kernel/git/next/linux-next.git/drivers/infiniband, branch master

Merge branch 'bitmap-for-next' of https://github.com/norov/linux.git

2026-07-10T12:43:20+00:00

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git

2026-07-10T12:00:55+00:00

RDMA/ionic: Remove duplicate IONIC_SPEC_HIGH definition

2026-07-09T09:08:14+00:00

The macro IONIC_SPEC_HIGH is defined twice - remove it. Signed-off-by: Kamal Heib Link: https://patch.msgid.link/20260708210734.641411-1-kheib@redhat.com Signed-off-by: Leon Romanovsky

RDMA/hfi1: Use sysfs_emit() for cpumask show helper

2026-07-07T18:32:25+00:00

sdma_get_cpu_to_sde_map() is used by a sysfs show callback. Use sysfs_emit() and cpumask_pr_args() to emit the mask. This prepares for removing cpumap_print_to_pagebuf(). Signed-off-by: Yury Norov

RDMA/bng_re: return a timeout when firmware responses stall

2026-07-06T08:50:11+00:00

__wait_for_resp() documents that it returns a non-zero error when a firmware command does not complete, and bng_re_rcfw_send_message() already marks the firmware as stalled when the helper returns -ENODEV. However, the helper ignores wait_event_timeout() expiry. If the response slot remains in use after the timeout and after the polled CREQ service attempt, the loop starts another full timeout period and can repeat forever. Return -ENODEV after a timed out wait that still has no response. The existing caller then marks FIRMWARE_STALL_DETECTED and returns -ETIMEDOUT to the command issuer. Fixes: 53c6ee7d7f68 ("RDMA/bng_re: Enable Firmware channel and query device attributes") Signed-off-by: Pengpeng Hou Link: https://patch.msgid.link/20260625003614.27515-1-pengpeng@iscas.ac.cn Reviewed-by: Siva Reddy Kallam Signed-off-by: Leon Romanovsky

RDMA/hfi1: Remove unused non-user-accessible device class

2026-07-06T06:10:33+00:00

The driver defines two device classes: "hfi1" (mode 0600) and "hfi1_user" (mode 0666), selected by a user_accessible parameter to hfi1_cdev_init(). The only caller always passes user_accessible=true, so the "hfi1" class is registered but never used. The 0600 class was originally used by the diagnostics UI char device (hfi1_ui*), but that was removed over 10 years ago in commit 7312f29d8ee5 ("IB/hfi1: Remove UI char device"). The class and the user_accessible parameter were left behind. Remove the unused class and the user_accessible parameter. Now that there's only one class, it might make sense to change its name from "hfi1_user" to just "hfi1", but not knowing whether userspace would mind, keep the name as is. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michal Schmidt Link: https://patch.msgid.link/20260701150510.384858-1-mschmidt@redhat.com Signed-off-by: Leon Romanovsky

RDMA/rxe: Check PDs for memory window binds

2026-07-05T13:45:02+00:00

The IBTA Software Transport Verbs specification requires the QP, Memory Window and Memory Region for a Bind Memory Window operation to belong to the same HCA and protection domain. rxe only checked the QP and MW protection domain for type 2 MWs. Move the QP/MW PD check to the common bind path and also reject binding an MW to an MR from a different PD. Invalid bind requests continue to fail with IB_WC_MW_BIND_ERR. Reviewed-by: Zhu Yanjun Signed-off-by: Zhiwei Zhang <202275009@qq.com> Link: https://patch.msgid.link/tencent_FD4FB25AA4FFA845E63F5AC36CF4A46CDC0A@qq.com Signed-off-by: Leon Romanovsky

RDMA/irdma: Prevent overflows in memory contiguity checks

2026-07-05T11:02:35+00:00

irdma_check_mem_contiguous() and irdma_check_mr_contiguous() verify that PBL entries describe physically contiguous memory ranges. Both functions calculate byte offsets using 32-bit operands. For example, with 4 KiB pages, pg_size * pg_idx overflows 32-bit arithmetic when pg_idx reaches 1048576. In the level-2 check, PBLE_PER_PAGE is 512, so i * pg_size * PBLE_PER_PAGE overflows when i reaches 2048. These values are reachable in the driver. For MRs, palloc->total_cnt comes from iwmr->page_cnt, which is calculated by ib_umem_num_dma_blocks(). The MR size is limited by IRDMA_MAX_MR_SIZE, so a 4 GiB MR with 4 KiB pages can reach page_cnt of 1048576. PBLE resources do not exclude this value either: for gen3, the limit is based on avail_sds * MAX_PBLE_PER_SD, and MAX_PBLE_PER_SD is 0x40000, so 4 SDs are enough for 1048576 PBLEs. Cast one operand to u64 before the multiplications so that the offset calculations are performed in 64-bit arithmetic. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Aleksandrova Alyona Link: https://patch.msgid.link/20260624144846.61242-1-aga@itb.spb.ru Signed-off-by: Leon Romanovsky

RDMA/irdma: Suppress PF reset on HMC error

2026-07-05T10:57:20+00:00

The irdma driver currently issues an unconditional PF reset whenever the HMC Error interrupt (PFINT_OICR bit 26) fires: if (event->reg & IRDMAPFINT_OICR_HMC_ERR_M) { ibdev_err(&iwdev->ibdev, "HMC Error\n"); iwdev->rf->reset = true; } request_reset() issues an IIDC_PFR to ice. In practice a single HMC_ERR can trigger cascading PF resets, IOMMU faults during teardown, and teardown of every RDMA connection on the device. i40e handles the identically-named interrupt by reading PFHMC_ERRORINFO and PFHMC_ERRORDATA and logging them without touching device state; see commit 9c010ee0ea5f ("i40e: Suppress HMC error to Interrupt message level") which removed the reset as "not necessary". This patch mirrors that handling on irdma. With this change, repeated HMC_ERR no longer produces a reset storm and RDMA traffic on the device continues uninterrupted. Signed-off-by: Seyeong Kim Link: https://patch.msgid.link/20260619050044.1807044-1-seyeong.kim@canonical.com Signed-off-by: Leon Romanovsky

RDMA/irdma: Add refcounting to user ring MRs

2026-07-05T10:44:41+00:00

Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Jacob Moroni Link: https://patch.msgid.link/20260618201458.875740-5-jmoroni@google.com Signed-off-by: Leon Romanovsky