The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=631e57d54c137e9393c47075db09a6c7fb84c6ed
commit 631e57d54c137e9393c47075db09a6c7fb84c6ed Author: Ariel Ehrenberg <[email protected]> AuthorDate: 2026-06-08 10:55:47 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2026-07-07 11:25:06 +0000 mlx5ib: encode dynamic UAR mmap offsets in the reserved command range The UAR ioctl handed user space a raw mmap offset, so the first dynamic UAR landed at page offset 0. mlx5_ib_mmap() decodes offset 0 as the legacy regular-page command and routed the mapping through the old bfreg path, which rejects dynamic-UAR contexts, so mmap() failed with EINVAL and mlx5dv_devx_alloc_uar() returned NULL. Follow the upstream scheme: reserve the mmap command range [9, 255] for rdma_user_mmap entries and return command-encoded offsets, so the dynamic-UAR mappings decode to the intended mlx5_ib_mmap() path. Reviewed by: kib Tested by: Wafa Hamzah <[email protected]> Sponsored by: Nvidia networking MFC after: 1 month --- sys/dev/mlx5/mlx5_ib/mlx5_ib.h | 11 +++++++++++ sys/dev/mlx5/mlx5_ib/mlx5_ib_main.c | 24 +++++++++++++++++++++--- 2 files changed, 32 insertions(+), 3 deletions(-) diff --git a/sys/dev/mlx5/mlx5_ib/mlx5_ib.h b/sys/dev/mlx5/mlx5_ib/mlx5_ib.h index bbc7aa4a170a..c4775319ea47 100644 --- a/sys/dev/mlx5/mlx5_ib/mlx5_ib.h +++ b/sys/dev/mlx5/mlx5_ib/mlx5_ib.h @@ -66,6 +66,17 @@ enum { MLX5_IB_MMAP_CMD_MASK = 0xff, }; +/* + * Reserved mmap command range used to encode rdma_user_mmap entry page + * offsets (e.g. dynamically allocated UARs). Keeping these above the legacy + * MLX5_IB_MMAP_* commands ensures mlx5_ib_mmap() routes them to the + * rdma_user_mmap offset handler instead of the legacy bfreg uar_mmap() path. + */ +enum { + MLX5_IB_MMAP_OFFSET_START = 9, + MLX5_IB_MMAP_OFFSET_END = 255, +}; + enum { MLX5_RES_SCAT_DATA32_CQE = 0x1, MLX5_RES_SCAT_DATA64_CQE = 0x2, diff --git a/sys/dev/mlx5/mlx5_ib/mlx5_ib_main.c b/sys/dev/mlx5/mlx5_ib/mlx5_ib_main.c index daf5cb217001..66d8d511f2f0 100644 --- a/sys/dev/mlx5/mlx5_ib/mlx5_ib_main.c +++ b/sys/dev/mlx5/mlx5_ib/mlx5_ib_main.c @@ -1675,6 +1675,25 @@ static unsigned long mlx5_vma_to_pgoff(struct vm_area_struct *vma) return (command << 16 | idx); } +static u64 mlx5_entry_to_mmap_offset(struct mlx5_user_mmap_entry *entry) +{ + u64 cmd = (entry->rdma_entry.start_pgoff >> 16) & 0xFFFF; + u64 index = entry->rdma_entry.start_pgoff & 0xFFFF; + + return (((index >> 8) << 16) | (cmd << MLX5_IB_MMAP_CMD_SHIFT) | + (index & 0xFF)) << PAGE_SHIFT; +} + +static int mlx5_rdma_user_mmap_entry_insert(struct mlx5_ib_ucontext *c, + struct mlx5_user_mmap_entry *entry, + size_t length) +{ + return rdma_user_mmap_entry_insert_range( + &c->ibucontext, &entry->rdma_entry, length, + (MLX5_IB_MMAP_OFFSET_START << 16), + ((MLX5_IB_MMAP_OFFSET_END << 16) + (1UL << 16) - 1)); +} + static int mlx5_ib_mmap_offset(struct mlx5_ib_dev *dev, struct vm_area_struct *vma, struct ib_ucontext *ucontext) @@ -3416,12 +3435,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_UAR_OBJ_ALLOC)( entry->page_idx = uar_index; entry->address = uar_index2pfn(dev, uar_index) << PAGE_SHIFT; - err = rdma_user_mmap_entry_insert(&c->ibucontext, &entry->rdma_entry, - length); + err = mlx5_rdma_user_mmap_entry_insert(c, entry, length); if (err) goto err_entry; - mmap_offset = rdma_user_mmap_get_offset(&entry->rdma_entry); + mmap_offset = mlx5_entry_to_mmap_offset(entry); err = uverbs_copy_to(attrs, MLX5_IB_ATTR_UAR_OBJ_ALLOC_MMAP_OFFSET, &mmap_offset, sizeof(mmap_offset)); if (err)
