[PATCH rdma-next 00/15] DMA direction and mlx5 driver correctness fixes

[Yishai Hadas <yishaih@nvidia.com>]

This series contains two independent groups of fixes for the RDMA
subsystem.

Group 1: DMA direction correctness (patches 1-7).

RDMA drivers have historically mapped all pinned user buffers
DMA_BIDIRECTIONAL regardless of how the device actually accesses them.
This group tightens the DMA mapping direction to match the real access
pattern for each buffer type:

  - CQ ring buffers: the device writes CQEs, the CPU only reads.
    Mapped DMA_FROM_DEVICE.

  - WQE rings, SRQ rings, doorbell records: the CPU writes, the device
    only reads.  Mapped DMA_TO_DEVICE (derived from the absence of any
    write access flag).

  - Writable MRs and other buffers with write access flags: unchanged,
    DMA_BIDIRECTIONAL.

On platforms with a write-enforcing IOMMU this prevents the device from
accessing memory beyond what the mapping semantically declares.  On
standard deployments without direction enforcement the change declares
the correct semantic at zero runtime cost.

The group includes preparatory driver fixes (patches 1-3) that correct
existing access=0 pins on writable buffers in erdma, hns, and
vmw_pvrdma, and a refactoring patch (4) that consolidates all CQ buffer
pinning through ib_umem_get_cq_buf_or_va() so the directional change in
patch 6 covers every CQ call site automatically.  Full details are in
the individual commit logs.

Group 2: mlx5 driver correctness fixes (patches 8-15).

Patch 8 fixes driver probe failure on XRC-less devices.
mlx5_ib_dev_res_init() was returning -EOPNOTSUPP when the firmware XRC
capability is absent. XRC is optional; the patch makes the devr
resource path XRC-optional throughout.

Patches 9-14 fix a cluster of related bugs in the mlx5 firmware event
dispatch path. The common root cause is that resources were made
visible to the event notifier (via radix tree or xarray insertion)
before their event callback, container pointer, and refcount were fully
initialized, leaving windows where firmware EQEs could call through NULL
function pointers or corrupt refcounts:

- mlx5_ib_wq_event() never released the reference taken before
    dispatch, leaking it on every WQ event.
  - WQ, SRQ, QP, and raw-packet QP SQ/RQ event callbacks were
    assigned after the resource became visible to the notifier.
    For SRQ and QP paths this directly causes a kernel crash on any
    matching firmware event.
  - create_resource_common() initialized the refcount and completion
    after the radix tree insert, allowing refcount_inc() on a
    still-zero refcount_t, which saturates the counter and permanently
    corrupts the resource's lifecycle tracking.

Patch 15 fixes undefined behavior in the EQE type field shift: the u8
type is left-shifted by 24 without a cast, promoting it to signed int
and causing UB for values >= 128.  All currently used type codes are
below 128, but a cast to u32 makes the shift well-defined.

Yishai

Yishai Hadas (15):
  RDMA/erdma: Pin CQ buffer writable to match device DMA write access
  RDMA/hns: Pin CQ buffer writable to match device DMA write access
  RDMA/vmw_pvrdma: Pin QP and SRQ rings writable to match device DMA
    write access
  RDMA/umem: Reuse ib_umem_get_cq_buf_or_va() for VA-only CQ pinning
  RDMA/umem: Support an explicit DMA direction other than
    DMA_BIDIRECTIONAL
  RDMA/umem: Map CQ buffers DMA_FROM_DEVICE
  RDMA/umem: Derive DMA direction from IB access flags
  RDMA/mlx5: Fix mlx5_ib_dev_res_init() failure when XRC cap is absent
  RDMA/mlx5: Put resource reference in mlx5_ib_wq_event()
  RDMA/mlx5: Set WQ event handler before firmware RQ insertion
  RDMA/mlx5: Set SRQ event handler before xarray insertion
  RDMA/mlx5: Set RQ event handler for raw-packet QP
  RDMA/mlx5: Set QP event handler before firmware QPC insertion
  RDMA/mlx5: Initialize QP/RQ/SQ resource refcount before publishing it
  RDMA/mlx5: Fix signed integer overflow in EQE qp_srq type shift

 drivers/infiniband/core/umem.c                | 87 ++++++++++++++-----
 drivers/infiniband/hw/bnxt_re/ib_verbs.c      |  9 +-
 drivers/infiniband/hw/erdma/erdma_verbs.c     | 19 ++--
 drivers/infiniband/hw/hns/hns_roce_cq.c       |  3 +-
 drivers/infiniband/hw/hns/hns_roce_device.h   |  2 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c    |  2 +-
 drivers/infiniband/hw/hns/hns_roce_mr.c       | 22 +++--
 drivers/infiniband/hw/hns/hns_roce_qp.c       |  2 +-
 drivers/infiniband/hw/hns/hns_roce_srq.c      |  4 +-
 .../infiniband/hw/ionic/ionic_controlpath.c   |  5 +-
 drivers/infiniband/hw/mana/cq.c               |  2 +-
 drivers/infiniband/hw/mana/main.c             |  9 +-
 drivers/infiniband/hw/mana/mana_ib.h          |  2 +-
 drivers/infiniband/hw/mana/qp.c               |  9 +-
 drivers/infiniband/hw/mana/wq.c               |  3 +-
 drivers/infiniband/hw/mlx4/cq.c               | 14 +--
 drivers/infiniband/hw/mlx5/cq.c               |  6 +-
 drivers/infiniband/hw/mlx5/main.c             | 56 +++++++-----
 drivers/infiniband/hw/mlx5/qp.c               | 29 ++++---
 drivers/infiniband/hw/mlx5/qpc.c              | 20 +++--
 drivers/infiniband/hw/mlx5/srq.c              |  3 +-
 drivers/infiniband/hw/qedr/verbs.c            | 23 +++--
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c  |  6 +-
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c |  3 +-
 include/rdma/ib_umem.h                        |  2 +
 25 files changed, 223 insertions(+), 119 deletions(-)

-- 
2.18.1