[PATCH rdma-next 0/4] RDMA: use kmalloc() for remaining scratch buffers

[PATCH rdma-next 0/4] RDMA: use kmalloc() for remaining scratch buffers

[Leon Romanovsky]

The series [PATCH v2 0/5] RDMA, IB: replace __get_free_pages() with
kmalloc() [1] replaced direct page allocator use in RDMA buffers that
have no page-specific requirements. Continue that cleanup for the remaining
scratch buffers in cxgb4, mlx4, usnic and mlx5.

Use kmalloc() or kzalloc() to retain the existing physically contiguous
storage and alignment while avoiding casts and allowing kfree() to derive
the allocation size. The mlx5 patch converts every allocation tier in the
shared UMR buffer allocator so its cleanup path does not mix allocator
families.

Allocations in qedr, cxgb4 and bnxt_re that back userspace mappings are
intentionally unchanged. Those buffers are passed to vm_insert_page() or
io_remap_pfn_range() and must remain individual page allocations rather
than slab pages.

[1] https://lore.kernel.org/all/20260713-b4-rdma-v2-0-65d2a1a5180c@kernel.org/

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
Leon Romanovsky (4):
      RDMA/cxgb4: use kmalloc() for the PBL address array
      RDMA/mlx4: use kzalloc() for the fast registration page list
      RDMA/usnic: use kmalloc() for the page pointer array
      RDMA/mlx5: use kmalloc() for UMR translation buffers

 drivers/infiniband/hw/cxgb4/mem.c        |  4 ++--
 drivers/infiniband/hw/mlx4/mr.c          |  6 +++---
 drivers/infiniband/hw/mlx5/main.c        |  8 ++++----
 drivers/infiniband/hw/mlx5/umr.c         | 11 +++++------
 drivers/infiniband/hw/usnic/usnic_uiom.c |  4 ++--
 5 files changed, 16 insertions(+), 17 deletions(-)
---
base-commit: e952e079d226209a132110acc1de96a099701292
change-id: 20260715-get_pages-to-kmalloc-fff6f623114e

Best regards,
--  
Leon Romanovsky <leonro@nvidia.com>

[PATCH rdma-next 1/4] RDMA/cxgb4: use kmalloc() for the PBL address array

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

c4iw_reg_user_mr() allocates a page-sized temporary array of DMA
addresses while programming a PBL. The array has no page-specific
requirements, so allocate it with kmalloc() and release it with kfree().

This avoids the casts required by the page allocator and lets the free
operation derive the allocation size from the object.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/cxgb4/mem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index cd1b01014198..49498c75f38f 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -541,7 +541,7 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 	if (err)
 		goto err_umem_release;
 
-	pages = (__be64 *) __get_free_page(GFP_KERNEL);
+	pages = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!pages) {
 		err = -ENOMEM;
 		goto err_pbl_free;
@@ -568,7 +568,7 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
 				mhp->wr_waitp);
 
 pbl_done:
-	free_page((unsigned long) pages);
+	kfree(pages);
 	if (err)
 		goto err_pbl_free;
 

-- 
2.55.0

[PATCH rdma-next 2/4] RDMA/mlx4: use kzalloc() for the fast registration page list

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

mlx4_alloc_priv_pages() allocates a zeroed, page-sized buffer for a
DMA-to-device page list. kmalloc() provides the required physical
contiguity, and a PAGE_SIZE allocation retains the alignment needed to
keep the list within one page.

Use kzalloc() for the buffer and kfree() on the error and teardown paths.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/mlx4/mr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 761e2c05dd0f..a6b4abce1bfe 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -313,7 +313,7 @@ mlx4_alloc_priv_pages(struct ib_device *device,
 				    MLX4_MR_PAGES_ALIGN);
 
 	/* Prevent cross page boundary allocation. */
-	mr->pages = (__be64 *)get_zeroed_page(GFP_KERNEL);
+	mr->pages = kzalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!mr->pages)
 		return -ENOMEM;
 
@@ -328,7 +328,7 @@ mlx4_alloc_priv_pages(struct ib_device *device,
 	return 0;
 
 err:
-	free_page((unsigned long)mr->pages);
+	kfree(mr->pages);
 	return ret;
 }
 
@@ -340,7 +340,7 @@ mlx4_free_priv_pages(struct mlx4_ib_mr *mr)
 
 		dma_unmap_single(device->dev.parent, mr->page_map,
 				 mr->page_map_size, DMA_TO_DEVICE);
-		free_page((unsigned long)mr->pages);
+		kfree(mr->pages);
 		mr->pages = NULL;
 	}
 }

-- 
2.55.0

[PATCH rdma-next 3/4] RDMA/usnic: use kmalloc() for the page pointer array

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

usnic_uiom_get_pages() uses a page-sized array of struct page pointers
as temporary storage for pin_user_pages(). Nothing requires the array to
come directly from the page allocator.

Use kmalloc() for the array and kfree() after the pinning loop.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/usnic/usnic_uiom.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/hw/usnic/usnic_uiom.c b/drivers/infiniband/hw/usnic/usnic_uiom.c
index 691c64a73516..201c35039a74 100644
--- a/drivers/infiniband/hw/usnic/usnic_uiom.c
+++ b/drivers/infiniband/hw/usnic/usnic_uiom.c
@@ -114,7 +114,7 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable,
 
 	INIT_LIST_HEAD(chunk_list);
 
-	page_list = (struct page **) __get_free_page(GFP_KERNEL);
+	page_list = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!page_list)
 		return -ENOMEM;
 
@@ -182,7 +182,7 @@ static int usnic_uiom_get_pages(unsigned long addr, size_t size, int writable,
 		mmgrab(uiomr->owning_mm);
 
 	mmap_read_unlock(mm);
-	free_page((unsigned long) page_list);
+	kfree(page_list);
 	return ret;
 }
 

-- 
2.55.0

[PATCH rdma-next 4/4] RDMA/mlx5: use kmalloc() for UMR translation buffers

[Leon Romanovsky]

From: Leon Romanovsky <leonro@nvidia.com>

mlx5r_umr_alloc_xlt() allocates physically contiguous scratch buffers
that are DMA mapped only in the DMA_TO_DEVICE direction. kmalloc()
provides the required contiguity and alignment for these sizes while
preserving the existing GFP allocation policy.

The emergency translation buffer has the same requirements. Convert all
of these UMR buffers to kmalloc() and release them with kfree(), which no
longer requires the caller to supply the allocation order.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/infiniband/hw/mlx5/main.c |  8 ++++----
 drivers/infiniband/hw/mlx5/umr.c  | 11 +++++------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index e8bba5a76d4e..d65ebdef2823 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -5500,13 +5500,13 @@ static int __init mlx5_ib_init(void)
 {
 	int ret;
 
-	xlt_emergency_page = (void *)__get_free_page(GFP_KERNEL);
+	xlt_emergency_page = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!xlt_emergency_page)
 		return -ENOMEM;
 
 	mlx5_ib_event_wq = alloc_ordered_workqueue("mlx5_ib_event_wq", 0);
 	if (!mlx5_ib_event_wq) {
-		free_page((unsigned long)xlt_emergency_page);
+		kfree(xlt_emergency_page);
 		return -ENOMEM;
 	}
 
@@ -5540,7 +5540,7 @@ static int __init mlx5_ib_init(void)
 	mlx5_ib_qp_event_cleanup();
 qp_event_err:
 	destroy_workqueue(mlx5_ib_event_wq);
-	free_page((unsigned long)xlt_emergency_page);
+	kfree(xlt_emergency_page);
 	return ret;
 }
 
@@ -5553,7 +5553,7 @@ static void __exit mlx5_ib_cleanup(void)
 
 	mlx5_ib_qp_event_cleanup();
 	destroy_workqueue(mlx5_ib_event_wq);
-	free_page((unsigned long)xlt_emergency_page);
+	kfree(xlt_emergency_page);
 }
 
 module_init(mlx5_ib_init);
diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c
index c595b85b428c..80d0d190b26c 100644
--- a/drivers/infiniband/hw/mlx5/umr.c
+++ b/drivers/infiniband/hw/mlx5/umr.c
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB
 /* Copyright (c) 2022, NVIDIA CORPORATION & AFFILIATES. */
 
+#include <linux/slab.h>
 #include <rdma/ib_umem_odp.h>
 #include <rdma/iter.h>
 #include "mlx5_ib.h"
@@ -517,22 +518,20 @@ static void *mlx5r_umr_alloc_xlt(size_t *nents, size_t ent_size, gfp_t gfp_mask)
 	size = min_t(size_t, ent_size * ALIGN(*nents, xlt_chunk_align),
 		     MLX5_MAX_UMR_CHUNK);
 	*nents = size / ent_size;
-	res = (void *)__get_free_pages(gfp_mask | __GFP_NOWARN,
-				       get_order(size));
+	res = kmalloc(size, gfp_mask | __GFP_NOWARN);
 	if (res)
 		return res;
 
 	if (size > MLX5_SPARE_UMR_CHUNK) {
 		size = MLX5_SPARE_UMR_CHUNK;
 		*nents = size / ent_size;
-		res = (void *)__get_free_pages(gfp_mask | __GFP_NOWARN,
-					       get_order(size));
+		res = kmalloc(size, gfp_mask | __GFP_NOWARN);
 		if (res)
 			return res;
 	}
 
 	*nents = PAGE_SIZE / ent_size;
-	res = (void *)__get_free_page(gfp_mask);
+	res = kmalloc(PAGE_SIZE, gfp_mask);
 	if (res)
 		return res;
 
@@ -548,7 +547,7 @@ static void mlx5r_umr_free_xlt(void *xlt, size_t length)
 		return;
 	}
 
-	free_pages((unsigned long)xlt, get_order(length));
+	kfree(xlt);
 }
 
 static void mlx5r_umr_unmap_free_xlt(struct mlx5_ib_dev *dev, void *xlt,

-- 
2.55.0

Re: [PATCH rdma-next 0/4] RDMA: use kmalloc() for remaining scratch buffers

[Mike Rapoport]

On Wed, Jul 15, 2026 at 02:03:08PM +0300, Leon Romanovsky wrote:
> The series [PATCH v2 0/5] RDMA, IB: replace __get_free_pages() with
> kmalloc() [1] replaced direct page allocator use in RDMA buffers that
> have no page-specific requirements. Continue that cleanup for the remaining
> scratch buffers in cxgb4, mlx4, usnic and mlx5.
> 
> Use kmalloc() or kzalloc() to retain the existing physically contiguous
> storage and alignment while avoiding casts and allowing kfree() to derive
> the allocation size. The mlx5 patch converts every allocation tier in the
> shared UMR buffer allocator so its cleanup path does not mix allocator
> families.
> 
> Allocations in qedr, cxgb4 and bnxt_re that back userspace mappings are
> intentionally unchanged. Those buffers are passed to vm_insert_page() or
> io_remap_pfn_range() and must remain individual page allocations rather
> than slab pages.
> 
> [1] https://lore.kernel.org/all/20260713-b4-rdma-v2-0-65d2a1a5180c@kernel.org/
> 
> Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Thanks, Leon!

-- 
Sincerely yours,
Mike.

Re: [PATCH rdma-next 0/4] RDMA: use kmalloc() for remaining scratch buffers

[Leon Romanovsky]

On Wed, 15 Jul 2026 14:03:08 +0300, Leon Romanovsky wrote:
> The series [PATCH v2 0/5] RDMA, IB: replace __get_free_pages() with
> kmalloc() [1] replaced direct page allocator use in RDMA buffers that
> have no page-specific requirements. Continue that cleanup for the remaining
> scratch buffers in cxgb4, mlx4, usnic and mlx5.
> 
> Use kmalloc() or kzalloc() to retain the existing physically contiguous
> storage and alignment while avoiding casts and allowing kfree() to derive
> the allocation size. The mlx5 patch converts every allocation tier in the
> shared UMR buffer allocator so its cleanup path does not mix allocator
> families.
> 
> [...]

Applied, thanks!

[1/4] RDMA/cxgb4: use kmalloc() for the PBL address array
      https://git.kernel.org/rdma/rdma/c/8d478a35ddd99c
[2/4] RDMA/mlx4: use kzalloc() for the fast registration page list
      https://git.kernel.org/rdma/rdma/c/1c549b0722a81d
[3/4] RDMA/usnic: use kmalloc() for the page pointer array
      https://git.kernel.org/rdma/rdma/c/50ba3490bf1567
[4/4] RDMA/mlx5: use kmalloc() for UMR translation buffers
      https://git.kernel.org/rdma/rdma/c/94db8be4a1772d

Best regards,
-- 
Leon Romanovsky <leonro@nvidia.com>