp_ex *ibv_qp, void *addr,
 
 	qp->sge_info.total_len = length;
 	set_inline_data_list_ud(qp, wqe, 1, &buff);
-	enable_wqe(qp, wqe, qp->sq.head);
 }
 
 static void wr_set_inline_data_list_ud(struct ibv_qp_ex *ibv_qp, size_t num_buf,
@@ -2785,7 +2779,6 @@ static void wr_set_inline_data_list_ud(struct ibv_qp_ex *ibv_qp, size_t num_buf,
 		qp->sge_info.total_len += buf_list[i].length;
 
 	set_inline_data_list_ud(qp, wqe, num_buf, buf_list);
-	enable_wqe(qp, wqe, qp->sq.head);
 }
 
 static void wr_start(struct ibv_qp_ex *ibv_qp)
-- 
2.33.0