wireguard-linux/drivers/infiniband/hw/ionic, branch stable

RDMA/ionic: Embed counter driver data in rdma_counter allocation

2026-08-06T11:21:21Z

Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdma_counter using rdma_zalloc_drv_obj()") requires drivers implementing counter ops to embed struct rdma_counter in a driver-specific struct, register its size via INIT_RDMA_OBJ_SIZE, and provide a counter_init callback. The ionic driver was merged without this adaptation, causing a NULL pointer dereference in alloc_and_bind() since rdma_zalloc_drv_obj() allocates zero bytes when size_rdma_counter is unset. Consolidate struct ionic_counter into a new struct ionic_rdma_counter that embeds struct rdma_counter, replace the xarray with a lightweight ida for ID allocation, and add the required counter_init and INIT_RDMA_OBJ_SIZE declarations. Fixes: ea4c399642b8 ("RDMA/ionic: Implement device stats ops") Cc: stable@vger.kernel.org # 6.18 Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260805053254.4023262-2-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget

2026-08-06T11:21:21Z

ionic_fill_lif_cfg() reads eq_count from firmware uncapped, but the eth driver only reserves ionic->neqs_per_lif MSI-X vectors for RDMA event queues. Since ionic_rdma probes via the auxiliary bus before the netdev is brought up, it can exhaust the shared interrupt bitmap, causing ionic_open() to fail with -ENOSPC when allocating rx/tx interrupts. Cap RDMA eq_count to neqs_per_lif, which is populated by ionic_lif_size() at PCI probe before the RDMA aux device registers. Fixes: 8d765af51a09 ("RDMA/ionic: Register auxiliary module for ionic ethernet adapter") Cc: stable@vger.kernel.org Signed-off-by: Brett Creeley Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260805053254.4023262-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: add completion timestamp to CQE format

2026-07-22T08:53:36Z

Update the CQE structure to include hardware timestamp. When firmware supports RDMA completion timestamps, the hardware populates the timestamp field. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260610154216.712374-5-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: map PHC state into user space

2026-07-22T08:53:36Z

Enable user space applications to access the PHC state page when firmware RDMA completion timestamp is supported. This mapping allows user space to convert RDMA completion timestamps to system wall time without kernel transitions, minimizing latency overhead. Applications can directly read the PHC state through mmap, enabling efficient timestamp correlation for precision timing applications. Co-developed-by: Allen Hubbe Signed-off-by: Allen Hubbe Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260610154216.712374-4-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Add robust udata compatibility checks to all uapi verbs

2026-07-20T13:45:44Z

Enable the robust udata contract by setting uverbs_robust_udata and adding proper input validation and output handling to all verbs that accept struct ib_udata. For verbs with no driver request or response struct, add ib_no_udata_io(). For create_ah, which already responds with ionic_ah_resp, add the missing input validation via ib_is_udata_in_empty(). Signed-off-by: Abhijit Gangurde Link: https://patch.msgid.link/20260717092345.2533564-1-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky

RDMA: Use ib_no_udata_io() in query_device callbacks

2026-07-20T13:00:40Z

The query_device callbacks that neither accept driver-specific input nor return a driver-specific response open-code the empty udata handling as ib_is_udata_in_empty() on entry and ib_respond_empty_udata() on exit. ib_no_udata_io() already combines both steps, so replace the entry check with it and simply return 0 on success. Unlike the create and destroy flows, query_device owns no uobject or HW resource - the extended path fills a stack ib_device_attr that the core discards on error - so clearing the empty response buffer on entry rather than on exit is a mechanical change with no functional difference. Link: https://patch.msgid.link/20260714-convert-to-noio-udata-v1-1-f1f6b6c7c988@nvidia.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Remove duplicate IONIC_SPEC_HIGH definition

2026-07-09T09:08:14Z

The macro IONIC_SPEC_HIGH is defined twice - remove it. Signed-off-by: Kamal Heib Link: https://patch.msgid.link/20260708210734.641411-1-kheib@redhat.com Signed-off-by: Leon Romanovsky

RDMA/ionic: Validate rate limit attribute in modify QP

2026-06-11T11:02:05Z

Rate limit transition validation for RC QPs currently relies on the IB core qp_state_table. Add a driver-level helper to validate the rate limit attribute directly during QP modify, ensuring it is only accepted for RC QPs in INIT->RTR, RTR->RTS and RTS->RTS transitions. This makes the driver responsible for rate limit validation and prepares for a follow-up IB core change that delegates IB_QP_RATE_LIMIT and all future non-standard modify attributes handling to individual vendor drivers. Signed-off-by: Maher Sanalla Reviewed-by: Michael Guralnik Signed-off-by: Edward Srouji Link: https://patch.msgid.link/20260524-packet-pacing-v1-7-3d79439f8d08@nvidia.com Signed-off-by: Leon Romanovsky

RDMA: Update the query_device() op

2026-06-03T18:12:43Z

This op hasn't followed the normal pattern of passing NULL for udata when invoked by the kernel. Instead the kernel caller creates a dummy ib_udata on the stack and passes that in. It does not seem to currently be a bug, but this flow should be modernized to use the new API flow and in the process accept NULL as well. Only mlx4 uses an input request structure, have every other driver call ib_is_udata_in_empty() to enforce the lack of request structs. Use ib_respond_empty_udata() in every driver that does not use a response struct. Ensure a check for NULL udata before calling ib_respond_udata() in bnxt_re, efa, and mlx5. Make mlx4 safe to be called with NULL. Link: https://patch.msgid.link/r/2-v1-922fa8e828ba+f7-ib_udata_stack_jgg@nvidia.com Signed-off-by: Jason Gunthorpe

RDMA/umem: Rename ib_umem_get() to ib_umem_get_va()

2026-05-29T23:19:57Z

The new umem getter family being introduced in follow-up patches need a fitting name for the central all-source helper that resolves attributes, legacy fillers and a UHW VA fallback. Rename the existing VA-pinning helper ib_umem_get() to ib_umem_get_va() so the name is freed up. The new name is consistent with names of rest of the helpers that are about to be introduced. Link: https://patch.msgid.link/r/20260529134312.2836341-2-jiri@resnulli.us Signed-off-by: Jiri Pirko Signed-off-by: Jason Gunthorpe