Re: [PATCH v7 09/10] vfio: selftests: Add mlx5 driver - data path and memcpy ops

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] hw race condition in mlx5st_poll_cq_batch due to premature CQ doorbell update
--

commit 6b2a87450d158c064575c07067d4356a0b0950cd
Author: Jason Gunthorpe <jgg@ziepe.ca>

vfio: selftests: Add mlx5 driver - data path and memcpy ops

Complete the mlx5 driver by adding CQ/QP creation, QP state
transitions, WQE posting, CQ polling, and the
memcpy_start/memcpy_wait callbacks.

> diff --git a/tools/testing/selftests/vfio/lib/drivers/mlx5/mlx5.c b/tools/testing/selftests/vfio/lib/drivers/mlx5/mlx5.c
> index 5a87d070dc425..fff3babef5e78 100644
> --- a/tools/testing/selftests/vfio/lib/drivers/mlx5/mlx5.c
> +++ b/tools/testing/selftests/vfio/lib/drivers/mlx5/mlx5.c

[ ... ]

> +static int mlx5st_poll_cq_batch(struct mlx5st_device *dev,
> +				unsigned int max_cqe)
> +{
> +	unsigned int polled = 0;
> +
> +	while (polled < max_cqe) {
> +		unsigned int idx = dev->cq_ci % CQ_CQE_CNT;
> +		struct mlx5st_cqe64 *cqe = &dev->cq_buf[idx];
> +		u8 owner, opcode;
> +
> +		owner = MLX5_GET_ONCE(cqe64, cqe, owner);
> +		if (owner != ((dev->cq_ci >> LOG_CQ_SIZE) & 1))
> +			break;
> +
> +		dma_rmb();
> +
> +		opcode = MLX5_GET(cqe64, cqe, opcode);
> +
> +		dev->cq_ci++;
> +		WRITE_ONCE(dev->cq_dbrec.recv_counter,
> +			   cpu_to_be32(dev->cq_ci & 0xffffff));
> +
> +		if (opcode == MLX5_CQE_REQ) {
> +			dev->sq_ci =
> +				(u16)(MLX5_GET(cqe64, cqe, wqe_counter) + 1);

[Severity: Medium]
Could this sequence cause a read-after-release hardware race regression?

Looking at mlx5st_poll_cq_batch(), dev->cq_ci is incremented and the CQ
doorbell (recv_counter) is updated before extracting wqe_counter or the error
syndrome from the CQE.

Updating the doorbell record releases the CQE slot back to the device.
If the hardware is actively pushing new completions, could it overwrite
the CQE memory via DMA while the CPU is still extracting the necessary
fields from it?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/0-v7-c6d30e8ce1e4+3dfa6-mlx5st_jgg@nvidia.com?part=9