From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 234C4155C97 for ; Sat, 2 May 2026 02:12:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777687961; cv=none; b=VzdXJZ7yzI0CtAtYFTj8FD+bDIbpQyI9+JuJd59RCqVsU+ma166E784YhHcHvSdEK8lz5TUOgIVY58gU2zsISxgqLl9zVrqlGuF0CJk39oFrLIsr7VtckfodiGUZvs+Umw5QoT/OLADLAxeIuJ0dl/7ZXPMj/ZnS+me34Vjkn2U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777687961; c=relaxed/simple; bh=iSEFrnpuhnI4Qfaa116HnTtBS7sm750QLZYleIT1JP0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=MNaqIJsC9Jnehfy6Jf0i4LxA/SGW9jk9zJ2AvXXB2LjGZygWADs7WavGwAHzvrPskFSSt4m4mtpAzgGBzrjsiqbBVb8nUfFNIphTW7iylCY+s2ev0wDmnUNUR+Bo5hW8vrcmeBmTBvEgtAD006xun8m21pfn+ohzRYnVMB70Y7I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bTzKjIBl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bTzKjIBl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D980C2BCB4; Sat, 2 May 2026 02:12:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777687960; bh=iSEFrnpuhnI4Qfaa116HnTtBS7sm750QLZYleIT1JP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bTzKjIBlBGmXu0kcvXL0jIC3ILNpp29oSyUkteH1NBQO6WH1BLTd91vPK77QLl3Ll x8pmVF6k+2OqZbxMd9R6XOQD1Don7Q+PM1QlDUGa2bCWinjPyGRy2p7L7Pd7usU3wB 55ZCvuLzP4PyDQ2fP7zGidQSKEcao7UpqXxk7nLnuP69xqUs3cOdFlTLGMBmFues4m 5zajX+P+gwZYEo3ytYDk9QLebcgCALEol4vw+zTKR57JlyydWNApdzN7YsCW7GUa/6 gqvN8Kn1umg+mFTp/CjG5DdCVyPHKKZjL5tXaOKwZONgSDFDFq59mDLRRNWan6/W6y 0BMQRh6Cgq9kw== From: Sasha Levin To: stable@vger.kernel.org Cc: Long Li , Leon Romanovsky , Sasha Levin Subject: [PATCH 6.12.y] RDMA/mana_ib: Disable RX steering on RSS QP destroy Date: Fri, 1 May 2026 22:12:37 -0400 Message-ID: <20260502021238.4167696-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026050131-tanning-savor-298d@gregkh> References: <2026050131-tanning-savor-298d@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Long Li [ Upstream commit dbeb256e8dd87233d891b170c0b32a6466467036 ] When an RSS QP is destroyed (e.g. DPDK exit), mana_ib_destroy_qp_rss() destroys the RX WQ objects but does not disable vPort RX steering in firmware. This leaves stale steering configuration that still points to the destroyed RX objects. If traffic continues to arrive (e.g. peer VM is still transmitting) and the VF interface is subsequently brought up (mana_open), the firmware may deliver completions using stale CQ IDs from the old RX objects. These CQ IDs can be reused by the ethernet driver for new TX CQs, causing RX completions to land on TX CQs: WARNING: mana_poll_tx_cq+0x1b8/0x220 [mana] (is_sq == false) WARNING: mana_gd_process_eq_events+0x209/0x290 (cq_table lookup fails) Fix this by disabling vPort RX steering before destroying RX WQ objects. Note that mana_fence_rqs() cannot be used here because the fence completion is delivered on the CQ, which is polled by user-mode (e.g. DPDK) and not visible to the kernel driver. Refactor the disable logic into a shared mana_disable_vport_rx() in mana_en, exported for use by mana_ib, replacing the duplicate code. The ethernet driver's mana_dealloc_queues() is also updated to call this common function. Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") Cc: stable@vger.kernel.org Signed-off-by: Long Li Link: https://patch.msgid.link/20260325194100.1929056-1-longli@microsoft.com Signed-off-by: Leon Romanovsky [ kept early-return error handling and used unquoted NET_MANA namespace in EXPORT_SYMBOL_NS ] Signed-off-by: Sasha Levin --- drivers/infiniband/hw/mana/qp.c | 15 +++++++++++++++ drivers/net/ethernet/microsoft/mana/mana_en.c | 11 ++++++++++- include/net/mana/mana.h | 1 + 3 files changed, 26 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c index 48fef989318b4..84b8666af606c 100644 --- a/drivers/infiniband/hw/mana/qp.c +++ b/drivers/infiniband/hw/mana/qp.c @@ -601,6 +601,21 @@ static int mana_ib_destroy_qp_rss(struct mana_ib_qp *qp, ndev = mana_ib_get_netdev(qp->ibqp.device, qp->port); mpc = netdev_priv(ndev); + /* Disable vPort RX steering before destroying RX WQ objects. + * Otherwise firmware still routes traffic to the destroyed queues, + * which can cause bogus completions on reused CQ IDs when the + * ethernet driver later creates new queues on mana_open(). + * + * Unlike the ethernet teardown path, mana_fence_rqs() cannot be + * used here because the fence completion CQE is delivered on the + * CQ which is polled by userspace (e.g. DPDK), so there is no way + * for the kernel to wait for fence completion. + * + * This is best effort — if it fails there is not much we can do, + * and mana_cfg_vport_steering() already logs the error. + */ + mana_disable_vport_rx(mpc); + for (i = 0; i < (1 << ind_tbl->log_ind_tbl_size); i++) { ibwq = ind_tbl->ind_tbl[i]; wq = container_of(ibwq, struct mana_ib_wq, ibwq); diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index 969dd44303569..e527139936dee 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -2392,6 +2392,13 @@ static void mana_rss_table_init(struct mana_port_context *apc) ethtool_rxfh_indir_default(i, apc->num_queues); } +int mana_disable_vport_rx(struct mana_port_context *apc) +{ + return mana_cfg_vport_steering(apc, TRI_STATE_FALSE, false, false, + false); +} +EXPORT_SYMBOL_NS(mana_disable_vport_rx, NET_MANA); + int mana_config_rss(struct mana_port_context *apc, enum TRI_STATE rx, bool update_hash, bool update_tab) { @@ -2676,12 +2683,14 @@ static int mana_dealloc_queues(struct net_device *ndev) */ apc->rss_state = TRI_STATE_FALSE; - err = mana_config_rss(apc, TRI_STATE_FALSE, false, false); + err = mana_disable_vport_rx(apc); if (err) { netdev_err(ndev, "Failed to disable vPort: %d\n", err); return err; } + mana_fence_rqs(apc); + mana_destroy_vport(apc); return 0; diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h index ac9a4b0bd49bf..ab10b0cc1dc2d 100644 --- a/include/net/mana/mana.h +++ b/include/net/mana/mana.h @@ -473,6 +473,7 @@ struct mana_port_context { netdev_tx_t mana_start_xmit(struct sk_buff *skb, struct net_device *ndev); int mana_config_rss(struct mana_port_context *ac, enum TRI_STATE rx, bool update_hash, bool update_tab); +int mana_disable_vport_rx(struct mana_port_context *apc); int mana_alloc_queues(struct net_device *ndev); int mana_attach(struct net_device *ndev); -- 2.53.0