--- /dev/null
+From eb1b66887472eaa7342305b7890ae510dd9d1a79 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Sat, 2 Nov 2019 00:17:58 +0100
+Subject: bpf: Make use of probe_user_write in probe write helper
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit eb1b66887472eaa7342305b7890ae510dd9d1a79 upstream.
+
+Convert the bpf_probe_write_user() helper to probe_user_write() such that
+writes are not attempted under KERNEL_DS anymore which is buggy as kernel
+and user space pointers can have overlapping addresses. Also, given we have
+the access_ok() check inside probe_user_write(), the helper doesn't need
+to do it twice.
+
+Fixes: 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/841c461781874c07a0ee404a454c3bc0459eed30.1572649915.git.daniel@iogearbox.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/trace/bpf_trace.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -163,7 +163,7 @@ static const struct bpf_func_proto bpf_p
+ .arg3_type = ARG_ANYTHING,
+ };
+
+-BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src,
++BPF_CALL_3(bpf_probe_write_user, void __user *, unsafe_ptr, const void *, src,
+ u32, size)
+ {
+ /*
+@@ -186,10 +186,8 @@ BPF_CALL_3(bpf_probe_write_user, void *,
+ return -EPERM;
+ if (unlikely(!nmi_uaccess_okay()))
+ return -EPERM;
+- if (!access_ok(unsafe_ptr, size))
+- return -EPERM;
+
+- return probe_kernel_write(unsafe_ptr, src, size);
++ return probe_user_write(unsafe_ptr, src, size);
+ }
+
+ static const struct bpf_func_proto bpf_probe_write_user_proto = {
--- /dev/null
+From 8163999db445021f2651a8a47b5632483e8722ea Mon Sep 17 00:00:00 2001
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Thu, 21 Nov 2019 08:25:09 -0800
+Subject: bpf: skmsg, fix potential psock NULL pointer dereference
+
+From: John Fastabend <john.fastabend@gmail.com>
+
+commit 8163999db445021f2651a8a47b5632483e8722ea upstream.
+
+Report from Dan Carpenter,
+
+ net/core/skmsg.c:792 sk_psock_write_space()
+ error: we previously assumed 'psock' could be null (see line 790)
+
+ net/core/skmsg.c
+ 789 psock = sk_psock(sk);
+ 790 if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
+ Check for NULL
+ 791 schedule_work(&psock->work);
+ 792 write_space = psock->saved_write_space;
+ ^^^^^^^^^^^^^^^^^^^^^^^^
+ 793 rcu_read_unlock();
+ 794 write_space(sk);
+
+Ensure psock dereference on line 792 only occurs if psock is not null.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/skmsg.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -793,15 +793,18 @@ static void sk_psock_strp_data_ready(str
+ static void sk_psock_write_space(struct sock *sk)
+ {
+ struct sk_psock *psock;
+- void (*write_space)(struct sock *sk);
++ void (*write_space)(struct sock *sk) = NULL;
+
+ rcu_read_lock();
+ psock = sk_psock(sk);
+- if (likely(psock && sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)))
+- schedule_work(&psock->work);
+- write_space = psock->saved_write_space;
++ if (likely(psock)) {
++ if (sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED))
++ schedule_work(&psock->work);
++ write_space = psock->saved_write_space;
++ }
+ rcu_read_unlock();
+- write_space(sk);
++ if (write_space)
++ write_space(sk);
+ }
+
+ int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock)
--- /dev/null
+From da5fb18225b49b97bb37c51bcbbb2990a507c364 Mon Sep 17 00:00:00 2001
+From: Stanislav Fomichev <sdf@google.com>
+Date: Wed, 27 Nov 2019 08:14:10 -0800
+Subject: bpf: Support pre-2.25-binutils objcopy for vmlinux BTF
+
+From: Stanislav Fomichev <sdf@google.com>
+
+commit da5fb18225b49b97bb37c51bcbbb2990a507c364 upstream.
+
+If vmlinux BTF generation fails, but CONFIG_DEBUG_INFO_BTF is set,
+.BTF section of vmlinux is empty and kernel will prohibit
+BPF loading and return "in-kernel BTF is malformed".
+
+--dump-section argument to binutils' objcopy was added in version 2.25.
+When using pre-2.25 binutils, BTF generation silently fails. Convert
+to --only-section which is present on pre-2.25 binutils.
+
+Documentation/process/changes.rst states that binutils 2.21+
+is supported, not sure those standards apply to BPF subsystem.
+
+v2:
+* exit and print an error if gen_btf fails (John Fastabend)
+
+v3:
+* resend with Andrii's Acked-by/Tested-by tags
+
+Fixes: 341dfcf8d78ea ("btf: expose BTF info through sysfs")
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Tested-by: Andrii Nakryiko <andriin@fb.com>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Cc: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20191127161410.57327-1-sdf@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/link-vmlinux.sh | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/scripts/link-vmlinux.sh
++++ b/scripts/link-vmlinux.sh
+@@ -127,7 +127,8 @@ gen_btf()
+ cut -d, -f1 | cut -d' ' -f2)
+ bin_format=$(LANG=C ${OBJDUMP} -f ${1} | grep 'file format' | \
+ awk '{print $4}')
+- ${OBJCOPY} --dump-section .BTF=.btf.vmlinux.bin ${1} 2>/dev/null
++ ${OBJCOPY} --set-section-flags .BTF=alloc -O binary \
++ --only-section=.BTF ${1} .btf.vmlinux.bin 2>/dev/null
+ ${OBJCOPY} -I binary -O ${bin_format} -B ${bin_arch} \
+ --rename-section .data=.BTF .btf.vmlinux.bin ${2}
+ }
+@@ -253,6 +254,10 @@ btf_vmlinux_bin_o=""
+ if [ -n "${CONFIG_DEBUG_INFO_BTF}" ]; then
+ if gen_btf .tmp_vmlinux.btf .btf.vmlinux.bin.o ; then
+ btf_vmlinux_bin_o=.btf.vmlinux.bin.o
++ else
++ echo >&2 "Failed to generate BTF for vmlinux"
++ echo >&2 "Try to disable CONFIG_DEBUG_INFO_BTF"
++ exit 1
+ fi
+ fi
+
--- /dev/null
+From b568405856906ee4d9ba6284fd36f2928653a623 Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andriin@fb.com>
+Date: Wed, 27 Nov 2019 12:01:34 -0800
+Subject: libbpf: Fix Makefile' libbpf symbol mismatch diagnostic
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+commit b568405856906ee4d9ba6284fd36f2928653a623 upstream.
+
+Fix Makefile's diagnostic diff output when there is LIBBPF_API-versioned
+symbols mismatch.
+
+Fixes: 1bd63524593b ("libbpf: handle symbol versioning properly for libbpf.a")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20191127200134.1360660-1-andriin@fb.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/lib/bpf/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/lib/bpf/Makefile
++++ b/tools/lib/bpf/Makefile
+@@ -215,7 +215,7 @@ check_abi: $(OUTPUT)libbpf.so
+ "versioned symbols in $^ ($(VERSIONED_SYM_COUNT))." \
+ "Please make sure all LIBBPF_API symbols are" \
+ "versioned in $(VERSION_SCRIPT)." >&2; \
+- readelf -s --wide $(OUTPUT)libbpf-in.o | \
++ readelf -s --wide $(BPF_IN_SHARED) | \
+ cut -d "@" -f1 | sed 's/_v[0-9]_[0-9]_[0-9].*//' | \
+ awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$8}'| \
+ sort -u > $(OUTPUT)libbpf_global_syms.tmp; \
--- /dev/null
+From 663912a6378a34fd4f43b8d873f0c6c6322d9d0e Mon Sep 17 00:00:00 2001
+From: Mark Zhang <markz@mellanox.com>
+Date: Mon, 16 Sep 2019 10:11:52 +0300
+Subject: RDMA/counter: Prevent QP counter manual binding in auto mode
+
+From: Mark Zhang <markz@mellanox.com>
+
+commit 663912a6378a34fd4f43b8d873f0c6c6322d9d0e upstream.
+
+If auto mode is configured, manual counter allocation and QP bind is not
+allowed.
+
+Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support")
+Link: https://lore.kernel.org/r/20190916071154.20383-3-leon@kernel.org
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/counters.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/counters.c
++++ b/drivers/infiniband/core/counters.c
+@@ -466,10 +466,15 @@ static struct rdma_counter *rdma_get_cou
+ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port,
+ u32 qp_num, u32 counter_id)
+ {
++ struct rdma_port_counter *port_counter;
+ struct rdma_counter *counter;
+ struct ib_qp *qp;
+ int ret;
+
++ port_counter = &dev->port_data[port].port_counter;
++ if (port_counter->mode.mode == RDMA_COUNTER_MODE_AUTO)
++ return -EINVAL;
++
+ qp = rdma_counter_get_qp(dev, qp_num);
+ if (!qp)
+ return -ENOENT;
+@@ -506,6 +511,7 @@ err:
+ int rdma_counter_bind_qpn_alloc(struct ib_device *dev, u8 port,
+ u32 qp_num, u32 *counter_id)
+ {
++ struct rdma_port_counter *port_counter;
+ struct rdma_counter *counter;
+ struct ib_qp *qp;
+ int ret;
+@@ -513,9 +519,13 @@ int rdma_counter_bind_qpn_alloc(struct i
+ if (!rdma_is_port_valid(dev, port))
+ return -EINVAL;
+
+- if (!dev->port_data[port].port_counter.hstats)
++ port_counter = &dev->port_data[port].port_counter;
++ if (!port_counter->hstats)
+ return -EOPNOTSUPP;
+
++ if (port_counter->mode.mode == RDMA_COUNTER_MODE_AUTO)
++ return -EINVAL;
++
+ qp = rdma_counter_get_qp(dev, qp_num);
+ if (!qp)
+ return -ENOENT;
--- /dev/null
+From 887803db866a7a4e1817a3cb8a3eee4e9879fed2 Mon Sep 17 00:00:00 2001
+From: Yangyang Li <liyangyang20@huawei.com>
+Date: Thu, 24 Oct 2019 17:21:57 +0800
+Subject: RDMA/hns: Bugfix for qpc/cqc timer configuration
+
+From: Yangyang Li <liyangyang20@huawei.com>
+
+commit 887803db866a7a4e1817a3cb8a3eee4e9879fed2 upstream.
+
+qpc/cqc timer entry size needs one page, but currently they are fixedly
+configured to 4096, which is not appropriate in 64K page scenarios. So
+they should be modified to PAGE_SIZE.
+
+Fixes: 0e40dc2f70cd ("RDMA/hns: Add timer allocation support for hip08")
+Link: https://lore.kernel.org/r/1571908917-16220-3-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+@@ -87,8 +87,8 @@
+ #define HNS_ROCE_V2_MTT_ENTRY_SZ 64
+ #define HNS_ROCE_V2_CQE_ENTRY_SIZE 32
+ #define HNS_ROCE_V2_SCCC_ENTRY_SZ 32
+-#define HNS_ROCE_V2_QPC_TIMER_ENTRY_SZ 4096
+-#define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ 4096
++#define HNS_ROCE_V2_QPC_TIMER_ENTRY_SZ PAGE_SIZE
++#define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ PAGE_SIZE
+ #define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFFF000
+ #define HNS_ROCE_V2_MAX_INNER_MTPT_NUM 2
+ #define HNS_ROCE_INVALID_LKEY 0x100
--- /dev/null
+From d5b60e26e86a463ca83bb5ec502dda6ea685159e Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 7 Oct 2019 23:18:08 +0200
+Subject: RDMA/hns: Fix build error again
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit d5b60e26e86a463ca83bb5ec502dda6ea685159e upstream.
+
+This is not the first attempt to fix building random configurations,
+unfortunately the attempt in commit a07fc0bb483e ("RDMA/hns: Fix build
+error") caused a new problem when CONFIG_INFINIBAND_HNS_HIP06=m and
+CONFIG_INFINIBAND_HNS_HIP08=y:
+
+drivers/infiniband/hw/hns/hns_roce_main.o:(.rodata+0xe60): undefined reference to `__this_module'
+
+Revert commits a07fc0bb483e ("RDMA/hns: Fix build error") and
+a3e2d4c7e766 ("RDMA/hns: remove obsolete Kconfig comment") to get back to
+the previous state, then fix the issues described there differently, by
+adding more specific dependencies: INFINIBAND_HNS can now only be built-in
+if at least one of HNS or HNS3 are built-in, and the individual back-ends
+are only available if that code is reachable from the main driver.
+
+Fixes: a07fc0bb483e ("RDMA/hns: Fix build error")
+Fixes: a3e2d4c7e766 ("RDMA/hns: remove obsolete Kconfig comment")
+Fixes: dd74282df573 ("RDMA/hns: Initialize the PCI device for hip08 RoCE")
+Fixes: 08805fdbeb2d ("RDMA/hns: Split hw v1 driver from hns roce driver")
+Link: https://lore.kernel.org/r/20191007211826.3361202-1-arnd@arndb.de
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/Kconfig | 17 ++++++++++++++---
+ drivers/infiniband/hw/hns/Makefile | 8 ++++++--
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/Kconfig
++++ b/drivers/infiniband/hw/hns/Kconfig
+@@ -1,23 +1,34 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ config INFINIBAND_HNS
+- bool "HNS RoCE Driver"
++ tristate "HNS RoCE Driver"
+ depends on NET_VENDOR_HISILICON
+ depends on ARM64 || (COMPILE_TEST && 64BIT)
++ depends on (HNS_DSAF && HNS_ENET) || HNS3
+ ---help---
+ This is a RoCE/RDMA driver for the Hisilicon RoCE engine. The engine
+ is used in Hisilicon Hip06 and more further ICT SoC based on
+ platform device.
+
++ To compile HIP06 or HIP08 driver as module, choose M here.
++
+ config INFINIBAND_HNS_HIP06
+- tristate "Hisilicon Hip06 Family RoCE support"
++ bool "Hisilicon Hip06 Family RoCE support"
+ depends on INFINIBAND_HNS && HNS && HNS_DSAF && HNS_ENET
++ depends on INFINIBAND_HNS=m || (HNS_DSAF=y && HNS_ENET=y)
+ ---help---
+ RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip06 and
+ Hip07 SoC. These RoCE engines are platform devices.
+
++ To compile this driver, choose Y here: if INFINIBAND_HNS is m, this
++ module will be called hns-roce-hw-v1
++
+ config INFINIBAND_HNS_HIP08
+- tristate "Hisilicon Hip08 Family RoCE support"
++ bool "Hisilicon Hip08 Family RoCE support"
+ depends on INFINIBAND_HNS && PCI && HNS3
++ depends on INFINIBAND_HNS=m || HNS3=y
+ ---help---
+ RoCE driver support for Hisilicon RoCE engine in Hisilicon Hip08 SoC.
+ The RoCE engine is a PCI device.
++
++ To compile this driver, choose Y here: if INFINIBAND_HNS is m, this
++ module will be called hns-roce-hw-v2.
+--- a/drivers/infiniband/hw/hns/Makefile
++++ b/drivers/infiniband/hw/hns/Makefile
+@@ -9,8 +9,12 @@ hns-roce-objs := hns_roce_main.o hns_roc
+ hns_roce_ah.o hns_roce_hem.o hns_roce_mr.o hns_roce_qp.o \
+ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o
+
++ifdef CONFIG_INFINIBAND_HNS_HIP06
+ hns-roce-hw-v1-objs := hns_roce_hw_v1.o $(hns-roce-objs)
+-obj-$(CONFIG_INFINIBAND_HNS_HIP06) += hns-roce-hw-v1.o
++obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v1.o
++endif
+
++ifdef CONFIG_INFINIBAND_HNS_HIP08
+ hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs)
+-obj-$(CONFIG_INFINIBAND_HNS_HIP08) += hns-roce-hw-v2.o
++obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o
++endif
--- /dev/null
+From 5c7e76fb7cb5071be800c938ebf2c475e140d3f0 Mon Sep 17 00:00:00 2001
+From: Lijun Ou <oulijun@huawei.com>
+Date: Thu, 24 Oct 2019 17:21:56 +0800
+Subject: RDMA/hns: Fix to support 64K page for srq
+
+From: Lijun Ou <oulijun@huawei.com>
+
+commit 5c7e76fb7cb5071be800c938ebf2c475e140d3f0 upstream.
+
+SRQ's page size configuration of BA and buffer should depend on current
+PAGE_SHIFT, or it can't work in scenario of 64K page.
+
+Fixes: c7bcb13442e1 ("RDMA/hns: Add SRQ support for hip08 kernel mode")
+Link: https://lore.kernel.org/r/1571908917-16220-2-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -6088,11 +6088,11 @@ static void hns_roce_v2_write_srqc(struc
+ roce_set_field(srq_context->byte_44_idxbufpgsz_addr,
+ SRQC_BYTE_44_SRQ_IDX_BA_PG_SZ_M,
+ SRQC_BYTE_44_SRQ_IDX_BA_PG_SZ_S,
+- hr_dev->caps.idx_ba_pg_sz);
++ hr_dev->caps.idx_ba_pg_sz + PG_SHIFT_OFFSET);
+ roce_set_field(srq_context->byte_44_idxbufpgsz_addr,
+ SRQC_BYTE_44_SRQ_IDX_BUF_PG_SZ_M,
+ SRQC_BYTE_44_SRQ_IDX_BUF_PG_SZ_S,
+- hr_dev->caps.idx_buf_pg_sz);
++ hr_dev->caps.idx_buf_pg_sz + PG_SHIFT_OFFSET);
+
+ srq_context->idx_nxt_blk_addr =
+ cpu_to_le32(mtts_idx[1] >> PAGE_ADDR_SHIFT);
--- /dev/null
+From cfd82da4e741c16d71a12123bf0cb585af2b8796 Mon Sep 17 00:00:00 2001
+From: Lang Cheng <chenglang@huawei.com>
+Date: Wed, 4 Sep 2019 11:14:44 +0800
+Subject: RDMA/hns: Modify return value of restrack functions
+
+From: Lang Cheng <chenglang@huawei.com>
+
+commit cfd82da4e741c16d71a12123bf0cb585af2b8796 upstream.
+
+The restrack function return EINVAL instead of EMSGSIZE when the driver
+operation fails.
+
+Fixes: 4b42d05d0b2c ("RDMA/hns: Remove unnecessary kzalloc")
+Signed-off-by: Lang Cheng <chenglang@huawei.com>
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Link: https://lore.kernel.org/r/1567566885-23088-5-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/hns_roce_restrack.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_restrack.c
++++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c
+@@ -95,7 +95,7 @@ static int hns_roce_fill_res_cq_entry(st
+
+ ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context);
+ if (ret)
+- goto err;
++ return -EINVAL;
+
+ table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER);
+ if (!table_attr) {
--- /dev/null
+From 515f60004ed985d2b2f03659365752e0b6142986 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Sat, 8 Jun 2019 12:25:14 +0300
+Subject: RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit 515f60004ed985d2b2f03659365752e0b6142986 upstream.
+
+The "ucmd->log_sq_bb_count" variable is a user controlled variable in the
+0-255 range. If we shift more than then number of bits in an int then
+it's undefined behavior (it shift wraps), and potentially the int could
+become negative.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Link: https://lore.kernel.org/r/20190608092514.GC28890@mwanda
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -332,9 +332,8 @@ static int check_sq_size_with_integrity(
+ u8 max_sq_stride = ilog2(roundup_sq_stride);
+
+ /* Sanity check SQ size before proceeding */
+- if ((u32)(1 << ucmd->log_sq_bb_count) > hr_dev->caps.max_wqes ||
+- ucmd->log_sq_stride > max_sq_stride ||
+- ucmd->log_sq_stride < HNS_ROCE_IB_MIN_SQ_STRIDE) {
++ if (ucmd->log_sq_stride > max_sq_stride ||
++ ucmd->log_sq_stride < HNS_ROCE_IB_MIN_SQ_STRIDE) {
+ ibdev_err(&hr_dev->ib_dev, "check SQ size error!\n");
+ return -EINVAL;
+ }
+@@ -358,13 +357,16 @@ static int hns_roce_set_user_sq_size(str
+ u32 max_cnt;
+ int ret;
+
++ if (check_shl_overflow(1, ucmd->log_sq_bb_count, &hr_qp->sq.wqe_cnt) ||
++ hr_qp->sq.wqe_cnt > hr_dev->caps.max_wqes)
++ return -EINVAL;
++
+ ret = check_sq_size_with_integrity(hr_dev, cap, ucmd);
+ if (ret) {
+ ibdev_err(&hr_dev->ib_dev, "Sanity check sq size failed\n");
+ return ret;
+ }
+
+- hr_qp->sq.wqe_cnt = 1 << ucmd->log_sq_bb_count;
+ hr_qp->sq.wqe_shift = ucmd->log_sq_stride;
+
+ max_cnt = max(1U, cap->max_send_sge);
--- /dev/null
+From d302c6e3a6895608a5856bc708c47bda1770b24d Mon Sep 17 00:00:00 2001
+From: Yangyang Li <liyangyang20@huawei.com>
+Date: Wed, 9 Oct 2019 09:21:50 +0800
+Subject: RDMA/hns: Release qp resources when failed to destroy qp
+
+From: Yangyang Li <liyangyang20@huawei.com>
+
+commit d302c6e3a6895608a5856bc708c47bda1770b24d upstream.
+
+Even if no response from hardware, we should make sure that qp related
+resources are released to avoid memory leaks.
+
+Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
+Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Link: https://lore.kernel.org/r/1570584110-3659-1-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -4650,16 +4650,14 @@ static int hns_roce_v2_destroy_qp_common
+ {
+ struct hns_roce_cq *send_cq, *recv_cq;
+ struct ib_device *ibdev = &hr_dev->ib_dev;
+- int ret;
++ int ret = 0;
+
+ if (hr_qp->ibqp.qp_type == IB_QPT_RC && hr_qp->state != IB_QPS_RESET) {
+ /* Modify qp to reset before destroying qp */
+ ret = hns_roce_v2_modify_qp(&hr_qp->ibqp, NULL, 0,
+ hr_qp->state, IB_QPS_RESET);
+- if (ret) {
++ if (ret)
+ ibdev_err(ibdev, "modify QP to Reset failed.\n");
+- return ret;
+- }
+ }
+
+ send_cq = to_hr_cq(hr_qp->ibqp.send_cq);
+@@ -4715,7 +4713,7 @@ static int hns_roce_v2_destroy_qp_common
+ kfree(hr_qp->rq_inl_buf.wqe_list);
+ }
+
+- return 0;
++ return ret;
+ }
+
+ static int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
+@@ -4725,11 +4723,9 @@ static int hns_roce_v2_destroy_qp(struct
+ int ret;
+
+ ret = hns_roce_v2_destroy_qp_common(hr_dev, hr_qp, udata);
+- if (ret) {
++ if (ret)
+ ibdev_err(&hr_dev->ib_dev, "Destroy qp 0x%06lx failed(%d)\n",
+ hr_qp->qpn, ret);
+- return ret;
+- }
+
+ if (hr_qp->ibqp.qp_type == IB_QPT_GSI)
+ kfree(hr_to_hr_sqp(hr_qp));
--- /dev/null
+From 9f7d7064009c37cb26eee4a83302cf077fe180d6 Mon Sep 17 00:00:00 2001
+From: Weihang Li <liweihang@hisilicon.com>
+Date: Wed, 4 Sep 2019 11:14:41 +0800
+Subject: RDMA/hns: remove a redundant le16_to_cpu
+
+From: Weihang Li <liweihang@hisilicon.com>
+
+commit 9f7d7064009c37cb26eee4a83302cf077fe180d6 upstream.
+
+Type of ah->av.vlan is u16, there will be a problem using le16_to_cpu
+on it.
+
+Fixes: 82e620d9c3a0 ("RDMA/hns: Modify the data structure of hns_roce_av")
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Link: https://lore.kernel.org/r/1567566885-23088-2-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -389,7 +389,7 @@ static int hns_roce_v2_post_send(struct
+ roce_set_field(ud_sq_wqe->byte_36,
+ V2_UD_SEND_WQE_BYTE_36_VLAN_M,
+ V2_UD_SEND_WQE_BYTE_36_VLAN_S,
+- le16_to_cpu(ah->av.vlan));
++ ah->av.vlan);
+ roce_set_field(ud_sq_wqe->byte_36,
+ V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_M,
+ V2_UD_SEND_WQE_BYTE_36_HOPLIMIT_S,
--- /dev/null
+From 546d30099ed204792083f043cd7e016de86016a3 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leon@kernel.org>
+Date: Tue, 29 Oct 2019 07:57:21 +0200
+Subject: RDMA/mlx5: Return proper error value
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+commit 546d30099ed204792083f043cd7e016de86016a3 upstream.
+
+Returned value from mlx5_mr_cache_alloc() is checked to be error or real
+pointer. Return proper error code instead of NULL which is not checked
+later.
+
+Fixes: 81713d3788d2 ("IB/mlx5: Add implicit MR support")
+Link: https://lore.kernel.org/r/20191029055721.7192-1-leon@kernel.org
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/mr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -428,7 +428,7 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(s
+
+ if (entry < 0 || entry >= MAX_MR_CACHE_ENTRIES) {
+ mlx5_ib_err(dev, "cache entry %d is out of range\n", entry);
+- return NULL;
++ return ERR_PTR(-EINVAL);
+ }
+
+ ent = &cache->ent[entry];
--- /dev/null
+From 949b452f9cfef17e78055239f978d95ba729eee1 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Thu, 24 Oct 2019 13:51:03 +0000
+Subject: rdma: Remove nes ABI header
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit 949b452f9cfef17e78055239f978d95ba729eee1 upstream.
+
+This was missed when nes was removed.
+
+Fixes: 2d3c72ed5041 ("rdma: Remove nes")
+Link: https://lore.kernel.org/r/20191024135059.GA20084@ziepe.ca
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/uapi/rdma/nes-abi.h | 115 --------------------------------------------
+ 1 file changed, 115 deletions(-)
+
+--- a/include/uapi/rdma/nes-abi.h
++++ /dev/null
+@@ -1,115 +0,0 @@
+-/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR Linux-OpenIB) */
+-/*
+- * Copyright (c) 2006 - 2011 Intel Corporation. All rights reserved.
+- * Copyright (c) 2005 Topspin Communications. All rights reserved.
+- * Copyright (c) 2005 Cisco Systems. All rights reserved.
+- * Copyright (c) 2005 Open Grid Computing, Inc. All rights reserved.
+- *
+- * This software is available to you under a choice of one of two
+- * licenses. You may choose to be licensed under the terms of the GNU
+- * General Public License (GPL) Version 2, available from the file
+- * COPYING in the main directory of this source tree, or the
+- * OpenIB.org BSD license below:
+- *
+- * Redistribution and use in source and binary forms, with or
+- * without modification, are permitted provided that the following
+- * conditions are met:
+- *
+- * - Redistributions of source code must retain the above
+- * copyright notice, this list of conditions and the following
+- * disclaimer.
+- *
+- * - Redistributions in binary form must reproduce the above
+- * copyright notice, this list of conditions and the following
+- * disclaimer in the documentation and/or other materials
+- * provided with the distribution.
+- *
+- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+- * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+- * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+- * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+- * SOFTWARE.
+- *
+- */
+-
+-#ifndef NES_ABI_USER_H
+-#define NES_ABI_USER_H
+-
+-#include <linux/types.h>
+-
+-#define NES_ABI_USERSPACE_VER 2
+-#define NES_ABI_KERNEL_VER 2
+-
+-/*
+- * Make sure that all structs defined in this file remain laid out so
+- * that they pack the same way on 32-bit and 64-bit architectures (to
+- * avoid incompatibility between 32-bit userspace and 64-bit kernels).
+- * In particular do not use pointer types -- pass pointers in __u64
+- * instead.
+- */
+-
+-struct nes_alloc_ucontext_req {
+- __u32 reserved32;
+- __u8 userspace_ver;
+- __u8 reserved8[3];
+-};
+-
+-struct nes_alloc_ucontext_resp {
+- __u32 max_pds; /* maximum pds allowed for this user process */
+- __u32 max_qps; /* maximum qps allowed for this user process */
+- __u32 wq_size; /* size of the WQs (sq+rq) allocated to the mmaped area */
+- __u8 virtwq; /* flag to indicate if virtual WQ are to be used or not */
+- __u8 kernel_ver;
+- __u8 reserved[2];
+-};
+-
+-struct nes_alloc_pd_resp {
+- __u32 pd_id;
+- __u32 mmap_db_index;
+-};
+-
+-struct nes_create_cq_req {
+- __aligned_u64 user_cq_buffer;
+- __u32 mcrqf;
+- __u8 reserved[4];
+-};
+-
+-struct nes_create_qp_req {
+- __aligned_u64 user_wqe_buffers;
+- __aligned_u64 user_qp_buffer;
+-};
+-
+-enum iwnes_memreg_type {
+- IWNES_MEMREG_TYPE_MEM = 0x0000,
+- IWNES_MEMREG_TYPE_QP = 0x0001,
+- IWNES_MEMREG_TYPE_CQ = 0x0002,
+- IWNES_MEMREG_TYPE_MW = 0x0003,
+- IWNES_MEMREG_TYPE_FMR = 0x0004,
+- IWNES_MEMREG_TYPE_FMEM = 0x0005,
+-};
+-
+-struct nes_mem_reg_req {
+- __u32 reg_type; /* indicates if id is memory, QP or CQ */
+- __u32 reserved;
+-};
+-
+-struct nes_create_cq_resp {
+- __u32 cq_id;
+- __u32 cq_size;
+- __u32 mmap_db_index;
+- __u32 reserved;
+-};
+-
+-struct nes_create_qp_resp {
+- __u32 qp_id;
+- __u32 actual_sq_size;
+- __u32 actual_rq_size;
+- __u32 mmap_sq_db_index;
+- __u32 mmap_rq_db_index;
+- __u32 nes_drv_opt;
+-};
+-
+-#endif /* NES_ABI_USER_H */
--- /dev/null
+From 050dbddf249eee3e936b5734c30b2e1b427efdc3 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 30 Sep 2019 16:16:56 -0700
+Subject: RDMA/siw: Fix port number endianness in a debug message
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 050dbddf249eee3e936b5734c30b2e1b427efdc3 upstream.
+
+sin_port and sin6_port are big endian member variables. Convert these port
+numbers into CPU endianness before printing.
+
+Link: https://lore.kernel.org/r/20190930231707.48259-5-bvanassche@acm.org
+Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/sw/siw/siw_cm.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/infiniband/sw/siw/siw_cm.c
++++ b/drivers/infiniband/sw/siw/siw_cm.c
+@@ -1867,14 +1867,7 @@ static int siw_listen_address(struct iw_
+ list_add_tail(&cep->listenq, (struct list_head *)id->provider_data);
+ cep->state = SIW_EPSTATE_LISTENING;
+
+- if (addr_family == AF_INET)
+- siw_dbg(id->device, "Listen at laddr %pI4 %u\n",
+- &(((struct sockaddr_in *)laddr)->sin_addr),
+- ((struct sockaddr_in *)laddr)->sin_port);
+- else
+- siw_dbg(id->device, "Listen at laddr %pI6 %u\n",
+- &(((struct sockaddr_in6 *)laddr)->sin6_addr),
+- ((struct sockaddr_in6 *)laddr)->sin6_port);
++ siw_dbg(id->device, "Listen at laddr %pISp\n", laddr);
+
+ return 0;
+
--- /dev/null
+From e88982ad1bb12db699de96fbc07096359ef6176c Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Tue, 5 Nov 2019 13:46:32 -0800
+Subject: RDMA/srpt: Report the SCSI residual to the initiator
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit e88982ad1bb12db699de96fbc07096359ef6176c upstream.
+
+The code added by this patch is similar to the code that already exists in
+ibmvscsis_determine_resid(). This patch has been tested by running the
+following command:
+
+strace sg_raw -r 1k /dev/sdb 12 00 00 00 60 00 -o inquiry.bin |&
+ grep resid=
+
+Link: https://lore.kernel.org/r/20191105214632.183302-1-bvanassche@acm.org
+Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Honggang Li <honli@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/srpt/ib_srpt.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -1364,9 +1364,11 @@ static int srpt_build_cmd_rsp(struct srp
+ struct srpt_send_ioctx *ioctx, u64 tag,
+ int status)
+ {
++ struct se_cmd *cmd = &ioctx->cmd;
+ struct srp_rsp *srp_rsp;
+ const u8 *sense_data;
+ int sense_data_len, max_sense_len;
++ u32 resid = cmd->residual_count;
+
+ /*
+ * The lowest bit of all SAM-3 status codes is zero (see also
+@@ -1388,6 +1390,28 @@ static int srpt_build_cmd_rsp(struct srp
+ srp_rsp->tag = tag;
+ srp_rsp->status = status;
+
++ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) {
++ if (cmd->data_direction == DMA_TO_DEVICE) {
++ /* residual data from an underflow write */
++ srp_rsp->flags = SRP_RSP_FLAG_DOUNDER;
++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
++ } else if (cmd->data_direction == DMA_FROM_DEVICE) {
++ /* residual data from an underflow read */
++ srp_rsp->flags = SRP_RSP_FLAG_DIUNDER;
++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
++ }
++ } else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) {
++ if (cmd->data_direction == DMA_TO_DEVICE) {
++ /* residual data from an overflow write */
++ srp_rsp->flags = SRP_RSP_FLAG_DOOVER;
++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid);
++ } else if (cmd->data_direction == DMA_FROM_DEVICE) {
++ /* residual data from an overflow read */
++ srp_rsp->flags = SRP_RSP_FLAG_DIOVER;
++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid);
++ }
++ }
++
+ if (sense_data_len) {
+ BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp));
+ max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp);
asoc-sof-intel-broadwell-clarify-mutual-exclusion-with-legacy-driver.patch
asoc-core-fix-compile-warning-with-config_debug_fs-n.patch
asoc-rsnd-fix-dalign-register-for-ssiu.patch
+rdma-hns-prevent-undefined-behavior-in-hns_roce_set_user_sq_size.patch
+rdma-hns-remove-a-redundant-le16_to_cpu.patch
+rdma-hns-modify-return-value-of-restrack-functions.patch
+rdma-counter-prevent-qp-counter-manual-binding-in-auto-mode.patch
+rdma-siw-fix-port-number-endianness-in-a-debug-message.patch
+rdma-hns-fix-build-error-again.patch
+rdma-hns-release-qp-resources-when-failed-to-destroy-qp.patch
+xprtrdma-add-unique-trace-points-for-posting-local-invalidate-wrs.patch
+xprtrdma-connection-becomes-unstable-after-a-reconnect.patch
+xprtrdma-fix-mr-list-handling.patch
+xprtrdma-close-window-between-waking-rpc-senders-and-posting-receives.patch
+rdma-hns-fix-to-support-64k-page-for-srq.patch
+rdma-hns-bugfix-for-qpc-cqc-timer-configuration.patch
+rdma-remove-nes-abi-header.patch
+rdma-mlx5-return-proper-error-value.patch
+rdma-srpt-report-the-scsi-residual-to-the-initiator.patch
+bpf-make-use-of-probe_user_write-in-probe-write-helper.patch
+bpf-skmsg-fix-potential-psock-null-pointer-dereference.patch
+bpf-support-pre-2.25-binutils-objcopy-for-vmlinux-btf.patch
+libbpf-fix-makefile-libbpf-symbol-mismatch-diagnostic.patch
--- /dev/null
+From 4b93dab36f28e673725e5e6123ebfccf7697f96a Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 9 Oct 2019 13:07:21 -0400
+Subject: xprtrdma: Add unique trace points for posting Local Invalidate WRs
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 4b93dab36f28e673725e5e6123ebfccf7697f96a upstream.
+
+When adding frwr_unmap_async way back when, I re-used the existing
+trace_xprtrdma_post_send() trace point to record the return code
+of ib_post_send.
+
+Unfortunately there are some cases where re-using that trace point
+causes a crash. Instead, construct a trace point specific to posting
+Local Invalidate WRs that will always be safe to use in that context,
+and will act as a trace log eye-catcher for Local Invalidation.
+
+Fixes: 847568942f93 ("xprtrdma: Remove fr_state")
+Fixes: d8099feda483 ("xprtrdma: Reduce context switching due ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Bill Baker <bill.baker@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/trace/events/rpcrdma.h | 25 +++++++++++++++++++++++++
+ net/sunrpc/xprtrdma/frwr_ops.c | 4 ++--
+ 2 files changed, 27 insertions(+), 2 deletions(-)
+
+--- a/include/trace/events/rpcrdma.h
++++ b/include/trace/events/rpcrdma.h
+@@ -735,6 +735,31 @@ TRACE_EVENT(xprtrdma_post_recvs,
+ )
+ );
+
++TRACE_EVENT(xprtrdma_post_linv,
++ TP_PROTO(
++ const struct rpcrdma_req *req,
++ int status
++ ),
++
++ TP_ARGS(req, status),
++
++ TP_STRUCT__entry(
++ __field(const void *, req)
++ __field(int, status)
++ __field(u32, xid)
++ ),
++
++ TP_fast_assign(
++ __entry->req = req;
++ __entry->status = status;
++ __entry->xid = be32_to_cpu(req->rl_slot.rq_xid);
++ ),
++
++ TP_printk("req=%p xid=0x%08x status=%d",
++ __entry->req, __entry->xid, __entry->status
++ )
++);
++
+ /**
+ ** Completion events
+ **/
+--- a/net/sunrpc/xprtrdma/frwr_ops.c
++++ b/net/sunrpc/xprtrdma/frwr_ops.c
+@@ -570,7 +570,6 @@ void frwr_unmap_sync(struct rpcrdma_xprt
+ */
+ bad_wr = NULL;
+ rc = ib_post_send(r_xprt->rx_ia.ri_id->qp, first, &bad_wr);
+- trace_xprtrdma_post_send(req, rc);
+
+ /* The final LOCAL_INV WR in the chain is supposed to
+ * do the wake. If it was never posted, the wake will
+@@ -583,6 +582,7 @@ void frwr_unmap_sync(struct rpcrdma_xprt
+
+ /* Recycle MRs in the LOCAL_INV chain that did not get posted.
+ */
++ trace_xprtrdma_post_linv(req, rc);
+ while (bad_wr) {
+ frwr = container_of(bad_wr, struct rpcrdma_frwr,
+ fr_invwr);
+@@ -673,12 +673,12 @@ void frwr_unmap_async(struct rpcrdma_xpr
+ */
+ bad_wr = NULL;
+ rc = ib_post_send(r_xprt->rx_ia.ri_id->qp, first, &bad_wr);
+- trace_xprtrdma_post_send(req, rc);
+ if (!rc)
+ return;
+
+ /* Recycle MRs in the LOCAL_INV chain that did not get posted.
+ */
++ trace_xprtrdma_post_linv(req, rc);
+ while (bad_wr) {
+ frwr = container_of(bad_wr, struct rpcrdma_frwr, fr_invwr);
+ mr = container_of(frwr, struct rpcrdma_mr, frwr);
--- /dev/null
+From 2ae50ad68cd79224198b525f7bd645c9da98b6ff Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 9 Oct 2019 13:07:38 -0400
+Subject: xprtrdma: Close window between waking RPC senders and posting Receives
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 2ae50ad68cd79224198b525f7bd645c9da98b6ff upstream.
+
+A recent clean up attempted to separate Receive handling and RPC
+Reply processing, in the name of clean layering.
+
+Unfortunately, we can't do this because the Receive Queue has to be
+refilled _after_ the most recent credit update from the responder
+is parsed from the transport header, but _before_ we wake up the
+next RPC sender. That is right in the middle of
+rpcrdma_reply_handler().
+
+Usually this isn't a problem because current responder
+implementations don't vary their credit grant. The one exception is
+when a connection is established: the grant goes from one to a much
+larger number on the first Receive. The requester MUST post enough
+Receives right then so that any outstanding requests can be sent
+without risking RNR and connection loss.
+
+Fixes: 6ceea36890a0 ("xprtrdma: Refactor Receive accounting")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/rpc_rdma.c | 1 +
+ net/sunrpc/xprtrdma/verbs.c | 11 +++++++----
+ net/sunrpc/xprtrdma/xprt_rdma.h | 1 +
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -1362,6 +1362,7 @@ void rpcrdma_reply_handler(struct rpcrdm
+ xprt->cwnd = credits << RPC_CWNDSHIFT;
+ spin_unlock(&xprt->transport_lock);
+ }
++ rpcrdma_post_recvs(r_xprt, false);
+
+ req = rpcr_to_rdmar(rqst);
+ if (req->rl_reply) {
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -84,7 +84,6 @@ rpcrdma_regbuf_alloc(size_t size, enum d
+ gfp_t flags);
+ static void rpcrdma_regbuf_dma_unmap(struct rpcrdma_regbuf *rb);
+ static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb);
+-static void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
+
+ /* Wait for outstanding transport work to finish. ib_drain_qp
+ * handles the drains in the wrong order for us, so open code
+@@ -170,7 +169,6 @@ rpcrdma_wc_receive(struct ib_cq *cq, str
+ rdmab_addr(rep->rr_rdmabuf),
+ wc->byte_len, DMA_FROM_DEVICE);
+
+- rpcrdma_post_recvs(r_xprt, false);
+ rpcrdma_reply_handler(rep);
+ return;
+
+@@ -1478,8 +1476,13 @@ rpcrdma_ep_post(struct rpcrdma_ia *ia,
+ return 0;
+ }
+
+-static void
+-rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
++/**
++ * rpcrdma_post_recvs - Refill the Receive Queue
++ * @r_xprt: controlling transport instance
++ * @temp: mark Receive buffers to be deleted after use
++ *
++ */
++void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp)
+ {
+ struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+ struct rpcrdma_ep *ep = &r_xprt->rx_ep;
+--- a/net/sunrpc/xprtrdma/xprt_rdma.h
++++ b/net/sunrpc/xprtrdma/xprt_rdma.h
+@@ -474,6 +474,7 @@ void rpcrdma_ep_disconnect(struct rpcrdm
+
+ int rpcrdma_ep_post(struct rpcrdma_ia *, struct rpcrdma_ep *,
+ struct rpcrdma_req *);
++void rpcrdma_post_recvs(struct rpcrdma_xprt *r_xprt, bool temp);
+
+ /*
+ * Buffer calls - xprtrdma/verbs.c
--- /dev/null
+From a31b2f939219dd9bffdf01a45bd91f209f8cc369 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 9 Oct 2019 13:07:27 -0400
+Subject: xprtrdma: Connection becomes unstable after a reconnect
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit a31b2f939219dd9bffdf01a45bd91f209f8cc369 upstream.
+
+This is because xprt_request_get_cong() is allowing more than one
+RPC Call to be transmitted before the first Receive on the new
+connection. The first Receive fills the Receive Queue based on the
+server's credit grant. Before that Receive, there is only a single
+Receive WR posted because the client doesn't know the server's
+credit grant.
+
+Solution is to clear rq_cong on all outstanding rpc_rqsts when the
+the cwnd is reset. This is because an RPC/RDMA credit is good for
+one connection instance only.
+
+Fixes: 75891f502f5f ("SUNRPC: Support for congestion control ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/transport.c | 3 +++
+ net/sunrpc/xprtrdma/verbs.c | 22 ++++++++++++++++++++++
+ 2 files changed, 25 insertions(+)
+
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -428,8 +428,11 @@ void xprt_rdma_close(struct rpc_xprt *xp
+ /* Prepare @xprt for the next connection by reinitializing
+ * its credit grant to one (see RFC 8166, Section 3.3.3).
+ */
++ spin_lock(&xprt->transport_lock);
+ r_xprt->rx_buf.rb_credits = 1;
++ xprt->cong = 0;
+ xprt->cwnd = RPC_CWNDSHIFT;
++ spin_unlock(&xprt->transport_lock);
+
+ out:
+ xprt->reestablish_timeout = 0;
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -75,6 +75,7 @@
+ * internal functions
+ */
+ static void rpcrdma_sendctx_put_locked(struct rpcrdma_sendctx *sc);
++static void rpcrdma_reqs_reset(struct rpcrdma_xprt *r_xprt);
+ static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf);
+ static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt);
+ static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf);
+@@ -780,6 +781,7 @@ rpcrdma_ep_disconnect(struct rpcrdma_ep
+ trace_xprtrdma_disconnect(r_xprt, rc);
+
+ rpcrdma_xprt_drain(r_xprt);
++ rpcrdma_reqs_reset(r_xprt);
+ }
+
+ /* Fixed-size circular FIFO queue. This implementation is wait-free and
+@@ -1042,6 +1044,26 @@ out1:
+ return NULL;
+ }
+
++/**
++ * rpcrdma_reqs_reset - Reset all reqs owned by a transport
++ * @r_xprt: controlling transport instance
++ *
++ * ASSUMPTION: the rb_allreqs list is stable for the duration,
++ * and thus can be walked without holding rb_lock. Eg. the
++ * caller is holding the transport send lock to exclude
++ * device removal or disconnection.
++ */
++static void rpcrdma_reqs_reset(struct rpcrdma_xprt *r_xprt)
++{
++ struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
++ struct rpcrdma_req *req;
++
++ list_for_each_entry(req, &buf->rb_allreqs, rl_all) {
++ /* Credits are valid only for one connection */
++ req->rl_slot.rq_cong = 0;
++ }
++}
++
+ static struct rpcrdma_rep *rpcrdma_rep_create(struct rpcrdma_xprt *r_xprt,
+ bool temp)
+ {
--- /dev/null
+From c3700780a096fc66467c81076ddf7f3f11d639b5 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 9 Oct 2019 13:07:43 -0400
+Subject: xprtrdma: Fix MR list handling
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit c3700780a096fc66467c81076ddf7f3f11d639b5 upstream.
+
+Close some holes introduced by commit 6dc6ec9e04c4 ("xprtrdma: Cache
+free MRs in each rpcrdma_req") that could result in list corruption.
+
+In addition, the result that is tabulated in @count is no longer
+used, so @count is removed.
+
+Fixes: 6dc6ec9e04c4 ("xprtrdma: Cache free MRs in each rpcrdma_req")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/verbs.c | 41 +++++++++++++++++++++--------------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -79,7 +79,6 @@ static void rpcrdma_reqs_reset(struct rp
+ static void rpcrdma_reps_destroy(struct rpcrdma_buffer *buf);
+ static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt);
+ static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf);
+-static void rpcrdma_mr_free(struct rpcrdma_mr *mr);
+ static struct rpcrdma_regbuf *
+ rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction,
+ gfp_t flags);
+@@ -967,7 +966,7 @@ rpcrdma_mrs_create(struct rpcrdma_xprt *
+ mr->mr_xprt = r_xprt;
+
+ spin_lock(&buf->rb_lock);
+- list_add(&mr->mr_list, &buf->rb_mrs);
++ rpcrdma_mr_push(mr, &buf->rb_mrs);
+ list_add(&mr->mr_all, &buf->rb_all_mrs);
+ spin_unlock(&buf->rb_lock);
+ }
+@@ -1185,10 +1184,19 @@ out:
+ */
+ void rpcrdma_req_destroy(struct rpcrdma_req *req)
+ {
++ struct rpcrdma_mr *mr;
++
+ list_del(&req->rl_all);
+
+- while (!list_empty(&req->rl_free_mrs))
+- rpcrdma_mr_free(rpcrdma_mr_pop(&req->rl_free_mrs));
++ while ((mr = rpcrdma_mr_pop(&req->rl_free_mrs))) {
++ struct rpcrdma_buffer *buf = &mr->mr_xprt->rx_buf;
++
++ spin_lock(&buf->rb_lock);
++ list_del(&mr->mr_all);
++ spin_unlock(&buf->rb_lock);
++
++ frwr_release_mr(mr);
++ }
+
+ rpcrdma_regbuf_free(req->rl_recvbuf);
+ rpcrdma_regbuf_free(req->rl_sendbuf);
+@@ -1196,24 +1204,28 @@ void rpcrdma_req_destroy(struct rpcrdma_
+ kfree(req);
+ }
+
+-static void
+-rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf)
++/**
++ * rpcrdma_mrs_destroy - Release all of a transport's MRs
++ * @buf: controlling buffer instance
++ *
++ * Relies on caller holding the transport send lock to protect
++ * removing mr->mr_list from req->rl_free_mrs safely.
++ */
++static void rpcrdma_mrs_destroy(struct rpcrdma_buffer *buf)
+ {
+ struct rpcrdma_xprt *r_xprt = container_of(buf, struct rpcrdma_xprt,
+ rx_buf);
+ struct rpcrdma_mr *mr;
+- unsigned int count;
+
+- count = 0;
+ spin_lock(&buf->rb_lock);
+ while ((mr = list_first_entry_or_null(&buf->rb_all_mrs,
+ struct rpcrdma_mr,
+ mr_all)) != NULL) {
++ list_del(&mr->mr_list);
+ list_del(&mr->mr_all);
+ spin_unlock(&buf->rb_lock);
+
+ frwr_release_mr(mr);
+- count++;
+ spin_lock(&buf->rb_lock);
+ }
+ spin_unlock(&buf->rb_lock);
+@@ -1286,17 +1298,6 @@ void rpcrdma_mr_put(struct rpcrdma_mr *m
+ rpcrdma_mr_push(mr, &mr->mr_req->rl_free_mrs);
+ }
+
+-static void rpcrdma_mr_free(struct rpcrdma_mr *mr)
+-{
+- struct rpcrdma_xprt *r_xprt = mr->mr_xprt;
+- struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
+-
+- mr->mr_req = NULL;
+- spin_lock(&buf->rb_lock);
+- rpcrdma_mr_push(mr, &buf->rb_mrs);
+- spin_unlock(&buf->rb_lock);
+-}
+-
+ /**
+ * rpcrdma_buffer_get - Get a request buffer
+ * @buffers: Buffer pool from which to obtain a buffer
projects / thirdparty / kernel / stable-queue.git / commitdiff
