From 7f059e47326746ceebe2a984bd6124459df3b458 Mon Sep 17 00:00:00 2001 From: Akhilesh Patil Date: Sat, 16 Aug 2025 11:49:54 +0530 Subject: [PATCH 1/5] fwctl/mlx5: Fix memory alloc/free in mlx5ctl_fw_rpc() Use kvfree() to free memory allocated by kvzalloc() instead of kfree(). Avoid potential memory management issue considering kvzalloc() can internally choose to use either kmalloc() or vmalloc() based on memory request and current system memory state. Hence, use more appropriate kvfree() which automatically determines correct free method to avoid potential hard to debug memory issues. Fix this issue discovered by running spatch static analysis tool using coccinelle script - scripts/coccinelle/api/kfree_mismatch.cocci Fixes: 52929c2142041 ("fwctl/mlx5: Support for communicating with mlx5 fw") Link: https://patch.msgid.link/r/aKAjCoF9cT3VEbSE@bhairav-test.ee.iitb.ac.in Signed-off-by: Akhilesh Patil Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Signed-off-by: Jason Gunthorpe --- drivers/fwctl/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c index f93aa0cecdb9..4b379f695eb7 100644 --- a/drivers/fwctl/mlx5/main.c +++ b/drivers/fwctl/mlx5/main.c @@ -345,7 +345,7 @@ static void *mlx5ctl_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope, */ if (ret && ret != -EREMOTEIO) { if (rpc_out != rpc_in) - kfree(rpc_out); + kvfree(rpc_out); return ERR_PTR(ret); } return rpc_out; From f12343013022a92fff0cf22cb7b22b9c909cdbf5 Mon Sep 17 00:00:00 2001 From: Liao Yuanhong Date: Wed, 20 Aug 2025 20:40:11 +0800 Subject: [PATCH 2/5] pds_fwctl: Remove the use of dev_err_probe() Logging messages that show some type of "out of memory" error are generally unnecessary as there is a generic message and a stack dump done by the memory subsystem. These messages generally increase kernel size without much added value[1]. The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, remove the useless call to dev_err_probe(), and just return the value instead. [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ Link: https://patch.msgid.link/r/20250820124011.474224-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Brett Creeley Signed-off-by: Jason Gunthorpe --- drivers/fwctl/pds/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/fwctl/pds/main.c b/drivers/fwctl/pds/main.c index 9b9d1f6b5556..8dd659aee256 100644 --- a/drivers/fwctl/pds/main.c +++ b/drivers/fwctl/pds/main.c @@ -481,7 +481,7 @@ static int pdsfc_probe(struct auxiliary_device *adev, pdsfc = fwctl_alloc_device(&padev->vf_pdev->dev, &pdsfc_ops, struct pdsfc_dev, fwctl); if (!pdsfc) - return dev_err_probe(dev, -ENOMEM, "Failed to allocate fwctl device struct\n"); + return -ENOMEM; pdsfc->padev = padev; err = pdsfc_identify(pdsfc); From cb81f72f86e0ad7da83236c2f8b2db5a8f1310ba Mon Sep 17 00:00:00 2001 From: Avihai Horon Date: Mon, 8 Sep 2025 09:52:55 -0700 Subject: [PATCH 3/5] fwctl/mlx5: Allow MODIFY_CONG_STATUS command MODIFY_CONG_STATUS command is used to enable or disable congestion control according to a given priority and protocol. Add MODIFY_CONG_STATUS to the allowed commands under configuration scope. Link: https://patch.msgid.link/r/20250908165256.1255985-2-saeed@kernel.org Signed-off-by: Avihai Horon Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe --- drivers/fwctl/mlx5/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c index 4b379f695eb7..3d32c1d77879 100644 --- a/drivers/fwctl/mlx5/main.c +++ b/drivers/fwctl/mlx5/main.c @@ -188,6 +188,7 @@ static bool mlx5ctl_validate_rpc(const void *in, enum fwctl_rpc_scope scope) * filter commands manually for now. */ switch (opcode) { + case MLX5_CMD_OP_MODIFY_CONG_STATUS: case MLX5_CMD_OP_POSTPONE_CONNECTED_QP_TIMEOUT: case MLX5_CMD_OP_QUERY_ADAPTER: case MLX5_CMD_OP_QUERY_ESW_FUNCTIONS: From e7085be863839e3438fb67da65a74b64e99917e7 Mon Sep 17 00:00:00 2001 From: Saeed Mahameed Date: Mon, 8 Sep 2025 09:52:56 -0700 Subject: [PATCH 4/5] fwctl/mlx5: Add Adjacent function query commands and their scope MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID: - Query Adjacent functions (PFs/VFs) of the function calling FW. MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT: - Delegates own VFs to be managed/seen by other adjacent PFs MLX5_CMD_OP_QUERY_DELEGATED_VHCA: - Query current function delegation state. Link: https://patch.msgid.link/r/20250908165256.1255985-3-saeed@kernel.org Signed-off-by: Saeed Mahameed Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe --- drivers/fwctl/mlx5/main.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/fwctl/mlx5/main.c b/drivers/fwctl/mlx5/main.c index 3d32c1d77879..3dacccf7855c 100644 --- a/drivers/fwctl/mlx5/main.c +++ b/drivers/fwctl/mlx5/main.c @@ -58,6 +58,9 @@ enum { MLX5_CMD_OP_QUERY_DC_CNAK_TRACE = 0x716, MLX5_CMD_OP_QUERY_NVMF_BACKEND_CONTROLLER = 0x722, MLX5_CMD_OP_QUERY_NVMF_NAMESPACE_CONTEXT = 0x728, + MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID = 0x730, + MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT = 0x731, + MLX5_CMD_OP_QUERY_DELEGATED_VHCA = 0x732, MLX5_CMD_OP_QUERY_BURST_SIZE = 0x813, MLX5_CMD_OP_QUERY_DIAGNOSTIC_PARAMS = 0x819, MLX5_CMD_OP_SET_DIAGNOSTIC_PARAMS = 0x820, @@ -197,6 +200,7 @@ static bool mlx5ctl_validate_rpc(const void *in, enum fwctl_rpc_scope scope) case MLX5_CMD_OP_QUERY_OTHER_HCA_CAP: case MLX5_CMD_OP_QUERY_ROCE_ADDRESS: case MLX5_CMD_OPCODE_QUERY_VUID: + case MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT: /* * FW limits SET_HCA_CAP on the tools UID to only the other function * mode which is used for function pre-configuration @@ -282,6 +286,8 @@ static bool mlx5ctl_validate_rpc(const void *in, enum fwctl_rpc_scope scope) case MLX5_CMD_OP_QUERY_XRQ: case MLX5_CMD_OP_USER_QUERY_XRQ_DC_PARAMS_ENTRY: case MLX5_CMD_OP_USER_QUERY_XRQ_ERROR_PARAMS: + case MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID: + case MLX5_CMD_OP_QUERY_DELEGATED_VHCA: return scope >= FWCTL_RPC_DEBUG_READ_ONLY; case MLX5_CMD_OP_SET_DIAGNOSTIC_PARAMS: From 479bec4cb39a1bfb2e5d3e3959d660f61399cad4 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Wed, 17 Sep 2025 17:09:41 +0200 Subject: [PATCH 5/5] pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify pdsfc_fw_rpc(). Return early if an error occurs and remove the obsolete 'err_out' label. No functional changes intended. Link: https://patch.msgid.link/r/20250917150941.168887-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Dave Jiang Reviewed-by: Jason Gunthorpe Tested-by: Brett Creeley Signed-off-by: Jason Gunthorpe --- drivers/fwctl/pds/main.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/drivers/fwctl/pds/main.c b/drivers/fwctl/pds/main.c index 8dd659aee256..1809853f6353 100644 --- a/drivers/fwctl/pds/main.c +++ b/drivers/fwctl/pds/main.c @@ -6,6 +6,7 @@ #include #include #include +#include #include #include @@ -366,18 +367,10 @@ static void *pdsfc_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope, return ERR_PTR(err); if (rpc->in.len > 0) { - in_payload = kzalloc(rpc->in.len, GFP_KERNEL); - if (!in_payload) { - dev_err(dev, "Failed to allocate in_payload\n"); - err = -ENOMEM; - goto err_out; - } - - if (copy_from_user(in_payload, u64_to_user_ptr(rpc->in.payload), - rpc->in.len)) { + in_payload = memdup_user(u64_to_user_ptr(rpc->in.payload), rpc->in.len); + if (IS_ERR(in_payload)) { dev_dbg(dev, "Failed to copy in_payload from user\n"); - err = -EFAULT; - goto err_in_payload; + return in_payload; } in_payload_dma_addr = dma_map_single(dev->parent, in_payload, @@ -453,7 +446,6 @@ static void *pdsfc_fw_rpc(struct fwctl_uctx *uctx, enum fwctl_rpc_scope scope, rpc->in.len, DMA_TO_DEVICE); err_in_payload: kfree(in_payload); -err_out: if (err) return ERR_PTR(err);