kernel/git/stable/linux.git/drivers/infiniband/hw/ionic, branch master

RDMA/ionic: Validate rate limit attribute in modify QP

2026-06-11T11:02:05+00:00

Rate limit transition validation for RC QPs currently relies on the IB core qp_state_table. Add a driver-level helper to validate the rate limit attribute directly during QP modify, ensuring it is only accepted for RC QPs in INIT->RTR, RTR->RTS and RTS->RTS transitions. This makes the driver responsible for rate limit validation and prepares for a follow-up IB core change that delegates IB_QP_RATE_LIMIT and all future non-standard modify attributes handling to individual vendor drivers. Signed-off-by: Maher Sanalla Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260524-packet-pacing-v1-7-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky

RDMA: Update the query_device() op

2026-06-03T18:12:43+00:00

This op hasn't followed the normal pattern of passing NULL for udata when invoked by the kernel. Instead the kernel caller creates a dummy ib_udata on the stack and passes that in. It does not seem to currently be a bug, but this flow should be modernized to use the new API flow and in the process accept NULL as well. Only mlx4 uses an input request structure, have every other driver call ib_is_udata_in_empty() to enforce the lack of request structs. Use ib_respond_empty_udata() in every driver that does not use a response struct. Ensure a check for NULL udata before calling ib_respond_udata() in bnxt_re, efa, and mlx5. Make mlx4 safe to be called with NULL. Link: https://patch.msgid.link/r/2-v1-922fa8e828ba+f7-ib_udata_stack_jgg@nvidia.com Signed-off-by: Jason Gunthorpe

RDMA/umem: Rename ib_umem_get() to ib_umem_get_va()

2026-05-29T23:19:57+00:00

The new umem getter family being introduced in follow-up patches need a fitting name for the central all-source helper that resolves attributes, legacy fillers and a UHW VA fallback. Rename the existing VA-pinning helper ib_umem_get() to ib_umem_get_va() so the name is freed up. The new name is consistent with names of rest of the helpers that are about to be introduced. Link: https://patch.msgid.link/r/20260529134312.2836341-2-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe

Merge tag 'v7.1-rc5' into rdma.git for-next

2026-05-25T16:48:00+00:00

For dependencies in the following patches Resolve conflicts, use the goto labels from the rc tag. * tag 'v7.1-rc5': (1526 commits) Signed-off-by: Jason Gunthorpe

RDMA: Convert drivers using sizeof() to ib_respond_udata()

2026-05-18T08:58:42+00:00

Convert the pattern: ib_copy_to_udata(udata, &resp, sizeof(resp)); Using Coccinelle: @@ identifier resp; expression udata; @@ - ib_copy_to_udata(udata, &resp, sizeof(resp)) + ib_respond_udata(udata, resp) Run another pass with AI to propagate the return code correctly and remove redundant prints. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky

RDMA/ionic: Fix typo in format string

2026-05-02T18:30:48+00:00

Applying the corrupted patch by hand mangled the format string, put the s in the right place. Cc: stable@vger.kernel.org Fixes: 654a27f25530 ("RDMA/ionic: bound node_desc sysfs read with %.64s") Link: https://patch.msgid.link/r/1-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com Reported-by: Brad Spengler Signed-off-by: Jason Gunthorpe

RDMA/ionic: bound node_desc sysfs read with %.64s

2026-04-09T15:47:04+00:00

node_desc[64] in struct ib_device is not guaranteed to be NUL- terminated. The core IB sysfs handler uses "%.64s" for exactly this reason (drivers/infiniband/core/sysfs.c:1307), since node_desc_store() performs a raw memcpy of up to IB_DEVICE_NODE_DESC_MAX bytes with no NUL termination: memcpy(desc.node_desc, buf, min_t(int, count, IB_DEVICE_NODE_DESC_MAX)); If exactly 64 bytes are written via the node_desc sysfs file, the array contains no NUL byte. The ionic hca_type_show() handler uses unbounded "%s" and will read past the end of node_desc into adjacent fields of struct ib_device until it encounters a NUL. ionic supports IB_DEVICE_MODIFY_NODE_DESC, so this is triggerable by userspace. Match the core handler and bound the format specifier. Cc: stable@vger.kernel.org Fixes: 2075bbe8ef03 ("RDMA/ionic: Register device ops for miscellaneous functionality") Link: https://patch.msgid.link/r/CALynFi7NAbhDCt1tdaDbf6TnLvAqbaHa6-Wqf6OkzREbA_PAfg@mail.gmail.com Signed-off-by: Kai Aizen Signed-off-by: Jason Gunthorpe

RDMA: Use ib_copy_validate_udata_in() for implicit full structs

2026-03-31T07:11:01+00:00

All of these cases have git blames that say the entire current struct was introduced at once, so the last member is the right choice. Signed-off-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky

Merge branch 'master' into rdma-next

2026-03-30T17:47:44+00:00

Let's bring v7.0-rc6 to the -next branch, so we can merge the DMA attributes fix [1] without merge conflicts. [1] https://lore.kernel.org/all/20260323-umem-dma-attrs-v1-1-d6890f2e6a1e@nvidia.com Signed-off-by: Leon Romanovsky * master: (1688 commits) Linux 7.0-rc6 ...

Add support for TLP emulation

2026-03-05T10:41:16+00:00

This series adds support for Transaction Layer Packet (TLP) emulation response gateway regions, enabling userspace device emulation software to write TLP responses directly to lower layers without kernel driver involvement. Currently, the mlx5 driver exposes VirtIO emulation access regions via the MLX5_IB_METHOD_VAR_OBJ_ALLOC ioctl. This series extends that ioctl to also support allocating TLP response gateway channels for PCI device emulation use cases. Signed-off-by: Leon Romanovsky