Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma updates from Jason Gunthorpe:
 "A smaller cycle for features, still mostly AI and tool found bug fixes
  for long standing issues:

   - Bug fixes and minor cleanups across bnxt_re, cxgb4, EFA, ERDMA,
     HFI1, HNS, ionic, iRDMA, mlx4/mlx5, rdmavt, rtrs, RXE, SIW, SRP,
     isert and IPoIB. Lots of error unwind leaks, integer overflows, and
     use after free during teardown from timers/work that was not
     cancelled

   - Core fixes for uverbs DMABUF lifetime, RMPP reassembly use after
     free, multicast rb-tree corruption, restrack, and a user
     triggerable NULL deref when creating a WQ without a CQ

   - Prevent userspace from getting a writable mmap of the cxgb4 status
     page and the mlx4 clock page

   - Many rxe hardening fixes for bad user and network input, plus
     netdev and tunnel socket lifetime fixes

   - Peer supplied values are now validated in rtrs-clt, which is remote
     triggerable

   - umem now picks the DMA direction from the access flags instead of
     always using DMA_BIDIRECTIONAL, so an IOMMU can stop the device
     from writing to read-only memory. Several drivers were fixed to pin
     CQ and queue memory as writable to go along with this

   - SRQ support, firmware assigned CQ IDs and RCQ userspace support for
     ionic

   - RC QP improvements in MANA: MMQ creation, fixed size send WQEs and
     power of two send queues. Also multi-port GSI QPs and a rework of
     the UD send/receive and CQ polling paths

   - Relaxed ordering MRs for EFA

   - Non-contiguous kernel QP and CQ buffers for ERDMA

   - Move the mlx5 data direct infrastructure from mlx5_ib to mlx5_core
     so netdev can use it too. The data direct PCI driver is now named
     "mlx5_dd"

   - debugfs knob in hns to fix the SL used by the GSI QP, working
     around a HW problem with dropped CQEs

   - Selftest fixes, removal of the qib sysfs ABI docs, DT schema
     conversion for hns, and MANA maintainer handover"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (153 commits)
  RDMA/irdma: Bound in-flight CQP ops across deferred completions
  RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler
  RDMA/mlx5: Fix CQ resize destination index mask
  RDMA/usnic: Bound buffer size to sizeof(buf) in flowinfo_read()
  RDMA/rxe: Clear pkt->qp before the early drop exits in rxe_rcv()
  dt-bindings: infiniband: Convert hisilicon,hns-roce-v1 to DT schema
  RDMA/srp: Avoid reading uninitialized has_port on srp_parse_in() failure
  RDMA/irdma: Fix PBLE_LEVEL_2 FRWR generation
  RDMA/core: Reject LAG selection when source MAC lookup fails
  RDMA/core: Free unpublished port statistics after initial-read failure
  RDMA/core: Preserve the selected source GID on failed AH modification
  RDMA/uverbs: Fix DMABUF use-after-free during ufile cleanup
  RDMA/uverbs: Fix uobject leak in DMABUF release
  RDMA/irdma: Fix FRWR IRDMAQPSQ_PBLADDR field population
  IB/rdmavt: Fix error unwind path for qp_priv_init() in rvt_create_qp()
  RDMA/irdma: Check MR contiguity before PBLE alloc
  IB/mlx4: Avoid requeueing executing CM timeout work
  RDMA/rxe: bound the WQE opcode before indexing rxe_wr_opcode_info[]
  RDMA/rxe: Fix out-of-range unsigned-to-signed conversion for RDMA message in 2GiB size
  RDMA/rxe: validate inline sge_offset in finish_packet() before indexing inline_data[]
  ...

2 files changed, 55 insertions, 0 deletions

diff --git a/include/linux/mlx5/data_direct.h b/include/linux/mlx5/data_direct.h
new file mode 100644
index 000000000000..4cff5ff5489d
--- /dev/null
+++ b/include/linux/mlx5/data_direct.h
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */
+/*
+ * Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved
+ */
+
+#ifndef _MLX5_DATA_DIRECT_H
+#define _MLX5_DATA_DIRECT_H
+
+#include <linux/compiler.h>
+#include <linux/list.h>
+
+struct device;
+struct mlx5_core_dev;
+struct notifier_block;
+struct pci_dev;
+
+enum mlx5_data_direct_event {
+	MLX5_DATA_DIRECT_UNBIND,
+};
+
+struct mlx5_data_direct_dev {
+	struct device *device;
+	struct pci_dev *pdev;
+	char *vuid;
+	struct list_head list;
+};
+
+struct mlx5_data_direct {
+	struct mlx5_data_direct_dev *dev;
+	u32 pdn;
+	u32 mkey;
+	u32 mkey_ro;
+	u8 mkey_ro_valid :1;
+};
+
+static inline struct mlx5_data_direct_dev *
+mlx5_data_direct_get_dev(struct mlx5_data_direct *dd)
+{
+	return dd ? READ_ONCE(dd->dev) : NULL;
+}
+
+int mlx5_data_direct_register(struct mlx5_core_dev *mdev,
+			      struct notifier_block *nb);
+void mlx5_data_direct_unregister(struct mlx5_core_dev *mdev,
+				 struct notifier_block *nb);
+
+#endif
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 83d0a83bbfbc..abb99371ff13 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -707,6 +707,7 @@ struct mlx5_rsvd_gids {
 
 struct mlx5_clock;
 struct mlx5_clock_dev_state;
+struct mlx5_data_direct;
 struct mlx5_dm;
 struct mlx5_fw_tracer;
 struct mlx5_vxlan;
@@ -801,6 +802,7 @@ struct mlx5_core_dev {
 	/* sync write combining state */
 	struct mutex wc_state_lock;
 	struct devlink *shd;
+	struct mlx5_data_direct *data_direct;
 };
 
 struct mlx5_db {
@@ -1395,4 +1397,10 @@ static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev)
 
 #define MLX5_SW_IMAGE_GUID_MAX_BYTES 9
 
+static inline bool mlx5_data_direct_supported(struct mlx5_core_dev *mdev)
+{
+	return MLX5_CAP_GEN(mdev, data_direct) &&
+	       MLX5_CAP_GEN_2(mdev, query_vuid);
+}
+
 #endif /* MLX5_DRIVER_H */