From: Li RongQing <lirongqing@baidu.com>

mlx5e_poll_ico_cq() requires sq->cc to be updated only after
mlx5_cqwq_update_db_record(), otherwise a CQ overrun may occur.

The current implementation updates sq->cc before the CQ doorbell
record, violating this ordering requirement.

Update the CQ doorbell record first and use dma_wmb() before updating
sq->cc. This ensures that the CQ space is released to the device
before the corresponding ICOSQ consumer index is updated by software.

Fixes: fd9b4be8002c ("net/mlx5e: RX, Support multiple outstanding UMR posts")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index f6eff03..01867dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -905,10 +905,12 @@ int mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
 		} while (!last_wqe);
 	} while ((++i < MLX5E_TX_CQ_POLL_BUDGET) && (cqe = mlx5_cqwq_get_cqe(&cq->wq)));
 
-	sq->cc = sqcc;
-
 	mlx5_cqwq_update_db_record(&cq->wq);
 
+	/* ensure cq space is freed before enabling more cqes */
+	dma_wmb();
+
+	sq->cc = sqcc;
 	return i;
 }
 
-- 
2.9.4

On 20.08.26 05:08, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
> 
> mlx5e_poll_ico_cq() requires sq->cc to be updated only after
> mlx5_cqwq_update_db_record(), otherwise a CQ overrun may occur.
> 
> The current implementation updates sq->cc before the CQ doorbell
> record, violating this ordering requirement.
> 
> Update the CQ doorbell record first and use dma_wmb() before updating
> sq->cc. This ensures that the CQ space is released to the device
> before the corresponding ICOSQ consumer index is updated by software.
> 
> Fixes: fd9b4be8002c ("net/mlx5e: RX, Support multiple outstanding UMR posts")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> index f6eff03..01867dd 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
> @@ -905,10 +905,12 @@ int mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
>  		} while (!last_wqe);
>  	} while ((++i < MLX5E_TX_CQ_POLL_BUDGET) && (cqe = mlx5_cqwq_get_cqe(&cq->wq)));
>  
> -	sq->cc = sqcc;
> -
>  	mlx5_cqwq_update_db_record(&cq->wq);
>  
> +	/* ensure cq space is freed before enabling more cqes */
> +	dma_wmb();
> +
> +	sq->cc = sqcc;
>  	return i;
>  }
>  
Thanks for your patch. The patch looks good but we want to pass it through our
internal regressions.

Thanks,
Dragos