From patchwork Fri Aug 28 20:31:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294267 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnH5zv3z1xyd for ; Sat, 29 Aug 2026 06:32:18 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03F8-0002JA-SZ; Fri, 28 Aug 2026 20:32:06 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03F4-0002I6-T4 for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:02 +0000 Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id A814C3F2DD for ; Fri, 28 Aug 2026 20:32:02 +0000 (UTC) Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-92e4f946461so163269485a.2 for ; Fri, 28 Aug 2026 13:32:02 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949121; x=1788553921; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=biQuFj57ZQU25hotCT4VtdikINQGD+AlWNHFSkfvpG4=; b=JL3uGhGf8UU1YSQqJ5KoyavO43sXUhIXi8w1ciJxsuEiKuppcZRodJD8h2SgBN30dS S7KsUPRCSOESl8DADi3X7s6sg7u0JAWNDMAtPhgOBonnPzXfr5vVPrCV8wyNYFzrObCB ZXAfVr8cBTV99fF8/BXJK2JTlCd/UTTTGoPXGuv4NLN8Dk4J4PDWut9Ofux/fRkMykAW iyAtMXe2KcPIcYATUccHNd544TDDGhpkzZBGpQp7paO4dInwL/ScFxfEVjE/3NB41tV6 QWe1dsc+rkx8HJxSa2fwV3ZL7zrMBZeRmZ27qbd5VAggYUAZZaKlWn4gBhIAPAhATWVF EJSw== X-Gm-Message-State: AFuF++nuvWRA4E1b7qAGCAhxaJw9EbPvMuXX5ZnoEDPQt8zppCfvK5iF vPyvkZgyC/AypX4QuhfB1nJIXbxSupzybPrv+OL9qHrIba5rgJ/jJp0bWwPhOk5JdPS2zXHoS7U xTK4GIfx9TkzVsAZ8HCJO+5GF3WXB0XXT5zuLWx9+gBGJmtHMXmDquqo2AbKjKWt25GD7L2yStY LSOJkaJAJ+1LvOMA== X-Gm-Gg: AR+sD13Se28/djixGYb0EG1JNqY+XQJKPdaDH/JGf9lW2DEVuSYiFXFQ34podk9t/6B CMGcBAvkpj4LMTNt2tjLf5rkbHEU2LMsYI8Yw7vmvWlXf6/qVGxoTPEimISCtYdWGGahDbxJeDr UM3GQvPIfiV23xfTJIGPccF0eWW3mAGxFQ2h7wHU4ZH2NPC2/Bch0SM+bEy4RANZ7w/WXHtOGSI E+mQF0Klu4XtgDlc4XLWbusw2+OYUirH475LB0I/5scDzkoqUboumGmZ1Brzv2aGCgHHnM/SM7Z 6d4brSR/3E/OV4kdWFPTrbdc11ZRYi8o0pU8cJNAe7pt6Q/+EvfbRnG3cIqmoE0tOkZaGduZV/k mLqjeww== X-Received: by 2002:a05:620a:6488:b0:939:1fc6:3fd6 with SMTP id af79cd13be357-9391fc64239mr443314385a.18.1787949121133; Fri, 28 Aug 2026 13:32:01 -0700 (PDT) X-Received: by 2002:a05:620a:6488:b0:939:1fc6:3fd6 with SMTP id af79cd13be357-9391fc64239mr443303085a.18.1787949120512; Fri, 28 Aug 2026 13:32:00 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id af79cd13be357-9391723e87dsm225336685a.15.2026.08.28.13.31.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:00 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 1/9] RDMA/irdma: Provide scratch buffers to firmware for internal use Date: Fri, 28 Aug 2026 16:31:47 -0400 Message-ID: <20260828203155.75778-2-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jay Bhat BugLink: https://bugs.launchpad.net/bugs/2165062 For GEN3 and higher, FW requires scratch buffers for bookkeeping during cleanup, specifically during QP and MR destroy ops. Signed-off-by: Jay Bhat Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky (cherry picked from commit 9d6ba4ced73433df3d3c5909d73a49945bedd5c6) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/ctrl.c | 43 +++++++++++++++++++++++++++++- drivers/infiniband/hw/irdma/defs.h | 4 +++ drivers/infiniband/hw/irdma/hw.c | 11 ++++++++ drivers/infiniband/hw/irdma/type.h | 2 ++ drivers/infiniband/hw/irdma/user.h | 4 +-- 5 files changed, 61 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c index 45c7433c96f36..13820f1a48a40 100644 --- a/drivers/infiniband/hw/irdma/ctrl.c +++ b/drivers/infiniband/hw/irdma/ctrl.c @@ -3570,6 +3570,41 @@ static int irdma_sc_parse_fpm_query_buf(struct irdma_sc_dev *dev, __le64 *buf, hmc_fpm_misc->loc_mem_pages = (u32)FIELD_GET(IRDMA_QUERY_FPM_LOC_MEM_PAGES, temp); if (!hmc_fpm_misc->loc_mem_pages) return -EINVAL; + + get_64bit_val(buf, 184, &temp); + if (temp) { + hmc_fpm_misc->fw_scratch_buf0.size = temp; + hmc_fpm_misc->fw_scratch_buf0.va = + dma_alloc_coherent(dev->hw->device, + hmc_fpm_misc->fw_scratch_buf0.size, + &hmc_fpm_misc->fw_scratch_buf0.pa, + GFP_KERNEL); + + if (!hmc_fpm_misc->fw_scratch_buf0.va) { + hmc_fpm_misc->fw_scratch_buf0.size = 0; + return -ENOMEM; + } + } + get_64bit_val(buf, 192, &temp); + if (temp) { + hmc_fpm_misc->fw_scratch_buf1.size = temp; + hmc_fpm_misc->fw_scratch_buf1.va = + dma_alloc_coherent(dev->hw->device, + hmc_fpm_misc->fw_scratch_buf1.size, + &hmc_fpm_misc->fw_scratch_buf1.pa, + GFP_KERNEL); + + if (!hmc_fpm_misc->fw_scratch_buf1.va) { + hmc_fpm_misc->fw_scratch_buf1.size = 0; + dma_free_coherent(dev->hw->device, + hmc_fpm_misc->fw_scratch_buf0.size, + hmc_fpm_misc->fw_scratch_buf0.va, + hmc_fpm_misc->fw_scratch_buf0.pa); + hmc_fpm_misc->fw_scratch_buf0.va = NULL; + hmc_fpm_misc->fw_scratch_buf0.size = 0; + return -ENOMEM; + } + } } return 0; @@ -4187,6 +4222,8 @@ static int irdma_sc_commit_fpm_val(struct irdma_sc_cqp *cqp, u64 scratch, hdr = FIELD_PREP(IRDMA_CQPSQ_BUFSIZE, IRDMA_COMMIT_FPM_BUF_SIZE) | FIELD_PREP(IRDMA_CQPSQ_OPCODE, IRDMA_CQP_OP_COMMIT_FPM_VAL) | + FIELD_PREP(IRDMA_CQPSQ_CFPM_FW_SCRATCH_BUF_PRESENT, + cqp->dev->hmc_fpm_misc.fw_scratch_buf0.va != NULL) | FIELD_PREP(IRDMA_CQPSQ_WQEVALID, cqp->polarity); dma_wmb(); /* make sure WQE is written before valid bit is set */ @@ -5034,7 +5071,9 @@ static void irdma_set_loc_mem(__le64 *buf) for (offset = 0; offset < IRDMA_COMMIT_FPM_BUF_SIZE; offset += sizeof(__le64)) { - if (offset == IRDMA_PBLE_COMMIT_OFFSET) + if (offset == IRDMA_PBLE_COMMIT_OFFSET || + offset == IRDMA_SCRATCH_BUF0_COMMIT_OFFSET || + offset == IRDMA_SCRATCH_BUF1_COMMIT_OFFSET) continue; get_64bit_val(buf, offset, &temp); if (temp) @@ -5090,6 +5129,8 @@ static int irdma_sc_cfg_iw_fpm(struct irdma_sc_dev *dev, u8 hmc_fn_id) (u64)obj_info[IRDMA_HMC_IW_OOISC].cnt); set_64bit_val(buf, 168, (u64)obj_info[IRDMA_HMC_IW_OOISCFFL].cnt); + set_64bit_val(buf, 192, dev->hmc_fpm_misc.fw_scratch_buf0.pa); + set_64bit_val(buf, 200, dev->hmc_fpm_misc.fw_scratch_buf1.pa); if (dev->hw_attrs.uk_attrs.hw_rev >= IRDMA_GEN_3 && dev->hmc_fpm_misc.loc_mem_pages) irdma_set_loc_mem(buf); diff --git a/drivers/infiniband/hw/irdma/defs.h b/drivers/infiniband/hw/irdma/defs.h index 983b22d7ae233..d6a3152959dde 100644 --- a/drivers/infiniband/hw/irdma/defs.h +++ b/drivers/infiniband/hw/irdma/defs.h @@ -133,6 +133,8 @@ enum irdma_protocol_used { #define MAX_MR_PER_SD 0x8000 #define MAX_MR_SD_PER_FCN 0x80 #define IRDMA_PBLE_COMMIT_OFFSET 112 +#define IRDMA_SCRATCH_BUF0_COMMIT_OFFSET 192 +#define IRDMA_SCRATCH_BUF1_COMMIT_OFFSET 200 #define IRDMA_MAX_QUANTA_PER_WR 8 #define IRDMA_QP_SW_MAX_WQ_QUANTA 32768 @@ -658,6 +660,8 @@ enum irdma_cqp_op_type { #define IRDMA_COMMIT_FPM_QPCNT GENMASK_ULL(20, 0) #define IRDMA_COMMIT_FPM_BASE_S 32 #define IRDMA_CQPSQ_CFPM_HMCFNID GENMASK_ULL(15, 0) +#define IRDMA_CQPSQ_CFPM_FW_SCRATCH_BUF_PRESENT_S 38 +#define IRDMA_CQPSQ_CFPM_FW_SCRATCH_BUF_PRESENT BIT_ULL(38) #define IRDMA_CQPSQ_FWQE_AECODE GENMASK_ULL(15, 0) #define IRDMA_CQPSQ_FWQE_AESOURCE GENMASK_ULL(19, 16) diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c index f4ae530f56db0..879fb632ee7a9 100644 --- a/drivers/infiniband/hw/irdma/hw.c +++ b/drivers/infiniband/hw/irdma/hw.c @@ -1693,6 +1693,8 @@ static int irdma_hmc_setup(struct irdma_pci_f *rf) static void irdma_del_init_mem(struct irdma_pci_f *rf) { struct irdma_sc_dev *dev = &rf->sc_dev; + struct irdma_dma_mem *fw_scratch_buf0; + struct irdma_dma_mem *fw_scratch_buf1; if (!rf->sc_dev.privileged) irdma_vchnl_req_put_hmc_fcn(&rf->sc_dev); @@ -1713,6 +1715,15 @@ static void irdma_del_init_mem(struct irdma_pci_f *rf) rf->iw_msixtbl = NULL; kfree(rf->hmc_info_mem); rf->hmc_info_mem = NULL; + + fw_scratch_buf0 = &dev->hmc_fpm_misc.fw_scratch_buf0; + fw_scratch_buf1 = &dev->hmc_fpm_misc.fw_scratch_buf1; + if (fw_scratch_buf0->va) + dma_free_coherent(dev->hw->device, fw_scratch_buf0->size, + fw_scratch_buf0->va, fw_scratch_buf0->pa); + if (fw_scratch_buf1->va) + dma_free_coherent(dev->hw->device, fw_scratch_buf1->size, + fw_scratch_buf1->va, fw_scratch_buf1->pa); } /** diff --git a/drivers/infiniband/hw/irdma/type.h b/drivers/infiniband/hw/irdma/type.h index da8c54d1f035a..5557d9338796f 100644 --- a/drivers/infiniband/hw/irdma/type.h +++ b/drivers/infiniband/hw/irdma/type.h @@ -622,6 +622,8 @@ struct irdma_hmc_fpm_misc { u32 timer_bucket; u32 rrf_block_size; u32 ooiscf_block_size; + struct irdma_dma_mem fw_scratch_buf0; + struct irdma_dma_mem fw_scratch_buf1; }; #define IRDMA_VCHNL_MAX_MSG_SIZE 512 diff --git a/drivers/infiniband/hw/irdma/user.h b/drivers/infiniband/hw/irdma/user.h index 9eb7fd0b1cbf9..008af1acc9288 100644 --- a/drivers/infiniband/hw/irdma/user.h +++ b/drivers/infiniband/hw/irdma/user.h @@ -159,8 +159,8 @@ enum irdma_device_caps_const { IRDMA_CEQE_SIZE = 1, IRDMA_CQP_CTX_SIZE = 8, IRDMA_SHADOW_AREA_SIZE = 8, - IRDMA_QUERY_FPM_BUF_SIZE = 192, - IRDMA_COMMIT_FPM_BUF_SIZE = 192, + IRDMA_QUERY_FPM_BUF_SIZE = 200, + IRDMA_COMMIT_FPM_BUF_SIZE = 208, IRDMA_GATHER_STATS_BUF_SIZE = 1024, IRDMA_MIN_IW_QP_ID = 0, IRDMA_MAX_IW_QP_ID = 262143, From patchwork Fri Aug 28 20:31:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294264 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnH5tpNz1xpT for ; Sat, 29 Aug 2026 06:32:18 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FB-0002K2-AX; Fri, 28 Aug 2026 20:32:09 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03F7-0002Ii-19 for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:05 +0000 Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id E7CF03F2DD for ; Fri, 28 Aug 2026 20:32:04 +0000 (UTC) Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-93917f4ccb4so92973685a.0 for ; Fri, 28 Aug 2026 13:32:04 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949124; x=1788553924; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=c+TTdhLH16O1H9XxfWRYAOT05KNsIAvZ8miu2H4j1a0=; b=MWL+Yqwn77kBCDfisPgjs0RyPzirCn2egzenvtOyRKYKCxkOsy3Ywa6Q7zS5eCZ/j5 hYIIETHljJ5EWn9Yf7pc0Lfy4ItBzpoKVq3wuslIFFF93/owgwcXRDWHNlPSAHvwnJlF 7jD3zvS/fIMqJgOtVZt89zm7N1/cvpUMdwPrTxD6xB/gwk/ZziEr6HtrTEPD1RoBMzkr 9R1cWuNAjjr4o2Pka9ol79HlLSIPlvgRRTIysNHKO/AaqybKeZ/Vhi+12isugK5vds+m qYlEG2+uDDHTRV+u6aNZ4Ig63L7hFPC2xdS3e9qFS5HSRNP7nyTAgzu1jzFm3OFJu3ql MzRg== X-Gm-Message-State: AFuF++kvc5wfLSdsBV9t7W3vlDrAYqWbnpAyXKm7uebkL/8lI4Es3Lft 6ftaQX68ZEUOQnhIgowNDyGKr4mO9UR3KSb6pw3FcJ925bTFn5H4UKVjiRcvGP0+IaAiFXCSSnn Du1rcDatAxAg9m2NvEgXU2g4yYCMaBNQHJdE61G+QZQzHTgN4cvxTdNAYEEWjxBkJ4XeF7a1Mkf AdCTxn4feDbwENfg== X-Gm-Gg: AR+sD12FcXcRGQjeu5FeLxE4x+nTKuKjyGOIPh2sa2pfESjyfcF+QkjwLztFPxfuD6b D3GRrIXkIxc5+XMOatXiDoXgm17aIVh79i6tjwir30w0j+2iNeqxrE9bbbeXvNBr/+VixI1tmNs uaQUTyXWIhYTPo9yMTQkUwZ3CcMIvZ9xCxiF3vhebqXfU0porxK1tTpcSL1Rpyin4lL1I6wqdJj JuenKZEs2kD1j74JdvzS4HsDU7r2ZT88ssHKTHVAh3MfBjoJWOERcpL7+2rhZxzTXrb77kEUPao +t6RTQs289E+22sJ9ymHubfRSgBqtCEurNjg+AWy1yTAZQGyxfu3ZI7PjLZJtp8PqQJCmkrJqxp ID0nJIQ== X-Received: by 2002:a05:620a:240b:10b0:937:260a:bcd7 with SMTP id af79cd13be357-939137b8c57mr896661185a.8.1787949123824; Fri, 28 Aug 2026 13:32:03 -0700 (PDT) X-Received: by 2002:a05:620a:240b:10b0:937:260a:bcd7 with SMTP id af79cd13be357-939137b8c57mr896654185a.8.1787949123382; Fri, 28 Aug 2026 13:32:03 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id af79cd13be357-939173a735asm219608885a.28.2026.08.28.13.32.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:02 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 2/9] RDMA/irdma: Add support for GEN4 hardware Date: Fri, 28 Aug 2026 16:31:48 -0400 Message-ID: <20260828203155.75778-3-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 GEN4 hardware is similar to GEN3 and requires only a few special cases. Signed-off-by: Jacob Moroni Signed-off-by: Tatyana Nikolova Signed-off-by: Leon Romanovsky (cherry picked from commit f3cf74933c9ca62a46e51c69412c93c9df816b4b) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/ctrl.c | 1 + drivers/infiniband/hw/irdma/hw.c | 14 ++++++++++---- drivers/infiniband/hw/irdma/ig3rdma_hw.c | 1 - drivers/infiniband/hw/irdma/irdma.h | 1 + 4 files changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/irdma/ctrl.c b/drivers/infiniband/hw/irdma/ctrl.c index 13820f1a48a40..335ae3c82e173 100644 --- a/drivers/infiniband/hw/irdma/ctrl.c +++ b/drivers/infiniband/hw/irdma/ctrl.c @@ -6465,6 +6465,7 @@ static inline void irdma_sc_init_hw(struct irdma_sc_dev *dev) icrdma_init_hw(dev); break; case IRDMA_GEN_3: + case IRDMA_GEN_4: ig3rdma_init_hw(dev); break; } diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c index 879fb632ee7a9..05e813ba30553 100644 --- a/drivers/infiniband/hw/irdma/hw.c +++ b/drivers/infiniband/hw/irdma/hw.c @@ -1082,6 +1082,7 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) cqp_init_info.hw_maj_ver = IRDMA_CQPHC_HW_MAJVER_GEN_2; break; case IRDMA_GEN_3: + case IRDMA_GEN_4: cqp_init_info.hw_maj_ver = IRDMA_CQPHC_HW_MAJVER_GEN_3; cqp_init_info.ts_override = 1; break; @@ -1508,7 +1509,7 @@ static int irdma_create_aeq(struct irdma_pci_f *rf) hmc_info->hmc_obj[IRDMA_HMC_IW_CQ].cnt; aeq_size = min(aeq_size, dev->hw_attrs.max_hw_aeq_size); /* GEN_3 does not support virtual AEQ. Cap at max Kernel alloc size */ - if (rf->rdma_ver == IRDMA_GEN_3) + if (rf->rdma_ver >= IRDMA_GEN_3) aeq_size = min(aeq_size, (u32)((PAGE_SIZE << MAX_PAGE_ORDER) / sizeof(struct irdma_sc_aeqe))); aeq->mem.size = ALIGN(sizeof(struct irdma_sc_aeqe) * aeq_size, @@ -1518,7 +1519,7 @@ static int irdma_create_aeq(struct irdma_pci_f *rf) GFP_KERNEL | __GFP_NOWARN); if (aeq->mem.va) goto skip_virt_aeq; - else if (rf->rdma_ver == IRDMA_GEN_3) + else if (rf->rdma_ver >= IRDMA_GEN_3) return -ENOMEM; /* physically mapped aeq failed. setup virtual aeq */ @@ -2192,8 +2193,13 @@ u32 irdma_initialize_hw_rsrc(struct irdma_pci_f *rf) set_bit(2, rf->allocated_pds); INIT_LIST_HEAD(&rf->mc_qht_list.list); - /* stag index mask has a minimum of 14 bits */ - mrdrvbits = 24 - max(get_count_order(rf->max_mr), 14); + + if (rf->rdma_ver >= IRDMA_GEN_4) + mrdrvbits = 24 - max(get_count_order(rf->max_mr), 16); + else + /* stag index mask has a minimum of 14 bits */ + mrdrvbits = 24 - max(get_count_order(rf->max_mr), 14); + rf->mr_stagmask = ~(((1 << mrdrvbits) - 1) << (32 - mrdrvbits)); return 0; diff --git a/drivers/infiniband/hw/irdma/ig3rdma_hw.c b/drivers/infiniband/hw/irdma/ig3rdma_hw.c index 2e8bb475e22a9..f0361675c2de1 100644 --- a/drivers/infiniband/hw/irdma/ig3rdma_hw.c +++ b/drivers/infiniband/hw/irdma/ig3rdma_hw.c @@ -113,7 +113,6 @@ void ig3rdma_init_hw(struct irdma_sc_dev *dev) dev->irq_ops = &ig3rdma_irq_ops; dev->hw_stats_map = ig3rdma_hw_stat_map; - dev->hw_attrs.uk_attrs.hw_rev = IRDMA_GEN_3; dev->hw_attrs.uk_attrs.max_hw_wq_frags = IG3RDMA_MAX_WQ_FRAGMENT_COUNT; dev->hw_attrs.uk_attrs.max_hw_read_sges = IG3RDMA_MAX_SGE_RD; dev->hw_attrs.uk_attrs.max_hw_sq_chunk = IRDMA_MAX_QUANTA_PER_WR; diff --git a/drivers/infiniband/hw/irdma/irdma.h b/drivers/infiniband/hw/irdma/irdma.h index ff938a01d70c4..b5ce515f4ee83 100644 --- a/drivers/infiniband/hw/irdma/irdma.h +++ b/drivers/infiniband/hw/irdma/irdma.h @@ -119,6 +119,7 @@ enum irdma_vers { IRDMA_GEN_1, IRDMA_GEN_2, IRDMA_GEN_3, + IRDMA_GEN_4, IRDMA_GEN_NEXT, IRDMA_GEN_MAX = IRDMA_GEN_NEXT-1 }; From patchwork Fri Aug 28 20:31:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294265 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnH5xS6z1xyc for ; Sat, 29 Aug 2026 06:32:18 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FC-0002Ky-3g; Fri, 28 Aug 2026 20:32:10 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FA-0002Jl-DH for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:08 +0000 Received: from mail-qk1-f197.google.com (mail-qk1-f197.google.com [209.85.222.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 03AB33F2DD for ; Fri, 28 Aug 2026 20:32:08 +0000 (UTC) Received: by mail-qk1-f197.google.com with SMTP id af79cd13be357-9377829a759so130933885a.0 for ; Fri, 28 Aug 2026 13:32:07 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949127; x=1788553927; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=nrpNX61aYTGfOAxGvFTdEioX93QjlYZtKotnrKWU6gA=; b=SAz1tSIcWLnl/tPc6AwAGpMTNa5NIxAxpNtWLfCNwaD+JStBhYt+tHZgo22fyczd7W tugvWlXuMv+puw59FetmY/vseG5UV1F+2EOw9Jpd7hxaSblRhnGaU6eW7rjihep4hcRu bHC6RFtVs2vvCY/29emsvb76TK7AljxwA4voFyNZSqArDT7q2PyICaWqlwDttivolP3V 6Hb7/GYfj/tT5VhUHNi7J+oHNAY4DOoatUgBNV2HzNbCSyRSPmKKozACEIJ8Ugp1OP5c nVWC0SiXxXTWulhO1w5zhPG7b1TiMrk1/gtc4SYO4oG3/yMXFaYbq6GsrufZVGda38wD yRQQ== X-Gm-Message-State: AFuF++mqKTQ0WPo5IF88CUUBHU0fUbZAe5JExLAwOt+rhzgUSDTOA7RG p93JLWn7WAMPjDnRAqX5oTfvYLKzLNojzxduV1//4Ofl3GAQe0HBI8f49QA21813ZcFO3FrCccW Om96d6+y9yB913lWKQADcSSqw5wRPMv66Gfc+wvv8MTzkQnVth/eoo3Xy9pbhhdGOuFr0ntJNLC ABcK28iWd2vfoBSA== X-Gm-Gg: AR+sD11Fg9ahbGAIsajMtsSr/DTN/8+y54YiU1fTQye1MicmCbi3QsPI84u8iFGEMfr qoIkclaotRGaT9Wa67Ru3lLstV4IlJEWKoCTuK7cOZExJ3JwKKPEgdw1dejRE4uRZXGzNc2TBVE kE5UsznEAtYXdX7GmU7qIYd9XsjnS7zw8Ka+zTel5dxtTr8LZib+OmNGxscgp34esjqLEvnUvnw 96rjE1bywU/iE+QzPNEyZQ1n1yM2pffH38bGGGYmNbDCQSyWwJca5dMVUTP6Uv9Mn+RVfufHOar lnwJleL8yUVp5HibvkeE9XIR82OgyN943XR3lV+TN51Klcb8s4aQh9sD31th5DEexVVe04wbdUD cPj2vQA== X-Received: by 2002:a05:620a:f8d:b0:939:7fc:cec3 with SMTP id af79cd13be357-9391395e55bmr944849885a.41.1787949126654; Fri, 28 Aug 2026 13:32:06 -0700 (PDT) X-Received: by 2002:a05:620a:f8d:b0:939:7fc:cec3 with SMTP id af79cd13be357-9391395e55bmr944842085a.41.1787949126078; Fri, 28 Aug 2026 13:32:06 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id af79cd13be357-93919801088sm182988885a.31.2026.08.28.13.32.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:05 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 3/9] RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs Date: Fri, 28 Aug 2026 16:31:49 -0400 Message-ID: <20260828203155.75778-4-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values. When irdma_setup_pbles is called with lvl==0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case. In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://patch.msgid.link/r/20260512183852.614045-1-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe (cherry picked from commit 5ebb3ed757be3e04cf803026004aa0beaeb13e9b) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/verbs.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index cbf76d9999fb4..a1a63798bcf9d 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -2779,10 +2779,11 @@ static inline u64 *irdma_next_pbl_addr(u64 *pbl, struct irdma_pble_info **pinfo, * irdma_copy_user_pgaddrs - copy user page address to pble's os locally * @iwmr: iwmr for IB's user page addresses * @pbl: ple pointer to save 1 level or 0 level pble + * @pbl_len: Max number of PBL entries to populate * @level: indicated level 0, 1 or 2 */ static void irdma_copy_user_pgaddrs(struct irdma_mr *iwmr, u64 *pbl, - enum irdma_pble_level level) + u32 pbl_len, enum irdma_pble_level level) { struct ib_umem *region = iwmr->region; struct irdma_pbl *iwpbl = &iwmr->iwpbl; @@ -2790,7 +2791,9 @@ static void irdma_copy_user_pgaddrs(struct irdma_mr *iwmr, u64 *pbl, struct irdma_pble_info *pinfo; struct ib_block_iter biter; u32 idx = 0; - u32 pbl_cnt = 0; + + if (!pbl_len) + return; pinfo = (level == PBLE_LEVEL_1) ? NULL : palloc->level2.leaf; @@ -2799,7 +2802,7 @@ static void irdma_copy_user_pgaddrs(struct irdma_mr *iwmr, u64 *pbl, rdma_umem_for_each_dma_block(region, &biter, iwmr->page_size) { *pbl = rdma_block_iter_dma_address(&biter); - if (++pbl_cnt == palloc->total_cnt) + if (!--pbl_len) break; pbl = irdma_next_pbl_addr(pbl, &pinfo, &idx); } @@ -2875,6 +2878,7 @@ static int irdma_setup_pbles(struct irdma_pci_f *rf, struct irdma_mr *iwmr, u64 *pbl; int status; enum irdma_pble_level level = PBLE_LEVEL_1; + u32 pbl_len; if (lvl) { status = irdma_get_pble(rf->pble_rsrc, palloc, iwmr->page_cnt, @@ -2882,16 +2886,18 @@ static int irdma_setup_pbles(struct irdma_pci_f *rf, struct irdma_mr *iwmr, if (status) return status; + pbl_len = palloc->total_cnt; iwpbl->pbl_allocated = true; level = palloc->level; pinfo = (level == PBLE_LEVEL_1) ? &palloc->level1 : palloc->level2.leaf; pbl = pinfo->addr; } else { + pbl_len = IRDMA_MAX_SAVED_PHY_PGADDR; pbl = iwmr->pgaddrmem; } - irdma_copy_user_pgaddrs(iwmr, pbl, level); + irdma_copy_user_pgaddrs(iwmr, pbl, pbl_len, level); if (lvl) iwmr->pgaddrmem[0] = *pbl; From patchwork Fri Aug 28 20:31:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294268 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnM0XQ0z1xpT for ; Sat, 29 Aug 2026 06:32:23 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FH-0002R0-AF; Fri, 28 Aug 2026 20:32:15 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FD-0002ME-40 for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:11 +0000 Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id D16683F2DD for ; Fri, 28 Aug 2026 20:32:10 +0000 (UTC) Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-526da7e3c9dso11726241cf.1 for ; Fri, 28 Aug 2026 13:32:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949129; x=1788553929; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=J6ClhK3Y7hcXzad2IYKs/LJOJOlr3oID14tz0tiXhiU=; b=DjpU8prCldGZpiiMAeiGUs9L1ArqizAwPknru/Z8WANwDlB94ApS5KfkVtZRwd/pVP FUOcWDvww9dN3biM0C7VtH3rnmU6gVvy6duR12h2HPW6f1G5odHNELGD5hgldnZtWS/d 7U/vRrgb+4eh2orjEnZv+WYBhh+oXWGSuS0KGEW8Sm4s9jJGR/o86LMJKS8toB1EyC6e qSWWQKBeqeTj5+r3uHF7hHoIlEnr2KNJMrKNzJYUbAWRn2vv8pzjjPUz1SrCsyIlyRh2 jDBgZMSfZ7BXE/Jxtk/G+JnCPVfuP077YALZUNVuXapwTSi7r2htvBsuP/o2I+6MpKeI R1dw== X-Gm-Message-State: AFuF++lI6Gh51uN3087ZcRQdkep1Lq4O6TOohV8mfrDW8Rmk+aznzUZQ QNcVRZqt4oCJaugBJNKdm80AsK14TfzBhJPp6846hozdA3+U9udU3jstkQGMRPP7K+b7R0ec9Fu wXGuTJBsR86+s/eZrTuOUogP0822zcnzculPBrkac9U9vPCZ2VKKb2ScsfCaw+28HbA2yigSUBw nY+TNOZ0KggWQorQ== X-Gm-Gg: AR+sD12MY93Ocs0hi22UiLsgBkkeuoavHBHj1/JZD/s3IBeWstQFY8oGxNvwaNCC/jY 29h6BNW83cClkM5UrTxVxw0iif+OfW34G0xTwralSCN0phsbeqvI3FV1Ej1Jl0w/QYbdiPg3Qpl Ap6aIcJHfBGpTirjCAgsDyauow9lga0DzCQLOzXbcwj3RNm45udBaQZnB3AXIKlY73Yy19GFGCX j1VCixKU+klIdCmqiV3PYDSlUVorvuk2frCMdzIjJH0Rdi2D8idL9gf/BcA95k+1zbcmmhL3vTW in7ya1x91vhSGx9woYI5XYQ4IoDYnHiZrQDd75rXGKvcUSWmwjiRdkqSDU2Vp3kvncOiIKlg+iq 6ggQgLw== X-Received: by 2002:a05:622a:10a:b0:51c:8432:1753 with SMTP id d75a77b69052e-52fb96736b4mr111379111cf.30.1787949129407; Fri, 28 Aug 2026 13:32:09 -0700 (PDT) X-Received: by 2002:a05:622a:10a:b0:51c:8432:1753 with SMTP id d75a77b69052e-52fb96736b4mr111378271cf.30.1787949128836; Fri, 28 Aug 2026 13:32:08 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-52fbe878f4esm20173501cf.31.2026.08.28.13.32.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:08 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 4/9] RDMA/irdma: Fix OOB read during CQ MR registration Date: Fri, 28 Aug 2026 16:31:50 -0400 Message-ID: <20260828203155.75778-5-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev/#/patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating the cqmr->split field which was not being set properly and instead just checks the CQ resize feature flag directly. The cqmr->split field essentially tracks whether IRDMA_FEATURE_CQ_RESIZE is set, but it was not being set until CQ creation time, which is _after_ CQ memory registration (the only other place where it is referenced). As a result, it would always be false during MR registration and would therefore cause irdma_handle_q_mem to populate cqmr->shadow even for GEN_2 HW and beyond: cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; The issue is that for GEN_2 and beyond, req->cq_pages may be exactly equal to iwmr->page_cnt and therefore equal to the size of arr, which would cause an OOB read by one. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://patch.msgid.link/r/20260602214423.1315105-2-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe (cherry picked from commit 4385ddd654d90245eeb83b3cb539670ab5c85ba4) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/verbs.c | 4 ++-- drivers/infiniband/hw/irdma/verbs.h | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index a1a63798bcf9d..6c8666d865a1d 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -2570,7 +2570,6 @@ static int irdma_create_cq(struct ib_cq *ibcq, } cqmr_shadow = &iwpbl_shadow->cq_mr; info.shadow_area_pa = cqmr_shadow->cq_pbl.addr; - cqmr->split = true; } else { info.shadow_area_pa = cqmr->shadow; } @@ -2978,7 +2977,8 @@ static int irdma_handle_q_mem(struct irdma_device *iwdev, case IRDMA_MEMREG_TYPE_CQ: hmc_p = &cqmr->cq_pbl; - if (!cqmr->split) + if (!(iwdev->rf->sc_dev.hw_attrs.uk_attrs.feature_flags & + IRDMA_FEATURE_CQ_RESIZE)) cqmr->shadow = (dma_addr_t)arr[req->cq_pages]; if (lvl) diff --git a/drivers/infiniband/hw/irdma/verbs.h b/drivers/infiniband/hw/irdma/verbs.h index aabbb3442098b..289ebc9b23ca7 100644 --- a/drivers/infiniband/hw/irdma/verbs.h +++ b/drivers/infiniband/hw/irdma/verbs.h @@ -65,7 +65,6 @@ struct irdma_hmc_pble { struct irdma_cq_mr { struct irdma_hmc_pble cq_pbl; dma_addr_t shadow; - bool split; }; struct irdma_srq_mr { From patchwork Fri Aug 28 20:31:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294269 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnM5HnCz1xyc for ; Sat, 29 Aug 2026 06:32:23 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FI-0002TR-Hf; Fri, 28 Aug 2026 20:32:16 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FF-0002OG-K9 for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:13 +0000 Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 5769E3F2DD for ; Fri, 28 Aug 2026 20:32:13 +0000 (UTC) Received: by mail-qk1-f198.google.com with SMTP id af79cd13be357-93494cce712so173839885a.3 for ; Fri, 28 Aug 2026 13:32:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949132; x=1788553932; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=wv0IC627tRTJGuCv6am19L+/9X+T7LWvV3leDRe2fXU=; b=JUFOEhDoVsXgvuhsz2BizKpoQLUf0p0Y8O7962KqjM56Fl3COTXZS8mOr77FuE9HUD gOecz69iSXcKBZH8MxkZPon2LTKxQOmSmYTg4O2IA9ri1zYQwooswm3frCo+2HjEv8+l oQpDJZAKfN0eONHh8RBdXrO/vsRJ0kTd+CCAyk5Nypeza2WqS0DS+flrChSB7sptGByj VcNDCrx0We6fraoy1fMa1AePjXV0D1MGc3T2e8PEWdLKb8fufPPHeLV/pNq9pmaFvNSL O1knr7S1vBvi0Nv+sTIUVe+FXQm7CYLg8Vgwna3cTWjwCT/WobzmxJQfhsHh3kGH/zQ6 rN3g== X-Gm-Message-State: AFuF++lRVsRg/s2awQ/dvJpn8QGJcj1Gz0jMRglKDFi4AfGGjtTAbG2u shch3O/D+pa4rpfW5MNGcypmTwOTFEAjpAvmBYgLKAJSkvPgivZxWScoFHlxOaSR06/QCnqomlS 2xrSN+qkuLKtuQUbN6+Ab2fjL5cmtEcXPrfbfz4+8XEj8Zg26uZe4KnQ9UVgfXRXrA/IAVi153O 2zl89cjC5Oggk1CA== X-Gm-Gg: AR+sD12Fd8zLoRSE3U2XjzZb3YhwJ3jF1unSa8w8O286HoAdcDtJydvDk+AUPBBnJ9l Qf9u9RE9z8CC8K7pTqIsYfropB4LR8yj3aPmr3ejKfb6zyW9/Pkq4Qiu6pmiMtnf15IfjSo4VWh L01XUnvgyJ7i00Xfk6qNt3qiuadvyvIANqGFdBrflVGylYmf9n9yx0oKbJsof4Ah2LqE1OvtWUF 7maAImUzeI7TVN6LjK2pKycX//J3EyjKN97fstF8qy4llD+JRdi97kkM6xbW/b+vChxnYFOu+qP u8ShIERXC8iCxzhioBTfOJbdrb63tlr4nbl0M6rNwUa8aoI91kf+osxNo7hgTYYfoCOZw22QtcC 7v6uLfQ== X-Received: by 2002:a05:620a:2319:10b0:914:bd3f:b6db with SMTP id af79cd13be357-939137cb552mr876109585a.10.1787949132121; Fri, 28 Aug 2026 13:32:12 -0700 (PDT) X-Received: by 2002:a05:620a:2319:10b0:914:bd3f:b6db with SMTP id af79cd13be357-939137cb552mr876102985a.10.1787949131638; Fri, 28 Aug 2026 13:32:11 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90ce4512dcasm23007436d6.34.2026.08.28.13.32.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:11 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 5/9] RDMA/irdma: Initialize iwmr->access during MR registration Date: Fri, 28 Aug 2026 16:31:51 -0400 Message-ID: <20260828203155.75778-6-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 Initialize iwmr->access during initial user mem registration so that it contains a valid value during a subsequent rereg_mr. Otherwise, a rereg_mr that doesn't set IB_MR_REREG_ACCESS (for example, one that only changes the PD) ends up clearing the access flags in HW since iwmr->access is zero-initialized, which is not intended. Fixes: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region") Link: https://patch.msgid.link/r/20260604154104.4035581-1-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe (cherry picked from commit 1521d560b7a1a39e437d37fffd9b55435d329ad1) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/verbs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index 6c8666d865a1d..1caf416a85027 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -3323,6 +3323,7 @@ static int irdma_reg_user_mr_type_mem(struct irdma_mr *iwmr, int access, int err; lvl = iwmr->page_cnt != 1 ? PBLE_LEVEL_1 | PBLE_LEVEL_2 : PBLE_LEVEL_0; + iwmr->access = access; err = irdma_setup_pbles(iwdev->rf, iwmr, lvl); if (err) From patchwork Fri Aug 28 20:31:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294270 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnQ5XQgz1xpT for ; Sat, 29 Aug 2026 06:32:26 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FL-0002ZQ-4w; Fri, 28 Aug 2026 20:32:19 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FJ-0002Ua-7K for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:17 +0000 Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 191213F2DD for ; Fri, 28 Aug 2026 20:32:17 +0000 (UTC) Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-51c1d30035dso10279091cf.2 for ; Fri, 28 Aug 2026 13:32:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949136; x=1788553936; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=PSlohGxzlKAY2G0ozvaKEvKYazBEZ5shSszBUYe1OWc=; b=qUEjK4Kv3k2YA+tN2OCU0aTzBIoJNFWKYR4X3HXedeDL+YyneW8H92EhQcxxkSWB1r FIk/5zLb7+FGV3eXtUtDYf648NLAaWZqRTvcOGoxYXDF3586BKwXmsRznLkyfV1UUctU 8R7boUuTVEVFuLJv0x9/dBYFlR90/QvEhvlLoEoaGIAP2cWnr50BIqP3eIi3ftqVxIXF 4xd0wl7SuG7yZn0J79DUHVAUgyBJKWYTgeHtiKLfJAg9GSSlrNYHP5ZsXUNEb8+LVyTb osZOxtlBzfay7X3g4fg63ig3JhbkNk1lqO8IKr8E3PgBLrrrXzOBnxQzH0h0rDsNxFDa p4gQ== X-Gm-Message-State: AFuF++luIRMTal0unUUS0gKO4E6fmjM1aqGpv3F27hlEYfkEX4K67Y+d m4D/fW6mY+hip/q4zhP1C5Z1V872ZCLWmE863xetIuBpG2T1Dt/X3eenW9W8cnFnj1NjI40vnff okej8JtofMd9UlNGzLJ3XbU/E99FDHl4hsd0rQr4qXrMZYWAeXsm05rjrL4IuJ2nFvIgSkb6eb9 76fB7s7fJgiTyEug== X-Gm-Gg: AR+sD11T0OFN1OcvBPqNnOLI2jUQsoMjj1rrd3R3pcTtU7NpVetVNPydTXoO2IZBRXy LQc2QIbjWU+w8S+NZzfLOful81Lr56GbIwuUnpy1HLRO92BsGRH2GiNkPgl3ONTZIgX/PaRWjBw kINrAbO82DnFGnt7vLjjTFLrTx9n8UiXr7NDxIvV0Ro24FiOpkp/iHBMKnGh7C/me+hYaQAIMsu pgDEYGiWS/RYvZNrxyH12OGP2YevMKrxUELeJublMBqRi7u0ZlgGcVAPriXIEkik/kSbBl84ngY PMTOxbWpa9LCt3j6kYcM8Tg2T7yS/sIcR+sly/mitl5wwJh+akAWgYimWztvyRZfGzu946x9Kz1 YFUJVvA== X-Received: by 2002:a05:622a:5a1b:b0:51c:52a:8e70 with SMTP id d75a77b69052e-52fb93d50f2mr130906441cf.2.1787949135954; Fri, 28 Aug 2026 13:32:15 -0700 (PDT) X-Received: by 2002:a05:622a:5a1b:b0:51c:52a:8e70 with SMTP id d75a77b69052e-52fb93d50f2mr130905671cf.2.1787949135401; Fri, 28 Aug 2026 13:32:15 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-52fbe830e90sm20057101cf.25.2026.08.28.13.32.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:13 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 6/9] RDMA/irdma: Replace waitqueue and flag with completion Date: Fri, 28 Aug 2026 16:31:52 -0400 Message-ID: <20260828203155.75778-7-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 The driver previously used a waitqueue along with an explicit request_done flag, but without proper barriers around request_done. An earlier patch by Gui-Dong Han attempted to fix this by adding the missing memory barriers. Rather than adding the barriers, this patch replaces the waitqueue+flag with a completion, which is designed for this exact purpose. Fixes: 44d9e52977a1 ("RDMA/irdma: Implement device initialization definitions") Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions") Link: https://patch.msgid.link/r/20260616155601.1081448-1-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe (cherry picked from commit d9c8c45e6d2f438a3c8e643ae78b59454fa0fadd) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/hw.c | 7 +++---- drivers/infiniband/hw/irdma/main.h | 3 +-- drivers/infiniband/hw/irdma/utils.c | 12 +++++------- 3 files changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/infiniband/hw/irdma/hw.c b/drivers/infiniband/hw/irdma/hw.c index 05e813ba30553..62e08913beff1 100644 --- a/drivers/infiniband/hw/irdma/hw.c +++ b/drivers/infiniband/hw/irdma/hw.c @@ -235,8 +235,7 @@ static void irdma_complete_cqp_request(struct irdma_cqp *cqp, struct irdma_cqp_request *cqp_request) { if (cqp_request->waiting) { - WRITE_ONCE(cqp_request->request_done, true); - wake_up(&cqp_request->waitq); + complete_all(&cqp_request->comp); } else if (cqp_request->callback_fcn) { cqp_request->callback_fcn(cqp_request); } @@ -1107,9 +1106,9 @@ static int irdma_create_cqp(struct irdma_pci_f *rf) INIT_LIST_HEAD(&cqp->cqp_avail_reqs); INIT_LIST_HEAD(&cqp->cqp_pending_reqs); - /* init the waitqueue of the cqp_requests and add them to the list */ + /* init the completion of the cqp_requests and add them to the list */ for (i = 0; i < sqsize; i++) { - init_waitqueue_head(&cqp->cqp_requests[i].waitq); + init_completion(&cqp->cqp_requests[i].comp); list_add_tail(&cqp->cqp_requests[i].list, &cqp->cqp_avail_reqs); } init_waitqueue_head(&cqp->remove_wq); diff --git a/drivers/infiniband/hw/irdma/main.h b/drivers/infiniband/hw/irdma/main.h index 3d49bd57bae7c..8c17a201c1fd2 100644 --- a/drivers/infiniband/hw/irdma/main.h +++ b/drivers/infiniband/hw/irdma/main.h @@ -161,13 +161,12 @@ struct irdma_cqp_compl_info { struct irdma_cqp_request { struct cqp_cmds_info info; - wait_queue_head_t waitq; + struct completion comp; struct list_head list; refcount_t refcnt; void (*callback_fcn)(struct irdma_cqp_request *cqp_request); void *param; struct irdma_cqp_compl_info compl_info; - bool request_done; /* READ/WRITE_ONCE macros operate on it */ bool waiting:1; bool dynamic:1; bool pending:1; diff --git a/drivers/infiniband/hw/irdma/utils.c b/drivers/infiniband/hw/irdma/utils.c index 495e5daff4b45..8e9e159f19ffe 100644 --- a/drivers/infiniband/hw/irdma/utils.c +++ b/drivers/infiniband/hw/irdma/utils.c @@ -442,7 +442,7 @@ struct irdma_cqp_request *irdma_alloc_and_get_cqp_request(struct irdma_cqp *cqp, if (cqp_request) { cqp_request->dynamic = true; if (wait) - init_waitqueue_head(&cqp_request->waitq); + init_completion(&cqp_request->comp); } } if (!cqp_request) { @@ -480,7 +480,7 @@ void irdma_free_cqp_request(struct irdma_cqp *cqp, if (cqp_request->dynamic) { kfree(cqp_request); } else { - WRITE_ONCE(cqp_request->request_done, false); + reinit_completion(&cqp_request->comp); cqp_request->callback_fcn = NULL; cqp_request->waiting = false; cqp_request->pending = false; @@ -515,8 +515,7 @@ irdma_free_pending_cqp_request(struct irdma_cqp *cqp, { if (cqp_request->waiting) { cqp_request->compl_info.error = true; - WRITE_ONCE(cqp_request->request_done, true); - wake_up(&cqp_request->waitq); + complete_all(&cqp_request->comp); } wait_event_timeout(cqp->remove_wq, refcount_read(&cqp_request->refcnt) == 1, 1000); @@ -609,9 +608,8 @@ static int irdma_wait_event(struct irdma_pci_f *rf, cqp_timeout.compl_cqp_cmds = atomic64_read(&rf->sc_dev.cqp->completed_ops); do { irdma_cqp_ce_handler(rf, &rf->ccq.sc_cq); - if (wait_event_timeout(cqp_request->waitq, - READ_ONCE(cqp_request->request_done), - msecs_to_jiffies(CQP_COMPL_WAIT_TIME_MS))) + if (wait_for_completion_timeout(&cqp_request->comp, + msecs_to_jiffies(CQP_COMPL_WAIT_TIME_MS))) break; if (cqp_request->pending) From patchwork Fri Aug 28 20:31:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294271 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnT70BZz1xpT for ; Sat, 29 Aug 2026 06:32:29 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FP-0002kT-Dq; Fri, 28 Aug 2026 20:32:23 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FL-0002aa-RF for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:19 +0000 Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id A99803F2DD for ; Fri, 28 Aug 2026 20:32:19 +0000 (UTC) Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-90ce21f2cc9so31625056d6.2 for ; Fri, 28 Aug 2026 13:32:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949138; x=1788553938; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=zDE3XIem3Li0qX0TuOTFQXgTE1ewKvrdHLEICWxZz68=; b=lj+WuTdoSdovIZOml9Dwox4urQYIZ4THSwIMfMgvARzLPyxHQuLsUhIxXbcYyL1N2l Cqq/FCZrn6GZ99dteQV8Bmrb17/Y9SEoSF5wbzLE8fz9W5MHkLcZDQDvLeR8dRpUn7wu QhnT3bmv/GHiENLiBdKUP6de2Z0Shh1mi3ri3LDn3CF2kIwYfIwqV7isRLkT77l/a7JA ENKoJCeB42Ct01jGwc4W009BrDYZpPFTeP1qBD0F18Vuxsp5Ray5QjmWOGz96pNTVVff ri1lbaFeuqxLVOrzKk6CXQ822xZT7Un6mMy7oFZjS+YlvHyZHkIOlHZCFIoUXol6RwQD XlJA== X-Gm-Message-State: AFuF++nb/yhVZsVDTU8Vc3tDctDUnuMdwlAnkzVP/FzYhD1CMO826pHw Rq+PYXIPZil+iUxBR8go/v6r0pXQlJI42oUfunuHRMey8TlfRxXpkcycT7MxZdtlmh4KCr/tLzg TRAtOnB8RkjcNfxFPL04FaQrnaeuVMFqS0nXN4v26haoRP1UfqdtpHMZw0O21uDS0W/JCUj3zFs SdL7eS66jEpsE4gA== X-Gm-Gg: AYBFou1yew1irPxRFXrHCqMGsvdyeBK204QjvSXSNObG/dqIucecI1+arsvGBswOy6V f1V7G/DAtO0M2B4IMAsMPUe7F71eN2vfdQ9wyH5NSv/QGk70plbQ+ODhBkGm5Ue8zSl99iaiUWl RknRn4iL0KHF8Xke2YOfy4LZhdUfnREmXBPxxW64jSBO8csPyXR8AtExFs9OufDirn54MzJ8DM3 xvsO8d6IJ61n9nQdljvueEnKAO471SzSJEtEdtv30V8CEbp2Uc5DhJ4X13pvEAtKPsU5crmF5BP eXW2c+n1PBea7ZqxftHGiwPtnRYW/4GB4pbCK72apAOnG64bOasXkeOqSMPvjfxXcLhGGWkVjV9 j5VXSuQ== X-Received: by 2002:a05:6214:e84:b0:90a:3c0e:a686 with SMTP id 6a1803df08f44-90ce0e75afamr117173056d6.8.1787949138456; Fri, 28 Aug 2026 13:32:18 -0700 (PDT) X-Received: by 2002:a05:6214:e84:b0:90a:3c0e:a686 with SMTP id 6a1803df08f44-90ce0e75afamr117172396d6.8.1787949138016; Fri, 28 Aug 2026 13:32:18 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90ce4478462sm23404496d6.21.2026.08.28.13.32.17 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:17 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 7/9] RDMA/irdma: Remove redundant legacy_mode checks Date: Fri, 28 Aug 2026 16:31:53 -0400 Message-ID: <20260828203155.75778-8-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 The driver has the following invariants: 1. legacy_mode is only allowed on GEN_1 hardware (enforced in irdma_alloc_ucontext). 2. GEN_1 hardware does not set IRDMA_FEATURE_CQ_RESIZE or IRDMA_FEATURE_RTS_AE. These feature flags are only set for GEN_2 and GEN_3 hardware. Therefore, legacy_mode is always false if IRDMA_FEATURE_CQ_RESIZE or IRDMA_FEATURE_RTS_AE is set, so remove the redundant checks. Link: https://patch.msgid.link/r/20260602214423.1315105-1-jmoroni@google.com Signed-off-by: Jacob Moroni Signed-off-by: Jason Gunthorpe (cherry picked from commit ed8621be482bf18dcd217aa024e95758bf9d28f2) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/uk.c | 9 +++------ drivers/infiniband/hw/irdma/user.h | 1 - drivers/infiniband/hw/irdma/verbs.c | 7 +------ 3 files changed, 4 insertions(+), 13 deletions(-) diff --git a/drivers/infiniband/hw/irdma/uk.c b/drivers/infiniband/hw/irdma/uk.c index 4718acf6c6fd0..a34883fe99836 100644 --- a/drivers/infiniband/hw/irdma/uk.c +++ b/drivers/infiniband/hw/irdma/uk.c @@ -1568,15 +1568,12 @@ static const struct irdma_wqe_uk_ops iw_wqe_uk_ops_gen_1 = { * irdma_setup_connection_wqes - setup WQEs necessary to complete * connection. * @qp: hw qp (user and kernel) - * @info: qp initialization info */ -static void irdma_setup_connection_wqes(struct irdma_qp_uk *qp, - struct irdma_qp_uk_init_info *info) +static void irdma_setup_connection_wqes(struct irdma_qp_uk *qp) { u16 move_cnt = 1; - if (!info->legacy_mode && - (qp->uk_attrs->feature_flags & IRDMA_FEATURE_RTS_AE)) + if (qp->uk_attrs->feature_flags & IRDMA_FEATURE_RTS_AE) move_cnt = 3; qp->conn_wqes = move_cnt; @@ -1727,7 +1724,7 @@ int irdma_uk_qp_init(struct irdma_qp_uk *qp, struct irdma_qp_uk_init_info *info) sq_ring_size = qp->sq_size << info->sq_shift; IRDMA_RING_INIT(qp->sq_ring, sq_ring_size); if (info->first_sq_wq) { - irdma_setup_connection_wqes(qp, info); + irdma_setup_connection_wqes(qp); qp->swqe_polarity = 1; qp->first_sq_wq = true; } else { diff --git a/drivers/infiniband/hw/irdma/user.h b/drivers/infiniband/hw/irdma/user.h index 008af1acc9288..4dd3776a4cddb 100644 --- a/drivers/infiniband/hw/irdma/user.h +++ b/drivers/infiniband/hw/irdma/user.h @@ -563,7 +563,6 @@ struct irdma_qp_uk_init_info { u8 sq_shift; u8 rq_shift; int abi_ver; - bool legacy_mode; struct irdma_srq_uk *srq_uk; }; diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index 1caf416a85027..a03724512b37a 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -632,7 +632,6 @@ static int irdma_setup_umode_qp(struct ib_udata *udata, iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx; iwqp->user_mode = 1; if (req.user_wqe_bufs) { - info->qp_uk_init_info.legacy_mode = ucontext->legacy_mode; spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags); iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs, &ucontext->qp_reg_mem_list); @@ -2072,10 +2071,6 @@ static int irdma_resize_cq(struct ib_cq *ibcq, int entries, rdma_udata_to_drv_context(udata, struct irdma_ucontext, ibucontext); - /* CQ resize not supported with legacy GEN_1 libi40iw */ - if (ucontext->legacy_mode) - return -EOPNOTSUPP; - if (ib_copy_from_udata(&req, udata, min(sizeof(req), udata->inlen))) return -EINVAL; @@ -2557,7 +2552,7 @@ static int irdma_create_cq(struct ib_cq *ibcq, cqmr = &iwpbl->cq_mr; if (rf->sc_dev.hw_attrs.uk_attrs.feature_flags & - IRDMA_FEATURE_CQ_RESIZE && !ucontext->legacy_mode) { + IRDMA_FEATURE_CQ_RESIZE) { spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags); iwpbl_shadow = irdma_get_pbl( (unsigned long)req.user_shadow_area, From patchwork Fri Aug 28 20:31:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294272 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnW5QCmz1xpT for ; Sat, 29 Aug 2026 06:32:31 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FR-0002qI-OT; Fri, 28 Aug 2026 20:32:25 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FO-0002iZ-Mk for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:22 +0000 Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 6EA923FE5E for ; Fri, 28 Aug 2026 20:32:22 +0000 (UTC) Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-93494cce712so173855785a.3 for ; Fri, 28 Aug 2026 13:32:22 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949141; x=1788553941; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=fgt5w2cZy+e/9NfaA1oAmk6GPn1sjElwS5CzC7yu1d8=; b=ROk+Qme3FY7XxxfQjRtt9V37T6rsB5e5R7uqmWinzKSd8xv6qRiss3hv1lFxfNeIrN 1dZnZ1b1WYFKnQkmnW5XY+qJomMasgScZbhvoKEpG4uNZTWL2jQn0PkCFGQB65lvk3Yh uZtRov8P0Rz5CakfI45USiFAfHLmimf8gr/Eo4fUaXebEyND46Cp37SBLEfyiQ5Yg4SV onMlovkjFKCPZrjGy9F0GnnmSyCVCdQhj7+GfNvBs5VZcDpYVXEBvqZfyO0nP6fcQdRh DSaeKMUa0Eq+5sMlkL9ki+XV7i+5AMQ1yLe/Fq/UrSGqJRsR3h+jo/Ax+FWsY1Pj8VdH 1J6Q== X-Gm-Message-State: AFuF++k6Ce1wZirsWiqxcYKJYu+1mWxKi0JCn8VNJy01RiXsIbgu2Zdi X5t9O1Fyj3wjRu0ShpdKr4X/Z3MW/bYeeD7jfIn6NGk+bQkc7u4j9Vl4p4xCbp/ikqCibt2pNpq 8px2yd4qzkpT+8fryaPsuqZ996NePnvb5S7DWsy8/Hk8sPrVgmL6tQE6eCE3bzb3qoNdDkpIlZD WRDXXU9p7zXCq6UQ== X-Gm-Gg: AR+sD12QzLWHoF1pMB/nJtwdN2la2oUQDx5G3B0OULI7PesqZ9diw41qr/IP+y8OuaE 08Fx+pRUFO0CZimqYQjCjjihac2t00ioSZcMwPmXdZaXSFFWttBNEX+dSO1zAa0WRY0Qah0WtOy IrRDLPUbBKbF+XQyaDnny49zmfyIwXifFqhjWxBMKRdN0rDzPTWo54b/3rJV73E1FYdp5qE4F5P sQuGpdtP7zzoZ88KUebv4E9D9jgM11oE9TUmc8bknOkSe3u2DTUhAy1ZCoocg4NKLdN4Q1Niq6V fqYsPwDRdTlMx7b8+kyj3EMDus9ISoC9gsqz75nvQYBBK80dXtLuxfgDJ7xe+pfew6Ibk3e/sga Mp7fnng== X-Received: by 2002:a05:620a:3721:b0:92e:6c8a:2a15 with SMTP id af79cd13be357-93913794006mr974668585a.1.1787949141188; Fri, 28 Aug 2026 13:32:21 -0700 (PDT) X-Received: by 2002:a05:620a:3721:b0:92e:6c8a:2a15 with SMTP id af79cd13be357-93913794006mr974661585a.1.1787949140648; Fri, 28 Aug 2026 13:32:20 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id af79cd13be357-9391703a918sm221922085a.12.2026.08.28.13.32.20 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:20 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 8/9] RDMA/irdma: Prevent user-triggered null deref on QP create Date: Fri, 28 Aug 2026 16:31:54 -0400 Message-ID: <20260828203155.75778-9-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jacob Moroni BugLink: https://bugs.launchpad.net/bugs/2165062 Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jacob Moroni Signed-off-by: Leon Romanovsky (cherry picked from commit d32fe5bb418832adef25e70f9d6ed50140b9f05f) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/verbs.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index a03724512b37a..097480c2a7c35 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -631,17 +631,16 @@ static int irdma_setup_umode_qp(struct ib_udata *udata, iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx; iwqp->user_mode = 1; - if (req.user_wqe_bufs) { - spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags); - iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs, - &ucontext->qp_reg_mem_list); - spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags); - if (!iwqp->iwpbl) { - ret = -ENODATA; - ibdev_dbg(&iwdev->ibdev, "VERBS: no pbl info\n"); - return ret; - } + spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags); + iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs, + &ucontext->qp_reg_mem_list); + spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags); + + if (!iwqp->iwpbl) { + ret = -ENODATA; + ibdev_dbg(&iwdev->ibdev, "VERBS: no pbl info\n"); + return ret; } if (!ucontext->use_raw_attrs) { From patchwork Fri Aug 28 20:31:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Whitfield X-Patchwork-Id: 2294273 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hWqnY4R4Lz1xpT for ; Sat, 29 Aug 2026 06:32:33 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x03FT-0002ss-0g; Fri, 28 Aug 2026 20:32:27 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x03FR-0002nw-BF for kernel-team@lists.ubuntu.com; Fri, 28 Aug 2026 20:32:25 +0000 Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 2C2DD3FE5E for ; Fri, 28 Aug 2026 20:32:25 +0000 (UTC) Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-52dcf1bb6e9so31761121cf.1 for ; Fri, 28 Aug 2026 13:32:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787949144; x=1788553944; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=SvEM++mWnqhgd6off3e/101qi7vLZBV33capRNoSqag=; b=GBiCmtzsC54nsB8kmknIRntsyiW7fSzIWycX81EX2i5v4lk7z23UmM0Pj5eoQLz/oa Ijr/sNwxWE53Az440mSJNEgLHZQTl/RNpxnjXqKGaTSBkIBhKPICFHUYjzPqC08Y2rwi OOphsogY1Y6v4QtQ0ZxOvxLKPYImobfQMXaGU5Z8OFpA+DxEMRCMcjMmeLHfShcSLxCn pNqz19rN//MVL3uq8777Nm/KBA30LlQ8ACyjo7UdiHDNQaYiXIeWqums/XktW2V5fj1G Ep2BC5d7QKvet7uYyYD56SUTxpUyPYxlGQzZGY6DN3rn4hIWA7QRu4OHyCVJNTSVr7MP suyA== X-Gm-Message-State: AFuF++lvigCYx4yajN93K+ynXHR/l3EmFAdjh4+Aa0d7eVqpN9GRDggI 7V3a/U0P3n53P3XoXtibA4rH0QyBl+BCi4cUfSdIUiOLcvA+TcQ6DEaLaMaQonPHBtob3Det18V Izyo6ovtBomEj7GnmnNPC/U23U/acV1phYgrukxMBnQAEer5UY4XwilaJhsSwXvQuoOeFaJiiMv h/Z7RDmidiywg2iw== X-Gm-Gg: AR+sD10nO3y2eA+EsyZpc9k4IAqr8ip+2NUzOrZrxuk4hoCdRtxn4zAYA31pJcHOfzW ZRlWN4uheSshcOC5VE5gqgGKjUuPf10rnYhvOoJjP367SCrrqHEut7T7+lWzouYjBUtbdYkVkxQ nxwZHmXr8ByTU7AC8LRZFsDL/nqWoIkto5uSk+Z9HHB6WnpxXEg3HCvY+m21cLk0dg3F3WYwJLJ yKlB4f/95LK0bGToi8c1Idb8qlc8UWQ8QSDfDTBP+0baaRyQe2NJvhnPmDbQHqiMBYNX+lKr03S Iypyds2TQ0zilvF8C7S+FcYSpXy6m5zHKaOUklxZnloNMo3DDH/KkrSPuwei9dqPM1u0r0R/RzH 7dtWiaw== X-Received: by 2002:a05:622a:120a:b0:51b:9873:e37b with SMTP id d75a77b69052e-52ff4cd09bfmr35127341cf.9.1787949144050; Fri, 28 Aug 2026 13:32:24 -0700 (PDT) X-Received: by 2002:a05:622a:120a:b0:51b:9873:e37b with SMTP id d75a77b69052e-52ff4cd09bfmr35126611cf.9.1787949143357; Fri, 28 Aug 2026 13:32:23 -0700 (PDT) Received: from localhost ([208.89.33.89]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-52fbe8511cfsm19861251cf.29.2026.08.28.13.32.22 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 28 Aug 2026 13:32:22 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R:linux-gcp][PATCH 9/9] RDMA/irdma: Prevent overflows in memory contiguity checks Date: Fri, 28 Aug 2026 16:31:55 -0400 Message-ID: <20260828203155.75778-10-ian.whitfield@canonical.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260828203155.75778-1-ian.whitfield@canonical.com> References: <20260828203155.75778-1-ian.whitfield@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Ian Whitfield via kernel-team From: Ian Whitfield Reply-To: Ian Whitfield Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Aleksandrova Alyona BugLink: https://bugs.launchpad.net/bugs/2165062 irdma_check_mem_contiguous() and irdma_check_mr_contiguous() verify that PBL entries describe physically contiguous memory ranges. Both functions calculate byte offsets using 32-bit operands. For example, with 4 KiB pages, pg_size * pg_idx overflows 32-bit arithmetic when pg_idx reaches 1048576. In the level-2 check, PBLE_PER_PAGE is 512, so i * pg_size * PBLE_PER_PAGE overflows when i reaches 2048. These values are reachable in the driver. For MRs, palloc->total_cnt comes from iwmr->page_cnt, which is calculated by ib_umem_num_dma_blocks(). The MR size is limited by IRDMA_MAX_MR_SIZE, so a 4 GiB MR with 4 KiB pages can reach page_cnt of 1048576. PBLE resources do not exclude this value either: for gen3, the limit is based on avail_sds * MAX_PBLE_PER_SD, and MAX_PBLE_PER_SD is 0x40000, so 4 SDs are enough for 1048576 PBLEs. Cast one operand to u64 before the multiplications so that the offset calculations are performed in 64-bit arithmetic. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Aleksandrova Alyona Link: https://patch.msgid.link/20260624144846.61242-1-aga@itb.spb.ru Signed-off-by: Leon Romanovsky (cherry picked from commit 3cda0dfe8c651dcbb9e38977905d3d3b1750c4ab) Signed-off-by: Ian Whitfield --- drivers/infiniband/hw/irdma/verbs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index 097480c2a7c35..95f968dd527ca 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -2813,7 +2813,7 @@ static bool irdma_check_mem_contiguous(u64 *arr, u32 npages, u32 pg_size) u32 pg_idx; for (pg_idx = 0; pg_idx < npages; pg_idx++) { - if ((*arr + (pg_size * pg_idx)) != arr[pg_idx]) + if ((*arr + ((u64)pg_size * pg_idx)) != arr[pg_idx]) return false; } @@ -2846,7 +2846,7 @@ static bool irdma_check_mr_contiguous(struct irdma_pble_alloc *palloc, for (i = 0; i < lvl2->leaf_cnt; i++, leaf++) { arr = leaf->addr; - if ((*start_addr + (i * pg_size * PBLE_PER_PAGE)) != *arr) + if ((*start_addr + ((u64)i * pg_size * PBLE_PER_PAGE)) != *arr) return false; ret = irdma_check_mem_contiguous(arr, leaf->cnt, pg_size); if (!ret)