[PATCH net v2] net/mlx5e: SHAMPO, Disable end padding when relaxed ordering is supported

[PATCH net v2] net/mlx5e: SHAMPO, Disable end padding when relaxed ordering is supported

[Jiabin Deng]

When SHAMPO and relaxed ordering writes are enabled, aligned RQ end
padding can corrupt received TCP data. Due to reordering, alignment
padding written at the end of one packet can overwrite data from the
next packet.

The current RQ end padding selection avoids alignment padding for LRO,
but not for SHAMPO. Extend the condition to SHAMPO to prevent this
corruption.

The issue was observed in a two-host test using a BlueField-3 NIC and
an NVIDIA H20 GPU. In the original test with MTU 1500, 354 of 400
transfers contained corrupted data before the fix. After applying this
change, all 400 transfers across eight message sizes from 32 KiB to
4 MiB, with 50 transfers per size, completed successfully, with no
incorrect bytes or corrupted intervals.

Fixes: e5ca8fb08ab2 ("net/mlx5e: Add control path for SHAMPO feature")
Closes: https://lists.openwall.net/linux-kernel/2026/09/15/154
Link: https://lists.openwall.net/linux-kernel/2026/10/20/1322
Suggested-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiabin Deng <dengjiabin2023@gmail.com>
---
Changes in v2:
- Clarify that the corruption is not specific to GPU or DMA-BUF memory.
- Explain how reordered alignment padding can overwrite the next
  packet's data.
- Add Dragos Tatulea's Reviewed-by tag.
- No code changes.

v1: https://lore.kernel.org/netdev/20261106083719.22798-1-dengjiabin2023@gmail.com/

 drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
index 5caf7820a136..159f79302a08 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
@@ -911,10 +911,11 @@ static void mlx5e_build_rx_cq_param(struct mlx5_core_dev *mdev,
 
 static u8 rq_end_pad_mode(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
 {
-	bool lro_en = params->packet_merge.type == MLX5E_PACKET_MERGE_LRO;
+	bool no_pad = params->packet_merge.type == MLX5E_PACKET_MERGE_LRO ||
+		      params->packet_merge.type == MLX5E_PACKET_MERGE_SHAMPO;
 	bool ro = MLX5_CAP_GEN(mdev, relaxed_ordering_write);
 
-	return ro && lro_en ?
+	return ro && no_pad ?
 		MLX5_WQ_END_PAD_MODE_NONE : MLX5_WQ_END_PAD_MODE_ALIGN;
 }
 

base-commit: fafbc4051123d5459ea6950899cec08ed946e278
-- 
2.51.0

Re: [PATCH net v2] net/mlx5e: SHAMPO, Disable end padding when relaxed ordering is supported

[Tariq Toukan]

On 09/11/2026 5:44, Jiabin Deng wrote:
> When SHAMPO and relaxed ordering writes are enabled, aligned RQ end
> padding can corrupt received TCP data. Due to reordering, alignment
> padding written at the end of one packet can overwrite data from the
> next packet.
> 
> The current RQ end padding selection avoids alignment padding for LRO,
> but not for SHAMPO. Extend the condition to SHAMPO to prevent this
> corruption.
> 
> The issue was observed in a two-host test using a BlueField-3 NIC and
> an NVIDIA H20 GPU. In the original test with MTU 1500, 354 of 400
> transfers contained corrupted data before the fix. After applying this
> change, all 400 transfers across eight message sizes from 32 KiB to
> 4 MiB, with 50 transfers per size, completed successfully, with no
> incorrect bytes or corrupted intervals.
> 
> Fixes: e5ca8fb08ab2 ("net/mlx5e: Add control path for SHAMPO feature")
> Closes: https://lists.openwall.net/linux-kernel/2026/09/15/154
> Link: https://lists.openwall.net/linux-kernel/2026/10/20/1322

nits:

lore.kernel.org links are preferred.

The Cc list leaves out the netdev maintainers and 
linux-rdma@vger.kernel.org (from MAINTAINERS for mlx5 core).


> Suggested-by: Dragos Tatulea <dtatulea@nvidia.com>
> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiabin Deng <dengjiabin2023@gmail.com>
> ---
> Changes in v2:
> - Clarify that the corruption is not specific to GPU or DMA-BUF memory.
> - Explain how reordered alignment padding can overwrite the next
>    packet's data.
> - Add Dragos Tatulea's Reviewed-by tag.
> - No code changes.
> 
> v1: https://lore.kernel.org/netdev/20261106083719.22798-1-dengjiabin2023@gmail.com/
> 
>   drivers/net/ethernet/mellanox/mlx5/core/en/params.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
> index 5caf7820a136..159f79302a08 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c
> @@ -911,10 +911,11 @@ static void mlx5e_build_rx_cq_param(struct mlx5_core_dev *mdev,
>   
>   static u8 rq_end_pad_mode(struct mlx5_core_dev *mdev, struct mlx5e_params *params)
>   {
> -	bool lro_en = params->packet_merge.type == MLX5E_PACKET_MERGE_LRO;
> +	bool no_pad = params->packet_merge.type == MLX5E_PACKET_MERGE_LRO ||
> +		      params->packet_merge.type == MLX5E_PACKET_MERGE_SHAMPO;
>   	bool ro = MLX5_CAP_GEN(mdev, relaxed_ordering_write);
>   
> -	return ro && lro_en ?
> +	return ro && no_pad ?
>   		MLX5_WQ_END_PAD_MODE_NONE : MLX5_WQ_END_PAD_MODE_ALIGN;
>   }
>   

Thanks for the fix.

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>

> 
> base-commit: fafbc4051123d5459ea6950899cec08ed946e278