* [PATCH rdma-next v2 14/14] RDMA/selftests: Add rxe_netns_names test
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Add a kselftest script that exercises per-netns RDMA device naming
with RXE. Cover duplicate names across namespaces, move conflict
handling, move-with-rename, and same-namespace rename requests.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v1->v2:
- fixed ktap_set_plan
- s/RXE_A/RXE_SAME/ in dup rename
---
tools/testing/selftests/rdma/Makefile | 3 +-
tools/testing/selftests/rdma/config | 2 +
.../testing/selftests/rdma/rxe_netns_names.sh | 282 ++++++++++++++++++
3 files changed, 286 insertions(+), 1 deletion(-)
create mode 100755 tools/testing/selftests/rdma/rxe_netns_names.sh
diff --git a/tools/testing/selftests/rdma/Makefile b/tools/testing/selftests/rdma/Makefile
index 07af7f15c1bf..a91c14c45006 100644
--- a/tools/testing/selftests/rdma/Makefile
+++ b/tools/testing/selftests/rdma/Makefile
@@ -3,6 +3,7 @@ TEST_PROGS := rxe_rping_between_netns.sh \
rxe_ipv6.sh \
rxe_socket_with_netns.sh \
rxe_test_NETDEV_UNREGISTER.sh \
- rxe_sent_rcvd_bytes.sh
+ rxe_sent_rcvd_bytes.sh \
+ rxe_netns_names.sh
include ../lib.mk
diff --git a/tools/testing/selftests/rdma/config b/tools/testing/selftests/rdma/config
index 4ffb814e253b..e1ff54ec0f57 100644
--- a/tools/testing/selftests/rdma/config
+++ b/tools/testing/selftests/rdma/config
@@ -1,3 +1,5 @@
CONFIG_TUN
CONFIG_VETH
+CONFIG_DUMMY
+CONFIG_NET_NS
CONFIG_RDMA_RXE
diff --git a/tools/testing/selftests/rdma/rxe_netns_names.sh b/tools/testing/selftests/rdma/rxe_netns_names.sh
new file mode 100755
index 000000000000..a4fabf86bdf7
--- /dev/null
+++ b/tools/testing/selftests/rdma/rxe_netns_names.sh
@@ -0,0 +1,282 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Exercise RDMA device name handling across network namespaces.
+
+source "$(dirname "$0")/../kselftest/ktap_helpers.sh"
+
+NAME_PREFIX="rxe_netns_names_$$"
+NETDEV_PREFIX="rxn$$"
+NS1="${NAME_PREFIX}ns1"
+NS2="${NAME_PREFIX}ns2"
+RXE_A="${NAME_PREFIX}rxe_a"
+RXE_B="${NAME_PREFIX}rxe_b"
+RXE_SAME="${NAME_PREFIX}rxe_same"
+RXE_NEW="${NAME_PREFIX}rxe_new"
+DUMMY_A="${NETDEV_PREFIX}a"
+DUMMY_B="${NETDEV_PREFIX}b"
+OLD_MODE=""
+MODE_CHANGED=0
+MODS=("dummy" "rdma_rxe")
+TEST_SAME_NAMES="same RDMA device name can exist in two net namespaces"
+TEST_MOVE_CONFLICT="move without rename fails on destination name conflict"
+TEST_MOVE_RENAME="move then rename succeeds"
+TEST_COMBINED_MOVE_RENAME="move with requested destination name succeeds"
+TEST_SAME_NETNS_DUP_RENAME="same-netns rename rejects duplicate name"
+TEST_TEARDOWN_RETURN="netns delete returns device to init_net and renames on conflict"
+
+ksft_skip()
+{
+ ktap_skip_all "$*"
+ exit "$KSFT_SKIP"
+}
+
+fail()
+{
+ ktap_exit_fail_msg "$*"
+}
+
+need_cmd()
+{
+ command -v "$1" >/dev/null 2>&1 || ksft_skip "missing command: $1"
+}
+
+rdma_ns()
+{
+ local ns=$1
+
+ shift
+ ip netns exec "$ns" rdma "$@"
+}
+
+rdma_dev_exists()
+{
+ local ns=$1
+ local dev=$2
+
+ if [ -n "$ns" ]; then
+ rdma_ns "$ns" dev show "$dev" >/dev/null 2>&1
+ else
+ rdma dev show "$dev" >/dev/null 2>&1
+ fi
+}
+
+add_dummy()
+{
+ local netdev=$1
+
+ ip link add "$netdev" type dummy || return 1
+ ip link set "$netdev" up || return 1
+}
+
+add_rxe()
+{
+ local dev=$1
+ local netdev=$2
+
+ rdma link add "$dev" type rxe netdev "$netdev"
+}
+
+rdma_dev_on_netdev()
+{
+ local netdev=$1
+
+ rdma link show 2>/dev/null | awk -v want="$netdev" '
+ {
+ for (i = 1; i < NF; i++)
+ if ($i == "netdev" && $(i + 1) == want) {
+ dev = $2
+ sub(/\/.*/, "", dev)
+ print dev
+ exit
+ }
+ }'
+}
+
+wait_rdma_dev_on_netdev()
+{
+ local netdev=$1
+ local dev
+ local i
+
+ for i in $(seq 1 50); do
+ dev=$(rdma_dev_on_netdev "$netdev")
+ if [ -n "$dev" ]; then
+ echo "$dev"
+ return 0
+ fi
+ sleep 0.1
+ done
+
+ return 1
+}
+
+setup_devs()
+{
+ cleanup_devs
+
+ add_dummy "$DUMMY_A" || return 1
+ add_dummy "$DUMMY_B" || return 1
+
+ add_rxe "$RXE_A" "$DUMMY_A" || return 1
+ add_rxe "$RXE_B" "$DUMMY_B" || return 1
+}
+
+cleanup_devs()
+{
+ ip link del "$DUMMY_A" 2>/dev/null
+ ip link del "$DUMMY_B" 2>/dev/null
+}
+
+setup()
+{
+ OLD_MODE=$(rdma system show 2>/dev/null |
+ sed -n 's/.*netns \([^ ]*\).*/\1/p')
+ [ -n "$OLD_MODE" ] || ksft_skip "failed to read RDMA netns mode"
+
+ rdma system set netns exclusive >/dev/null 2>&1 ||
+ ksft_skip "rdma netns exclusive mode is not supported"
+ MODE_CHANGED=1
+
+ ip netns add "$NS1" || return 1
+ ip netns add "$NS2" || return 1
+}
+
+cleanup()
+{
+ cleanup_devs
+
+ ip netns del "$NS1" 2>/dev/null
+ ip netns del "$NS2" 2>/dev/null
+
+ if [ "$MODE_CHANGED" -eq 1 ]; then
+ rdma system set netns "$OLD_MODE" 2>/dev/null
+ fi
+
+ for m in "${MODS[@]}"; do
+ modprobe -r "$m" 2>/dev/null
+ done
+}
+
+rdma_supports_combined_move_rename()
+{
+ rdma dev help 2>&1 | grep -Eq 'netns .*name|name .*netns'
+}
+
+[ "$(id -u)" -eq 0 ] || ksft_skip "must be run as root"
+need_cmd ip
+need_cmd rdma
+need_cmd modprobe
+
+trap cleanup EXIT
+
+for m in "${MODS[@]}"; do
+ modinfo "$m" >/dev/null 2>&1 || ksft_skip "module $m not found"
+ modprobe "$m" || fail "failed to load $m"
+done
+
+setup || fail "failed to create net namespaces"
+
+ktap_print_header
+ktap_set_plan 6
+
+if setup_devs &&
+ rdma dev set "$RXE_A" netns "$NS1" &&
+ rdma_ns "$NS1" dev set "$RXE_A" name "$RXE_SAME" &&
+ rdma dev set "$RXE_B" netns "$NS2" &&
+ rdma_ns "$NS2" dev set "$RXE_B" name "$RXE_SAME" &&
+ rdma_dev_exists "$NS1" "$RXE_SAME" &&
+ rdma_dev_exists "$NS2" "$RXE_SAME"; then
+ ktap_test_pass "$TEST_SAME_NAMES"
+else
+ ktap_test_fail "$TEST_SAME_NAMES"
+fi
+cleanup_devs
+
+if ! setup_devs ||
+ ! rdma dev set "$RXE_A" netns "$NS1" ||
+ ! rdma_ns "$NS1" dev set "$RXE_A" name "$RXE_SAME" ||
+ ! rdma dev set "$RXE_B" netns "$NS2" ||
+ ! rdma_ns "$NS2" dev set "$RXE_B" name "$RXE_SAME"; then
+ ktap_test_fail "$TEST_MOVE_CONFLICT"
+elif rdma_ns "$NS1" dev set "$RXE_SAME" netns "$NS2" >/dev/null 2>&1; then
+ ktap_test_fail "$TEST_MOVE_CONFLICT"
+elif rdma_dev_exists "$NS1" "$RXE_SAME" &&
+ rdma_dev_exists "$NS2" "$RXE_SAME"; then
+ ktap_test_pass "$TEST_MOVE_CONFLICT"
+else
+ ktap_test_fail "$TEST_MOVE_CONFLICT"
+fi
+cleanup_devs
+
+if ! setup_devs; then
+ ktap_test_fail "$TEST_MOVE_RENAME"
+elif rdma dev set "$RXE_A" netns "$NS2" &&
+ rdma_ns "$NS2" dev set "$RXE_A" name "$RXE_NEW"; then
+ if rdma_dev_exists "$NS2" "$RXE_NEW" &&
+ ! rdma_dev_exists "" "$RXE_A"; then
+ ktap_test_pass "$TEST_MOVE_RENAME"
+ else
+ ktap_test_fail "$TEST_MOVE_RENAME"
+ fi
+else
+ ktap_test_fail "$TEST_MOVE_RENAME"
+fi
+cleanup_devs
+
+if ! rdma_supports_combined_move_rename; then
+ ktap_test_skip "$TEST_COMBINED_MOVE_RENAME"
+elif ! setup_devs; then
+ ktap_test_fail "$TEST_COMBINED_MOVE_RENAME"
+elif rdma dev set "$RXE_A" netns "$NS2" name "$RXE_NEW"; then
+ if rdma_dev_exists "$NS2" "$RXE_NEW" &&
+ ! rdma_dev_exists "" "$RXE_A"; then
+ ktap_test_pass "$TEST_COMBINED_MOVE_RENAME"
+ else
+ ktap_test_fail "$TEST_COMBINED_MOVE_RENAME"
+ fi
+else
+ ktap_test_fail "$TEST_COMBINED_MOVE_RENAME"
+fi
+cleanup_devs
+
+if ! setup_devs; then
+ ktap_test_fail "$TEST_SAME_NETNS_DUP_RENAME"
+elif rdma dev set "$RXE_A" name "$RXE_SAME" &&
+ rdma dev set "$RXE_B" name "$RXE_NEW"; then
+ if rdma dev set "$RXE_SAME" name "$RXE_NEW" >/dev/null 2>&1; then
+ ktap_test_fail "$TEST_SAME_NETNS_DUP_RENAME"
+ elif rdma_dev_exists "" "$RXE_SAME" &&
+ rdma_dev_exists "" "$RXE_NEW"; then
+ ktap_test_pass "$TEST_SAME_NETNS_DUP_RENAME"
+ else
+ ktap_test_fail "$TEST_SAME_NETNS_DUP_RENAME"
+ fi
+else
+ ktap_test_fail "$TEST_SAME_NETNS_DUP_RENAME"
+fi
+cleanup_devs
+
+if ! setup_devs; then
+ ktap_test_fail "$TEST_TEARDOWN_RETURN"
+elif ! rdma dev set "$RXE_A" name "$RXE_SAME" ||
+ ! rdma dev set "$RXE_B" netns "$NS2" ||
+ ! rdma_ns "$NS2" dev set "$RXE_B" name "$RXE_SAME" ||
+ ! rdma_dev_exists "$NS2" "$RXE_SAME"; then
+ ktap_test_fail "$TEST_TEARDOWN_RETURN"
+else
+ ip netns del "$NS2"
+ returned=$(wait_rdma_dev_on_netdev "$DUMMY_B")
+ ktap_print_msg "device returned to init_net as '${returned:-<missing>}'"
+ if rdma_dev_exists "" "$RXE_SAME" &&
+ [ -n "$returned" ] &&
+ [ "$returned" != "$RXE_SAME" ] &&
+ [ "${returned#ibdev}" != "$returned" ]; then
+ ktap_test_pass "$TEST_TEARDOWN_RETURN"
+ else
+ ktap_test_fail "$TEST_TEARDOWN_RETURN"
+ fi
+fi
+cleanup_devs
+
+ktap_finished
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 13/14] RDMA/rxe: Implement disassociate_ucontext callback
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Implement an empty disassociate_ucontext() callback so the RDMA core
can move rxe devices between net namespaces. The core requires this
callback to reset user contexts without waiting for userspace.
rxe needs no teardown here: its user-mapped queues live in
reference-counted vmalloc memory (see rxe_mmap.c) that stays valid
while userspace holds the mappings.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/sw/rxe/rxe_verbs.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c
index 1ec130fee8ea..6eb10d2f0653 100644
--- a/drivers/infiniband/sw/rxe/rxe_verbs.c
+++ b/drivers/infiniband/sw/rxe/rxe_verbs.c
@@ -240,6 +240,10 @@ static void rxe_dealloc_ucontext(struct ib_ucontext *ibuc)
rxe_err_uc(uc, "cleanup failed, err = %d\n", err);
}
+static void rxe_disassociate_ucontext(struct ib_ucontext *ibuc)
+{
+}
+
/* pd */
static int rxe_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata)
{
@@ -1478,6 +1482,7 @@ static const struct ib_device_ops rxe_dev_ops = {
.destroy_srq = rxe_destroy_srq,
.detach_mcast = rxe_detach_mcast,
.device_group = &rxe_attr_group,
+ .disassociate_ucontext = rxe_disassociate_ucontext,
.enable_driver = rxe_enable_driver,
.get_dma_mr = rxe_get_dma_mr,
.get_hw_stats = rxe_ib_get_hw_stats,
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 12/14] RDMA/rxe: Allow queue VMAs to outlive ucontexts
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Prepare queue mappings for asynchronous ucontext disassociation during
device disable. Rely on the VMA page references to preserve mapped
memory until the final unmap.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v1->v2:
- new patch
---
drivers/infiniband/sw/rxe/rxe_mmap.c | 35 ++--------------------------
1 file changed, 2 insertions(+), 33 deletions(-)
diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c
index 7f723a2f3700..a4ead89ccbd3 100644
--- a/drivers/infiniband/sw/rxe/rxe_mmap.c
+++ b/drivers/infiniband/sw/rxe/rxe_mmap.c
@@ -11,7 +11,6 @@
#include "rxe.h"
#include "rxe_loc.h"
-#include "rxe_queue.h"
void rxe_mmap_release(struct kref *ref)
{
@@ -30,29 +29,6 @@ void rxe_mmap_release(struct kref *ref)
kfree(ip);
}
-/*
- * open and close keep track of how many times the memory region is mapped,
- * to avoid releasing it.
- */
-static void rxe_vma_open(struct vm_area_struct *vma)
-{
- struct rxe_mmap_info *ip = vma->vm_private_data;
-
- kref_get(&ip->ref);
-}
-
-static void rxe_vma_close(struct vm_area_struct *vma)
-{
- struct rxe_mmap_info *ip = vma->vm_private_data;
-
- kref_put(&ip->ref, rxe_mmap_release);
-}
-
-static const struct vm_operations_struct rxe_vm_ops = {
- .open = rxe_vma_open,
- .close = rxe_vma_close,
-};
-
/**
* rxe_mmap - create a new mmap region
* @context: the IB user context of the process making the mmap() call
@@ -106,17 +82,10 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
list_del_init(&ip->pending_mmaps);
spin_unlock_bh(&rxe->pending_lock);
- vma->vm_ops = &rxe_vm_ops;
- vma->vm_private_data = ip;
-
ret = remap_vmalloc_range(vma, ip->obj, 0);
- if (ret) {
- vma->vm_private_data = NULL;
- vma->vm_ops = NULL;
- kref_put(&ip->ref, rxe_mmap_release);
+ kref_put(&ip->ref, rxe_mmap_release);
+ if (ret)
rxe_dbg_dev(rxe, "err %d from remap_vmalloc_range\n", ret);
- goto done;
- }
done:
return ret;
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 11/14] RDMA/core: Make device names unique per net namespace
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Use rdma_dev_access_netns() to scope RDMA device name lookup and "%d" name
allocation to the relevant net namespace. Keep shared mode and
CONFIG_NET_NS=n behaviour system-wide.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/core/device.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index bb02640239d7..4c75078448a3 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -129,7 +129,7 @@ static DECLARE_RWSEM(rdma_nets_rwsem);
bool ib_devices_shared_netns = true;
module_param_named(netns_mode, ib_devices_shared_netns, bool, 0444);
MODULE_PARM_DESC(netns_mode,
- "Share device among net namespaces; default=1 (shared)");
+ "Share device among net namespaces; default=1 (shared). In exclusive mode device names are unique per net namespace");
/**
* rdma_dev_access_netns() - Return whether an rdma device can be accessed
* from a specified net namespace or not.
@@ -359,7 +359,8 @@ static struct ib_device *__ib_device_get_by_name(const char *name,
unsigned long index;
xa_for_each (&devices, index, device)
- if (!strcmp(name, dev_name(&device->dev)))
+ if (rdma_dev_access_netns(device, net) &&
+ !strcmp(name, dev_name(&device->dev)))
return device;
return NULL;
@@ -437,7 +438,11 @@ int ib_device_set_dim(struct ib_device *ibdev, u8 use_dim)
return 0;
}
-/* Pick a free index for the '%d' style @name pattern. */
+/*
+ * Pick a free index for the '%d' style @name pattern within net namespace
+ * @net. Returns the index on success or a negative errno. The caller builds
+ * the final unique device name from the returned index.
+ */
static int __alloc_name_id(struct net *net, const char *name,
const struct ib_device *skip)
{
@@ -452,7 +457,7 @@ static int __alloc_name_id(struct net *net, const char *name,
xa_for_each (&devices, index, device) {
char buf[IB_DEVICE_NAME_MAX];
- if (device == skip)
+ if (device == skip || !rdma_dev_access_netns(device, net))
continue;
if (sscanf(dev_name(&device->dev), name, &i) != 1)
continue;
@@ -1233,7 +1238,8 @@ static __net_init int rdma_dev_init_net(struct net *net)
}
/*
- * Assign the unique string device name and the unique device index. This is
+ * Assign the unique string device name and the unique device index. The device
+ * name is unique within the net namespace the device is assigned to. This is
* undone by ib_dealloc_device.
*/
static int assign_name(struct ib_device *device, const char *name)
@@ -1416,8 +1422,9 @@ static void ib_device_notify_register(struct ib_device *device)
/**
* ib_register_device - Register an IB device with IB core
* @device: Device to register
- * @name: unique string device name. This may include a '%' which will
- * cause a unique index to be added to the passed device name.
+ * @name: device name, unique within the device's net namespace. This may
+ * include a '%' which will cause a unique index to be added to the
+ * passed device name.
* @dma_device: pointer to a DMA-capable device. If %NULL, then the IB
* device will be used. In this case the caller should fully
* setup the ibdev for DMA. This usually means using dma_virt_ops.
@@ -1708,6 +1715,7 @@ static bool rdma_dev_name_in_netns(struct ib_device *skip, struct net *net,
xa_for_each(&devices, index, device)
if (device != skip &&
+ rdma_dev_access_netns(device, net) &&
!strcmp(name, dev_name(&device->dev)))
return true;
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 10/14] RDMA/core: Document the SELinux ibendport net namespace limitation
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Document that SELinux ibendport labels use a global (device name, port)
key, so same-named RDMA devices in different net namespaces share a label.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/core/security.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
index 9af31d1d9d70..a82c46965416 100644
--- a/drivers/infiniband/core/security.c
+++ b/drivers/infiniband/core/security.c
@@ -700,6 +700,12 @@ int ib_mad_agent_security_setup(struct ib_mad_agent *agent,
if (qp_type != IB_QPT_SMI)
return 0;
+ /*
+ * SELinux labels an endport by (device name, port) from a global
+ * policy. If devices in different net namespaces share a name, they get
+ * the same label; distinguishing them would need net namespace support
+ * in the policy language and tooling.
+ */
spin_lock(&mad_agent_list_lock);
ret = security_ib_endport_manage_subnet(agent->security,
dev_name(&agent->device->dev),
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 09/14] RDMA/cma: Document that CM configfs cannot be net namespace scoped
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Document the rdma_cm configfs limitation: configfs is global, so same-named
RDMA devices in different net namespaces cannot both be represented there.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
Documentation/ABI/testing/configfs-rdma_cm | 4 ++++
drivers/infiniband/core/cma_configfs.c | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/Documentation/ABI/testing/configfs-rdma_cm b/Documentation/ABI/testing/configfs-rdma_cm
index 74f9506f42e7..739f7b6a1259 100644
--- a/Documentation/ABI/testing/configfs-rdma_cm
+++ b/Documentation/ABI/testing/configfs-rdma_cm
@@ -12,6 +12,10 @@ Description: Interface is used to configure RDMA-cable HCAs in respect to
for this HCA has to be created:
mkdir -p /config/rdma_cm/<hca>
+ Note: configfs has no network namespace support, so this
+ interface cannot represent two devices that share a name in
+ different network namespaces (possible in exclusive netns mode).
+
What: /config/rdma_cm/<hca>/ports/<port-num>/default_roce_mode
Date: November 29, 2015
diff --git a/drivers/infiniband/core/cma_configfs.c b/drivers/infiniband/core/cma_configfs.c
index 891e52afb8f4..c389d4e37b6b 100644
--- a/drivers/infiniband/core/cma_configfs.c
+++ b/drivers/infiniband/core/cma_configfs.c
@@ -65,6 +65,10 @@ static struct cma_dev_port_group *to_dev_port_group(struct config_item *item)
return container_of(group, struct cma_dev_port_group, group);
}
+/*
+ * configfs is not net namespace aware, so a name shared by devices in
+ * different namespaces resolves to the first match here.
+ */
static bool filter_by_name(struct ib_device *ib_dev, void *cookie)
{
return !strcmp(dev_name(&ib_dev->dev), cookie);
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 08/14] RDMA/cgroup: Disambiguate devices across net namespaces
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
RDMA device names are unique only within a network namespace, but an
RDMA cgroup can account resources for devices from multiple namespaces.
Duplicate names therefore make cgroup output ambiguous and can cause
limit writes to select the wrong device.
Use the system-wide RDMA device index to distinguish duplicate names
while preserving the existing UAPI for unique names. Reject ambiguous
name-only writes with -ENOTUNIQ and expose a complete device view to
administrators.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v1->v2:
- replace caller-netns filtering with global visibility and index-based
disambiguation
---
Documentation/admin-guide/cgroup-v1/rdma.rst | 8 +++
Documentation/admin-guide/cgroup-v2.rst | 15 ++++-
drivers/infiniband/core/cgroup.c | 1 +
include/linux/cgroup_rdma.h | 1 +
kernel/cgroup/rdma.c | 71 ++++++++++++++++----
5 files changed, 83 insertions(+), 13 deletions(-)
diff --git a/Documentation/admin-guide/cgroup-v1/rdma.rst b/Documentation/admin-guide/cgroup-v1/rdma.rst
index e69369b7252e..8d0c3a796ee3 100644
--- a/Documentation/admin-guide/cgroup-v1/rdma.rst
+++ b/Documentation/admin-guide/cgroup-v1/rdma.rst
@@ -90,6 +90,13 @@ Following resources can be accounted by rdma controller.
hca_object Maximum number of HCA Objects
========== =============================
+RDMA devices from all network namespaces are listed. Each line starts with
+the device name. If more than one device has the same name, ``index=N``
+follows the name, where ``N`` is the system-wide RDMA device index, unique
+among registered devices. When configuring a limit, the index is optional
+for a globally unique name and required for a duplicate name. A write without
+the required index fails with ``-ENOTUNIQ``.
+
2. Usage Examples
=================
@@ -97,6 +104,7 @@ Following resources can be accounted by rdma controller.
echo mlx4_0 hca_handle=2 hca_object=2000 > /sys/fs/cgroup/rdma/1/rdma.max
echo ocrdma1 hca_handle=3 > /sys/fs/cgroup/rdma/2/rdma.max
+ echo "rxe0 index=5 hca_handle=2" > /sys/fs/cgroup/rdma/3/rdma.max
(b) Query resource limit::
diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst
index 993446ab66d0..df74d554d2cd 100644
--- a/Documentation/admin-guide/cgroup-v2.rst
+++ b/Documentation/admin-guide/cgroup-v2.rst
@@ -2752,6 +2752,11 @@ RDMA
The "rdma" controller regulates the distribution and accounting of
RDMA resources.
+RDMA devices from all network namespaces are listed. Each line starts with
+the device name. If more than one device has the same name, ``index=N``
+follows the name, where ``N`` is the system-wide RDMA device index, unique
+among registered devices.
+
RDMA Interface Files
~~~~~~~~~~~~~~~~~~~~
@@ -2760,7 +2765,11 @@ RDMA Interface Files
except root that describes current configured resource limit
for a RDMA/IB device.
- Lines are keyed by device name and are not ordered.
+ Lines are keyed by device name and are not ordered. A write may
+ include ``index=N`` after the device name. The index is optional
+ when the name is globally unique. If multiple devices have that
+ name, the index is required and a write without it fails with
+ ``-ENOTUNIQ``.
Each line contains space separated resource name and its configured
limit that can be distributed.
@@ -2776,6 +2785,10 @@ RDMA Interface Files
mlx4_0 hca_handle=2 hca_object=2000
ocrdma1 hca_handle=3 hca_object=max
+ For devices with duplicate names, select the device by index::
+
+ echo "rxe0 index=5 hca_handle=2" > rdma.max
+
rdma.current
A read-only file that describes current resource usage.
It exists for all the cgroup except root.
diff --git a/drivers/infiniband/core/cgroup.c b/drivers/infiniband/core/cgroup.c
index 1f037fe01450..8611b4e32cfb 100644
--- a/drivers/infiniband/core/cgroup.c
+++ b/drivers/infiniband/core/cgroup.c
@@ -17,6 +17,7 @@
void ib_device_register_rdmacg(struct ib_device *device)
{
device->cg_device.name = device->name;
+ device->cg_device.index = device->index;
rdmacg_register_device(&device->cg_device);
}
diff --git a/include/linux/cgroup_rdma.h b/include/linux/cgroup_rdma.h
index 404e746552ca..9a5c9ee728e7 100644
--- a/include/linux/cgroup_rdma.h
+++ b/include/linux/cgroup_rdma.h
@@ -34,6 +34,7 @@ struct rdmacg_device {
struct list_head dev_node;
struct list_head rpools;
char *name;
+ u32 index;
};
/*
diff --git a/kernel/cgroup/rdma.c b/kernel/cgroup/rdma.c
index 5e82a03b3270..9489f3df0bf3 100644
--- a/kernel/cgroup/rdma.c
+++ b/kernel/cgroup/rdma.c
@@ -19,6 +19,7 @@
#define RDMACG_MAX_STR "max"
enum rdmacg_limit_tokens {
+ RDMACG_DEVICE_INDEX,
RDMACG_HCA_HANDLE_VAL,
RDMACG_HCA_HANDLE_MAX,
RDMACG_HCA_OBJECT_VAL,
@@ -27,6 +28,7 @@ enum rdmacg_limit_tokens {
};
static const match_table_t rdmacg_limit_tokens = {
+ { RDMACG_DEVICE_INDEX, "index=%u" },
{ RDMACG_HCA_HANDLE_VAL, "hca_handle=%d" },
{ RDMACG_HCA_HANDLE_MAX, "hca_handle=max" },
{ RDMACG_HCA_OBJECT_VAL, "hca_object=%d" },
@@ -464,17 +466,53 @@ void rdmacg_unregister_device(struct rdmacg_device *device)
}
EXPORT_SYMBOL(rdmacg_unregister_device);
-static struct rdmacg_device *rdmacg_get_device_locked(const char *name)
+static struct rdmacg_device *
+rdmacg_get_device_locked(const char *name, bool has_index, u32 index)
{
+ struct rdmacg_device *match = NULL;
struct rdmacg_device *device;
lockdep_assert_held(&rdmacg_mutex);
- list_for_each_entry(device, &rdmacg_devices, dev_node)
- if (!strcmp(name, device->name))
- return device;
+ list_for_each_entry(device, &rdmacg_devices, dev_node) {
+ if (strcmp(name, device->name))
+ continue;
- return NULL;
+ if (has_index) {
+ if (device->index == index)
+ return device;
+ continue;
+ }
+
+ if (match)
+ return ERR_PTR(-ENOTUNIQ);
+ match = device;
+ }
+
+ return match ?: ERR_PTR(-ENODEV);
+}
+
+static bool
+rdmacg_device_name_unique_locked(const struct rdmacg_device *device)
+{
+ struct rdmacg_device *other;
+
+ lockdep_assert_held(&rdmacg_mutex);
+
+ list_for_each_entry(other, &rdmacg_devices, dev_node)
+ if (other != device && !strcmp(other->name, device->name))
+ return false;
+
+ return true;
+}
+
+static void rdmacg_print_device_key(struct seq_file *sf,
+ const struct rdmacg_device *device)
+{
+ seq_puts(sf, device->name);
+ if (!rdmacg_device_name_unique_locked(device))
+ seq_printf(sf, " index=%u", device->index);
+ seq_putc(sf, ' ');
}
static ssize_t rdmacg_resource_set_max(struct kernfs_open_file *of,
@@ -488,6 +526,8 @@ static ssize_t rdmacg_resource_set_max(struct kernfs_open_file *of,
char *p;
int *new_limits;
unsigned long enables = 0;
+ u32 dev_index = 0;
+ bool has_index = false;
int i = 0, ret = 0;
/* extract the device name first */
@@ -503,7 +543,7 @@ static ssize_t rdmacg_resource_set_max(struct kernfs_open_file *of,
goto err;
}
- /* parse resource limit tokens */
+ /* parse the optional device index and resource limit tokens */
while ((p = strsep(&options, " \t\n"))) {
substring_t args[MAX_OPT_ARGS];
int tok, intval;
@@ -513,6 +553,13 @@ static ssize_t rdmacg_resource_set_max(struct kernfs_open_file *of,
tok = match_token(p, rdmacg_limit_tokens, args);
switch (tok) {
+ case RDMACG_DEVICE_INDEX:
+ if (has_index || match_uint(&args[0], &dev_index)) {
+ ret = -EINVAL;
+ goto parse_err;
+ }
+ has_index = true;
+ break;
case RDMACG_HCA_HANDLE_VAL:
if (match_int(&args[0], &intval) || intval < 0) {
ret = -EINVAL;
@@ -546,9 +593,9 @@ static ssize_t rdmacg_resource_set_max(struct kernfs_open_file *of,
/* acquire lock to synchronize with hot plug devices */
mutex_lock(&rdmacg_mutex);
- device = rdmacg_get_device_locked(dev_name);
- if (!device) {
- ret = -ENODEV;
+ device = rdmacg_get_device_locked(dev_name, has_index, dev_index);
+ if (IS_ERR(device)) {
+ ret = PTR_ERR(device);
goto dev_err;
}
@@ -626,7 +673,7 @@ static int rdmacg_resource_read(struct seq_file *sf, void *v)
mutex_lock(&rdmacg_mutex);
list_for_each_entry(device, &rdmacg_devices, dev_node) {
- seq_printf(sf, "%s ", device->name);
+ rdmacg_print_device_key(sf, device);
rpool = find_cg_rpool_locked(cg, device);
print_rpool_values(sf, rpool);
@@ -650,7 +697,7 @@ static int rdmacg_events_show(struct seq_file *sf, void *v)
list_for_each_entry(device, &rdmacg_devices, dev_node) {
rpool = find_cg_rpool_locked(cg, device);
- seq_printf(sf, "%s ", device->name);
+ rdmacg_print_device_key(sf, device);
for (i = 0; i < RDMACG_RESOURCE_MAX; i++) {
seq_printf(sf, "%s.max=%llu %s.alloc_fail=%llu",
rdmacg_resource_names[i],
@@ -679,7 +726,7 @@ static int rdmacg_events_local_show(struct seq_file *sf, void *v)
list_for_each_entry(device, &rdmacg_devices, dev_node) {
rpool = find_cg_rpool_locked(cg, device);
- seq_printf(sf, "%s ", device->name);
+ rdmacg_print_device_key(sf, device);
for (i = 0; i < RDMACG_RESOURCE_MAX; i++) {
seq_printf(sf, "%s.max=%llu %s.alloc_fail=%llu",
rdmacg_resource_names[i],
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 07/14] RDMA/srp: Make the SRP sysfs class net namespace aware
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Tag srp_class by the RDMA device's net namespace so SRP hosts derived from
same-named RDMA devices can coexist across namespaces.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 0caebbc2810f..2fc8e133c70f 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -3189,10 +3189,24 @@ static struct attribute *srp_class_attrs[];
ATTRIBUTE_GROUPS(srp_class);
+/*
+ * SRP hosts are named after their ib device, so tag the class by the ib
+ * device's net namespace.
+ */
+static const struct ns_common *srp_net_namespace(const struct device *dev)
+{
+ struct srp_host *host = container_of(dev, struct srp_host, dev);
+ struct net *net = rdma_dev_net(host->srp_dev->dev);
+
+ return net ? to_ns_common(net) : NULL;
+}
+
static struct class srp_class = {
.name = "infiniband_srp",
.dev_groups = srp_class_groups,
- .dev_release = srp_release_dev
+ .dev_release = srp_release_dev,
+ .ns_type = &net_ns_type_operations,
+ .namespace = srp_net_namespace,
};
/**
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 06/14] net/smc: Look up the pnetid ib device within the net namespace
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Scope smc_pnet_find_ib() to the caller's net namespace so pnetid setup
cannot bind to a same-named RDMA device from another namespace once names
become per-netns.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
net/smc/smc_pnet.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c
index 63e286e2dfaa..ff9c9c35cc2f 100644
--- a/net/smc/smc_pnet.c
+++ b/net/smc/smc_pnet.c
@@ -304,13 +304,18 @@ static bool smc_pnetid_valid(const char *pnet_name, char *pnetid)
return true;
}
-/* Find an infiniband device by a given name. The device might not exist. */
-static struct smc_ib_device *smc_pnet_find_ib(char *ib_name)
+/*
+ * Find an infiniband device by a given name, restricted to the devices
+ * accessible from @net. The device might not exist.
+ */
+static struct smc_ib_device *smc_pnet_find_ib(struct net *net, char *ib_name)
{
struct smc_ib_device *ibdev;
mutex_lock(&smc_ib_devices.mutex);
list_for_each_entry(ibdev, &smc_ib_devices.list, list) {
+ if (!rdma_dev_access_netns(ibdev->ibdev, net))
+ continue;
if (!strncmp(ibdev->ibdev->name, ib_name,
sizeof(ibdev->ibdev->name)) ||
(ibdev->ibdev->dev.parent &&
@@ -408,8 +413,8 @@ static int smc_pnet_add_eth(struct smc_pnettable *pnettable, struct net *net,
return rc;
}
-static int smc_pnet_add_ib(struct smc_pnettable *pnettable, char *ib_name,
- u8 ib_port, char *pnet_name)
+static int smc_pnet_add_ib(struct smc_pnettable *pnettable, struct net *net,
+ char *ib_name, u8 ib_port, char *pnet_name)
{
struct smc_pnetentry *tmp_pe, *new_pe;
struct smc_ib_device *ib_dev;
@@ -419,7 +424,7 @@ static int smc_pnet_add_ib(struct smc_pnettable *pnettable, char *ib_name,
bool new_ibdev;
/* try to apply the pnetid to active devices */
- ib_dev = smc_pnet_find_ib(ib_name);
+ ib_dev = smc_pnet_find_ib(net, ib_name);
if (ib_dev) {
ibdev_applied = smc_pnet_apply_ib(ib_dev, ib_port, pnet_name);
if (ibdev_applied)
@@ -518,7 +523,7 @@ static int smc_pnet_enter(struct net *net, struct nlattr *tb[])
if (ibport < 1 || ibport > SMC_MAX_PORTS)
goto error;
}
- rc = smc_pnet_add_ib(pnettable, string, ibport, pnet_name);
+ rc = smc_pnet_add_ib(pnettable, net, string, ibport, pnet_name);
if (!rc)
new_ibdev = true;
else if (rc != -EEXIST)
@@ -1170,6 +1175,9 @@ int smc_pnetid_by_table_ib(struct smc_ib_device *smcibdev, u8 ib_port)
struct smc_net *sn;
int rc = -ENOENT;
+ if (!rdma_dev_access_netns(smcibdev->ibdev, &init_net))
+ return -ENOENT;
+
/* get pnettable for init namespace */
sn = net_generic(&init_net, smc_net_id);
pnettable = &sn->pnettable;
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 05/14] RDMA/nldev: Allow setting the device name while changing net namespace
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Accept RDMA_NLDEV_ATTR_DEV_NAME together with RDMA_NLDEV_NET_NS_FD so a
netlink move can rename the device in the destination namespace. Keep the
name semantics aligned with the existing RDMA rename path.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/core/device.c | 6 ++++++
drivers/infiniband/core/nldev.c | 27 ++++++++++++++++++---------
include/uapi/rdma/rdma_netlink.h | 5 ++++-
3 files changed, 28 insertions(+), 10 deletions(-)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 366bd8463c07..bb02640239d7 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1901,6 +1901,9 @@ int ib_device_set_netns_put(struct sk_buff *skb,
if (ret == -EEXIST)
NL_SET_ERR_MSG(extack,
"Device name already exists in the target net namespace");
+ else if (ret == -EINVAL && name)
+ NL_SET_ERR_MSG(extack,
+ "Unable to use requested device name in the target net namespace");
goto ns_err;
}
@@ -1931,6 +1934,9 @@ int ib_device_set_netns_put(struct sk_buff *skb,
if (ret == -EEXIST)
NL_SET_ERR_MSG(extack,
"Device name already exists in the target net namespace");
+ else if (ret == -EINVAL && name)
+ NL_SET_ERR_MSG(extack,
+ "Unable to use requested device name in the target net namespace");
put_net(net);
return ret;
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 8648e95700bf..4efa387ec1be 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1178,6 +1178,24 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
if (!device)
return -EINVAL;
+ if (tb[RDMA_NLDEV_NET_NS_FD]) {
+ char name[IB_DEVICE_NAME_MAX] = {};
+ u32 ns_fd;
+
+ if (tb[RDMA_NLDEV_ATTR_DEV_NAME]) {
+ nla_strscpy(name, tb[RDMA_NLDEV_ATTR_DEV_NAME],
+ IB_DEVICE_NAME_MAX);
+ if (strlen(name) == 0) {
+ err = -EINVAL;
+ goto done;
+ }
+ }
+ ns_fd = nla_get_u32(tb[RDMA_NLDEV_NET_NS_FD]);
+ err = ib_device_set_netns_put(skb, device, ns_fd,
+ name[0] ? name : NULL, extack);
+ goto put_done;
+ }
+
if (tb[RDMA_NLDEV_ATTR_DEV_NAME]) {
char name[IB_DEVICE_NAME_MAX] = {};
@@ -1191,15 +1209,6 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
goto done;
}
- if (tb[RDMA_NLDEV_NET_NS_FD]) {
- u32 ns_fd;
-
- ns_fd = nla_get_u32(tb[RDMA_NLDEV_NET_NS_FD]);
- err = ib_device_set_netns_put(skb, device, ns_fd, NULL,
- extack);
- goto put_done;
- }
-
if (tb[RDMA_NLDEV_ATTR_DEV_DIM]) {
u8 use_dim;
diff --git a/include/uapi/rdma/rdma_netlink.h b/include/uapi/rdma/rdma_netlink.h
index 3af946ecbac3..ee11c3bbbae2 100644
--- a/include/uapi/rdma/rdma_netlink.h
+++ b/include/uapi/rdma/rdma_netlink.h
@@ -516,7 +516,10 @@ enum rdma_nldev_attr {
RDMA_NLDEV_ATTR_DEV_PROTOCOL, /* string */
/*
- * File descriptor handle of the net namespace object
+ * File descriptor handle of the net namespace object. May be combined
+ * with RDMA_NLDEV_ATTR_DEV_NAME (a literal device name) to also rename
+ * the device in the destination namespace; the move fails with -EEXIST
+ * if that name is already taken there.
*/
RDMA_NLDEV_NET_NS_FD, /* u32 */
/*
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 04/14] RDMA/nldev: Report net namespace move errors through extack
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Thread extack through the existing net namespace move helper and report the
main failure reasons from the core path. Keep the existing move UAPI shape
unchanged.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/core/core_priv.h | 3 ++-
drivers/infiniband/core/device.c | 24 ++++++++++++++++++++++--
drivers/infiniband/core/nldev.c | 6 ++----
3 files changed, 26 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 3bd5bb7135a3..aaf330b0d333 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -356,7 +356,8 @@ void ib_port_unregister_client_groups(struct ib_device *ibdev, u32 port_num,
const struct attribute_group **groups);
int ib_device_set_netns_put(struct sk_buff *skb,
- struct ib_device *dev, u32 ns_fd, const char *name);
+ struct ib_device *dev, u32 ns_fd, const char *name,
+ struct netlink_ext_ack *extack);
int rdma_nl_net_init(struct rdma_dev_net *rnet);
void rdma_nl_net_exit(struct rdma_dev_net *rnet);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index c0b6613dba4c..366bd8463c07 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1871,18 +1871,22 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
}
int ib_device_set_netns_put(struct sk_buff *skb,
- struct ib_device *dev, u32 ns_fd, const char *name)
+ struct ib_device *dev, u32 ns_fd, const char *name,
+ struct netlink_ext_ack *extack)
{
struct net *net;
int ret;
net = get_net_ns_by_fd(ns_fd);
if (IS_ERR(net)) {
+ NL_SET_ERR_MSG(extack, "Invalid target net namespace fd");
ret = PTR_ERR(net);
goto net_err;
}
if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+ NL_SET_ERR_MSG(extack,
+ "Missing CAP_NET_ADMIN in the target net namespace");
ret = -EPERM;
goto ns_err;
}
@@ -1893,6 +1897,10 @@ int ib_device_set_netns_put(struct sk_buff *skb,
*/
if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
ret = name ? ib_device_rename(dev, name) : 0;
+
+ if (ret == -EEXIST)
+ NL_SET_ERR_MSG(extack,
+ "Device name already exists in the target net namespace");
goto ns_err;
}
@@ -1901,7 +1909,16 @@ int ib_device_set_netns_put(struct sk_buff *skb,
* changed and this cannot be blocked waiting for userspace to do
* something, so disassociation is mandatory.
*/
- if (!dev->ops.disassociate_ucontext || ib_devices_shared_netns) {
+ if (ib_devices_shared_netns) {
+ NL_SET_ERR_MSG(extack,
+ "Cannot change net namespace of RDMA device in shared netns mode");
+ ret = -EOPNOTSUPP;
+ goto ns_err;
+ }
+
+ if (!dev->ops.disassociate_ucontext) {
+ NL_SET_ERR_MSG(extack,
+ "Device does not support namespace changes (no disassociate support)");
ret = -EOPNOTSUPP;
goto ns_err;
}
@@ -1911,6 +1928,9 @@ int ib_device_set_netns_put(struct sk_buff *skb,
ret = rdma_dev_change_netns(dev, current->nsproxy->net_ns, net, name,
NULL);
put_device(&dev->dev);
+ if (ret == -EEXIST)
+ NL_SET_ERR_MSG(extack,
+ "Device name already exists in the target net namespace");
put_net(net);
return ret;
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 77a758080148..8648e95700bf 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1195,10 +1195,8 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
u32 ns_fd;
ns_fd = nla_get_u32(tb[RDMA_NLDEV_NET_NS_FD]);
- err = ib_device_set_netns_put(skb, device, ns_fd, NULL);
- if (err == -EEXIST)
- NL_SET_ERR_MSG(extack,
- "Device name already exists in the target net namespace");
+ err = ib_device_set_netns_put(skb, device, ns_fd, NULL,
+ extack);
goto put_done;
}
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 03/14] RDMA/core: Support renaming a device when changing its net namespace
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Allow namespace moves to request a destination device name. Keep requested
names on the same literal-name path as the existing RDMA rename operation,
and keep teardown fallback naming on the trusted kernel-controlled path.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/core/core_priv.h | 2 +-
drivers/infiniband/core/device.c | 48 ++++++++++++++++++++---------
drivers/infiniband/core/nldev.c | 2 +-
3 files changed, 35 insertions(+), 17 deletions(-)
diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
index 19104c542b27..3bd5bb7135a3 100644
--- a/drivers/infiniband/core/core_priv.h
+++ b/drivers/infiniband/core/core_priv.h
@@ -356,7 +356,7 @@ void ib_port_unregister_client_groups(struct ib_device *ibdev, u32 port_num,
const struct attribute_group **groups);
int ib_device_set_netns_put(struct sk_buff *skb,
- struct ib_device *dev, u32 ns_fd);
+ struct ib_device *dev, u32 ns_fd, const char *name);
int rdma_nl_net_init(struct rdma_dev_net *rnet);
void rdma_nl_net_exit(struct rdma_dev_net *rnet);
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index b55fb075d0ae..c0b6613dba4c 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -268,7 +268,8 @@ static struct notifier_block ibdev_lsm_nb = {
};
static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
- struct net *net, const char *fallback_pattern);
+ struct net *net, const char *requested_name,
+ const char *fallback_pattern);
/* Pointer to the RCU head at the start of the ib_port_data array */
struct ib_port_data_rcu {
@@ -1173,7 +1174,7 @@ static void rdma_dev_exit_net(struct net *net)
*/
if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
ret = rdma_dev_change_netns(dev, net, &init_net,
- "ibdev%d");
+ NULL, "ibdev%d");
if (ret && ret != -ENODEV)
WARN(1,
"Failed to move RDMA device %s to init_net on netns exit: %d\n",
@@ -1714,12 +1715,13 @@ static bool rdma_dev_name_in_netns(struct ib_device *skip, struct net *net,
}
/*
- * Choose the name @device should use in net namespace @net: keep the current
- * name when it is free, otherwise use a trusted '%d' @fallback_pattern
- * (namespace teardown) to pick a free index. The caller must hold the write
- * side of devices_rwsem.
+ * Choose the name @device should use in net namespace @net. @requested_name
+ * is used as a literal device name when set. Otherwise keep the current name
+ * when it is free, or use a trusted '%d' @fallback_pattern for teardown. The
+ * caller must hold the write side of devices_rwsem.
*/
static int rdma_dev_pick_netns_name(struct ib_device *device, struct net *net,
+ const char *requested_name,
const char *fallback_pattern,
char *buf, size_t buf_len,
const char **new_name)
@@ -1728,6 +1730,15 @@ static int rdma_dev_pick_netns_name(struct ib_device *device, struct net *net,
lockdep_assert_held_write(&devices_rwsem);
+ if (requested_name) {
+ if (!rdma_dev_name_in_netns(device, net, requested_name)) {
+ *new_name = requested_name;
+ return 0;
+ }
+
+ return -EEXIST;
+ }
+
if (!rdma_dev_name_in_netns(device, net, dev_name(&device->dev))) {
*new_name = dev_name(&device->dev);
return 0;
@@ -1758,7 +1769,8 @@ static int rdma_dev_pick_netns_name(struct ib_device *device, struct net *net,
* Naming rules are handled by rdma_dev_pick_netns_name().
*/
static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
- struct net *net, const char *fallback_pattern)
+ struct net *net, const char *requested_name,
+ const char *fallback_pattern)
{
char buf[IB_DEVICE_NAME_MAX];
const char *new_name;
@@ -1784,8 +1796,9 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
* down, so a doomed user move does not disable a live device.
*/
down_write(&devices_rwsem);
- ret = rdma_dev_pick_netns_name(device, net, fallback_pattern,
- buf, sizeof(buf), &new_name);
+ ret = rdma_dev_pick_netns_name(device, net, requested_name,
+ fallback_pattern, buf,
+ sizeof(buf), &new_name);
up_write(&devices_rwsem);
if (ret)
goto out;
@@ -1801,8 +1814,9 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
* level.
*/
down_write(&devices_rwsem);
- ret = rdma_dev_pick_netns_name(device, net, fallback_pattern, buf,
- sizeof(buf), &new_name);
+ ret = rdma_dev_pick_netns_name(device, net, requested_name,
+ fallback_pattern, buf, sizeof(buf),
+ &new_name);
if (ret) {
if (fallback_pattern) {
WARN(1,
@@ -1857,7 +1871,7 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
}
int ib_device_set_netns_put(struct sk_buff *skb,
- struct ib_device *dev, u32 ns_fd)
+ struct ib_device *dev, u32 ns_fd, const char *name)
{
struct net *net;
int ret;
@@ -1873,9 +1887,12 @@ int ib_device_set_netns_put(struct sk_buff *skb,
goto ns_err;
}
- /* Moving a device to the namespace it already lives in is a no-op. */
+ /*
+ * Moving a device to the namespace it already lives in is a no-op; a
+ * supplied name still renames it in place.
+ */
if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
- ret = 0;
+ ret = name ? ib_device_rename(dev, name) : 0;
goto ns_err;
}
@@ -1891,7 +1908,8 @@ int ib_device_set_netns_put(struct sk_buff *skb,
get_device(&dev->dev);
ib_device_put(dev);
- ret = rdma_dev_change_netns(dev, current->nsproxy->net_ns, net, NULL);
+ ret = rdma_dev_change_netns(dev, current->nsproxy->net_ns, net, name,
+ NULL);
put_device(&dev->dev);
put_net(net);
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index 32b6c4d68ca0..77a758080148 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1195,7 +1195,7 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
u32 ns_fd;
ns_fd = nla_get_u32(tb[RDMA_NLDEV_NET_NS_FD]);
- err = ib_device_set_netns_put(skb, device, ns_fd);
+ err = ib_device_set_netns_put(skb, device, ns_fd, NULL);
if (err == -EEXIST)
NL_SET_ERR_MSG(extack,
"Device name already exists in the target net namespace");
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 02/14] RDMA/core: Handle device name conflicts when changing net namespace
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Prepare namespace moves for per-netns names. Check user-initiated moves for
destination-name conflicts before disabling the device, keep same-netns
moves as no-ops, and make teardown moves detach from the exiting namespace
even if fallback naming fails.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
v1->v2:
- fixed possible bogus race-triggered-WARN in rdma_dev_exit_net()
---
drivers/infiniband/core/device.c | 155 ++++++++++++++++++++++++++-----
drivers/infiniband/core/nldev.c | 3 +
2 files changed, 137 insertions(+), 21 deletions(-)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index de610f52c9b2..b55fb075d0ae 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -268,7 +268,7 @@ static struct notifier_block ibdev_lsm_nb = {
};
static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
- struct net *net);
+ struct net *net, const char *fallback_pattern);
/* Pointer to the RCU head at the start of the ib_port_data array */
struct ib_port_data_rcu {
@@ -437,7 +437,8 @@ int ib_device_set_dim(struct ib_device *ibdev, u8 use_dim)
}
/* Pick a free index for the '%d' style @name pattern. */
-static int alloc_name_id(struct net *net, const char *name)
+static int __alloc_name_id(struct net *net, const char *name,
+ const struct ib_device *skip)
{
struct ib_device *device;
unsigned long index;
@@ -450,6 +451,8 @@ static int alloc_name_id(struct net *net, const char *name)
xa_for_each (&devices, index, device) {
char buf[IB_DEVICE_NAME_MAX];
+ if (device == skip)
+ continue;
if (sscanf(dev_name(&device->dev), name, &i) != 1)
continue;
if (i < 0 || i >= INT_MAX)
@@ -469,6 +472,11 @@ static int alloc_name_id(struct net *net, const char *name)
return rc;
}
+static int alloc_name_id(struct net *net, const char *name)
+{
+ return __alloc_name_id(net, name, NULL);
+}
+
static int alloc_name(struct ib_device *ibdev, const char *name)
{
int id;
@@ -1160,8 +1168,17 @@ static void rdma_dev_exit_net(struct net *net)
/*
* If the real device is in the NS then move it back to init.
+ * Provide a fallback pattern so a name conflict in init_net
+ * cannot make the teardown move fail.
*/
- rdma_dev_change_netns(dev, net, &init_net);
+ if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
+ ret = rdma_dev_change_netns(dev, net, &init_net,
+ "ibdev%d");
+ if (ret && ret != -ENODEV)
+ WARN(1,
+ "Failed to move RDMA device %s to init_net on netns exit: %d\n",
+ dev_name(&dev->dev), ret);
+ }
put_device(&dev->dev);
down_read(&devices_rwsem);
@@ -1680,14 +1697,71 @@ void ib_unregister_device_queued(struct ib_device *ib_dev)
}
EXPORT_SYMBOL(ib_unregister_device_queued);
+static bool rdma_dev_name_in_netns(struct ib_device *skip, struct net *net,
+ const char *name)
+{
+ struct ib_device *device;
+ unsigned long index;
+
+ lockdep_assert_held_write(&devices_rwsem);
+
+ xa_for_each(&devices, index, device)
+ if (device != skip &&
+ !strcmp(name, dev_name(&device->dev)))
+ return true;
+
+ return false;
+}
+
+/*
+ * Choose the name @device should use in net namespace @net: keep the current
+ * name when it is free, otherwise use a trusted '%d' @fallback_pattern
+ * (namespace teardown) to pick a free index. The caller must hold the write
+ * side of devices_rwsem.
+ */
+static int rdma_dev_pick_netns_name(struct ib_device *device, struct net *net,
+ const char *fallback_pattern,
+ char *buf, size_t buf_len,
+ const char **new_name)
+{
+ int id;
+
+ lockdep_assert_held_write(&devices_rwsem);
+
+ if (!rdma_dev_name_in_netns(device, net, dev_name(&device->dev))) {
+ *new_name = dev_name(&device->dev);
+ return 0;
+ }
+
+ if (!fallback_pattern)
+ return -EEXIST;
+
+ snprintf(buf, buf_len, "ibdev%u", device->index);
+ if (!rdma_dev_name_in_netns(device, net, buf)) {
+ *new_name = buf;
+ return 0;
+ }
+
+ id = __alloc_name_id(net, fallback_pattern, device);
+ if (id < 0)
+ return id;
+ snprintf(buf, buf_len, fallback_pattern, id);
+ *new_name = buf;
+ return 0;
+}
+
/*
* The caller must pass in a device that has the kref held and the refcount
* released. If the device is in cur_net and still registered then it is moved
* into net.
+ *
+ * Naming rules are handled by rdma_dev_pick_netns_name().
*/
static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
- struct net *net)
+ struct net *net, const char *fallback_pattern)
{
+ char buf[IB_DEVICE_NAME_MAX];
+ const char *new_name;
int ret2 = -EINVAL;
int ret;
@@ -1704,30 +1778,63 @@ static int rdma_dev_change_netns(struct ib_device *device, struct net *cur_net,
goto out;
}
+ if (!fallback_pattern) {
+ /*
+ * Reject a predictable name conflict before tearing anything
+ * down, so a doomed user move does not disable a live device.
+ */
+ down_write(&devices_rwsem);
+ ret = rdma_dev_pick_netns_name(device, net, fallback_pattern,
+ buf, sizeof(buf), &new_name);
+ up_write(&devices_rwsem);
+ if (ret)
+ goto out;
+ }
+
kobject_uevent(&device->dev.kobj, KOBJ_REMOVE);
disable_device(device);
/*
- * At this point no one can be using the device, so it is safe to
- * change the namespace.
+ * Recompute the destination name under the write side of devices_rwsem
+ * now that the device is disabled, closing races with a concurrent
+ * registration or rename, then publish the new namespace at the sysfs
+ * level.
*/
- write_pnet(&device->coredev.rdma_net, net);
+ down_write(&devices_rwsem);
+ ret = rdma_dev_pick_netns_name(device, net, fallback_pattern, buf,
+ sizeof(buf), &new_name);
+ if (ret) {
+ if (fallback_pattern) {
+ WARN(1,
+ "%s: failed to pick device name during namespace teardown: %d\n",
+ __func__, ret);
+ write_pnet(&device->coredev.rdma_net, net);
+ ret = 0;
+ }
+ goto rename_done;
+ }
- down_read(&devices_rwsem);
- /*
- * Currently rdma devices are system wide unique. So the device name
- * is guaranteed free in the new namespace. Publish the new namespace
- * at the sysfs level.
- */
- ret = device_rename(&device->dev, dev_name(&device->dev));
- up_read(&devices_rwsem);
+ write_pnet(&device->coredev.rdma_net, net);
+ ret = device_rename(&device->dev, new_name);
if (ret) {
- dev_warn(&device->dev,
- "%s: Couldn't rename device after namespace change\n",
- __func__);
- /* Try and put things back and re-enable the device */
- write_pnet(&device->coredev.rdma_net, cur_net);
+ if (fallback_pattern) {
+ WARN(1,
+ "%s: failed to rename device during namespace teardown: %d\n",
+ __func__, ret);
+ ret = 0;
+ } else {
+ dev_warn(&device->dev,
+ "%s: Couldn't rename device after namespace change\n",
+ __func__);
+ /* Try and put things back and re-enable the device */
+ write_pnet(&device->coredev.rdma_net, cur_net);
+ }
+ } else {
+ strscpy(device->name, dev_name(&device->dev),
+ IB_DEVICE_NAME_MAX);
}
+rename_done:
+ up_write(&devices_rwsem);
ret2 = enable_device_and_get(device);
if (ret2) {
@@ -1766,6 +1873,12 @@ int ib_device_set_netns_put(struct sk_buff *skb,
goto ns_err;
}
+ /* Moving a device to the namespace it already lives in is a no-op. */
+ if (net_eq(net, read_pnet(&dev->coredev.rdma_net))) {
+ ret = 0;
+ goto ns_err;
+ }
+
/*
* All the ib_clients, including uverbs, are reset when the namespace is
* changed and this cannot be blocked waiting for userspace to do
@@ -1778,7 +1891,7 @@ int ib_device_set_netns_put(struct sk_buff *skb,
get_device(&dev->dev);
ib_device_put(dev);
- ret = rdma_dev_change_netns(dev, current->nsproxy->net_ns, net);
+ ret = rdma_dev_change_netns(dev, current->nsproxy->net_ns, net, NULL);
put_device(&dev->dev);
put_net(net);
diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
index aae4f3f6bcba..32b6c4d68ca0 100644
--- a/drivers/infiniband/core/nldev.c
+++ b/drivers/infiniband/core/nldev.c
@@ -1196,6 +1196,9 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
ns_fd = nla_get_u32(tb[RDMA_NLDEV_NET_NS_FD]);
err = ib_device_set_netns_put(skb, device, ns_fd);
+ if (err == -EEXIST)
+ NL_SET_ERR_MSG(extack,
+ "Device name already exists in the target net namespace");
goto put_done;
}
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 01/14] RDMA/core: Pass the net namespace to the device name lookups
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
In-Reply-To: <20260714142927.1298897-1-jiri@resnulli.us>
From: Jiri Pirko <jiri@nvidia.com>
Prepare for per-netns RDMA device names by passing the target net
namespace through the name lookup and allocation helpers. Keep current
global uniqueness behaviour.
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
---
drivers/infiniband/core/device.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index b8193e077a74..de610f52c9b2 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -351,7 +351,8 @@ void ib_device_put(struct ib_device *device)
}
EXPORT_SYMBOL(ib_device_put);
-static struct ib_device *__ib_device_get_by_name(const char *name)
+static struct ib_device *__ib_device_get_by_name(const char *name,
+ const struct net *net)
{
struct ib_device *device;
unsigned long index;
@@ -395,7 +396,7 @@ int ib_device_rename(struct ib_device *ibdev, const char *name)
return 0;
}
- if (__ib_device_get_by_name(name)) {
+ if (__ib_device_get_by_name(name, rdma_dev_net(ibdev))) {
up_write(&devices_rwsem);
return -EEXIST;
}
@@ -435,7 +436,8 @@ int ib_device_set_dim(struct ib_device *ibdev, u8 use_dim)
return 0;
}
-static int alloc_name(struct ib_device *ibdev, const char *name)
+/* Pick a free index for the '%d' style @name pattern. */
+static int alloc_name_id(struct net *net, const char *name)
{
struct ib_device *device;
unsigned long index;
@@ -462,15 +464,22 @@ static int alloc_name(struct ib_device *ibdev, const char *name)
}
rc = ida_alloc(&inuse, GFP_KERNEL);
- if (rc < 0)
- goto out;
-
- rc = dev_set_name(&ibdev->dev, name, rc);
out:
ida_destroy(&inuse);
return rc;
}
+static int alloc_name(struct ib_device *ibdev, const char *name)
+{
+ int id;
+
+ id = alloc_name_id(rdma_dev_net(ibdev), name);
+ if (id < 0)
+ return id;
+
+ return dev_set_name(&ibdev->dev, name, id);
+}
+
static void ib_device_release(struct device *device)
{
struct ib_device *dev = container_of(device, struct ib_device, dev);
@@ -1223,7 +1232,8 @@ static int assign_name(struct ib_device *device, const char *name)
if (ret)
goto out;
- if (__ib_device_get_by_name(dev_name(&device->dev))) {
+ if (__ib_device_get_by_name(dev_name(&device->dev),
+ rdma_dev_net(device))) {
ret = -ENFILE;
goto out;
}
--
2.54.0
^ permalink raw reply related
* [PATCH rdma-next v2 00/14] RDMA: Make device names unique per net namespace
From: Jiri Pirko @ 2026-07-14 14:29 UTC (permalink / raw)
To: linux-rdma
Cc: cgroups, netdev, linux-s390, linux-kselftest, jgg, leon, parav,
mbloch, cmeiohas, roman.gushchin, bvanassche, zyjzyj2000, shuah,
tj, mkoutny, hannes, alibuda, dust.li, sidraya, wenjia,
yanjun.zhu, cui.tao
From: Jiri Pirko <jiri@nvidia.com>
RDMA device names are unique system-wide today:
__ib_device_get_by_name() checks a requested name against every
registered device regardless of the network namespace it lives in.
A device in one network namespace therefore cannot use a name already
taken in another, even in exclusive netns mode (netns_mode=0) where
the two are otherwise isolated. Net devices have no such restriction -
their names only need to be unique within a network namespace.
This series makes RDMA device names unique per network namespace,
matching net device semantics, and adapts the users that assumed
system-wide unique names.
Scoping reuses the existing rdma_dev_access_netns() predicate, so
behavior only changes in exclusive mode:
- shared mode (default): names stay unique system-wide, no change;
- exclusive mode: names only need to be unique within a namespace;
- CONFIG_NET_NS=n: everything is init_net, names stay system-wide
unique.
There are two users that cannot be made per-namespace and are
documented as known limitations instead of changed:
- the rdma_cm configfs tree: configfs has no network namespace
support, so it cannot represent two same-named devices;
- SELinux ibendport labelling: endports are labelled by (device
name, port) from a global policy; distinguishing same-named
devices would need net namespace support in the SELinux policy
language and tooling.
Tested with the new rxe_netns_names kselftest added in the last patch.
Jiri Pirko (14):
RDMA/core: Pass the net namespace to the device name lookups
RDMA/core: Handle device name conflicts when changing net namespace
RDMA/core: Support renaming a device when changing its net namespace
RDMA/nldev: Report net namespace move errors through extack
RDMA/nldev: Allow setting the device name while changing net namespace
net/smc: Look up the pnetid ib device within the net namespace
RDMA/srp: Make the SRP sysfs class net namespace aware
RDMA/cgroup: Disambiguate devices across net namespaces
RDMA/cma: Document that CM configfs cannot be net namespace scoped
RDMA/core: Document the SELinux ibendport net namespace limitation
RDMA/core: Make device names unique per net namespace
RDMA/rxe: Allow queue VMAs to outlive ucontexts
RDMA/rxe: Implement disassociate_ucontext callback
RDMA/selftests: Add rxe_netns_names test
Documentation/ABI/testing/configfs-rdma_cm | 4 +
Documentation/admin-guide/cgroup-v1/rdma.rst | 8 +
Documentation/admin-guide/cgroup-v2.rst | 15 +-
drivers/infiniband/core/cgroup.c | 1 +
drivers/infiniband/core/cma_configfs.c | 4 +
drivers/infiniband/core/core_priv.h | 3 +-
drivers/infiniband/core/device.c | 245 ++++++++++++---
drivers/infiniband/core/nldev.c | 26 +-
drivers/infiniband/core/security.c | 6 +
drivers/infiniband/sw/rxe/rxe_mmap.c | 35 +--
drivers/infiniband/sw/rxe/rxe_verbs.c | 5 +
drivers/infiniband/ulp/srp/ib_srp.c | 16 +-
include/linux/cgroup_rdma.h | 1 +
include/uapi/rdma/rdma_netlink.h | 5 +-
kernel/cgroup/rdma.c | 71 ++++-
net/smc/smc_pnet.c | 20 +-
tools/testing/selftests/rdma/Makefile | 3 +-
tools/testing/selftests/rdma/config | 2 +
.../testing/selftests/rdma/rxe_netns_names.sh | 282 ++++++++++++++++++
19 files changed, 653 insertions(+), 99 deletions(-)
create mode 100755 tools/testing/selftests/rdma/rxe_netns_names.sh
--
2.54.0
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free in dynamic port cleanup
From: Loktionov, Aleksandr @ 2026-07-14 14:24 UTC (permalink / raw)
To: xuanqiang.luo@linux.dev, intel-wired-lan@lists.osuosl.org
Cc: Nguyen, Anthony L, Kitszel, Przemyslaw, andrew+netdev@lunn.ch,
Samudrala, Sridhar, Drewek, Wojciech, piotr.raczynski@intel.com,
michal.swiatkowski@linux.intel.com, Keller, Jacob E,
netdev@vger.kernel.org, Xuanqiang Luo, stable@vger.kernel.org
In-Reply-To: <20260714063937.26325-1-xuanqiang.luo@linux.dev>
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of xuanqiang.luo@linux.dev
> Sent: Tuesday, July 14, 2026 8:40 AM
> To: intel-wired-lan@lists.osuosl.org
> Cc: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; andrew+netdev@lunn.ch;
> Samudrala, Sridhar <sridhar.samudrala@intel.com>; Drewek, Wojciech
> <wojciech.drewek@intel.com>; piotr.raczynski@intel.com;
> michal.swiatkowski@linux.intel.com; Keller, Jacob E
> <jacob.e.keller@intel.com>; netdev@vger.kernel.org; Xuanqiang Luo
> <luoxuanqiang@kylinos.cn>; stable@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free
> in dynamic port cleanup
>
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the
> dynamic port from pf->dyn_ports. However, it frees the VSI before
> reading the index for the erase, resulting in a use-after-free.
>
> Follow the reverse of the allocation order in ice_alloc_dynamic_port()
> by erasing the xarray entry before freeing the VSI.
>
> Fixes: eda69d654c7e ("ice: add basic devlink subfunctions support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> ---
> drivers/net/ethernet/intel/ice/devlink/port.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/devlink/port.c
> b/drivers/net/ethernet/intel/ice/devlink/port.c
> index 2a2e56777f9f7..3ede246490027 100644
> --- a/drivers/net/ethernet/intel/ice/devlink/port.c
> +++ b/drivers/net/ethernet/intel/ice/devlink/port.c
> @@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct
> ice_dynamic_port *dyn_port)
>
> xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf);
> ice_eswitch_detach_sf(pf, dyn_port);
> - ice_vsi_free(dyn_port->vsi);
> xa_erase(&pf->dyn_ports, dyn_port->vsi->idx);
> + ice_vsi_free(dyn_port->vsi);
> kfree(dyn_port);
> }
>
> --
> 2.43.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
^ permalink raw reply
* Re: [PATCH nf v3 2/2] ipvs: use bitops for destination overload state
From: Yizhou Zhao @ 2026-07-14 14:22 UTC (permalink / raw)
To: Julian Anastasov
Cc: David Ahern, Ido Schimmel, Simon Horman, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Pablo Neira Ayuso,
Florian Westphal, Phil Sutter, netdev, lvs-devel, linux-kernel,
netfilter-devel, coreteam, stable, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu
In-Reply-To: <a82b528b-2710-3978-fc18-ef902fd903e1@ssi.bg>
Hi Julian,
> On Jul 14, 2026, at 19:16, Julian Anastasov <ja@ssi.bg> wrote:
>
>
> Hi Yizhou,
>
> On Mon, 13 Jul 2026, Yizhou Zhao wrote:
>
>> IPVS destination schedulers read the overload state from packet processing
>> paths, while connection accounting and destination updates can change it
>> concurrently. IP_VS_DEST_F_OVERLOAD currently shares dest->flags with
>> IP_VS_DEST_F_AVAILABLE, so plain read-modify-write operations on the two
>> independent states can race and lose either update.
>>
>> KCSAN reports the race with the SH scheduler and an upper connection
>> threshold configured:
>>
>> BUG: KCSAN: data-race in __ip_vs_update_dest / ip_vs_sh_schedule
>>
>> IP_VS_DEST_F_AVAILABLE is changed under service_mutex. Keep it in the
>> existing flags word, but move the overload state to a separate unsigned
>> long and access it with bitops. Use test_bit() in scheduler paths and
>> set_bit()/clear_bit() in ip_vs_dest_update_overload(). This serializes the
>> overload bit accesses and prevents updates to the available and overload
>> states from clobbering each other.
>>
>> The destination flags are not exposed by the IPVS sockopt or netlink
>> interfaces, so move their definitions out of the UAPI header. Place the
>> new overload word next to weight, which keeps the existing flags,
>> conn_flags and weight offsets unchanged. On x86-64 this grows struct
>> ip_vs_dest from 472 to 480 bytes.
>>
>> test_bit() does not add reader-side ordering. Schedulers can still observe
>> stale destination state, as they could before this change; this does not
>> provide a fresh cross-field snapshot.
>>
>> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
>> Cc: stable@vger.kernel.org
>> Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
>> Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
>> Reported-by: Ao Wang <wangao@seu.edu.cn>
>> Reported-by: Xuewei Feng <fengxw06@126.com>
>> Reported-by: Qi Li <qli01@tsinghua.edu.cn>
>> Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
>> Assisted-by: Claude-Code:GLM-5.2
>> Suggested-by: Julian Anastasov <ja@ssi.bg>
>> Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
>> ---
>> include/net/ip_vs.h | 8 ++++++++
>> include/uapi/linux/ip_vs.h | 6 ------
>> net/netfilter/ipvs/ip_vs_conn.c | 7 ++++---
>> net/netfilter/ipvs/ip_vs_dh.c | 4 ++--
>> net/netfilter/ipvs/ip_vs_fo.c | 2 +-
>> net/netfilter/ipvs/ip_vs_lblc.c | 4 ++--
>> net/netfilter/ipvs/ip_vs_lblcr.c | 8 ++++----
>> net/netfilter/ipvs/ip_vs_lc.c | 2 +-
>> net/netfilter/ipvs/ip_vs_mh.c | 2 +-
>> net/netfilter/ipvs/ip_vs_nq.c | 2 +-
>> net/netfilter/ipvs/ip_vs_ovf.c | 2 +-
>> net/netfilter/ipvs/ip_vs_rr.c | 2 +-
>> net/netfilter/ipvs/ip_vs_sed.c | 4 ++--
>> net/netfilter/ipvs/ip_vs_sh.c | 2 +-
>> net/netfilter/ipvs/ip_vs_twos.c | 4 ++--
>> net/netfilter/ipvs/ip_vs_wlc.c | 4 ++--
>> net/netfilter/ipvs/ip_vs_wrr.c | 2 +-
>> 17 files changed, 34 insertions(+), 31 deletions(-)
>>
>> diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
>> index 3fc864a320fb..5e8e55f82b04 100644
>> --- a/include/net/ip_vs.h
>> +++ b/include/net/ip_vs.h
>> @@ -36,6 +36,13 @@
>> #define IP_VS_HDR_INVERSE 1
>> #define IP_VS_HDR_ICMP 2
>>
>> +/* Destination Server Flags */
>> +#define IP_VS_DEST_F_AVAILABLE 0x0001 /* server is available */
>> +
>> +enum {
>> + IP_VS_DEST_FL_OVERLOAD,
>> +};
>> +
>> /* conn_tab limits (as per Kconfig) */
>> #define IP_VS_CONN_TAB_MIN_BITS 8
>> #if BITS_PER_LONG > 32
>> @@ -976,6 +983,7 @@ struct ip_vs_dest {
>> volatile unsigned int flags; /* dest status flags */
>
> Sashiko has some comments that we should fix somehow:
>
> https://sashiko.dev/#/patchset/cover.1783931964.git.zhaoyz24%40mails.tsinghua.edu.cn
>
> One option is IP_VS_DEST_F_AVAILABLE to become
> IP_VS_DEST_CF_AVAILABLE (CF=Config Flag)
>
>> atomic_t conn_flags; /* flags to copy to conn */
>> atomic_t weight; /* server weight */
>> + unsigned long flags2; /* dest status flags */
>
> unsigned long cfg_flags;
>
> We then put IP_VS_DEST_CF_AVAILABLE in this new cache line
> that most of the schedulers will not read until dest is selected.
> DH even should not check the IP_VS_DEST_F_AVAILABLE flag,
> only lblc/lblcr should use this flag.
I agree that moving AVAILABLE to a separate cfg_flags word
looks better for the scheduler cacheline footprint than my flags2
placement.
>
> We can preserve IP_VS_DEST_F_OVERLOAD in 'flags',
> even we may not need to use bitops if we start to use
> spin_lock_bh(&dest->dst_lock), as this lock is already
> present in the dest structure. See below...
>
>> atomic_t last_weight; /* server latest weight */
>> __u16 tun_type; /* tunnel type */
>> __be16 tun_port; /* tunnel port */
>
>> diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
>> index fa3fbd597f3f..2591f4e143f8 100644
>> --- a/net/netfilter/ipvs/ip_vs_conn.c
>> +++ b/net/netfilter/ipvs/ip_vs_conn.c
>> @@ -1006,7 +1006,7 @@ __always_inline void ip_vs_dest_update_overload(struct ip_vs_dest *dest)
>
> We can add new arg 'bool locked'. Also, we will
> return false if caller should retry under lock.
> It will happen when we change IP_VS_DEST_F_OVERLOAD and
> require its changes to be synchronized with the
> thresholds and the number of connections.
>
>> goto unset;
>> conns = ip_vs_dest_totalconns(dest);
>> if (conns >= u) {
>> - dest->flags |= IP_VS_DEST_F_OVERLOAD;
>> + set_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2);
>
>
> if (conns >= u) {
> if (!locked)
> return false;
> dest->flags |= IP_VS_DEST_F_OVERLOAD;
> return true;
> }
>
>> return;
>> }
>> /* Low threshold defaults to 75% of upper threshold */
>> @@ -1015,7 +1015,8 @@ __always_inline void ip_vs_dest_update_overload(struct ip_vs_dest *dest)
>> return;
>>
>> unset:
>> - dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
>> + if (test_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2))
>> + clear_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2);
>
> if (dest->flags & IP_VS_DEST_F_OVERLOAD) {
> if (!locked)
> return false;
> dest->flags &= ~IP_VS_DEST_F_OVERLOAD;
> }
> return true;
>
>> }
>>
>> /*
>> @@ -1174,7 +1175,7 @@ static inline void ip_vs_unbind_dest(struct ip_vs_conn *cp)
>> atomic_dec(&dest->persistconns);
>> }
>>
>> - if (dest->flags & IP_VS_DEST_F_OVERLOAD)
>> + if (test_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2))
>> ip_vs_dest_update_overload(dest);
>
> if (dest->flags & IP_VS_DEST_F_OVERLOAD) {
> if (!ip_vs_dest_update_overload(dest, false)) {
> spin_lock_bh(&dest->dst_lock);
> ip_vs_dest_update_overload(dest, true);
> spin_unlock_bh(&dest->dst_lock);
> }
> }
>
> In __ip_vs_update_dest() we will always use lock:
>
> spin_lock_bh(&dest->dst_lock);
> WRITE_ONCE(dest->u_threshold, udest->u_threshold);
> WRITE_ONCE(dest->l_threshold, udest->l_threshold);
> ip_vs_dest_update_overload(dest, true);
> spin_unlock_bh(&dest->dst_lock);
>
> The goal is to avoid the lock for the common case
> when flag does not change. What do you think?
I looked more closely at the proposed dst_lock retry. I think there
is still a window because the connection counters are modified
outside dst_lock in this approach.
For example, CPU A can bind a connection, take dst_lock, and in
ip_vs_dest_update_overload(dest, true) observe conns >= u. Before it
sets OVERLOAD, CPU B can expire the remaining connections. Since
OVERLOAD is still clear, B skips the unbind helper and does not take
dst_lock. CPU A can then resume and set OVERLOAD after the connection
count has reached zero.
At that point no later unbind is guaranteed to clear the bit, while
schedulers can avoid the destination because it appears overloaded.
The correct solution is to take dst_lock for every bind/unbind, however, it
seems costly. I’m sorry I didn’t find a better solution. Is there a lighter
synchronization scheme you had in mind?
>
> Regards
>
> --
> Julian Anastasov <ja@ssi.bg>
Regards,
Yizhou
^ permalink raw reply
* Re: [Intel-wired-lan] [PATCH iwl-net v1] ice: fix use-after-free in dynamic port cleanup
From: Marcin Szycik @ 2026-07-14 14:14 UTC (permalink / raw)
To: xuanqiang.luo, intel-wired-lan
Cc: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev,
sridhar.samudrala, wojciech.drewek, piotr.raczynski,
michal.swiatkowski, jacob.e.keller, netdev, Xuanqiang Luo, stable
In-Reply-To: <20260714063937.26325-1-xuanqiang.luo@linux.dev>
On 14.07.2026 08:39, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic
> port from pf->dyn_ports. However, it frees the VSI before reading the
> index for the erase, resulting in a use-after-free.
>
> Follow the reverse of the allocation order in ice_alloc_dynamic_port()
> by erasing the xarray entry before freeing the VSI.
>
> Fixes: eda69d654c7e ("ice: add basic devlink subfunctions support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Thank you!
I wonder how such a glaring issue survived in the codebase for so long.
Perhaps ice_vsi_free() exited early for some reason.
> ---
> drivers/net/ethernet/intel/ice/devlink/port.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/devlink/port.c b/drivers/net/ethernet/intel/ice/devlink/port.c
> index 2a2e56777f9f7..3ede246490027 100644
> --- a/drivers/net/ethernet/intel/ice/devlink/port.c
> +++ b/drivers/net/ethernet/intel/ice/devlink/port.c
> @@ -590,8 +590,8 @@ static void ice_dealloc_dynamic_port(struct ice_dynamic_port *dyn_port)
>
> xa_erase(&pf->sf_nums, devlink_port->attrs.pci_sf.sf);
> ice_eswitch_detach_sf(pf, dyn_port);
> - ice_vsi_free(dyn_port->vsi);
> xa_erase(&pf->dyn_ports, dyn_port->vsi->idx);
> + ice_vsi_free(dyn_port->vsi);
> kfree(dyn_port);
> }
>
^ permalink raw reply
* [PATCH v3 net 6/6] selftests/xsk: account invalid multi-buffer Tx descriptors
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Maciej Fijalkowski
In-Reply-To: <20260714140722.111645-1-maciej.fijalkowski@intel.com>
Invalid descriptors in the middle of a multi-buffer packet still belong
to the packet being consumed from the Tx ring. The tests should therefore
count the whole invalid packet as outstanding in verbatim mode, even
though the packet must not be expected on the Rx side.
Make fragment counting follow the packet boundary instead of stopping at
the first invalid fragment. Update custom stream generation so invalid
middle fragments terminate the generated Rx packet while Tx accounting
still covers all descriptors consumed from the invalid multi-buffer
packet.
Also add explicit end fragments after invalid middle descriptors. This
exercises the kernel drain logic and verifies that subsequent valid
packets are not interpreted as continuations of the invalid packet.
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
---
.../selftests/bpf/prog_tests/test_xsk.c | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_xsk.c b/tools/testing/selftests/bpf/prog_tests/test_xsk.c
index de17dd48f176..7abb4935edf9 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_xsk.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_xsk.c
@@ -427,14 +427,14 @@ static u32 pkt_nb_frags(u32 frame_size, struct pkt_stream *pkt_stream, struct pk
}
/* Search for the end of the packet in verbatim mode */
- if (!pkt_continues(pkt->options) || !pkt->valid)
+ if (!pkt_continues(pkt->options))
return nb_frags;
next_frag = pkt_stream->current_pkt_nb;
pkt++;
while (next_frag++ < pkt_stream->nb_pkts) {
nb_frags++;
- if (!pkt_continues(pkt->options) || !pkt->valid)
+ if (!pkt_continues(pkt->options))
break;
pkt++;
}
@@ -665,11 +665,11 @@ static struct pkt_stream *__pkt_stream_generate_custom(struct ifobject *ifobj, s
if (!frame->valid || !pkt_continues(frame->options))
payload++;
} else {
- if (frame->valid)
+ if (frame->valid) {
len += frame->len;
- if (frame->valid && pkt_continues(frame->options))
- continue;
-
+ if (pkt_continues(frame->options))
+ continue;
+ }
pkt->pkt_nb = pkt_nb;
pkt->len = len;
pkt->valid = frame->valid;
@@ -1209,6 +1209,7 @@ static int __send_pkts(struct ifobject *ifobject, struct xsk_socket_info *xsk,
for (i = 0; i < xsk->batch_size; i++) {
struct pkt *pkt = pkt_stream_get_next_tx_pkt(pkt_stream);
u32 nb_frags_left, nb_frags, bytes_written = 0;
+ struct pkt *first_pkt = pkt;
if (!pkt)
break;
@@ -1253,6 +1254,8 @@ static int __send_pkts(struct ifobject *ifobject, struct xsk_socket_info *xsk,
if (pkt && pkt->valid) {
valid_pkts++;
valid_frags += nb_frags;
+ } else if (pkt_stream->verbatim && pkt_continues(first_pkt->options)) {
+ valid_frags += nb_frags;
}
}
@@ -2099,13 +2102,16 @@ int testapp_invalid_desc_mb(struct test_spec *test)
{0, 0, 0, false, 0},
/* Invalid address in the second frame */
{0, XSK_UMEM__LARGE_FRAME_SIZE, 0, false, XDP_PKT_CONTD},
- {umem_sz, XSK_UMEM__LARGE_FRAME_SIZE, 0, false, XDP_PKT_CONTD},
+ {umem_sz * 2, XSK_UMEM__LARGE_FRAME_SIZE, 0, false, XDP_PKT_CONTD},
+ {0, MIN_PKT_SIZE, 0, false, 0},
/* Invalid len in the middle */
{0, XSK_UMEM__LARGE_FRAME_SIZE, 0, false, XDP_PKT_CONTD},
{0, XSK_UMEM__INVALID_FRAME_SIZE, 0, false, XDP_PKT_CONTD},
+ {0, MIN_PKT_SIZE, 0, false, 0},
/* Invalid options in the middle */
{0, XSK_UMEM__LARGE_FRAME_SIZE, 0, false, XDP_PKT_CONTD},
{0, XSK_UMEM__LARGE_FRAME_SIZE, 0, false, XSK_DESC__INVALID_OPTION},
+ {0, MIN_PKT_SIZE, 0, false, 0},
/* Transmit 2 frags, receive 3 */
{0, XSK_UMEM__MAX_FRAME_SIZE, 0, true, XDP_PKT_CONTD},
{0, XSK_UMEM__MAX_FRAME_SIZE, 0, true, 0},
@@ -2117,8 +2123,8 @@ int testapp_invalid_desc_mb(struct test_spec *test)
if (umem->unaligned_mode) {
/* Crossing a chunk boundary allowed */
- pkts[12].valid = true;
- pkts[13].valid = true;
+ pkts[15].valid = true;
+ pkts[16].valid = true;
}
test->mtu = MAX_ETH_JUMBO_SIZE;
--
2.43.0
^ permalink raw reply related
* [PATCH v3 net 5/6] selftests/xsk: fix too-many-frags multi-buffer Tx test
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Maciej Fijalkowski
In-Reply-To: <20260714140722.111645-1-maciej.fijalkowski@intel.com>
The too-many-frags test describes a packet that is valid from the Tx
ring ownership point of view, but invalid for transmission because it
exceeds the supported number of fragments.
Keep the generated Tx descriptors valid so that __send_pkts() accounts
them as outstanding descriptors that must be reclaimed through the CQ.
Then mark the corresponding Rx packet invalid so the test still does
not expect the oversized packet to appear on the receive side.
Add a valid synchronization packet after the oversized packet so the
test can verify that the Tx path drains the bad packet and resumes at
the next packet boundary.
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
---
.../selftests/bpf/prog_tests/test_xsk.c | 24 ++++++++++++-------
1 file changed, 15 insertions(+), 9 deletions(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/test_xsk.c b/tools/testing/selftests/bpf/prog_tests/test_xsk.c
index 6eb9096d084c..de17dd48f176 100644
--- a/tools/testing/selftests/bpf/prog_tests/test_xsk.c
+++ b/tools/testing/selftests/bpf/prog_tests/test_xsk.c
@@ -2270,7 +2270,7 @@ int testapp_too_many_frags(struct test_spec *test)
max_frags += 1;
}
- pkts = calloc(2 * max_frags + 2, sizeof(struct pkt));
+ pkts = calloc(2 * max_frags + 3, sizeof(struct pkt));
if (!pkts)
return TEST_FAILURE;
@@ -2288,24 +2288,30 @@ int testapp_too_many_frags(struct test_spec *test)
}
pkts[max_frags].options = 0;
- /* An invalid packet with the max amount of frags but signals packet
- * continues on the last frag
- */
- for (i = max_frags + 1; i < 2 * max_frags + 1; i++) {
+ /* An invalid packet with the max + 1 amount of frags */
+ for (i = max_frags + 1; i < 2 * max_frags + 2; i++) {
pkts[i].len = MIN_PKT_SIZE;
pkts[i].options = XDP_PKT_CONTD;
- pkts[i].valid = false;
+ pkts[i].valid = true;
}
+ pkts[2 * max_frags + 1].options = 0;
/* Valid packet for synch */
- pkts[2 * max_frags + 1].len = MIN_PKT_SIZE;
- pkts[2 * max_frags + 1].valid = true;
+ pkts[2 * max_frags + 2].len = MIN_PKT_SIZE;
+ pkts[2 * max_frags + 2].valid = true;
- if (pkt_stream_generate_custom(test, pkts, 2 * max_frags + 2)) {
+ if (pkt_stream_generate_custom(test, pkts, 2 * max_frags + 3)) {
free(pkts);
return TEST_FAILURE;
}
+ /* The generated Tx stream must keep the too-big packet valid so that
+ * __send_pkts() accounts its descriptors in outstanding_tx. The Rx
+ * stream, however, must not expect this packet on the wire.
+ */
+ test->ifobj_rx->xsk->pkt_stream->pkts[2].valid = false;
+ test->ifobj_rx->xsk->pkt_stream->nb_valid_entries--;
+
ret = testapp_validate_traffic(test);
free(pkts);
return ret;
--
2.43.0
^ permalink raw reply related
* [PATCH v3 net 4/6] xsk: reclaim invalid multi-buffer Tx descs in ZC path
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Maciej Fijalkowski
In-Reply-To: <20260714140722.111645-1-maciej.fijalkowski@intel.com>
The zero-copy Tx batch parser stops when it encounters an invalid
descriptor. If this happens after one or more continuation descriptors,
the Tx consumer can be advanced past fragments that are neither submitted
to the driver nor returned to userspace through the completion ring.
A similar problem occurs when a packet exceeds xdp_zc_max_segs. The
descriptors consumed up to the limit are released without completion, and
the remaining continuation descriptors can subsequently be interpreted
as the beginning of another packet.
Parse Tx batches in packet units and distinguish descriptors belonging to
complete valid packets from descriptors consumed while draining an
invalid or oversized packet. Return the former to the driver and append
the latter to the CQ address area so userspace can reclaim their UMEM
frames.
Once draining starts, continue until the packet's end-of-packet
descriptor is consumed. Preserve the drain state on the socket when EOP
has not yet been supplied, so draining can continue during a later call.
Leave incomplete but otherwise valid packets on the Tx ring. Keep the
existing handling of standalone invalid descriptors unchanged.
Shared-UMEM pools using multi-buffer Tx also need packet-framed parsing.
Walk their Tx sockets one packet at a time, preserving the existing
per-socket fairness scheme, instead of using the legacy one-descriptor
fallback. Keep that fallback for shared pools that do not use
multi-buffer Tx. Since the drain state is maintained per socket and both
the singular and shared paths can resume an interrupted drain, changing
the socket list from singular to shared requires no special bind-time
transition.
CQ entries are positional, and drivers may complete only part of the Tx
work returned by xsk_tx_peek_release_desc_batch(). Therefore, reclaim-only
entries cannot be published immediately when earlier driver-visible
descriptors are still outstanding.
Track the number of driver-visible CQ entries preceding the reclaim
entries. Let xsk_tx_completed() publish partial real Tx completions, and
publish the reclaim entries only after every earlier Tx descriptor has
completed. Complete a reclaim-only batch immediately when there is no
driver-visible work in front of it, and prevent another Tx batch from
being appended while reclaim entries remain pending.
Also cap batch processing by the size of the pool's temporary descriptor
array, as Tx rings belonging to sockets sharing a UMEM may have different
sizes.
This ensures that every descriptor consumed as part of an invalid
multi-buffer packet is eventually returned to userspace without exposing
the dropped packet to the driver or violating CQ completion ordering.
Fixes: cf24f5a5feea ("xsk: add support for AF_XDP multi-buffer on Tx path")
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
---
include/net/xsk_buff_pool.h | 3 +
net/xdp/xsk.c | 192 ++++++++++++++++++++++++++++++++----
net/xdp/xsk_buff_pool.c | 1 +
net/xdp/xsk_queue.h | 76 ++++++++++----
4 files changed, 232 insertions(+), 40 deletions(-)
diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h
index f5e737a83055..2bb1d122b1bc 100644
--- a/include/net/xsk_buff_pool.h
+++ b/include/net/xsk_buff_pool.h
@@ -78,6 +78,9 @@ struct xsk_buff_pool {
u32 chunk_size;
u32 chunk_shift;
u32 frame_len;
+ u32 tx_descs_nentries;
+ u32 reclaim_descs;
+ u32 tx_zc_pending_descs;
u32 xdp_zc_max_segs;
u8 tx_metadata_len; /* inherited from umem */
u8 cached_need_wakeup;
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 385a3f4a1b32..2909a0ec6837 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -499,6 +499,23 @@ void __xsk_map_flush(struct list_head *flush_list)
void xsk_tx_completed(struct xsk_buff_pool *pool, u32 nb_entries)
{
+ u32 reclaim_descs = READ_ONCE(pool->reclaim_descs);
+
+ if (unlikely(reclaim_descs)) {
+ u32 pending_descs = READ_ONCE(pool->tx_zc_pending_descs);
+
+ if (nb_entries < pending_descs) {
+ WRITE_ONCE(pool->tx_zc_pending_descs,
+ pending_descs - nb_entries);
+ xskq_prod_submit_n(pool->cq, nb_entries);
+ return;
+ }
+
+ WRITE_ONCE(pool->tx_zc_pending_descs, 0);
+ nb_entries += reclaim_descs;
+ WRITE_ONCE(pool->reclaim_descs, 0);
+ }
+
xskq_prod_submit_n(pool->cq, nb_entries);
}
EXPORT_SYMBOL(xsk_tx_completed);
@@ -574,24 +591,162 @@ static u32 xsk_tx_peek_release_fallback(struct xsk_buff_pool *pool, u32 max_entr
return nb_pkts;
}
+static void xsk_tx_commit_batch(struct xsk_buff_pool *pool,
+ struct xsk_tx_batch *batch)
+{
+ u32 nb_descs = xsk_tx_batch_cq_descs(batch);
+ u32 cq_cached_prod;
+
+ if (!nb_descs)
+ return;
+
+ cq_cached_prod = pool->cq->cached_prod;
+ xskq_prod_write_addr_batch(pool->cq, pool->tx_descs, nb_descs);
+
+ if (unlikely(batch->reclaim_descs)) {
+ u32 cq_pending_descs;
+
+ /* CQ is positional. Descriptors already written but not
+ * submitted must complete before any reclaim-only descriptors
+ * appended below.
+ */
+ cq_pending_descs = cq_cached_prod - xskq_get_prod(pool->cq);
+
+ WRITE_ONCE(pool->tx_zc_pending_descs,
+ batch->tx_descs + cq_pending_descs);
+ WRITE_ONCE(pool->reclaim_descs, batch->reclaim_descs);
+ if (unlikely(!pool->tx_zc_pending_descs))
+ xsk_tx_completed(pool, 0);
+ }
+}
+
+static struct xsk_tx_batch
+__xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, struct xdp_sock *xs,
+ struct xdp_desc *descs, u32 max_descs)
+{
+ struct xsk_tx_batch batch = {};
+ u32 entries;
+
+ entries = xskq_cons_nb_entries(xs->tx, max_descs);
+ if (!entries)
+ return batch;
+
+ batch = xskq_cons_read_desc_batch(xs, pool, descs, max_descs);
+ if (!xsk_tx_batch_cq_descs(&batch)) {
+ xs->tx->queue_empty_descs++;
+ if (batch.consumed_descs) {
+ __xskq_cons_release(xs->tx);
+ xs->sk.sk_write_space(&xs->sk);
+ }
+ return batch;
+ }
+
+ __xskq_cons_release(xs->tx);
+ xs->sk.sk_write_space(&xs->sk);
+ return batch;
+}
+
+static struct xsk_tx_batch
+xsk_tx_peek_release_shared_desc_batch(struct xsk_buff_pool *pool, u32 max_descs)
+{
+ u32 cq_descs_before, cq_descs_after;
+ struct xsk_tx_batch sum_batch = {};
+ bool budget_exhausted;
+ u32 per_socket_budget;
+ struct xdp_sock *xs;
+
+ /* The fairness quota must allow one maximum-sized valid packet. */
+ per_socket_budget = max_t(u32, MAX_PER_SOCKET_BUDGET,
+ pool->xdp_zc_max_segs);
+
+again:
+ budget_exhausted = false;
+ cq_descs_before = xsk_tx_batch_cq_descs(&sum_batch);
+ list_for_each_entry_rcu(xs, &pool->xsk_tx_list, tx_list) {
+ u32 budget, budget_left, offset, remaining;
+ struct xsk_tx_batch curr_batch;
+
+ /* Once reclaim-only descriptors have been appended to the CQ
+ * address area, do not append driver-visible Tx descriptors
+ * from another socket after them. xsk_tx_completed() relies on
+ * all driver-visible descriptors preceding all reclaim-only
+ * descriptors in CQ order.
+ */
+ if (sum_batch.reclaim_descs)
+ break;
+
+ /* be gentle when playing with pool->tx_descs */
+ offset = xsk_tx_batch_cq_descs(&sum_batch);
+ if (offset >= max_descs)
+ break;
+
+ if (xs->tx_budget_spent >= per_socket_budget) {
+ if (xskq_cons_nb_entries(xs->tx, 1))
+ budget_exhausted = true;
+ continue;
+ }
+
+ budget_left = per_socket_budget - xs->tx_budget_spent;
+ remaining = max_descs - offset;
+ budget = min(remaining, budget_left);
+
+ curr_batch = __xsk_tx_peek_release_desc_batch(pool, xs,
+ pool->tx_descs + offset,
+ budget);
+ if (!xsk_tx_batch_cq_descs(&curr_batch)) {
+ if (curr_batch.budget_limited && budget_left < remaining)
+ budget_exhausted = true;
+ xs->tx_budget_spent += curr_batch.consumed_descs;
+ continue;
+ }
+
+ xs->tx_budget_spent += curr_batch.consumed_descs;
+ sum_batch.tx_descs += curr_batch.tx_descs;
+ sum_batch.reclaim_descs += curr_batch.reclaim_descs;
+ }
+
+ cq_descs_after = xsk_tx_batch_cq_descs(&sum_batch);
+
+ if (sum_batch.reclaim_descs || cq_descs_after >= max_descs)
+ return sum_batch;
+
+ /* Continue filling the batch while this pass made progress */
+ if (cq_descs_before != cq_descs_after)
+ goto again;
+
+ if (!budget_exhausted)
+ return sum_batch;
+
+ list_for_each_entry_rcu(xs, &pool->xsk_tx_list, tx_list)
+ xs->tx_budget_spent = 0;
+ goto again;
+}
+
u32 xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, u32 nb_pkts)
{
+ struct xsk_tx_batch batch = {};
struct xdp_sock *xs;
+ bool umem_shared;
rcu_read_lock();
- if (!list_is_singular(&pool->xsk_tx_list)) {
- /* Fallback to the non-batched version */
- rcu_read_unlock();
- return xsk_tx_peek_release_fallback(pool, nb_pkts);
- }
+ if (unlikely(READ_ONCE(pool->reclaim_descs)))
+ goto out;
- xs = list_first_or_null_rcu(&pool->xsk_tx_list, struct xdp_sock, tx_list);
- if (!xs) {
- nb_pkts = 0;
+ xs = list_first_or_null_rcu(&pool->xsk_tx_list, struct xdp_sock,
+ tx_list);
+ if (!xs)
goto out;
- }
- nb_pkts = xskq_cons_nb_entries(xs->tx, nb_pkts);
+ nb_pkts = min(nb_pkts, pool->tx_descs_nentries);
+ if (!nb_pkts)
+ goto out;
+
+ umem_shared = !list_is_singular(&pool->xsk_tx_list);
+
+ if (umem_shared && !(pool->umem->flags & XDP_UMEM_SG_FLAG)) {
+ rcu_read_unlock();
+ return xsk_tx_peek_release_fallback(pool, nb_pkts);
+ }
/* This is the backpressure mechanism for the Tx path. Try to
* reserve space in the completion queue for all packets, but
@@ -603,19 +758,16 @@ u32 xsk_tx_peek_release_desc_batch(struct xsk_buff_pool *pool, u32 nb_pkts)
if (!nb_pkts)
goto out;
- nb_pkts = xskq_cons_read_desc_batch(xs->tx, pool, nb_pkts);
- if (!nb_pkts) {
- xs->tx->queue_empty_descs++;
- goto out;
- }
-
- __xskq_cons_release(xs->tx);
- xskq_prod_write_addr_batch(pool->cq, pool->tx_descs, nb_pkts);
- xs->sk.sk_write_space(&xs->sk);
+ batch = umem_shared ?
+ xsk_tx_peek_release_shared_desc_batch(pool, nb_pkts) :
+ __xsk_tx_peek_release_desc_batch(pool, xs,
+ pool->tx_descs,
+ nb_pkts);
+ xsk_tx_commit_batch(pool, &batch);
out:
rcu_read_unlock();
- return nb_pkts;
+ return batch.tx_descs;
}
EXPORT_SYMBOL(xsk_tx_peek_release_desc_batch);
diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
index 12c9fb29af05..a4089480b22b 100644
--- a/net/xdp/xsk_buff_pool.c
+++ b/net/xdp/xsk_buff_pool.c
@@ -51,6 +51,7 @@ int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs,
if (!pool->tx_descs)
return -ENOMEM;
+ pool->tx_descs_nentries = nentries;
return 0;
}
diff --git a/net/xdp/xsk_queue.h b/net/xdp/xsk_queue.h
index 3e3fbb73d23e..a15ff1929db6 100644
--- a/net/xdp/xsk_queue.h
+++ b/net/xdp/xsk_queue.h
@@ -58,6 +58,18 @@ struct parsed_desc {
u32 valid;
};
+struct xsk_tx_batch {
+ u32 tx_descs;
+ u32 reclaim_descs;
+ u32 consumed_descs;
+ bool budget_limited;
+};
+
+static inline u32 xsk_tx_batch_cq_descs(const struct xsk_tx_batch *batch)
+{
+ return batch->tx_descs + batch->reclaim_descs;
+}
+
/* The structure of the shared state of the rings are a simple
* circular buffer, as outlined in
* Documentation/core-api/circular-buffers.rst. For the Rx and
@@ -263,17 +275,18 @@ static inline void parse_desc(struct xsk_queue *q, struct xsk_buff_pool *pool,
parsed->mb = xp_mb_desc(desc);
}
-static inline
-u32 xskq_cons_read_desc_batch(struct xsk_queue *q, struct xsk_buff_pool *pool,
- u32 max)
+static inline struct xsk_tx_batch
+xskq_cons_read_desc_batch(struct xdp_sock *xs, struct xsk_buff_pool *pool,
+ struct xdp_desc *descs, u32 max)
{
- u32 cached_cons = q->cached_cons, nb_entries = 0;
- struct xdp_desc *descs = pool->tx_descs;
- u32 total_descs = 0, nr_frags = 0;
+ bool drain = READ_ONCE(xs->drain_cont);
+ u32 cached_cons, nb_entries = 0, released;
+ struct xsk_tx_batch batch = {};
+ struct xsk_queue *q = xs->tx;
+ u32 nr_frags = 0;
+
+ cached_cons = q->cached_cons;
- /* track first entry, if stumble upon *any* invalid descriptor, rewind
- * current packet that consists of frags and stop the processing
- */
while (cached_cons != q->cached_prod && nb_entries < max) {
struct xdp_rxtx_ring *ring = (struct xdp_rxtx_ring *)q->ring;
u32 idx = cached_cons & q->ring_mask;
@@ -282,26 +295,49 @@ u32 xskq_cons_read_desc_batch(struct xsk_queue *q, struct xsk_buff_pool *pool,
descs[nb_entries] = ring->desc[idx];
cached_cons++;
parse_desc(q, pool, &descs[nb_entries], &parsed);
- if (unlikely(!parsed.valid))
- break;
+ if (unlikely(!parsed.valid)) {
+ if (!drain && !nr_frags && !parsed.mb)
+ break;
+
+ drain = true;
+ }
+
+ nr_frags++;
+ nb_entries++;
if (likely(!parsed.mb)) {
- total_descs += (nr_frags + 1);
- nr_frags = 0;
- } else {
- nr_frags++;
- if (nr_frags == pool->xdp_zc_max_segs) {
+ if (unlikely(drain)) {
+ batch.reclaim_descs = nr_frags;
+ WRITE_ONCE(xs->drain_cont, false);
nr_frags = 0;
break;
}
+
+ batch.tx_descs += nr_frags;
+ nr_frags = 0;
+ continue;
+ }
+
+ if (nr_frags == pool->xdp_zc_max_segs)
+ drain = true;
+ }
+
+ if (nr_frags) {
+ if (drain) {
+ batch.reclaim_descs = nr_frags;
+ WRITE_ONCE(xs->drain_cont, true);
+ } else {
+ if (nb_entries == max)
+ batch.budget_limited = true;
+ cached_cons -= nr_frags;
}
- nb_entries++;
}
- cached_cons -= nr_frags;
+ released = cached_cons - q->cached_cons;
/* Release valid plus any invalid entries */
- xskq_cons_release_n(q, cached_cons - q->cached_cons);
- return total_descs;
+ xskq_cons_release_n(q, released);
+ batch.consumed_descs = released;
+ return batch;
}
/* Functions for consumers */
--
2.43.0
^ permalink raw reply related
* [PATCH v3 net 3/6] xsk: provide sufficient space in pool->tx_descs
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Maciej Fijalkowski
In-Reply-To: <20260714140722.111645-1-maciej.fijalkowski@intel.com>
The temporary Tx descriptor array in an XSK buffer pool is currently
sized from the Tx ring of the socket that creates the pool.
This is insufficient for shared-UMEM Tx. A later socket may have a
larger Tx ring and submit a valid multi-buffer packet containing more
descriptors than the first socket's ring, while still remaining within
the device's xdp_zc_max_segs limit.
A packet-framed batch parser bounded by the temporary array cannot reach
the end-of-packet descriptor in that case. It leaves the packet on the
Tx ring and encounters the same packet on every subsequent attempt,
stalling Tx processing for that socket.
Size the temporary descriptor array to the larger of the first Tx ring
and the device's xdp_zc_max_segs capability. This keeps the array large
enough to inspect one maximum-sized valid packet. Larger shared Tx rings
do not require further resizing, as they can be processed over multiple
batches.
Following commit will actually address the data path side.
Fixes: d5581966040f ("xsk: support ZC Tx multi-buffer in batch API")
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
---
include/net/xsk_buff_pool.h | 6 ++++--
net/xdp/xsk.c | 10 +++++++---
net/xdp/xsk_buff_pool.c | 12 ++++++++----
3 files changed, 19 insertions(+), 9 deletions(-)
diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h
index ccb3b350001f..f5e737a83055 100644
--- a/include/net/xsk_buff_pool.h
+++ b/include/net/xsk_buff_pool.h
@@ -102,12 +102,14 @@ struct xsk_buff_pool {
/* AF_XDP core. */
struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs,
- struct xdp_umem *umem);
+ struct xdp_umem *umem,
+ u32 max_segs);
int xp_assign_dev(struct xsk_buff_pool *pool, struct net_device *dev,
u16 queue_id, u16 flags);
int xp_assign_dev_shared(struct xsk_buff_pool *pool, struct xdp_sock *umem_xs,
struct net_device *dev, u16 queue_id);
-int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs);
+int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs,
+ u32 max_segs);
void xp_destroy(struct xsk_buff_pool *pool);
void xp_get_pool(struct xsk_buff_pool *pool);
bool xp_put_pool(struct xsk_buff_pool *pool);
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 43791647cf18..385a3f4a1b32 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -1525,7 +1525,8 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
* and/or device.
*/
xs->pool = xp_create_and_assign_umem(xs,
- umem_xs->umem);
+ umem_xs->umem,
+ dev->xdp_zc_max_segs);
if (!xs->pool) {
err = -ENOMEM;
sockfd_put(sock);
@@ -1557,7 +1558,8 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
* utilizes
*/
if (xs->tx && !xs->pool->tx_descs) {
- err = xp_alloc_tx_descs(xs->pool, xs);
+ err = xp_alloc_tx_descs(xs->pool, xs,
+ dev->xdp_zc_max_segs);
if (err) {
xp_put_pool(xs->pool);
xs->pool = NULL;
@@ -1575,7 +1577,9 @@ static int xsk_bind(struct socket *sock, struct sockaddr_unsized *addr, int addr
goto out_unlock;
} else {
/* This xsk has its own umem. */
- xs->pool = xp_create_and_assign_umem(xs, xs->umem);
+ xs->pool = xp_create_and_assign_umem(xs, xs->umem,
+ dev->xdp_zc_max_segs);
+
if (!xs->pool) {
err = -ENOMEM;
goto out_unlock;
diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
index 1f28a9641571..12c9fb29af05 100644
--- a/net/xdp/xsk_buff_pool.c
+++ b/net/xdp/xsk_buff_pool.c
@@ -42,9 +42,12 @@ void xp_destroy(struct xsk_buff_pool *pool)
kvfree(pool);
}
-int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs)
+int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs,
+ u32 max_segs)
{
- pool->tx_descs = kvzalloc_objs(*pool->tx_descs, xs->tx->nentries);
+ u32 nentries = max(xs->tx->nentries, max_segs);
+
+ pool->tx_descs = kvzalloc_objs(*pool->tx_descs, nentries);
if (!pool->tx_descs)
return -ENOMEM;
@@ -52,7 +55,8 @@ int xp_alloc_tx_descs(struct xsk_buff_pool *pool, struct xdp_sock *xs)
}
struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs,
- struct xdp_umem *umem)
+ struct xdp_umem *umem,
+ u32 max_segs)
{
bool unaligned = umem->flags & XDP_UMEM_UNALIGNED_CHUNK_FLAG;
struct xsk_buff_pool *pool;
@@ -69,7 +73,7 @@ struct xsk_buff_pool *xp_create_and_assign_umem(struct xdp_sock *xs,
goto out;
if (xs->tx)
- if (xp_alloc_tx_descs(pool, xs))
+ if (xp_alloc_tx_descs(pool, xs, max_segs))
goto out;
pool->chunk_mask = ~((u64)umem->chunk_size - 1);
--
2.43.0
^ permalink raw reply related
* [PATCH v3 net 2/6] xsk: drain continuation descs after overflow in xsk_build_skb()
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Jason Xing, Maciej Fijalkowski
In-Reply-To: <20260714140722.111645-1-maciej.fijalkowski@intel.com>
From: Jason Xing <kernelxing@tencent.com>
Fix generic xmit path multi-buffer logic when packets are either too big
(count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is
included in fragmented packet. Introduce xdp_sock::drain_cont and act
upon this flag - when it is set, keep on consuming descriptors from
AF_XDP Tx ring and put them directly onto Cq. Previously these
descriptors were silently lost and could never be reached again.
Fixes: cf24f5a5feea ("xsk: add support for AF_XDP multi-buffer on Tx path")
Closes: https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/
Co-developed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> # wrapped cq addr submission onto routine
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Jason Xing <kernelxing@tencent.com>
---
include/net/xdp_sock.h | 1 +
net/xdp/xsk.c | 39 +++++++++++++++++++++++++++++++++++++++
2 files changed, 40 insertions(+)
diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
index ebac60a3d8a1..8b51876efbed 100644
--- a/include/net/xdp_sock.h
+++ b/include/net/xdp_sock.h
@@ -80,6 +80,7 @@ struct xdp_sock {
* call of __xsk_generic_xmit().
*/
struct sk_buff *skb;
+ bool drain_cont;
struct list_head map_list;
/* Protects map_list */
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index a7a83dc4546a..43791647cf18 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -737,6 +737,19 @@ static void xsk_cq_submit_addr_locked(struct xsk_buff_pool *pool,
spin_unlock_irqrestore(&pool->cq_prod_lock, flags);
}
+static void xsk_cq_submit_addr_single_locked(struct xsk_buff_pool *pool,
+ struct xdp_desc *desc)
+{
+ unsigned long flags;
+ u32 idx;
+
+ spin_lock_irqsave(&pool->cq_prod_lock, flags);
+ idx = xskq_get_prod(pool->cq);
+ xskq_prod_write_addr(pool->cq, idx, desc->addr);
+ xskq_prod_submit_n(pool->cq, 1);
+ spin_unlock_irqrestore(&pool->cq_prod_lock, flags);
+}
+
static void xsk_cq_cancel_locked(struct xsk_buff_pool *pool, u32 n)
{
spin_lock(&pool->cq->cq_cached_prod_lock);
@@ -1063,11 +1076,22 @@ static int __xsk_generic_xmit(struct sock *sk)
goto out;
}
+ if (unlikely(xs->drain_cont)) {
+ xsk_cq_submit_addr_single_locked(xs->pool, &desc);
+
+ xs->tx->invalid_descs++;
+ xskq_cons_release(xs->tx);
+ xs->drain_cont = xp_mb_desc(&desc);
+ continue;
+ }
+
skb = xsk_build_skb(xs, &desc);
if (IS_ERR(skb)) {
err = PTR_ERR(skb);
if (err != -EOVERFLOW)
goto out;
+ if (xp_mb_desc(&desc))
+ xs->drain_cont = true;
err = 0;
continue;
}
@@ -1101,9 +1125,24 @@ static int __xsk_generic_xmit(struct sock *sk)
}
if (xskq_has_descs(xs->tx)) {
+ bool reclaim_desc = xs->skb || xs->drain_cont;
+
+ if (reclaim_desc) {
+ err = xsk_cq_reserve_locked(xs->pool);
+ if (err) {
+ err = -EAGAIN;
+ goto out;
+ }
+ }
+
if (xs->skb)
xsk_drop_skb(xs->skb);
+
+ if (reclaim_desc)
+ xsk_cq_submit_addr_single_locked(xs->pool, &desc);
+
xskq_cons_release(xs->tx);
+ xs->drain_cont = xp_mb_desc(&desc);
}
out:
--
2.43.0
^ permalink raw reply related
* [PATCH v3 net 1/6] xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Jason Xing
In-Reply-To: <20260714140722.111645-1-maciej.fijalkowski@intel.com>
From: Jason Xing <kernelxing@tencent.com>
This patch is inspired by the check[1] from sashiko. It says when
overflow happens, the address of cq to be published is invalid.
Actually the severer thing is the whole process of publishing the
address of cq in this particular case is not right: it should truely
publish the address and advance the cached_prod in cq as long as it
reads descriptors from txq.
The following is the full analysis.
xsk_drop_skb() is called in three places, which all discard a partially
built multi-buffer skb:
1) xsk_build_skb() -EOVERFLOW error path: packet exceeds MAX_SKB_FRAGS
2) __xsk_generic_xmit() post-loop cleanup: an invalid descriptor in
the TX ring prevents the partial packet from completing
3) xsk_release(): socket close while xs->skb holds an incomplete packet
In all three cases, the TX descriptors for the already-processed frags
have been consumed from the TX ring (xskq_cons_release), and CQ slots
have been reserved. However, xsk_drop_skb() calls xsk_consume_skb()
which cancels the CQ reservations via xsk_cq_cancel_locked(). Since
the buffer addresses never appear in the completion queue, userspace
permanently loses track of these buffers.
Fix this by letting consume_skb() trigger the existing xsk_destruct_skb
destructor, which already submits buffer addresses to the CQ via
xsk_cq_submit_addr_locked().
Note that cancelling the descriptors back to the TX ring (via
xskq_cons_cancel_n) is not a appropriate option because an oversized
packet that always exceeds MAX_SKB_FRAGS would be retried indefinitely,
which is an obviously deadlock bug in the TX path.
Also move the desc->addr assignment in xsk_build_skb() above the
overflow check so that the current descriptor's address is recorded
before a potential -EOVERFLOW jump to free_err, consistent with the
zerocopy path in xsk_build_skb_zerocopy().
[1]: https://lore.kernel.org/all/20260425041726.85FB3C2BCB2@smtp.kernel.org/
Fixes: cf24f5a5feea ("xsk: add support for AF_XDP multi-buffer on Tx path")
Signed-off-by: Jason Xing <kernelxing@tencent.com>
---
net/xdp/xsk.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index b970f30ea9b9..a7a83dc4546a 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -794,8 +794,11 @@ static void xsk_consume_skb(struct sk_buff *skb)
static void xsk_drop_skb(struct sk_buff *skb)
{
- xdp_sk(skb->sk)->tx->invalid_descs += xsk_get_num_desc(skb);
- xsk_consume_skb(skb);
+ struct xdp_sock *xs = xdp_sk(skb->sk);
+
+ xs->tx->invalid_descs += xsk_get_num_desc(skb);
+ consume_skb(skb);
+ xs->skb = NULL;
}
static int xsk_skb_metadata(struct sk_buff *skb, void *buffer,
@@ -877,7 +880,7 @@ static struct sk_buff *xsk_build_skb_zerocopy(struct xdp_sock *xs,
return ERR_PTR(-ENOMEM);
/* in case of -EOVERFLOW that could happen below,
- * xsk_consume_skb() will release this node as whole skb
+ * xsk_drop_skb() will release this node as whole skb
* would be dropped, which implies freeing all list elements
*/
xsk_addr->addrs[xsk_addr->num_descs] = desc->addr;
@@ -969,6 +972,8 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
goto free_err;
}
+ xsk_addr->addrs[xsk_addr->num_descs] = desc->addr;
+
if (unlikely(nr_frags == (MAX_SKB_FRAGS - 1) && xp_mb_desc(desc))) {
err = -EOVERFLOW;
goto free_err;
@@ -986,8 +991,6 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
skb_add_rx_frag(skb, nr_frags, page, 0, len, PAGE_SIZE);
refcount_add(PAGE_SIZE, &xs->sk.sk_wmem_alloc);
-
- xsk_addr->addrs[xsk_addr->num_descs] = desc->addr;
}
}
--
2.43.0
^ permalink raw reply related
* [PATCH v3 net 0/6] xsk: fix AF_XDP multi-buffer Tx descriptor reclaim
From: Maciej Fijalkowski @ 2026-07-14 14:07 UTC (permalink / raw)
To: netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms, bjorn,
kerneljasonxing, Maciej Fijalkowski
v2: https://lore.kernel.org/netdev/20260710194424.84844-1-maciej.fijalkowski@intel.com/
v2->v3:
* Added a preceding patch that sizes the pool-wide temporary Tx descriptor
array to the larger of the first Tx ring and the device's
xdp_zc_max_segs capability. This guarantees that the shared-UMEM path can
inspect one maximum-sized valid packet even when the socket that creates
the pool has a smaller Tx ring. Consequently, this patch now records the
actual allocated size in pool->tx_descs_nentries rather than the first
socket's Tx ring size.
* Fixed a possible infinite retry loop when a shared-UMEM socket contains
an incomplete multi-buffer packet. Pass the original descriptor budget
to xskq_cons_read_desc_batch() instead of the number of descriptors
currently available, so the parser can distinguish producer exhaustion
from actual budget exhaustion.
* Moved the completion-ring space check to the common batched Tx path, so
it is performed exactly once for both singular and shared-SG pools. Keep
the legacy shared non-SG fallback outside this handling, as it reserves
completion entries one descriptor at a time.
* Reworked xsk_tx_peek_release_desc_batch() to use a common singular/shared
batched flow. Resolve an empty Tx socket list before checking CQ space,
select the shared-SG walker through an explicit shared-pool condition,
and commit the resulting batch through one common path.
* Simplified xsk_tx_commit_batch() by moving the cached CQ producer
snapshot into the helper instead of passing it from each caller.
v1: https://lore.kernel.org/netdev/20260623133240.1048434-1-maciej.fijalkowski@intel.com/
v1->v2:
* Reduced the series from seven to five patches by squashing the three
generic Tx drain and reclaim changes into a single patch. The resulting
patch handles overflow, invalid descriptors in the middle of a packet,
and reclaim of the offending descriptor as one coherent change. This
so it will be less likely to have things reported by Sashiko that are
fixed in later commits;
* Reworked the zero-copy implementation substantially:
* removed the bind-transition mechanism, including tx_share_pending,
xp_prepare_xsk_tx_share(), xp_finish_xsk_tx_share(),
synchronize_net(), and the transient bind() -EAGAIN behavior;
* added packet-framed parsing for shared-UMEM SG pools, allowing
per-socket drain state to be resumed by both singular and shared Tx
paths;
* retained the legacy one-descriptor fallback for shared non-SG pools;
* preserved the existing per-socket fairness quota while allowing the
shared walker to consume multiple complete packets and continue
filling the requested batch across fairness rounds;
* made the fairness quota large enough to process one maximum-sized
valid multi-buffer packet;
* extended the parser result with consumed-descriptor and
budget-limited accounting needed by the shared walker;
* recorded the size of the pool's temporary Tx descriptor array and
capped batch processing at that size;
* kept reclaim-only descriptors ordered after preceding driver-visible
descriptors and protected the delayed-reclaim state with
READ_ONCE()/WRITE_ONCE().
* Rewrote the zero-copy patch description to cover oversized packets,
continuation draining across calls, shared-UMEM SG handling, and CQ
publication ordering.
* Corrected the too-many-frags selftest description to state that the
invalid packet contains max_frags + 1 fragments and terminates at an
explicit packet boundary.
Hi,
This series fixes several AF_XDP multi-buffer Tx paths where descriptors
consumed from the Tx ring are not consistently returned to userspace
through the completion ring when the packet is later dropped as invalid.
The affected cases are invalid or oversized multi-buffer Tx packets in
both the generic and zero-copy paths. In these cases, the kernel can
consume one or more Tx descriptors while building or validating a
multi-buffer packet, then drop the packet before it reaches the device.
Userspace still owns the UMEM buffers only after the corresponding
addresses are returned through the CQ. Missing completions therefore
make userspace lose track of those buffers.
The generic path fixes cover following related cases:
* partially built multi-buffer skbs dropped by xsk_drop_skb();
continuation descriptors left in the Tx ring after xsk_build_skb()
reports overflow;
* invalid descriptors encountered in the middle of a multi-buffer
packet, including the offending invalid descriptor itself.
The zero-copy path is handled separately. The batched Tx parser now
distinguishes descriptors that can be passed to the driver from
descriptors that are consumed only because they belong to an invalid
multi-buffer packet. Reclaim-only descriptors are written to the CQ
address area and published in completion order, after any earlier
driver-visible Tx descriptors.
The last two patches update xskxceiver so the tests account invalid
multi-buffer Tx packets as descriptors that must be reclaimed, while
still not expecting those invalid packets on the Rx side.
This is a follow-up to Jason's changes [0] which were addressing generic
xmit only and this set allows me to pass full xskxceiver test suite run
against ice driver.
Thanks,
Maciej
[0]: https://lore.kernel.org/netdev/20260520004244.55663-1-kerneljasonxing@gmail.com/
Jason Xing (2):
xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx
xsk: drain continuation descs after overflow in xsk_build_skb()
Maciej Fijalkowski (4):
xsk: provide sufficient space in pool->tx_descs
xsk: reclaim invalid multi-buffer Tx descs in ZC path
selftests/xsk: fix too-many-frags multi-buffer Tx test
selftests/xsk: account invalid multi-buffer Tx descriptors
include/net/xdp_sock.h | 1 +
include/net/xsk_buff_pool.h | 9 +-
net/xdp/xsk.c | 254 ++++++++++++++++--
net/xdp/xsk_buff_pool.c | 13 +-
net/xdp/xsk_queue.h | 76 ++++--
.../selftests/bpf/prog_tests/test_xsk.c | 48 ++--
6 files changed, 329 insertions(+), 72 deletions(-)
--
2.43.0
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox