[v2,4/4] regex/mlx5: prevent wrong calculation of free sqs in umr mode

  From: John Hurley <jhurley@nvidia.com>

A recent change adds support for scattered mbuf and UMR support for regex.
Part of this commit makes the pi and ci counters of the regex_sq a quarter
of the length in non umr mode, effectively moving them from 16 bits to
14. The new get_free method casts the difference in pi and ci to a 16 bit
value when calculating the free send queues, accounting for any wrapping
when pi has looped back to 0 but ci has not yet. However, the move to 14
bits while still casting to 16 can now lead to corrupted, large values
returned.

Modify the get_free function to take in the has_umr flag and, accordingly,
account for wrapping on either 14 or 16 bit pi/ci difference.

Fixes: a20fe8e74dea ("regex/mlx5: add data path scattered mbuf process")
Signed-off-by: John Hurley <jhurley@nvidia.com>
---
 drivers/regex/mlx5/mlx5_regex_fastpath.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
  

Hi

> -----Original Message-----
> From: Suanming Mou <suanmingm@nvidia.com>
> 
> From: John Hurley <jhurley@nvidia.com>
> 
> A recent change adds support for scattered mbuf and UMR support for regex.
> Part of this commit makes the pi and ci counters of the regex_sq a quarter
> of the length in non umr mode, effectively moving them from 16 bits to
> 14. The new get_free method casts the difference in pi and ci to a 16 bit
> value when calculating the free send queues, accounting for any wrapping
> when pi has looped back to 0 but ci has not yet. However, the move to 14
> bits while still casting to 16 can now lead to corrupted, large values
> returned.
> 
> Modify the get_free function to take in the has_umr flag and, accordingly,
> account for wrapping on either 14 or 16 bit pi/ci difference.
> 
> Fixes: a20fe8e74dea ("regex/mlx5: add data path scattered mbuf process")
> Signed-off-by: John Hurley <jhurley@nvidia.com>
> ---
>  drivers/regex/mlx5/mlx5_regex_fastpath.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/regex/mlx5/mlx5_regex_fastpath.c
> b/drivers/regex/mlx5/mlx5_regex_fastpath.c
> index 4f9402c583..b57e7d7794 100644
> --- a/drivers/regex/mlx5/mlx5_regex_fastpath.c
> +++ b/drivers/regex/mlx5/mlx5_regex_fastpath.c
> @@ -192,8 +192,10 @@ send_doorbell(struct mlx5_regex_priv *priv, struct
> mlx5_regex_sq *sq)
>  }
> 
>  static inline int
> -get_free(struct mlx5_regex_sq *sq) {
> -	return (sq_size_get(sq) - (uint16_t)(sq->pi - sq->ci));
> +get_free(struct mlx5_regex_sq *sq, uint8_t has_umr) {
> +	return (sq_size_get(sq) - ((sq->pi - sq->ci) &
> +			(has_umr ? (MLX5_REGEX_MAX_WQE_INDEX >> 2) :
> +			MLX5_REGEX_MAX_WQE_INDEX)));
>  }
> 
>  static inline uint32_t
> @@ -385,7 +387,7 @@ mlx5_regexdev_enqueue_gga(struct rte_regexdev
> *dev, uint16_t qp_id,
>  	while ((sqid = ffs(queue->free_sqs))) {
>  		sqid--; /* ffs returns 1 for bit 0 */
>  		sq = &queue->sqs[sqid];
> -		nb_desc = get_free(sq);
> +		nb_desc = get_free(sq, priv->has_umr);
>  		if (nb_desc) {
>  			/* The ops be handled can't exceed nb_ops. */
>  			if (nb_desc > nb_left)
> @@ -418,7 +420,7 @@ mlx5_regexdev_enqueue(struct rte_regexdev *dev,
> uint16_t qp_id,
>  	while ((sqid = ffs(queue->free_sqs))) {
>  		sqid--; /* ffs returns 1 for bit 0 */
>  		sq = &queue->sqs[sqid];
> -		while (get_free(sq)) {
> +		while (get_free(sq, priv->has_umr)) {
>  			job_id = job_id_get(sqid, sq_size_get(sq), sq->pi);
>  			prep_one(priv, queue, sq, ops[i], &queue-
> >jobs[job_id]);
>  			i++;
> --
> 2.25.1

Acked-by: Ori Kam <orika@nvidia.com>
Best,
Ori