[PATCH net] net/mlx5e: SHAMPO, Disable end padding when relaxed ordering is supported

[PATCH net] net/mlx5e: SHAMPO, Disable end padding when relaxed ordering is supported

[Jiabin Deng]

When SHAMPO and relaxed ordering writes are enabled, aligned RQ end
padding can corrupt TCP data received directly into GPU DMA-BUF memory.
The receiver gets the expected number of bytes, but some payload
prefixes are zero-filled, with the corrupted ranges ending at 64-byte
boundaries.

The current RQ end padding selection avoids alignment padding for LRO,
but not for SHAMPO. Extend the condition to SHAMPO to prevent this
corruption.

The issue was observed in a two-host test using a BlueField-3 NIC and
an NVIDIA H20 GPU. In the original test with MTU 1500, 354 of 400
transfers contained corrupted data before the fix. After applying this
change, all 400 transfers across eight message sizes from 32 KiB to
4 MiB, with 50 transfers per size, completed successfully, with no
incorrect bytes or corrupted intervals.

Fixes: e5ca8fb08ab2 ("net/mlx5e: Add control path for SHAMPO feature")
Closes: https://lists.openwall.net/linux-kernel/2026/09/15/154
Link: https://lists.openwall.net/linux-kernel/2026/10/20/1322
Suggested-by: Dragos Tatulea <dtatulea@nvidia.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiabin Deng <dengjiabin2023@gmail.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
index 5caf7820a136..159f79302a08 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
@@ -911,10 +911,11 @@ static void mlx5e_build_rx_cq_param(struct mlx5_core_dev *mdev,
 
 static u8 rq_end_pad_mode(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
 {
-	bool lro_en = params->packet_merge.type == MLX5E_PACKET_MERGE_LRO;
+	bool no_pad = params->packet_merge.type == MLX5E_PACKET_MERGE_LRO ||
+		      params->packet_merge.type == MLX5E_PACKET_MERGE_SHAMPO;
 	bool ro = MLX5_CAP_GEN(mdev, relaxed_ordering_write);
 
-	return ro && lro_en ?
+	return ro && no_pad ?
 		MLX5_WQ_END_PAD_MODE_NONE : MLX5_WQ_END_PAD_MODE_ALIGN;
 }
 

base-commit: fafbc4051123d5459ea6950899cec08ed946e278
-- 
2.51.0

Re: [PATCH net] net/mlx5e: SHAMPO, Disable end padding when relaxed ordering is supported

[Dragos Tatulea]

Hi,

Thanks for sending the patch!

On 06.11.26 09:37, Jiabin Deng wrote:
> When SHAMPO and relaxed ordering writes are enabled, aligned RQ end
> padding can corrupt TCP data received directly into GPU DMA-BUF memory.
This is a generic issue, not just for GPU memory or DMA-BUF. Why not
just say: can corrupt received TCP data.

> The receiver gets the expected number of bytes, but some payload
> prefixes are zero-filled, with the corrupted ranges ending at 64-byte
> boundaries.
> 
This is a bit confusing. Prefix sounds like the first bytes in the next
packet's data are padded. Why not just say that due to reordering,
the alignment padding bytes from the end of one packet are overwriting
data from the next packet.

> The current RQ end padding selection avoids alignment padding for LRO,
> but not for SHAMPO. Extend the condition to SHAMPO to prevent this
> corruption.
> 
> The issue was observed in a two-host test using a BlueField-3 NIC and
> an NVIDIA H20 GPU. In the original test with MTU 1500, 354 of 400
> transfers contained corrupted data before the fix. After applying this
> change, all 400 transfers across eight message sizes from 32 KiB to
> 4 MiB, with 50 transfers per size, completed successfully, with no
> incorrect bytes or corrupted intervals.
> 
> Fixes: e5ca8fb08ab2 ("net/mlx5e: Add control path for SHAMPO feature")
> Closes: https://lists.openwall.net/linux-kernel/2026/09/15/154
> Link: https://lists.openwall.net/linux-kernel/2026/10/20/1322
> Suggested-by: Dragos Tatulea <dtatulea@nvidia.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiabin Deng <dengjiabin2023@gmail.com>

Once you do the small fixes in the commit, you can add:
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>

Thanks,
Dragos