* [PATCH rdma-next v9 01/16] RDMA/umem: Rename ib_umem_get() to ib_umem_get_va()
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
@ 2026-05-29 13:42 ` Jiri Pirko
2026-05-29 13:42 ` [PATCH rdma-next v9 02/16] RDMA/umem: Split ib_umem_get_va() into a thin wrapper around __ib_umem_get_va() Jiri Pirko
` (15 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:42 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
The new umem getter family being introduced in follow-up patches
need a fitting name for the central all-source helper that resolves
attributes, legacy fillers and a UHW VA fallback.
Rename the existing VA-pinning helper ib_umem_get() to ib_umem_get_va()
so the name is freed up. The new name is consistent with names of rest
of the helpers that are about to be introduced.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v6->v7:
- rebased on top of bnxt_re changes
v4->v5:
- rebased on top of siw changes
v2->v3:
- new patch
---
drivers/infiniband/core/umem.c | 10 +++----
drivers/infiniband/core/uverbs_std_types_cq.c | 2 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 28 +++++++++----------
drivers/infiniband/hw/cxgb4/mem.c | 2 +-
drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
drivers/infiniband/hw/erdma/erdma_verbs.c | 6 ++--
drivers/infiniband/hw/hns/hns_roce_db.c | 4 +--
drivers/infiniband/hw/hns/hns_roce_mr.c | 4 +--
.../infiniband/hw/ionic/ionic_controlpath.c | 10 +++----
drivers/infiniband/hw/irdma/verbs.c | 4 +--
drivers/infiniband/hw/mana/main.c | 2 +-
drivers/infiniband/hw/mana/mr.c | 2 +-
drivers/infiniband/hw/mlx4/cq.c | 12 ++++----
drivers/infiniband/hw/mlx4/doorbell.c | 4 +--
drivers/infiniband/hw/mlx4/mr.c | 4 +--
drivers/infiniband/hw/mlx4/qp.c | 4 +--
drivers/infiniband/hw/mlx4/srq.c | 2 +-
drivers/infiniband/hw/mlx5/cq.c | 12 ++++----
drivers/infiniband/hw/mlx5/devx.c | 2 +-
drivers/infiniband/hw/mlx5/doorbell.c | 4 +--
drivers/infiniband/hw/mlx5/mr.c | 6 ++--
drivers/infiniband/hw/mlx5/qp.c | 10 +++----
drivers/infiniband/hw/mlx5/srq.c | 2 +-
drivers/infiniband/hw/mthca/mthca_provider.c | 2 +-
drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
drivers/infiniband/hw/qedr/verbs.c | 13 +++++----
drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c | 4 +--
drivers/infiniband/hw/vmw_pvrdma/pvrdma_mr.c | 2 +-
drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c | 10 +++----
drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c | 2 +-
drivers/infiniband/sw/rdmavt/mr.c | 2 +-
drivers/infiniband/sw/rxe/rxe_mr.c | 2 +-
drivers/infiniband/sw/siw/siw_mem.c | 4 +--
include/rdma/ib_umem.h | 10 +++----
34 files changed, 96 insertions(+), 95 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 786fa1aa8e55..b253090bb1ab 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -154,15 +154,15 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,
EXPORT_SYMBOL(ib_umem_find_best_pgsz);
/**
- * ib_umem_get - Pin and DMA map userspace memory.
+ * ib_umem_get_va - Pin and DMA map userspace memory.
*
* @device: IB device to connect UMEM
* @addr: userspace virtual address to start at
* @size: length of region to pin
* @access: IB_ACCESS_xxx flags for memory being pinned
*/
-struct ib_umem *ib_umem_get(struct ib_device *device, unsigned long addr,
- size_t size, int access)
+struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
+ size_t size, int access)
{
struct ib_umem *umem;
struct page **page_list;
@@ -275,10 +275,10 @@ struct ib_umem *ib_umem_get(struct ib_device *device, unsigned long addr,
}
return ret ? ERR_PTR(ret) : umem;
}
-EXPORT_SYMBOL(ib_umem_get);
+EXPORT_SYMBOL(ib_umem_get_va);
/**
- * ib_umem_release - release memory pinned with ib_umem_get
+ * ib_umem_release - release pinned memory
* @umem: umem struct to release
*/
void ib_umem_release(struct ib_umem *umem)
diff --git a/drivers/infiniband/core/uverbs_std_types_cq.c b/drivers/infiniband/core/uverbs_std_types_cq.c
index 79b51f60ce2a..1a6bc8baa52b 100644
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -139,7 +139,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
goto err_event_file;
}
- umem = ib_umem_get(ib_dev, buffer_va, buffer_length, IB_ACCESS_LOCAL_WRITE);
+ umem = ib_umem_get_va(ib_dev, buffer_va, buffer_length, IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(umem)) {
ret = PTR_ERR(umem);
goto err_event_file;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 94aa06e3b828..5e8fa7bf99cb 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -1210,8 +1210,8 @@ static int bnxt_re_init_user_qp(struct bnxt_re_dev *rdev, struct bnxt_re_pd *pd,
bytes += bnxt_re_get_psn_bytes(rdev, cntx, qplib_qp, ureq, fixed_que_attr);
bytes = PAGE_ALIGN(bytes);
- umem = ib_umem_get(&rdev->ibdev, ureq->qpsva, bytes,
- IB_ACCESS_LOCAL_WRITE);
+ umem = ib_umem_get_va(&rdev->ibdev, ureq->qpsva, bytes,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(umem))
return PTR_ERR(umem);
@@ -1225,8 +1225,8 @@ static int bnxt_re_init_user_qp(struct bnxt_re_dev *rdev, struct bnxt_re_pd *pd,
bytes = (qplib_qp->rq.max_wqe * qplib_qp->rq.wqe_size);
bytes = PAGE_ALIGN(bytes);
- umem = ib_umem_get(&rdev->ibdev, ureq->qprva, bytes,
- IB_ACCESS_LOCAL_WRITE);
+ umem = ib_umem_get_va(&rdev->ibdev, ureq->qprva, bytes,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(umem)) {
rc = PTR_ERR(umem);
goto fail;
@@ -2171,8 +2171,8 @@ static int bnxt_re_init_user_srq(struct bnxt_re_dev *rdev,
bytes = (qplib_srq->max_wqe * qplib_srq->wqe_size);
bytes = PAGE_ALIGN(bytes);
- umem = ib_umem_get(&rdev->ibdev, ureq.srqva, bytes,
- IB_ACCESS_LOCAL_WRITE);
+ umem = ib_umem_get_va(&rdev->ibdev, ureq.srqva, bytes,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(umem))
return PTR_ERR(umem);
@@ -3496,9 +3496,9 @@ int bnxt_re_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *att
dev_attr->max_cq_wqes + 1, uctx);
if (!ibcq->umem) {
- ibcq->umem = ib_umem_get(&rdev->ibdev, req.cq_va,
- entries * sizeof(struct cq_base),
- IB_ACCESS_LOCAL_WRITE);
+ ibcq->umem = ib_umem_get_va(&rdev->ibdev, req.cq_va,
+ entries * sizeof(struct cq_base),
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(ibcq->umem))
return PTR_ERR(ibcq->umem);
}
@@ -3655,12 +3655,12 @@ int bnxt_re_resize_cq(struct ib_cq *ibcq, unsigned int cqe,
if (rc)
goto fail;
- cq->resize_umem = ib_umem_get(&rdev->ibdev, req.cq_va,
- entries * sizeof(struct cq_base),
- IB_ACCESS_LOCAL_WRITE);
+ cq->resize_umem = ib_umem_get_va(&rdev->ibdev, req.cq_va,
+ entries * sizeof(struct cq_base),
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(cq->resize_umem)) {
rc = PTR_ERR(cq->resize_umem);
- ibdev_err(&rdev->ibdev, "%s: ib_umem_get failed! rc = %pe\n",
+ ibdev_err(&rdev->ibdev, "%s: ib_umem_get_va failed! rc = %pe\n",
__func__, cq->resize_umem);
cq->resize_umem = NULL;
goto fail;
@@ -4670,7 +4670,7 @@ struct ib_mr *bnxt_re_reg_user_mr(struct ib_pd *ib_pd, u64 start, u64 length,
if (dmah)
return ERR_PTR(-EOPNOTSUPP);
- umem = ib_umem_get(&rdev->ibdev, start, length, mr_access_flags);
+ umem = ib_umem_get_va(&rdev->ibdev, start, length, mr_access_flags);
if (IS_ERR(umem))
return ERR_CAST(umem);
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 9fde78b74690..cd1b01014198 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -530,7 +530,7 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
mhp->rhp = rhp;
- mhp->umem = ib_umem_get(pd->device, start, length, acc);
+ mhp->umem = ib_umem_get_va(pd->device, start, length, acc);
if (IS_ERR(mhp->umem))
goto err_free_skb;
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 395290ab0584..8d97a837fa6a 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1745,7 +1745,7 @@ struct ib_mr *efa_reg_mr(struct ib_pd *ibpd, u64 start, u64 length,
goto err_out;
}
- mr->umem = ib_umem_get(ibpd->device, start, length, access_flags);
+ mr->umem = ib_umem_get_va(ibpd->device, start, length, access_flags);
if (IS_ERR(mr->umem)) {
err = PTR_ERR(mr->umem);
ibdev_dbg(&dev->ibdev,
diff --git a/drivers/infiniband/hw/erdma/erdma_verbs.c b/drivers/infiniband/hw/erdma/erdma_verbs.c
index b59c2e3a5306..9a9dc78c7ab6 100644
--- a/drivers/infiniband/hw/erdma/erdma_verbs.c
+++ b/drivers/infiniband/hw/erdma/erdma_verbs.c
@@ -829,7 +829,7 @@ static int get_mtt_entries(struct erdma_dev *dev, struct erdma_mem *mem,
{
int ret = 0;
- mem->umem = ib_umem_get(&dev->ibdev, start, len, access);
+ mem->umem = ib_umem_get_va(&dev->ibdev, start, len, access);
if (IS_ERR(mem->umem)) {
ret = PTR_ERR(mem->umem);
mem->umem = NULL;
@@ -896,8 +896,8 @@ static int erdma_map_user_dbrecords(struct erdma_ucontext *ctx,
page->va = (dbrecords_va & PAGE_MASK);
page->refcnt = 0;
- page->umem = ib_umem_get(ctx->ibucontext.device,
- dbrecords_va & PAGE_MASK, PAGE_SIZE, 0);
+ page->umem = ib_umem_get_va(ctx->ibucontext.device,
+ dbrecords_va & PAGE_MASK, PAGE_SIZE, 0);
if (IS_ERR(page->umem)) {
rv = PTR_ERR(page->umem);
kfree(page);
diff --git a/drivers/infiniband/hw/hns/hns_roce_db.c b/drivers/infiniband/hw/hns/hns_roce_db.c
index f64023f5cf0a..5e008a1700ef 100644
--- a/drivers/infiniband/hw/hns/hns_roce_db.c
+++ b/drivers/infiniband/hw/hns/hns_roce_db.c
@@ -29,8 +29,8 @@ int hns_roce_db_map_user(struct hns_roce_ucontext *context, unsigned long virt,
refcount_set(&page->refcount, 1);
page->user_virt = page_addr;
- page->umem = ib_umem_get(context->ibucontext.device, page_addr,
- PAGE_SIZE, 0);
+ page->umem = ib_umem_get_va(context->ibucontext.device, page_addr,
+ PAGE_SIZE, 0);
if (IS_ERR(page->umem)) {
ret = PTR_ERR(page->umem);
kfree(page);
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index e8a9e7d8f267..01818a679d0a 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -591,8 +591,8 @@ static int mtr_alloc_bufs(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
if (udata) {
mtr->kmem = NULL;
- mtr->umem = ib_umem_get(ibdev, user_addr, total_size,
- buf_attr->user_access);
+ mtr->umem = ib_umem_get_va(ibdev, user_addr, total_size,
+ buf_attr->user_access);
if (IS_ERR(mtr->umem)) {
ibdev_err(ibdev, "failed to get umem, ret = %pe.\n",
mtr->umem);
diff --git a/drivers/infiniband/hw/ionic/ionic_controlpath.c b/drivers/infiniband/hw/ionic/ionic_controlpath.c
index 2b01345848dd..db18c315cc21 100644
--- a/drivers/infiniband/hw/ionic/ionic_controlpath.c
+++ b/drivers/infiniband/hw/ionic/ionic_controlpath.c
@@ -110,8 +110,8 @@ int ionic_create_cq_common(struct ionic_vcq *vcq,
if (rc)
goto err_qdesc;
- cq->umem = ib_umem_get(&dev->ibdev, req_cq->addr, req_cq->size,
- IB_ACCESS_LOCAL_WRITE);
+ cq->umem = ib_umem_get_va(&dev->ibdev, req_cq->addr,
+ req_cq->size, IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(cq->umem)) {
rc = PTR_ERR(cq->umem);
goto err_qdesc;
@@ -895,7 +895,7 @@ struct ib_mr *ionic_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,
mr->flags = IONIC_MRF_USER_MR | to_ionic_mr_flags(access);
- mr->umem = ib_umem_get(&dev->ibdev, start, length, access);
+ mr->umem = ib_umem_get_va(&dev->ibdev, start, length, access);
if (IS_ERR(mr->umem)) {
rc = PTR_ERR(mr->umem);
goto err_umem;
@@ -1837,7 +1837,7 @@ static int ionic_qp_sq_init(struct ionic_ibdev *dev, struct ionic_ctx *ctx,
qp->sq_meta = NULL;
qp->sq_msn_idx = NULL;
- qp->sq_umem = ib_umem_get(&dev->ibdev, sq->addr, sq->size, 0);
+ qp->sq_umem = ib_umem_get_va(&dev->ibdev, sq->addr, sq->size, 0);
if (IS_ERR(qp->sq_umem))
return PTR_ERR(qp->sq_umem);
} else {
@@ -2050,7 +2050,7 @@ static int ionic_qp_rq_init(struct ionic_ibdev *dev, struct ionic_ctx *ctx,
qp->rq_meta = NULL;
- qp->rq_umem = ib_umem_get(&dev->ibdev, rq->addr, rq->size, 0);
+ qp->rq_umem = ib_umem_get_va(&dev->ibdev, rq->addr, rq->size, 0);
if (IS_ERR(qp->rq_umem))
return PTR_ERR(qp->rq_umem);
} else {
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 3f4811bb5514..baee48df5fdf 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -3527,7 +3527,7 @@ static struct ib_mr *irdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 len,
if (udata->inlen < IRDMA_MEM_REG_MIN_REQ_LEN)
return ERR_PTR(-EINVAL);
- region = ib_umem_get(pd->device, start, len, access);
+ region = ib_umem_get_va(pd->device, start, len, access);
if (IS_ERR(region)) {
ibdev_dbg(&iwdev->ibdev,
@@ -3729,7 +3729,7 @@ static int irdma_rereg_mr_trans(struct irdma_mr *iwmr, u64 start, u64 len,
struct ib_umem *region;
int err;
- region = ib_umem_get(pd->device, start, len, iwmr->access);
+ region = ib_umem_get_va(pd->device, start, len, iwmr->access);
if (IS_ERR(region))
return PTR_ERR(region);
diff --git a/drivers/infiniband/hw/mana/main.c b/drivers/infiniband/hw/mana/main.c
index 307ae01bf26f..1e93df6455f5 100644
--- a/drivers/infiniband/hw/mana/main.c
+++ b/drivers/infiniband/hw/mana/main.c
@@ -238,7 +238,7 @@ int mana_ib_create_queue(struct mana_ib_dev *mdev, u64 addr, u32 size,
queue->id = INVALID_QUEUE_ID;
queue->gdma_region = GDMA_INVALID_DMA_REGION;
- umem = ib_umem_get(&mdev->ib_dev, addr, size, IB_ACCESS_LOCAL_WRITE);
+ umem = ib_umem_get_va(&mdev->ib_dev, addr, size, IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(umem)) {
ibdev_dbg(&mdev->ib_dev, "Failed to get umem, %pe\n", umem);
return PTR_ERR(umem);
diff --git a/drivers/infiniband/hw/mana/mr.c b/drivers/infiniband/hw/mana/mr.c
index 8092a7bb785b..030bfdcfff3c 100644
--- a/drivers/infiniband/hw/mana/mr.c
+++ b/drivers/infiniband/hw/mana/mr.c
@@ -127,7 +127,7 @@ struct ib_mr *mana_ib_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 length,
if (!mr)
return ERR_PTR(-ENOMEM);
- mr->umem = ib_umem_get(ibdev, start, length, access_flags);
+ mr->umem = ib_umem_get_va(ibdev, start, length, access_flags);
if (IS_ERR(mr->umem)) {
err = PTR_ERR(mr->umem);
ibdev_dbg(ibdev,
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index 7e4505f6c78b..f9ec6917d9c9 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -180,9 +180,9 @@ int mlx4_ib_create_user_cq(struct ib_cq *ibcq,
buf_addr = (void *)(unsigned long)ucmd.buf_addr;
if (!ibcq->umem)
- ibcq->umem = ib_umem_get(&dev->ib_dev, ucmd.buf_addr,
- entries * cqe_size,
- IB_ACCESS_LOCAL_WRITE);
+ ibcq->umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
+ entries * cqe_size,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(ibcq->umem)) {
err = PTR_ERR(ibcq->umem);
goto err_cq;
@@ -344,9 +344,9 @@ static int mlx4_alloc_resize_umem(struct mlx4_ib_dev *dev, struct mlx4_ib_cq *cq
if (!cq->resize_buf)
return -ENOMEM;
- cq->resize_umem = ib_umem_get(&dev->ib_dev, ucmd.buf_addr,
- entries * cqe_size,
- IB_ACCESS_LOCAL_WRITE);
+ cq->resize_umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
+ entries * cqe_size,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(cq->resize_umem)) {
err = PTR_ERR(cq->resize_umem);
goto err_buf;
diff --git a/drivers/infiniband/hw/mlx4/doorbell.c b/drivers/infiniband/hw/mlx4/doorbell.c
index 8ba86b1e4e46..22ae728834fc 100644
--- a/drivers/infiniband/hw/mlx4/doorbell.c
+++ b/drivers/infiniband/hw/mlx4/doorbell.c
@@ -64,8 +64,8 @@ int mlx4_ib_db_map_user(struct ib_udata *udata, unsigned long virt,
page->user_virt = (virt & PAGE_MASK);
page->refcnt = 0;
- page->umem = ib_umem_get(context->ibucontext.device, virt & PAGE_MASK,
- PAGE_SIZE, 0);
+ page->umem = ib_umem_get_va(context->ibucontext.device,
+ virt & PAGE_MASK, PAGE_SIZE, 0);
if (IS_ERR(page->umem)) {
err = PTR_ERR(page->umem);
kfree(page);
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 650b4a9121ff..027ffb6f79d3 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -110,7 +110,7 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_device *device, u64 start,
/*
* Force registering the memory as writable if the underlying pages
* are writable. This is so rereg can change the access permissions
- * from readable to writable without having to run through ib_umem_get
+ * from readable to writable without having to run through ib_umem_get_va
* again
*/
if (!ib_access_writable(access_flags)) {
@@ -135,7 +135,7 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_device *device, u64 start,
mmap_read_unlock(current->mm);
}
- return ib_umem_get(device, start, length, access_flags);
+ return ib_umem_get_va(device, start, length, access_flags);
}
struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 8dc4196218bf..effc6bcceb76 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -897,7 +897,7 @@ static int create_rq(struct ib_pd *pd, struct ib_qp_init_attr *init_attr,
qp->buf_size = (qp->rq.wqe_cnt << qp->rq.wqe_shift) +
(qp->sq.wqe_cnt << qp->sq.wqe_shift);
- qp->umem = ib_umem_get(pd->device, wq.buf_addr, qp->buf_size, 0);
+ qp->umem = ib_umem_get_va(pd->device, wq.buf_addr, qp->buf_size, 0);
if (IS_ERR(qp->umem)) {
err = PTR_ERR(qp->umem);
goto err;
@@ -1080,7 +1080,7 @@ static int create_qp_common(struct ib_pd *pd, struct ib_qp_init_attr *init_attr,
goto err;
qp->umem =
- ib_umem_get(pd->device, ucmd.buf_addr, qp->buf_size, 0);
+ ib_umem_get_va(pd->device, ucmd.buf_addr, qp->buf_size, 0);
if (IS_ERR(qp->umem)) {
err = PTR_ERR(qp->umem);
goto err;
diff --git a/drivers/infiniband/hw/mlx4/srq.c b/drivers/infiniband/hw/mlx4/srq.c
index dd868f9b893d..7bcb7e225662 100644
--- a/drivers/infiniband/hw/mlx4/srq.c
+++ b/drivers/infiniband/hw/mlx4/srq.c
@@ -116,7 +116,7 @@ int mlx4_ib_create_srq(struct ib_srq *ib_srq,
return err;
srq->umem =
- ib_umem_get(ib_srq->device, ucmd.buf_addr, buf_size, 0);
+ ib_umem_get_va(ib_srq->device, ucmd.buf_addr, buf_size, 0);
if (IS_ERR(srq->umem))
return PTR_ERR(srq->umem);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 64fad78cb256..5a89676ebeb2 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -747,9 +747,9 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata,
*cqe_size = ucmd.cqe_size;
if (!cq->ibcq.umem)
- cq->ibcq.umem = ib_umem_get(&dev->ib_dev, ucmd.buf_addr,
- entries * ucmd.cqe_size,
- IB_ACCESS_LOCAL_WRITE);
+ cq->ibcq.umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
+ entries * ucmd.cqe_size,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(cq->ibcq.umem))
return PTR_ERR(cq->ibcq.umem);
@@ -1242,9 +1242,9 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq,
if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1)
return -EINVAL;
- umem = ib_umem_get(&dev->ib_dev, ucmd.buf_addr,
- (size_t)ucmd.cqe_size * entries,
- IB_ACCESS_LOCAL_WRITE);
+ umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
+ (size_t)ucmd.cqe_size * entries,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(umem)) {
err = PTR_ERR(umem);
return err;
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index c5929d023ee3..fc6f793dcc65 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -2287,7 +2287,7 @@ static int devx_umem_get(struct mlx5_ib_dev *dev, struct ib_ucontext *ucontext,
return PTR_ERR(umem_dmabuf);
obj->umem = &umem_dmabuf->umem;
} else {
- obj->umem = ib_umem_get(&dev->ib_dev, addr, size, access_flags);
+ obj->umem = ib_umem_get_va(&dev->ib_dev, addr, size, access_flags);
if (IS_ERR(obj->umem))
return PTR_ERR(obj->umem);
}
diff --git a/drivers/infiniband/hw/mlx5/doorbell.c b/drivers/infiniband/hw/mlx5/doorbell.c
index bd68fcf011f4..020c70328663 100644
--- a/drivers/infiniband/hw/mlx5/doorbell.c
+++ b/drivers/infiniband/hw/mlx5/doorbell.c
@@ -66,8 +66,8 @@ int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context, unsigned long virt,
page->user_virt = (virt & PAGE_MASK);
page->refcnt = 0;
- page->umem = ib_umem_get(context->ibucontext.device, virt & PAGE_MASK,
- PAGE_SIZE, 0);
+ page->umem = ib_umem_get_va(context->ibucontext.device,
+ virt & PAGE_MASK, PAGE_SIZE, 0);
if (IS_ERR(page->umem)) {
err = PTR_ERR(page->umem);
kfree(page);
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index d7d8f3ae8b64..254e6aa4ccaf 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -874,7 +874,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
if (access_flags & IB_ACCESS_ON_DEMAND)
return create_user_odp_mr(pd, start, length, iova, access_flags,
udata);
- umem = ib_umem_get(&dev->ib_dev, start, length, access_flags);
+ umem = ib_umem_get_va(&dev->ib_dev, start, length, access_flags);
if (IS_ERR(umem))
return ERR_CAST(umem);
return create_real_mr(pd, umem, iova, access_flags, dmah);
@@ -1227,8 +1227,8 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start,
struct ib_umem *new_umem;
unsigned long page_size;
- new_umem = ib_umem_get(&dev->ib_dev, start, length,
- new_access_flags);
+ new_umem = ib_umem_get_va(&dev->ib_dev, start, length,
+ new_access_flags);
if (IS_ERR(new_umem))
return ERR_CAST(new_umem);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 043b12cf7c1f..dc5e6e3e5a64 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -886,7 +886,7 @@ static int create_user_rq(struct mlx5_ib_dev *dev, struct ib_pd *pd,
if (!ucmd->buf_addr)
return -EINVAL;
- rwq->umem = ib_umem_get(&dev->ib_dev, ucmd->buf_addr, rwq->buf_size, 0);
+ rwq->umem = ib_umem_get_va(&dev->ib_dev, ucmd->buf_addr, rwq->buf_size, 0);
if (IS_ERR(rwq->umem)) {
mlx5_ib_dbg(dev, "umem_get failed\n");
err = PTR_ERR(rwq->umem);
@@ -996,8 +996,8 @@ static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
if (ucmd->buf_addr && ubuffer->buf_size) {
ubuffer->buf_addr = ucmd->buf_addr;
- ubuffer->umem = ib_umem_get(&dev->ib_dev, ubuffer->buf_addr,
- ubuffer->buf_size, 0);
+ ubuffer->umem = ib_umem_get_va(&dev->ib_dev, ubuffer->buf_addr,
+ ubuffer->buf_size, 0);
if (IS_ERR(ubuffer->umem)) {
err = PTR_ERR(ubuffer->umem);
goto err_bfreg;
@@ -1348,8 +1348,8 @@ static int create_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
if (ts_format < 0)
return ts_format;
- sq->ubuffer.umem = ib_umem_get(&dev->ib_dev, ubuffer->buf_addr,
- ubuffer->buf_size, 0);
+ sq->ubuffer.umem = ib_umem_get_va(&dev->ib_dev, ubuffer->buf_addr,
+ ubuffer->buf_size, 0);
if (IS_ERR(sq->ubuffer.umem))
return PTR_ERR(sq->ubuffer.umem);
page_size = mlx5_umem_find_best_quantized_pgoff(
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 3fb8519a4ce0..44903015c6c9 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -66,7 +66,7 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
srq->wq_sig = !!(ucmd.flags & MLX5_SRQ_FLAG_SIGNATURE);
- srq->umem = ib_umem_get(pd->device, ucmd.buf_addr, buf_size, 0);
+ srq->umem = ib_umem_get_va(pd->device, ucmd.buf_addr, buf_size, 0);
if (IS_ERR(srq->umem)) {
mlx5_ib_dbg(dev, "failed umem get, size %d\n", buf_size);
err = PTR_ERR(srq->umem);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index afa97d3801f7..23e387dba79d 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -878,7 +878,7 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
if (!mr)
return ERR_PTR(-ENOMEM);
- mr->umem = ib_umem_get(pd->device, start, length, acc);
+ mr->umem = ib_umem_get_va(pd->device, start, length, acc);
if (IS_ERR(mr->umem)) {
err = PTR_ERR(mr->umem);
goto err;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index 383f1d9c15d1..69caadcff810 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -864,7 +864,7 @@ struct ib_mr *ocrdma_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
mr = kzalloc_obj(*mr);
if (!mr)
return ERR_PTR(status);
- mr->umem = ib_umem_get(ibpd->device, start, len, acc);
+ mr->umem = ib_umem_get_va(ibpd->device, start, len, acc);
if (IS_ERR(mr->umem)) {
status = -EFAULT;
goto umem_err;
diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
index 1af908275ca7..7195eeede530 100644
--- a/drivers/infiniband/hw/qedr/verbs.c
+++ b/drivers/infiniband/hw/qedr/verbs.c
@@ -779,9 +779,9 @@ static inline int qedr_init_user_queue(struct ib_udata *udata,
q->buf_addr = buf_addr;
q->buf_len = buf_len;
- q->umem = ib_umem_get(&dev->ibdev, q->buf_addr, q->buf_len, access);
+ q->umem = ib_umem_get_va(&dev->ibdev, q->buf_addr, q->buf_len, access);
if (IS_ERR(q->umem)) {
- DP_ERR(dev, "create user queue: failed ib_umem_get, got %ld\n",
+ DP_ERR(dev, "create user queue: failed ib_umem_get_va, got %ld\n",
PTR_ERR(q->umem));
return PTR_ERR(q->umem);
}
@@ -1439,13 +1439,14 @@ static int qedr_init_srq_user_params(struct ib_udata *udata,
if (rc)
return rc;
- srq->prod_umem = ib_umem_get(srq->ibsrq.device, ureq->prod_pair_addr,
- sizeof(struct rdma_srq_producers), access);
+ srq->prod_umem = ib_umem_get_va(srq->ibsrq.device, ureq->prod_pair_addr,
+ sizeof(struct rdma_srq_producers),
+ access);
if (IS_ERR(srq->prod_umem)) {
qedr_free_pbl(srq->dev, &srq->usrq.pbl_info, srq->usrq.pbl_tbl);
ib_umem_release(srq->usrq.umem);
DP_ERR(srq->dev,
- "create srq: failed ib_umem_get for producer, got %ld\n",
+ "create srq: failed ib_umem_get_va for producer, got %ld\n",
PTR_ERR(srq->prod_umem));
return PTR_ERR(srq->prod_umem);
}
@@ -2932,7 +2933,7 @@ struct ib_mr *qedr_reg_user_mr(struct ib_pd *ibpd, u64 start, u64 len,
mr->type = QEDR_MR_USER;
- mr->umem = ib_umem_get(ibpd->device, start, len, acc);
+ mr->umem = ib_umem_get_va(ibpd->device, start, len, acc);
if (IS_ERR(mr->umem)) {
rc = -EFAULT;
goto err0;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
index d5bfdbfe1376..0bdb4452d6f6 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
@@ -138,8 +138,8 @@ int pvrdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
if (ret)
goto err_cq;
- cq->umem = ib_umem_get(ibdev, ucmd.buf_addr, ucmd.buf_size,
- IB_ACCESS_LOCAL_WRITE);
+ cq->umem = ib_umem_get_va(ibdev, ucmd.buf_addr, ucmd.buf_size,
+ IB_ACCESS_LOCAL_WRITE);
if (IS_ERR(cq->umem)) {
ret = PTR_ERR(cq->umem);
goto err_cq;
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_mr.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_mr.c
index 05a6bd991502..942381ab0367 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_mr.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_mr.c
@@ -131,7 +131,7 @@ struct ib_mr *pvrdma_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
return ERR_PTR(-EINVAL);
}
- umem = ib_umem_get(pd->device, start, length, access_flags);
+ umem = ib_umem_get_va(pd->device, start, length, access_flags);
if (IS_ERR(umem)) {
dev_warn(&dev->pdev->dev,
"could not get umem for mem region\n");
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
index cefcb243c3a6..e939cd5ce40b 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
@@ -268,9 +268,9 @@ int pvrdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr,
if (!is_srq) {
/* set qp->sq.wqe_cnt, shift, buf_size.. */
- qp->rumem = ib_umem_get(ibqp->device,
- ucmd.rbuf_addr,
- ucmd.rbuf_size, 0);
+ qp->rumem = ib_umem_get_va(ibqp->device,
+ ucmd.rbuf_addr,
+ ucmd.rbuf_size, 0);
if (IS_ERR(qp->rumem)) {
ret = PTR_ERR(qp->rumem);
goto err_qp;
@@ -281,8 +281,8 @@ int pvrdma_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *init_attr,
qp->srq = to_vsrq(init_attr->srq);
}
- qp->sumem = ib_umem_get(ibqp->device, ucmd.sbuf_addr,
- ucmd.sbuf_size, 0);
+ qp->sumem = ib_umem_get_va(ibqp->device, ucmd.sbuf_addr,
+ ucmd.sbuf_size, 0);
if (IS_ERR(qp->sumem)) {
if (!is_srq)
ib_umem_release(qp->rumem);
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
index e69eadde6c26..345ec486a223 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c
@@ -146,7 +146,7 @@ int pvrdma_create_srq(struct ib_srq *ibsrq, struct ib_srq_init_attr *init_attr,
if (ret)
goto err_srq;
- srq->umem = ib_umem_get(ibsrq->device, ucmd.buf_addr, ucmd.buf_size, 0);
+ srq->umem = ib_umem_get_va(ibsrq->device, ucmd.buf_addr, ucmd.buf_size, 0);
if (IS_ERR(srq->umem)) {
ret = PTR_ERR(srq->umem);
goto err_srq;
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 15f1ff917d6c..3266129e63e7 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -351,7 +351,7 @@ struct ib_mr *rvt_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
if (length == 0)
return ERR_PTR(-EINVAL);
- umem = ib_umem_get(pd->device, start, length, mr_access_flags);
+ umem = ib_umem_get_va(pd->device, start, length, mr_access_flags);
if (IS_ERR(umem))
return ERR_CAST(umem);
diff --git a/drivers/infiniband/sw/rxe/rxe_mr.c b/drivers/infiniband/sw/rxe/rxe_mr.c
index c696ff874980..875eceb55fdf 100644
--- a/drivers/infiniband/sw/rxe/rxe_mr.c
+++ b/drivers/infiniband/sw/rxe/rxe_mr.c
@@ -197,7 +197,7 @@ int rxe_mr_init_user(struct rxe_dev *rxe, u64 start, u64 length,
rxe_mr_init(access, mr);
- umem = ib_umem_get(&rxe->ib_dev, start, length, access);
+ umem = ib_umem_get_va(&rxe->ib_dev, start, length, access);
if (IS_ERR(umem)) {
rxe_dbg_mr(mr, "Unable to pin memory region err = %d\n",
(int)PTR_ERR(umem));
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
index 4df792ebe02f..2a08817d3cce 100644
--- a/drivers/infiniband/sw/siw/siw_mem.c
+++ b/drivers/infiniband/sw/siw/siw_mem.c
@@ -350,7 +350,7 @@ struct siw_umem *siw_umem_get(struct ib_device *base_dev, u64 start,
if (!umem)
return ERR_PTR(-ENOMEM);
- base_mem = ib_umem_get(base_dev, start, len, rights);
+ base_mem = ib_umem_get_va(base_dev, start, len, rights);
if (IS_ERR(base_mem)) {
rv = PTR_ERR(base_mem);
siw_dbg(base_dev, "Cannot pin user memory: %d\n", rv);
@@ -385,7 +385,7 @@ struct siw_umem *siw_umem_get(struct ib_device *base_dev, u64 start,
if (num_pages) {
/*
- * Unexpected size of sg list provided by ib_umem_get()
+ * Unexpected size of sg list provided by ib_umem_get_va()
*/
siw_dbg(base_dev, "Short SG list, missing %u pages\n",
num_pages);
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 2ad52cc1d52b..25e90766892e 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -75,8 +75,8 @@ static inline size_t ib_umem_num_pages(struct ib_umem *umem)
}
#ifdef CONFIG_INFINIBAND_USER_MEM
-struct ib_umem *ib_umem_get(struct ib_device *device, unsigned long addr,
- size_t size, int access);
+struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
+ size_t size, int access);
void ib_umem_release(struct ib_umem *umem);
int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length);
@@ -160,9 +160,9 @@ void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf);
#include <linux/err.h>
-static inline struct ib_umem *ib_umem_get(struct ib_device *device,
- unsigned long addr, size_t size,
- int access)
+static inline struct ib_umem *ib_umem_get_va(struct ib_device *device,
+ unsigned long addr, size_t size,
+ int access)
{
return ERR_PTR(-EOPNOTSUPP);
}
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 02/16] RDMA/umem: Split ib_umem_get_va() into a thin wrapper around __ib_umem_get_va()
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
2026-05-29 13:42 ` [PATCH rdma-next v9 01/16] RDMA/umem: Rename ib_umem_get() to ib_umem_get_va() Jiri Pirko
@ 2026-05-29 13:42 ` Jiri Pirko
2026-05-29 13:42 ` [PATCH rdma-next v9 03/16] RDMA/core: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (14 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:42 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
The follow-up patch is going to introduce ib_umem_get_desc(),
the canonical desc-to-umem helper, which needs to pin a userspace VA
without going through the exported ib_umem_get_va() helper so later on
ib_umem_get_va() would use the ib_umem_get_desc() flow too.
Move the existing ib_umem_get_va() to a static __ib_umem_get_va()
and have ib_umem_get_va() as a thin wrapper that calls it.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v2->v3:
- new patch
---
drivers/infiniband/core/umem.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index b253090bb1ab..0056f23af57b 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -153,16 +153,9 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem,
}
EXPORT_SYMBOL(ib_umem_find_best_pgsz);
-/**
- * ib_umem_get_va - Pin and DMA map userspace memory.
- *
- * @device: IB device to connect UMEM
- * @addr: userspace virtual address to start at
- * @size: length of region to pin
- * @access: IB_ACCESS_xxx flags for memory being pinned
- */
-struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
- size_t size, int access)
+static struct ib_umem *__ib_umem_get_va(struct ib_device *device,
+ unsigned long addr, size_t size,
+ int access)
{
struct ib_umem *umem;
struct page **page_list;
@@ -275,6 +268,20 @@ struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
}
return ret ? ERR_PTR(ret) : umem;
}
+
+/**
+ * ib_umem_get_va - Pin and DMA map userspace memory.
+ *
+ * @device: IB device to connect UMEM
+ * @addr: userspace virtual address to start at
+ * @size: length of region to pin
+ * @access: IB_ACCESS_xxx flags for memory being pinned
+ */
+struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
+ size_t size, int access)
+{
+ return __ib_umem_get_va(device, addr, size, access);
+}
EXPORT_SYMBOL(ib_umem_get_va);
/**
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 03/16] RDMA/core: Introduce generic buffer descriptor infrastructure for umem
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
2026-05-29 13:42 ` [PATCH rdma-next v9 01/16] RDMA/umem: Rename ib_umem_get() to ib_umem_get_va() Jiri Pirko
2026-05-29 13:42 ` [PATCH rdma-next v9 02/16] RDMA/umem: Split ib_umem_get_va() into a thin wrapper around __ib_umem_get_va() Jiri Pirko
@ 2026-05-29 13:42 ` Jiri Pirko
2026-05-29 19:14 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 04/16] RDMA/umem: Route ib_umem_get_va() through ib_umem_get_attr_or_va() Jiri Pirko
` (13 subsequent siblings)
16 siblings, 1 reply; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:42 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Introduce a per-attribute UVERBS_ATTR_UMEM model so each uverbs
command's umem set is explicit in its UAPI definition. Add
driver-facing wrapper helpers that pin a umem on demand from an
attribute or a VA addr; the driver owns the returned umem and
releases it from its destroy/error paths.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v8->v9:
- added missed const to attrs_bundle for uverbs_get_buffer_desc() stub
- added check-fail of addr/length size to ib_umem_get_desc()
- added kdoc size sections
- extended uverbs_get_buffer_desc() kdoc return values
v7->v8:
- moved uverbs_attr_get_buffer_desc()to ib_core_uverbs.c
- s/uverbs_attr_get_buffer_desc/uverbs_get_buffer_desc/
- s/attrs/attrs_bundle/ for uverbs_get_buffer_desc() arg
v6->v7:
- replaced reserved[2] in struct ib_uverbs_buffer_desc with strict
flags + advisory optional_flags
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
- split ib_umem_get() into ib_umem_resolve_desc() +
ib_umem_get_desc_check() + ib_umem_get_from_attrs[_or_va]()
v4->v5:
- rebased on top of Jason's ib_uverbs dependencies patchset
- split "size" arg into two, documented the semantics in kdoc
- split desc extraction out of ib_umem_get() into new
uverbs_attr_get_buffer_desc() (uverbs_ioctl.{c,h})
- exported ib_umem_get_desc()
v3->v4:
- removed dmesg print from ib_umem_get() legacy filler check
v2->v3:
- pushed out desc processing to ib_umem_get_desc()
- replaced UVERBS_ATTR_BUFFERS array with per-attribute UVERBS_ATTR_UMEM
- struct ib_uverbs_buffer_desc: dropped .index, moved .type first,
bumped reserved to __u32 reserved[2]
- added canonical ib_umem_get() + two inline wrappers
(_attr, _attr_or_va)
- dropped ib_umem_list_* family + ib_umem_release_non_listed()
---
drivers/infiniband/core/ib_core_uverbs.c | 25 +++
drivers/infiniband/core/umem.c | 228 +++++++++++++++++++++++
include/rdma/ib_umem.h | 36 ++++
include/rdma/uverbs_ioctl.h | 30 +++
include/uapi/rdma/ib_user_ioctl_verbs.h | 27 +++
5 files changed, 346 insertions(+)
diff --git a/drivers/infiniband/core/ib_core_uverbs.c b/drivers/infiniband/core/ib_core_uverbs.c
index b4fc693a3bd8..6e063e05f796 100644
--- a/drivers/infiniband/core/ib_core_uverbs.c
+++ b/drivers/infiniband/core/ib_core_uverbs.c
@@ -708,6 +708,31 @@ int uverbs_get_flags32(u32 *to, const struct uverbs_attr_bundle *attrs_bundle,
}
EXPORT_SYMBOL(uverbs_get_flags32);
+/**
+ * uverbs_get_buffer_desc - Read a buffer descriptor from a uverbs attr.
+ * @attrs_bundle: uverbs attribute bundle.
+ * @attr_id: id of an UVERBS_ATTR_UMEM-typed attribute.
+ * @desc: descriptor to fill.
+ *
+ * Return: 0 on success, -ENOENT if @attr_id is not set, -EINVAL on a
+ * malformed descriptor, or any other negative errno propagated from
+ * uverbs_copy_from() (notably -EFAULT on copy_from_user() failure).
+ */
+int uverbs_get_buffer_desc(const struct uverbs_attr_bundle *attrs_bundle,
+ u16 attr_id, struct ib_uverbs_buffer_desc *desc)
+{
+ int ret;
+
+ ret = uverbs_copy_from(desc, attrs_bundle, attr_id);
+ if (ret)
+ return ret;
+ if (desc->flags & ~IB_UVERBS_BUFFER_DESC_FLAGS_KNOWN_MASK)
+ return -EINVAL;
+ desc->optional_flags &= IB_UVERBS_BUFFER_DESC_OPTIONAL_FLAGS_KNOWN_MASK;
+ return 0;
+}
+EXPORT_SYMBOL(uverbs_get_buffer_desc);
+
/* Once called an abort will call through to the type's destroy_hw() */
void uverbs_finalize_uobj_create(const struct uverbs_attr_bundle *bundle,
u16 idx)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 0056f23af57b..7d2256583bc7 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -269,6 +269,175 @@ static struct ib_umem *__ib_umem_get_va(struct ib_device *device,
return ret ? ERR_PTR(ret) : umem;
}
+/**
+ * ib_umem_get_desc - Pin a umem from a buffer descriptor.
+ * @device: IB device.
+ * @desc: buffer descriptor (VA or DMABUF).
+ * @access: IB access flags.
+ *
+ * Return: caller-owned umem on success, ERR_PTR(...) on error.
+ */
+struct ib_umem *ib_umem_get_desc(struct ib_device *device,
+ const struct ib_uverbs_buffer_desc *desc,
+ int access)
+{
+ struct ib_umem_dmabuf *umem_dmabuf;
+
+ if (desc->flags & ~IB_UVERBS_BUFFER_DESC_FLAGS_KNOWN_MASK)
+ return ERR_PTR(-EINVAL);
+
+ if (overflows_type(desc->addr, unsigned long) ||
+ overflows_type(desc->length, size_t))
+ return ERR_PTR(-EOVERFLOW);
+
+ switch (desc->type) {
+ case IB_UVERBS_BUFFER_TYPE_DMABUF:
+ umem_dmabuf = ib_umem_dmabuf_get_pinned(device, desc->addr,
+ desc->length, desc->fd,
+ access);
+ if (IS_ERR(umem_dmabuf))
+ return ERR_CAST(umem_dmabuf);
+ return &umem_dmabuf->umem;
+ case IB_UVERBS_BUFFER_TYPE_VA:
+ return __ib_umem_get_va(device, desc->addr, desc->length,
+ access);
+ default:
+ return ERR_PTR(-EINVAL);
+ }
+}
+EXPORT_SYMBOL(ib_umem_get_desc);
+
+/*
+ * Per-command legacy buffer-desc filler.
+ * Returns 0 on success (desc filled), -ENODATA if no legacy attrs apply,
+ * negative errno on validation failure.
+ */
+typedef int (*ib_umem_buf_desc_filler_t)(const struct uverbs_attr_bundle *attrs,
+ struct ib_uverbs_buffer_desc *desc);
+
+/*
+ * ib_umem_resolve_desc - Resolve a buffer descriptor from a per-command UMEM
+ * attribute and/or a legacy attr filler.
+ *
+ * Return:
+ * 0 @desc filled.
+ * -ENOENT no source produced a buffer.
+ * -EINVAL both the UMEM attribute and the legacy filler produced a buffer.
+ * -errno propagated from attr read / filler validation.
+ */
+static int ib_umem_resolve_desc(const struct uverbs_attr_bundle *attrs,
+ u16 attr_id,
+ ib_umem_buf_desc_filler_t legacy_filler,
+ struct ib_uverbs_buffer_desc *desc)
+{
+ bool have_desc = false;
+ int ret;
+
+ if (!attrs)
+ return -ENOENT;
+
+ ret = uverbs_get_buffer_desc(attrs, attr_id, desc);
+ if (!ret)
+ have_desc = true;
+ else if (ret != -ENOENT)
+ return ret;
+
+ if (legacy_filler) {
+ struct ib_uverbs_buffer_desc legacy_desc = {};
+
+ ret = legacy_filler(attrs, &legacy_desc);
+ if (!ret) {
+ if (have_desc)
+ return -EINVAL;
+ *desc = legacy_desc;
+ have_desc = true;
+ } else if (ret != -ENODATA) {
+ return ret;
+ }
+ }
+
+ return have_desc ? 0 : -ENOENT;
+}
+
+/*
+ * ib_umem_get_desc_check - Pin a umem from @desc and verify it meets
+ * @min_size.
+ */
+static struct ib_umem *
+ib_umem_get_desc_check(struct ib_device *device,
+ const struct ib_uverbs_buffer_desc *desc,
+ size_t min_size, int access)
+{
+ struct ib_umem *umem;
+
+ umem = ib_umem_get_desc(device, desc, access);
+ if (IS_ERR(umem))
+ return umem;
+ if (umem->length < min_size) {
+ ib_umem_release(umem);
+ return ERR_PTR(-EINVAL);
+ }
+ return umem;
+}
+
+/*
+ * ib_umem_get_from_attrs - Pin a umem from a per-command UMEM attribute
+ * and/or a legacy attr filler.
+ *
+ * Return: caller-owned umem on success; NULL when no source supplied a
+ * buffer; ERR_PTR(...) on error.
+ */
+static struct ib_umem *
+ib_umem_get_from_attrs(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u16 attr_id, ib_umem_buf_desc_filler_t legacy_filler,
+ size_t size, int access)
+{
+ struct ib_uverbs_buffer_desc desc = {};
+ int ret;
+
+ ret = ib_umem_resolve_desc(attrs, attr_id, legacy_filler, &desc);
+ if (ret == -ENOENT)
+ return NULL;
+ if (ret)
+ return ERR_PTR(ret);
+ return ib_umem_get_desc_check(device, &desc, size, access);
+}
+
+/*
+ * ib_umem_get_from_attrs_or_va - Pin a umem from a per-command UMEM
+ * attribute and/or a legacy attr filler,
+ * falling back to a UHW VA when no source
+ * matched.
+ *
+ * @size is always consumed: it is the length to pin on the VA fallback
+ * path AND the post-pin minimum-length check on the attr / legacy paths.
+ * Callers must always pass a meaningful, validated value.
+ *
+ * Return: caller-owned umem on success, ERR_PTR(...) on error.
+ */
+static struct ib_umem *
+ib_umem_get_from_attrs_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u16 attr_id,
+ ib_umem_buf_desc_filler_t legacy_filler,
+ u64 addr, size_t size, int access)
+{
+ struct ib_uverbs_buffer_desc desc = {};
+ int ret;
+
+ ret = ib_umem_resolve_desc(attrs, attr_id, legacy_filler, &desc);
+ if (ret == -ENOENT)
+ desc = (struct ib_uverbs_buffer_desc){
+ .type = IB_UVERBS_BUFFER_TYPE_VA,
+ .addr = addr,
+ .length = size,
+ };
+ else if (ret)
+ return ERR_PTR(ret);
+ return ib_umem_get_desc_check(device, &desc, size, access);
+}
+
/**
* ib_umem_get_va - Pin and DMA map userspace memory.
*
@@ -284,6 +453,65 @@ struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
}
EXPORT_SYMBOL(ib_umem_get_va);
+/**
+ * ib_umem_get_attr - Pin a umem from a per-command UMEM attribute.
+ * @device: IB device.
+ * @attrs: uverbs attribute bundle (may be NULL).
+ * @attr_id: per-command UMEM attribute id.
+ * @size: minimum required umem length.
+ * @access: IB access flags.
+ *
+ * Return: caller-owned umem on success; NULL when no source supplied
+ * a buffer; ERR_PTR(...) on error.
+ */
+struct ib_umem *ib_umem_get_attr(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u16 attr_id, size_t size, int access)
+{
+ return ib_umem_get_from_attrs(device, attrs, attr_id, NULL, size,
+ access);
+}
+EXPORT_SYMBOL(ib_umem_get_attr);
+
+/**
+ * ib_umem_get_attr_or_va - Pin a umem from a per-command UMEM attribute,
+ * falling back to a UHW VA.
+ * @device: IB device.
+ * @attrs: uverbs attribute bundle (may be NULL).
+ * @attr_id: per-command UMEM attribute id.
+ * @addr: UHW user VA used when no per-command attribute matched.
+ * @size: on the attr / legacy paths, the minimum required umem length
+ * validated post-pin; on the VA fallback path, the length to pin.
+ * @access: IB access flags.
+ *
+ * Like ib_umem_get_attr(), but pins @addr/@size when no per-command
+ * UMEM attribute is supplied.
+ *
+ * IMPORTANT: @size is always consumed. On the attr / legacy paths it is
+ * used as the post-pin minimum-length check; on the VA fallback path it
+ * is the length to pin. Callers MUST pass a meaningful, validated value
+ * even when they expect an attribute-supplied buffer to be used.
+ *
+ * Every in-tree caller passes the same value for the two roles of @size
+ * because no driver today distinguishes a user-passed buffer length from
+ * a driver-computed minimum. Drivers that currently accept a user-supplied
+ * length without cross-checking it against a driver minimum (vmw_pvrdma
+ * CQ/QP/SRQ, qedr CQ/QP/SRQ, mana WQ/QP, ionic CQ/QP), once tightened to
+ * compute and check a real minimum, will want to introduce a separate
+ * helper that passes these as distinct values.
+ *
+ * Return: caller-owned umem on success, ERR_PTR(...) on error.
+ */
+struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u16 attr_id, u64 addr, size_t size,
+ int access)
+{
+ return ib_umem_get_from_attrs_or_va(device, attrs, attr_id, NULL, addr,
+ size, access);
+}
+EXPORT_SYMBOL(ib_umem_get_attr_or_va);
+
/**
* ib_umem_release - release pinned memory
* @umem: umem struct to release
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 25e90766892e..0f373679ea81 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -73,10 +73,26 @@ static inline size_t ib_umem_num_pages(struct ib_umem *umem)
{
return ib_umem_num_dma_blocks(umem, PAGE_SIZE);
}
+
+struct ib_udata;
+struct ib_uverbs_buffer_desc;
+struct uverbs_attr_bundle;
+
#ifdef CONFIG_INFINIBAND_USER_MEM
+struct ib_umem *ib_umem_get_desc(struct ib_device *device,
+ const struct ib_uverbs_buffer_desc *desc,
+ int access);
struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
size_t size, int access);
+struct ib_umem *ib_umem_get_attr(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u16 attr_id, size_t size, int access);
+struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u16 attr_id, u64 addr, size_t size,
+ int access);
+
void ib_umem_release(struct ib_umem *umem);
int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length);
@@ -160,12 +176,32 @@ void ib_umem_dmabuf_revoke(struct ib_umem_dmabuf *umem_dmabuf);
#include <linux/err.h>
+static inline struct ib_umem *
+ib_umem_get_desc(struct ib_device *device,
+ const struct ib_uverbs_buffer_desc *desc, int access)
+{
+ return ERR_PTR(-EOPNOTSUPP);
+}
static inline struct ib_umem *ib_umem_get_va(struct ib_device *device,
unsigned long addr, size_t size,
int access)
{
return ERR_PTR(-EOPNOTSUPP);
}
+static inline struct ib_umem *
+ib_umem_get_attr(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs, u16 attr_id,
+ size_t size, int access)
+{
+ return ERR_PTR(-EOPNOTSUPP);
+}
+static inline struct ib_umem *
+ib_umem_get_attr_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs, u16 attr_id,
+ u64 addr, size_t size, int access)
+{
+ return ERR_PTR(-EOPNOTSUPP);
+}
static inline void ib_umem_release(struct ib_umem *umem) { }
static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length) {
diff --git a/include/rdma/uverbs_ioctl.h b/include/rdma/uverbs_ioctl.h
index 9d7575d999e1..24fd36213023 100644
--- a/include/rdma/uverbs_ioctl.h
+++ b/include/rdma/uverbs_ioctl.h
@@ -590,6 +590,28 @@ struct uapi_definition {
UA_OPTIONAL, \
.is_udata = 1)
+/*
+ * Per-attribute UMEM descriptor. The payload is a single
+ * struct ib_uverbs_buffer_desc identifying a memory region backed by
+ * dma-buf or user virtual address. _access selects UA_OPTIONAL or
+ * UA_MANDATORY. Drivers obtain a umem from the attribute via the
+ * ib_umem_get_*() wrapper helpers.
+ */
+#define UVERBS_ATTR_UMEM(_attr_id, _access) \
+ UVERBS_ATTR_PTR_IN(_attr_id, \
+ UVERBS_ATTR_TYPE(struct ib_uverbs_buffer_desc), \
+ _access)
+
+/*
+ * Bit masks of the @flags / @optional_flags fields of struct
+ * ib_uverbs_buffer_desc that the kernel understands. @flags is strict:
+ * any bit outside the known mask makes the call fail with -EINVAL.
+ * @optional_flags is advisory: bits outside the known mask are silently
+ * dropped. Both masks are extended as new bits are introduced.
+ */
+#define IB_UVERBS_BUFFER_DESC_FLAGS_KNOWN_MASK 0U
+#define IB_UVERBS_BUFFER_DESC_OPTIONAL_FLAGS_KNOWN_MASK 0U
+
/* =================================================
* Parsing infrastructure
* =================================================
@@ -862,6 +884,8 @@ int uverbs_get_flags32(u32 *to, const struct uverbs_attr_bundle *attrs_bundle,
size_t idx, u64 allowed_bits);
int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle, size_t idx,
const void *from, size_t size);
+int uverbs_get_buffer_desc(const struct uverbs_attr_bundle *attrs_bundle,
+ u16 attr_id, struct ib_uverbs_buffer_desc *desc);
__malloc void *_uverbs_alloc(struct uverbs_attr_bundle *bundle, size_t size,
gfp_t flags);
@@ -920,6 +944,12 @@ static inline int uverbs_copy_to(const struct uverbs_attr_bundle *attrs_bundle,
{
return -EINVAL;
}
+static inline int
+uverbs_get_buffer_desc(const struct uverbs_attr_bundle *attrs_bundle,
+ u16 attr_id, struct ib_uverbs_buffer_desc *desc)
+{
+ return -EINVAL;
+}
static inline __malloc void *uverbs_alloc(struct uverbs_attr_bundle *bundle,
size_t size)
{
diff --git a/include/uapi/rdma/ib_user_ioctl_verbs.h b/include/uapi/rdma/ib_user_ioctl_verbs.h
index 90c5cd8e7753..51030c27d479 100644
--- a/include/uapi/rdma/ib_user_ioctl_verbs.h
+++ b/include/uapi/rdma/ib_user_ioctl_verbs.h
@@ -273,4 +273,31 @@ struct ib_uverbs_gid_entry {
__u32 netdev_ifindex; /* It is 0 if there is no netdev associated with it */
};
+enum ib_uverbs_buffer_type {
+ IB_UVERBS_BUFFER_TYPE_DMABUF,
+ IB_UVERBS_BUFFER_TYPE_VA,
+};
+
+/*
+ * Describes a single buffer backed by dma-buf or user virtual address.
+ * Used as the payload of a per-attribute UVERBS_ATTR_UMEM-typed attribute.
+ *
+ * @type: buffer type from enum ib_uverbs_buffer_type
+ * @fd: dma-buf file descriptor (valid for IB_UVERBS_BUFFER_TYPE_DMABUF)
+ * @flags: required flags; the kernel rejects the call with -EINVAL if any
+ * bit is not understood. No bits are defined yet.
+ * @optional_flags: advisory flags; bits the kernel does not understand are
+ * silently ignored. No bits are defined yet.
+ * @addr: offset within dma-buf, or user virtual address for VA
+ * @length: buffer length in bytes
+ */
+struct ib_uverbs_buffer_desc {
+ __u32 type;
+ __s32 fd;
+ __u32 flags;
+ __u32 optional_flags;
+ __aligned_u64 addr;
+ __aligned_u64 length;
+};
+
#endif
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [PATCH rdma-next v9 03/16] RDMA/core: Introduce generic buffer descriptor infrastructure for umem
2026-05-29 13:42 ` [PATCH rdma-next v9 03/16] RDMA/core: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
@ 2026-05-29 19:14 ` Jiri Pirko
2026-05-29 19:53 ` Jason Gunthorpe
0 siblings, 1 reply; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 19:14 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
Fri, May 29, 2026 at 03:42:59PM +0200, jiri@resnulli.us wrote:
[..]
>+struct ib_umem *ib_umem_get_desc(struct ib_device *device,
>+ const struct ib_uverbs_buffer_desc *desc,
>+ int access)
>+{
>+ struct ib_umem_dmabuf *umem_dmabuf;
>+
>+ if (desc->flags & ~IB_UVERBS_BUFFER_DESC_FLAGS_KNOWN_MASK)
>+ return ERR_PTR(-EINVAL);
>+
>+ if (overflows_type(desc->addr, unsigned long) ||
>+ overflows_type(desc->length, size_t))
>+ return ERR_PTR(-EOVERFLOW);
Sashiko says:
Does this validation evaluate potentially uninitialized garbage data?
If a user passes an invalid, unsupported, or future buffer type, the
addr and length fields might be uninitialized garbage. Evaluating them
before validating desc->type might cause the kernel to return -EOVERFLOW
instead of -EINVAL, which can break userspace feature probing based on
error codes.
Should this validation be moved inside the cases of the switch statement
that actually use these fields?
Probably this may be hit in case some other type does not use addr
and length (how likely is that?).
I would sanitize it as a follow-up if nobody is oppose that.
[..]
^ permalink raw reply [flat|nested] 20+ messages in thread* Re: [PATCH rdma-next v9 03/16] RDMA/core: Introduce generic buffer descriptor infrastructure for umem
2026-05-29 19:14 ` Jiri Pirko
@ 2026-05-29 19:53 ` Jason Gunthorpe
0 siblings, 0 replies; 20+ messages in thread
From: Jason Gunthorpe @ 2026-05-29 19:53 UTC (permalink / raw)
To: Jiri Pirko
Cc: linux-rdma, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
On Fri, May 29, 2026 at 09:14:50PM +0200, Jiri Pirko wrote:
> Fri, May 29, 2026 at 03:42:59PM +0200, jiri@resnulli.us wrote:
>
> [..]
>
> >+struct ib_umem *ib_umem_get_desc(struct ib_device *device,
> >+ const struct ib_uverbs_buffer_desc *desc,
> >+ int access)
> >+{
> >+ struct ib_umem_dmabuf *umem_dmabuf;
> >+
> >+ if (desc->flags & ~IB_UVERBS_BUFFER_DESC_FLAGS_KNOWN_MASK)
> >+ return ERR_PTR(-EINVAL);
> >+
> >+ if (overflows_type(desc->addr, unsigned long) ||
> >+ overflows_type(desc->length, size_t))
> >+ return ERR_PTR(-EOVERFLOW);
>
> Sashiko says:
> Does this validation evaluate potentially uninitialized garbage data?
> If a user passes an invalid, unsupported, or future buffer type, the
> addr and length fields might be uninitialized garbage. Evaluating them
> before validating desc->type might cause the kernel to return -EOVERFLOW
> instead of -EINVAL, which can break userspace feature probing based on
> error codes.
I guess it is right stylistically but I am not worried about it for
this series.
> Should this validation be moved inside the cases of the switch statement
> that actually use these fields?
It should be moved down into the actual get functions when they check
that addr+length doesn't overflow, it is free to do this check there
and all that is needed is to propogate the desc down the
callchain. That is why I showed it that way in my diff
So it can be touched later, maybe ideally after converting
ib_umem_dmabuf_get_pinned() to all use desc
Jason
^ permalink raw reply [flat|nested] 20+ messages in thread
* [PATCH rdma-next v9 04/16] RDMA/umem: Route ib_umem_get_va() through ib_umem_get_attr_or_va()
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (2 preceding siblings ...)
2026-05-29 13:42 ` [PATCH rdma-next v9 03/16] RDMA/core: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 05/16] RDMA/uverbs: Push out CQ buffer umem processing into a helper Jiri Pirko
` (12 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
ib_umem_get_va() is now redundant: ib_umem_get_attr_or_va() with
attrs=NULL and attr_id=0 covers the exact same path. Make it a static
inline wrapper instead of a separately exported symbol.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- rebased on top of ib_umem_get() made static
v2->v3:
- new patch
---
drivers/infiniband/core/umem.c | 15 ---------------
include/rdma/ib_umem.h | 9 +++++++--
2 files changed, 7 insertions(+), 17 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 7d2256583bc7..680bdbbc5984 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -438,21 +438,6 @@ ib_umem_get_from_attrs_or_va(struct ib_device *device,
return ib_umem_get_desc_check(device, &desc, size, access);
}
-/**
- * ib_umem_get_va - Pin and DMA map userspace memory.
- *
- * @device: IB device to connect UMEM
- * @addr: userspace virtual address to start at
- * @size: length of region to pin
- * @access: IB_ACCESS_xxx flags for memory being pinned
- */
-struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
- size_t size, int access)
-{
- return __ib_umem_get_va(device, addr, size, access);
-}
-EXPORT_SYMBOL(ib_umem_get_va);
-
/**
* ib_umem_get_attr - Pin a umem from a per-command UMEM attribute.
* @device: IB device.
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 0f373679ea81..908eafa52840 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -83,8 +83,6 @@ struct uverbs_attr_bundle;
struct ib_umem *ib_umem_get_desc(struct ib_device *device,
const struct ib_uverbs_buffer_desc *desc,
int access);
-struct ib_umem *ib_umem_get_va(struct ib_device *device, unsigned long addr,
- size_t size, int access);
struct ib_umem *ib_umem_get_attr(struct ib_device *device,
const struct uverbs_attr_bundle *attrs,
u16 attr_id, size_t size, int access);
@@ -93,6 +91,13 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
u16 attr_id, u64 addr, size_t size,
int access);
+static inline struct ib_umem *ib_umem_get_va(struct ib_device *device,
+ unsigned long addr, size_t size,
+ int access)
+{
+ return ib_umem_get_attr_or_va(device, NULL, 0, addr, size, access);
+}
+
void ib_umem_release(struct ib_umem *umem);
int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length);
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 05/16] RDMA/uverbs: Push out CQ buffer umem processing into a helper
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (3 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 04/16] RDMA/umem: Route ib_umem_get_va() through ib_umem_get_attr_or_va() Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 06/16] RDMA/uverbs: Add CQ buffer UMEM attribute and driver helpers Jiri Pirko
` (11 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Extract the UVERBS_ATTR_CREATE_CQ_BUFFER_* parser from the CQ
create handler into uverbs_create_cq_get_buffer_desc(), and wrap
it in ib_umem_get_cq_tmp(), the umem-producing helper the cq_create
handler now calls.
ib_umem_get_cq_tmp() is temporary; subsequent patches replace it
with driver-owned ib_umem_get_cq_buf*() wrappers built on the
same parser, and remove it once all CQ drivers have switched.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- rebased on top of ib_umem_get() made static
v2->v3:
- renamed uverbs_create_cq_get_umem() to ib_umem_get_cq_tmp() and
moved to umem.c
- split legacy attr parser into uverbs_create_cq_get_buffer_desc()
for upcoming ib_umem_get_cq_buf*() reuse
- rebased on top of "RDMA/core: Fix user CQ creation for drivers
without create_cq"
---
drivers/infiniband/core/umem.c | 79 +++++++++++++++++++
drivers/infiniband/core/uverbs_std_types_cq.c | 60 +-------------
include/rdma/ib_umem.h | 7 ++
3 files changed, 89 insertions(+), 57 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index 680bdbbc5984..d364a5ab0558 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -497,6 +497,85 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
}
EXPORT_SYMBOL(ib_umem_get_attr_or_va);
+static int uverbs_create_cq_get_buffer_desc(struct uverbs_attr_bundle *attrs,
+ struct ib_uverbs_buffer_desc *desc)
+{
+ struct ib_device *ib_dev = attrs->context->device;
+ int ret;
+
+ if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_VA)) {
+ ret = uverbs_copy_from(&desc->addr, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUFFER_VA);
+ if (ret)
+ return ret;
+ ret = uverbs_copy_from(&desc->length, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH);
+ if (ret)
+ return ret;
+ if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_FD) ||
+ uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET) ||
+ !ib_dev->ops.create_user_cq)
+ return -EINVAL;
+ desc->type = IB_UVERBS_BUFFER_TYPE_VA;
+ return 0;
+ }
+
+ if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_FD)) {
+ ret = uverbs_get_raw_fd(&desc->fd, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUFFER_FD);
+ if (ret)
+ return ret;
+
+ ret = uverbs_copy_from(&desc->addr, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET);
+ if (ret)
+ return ret;
+ ret = uverbs_copy_from(&desc->length, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH);
+ if (ret)
+ return ret;
+ if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_VA) ||
+ !ib_dev->ops.create_user_cq)
+ return -EINVAL;
+ desc->type = IB_UVERBS_BUFFER_TYPE_DMABUF;
+ return 0;
+ }
+
+ if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET) ||
+ uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH))
+ return -EINVAL;
+ return -ENODATA;
+}
+
+/**
+ * ib_umem_get_cq_tmp - Temporary CQ buffer umem getter.
+ * @device: IB device.
+ * @attrs: uverbs attribute bundle.
+ *
+ * Pins a CQ buffer described by the legacy CQ buffer attributes.
+ * Returns NULL when none are supplied.
+ *
+ * Will be removed once all CQ drivers have switched to get
+ * their buffer directly.
+ *
+ * Return: caller-owned umem on success; NULL when no legacy attribute
+ * is supplied; ERR_PTR(...) on error.
+ */
+struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device,
+ struct uverbs_attr_bundle *attrs)
+{
+ struct ib_uverbs_buffer_desc desc = {};
+ int ret;
+
+ ret = uverbs_create_cq_get_buffer_desc(attrs, &desc);
+ if (ret == -ENODATA)
+ return NULL;
+ if (ret)
+ return ERR_PTR(ret);
+ return ib_umem_get_desc(device, &desc, IB_ACCESS_LOCAL_WRITE);
+}
+EXPORT_SYMBOL(ib_umem_get_cq_tmp);
+
/**
* ib_umem_release - release pinned memory
* @umem: umem struct to release
diff --git a/drivers/infiniband/core/uverbs_std_types_cq.c b/drivers/infiniband/core/uverbs_std_types_cq.c
index 1a6bc8baa52b..711bad0aa8a3 100644
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -66,16 +66,11 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
typeof(*obj), uevent.uobject);
struct ib_uverbs_completion_event_file *ev_file = NULL;
struct ib_device *ib_dev = attrs->context->device;
- struct ib_umem_dmabuf *umem_dmabuf;
struct ib_cq_init_attr attr = {};
struct ib_uobject *ev_file_uobj;
struct ib_umem *umem = NULL;
- u64 buffer_length;
- u64 buffer_offset;
struct ib_cq *cq;
u64 user_handle;
- u64 buffer_va;
- int buffer_fd;
int ret;
if ((!ib_dev->ops.create_cq && !ib_dev->ops.create_user_cq) ||
@@ -122,58 +117,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
INIT_LIST_HEAD(&obj->comp_list);
INIT_LIST_HEAD(&obj->uevent.event_list);
- if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_VA)) {
-
- ret = uverbs_copy_from(&buffer_va, attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_VA);
- if (ret)
- goto err_event_file;
-
- ret = uverbs_copy_from(&buffer_length, attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH);
- if (ret)
- goto err_event_file;
-
- if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_FD) ||
- uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET) ||
- !ib_dev->ops.create_user_cq) {
- ret = -EINVAL;
- goto err_event_file;
- }
-
- umem = ib_umem_get_va(ib_dev, buffer_va, buffer_length, IB_ACCESS_LOCAL_WRITE);
- if (IS_ERR(umem)) {
- ret = PTR_ERR(umem);
- goto err_event_file;
- }
- } else if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_FD)) {
-
- ret = uverbs_get_raw_fd(&buffer_fd, attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_FD);
- if (ret)
- goto err_event_file;
-
- ret = uverbs_copy_from(&buffer_offset, attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET);
- if (ret)
- goto err_event_file;
-
- ret = uverbs_copy_from(&buffer_length, attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH);
- if (ret)
- goto err_event_file;
-
- if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_VA) ||
- !ib_dev->ops.create_user_cq) {
- ret = -EINVAL;
- goto err_event_file;
- }
-
- umem_dmabuf = ib_umem_dmabuf_get_pinned(ib_dev, buffer_offset, buffer_length,
- buffer_fd, IB_ACCESS_LOCAL_WRITE);
- if (IS_ERR(umem_dmabuf)) {
- ret = PTR_ERR(umem_dmabuf);
- goto err_event_file;
- }
- umem = &umem_dmabuf->umem;
- } else if (uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET) ||
- uverbs_attr_is_valid(attrs, UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH)) {
- ret = -EINVAL;
+ umem = ib_umem_get_cq_tmp(ib_dev, attrs);
+ if (IS_ERR(umem)) {
+ ret = PTR_ERR(umem);
goto err_event_file;
}
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 908eafa52840..0d6e90a35f3a 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -90,6 +90,8 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
const struct uverbs_attr_bundle *attrs,
u16 attr_id, u64 addr, size_t size,
int access);
+struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device,
+ struct uverbs_attr_bundle *attrs);
static inline struct ib_umem *ib_umem_get_va(struct ib_device *device,
unsigned long addr, size_t size,
@@ -207,6 +209,11 @@ ib_umem_get_attr_or_va(struct ib_device *device,
{
return ERR_PTR(-EOPNOTSUPP);
}
+static inline struct ib_umem *
+ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs)
+{
+ return ERR_PTR(-EOPNOTSUPP);
+}
static inline void ib_umem_release(struct ib_umem *umem) { }
static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length) {
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 06/16] RDMA/uverbs: Add CQ buffer UMEM attribute and driver helpers
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (4 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 05/16] RDMA/uverbs: Push out CQ buffer umem processing into a helper Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 07/16] RDMA/efa: Use ib_umem_get_cq_buf() for user CQ buffer Jiri Pirko
` (10 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Add UVERBS_ATTR_CREATE_CQ_BUF_UMEM and two driver-facing
wrappers, ib_umem_get_cq_buf() and ib_umem_get_cq_buf_or_va(),
that pin a CQ buffer umem from it. The wrappers reuse the
existing legacy CQ buffer-attr filler.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
- use ib_umem_get_from_attrs*() helpers
v2->v3:
- new patch
---
drivers/infiniband/core/umem.c | 57 ++++++++++++++++++-
drivers/infiniband/core/uverbs_std_types_cq.c | 2 +
include/rdma/ib_umem.h | 20 +++++++
include/uapi/rdma/ib_user_ioctl_cmds.h | 1 +
4 files changed, 79 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index d364a5ab0558..b3261b924a71 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -497,7 +497,7 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
}
EXPORT_SYMBOL(ib_umem_get_attr_or_va);
-static int uverbs_create_cq_get_buffer_desc(struct uverbs_attr_bundle *attrs,
+static int uverbs_create_cq_get_buffer_desc(const struct uverbs_attr_bundle *attrs,
struct ib_uverbs_buffer_desc *desc)
{
struct ib_device *ib_dev = attrs->context->device;
@@ -547,6 +547,61 @@ static int uverbs_create_cq_get_buffer_desc(struct uverbs_attr_bundle *attrs,
return -ENODATA;
}
+/**
+ * ib_umem_get_cq_buf - Pin a CQ buffer umem from per-command attributes.
+ * @device: IB device.
+ * @attrs: uverbs attribute bundle (may be NULL).
+ * @size: minimum required CQ buffer length.
+ * @access: IB access flags.
+ *
+ * Resolves the CQ buffer from the new UMEM attribute or the legacy
+ * CQ buffer attributes. There is no UHW VA fallback, so the caller
+ * must arrange its own backing (typically an in-kernel allocation)
+ * when no source is available.
+ *
+ * Return: caller-owned umem on success; NULL when no source supplied
+ * a buffer; ERR_PTR(...) on error.
+ */
+struct ib_umem *ib_umem_get_cq_buf(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ size_t size, int access)
+{
+ return ib_umem_get_from_attrs(device, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUF_UMEM,
+ uverbs_create_cq_get_buffer_desc,
+ size, access);
+}
+EXPORT_SYMBOL(ib_umem_get_cq_buf);
+
+/**
+ * ib_umem_get_cq_buf_or_va - Pin a CQ buffer umem with UHW VA fallback.
+ * @device: IB device.
+ * @attrs: uverbs attribute bundle (may be NULL).
+ * @addr: UHW user VA used when no per-command attribute matched.
+ * @size: on the attr / legacy paths, the minimum required umem length
+ * validated post-pin; on the VA fallback path, the length to pin.
+ * @access: IB access flags.
+ *
+ * Like ib_umem_get_cq_buf(), but pins @addr/@size when neither the
+ * UMEM attribute nor the legacy CQ buffer attributes are supplied.
+ *
+ * See ib_umem_get_attr_or_va() for the note on @size's dual role and
+ * the migration path for drivers that would distinguish a user-supplied
+ * length from a driver-computed minimum.
+ *
+ * Return: caller-owned umem on success, ERR_PTR(...) on error.
+ */
+struct ib_umem *ib_umem_get_cq_buf_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u64 addr, size_t size, int access)
+{
+ return ib_umem_get_from_attrs_or_va(device, attrs,
+ UVERBS_ATTR_CREATE_CQ_BUF_UMEM,
+ uverbs_create_cq_get_buffer_desc,
+ addr, size, access);
+}
+EXPORT_SYMBOL(ib_umem_get_cq_buf_or_va);
+
/**
* ib_umem_get_cq_tmp - Temporary CQ buffer umem getter.
* @device: IB device.
diff --git a/drivers/infiniband/core/uverbs_std_types_cq.c b/drivers/infiniband/core/uverbs_std_types_cq.c
index 711bad0aa8a3..05d1294762c0 100644
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -215,6 +215,8 @@ DECLARE_UVERBS_NAMED_METHOD(
UVERBS_ATTR_PTR_IN(UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET,
UVERBS_ATTR_TYPE(u64),
UA_OPTIONAL),
+ UVERBS_ATTR_UMEM(UVERBS_ATTR_CREATE_CQ_BUF_UMEM,
+ UA_OPTIONAL),
UVERBS_ATTR_UHW());
static int UVERBS_HANDLER(UVERBS_METHOD_CQ_DESTROY)(
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 0d6e90a35f3a..492c8d365730 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -90,6 +90,12 @@ struct ib_umem *ib_umem_get_attr_or_va(struct ib_device *device,
const struct uverbs_attr_bundle *attrs,
u16 attr_id, u64 addr, size_t size,
int access);
+struct ib_umem *ib_umem_get_cq_buf(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ size_t size, int access);
+struct ib_umem *ib_umem_get_cq_buf_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs,
+ u64 addr, size_t size, int access);
struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device,
struct uverbs_attr_bundle *attrs);
@@ -210,6 +216,20 @@ ib_umem_get_attr_or_va(struct ib_device *device,
return ERR_PTR(-EOPNOTSUPP);
}
static inline struct ib_umem *
+ib_umem_get_cq_buf(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs, size_t size,
+ int access)
+{
+ return ERR_PTR(-EOPNOTSUPP);
+}
+static inline struct ib_umem *
+ib_umem_get_cq_buf_or_va(struct ib_device *device,
+ const struct uverbs_attr_bundle *attrs, u64 addr,
+ size_t size, int access)
+{
+ return ERR_PTR(-EOPNOTSUPP);
+}
+static inline struct ib_umem *
ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs)
{
return ERR_PTR(-EOPNOTSUPP);
diff --git a/include/uapi/rdma/ib_user_ioctl_cmds.h b/include/uapi/rdma/ib_user_ioctl_cmds.h
index 72041c1b0ea5..02835b7fd76d 100644
--- a/include/uapi/rdma/ib_user_ioctl_cmds.h
+++ b/include/uapi/rdma/ib_user_ioctl_cmds.h
@@ -117,6 +117,7 @@ enum uverbs_attrs_create_cq_cmd_attr_ids {
UVERBS_ATTR_CREATE_CQ_BUFFER_LENGTH,
UVERBS_ATTR_CREATE_CQ_BUFFER_FD,
UVERBS_ATTR_CREATE_CQ_BUFFER_OFFSET,
+ UVERBS_ATTR_CREATE_CQ_BUF_UMEM,
};
enum uverbs_attrs_destroy_cq_cmd_attr_ids {
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 07/16] RDMA/efa: Use ib_umem_get_cq_buf() for user CQ buffer
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (5 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 06/16] RDMA/uverbs: Add CQ buffer UMEM attribute and driver helpers Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 08/16] RDMA/mlx5: Use ib_umem_get_cq_buf_or_va() " Jiri Pirko
` (9 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf() and take
ownership of the umem in the driver. Fall back to the
existing kernel-DMA path on NULL.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v2->v3:
- used ib_umem_get_cq_buf() to get umem, stored in efa_cq->umem
- replaced ib_umem_release_non_listed() with ib_umem_release()
- added release to efa_destroy_cq() and new error path
---
drivers/infiniband/hw/efa/efa_verbs.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 8d97a837fa6a..434d60235945 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1049,6 +1049,7 @@ int efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata)
if (cq->cpu_addr)
efa_free_mapped(dev, cq->cpu_addr, cq->dma_addr, cq->size, DMA_FROM_DEVICE);
+ ib_umem_release(cq->umem);
return 0;
}
@@ -1101,6 +1102,7 @@ int efa_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
struct efa_ibv_create_cq cmd;
struct efa_cq *cq = to_ecq(ibcq);
int entries = attr->cqe;
+ struct ib_umem *umem;
bool set_src_addr;
int err;
@@ -1149,26 +1151,29 @@ int efa_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
cq->ucontext = ucontext;
cq->size = PAGE_ALIGN(cmd.cq_entry_size * entries * cmd.num_sub_cqs);
- if (ibcq->umem) {
- if (ibcq->umem->length < cq->size) {
- ibdev_dbg(&dev->ibdev, "External memory too small\n");
- err = -EINVAL;
- goto err_out;
- }
+ umem = ib_umem_get_cq_buf(ibcq->device, attrs, cq->size,
+ IB_ACCESS_LOCAL_WRITE);
+ if (IS_ERR(umem)) {
+ err = PTR_ERR(umem);
+ goto err_out;
+ }
+
+ cq->umem = umem;
- if (!ib_umem_is_contiguous(ibcq->umem)) {
+ if (umem) {
+ if (!ib_umem_is_contiguous(umem)) {
ibdev_dbg(&dev->ibdev, "Non contiguous CQ unsupported\n");
err = -EINVAL;
- goto err_out;
+ goto err_release_umem;
}
- cq->dma_addr = ib_umem_start_dma_addr(ibcq->umem);
+ cq->dma_addr = ib_umem_start_dma_addr(umem);
} else {
cq->cpu_addr = efa_zalloc_mapped(dev, &cq->dma_addr, cq->size,
DMA_FROM_DEVICE);
if (!cq->cpu_addr) {
err = -ENOMEM;
- goto err_out;
+ goto err_release_umem;
}
}
@@ -1235,6 +1240,8 @@ int efa_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr,
if (cq->cpu_addr)
efa_free_mapped(dev, cq->cpu_addr, cq->dma_addr, cq->size,
DMA_FROM_DEVICE);
+err_release_umem:
+ ib_umem_release(cq->umem);
err_out:
atomic64_inc(&dev->stats.create_cq_err);
return err;
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 08/16] RDMA/mlx5: Use ib_umem_get_cq_buf_or_va() for user CQ buffer
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (6 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 07/16] RDMA/efa: Use ib_umem_get_cq_buf() for user CQ buffer Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 09/16] RDMA/bnxt_re: " Jiri Pirko
` (8 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf_or_va() and take
ownership of the umem in the driver. Apply the same ownership
pattern to the resize path.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v2->v3:
- used ib_umem_get_cq_buf_or_va() to get umem, stored in cq->buf.umem
- replaced ib_umem_release_non_listed() with ib_umem_release()
- added release to destroy_cq_user() and the resize error path
---
drivers/infiniband/hw/mlx5/cq.c | 27 ++++++++++++++-------------
1 file changed, 14 insertions(+), 13 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 5a89676ebeb2..e8f8fcc106c8 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -746,15 +746,15 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata,
*cqe_size = ucmd.cqe_size;
- if (!cq->ibcq.umem)
- cq->ibcq.umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
- entries * ucmd.cqe_size,
- IB_ACCESS_LOCAL_WRITE);
- if (IS_ERR(cq->ibcq.umem))
- return PTR_ERR(cq->ibcq.umem);
+ cq->buf.umem = ib_umem_get_cq_buf_or_va(&dev->ib_dev, attrs,
+ ucmd.buf_addr,
+ entries * ucmd.cqe_size,
+ IB_ACCESS_LOCAL_WRITE);
+ if (IS_ERR(cq->buf.umem))
+ return PTR_ERR(cq->buf.umem);
page_size = mlx5_umem_find_best_cq_quantized_pgoff(
- cq->ibcq.umem, cqc, log_page_size, MLX5_ADAPTER_PAGE_SHIFT,
+ cq->buf.umem, cqc, log_page_size, MLX5_ADAPTER_PAGE_SHIFT,
page_offset, 64, &page_offset_quantized);
if (!page_size) {
err = -EINVAL;
@@ -765,12 +765,12 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata,
if (err)
goto err_umem;
- ncont = ib_umem_num_dma_blocks(cq->ibcq.umem, page_size);
+ ncont = ib_umem_num_dma_blocks(cq->buf.umem, page_size);
mlx5_ib_dbg(
dev,
"addr 0x%llx, size %u, npages %zu, page_size %lu, ncont %d\n",
ucmd.buf_addr, entries * ucmd.cqe_size,
- ib_umem_num_pages(cq->ibcq.umem), page_size, ncont);
+ ib_umem_num_pages(cq->buf.umem), page_size, ncont);
*inlen = MLX5_ST_SZ_BYTES(create_cq_in) +
MLX5_FLD_SZ_BYTES(create_cq_in, pas[0]) * ncont;
@@ -781,7 +781,7 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata,
}
pas = (__be64 *)MLX5_ADDR_OF(create_cq_in, *cqb, pas);
- mlx5_ib_populate_pas(cq->ibcq.umem, page_size, pas, 0);
+ mlx5_ib_populate_pas(cq->buf.umem, page_size, pas, 0);
cqc = MLX5_ADDR_OF(create_cq_in, *cqb, cq_context);
MLX5_SET(cqc, cqc, log_page_size,
@@ -854,7 +854,7 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata,
mlx5_ib_db_unmap_user(context, &cq->db);
err_umem:
- /* UMEM is released by ib_core */
+ ib_umem_release(cq->buf.umem);
return err;
}
@@ -864,6 +864,7 @@ static void destroy_cq_user(struct mlx5_ib_cq *cq, struct ib_udata *udata)
udata, struct mlx5_ib_ucontext, ibucontext);
mlx5_ib_db_unmap_user(context, &cq->db);
+ ib_umem_release(cq->buf.umem);
}
static void init_cq_frag_buf(struct mlx5_ib_cq_buf *buf)
@@ -1436,8 +1437,8 @@ int mlx5_ib_resize_cq(struct ib_cq *ibcq, unsigned int entries,
if (udata) {
cq->ibcq.cqe = entries - 1;
- ib_umem_release(cq->ibcq.umem);
- cq->ibcq.umem = cq->resize_umem;
+ ib_umem_release(cq->buf.umem);
+ cq->buf.umem = cq->resize_umem;
cq->resize_umem = NULL;
} else {
struct mlx5_ib_cq_buf tbuf;
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 09/16] RDMA/bnxt_re: Use ib_umem_get_cq_buf_or_va() for user CQ buffer
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (7 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 08/16] RDMA/mlx5: Use ib_umem_get_cq_buf_or_va() " Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 10/16] RDMA/mlx4: Use ib_umem_get_cq_buf() " Jiri Pirko
` (7 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf_or_va() and take
ownership of the umem in the driver. Apply the same ownership
pattern to the resize path.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v2->v3:
- used ib_umem_get_cq_buf_or_va() to get umem, stored in new
struct bnxt_re_cq field cq->umem
- replaced ib_umem_release_non_listed() with ib_umem_release()
- added release to bnxt_re_destroy_cq() and the resize error path
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 35 +++++++++++++-----------
drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 +
2 files changed, 20 insertions(+), 16 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 5e8fa7bf99cb..c1c4ddc615e2 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -3455,6 +3455,7 @@ int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata)
atomic_dec(&rdev->stats.res.cq_count);
kfree(cq->cql);
+ ib_umem_release(cq->umem);
return ib_respond_empty_udata(udata);
}
@@ -3495,17 +3496,15 @@ int bnxt_re_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *att
entries = bnxt_re_init_depth(attr->cqe + 1,
dev_attr->max_cq_wqes + 1, uctx);
- if (!ibcq->umem) {
- ibcq->umem = ib_umem_get_va(&rdev->ibdev, req.cq_va,
+ cq->umem = ib_umem_get_cq_buf_or_va(&rdev->ibdev, attrs, req.cq_va,
entries * sizeof(struct cq_base),
IB_ACCESS_LOCAL_WRITE);
- if (IS_ERR(ibcq->umem))
- return PTR_ERR(ibcq->umem);
- }
+ if (IS_ERR(cq->umem))
+ return PTR_ERR(cq->umem);
- rc = bnxt_re_setup_sginfo(rdev, ibcq->umem, &cq->qplib_cq.sg_info);
+ rc = bnxt_re_setup_sginfo(rdev, cq->umem, &cq->qplib_cq.sg_info);
if (rc)
- return rc;
+ goto free_umem;
cq->qplib_cq.dpi = &uctx->dpi;
cq->qplib_cq.max_wqe = entries;
@@ -3515,7 +3514,7 @@ int bnxt_re_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *att
rc = bnxt_qplib_create_cq(&rdev->qplib_res, &cq->qplib_cq);
if (rc)
- return rc;
+ goto free_umem;
cq->ib_cq.cqe = entries;
cq->cq_period = cq->qplib_cq.period;
@@ -3528,8 +3527,10 @@ int bnxt_re_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *att
hash_add(rdev->cq_hash, &cq->hash_entry, cq->qplib_cq.id);
/* Allocate a page */
cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL);
- if (!cq->uctx_cq_page)
- return -ENOMEM;
+ if (!cq->uctx_cq_page) {
+ rc = -ENOMEM;
+ goto destroy_cq;
+ }
resp.comp_mask |= BNXT_RE_CQ_TOGGLE_PAGE_SUPPORT;
}
@@ -3537,15 +3538,17 @@ int bnxt_re_create_user_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *att
resp.tail = cq->qplib_cq.hwq.cons;
resp.phase = cq->qplib_cq.period;
rc = ib_respond_udata(udata, resp);
- if (rc) {
- bnxt_qplib_destroy_cq(&rdev->qplib_res, &cq->qplib_cq);
+ if (rc)
goto free_mem;
- }
return 0;
free_mem:
free_page((unsigned long)cq->uctx_cq_page);
+destroy_cq:
+ bnxt_qplib_destroy_cq(&rdev->qplib_res, &cq->qplib_cq);
+free_umem:
+ ib_umem_release(cq->umem);
return rc;
}
@@ -3609,8 +3612,8 @@ static void bnxt_re_resize_cq_complete(struct bnxt_re_cq *cq)
cq->qplib_cq.max_wqe = cq->resize_cqe;
if (cq->resize_umem) {
- ib_umem_release(cq->ib_cq.umem);
- cq->ib_cq.umem = cq->resize_umem;
+ ib_umem_release(cq->umem);
+ cq->umem = cq->resize_umem;
cq->resize_umem = NULL;
cq->resize_cqe = 0;
}
@@ -4206,7 +4209,7 @@ int bnxt_re_poll_cq(struct ib_cq *ib_cq, int num_entries, struct ib_wc *wc)
/* User CQ; the only processing we do is to
* complete any pending CQ resize operation.
*/
- if (cq->ib_cq.umem) {
+ if (cq->umem) {
if (cq->resize_umem)
bnxt_re_resize_cq_complete(cq);
return 0;
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
index ebc393e6da4f..4d6d1259a795 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h
@@ -109,6 +109,7 @@ struct bnxt_re_cq {
struct bnxt_qplib_cqe *cql;
#define MAX_CQL_PER_POLL 1024
u32 max_cql;
+ struct ib_umem *umem;
struct ib_umem *resize_umem;
int resize_cqe;
void *uctx_cq_page;
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 10/16] RDMA/mlx4: Use ib_umem_get_cq_buf() for user CQ buffer
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (8 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 09/16] RDMA/bnxt_re: " Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 11/16] RDMA/uverbs: Remove legacy umem field from struct ib_cq Jiri Pirko
` (6 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Pin the user CQ buffer with ib_umem_get_cq_buf() and take
ownership of the umem in the driver; fall back to
ib_umem_get_va() for the legacy UHW VA path. Apply the same
ownership pattern to the resize path.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v2->v3:
- used ib_umem_get_cq_buf() to get umem, with ib_umem_get_va()
as the legacy UHW VA fallback; stored in new struct mlx4_ib_cq
field cq->umem
- replaced ib_umem_release_non_listed() with ib_umem_release()
- added release to mlx4_ib_destroy_cq(), the create error path
and the resize error path
v1->v2:
- rebase on top of Leon's fix
---
drivers/infiniband/hw/mlx4/cq.c | 50 +++++++++++++++++-----------
drivers/infiniband/hw/mlx4/mlx4_ib.h | 1 +
2 files changed, 31 insertions(+), 20 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index f9ec6917d9c9..887912469742 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -173,32 +173,40 @@ int mlx4_ib_create_user_cq(struct ib_cq *ibcq,
if (err)
goto err_cq;
- if (ibcq->umem &&
- (dev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_SW_CQ_INIT))
- return -EOPNOTSUPP;
-
- buf_addr = (void *)(unsigned long)ucmd.buf_addr;
-
- if (!ibcq->umem)
- ibcq->umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
- entries * cqe_size,
- IB_ACCESS_LOCAL_WRITE);
- if (IS_ERR(ibcq->umem)) {
- err = PTR_ERR(ibcq->umem);
+ cq->umem = ib_umem_get_cq_buf(&dev->ib_dev, attrs, entries * cqe_size,
+ IB_ACCESS_LOCAL_WRITE);
+ if (IS_ERR(cq->umem)) {
+ err = PTR_ERR(cq->umem);
goto err_cq;
}
+ if (cq->umem) {
+ if (dev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_SW_CQ_INIT) {
+ err = -EOPNOTSUPP;
+ goto err_umem;
+ }
+ } else {
+ cq->umem = ib_umem_get_va(&dev->ib_dev, ucmd.buf_addr,
+ entries * cqe_size,
+ IB_ACCESS_LOCAL_WRITE);
+ if (IS_ERR(cq->umem)) {
+ err = PTR_ERR(cq->umem);
+ goto err_cq;
+ }
+ }
- shift = mlx4_ib_umem_calc_optimal_mtt_size(cq->ibcq.umem, 0, &n);
+ buf_addr = (void *)(unsigned long)ucmd.buf_addr;
+
+ shift = mlx4_ib_umem_calc_optimal_mtt_size(cq->umem, 0, &n);
if (shift < 0) {
err = shift;
- goto err_cq;
+ goto err_umem;
}
err = mlx4_mtt_init(dev->dev, n, shift, &cq->buf.mtt);
if (err)
- goto err_cq;
+ goto err_umem;
- err = mlx4_ib_umem_write_mtt(dev, &cq->buf.mtt, cq->ibcq.umem);
+ err = mlx4_ib_umem_write_mtt(dev, &cq->buf.mtt, cq->umem);
if (err)
goto err_mtt;
@@ -235,7 +243,9 @@ int mlx4_ib_create_user_cq(struct ib_cq *ibcq,
err_mtt:
mlx4_mtt_cleanup(dev->dev, &cq->buf.mtt);
- /* UMEM is released by ib_core */
+
+err_umem:
+ ib_umem_release(cq->umem);
err_cq:
return err;
@@ -472,8 +482,8 @@ int mlx4_ib_resize_cq(struct ib_cq *ibcq, unsigned int entries,
if (ibcq->uobject) {
cq->buf = cq->resize_buf->buf;
cq->ibcq.cqe = cq->resize_buf->cqe;
- ib_umem_release(cq->ibcq.umem);
- cq->ibcq.umem = cq->resize_umem;
+ ib_umem_release(cq->umem);
+ cq->umem = cq->resize_umem;
kfree(cq->resize_buf);
cq->resize_buf = NULL;
@@ -533,7 +543,7 @@ int mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata)
struct mlx4_ib_ucontext,
ibucontext),
&mcq->db);
- /* UMEM is released by ib_core */
+ ib_umem_release(mcq->umem);
} else {
mlx4_ib_free_cq_buf(dev, &mcq->buf, cq->cqe);
mlx4_db_free(dev->dev, &mcq->db);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 5a799d6df93e..598954dd0613 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -121,6 +121,7 @@ struct mlx4_ib_cq {
struct mlx4_db db;
spinlock_t lock;
struct mutex resize_mutex;
+ struct ib_umem *umem;
struct ib_umem *resize_umem;
/* List of qps that it serves.*/
struct list_head send_qp_list;
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 11/16] RDMA/uverbs: Remove legacy umem field from struct ib_cq
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (9 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 10/16] RDMA/mlx4: Use ib_umem_get_cq_buf() " Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 12/16] RDMA/uverbs: Use UMEM attributes for QP creation Jiri Pirko
` (5 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Now that all drivers use helper to get umem and manage the lifetime,
legacy umem field in struct ib_cq is no longer needed. Remove it
along with ib_umem_get_cq_tmp() helper that populated it and both
error and destroy paths.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v2->v3:
- rebased on top of umem_list removal
---
drivers/infiniband/core/umem.c | 29 -------------------
drivers/infiniband/core/uverbs_cmd.c | 1 -
drivers/infiniband/core/uverbs_std_types_cq.c | 17 -----------
drivers/infiniband/core/verbs.c | 7 -----
include/rdma/ib_umem.h | 7 -----
include/rdma/ib_verbs.h | 1 -
6 files changed, 62 deletions(-)
diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
index b3261b924a71..89311fe65619 100644
--- a/drivers/infiniband/core/umem.c
+++ b/drivers/infiniband/core/umem.c
@@ -602,35 +602,6 @@ struct ib_umem *ib_umem_get_cq_buf_or_va(struct ib_device *device,
}
EXPORT_SYMBOL(ib_umem_get_cq_buf_or_va);
-/**
- * ib_umem_get_cq_tmp - Temporary CQ buffer umem getter.
- * @device: IB device.
- * @attrs: uverbs attribute bundle.
- *
- * Pins a CQ buffer described by the legacy CQ buffer attributes.
- * Returns NULL when none are supplied.
- *
- * Will be removed once all CQ drivers have switched to get
- * their buffer directly.
- *
- * Return: caller-owned umem on success; NULL when no legacy attribute
- * is supplied; ERR_PTR(...) on error.
- */
-struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device,
- struct uverbs_attr_bundle *attrs)
-{
- struct ib_uverbs_buffer_desc desc = {};
- int ret;
-
- ret = uverbs_create_cq_get_buffer_desc(attrs, &desc);
- if (ret == -ENODATA)
- return NULL;
- if (ret)
- return ERR_PTR(ret);
- return ib_umem_get_desc(device, &desc, IB_ACCESS_LOCAL_WRITE);
-}
-EXPORT_SYMBOL(ib_umem_get_cq_tmp);
-
/**
* ib_umem_release - release pinned memory
* @umem: umem struct to release
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 32914007bae6..86df7ec83b3a 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1084,7 +1084,6 @@ static int create_cq(struct uverbs_attr_bundle *attrs,
return uverbs_response(attrs, &resp, sizeof(resp));
err_free:
- ib_umem_release(cq->umem);
rdma_restrack_put(&cq->res);
kfree(cq);
err_file:
diff --git a/drivers/infiniband/core/uverbs_std_types_cq.c b/drivers/infiniband/core/uverbs_std_types_cq.c
index 05d1294762c0..148cdd180dab 100644
--- a/drivers/infiniband/core/uverbs_std_types_cq.c
+++ b/drivers/infiniband/core/uverbs_std_types_cq.c
@@ -68,7 +68,6 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
struct ib_device *ib_dev = attrs->context->device;
struct ib_cq_init_attr attr = {};
struct ib_uobject *ev_file_uobj;
- struct ib_umem *umem = NULL;
struct ib_cq *cq;
u64 user_handle;
int ret;
@@ -117,16 +116,9 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
INIT_LIST_HEAD(&obj->comp_list);
INIT_LIST_HEAD(&obj->uevent.event_list);
- umem = ib_umem_get_cq_tmp(ib_dev, attrs);
- if (IS_ERR(umem)) {
- ret = PTR_ERR(umem);
- goto err_event_file;
- }
-
cq = rdma_zalloc_drv_obj(ib_dev, ib_cq);
if (!cq) {
ret = -ENOMEM;
- ib_umem_release(umem);
goto err_event_file;
}
@@ -135,11 +127,6 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
cq->comp_handler = ib_uverbs_comp_handler;
cq->event_handler = ib_uverbs_cq_event_handler;
cq->cq_context = ev_file ? &ev_file->ev_queue : NULL;
- /*
- * If UMEM is not provided here, legacy drivers will set it during
- * CQ creation based on their internal udata.
- */
- cq->umem = umem;
atomic_set(&cq->usecnt, 0);
rdma_restrack_new(&cq->res, RDMA_RESTRACK_CQ);
@@ -152,9 +139,6 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
if (ret)
goto err_free;
- /* Check that driver didn't overrun existing umem */
- WARN_ON(umem && cq->umem != umem);
-
obj->uevent.uobject.object = cq;
obj->uevent.uobject.user_handle = user_handle;
rdma_restrack_add(&cq->res);
@@ -165,7 +149,6 @@ static int UVERBS_HANDLER(UVERBS_METHOD_CQ_CREATE)(
return ret;
err_free:
- ib_umem_release(cq->umem);
rdma_restrack_put(&cq->res);
kfree(cq);
err_event_file:
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index bac87de9cc67..de7d19fabd75 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2221,12 +2221,6 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
kfree(cq);
return ERR_PTR(ret);
}
- /*
- * We are in kernel verbs flow and drivers are not allowed
- * to set umem pointer, it needs to stay NULL.
- */
- WARN_ON_ONCE(cq->umem);
-
rdma_restrack_add(&cq->res);
return cq;
}
@@ -2257,7 +2251,6 @@ int ib_destroy_cq_user(struct ib_cq *cq, struct ib_udata *udata)
if (ret)
return ret;
- ib_umem_release(cq->umem);
rdma_restrack_del(&cq->res);
kfree(cq);
return ret;
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 492c8d365730..370d802f0e63 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -96,8 +96,6 @@ struct ib_umem *ib_umem_get_cq_buf(struct ib_device *device,
struct ib_umem *ib_umem_get_cq_buf_or_va(struct ib_device *device,
const struct uverbs_attr_bundle *attrs,
u64 addr, size_t size, int access);
-struct ib_umem *ib_umem_get_cq_tmp(struct ib_device *device,
- struct uverbs_attr_bundle *attrs);
static inline struct ib_umem *ib_umem_get_va(struct ib_device *device,
unsigned long addr, size_t size,
@@ -229,11 +227,6 @@ ib_umem_get_cq_buf_or_va(struct ib_device *device,
{
return ERR_PTR(-EOPNOTSUPP);
}
-static inline struct ib_umem *
-ib_umem_get_cq_tmp(struct ib_device *device, struct uverbs_attr_bundle *attrs)
-{
- return ERR_PTR(-EOPNOTSUPP);
-}
static inline void ib_umem_release(struct ib_umem *umem) { }
static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset,
size_t length) {
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 01e0eea0703f..893cb5b73951 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -1738,7 +1738,6 @@ struct ib_cq {
u8 interrupt:1;
u8 shared:1;
unsigned int comp_vector;
- struct ib_umem *umem;
/*
* Implementation details of the RDMA core, don't use in drivers:
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 12/16] RDMA/uverbs: Use UMEM attributes for QP creation
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (10 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 11/16] RDMA/uverbs: Remove legacy umem field from struct ib_cq Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 13/16] RDMA/mlx5: Use UMEM attributes for QP buffers in create_qp Jiri Pirko
` (4 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Apply the per-attribute UMEM model to the QP create method. Add
three optional UMEM attributes that drivers pick from based on
how their user ABI lays out the QP rings:
- CREATE_QP_BUF_UMEM is a single user buffer that backs both
the SQ and RQ of one QP. This is the common case where
userspace pins one contiguous WQE region for the QP.
- CREATE_QP_SQ_BUF_UMEM and CREATE_QP_RQ_BUF_UMEM are a pair
of user buffers backing the SQ and RQ independently, used
when the two rings live in physically distinct user
allocations and must be pinned and addressed separately.
Existing drivers would map their current umems as follows:
- mlx5: BUF for normal QPs (one ucmd->buf_addr covers SQ+RQ);
for IB_QPT_RAW_PACKET and IB_QP_CREATE_SOURCE_QPN, the RQ
side comes from ucmd->buf_addr (RQ-sized) via RQ_BUF and
the SQ from ucmd->sq_buf_addr via SQ_BUF.
- mlx4: BUF, single ucmd.buf_addr covering SQ+RQ.
- hns: BUF, single ucmd.buf_addr covering SQ + ext-SGE + RQ.
- erdma: BUF, single ureq.qbuf_va sliced by the kernel into
SQ at offset 0 and RQ at rq_offset.
- bnxt_re: SQ_BUF (ureq->qpsva) + RQ_BUF (ureq->qprva, the
RQ side is skipped when the QP uses an SRQ).
- vmw_pvrdma: SQ_BUF (sbuf_addr) + RQ_BUF (rbuf_addr, the RQ
side is skipped when the QP uses an SRQ).
- qedr: SQ_BUF (sq_addr) + RQ_BUF (rq_addr) for whichever
side the QP type actually has (no SQ for XRC_TGT/GSI; no
RQ for XRC_INI/XRC_TGT/SRQ).
- ionic: SQ_BUF (req.sq.addr) + RQ_BUF (req.rq.addr); both
are skipped when the rings are placed in CMB instead of
host memory.
- mana: raw-packet QP uses SQ_BUF (sq_buf_addr) only; the RC
path uses multiple per-queue user buffers (ucmd.queue_buf[])
that do not fit the SQ/RQ pair semantics of these attrs and
stays on the legacy UHW path.
- efa, irdma, hfi1, ocrdma, mthca, cxgb4 and usnic do not pin
a QP WQE buffer via umem; none of these attributes apply.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v3->v4:
- extended patch description with BUF vs SQ_BUF/RQ_BUF semantics
and per-driver attr usage mapping
v2->v3:
- replaced the array-form UVERBS_ATTR_BUFFERS attribute and its
uverbs_buf_qp_slots enum with per-attribute UMEM attrs
- dropped qp->umem_list field, handler allocation, write-path NULL
arg, and the umem_list parameter on ib_create_qp_user()
v1->v2:
- fixed umem_list double free
---
drivers/infiniband/core/uverbs_std_types_qp.c | 6 ++++++
include/uapi/rdma/ib_user_ioctl_cmds.h | 3 +++
2 files changed, 9 insertions(+)
diff --git a/drivers/infiniband/core/uverbs_std_types_qp.c b/drivers/infiniband/core/uverbs_std_types_qp.c
index be0730e8509e..e44974abc6b5 100644
--- a/drivers/infiniband/core/uverbs_std_types_qp.c
+++ b/drivers/infiniband/core/uverbs_std_types_qp.c
@@ -340,6 +340,12 @@ DECLARE_UVERBS_NAMED_METHOD(
UVERBS_ATTR_PTR_OUT(UVERBS_ATTR_CREATE_QP_RESP_QP_NUM,
UVERBS_ATTR_TYPE(u32),
UA_MANDATORY),
+ UVERBS_ATTR_UMEM(UVERBS_ATTR_CREATE_QP_BUF_UMEM,
+ UA_OPTIONAL),
+ UVERBS_ATTR_UMEM(UVERBS_ATTR_CREATE_QP_RQ_BUF_UMEM,
+ UA_OPTIONAL),
+ UVERBS_ATTR_UMEM(UVERBS_ATTR_CREATE_QP_SQ_BUF_UMEM,
+ UA_OPTIONAL),
UVERBS_ATTR_UHW());
static int UVERBS_HANDLER(UVERBS_METHOD_QP_DESTROY)(
diff --git a/include/uapi/rdma/ib_user_ioctl_cmds.h b/include/uapi/rdma/ib_user_ioctl_cmds.h
index 02835b7fd76d..839835bd4b23 100644
--- a/include/uapi/rdma/ib_user_ioctl_cmds.h
+++ b/include/uapi/rdma/ib_user_ioctl_cmds.h
@@ -159,6 +159,9 @@ enum uverbs_attrs_create_qp_cmd_attr_ids {
UVERBS_ATTR_CREATE_QP_EVENT_FD,
UVERBS_ATTR_CREATE_QP_RESP_CAP,
UVERBS_ATTR_CREATE_QP_RESP_QP_NUM,
+ UVERBS_ATTR_CREATE_QP_BUF_UMEM,
+ UVERBS_ATTR_CREATE_QP_RQ_BUF_UMEM,
+ UVERBS_ATTR_CREATE_QP_SQ_BUF_UMEM,
};
enum uverbs_attrs_destroy_qp_cmd_attr_ids {
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 13/16] RDMA/mlx5: Use UMEM attributes for QP buffers in create_qp
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (11 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 12/16] RDMA/uverbs: Use UMEM attributes for QP creation Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 14/16] RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM Jiri Pirko
` (3 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Use the per-attribute UMEM helpers to pin QP buffer umems on
demand. The QP-type predicate selects between the BUF and RQ_BUF
attrs; raw-packet SQ uses its own dedicated SQ_BUF attr.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v2->v3:
- changed to use ib_umem_get_attr_or_va() per-attr
- added ubuffer->umem / sq->ubuffer.umem to store umem
- renamed mlx5_qp_buf_slot() -> mlx5_qp_buf_attr()
- replaced ib_umem_release_non_listed() with ib_umem_release()
---
drivers/infiniband/hw/mlx5/qp.c | 46 +++++++++++++++++++++++----------
1 file changed, 33 insertions(+), 13 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dc5e6e3e5a64..dd5611800531 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -934,8 +934,17 @@ static int adjust_bfregn(struct mlx5_ib_dev *dev,
bfregn % MLX5_NON_FP_BFREGS_PER_UAR;
}
+static u16 mlx5_qp_buf_attr(struct mlx5_ib_qp *qp)
+{
+ if (qp->type == IB_QPT_RAW_PACKET ||
+ qp->flags & IB_QP_CREATE_SOURCE_QPN)
+ return UVERBS_ATTR_CREATE_QP_RQ_BUF_UMEM;
+ return UVERBS_ATTR_CREATE_QP_BUF_UMEM;
+}
+
static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
struct mlx5_ib_qp *qp, struct ib_udata *udata,
+ struct uverbs_attr_bundle *attrs,
struct ib_qp_init_attr *attr, u32 **in,
struct mlx5_ib_create_qp_resp *resp, int *inlen,
struct mlx5_ib_qp_base *base,
@@ -994,14 +1003,20 @@ static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
if (err)
goto err_bfreg;
- if (ucmd->buf_addr && ubuffer->buf_size) {
+ ubuffer->umem = NULL;
+ if (ubuffer->buf_size) {
ubuffer->buf_addr = ucmd->buf_addr;
- ubuffer->umem = ib_umem_get_va(&dev->ib_dev, ubuffer->buf_addr,
- ubuffer->buf_size, 0);
+ ubuffer->umem = ib_umem_get_attr_or_va(&dev->ib_dev, attrs,
+ mlx5_qp_buf_attr(qp),
+ ubuffer->buf_addr,
+ ubuffer->buf_size, 0);
if (IS_ERR(ubuffer->umem)) {
err = PTR_ERR(ubuffer->umem);
+ ubuffer->umem = NULL;
goto err_bfreg;
}
+ }
+ if (ubuffer->umem) {
page_size = mlx5_umem_find_best_quantized_pgoff(
ubuffer->umem, qpc, log_page_size,
MLX5_ADAPTER_PAGE_SHIFT, page_offset, 64,
@@ -1011,8 +1026,6 @@ static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
goto err_umem;
}
ncont = ib_umem_num_dma_blocks(ubuffer->umem, page_size);
- } else {
- ubuffer->umem = NULL;
}
*inlen = MLX5_ST_SZ_BYTES(create_qp_in) +
@@ -1329,6 +1342,7 @@ static int get_qp_ts_format(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *send_cq,
static int create_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
struct ib_udata *udata,
+ struct uverbs_attr_bundle *attrs,
struct mlx5_ib_sq *sq, void *qpin,
struct ib_pd *pd, struct mlx5_ib_cq *cq)
{
@@ -1348,8 +1362,10 @@ static int create_raw_packet_qp_sq(struct mlx5_ib_dev *dev,
if (ts_format < 0)
return ts_format;
- sq->ubuffer.umem = ib_umem_get_va(&dev->ib_dev, ubuffer->buf_addr,
- ubuffer->buf_size, 0);
+ sq->ubuffer.umem = ib_umem_get_attr_or_va(&dev->ib_dev, attrs,
+ UVERBS_ATTR_CREATE_QP_SQ_BUF_UMEM,
+ ubuffer->buf_addr,
+ ubuffer->buf_size, 0);
if (IS_ERR(sq->ubuffer.umem))
return PTR_ERR(sq->ubuffer.umem);
page_size = mlx5_umem_find_best_quantized_pgoff(
@@ -1562,6 +1578,7 @@ static int create_raw_packet_qp_tir(struct mlx5_ib_dev *dev,
static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
u32 *in, size_t inlen, struct ib_pd *pd,
struct ib_udata *udata,
+ struct uverbs_attr_bundle *attrs,
struct mlx5_ib_create_qp_resp *resp,
struct ib_qp_init_attr *init_attr)
{
@@ -1582,7 +1599,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp,
if (err)
return err;
- err = create_raw_packet_qp_sq(dev, udata, sq, in, pd,
+ err = create_raw_packet_qp_sq(dev, udata, attrs, sq, in, pd,
to_mcq(init_attr->send_cq));
if (err)
goto err_destroy_tis;
@@ -1700,6 +1717,7 @@ static void destroy_rss_raw_qp_tir(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *q
struct mlx5_create_qp_params {
struct ib_udata *udata;
+ struct uverbs_attr_bundle *attrs;
size_t inlen;
size_t outlen;
size_t ucmd_size;
@@ -2121,8 +2139,8 @@ static int create_dci(struct mlx5_ib_dev *dev, struct ib_pd *pd,
if (ts_format < 0)
return ts_format;
- err = _create_user_qp(dev, pd, qp, udata, init_attr, &in, ¶ms->resp,
- &inlen, base, ucmd);
+ err = _create_user_qp(dev, pd, qp, udata, params->attrs, init_attr,
+ &in, ¶ms->resp, &inlen, base, ucmd);
if (err)
return err;
@@ -2289,8 +2307,8 @@ static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
return ts_format;
}
- err = _create_user_qp(dev, pd, qp, udata, init_attr, &in, ¶ms->resp,
- &inlen, base, ucmd);
+ err = _create_user_qp(dev, pd, qp, udata, params->attrs, init_attr,
+ &in, ¶ms->resp, &inlen, base, ucmd);
if (err)
return err;
@@ -2394,7 +2412,8 @@ static int create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
qp->raw_packet_qp.sq.ubuffer.buf_addr = ucmd->sq_buf_addr;
raw_packet_qp_copy_info(qp, &qp->raw_packet_qp);
err = create_raw_packet_qp(dev, qp, in, inlen, pd, udata,
- ¶ms->resp, init_attr);
+ params->attrs, ¶ms->resp,
+ init_attr);
} else
err = mlx5_qpc_create_qp(dev, &base->mqp, in, inlen, out);
@@ -3274,6 +3293,7 @@ int mlx5_ib_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attr,
return err;
params.udata = udata;
+ params.attrs = udata ? rdma_udata_to_uverbs_attr_bundle(udata) : NULL;
params.uidx = MLX5_IB_DEFAULT_UIDX;
params.attr = attr;
params.is_rss_raw = !!attr->rwq_ind_tbl;
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 14/16] RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (12 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 13/16] RDMA/mlx5: Use UMEM attributes for QP buffers in create_qp Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 15/16] RDMA/mlx5: Use UMEM attribute for CQ doorbell record Jiri Pirko
` (2 subsequent siblings)
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
ib_umem_is_contiguous() is defined under #ifdef
CONFIG_INFINIBAND_USER_MEM, but the #else branch lacks a stub.
Add the missing inline to fix potential broken build.
Fixes: c897c2c8b8e8 ("RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v8->v9:
- new patch
---
include/rdma/ib_umem.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h
index 370d802f0e63..bc1e6ed73b3f 100644
--- a/include/rdma/ib_umem.h
+++ b/include/rdma/ib_umem.h
@@ -244,6 +244,10 @@ static inline unsigned long ib_umem_find_best_pgoff(struct ib_umem *umem,
{
return 0;
}
+static inline bool ib_umem_is_contiguous(struct ib_umem *umem)
+{
+ return false;
+}
static inline
struct ib_umem_dmabuf *ib_umem_dmabuf_get(struct ib_device *device,
unsigned long offset,
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 15/16] RDMA/mlx5: Use UMEM attribute for CQ doorbell record
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (13 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 14/16] RDMA/umem: Add ib_umem_is_contiguous() stub for !CONFIG_INFINIBAND_USER_MEM Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 13:43 ` [PATCH rdma-next v9 16/16] RDMA/mlx5: Use UMEM attribute for QP " Jiri Pirko
2026-05-29 23:26 ` [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jason Gunthorpe
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Add an optional mlx5 driver-namespace UMEM attribute on CQ
create so userspace can supply the doorbell record buffer
explicitly. mlx5_ib_db_map_user() resolves the attribute (or
falls back to the legacy UHW VA) into a struct
ib_uverbs_buffer_desc and runs a unified lookup-then-pin:
VA-typed descriptors share a per-page umem across CQ/QP/SRQ
in the same process, FD-typed descriptors are pinned per call.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v8->v9:
- added page boundary check for VA-based memory
v7->v8:
- rebased on top of uverbs_get_buffer_desc() rename
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v4->v5:
- split mlx5_ib_db_map_user() into a thin attr-resolving wrapper
and a static mlx5_ib_db_map_user_desc() taking a desc
- struct mlx5_ib_user_db_page: store ib_uverbs_buffer_desc instead
of user_virt; one match key for both VA and FD entries
- attr-based callers now share per-page umems with each other
and the legacy VA path; single ib_umem_get_desc() call
- replaced manual page-boundary check with ib_umem_is_contiguous()
v2->v3:
- moved CQ DBR attr to mlx5 driver namespace
- changed to use ib_umem_get_attr() to get umem
- added page-crossing check
---
drivers/infiniband/hw/mlx5/cq.c | 8 +-
drivers/infiniband/hw/mlx5/doorbell.c | 103 +++++++++++++++++++----
drivers/infiniband/hw/mlx5/mlx5_ib.h | 5 +-
drivers/infiniband/hw/mlx5/qp.c | 4 +-
drivers/infiniband/hw/mlx5/srq.c | 2 +-
include/uapi/rdma/mlx5_user_ioctl_cmds.h | 1 +
6 files changed, 98 insertions(+), 25 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index e8f8fcc106c8..49b4bf148a4a 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -761,7 +761,9 @@ static int create_cq_user(struct mlx5_ib_dev *dev, struct ib_udata *udata,
goto err_umem;
}
- err = mlx5_ib_db_map_user(context, ucmd.db_addr, &cq->db);
+ err = mlx5_ib_db_map_user(context, attrs,
+ MLX5_IB_ATTR_CREATE_CQ_DBR_BUF_UMEM,
+ ucmd.db_addr, &cq->db);
if (err)
goto err_umem;
@@ -1521,7 +1523,9 @@ ADD_UVERBS_ATTRIBUTES_SIMPLE(
UVERBS_ATTR_PTR_IN(
MLX5_IB_ATTR_CREATE_CQ_UAR_INDEX,
UVERBS_ATTR_TYPE(u32),
- UA_OPTIONAL));
+ UA_OPTIONAL),
+ UVERBS_ATTR_UMEM(MLX5_IB_ATTR_CREATE_CQ_DBR_BUF_UMEM,
+ UA_OPTIONAL));
const struct uapi_definition mlx5_ib_create_cq_defs[] = {
UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_CQ, &mlx5_ib_cq_create),
diff --git a/drivers/infiniband/hw/mlx5/doorbell.c b/drivers/infiniband/hw/mlx5/doorbell.c
index 020c70328663..3108894534a8 100644
--- a/drivers/infiniband/hw/mlx5/doorbell.c
+++ b/drivers/infiniband/hw/mlx5/doorbell.c
@@ -37,50 +37,95 @@
#include "mlx5_ib.h"
+#define MLX5_IB_DBR_SIZE (sizeof(__be32) * 2)
+
struct mlx5_ib_user_db_page {
struct list_head list;
struct ib_umem *umem;
- unsigned long user_virt;
+ struct ib_uverbs_buffer_desc desc;
int refcnt;
struct mm_struct *mm;
};
-int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context, unsigned long virt,
- struct mlx5_db *db)
+static int mlx5_ib_db_map_user_desc(struct mlx5_ib_ucontext *context,
+ const struct ib_uverbs_buffer_desc *desc,
+ struct mlx5_db *db)
{
struct mlx5_ib_user_db_page *page;
+ struct ib_umem *umem;
int err = 0;
+ if (desc->length < MLX5_IB_DBR_SIZE)
+ return -EINVAL;
+ /*
+ * For VA descriptors the umem is normalized to a single PAGE_SIZE
+ * region, so reject offsets that would place the 8-byte DBR
+ * straddling the page boundary.
+ */
+ if (desc->type == IB_UVERBS_BUFFER_TYPE_VA &&
+ (desc->addr & ~PAGE_MASK) > PAGE_SIZE - MLX5_IB_DBR_SIZE)
+ return -EINVAL;
+
mutex_lock(&context->db_page_mutex);
- list_for_each_entry(page, &context->db_page_list, list)
- if ((current->mm == page->mm) &&
- (page->user_virt == (virt & PAGE_MASK)))
- goto found;
+ /*
+ * Only VA-typed descriptors are eligible to share a per-page
+ * doorbell umem; FD-typed descriptors are pinned individually.
+ */
+ if (desc->type == IB_UVERBS_BUFFER_TYPE_VA) {
+ list_for_each_entry(page, &context->db_page_list, list) {
+ if (current->mm != page->mm)
+ continue;
+ if (page->desc.addr == (desc->addr & PAGE_MASK))
+ goto found;
+ }
+ }
- page = kmalloc_obj(*page);
+ page = kzalloc_obj(*page);
if (!page) {
err = -ENOMEM;
goto out;
}
- page->user_virt = (virt & PAGE_MASK);
- page->refcnt = 0;
- page->umem = ib_umem_get_va(context->ibucontext.device,
- virt & PAGE_MASK, PAGE_SIZE, 0);
- if (IS_ERR(page->umem)) {
- err = PTR_ERR(page->umem);
+ page->desc = *desc;
+
+ /*
+ * Normalize VA descriptors to a page-aligned PAGE_SIZE region so
+ * multiple DBRs that fall in the same user page share one umem.
+ */
+ if (page->desc.type == IB_UVERBS_BUFFER_TYPE_VA) {
+ page->desc.addr &= PAGE_MASK;
+ page->desc.length = PAGE_SIZE;
+ }
+
+ umem = ib_umem_get_desc(context->ibucontext.device, &page->desc, 0);
+ if (IS_ERR(umem)) {
+ err = PTR_ERR(umem);
+ kfree(page);
+ goto out;
+ }
+
+ /*
+ * The 8-byte DBR is programmed to the device as one DMA address,
+ * so it must live in a single contiguous DMA segment.
+ */
+ if (!ib_umem_is_contiguous(umem)) {
+ ib_umem_release(umem);
kfree(page);
+ err = -EINVAL;
goto out;
}
- mmgrab(current->mm);
- page->mm = current->mm;
+ page->umem = umem;
+ if (page->desc.type == IB_UVERBS_BUFFER_TYPE_VA) {
+ mmgrab(current->mm);
+ page->mm = current->mm;
+ }
list_add(&page->list, &context->db_page_list);
found:
db->dma = sg_dma_address(page->umem->sgt_append.sgt.sgl) +
- (virt & ~PAGE_MASK);
+ (desc->addr & ~PAGE_MASK);
db->u.user_page = page;
++page->refcnt;
@@ -90,13 +135,35 @@ int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context, unsigned long virt,
return err;
}
+int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context,
+ const struct uverbs_attr_bundle *attrs, u16 attr_id,
+ unsigned long virt, struct mlx5_db *db)
+{
+ struct ib_uverbs_buffer_desc desc = {
+ .type = IB_UVERBS_BUFFER_TYPE_VA,
+ .addr = virt,
+ .length = MLX5_IB_DBR_SIZE,
+ };
+
+ if (attrs) {
+ int err;
+
+ err = uverbs_get_buffer_desc(attrs, attr_id, &desc);
+ if (err && err != -ENOENT)
+ return err;
+ }
+
+ return mlx5_ib_db_map_user_desc(context, &desc, db);
+}
+
void mlx5_ib_db_unmap_user(struct mlx5_ib_ucontext *context, struct mlx5_db *db)
{
mutex_lock(&context->db_page_mutex);
if (!--db->u.user_page->refcnt) {
list_del(&db->u.user_page->list);
- mmdrop(db->u.user_page->mm);
+ if (db->u.user_page->mm)
+ mmdrop(db->u.user_page->mm);
ib_umem_release(db->u.user_page->umem);
kfree(db->u.user_page);
}
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index e156dc4d7529..078f281bcdac 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1259,8 +1259,9 @@ to_mmmap(struct rdma_user_mmap_entry *rdma_entry)
int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev);
int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev);
-int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context, unsigned long virt,
- struct mlx5_db *db);
+int mlx5_ib_db_map_user(struct mlx5_ib_ucontext *context,
+ const struct uverbs_attr_bundle *attrs, u16 attr_id,
+ unsigned long virt, struct mlx5_db *db);
void mlx5_ib_db_unmap_user(struct mlx5_ib_ucontext *context, struct mlx5_db *db);
void __mlx5_ib_cq_clean(struct mlx5_ib_cq *cq, u32 qpn, struct mlx5_ib_srq *srq);
void mlx5_ib_cq_clean(struct mlx5_ib_cq *cq, u32 qpn, struct mlx5_ib_srq *srq);
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index dd5611800531..58997714df70 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -914,7 +914,7 @@ static int create_user_rq(struct mlx5_ib_dev *dev, struct ib_pd *pd,
ib_umem_num_pages(rwq->umem), page_size, rwq->rq_num_pas,
offset);
- err = mlx5_ib_db_map_user(ucontext, ucmd->db_addr, &rwq->db);
+ err = mlx5_ib_db_map_user(ucontext, NULL, 0, ucmd->db_addr, &rwq->db);
if (err) {
mlx5_ib_dbg(dev, "map failed\n");
goto err_umem;
@@ -1053,7 +1053,7 @@ static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
resp->bfreg_index = MLX5_IB_INVALID_BFREG;
qp->bfregn = bfregn;
- err = mlx5_ib_db_map_user(context, ucmd->db_addr, &qp->db);
+ err = mlx5_ib_db_map_user(context, NULL, 0, ucmd->db_addr, &qp->db);
if (err) {
mlx5_ib_dbg(dev, "map failed\n");
goto err_free;
diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c
index 44903015c6c9..5bc48fef3744 100644
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -74,7 +74,7 @@ static int create_srq_user(struct ib_pd *pd, struct mlx5_ib_srq *srq,
}
in->umem = srq->umem;
- err = mlx5_ib_db_map_user(ucontext, ucmd.db_addr, &srq->db);
+ err = mlx5_ib_db_map_user(ucontext, NULL, 0, ucmd.db_addr, &srq->db);
if (err) {
mlx5_ib_dbg(dev, "map doorbell failed\n");
goto err_umem;
diff --git a/include/uapi/rdma/mlx5_user_ioctl_cmds.h b/include/uapi/rdma/mlx5_user_ioctl_cmds.h
index 01a2a050e468..b63e75034cda 100644
--- a/include/uapi/rdma/mlx5_user_ioctl_cmds.h
+++ b/include/uapi/rdma/mlx5_user_ioctl_cmds.h
@@ -274,6 +274,7 @@ enum mlx5_ib_device_query_context_attrs {
enum mlx5_ib_create_cq_attrs {
MLX5_IB_ATTR_CREATE_CQ_UAR_INDEX = UVERBS_ID_DRIVER_NS_WITH_UHW,
+ MLX5_IB_ATTR_CREATE_CQ_DBR_BUF_UMEM,
};
enum mlx5_ib_reg_dmabuf_mr_attrs {
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* [PATCH rdma-next v9 16/16] RDMA/mlx5: Use UMEM attribute for QP doorbell record
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (14 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 15/16] RDMA/mlx5: Use UMEM attribute for CQ doorbell record Jiri Pirko
@ 2026-05-29 13:43 ` Jiri Pirko
2026-05-29 23:26 ` [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jason Gunthorpe
16 siblings, 0 replies; 20+ messages in thread
From: Jiri Pirko @ 2026-05-29 13:43 UTC (permalink / raw)
To: linux-rdma
Cc: jgg, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
From: Jiri Pirko <jiri@nvidia.com>
Add an optional mlx5 driver-namespace UMEM attribute on QP
create so userspace can supply the doorbell record umem
explicitly, symmetric to the CQ side. Resolve it inside
mlx5_ib_db_map_user() and use it as a private DBR page when
present; otherwise take the existing UHW share-or-pin path
that preserves per-page DBR sharing across CQ/QP/SRQ in the
same process.
Add mlx5's first UVERBS_OBJECT_QP UAPI definition chain to
attach the new attr.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v5->v6:
- changed to pass attrs instead of udata to ib_umem_get*()
v2->v3:
- moved QP DBR attr to mlx5 driver namespace
- added new mlx5_ib_create_qp_defs[] UAPI chain (mlx5 had only a CQ one)
- changed to use ib_umem_get_attr() to get umem inside
mlx5_ib_db_map_user()
---
drivers/infiniband/hw/mlx5/main.c | 1 +
drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 +
drivers/infiniband/hw/mlx5/qp.c | 19 ++++++++++++++++++-
include/uapi/rdma/mlx5_user_ioctl_cmds.h | 4 ++++
4 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index 419489bd2199..12bfefc91b02 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -4456,6 +4456,7 @@ static const struct uapi_definition mlx5_ib_defs[] = {
UAPI_DEF_CHAIN(mlx5_ib_std_types_defs),
UAPI_DEF_CHAIN(mlx5_ib_dm_defs),
UAPI_DEF_CHAIN(mlx5_ib_create_cq_defs),
+ UAPI_DEF_CHAIN(mlx5_ib_create_qp_defs),
UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_DEVICE, &mlx5_ib_query_context),
UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_MR, &mlx5_ib_reg_dmabuf_mr),
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 078f281bcdac..1f03c05b0cbd 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -1511,6 +1511,7 @@ extern const struct uapi_definition mlx5_ib_flow_defs[];
extern const struct uapi_definition mlx5_ib_qos_defs[];
extern const struct uapi_definition mlx5_ib_std_types_defs[];
extern const struct uapi_definition mlx5_ib_create_cq_defs[];
+extern const struct uapi_definition mlx5_ib_create_qp_defs[];
static inline int is_qp1(enum ib_qp_type qp_type)
{
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 58997714df70..e8d34d54b435 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -44,6 +44,9 @@
#include "qp.h"
#include "wr.h"
+#define UVERBS_MODULE_NAME mlx5_ib
+#include <rdma/uverbs_named_ioctl.h>
+
enum {
MLX5_IB_ACK_REQ_FREQ = 8,
};
@@ -1053,7 +1056,9 @@ static int _create_user_qp(struct mlx5_ib_dev *dev, struct ib_pd *pd,
resp->bfreg_index = MLX5_IB_INVALID_BFREG;
qp->bfregn = bfregn;
- err = mlx5_ib_db_map_user(context, NULL, 0, ucmd->db_addr, &qp->db);
+ err = mlx5_ib_db_map_user(context, attrs,
+ MLX5_IB_ATTR_CREATE_QP_DBR_BUF_UMEM,
+ ucmd->db_addr, &qp->db);
if (err) {
mlx5_ib_dbg(dev, "map failed\n");
goto err_free;
@@ -5877,3 +5882,15 @@ void mlx5_ib_qp_event_cleanup(void)
{
destroy_workqueue(mlx5_ib_qp_event_wq);
}
+
+ADD_UVERBS_ATTRIBUTES_SIMPLE(
+ mlx5_ib_qp_create,
+ UVERBS_OBJECT_QP,
+ UVERBS_METHOD_QP_CREATE,
+ UVERBS_ATTR_UMEM(MLX5_IB_ATTR_CREATE_QP_DBR_BUF_UMEM,
+ UA_OPTIONAL));
+
+const struct uapi_definition mlx5_ib_create_qp_defs[] = {
+ UAPI_DEF_CHAIN_OBJ_TREE(UVERBS_OBJECT_QP, &mlx5_ib_qp_create),
+ {},
+};
diff --git a/include/uapi/rdma/mlx5_user_ioctl_cmds.h b/include/uapi/rdma/mlx5_user_ioctl_cmds.h
index b63e75034cda..ddb898afd813 100644
--- a/include/uapi/rdma/mlx5_user_ioctl_cmds.h
+++ b/include/uapi/rdma/mlx5_user_ioctl_cmds.h
@@ -277,6 +277,10 @@ enum mlx5_ib_create_cq_attrs {
MLX5_IB_ATTR_CREATE_CQ_DBR_BUF_UMEM,
};
+enum mlx5_ib_create_qp_attrs {
+ MLX5_IB_ATTR_CREATE_QP_DBR_BUF_UMEM = UVERBS_ID_DRIVER_NS_WITH_UHW,
+};
+
enum mlx5_ib_reg_dmabuf_mr_attrs {
MLX5_IB_ATTR_REG_DMABUF_MR_ACCESS_FLAGS = (1U << UVERBS_ID_NS_SHIFT),
};
--
2.54.0
^ permalink raw reply related [flat|nested] 20+ messages in thread* Re: [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem
2026-05-29 13:42 [PATCH rdma-next v9 00/16] RDMA: Introduce generic buffer descriptor infrastructure for umem Jiri Pirko
` (15 preceding siblings ...)
2026-05-29 13:43 ` [PATCH rdma-next v9 16/16] RDMA/mlx5: Use UMEM attribute for QP " Jiri Pirko
@ 2026-05-29 23:26 ` Jason Gunthorpe
16 siblings, 0 replies; 20+ messages in thread
From: Jason Gunthorpe @ 2026-05-29 23:26 UTC (permalink / raw)
To: Jiri Pirko
Cc: linux-rdma, leon, mrgolin, gal.pressman, sleybo, parav, mbloch,
yanjun.zhu, marco.crivellari, roman.gushchin, phaddad, lirongqing,
ynachum, huangjunxian6, kalesh-anakkur.purayil, ohartoov,
michaelgur, shayd, edwards, sriharsha.basavapatna,
andrew.gospodarek, selvin.xavier, jmoroni
On Fri, May 29, 2026 at 03:42:56PM +0200, Jiri Pirko wrote:
> Jiri Pirko (16):
> RDMA/umem: Rename ib_umem_get() to ib_umem_get_va()
> RDMA/umem: Split ib_umem_get_va() into a thin wrapper around
> __ib_umem_get_va()
> RDMA/core: Introduce generic buffer descriptor infrastructure for umem
> RDMA/umem: Route ib_umem_get_va() through ib_umem_get_attr_or_va()
> RDMA/uverbs: Push out CQ buffer umem processing into a helper
> RDMA/uverbs: Add CQ buffer UMEM attribute and driver helpers
> RDMA/efa: Use ib_umem_get_cq_buf() for user CQ buffer
> RDMA/mlx5: Use ib_umem_get_cq_buf_or_va() for user CQ buffer
> RDMA/bnxt_re: Use ib_umem_get_cq_buf_or_va() for user CQ buffer
> RDMA/mlx4: Use ib_umem_get_cq_buf() for user CQ buffer
> RDMA/uverbs: Remove legacy umem field from struct ib_cq
> RDMA/uverbs: Use UMEM attributes for QP creation
> RDMA/mlx5: Use UMEM attributes for QP buffers in create_qp
> RDMA/umem: Add ib_umem_is_contiguous() stub for
> !CONFIG_INFINIBAND_USER_MEM
> RDMA/mlx5: Use UMEM attribute for CQ doorbell record
> RDMA/mlx5: Use UMEM attribute for QP doorbell record
Applied to for-next
Thanks
Jason
^ permalink raw reply [flat|nested] 20+ messages in thread