[PATCH] RDMA/rxe: Check PDs for memory window binds

[PATCH] RDMA/rxe: Check PDs for memory window binds

[Zhiwei Zhang]

The IBTA Software Transport Verbs specification requires the QP,
Memory Window and Memory Region for a Bind Memory Window operation
to belong to the same HCA and protection domain.

rxe only checked the QP and MW protection domain for type 2 MWs.
Move the QP/MW PD check to the common bind path and also reject
binding an MW to an MR from a different PD.

Invalid bind requests continue to fail with IB_WC_MW_BIND_ERR.

Signed-off-by: Zhiwei Zhang <202275009@qq.com>
---
 drivers/infiniband/sw/rxe/rxe_mw.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
index 379e65bfcd49..aa9371e4ccd5 100644
--- a/drivers/infiniband/sw/rxe/rxe_mw.c
+++ b/drivers/infiniband/sw/rxe/rxe_mw.c
@@ -72,13 +72,6 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 			return -EINVAL;
 		}
 
-		/* C10-72 */
-		if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) {
-			rxe_dbg_mw(mw,
-				"attempt to bind type 2 MW with qp with different PD\n");
-			return -EINVAL;
-		}
-
 		/* o10-37.2.40 */
 		if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) {
 			rxe_dbg_mw(mw,
@@ -87,10 +80,21 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 		}
 	}
 
-	/* remaining checks only apply to a nonzero MR */
+	/* C10-72 */
+	if (unlikely(qp->pd != rxe_mw_pd(mw))) {
+		rxe_dbg_mw(mw, "attempt to bind MW with qp with different PD\n");
+		return -EINVAL;
+	}
+
 	if (!mr)
 		return 0;
 
+	/* remaining checks only apply to a nonzero MR */
+	if (unlikely(qp->pd != mr_pd(mr))) {
+		rxe_dbg_mw(mw, "attempt to bind MW to MR with different PD\n");
+		return -EINVAL;
+	}
+
 	if (unlikely(mr->access & IB_ZERO_BASED)) {
 		rxe_dbg_mw(mw, "attempt to bind MW to zero based MR\n");
 		return -EINVAL;
-- 
2.51.0

Re: [PATCH] RDMA/rxe: Check PDs for memory window binds

[Zhu Yanjun]

在 2026/6/24 23:16, Zhiwei Zhang 写道:
> The IBTA Software Transport Verbs specification requires the QP,
> Memory Window and Memory Region for a Bind Memory Window operation
> to belong to the same HCA and protection domain.
> 
> rxe only checked the QP and MW protection domain for type 2 MWs.
> Move the QP/MW PD check to the common bind path and also reject
> binding an MW to an MR from a different PD.
> 
> Invalid bind requests continue to fail with IB_WC_MW_BIND_ERR.
> 
> Signed-off-by: Zhiwei Zhang <202275009@qq.com>
> ---
>   drivers/infiniband/sw/rxe/rxe_mw.c | 20 ++++++++++++--------
>   1 file changed, 12 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/infiniband/sw/rxe/rxe_mw.c b/drivers/infiniband/sw/rxe/rxe_mw.c
> index 379e65bfcd49..aa9371e4ccd5 100644
> --- a/drivers/infiniband/sw/rxe/rxe_mw.c
> +++ b/drivers/infiniband/sw/rxe/rxe_mw.c
> @@ -72,13 +72,6 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
>   			return -EINVAL;
>   		}
>   
> -		/* C10-72 */
> -		if (unlikely(qp->pd != to_rpd(mw->ibmw.pd))) {
> -			rxe_dbg_mw(mw,
> -				"attempt to bind type 2 MW with qp with different PD\n");
> -			return -EINVAL;
> -		}
> -
>   		/* o10-37.2.40 */
>   		if (unlikely(!mr || wqe->wr.wr.mw.length == 0)) {
>   			rxe_dbg_mw(mw,
> @@ -87,10 +80,21 @@ static int rxe_check_bind_mw(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
>   		}
>   	}
>   
> -	/* remaining checks only apply to a nonzero MR */
> +	/* C10-72 */
> +	if (unlikely(qp->pd != rxe_mw_pd(mw))) {
> +		rxe_dbg_mw(mw, "attempt to bind MW with qp with different PD\n");
> +		return -EINVAL;
> +	}
> +
>   	if (!mr)
>   		return 0;
>   
> +	/* remaining checks only apply to a nonzero MR */
> +	if (unlikely(qp->pd != mr_pd(mr))) {
> +		rxe_dbg_mw(mw, "attempt to bind MW to MR with different PD\n");
> +		return -EINVAL;
> +	}

Since the previous check has already explicitly confirmed that qp->pd == 
rxe_mw_pd(mw), this second check implicitly means mw->pd != mr_pd(mr). 
However, for the sake of absolute precision in the kernel logs—and to 
help anyone debugging immediately identify which of the three entities 
is mismatched—it would be better to make the log message more explicit.
"attempt to bind MW/QP to MR with different PD\n"

Except this log, I am fine with this patch.
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>

Zhu Yanjun

> +
>   	if (unlikely(mr->access & IB_ZERO_BASED)) {
>   		rxe_dbg_mw(mw, "attempt to bind MW to zero based MR\n");
>   		return -EINVAL;